Difference between revisions of "Sony PRS-T1"

From InkBox
Jump to navigation Jump to search
 
(30 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Hardware
[[Category:Porting]]
==Stock Information==
[[File:Sony-PRS-T1.jpg|thumb|alt=Stock Sony PRS-T1|Stock Sony PRS-T1]]
[[File:Sony-PRS-T1 Bottom.png|thumb|alt=Sony-PRS-T1 Bottom|Sony-PRS-T1 Bottom]]
[[File:Sony-PRS-T1 Back.jpg|thumb|alt=Sony-PRS-T1 Back|Sony-PRS-T1 Back]]
Sony Reader Wi-Fi (PRS-T1)


<pre>
Made by: Sony
Released: October 2011
Predecessor: None
Languages Supported: English
File Types Supported: PDF, TXT, ePUB, MP3, AAC, JPG, GIF, PNG, BMP
</pre>


===Overview===
The PRS-T1 also known as "Reader Wi-Fi" is the world's lightest 6" e-Reader with a glare-free, paper-like display designed for hours of comfortable reading, even in direct sunlight. Use your fingertips to select a title, turn the page or zoom in and out. Wirelessly shop books, magazines and newspapers at Reader™ Store and get instantaneous access to websites like Wikipedia® and Google™ search.
Features direct access to public libraries in several countries. Uses E-Ink® Pearl V220 glare-free screen. Includes 12 Built-in Dictionaries with 2 English and 10 others with to and from French, German, Spanish, Dutch and Italian. Reader allows you to write on the page or highlight text as you would in a real book using your finger or a supplied stylus for Note taking.
The USB port supports mounting as a USB Mass Storage Device, and allows for syncing to Sony Reader for PC and Sony Reader for Mac. Installers for these are included.
===Specifications===
<pre>
Color: White, black or red.
Size: 173 x 110 x 8.9mm (6 7/8 x 4 3/8 x 3/8 inches).
Weight: 168g (5.9oz).
Display: 6" E-Ink Pearl™ with Clear Touch Infrared Technology 16 level grayscale.
    Resolution: 600 x 800 pixels 167ppi.
Operating Temperature: 5°C to 35°C (41°F to 95°F).
Memory Size: Internal: 2 GB Approx. 1.3 GB after initial setting.
    External: Micro SD card up to 32GB.
DRM Support: Adobe on ePub and PDF. ePub support is OPS 2.0, PDF is version 1.6.
MP3 Support: No DRM.
    Bit Rate: 8 to 320 kbps.
    Sampling Frequency: 8 to 48 kHz.
AAC Support: .mp4, .m4a (not raw AAC) no DRM.
Power: Built-in rechargeable battery: 3.7 V DC 1000mAh.
    Battery Life (Approx) : A single charge lasts over one month with wireless off based upon a half-hour of daily reading time.; Read on a single battery charge for 3-4 weeks with wireless on.; Up to 14,000 continuous page turns when reading only. Recharging Time: Fully charges in approximately 2 hours via the approved U.S. power adapter. Approx. 2.5 hours supports charging from your computer via the included USB 2.0 cable.
Wireless/Networking:
    Wi-Fi: Atheros AR6003 IEEE 802.11b/g/n (not 5GHz).
    Wireless Security: WEP (Open System), WEP (Shared Key), WPA-PSK (TKIP), WPA-PSK (AES), WPA2-PSK (TKIP), WPA2-PSK (AES).
</pre>
===Details===
<pre>
Micro USB port
In the Box
    Quick Start Guide, Warranty, Audio tips
    Important Product Information
    USB 2.0 (micro to standard) Cable
    Stylus Pen
</pre>
===Unofficial Details===
<pre>
Android 2.2.1-based
256MB RAM
800MHz Freescale ARMv7 CPU
Freescale MX50 board
</pre>
===Applications Included===
<pre>
eBook Reader - Supports dictionary lookup, notes, bookmarks, highlighting.
Music Player
Photo Viewer
Web Browser
Text Memo Maker
Handwriting Program - Supports freehand drawing.
eBook, periodical purchasing - Sony Reader store, provides access to Public Domain Google
    books as well.
Overdrive App - Browse and checkout Public Library books in the USA, UK.
</pre>
===Firmware Updates===
Sony has released several firmware updates for the T1, which are all installed using the provided Sony Reader for PC/Sony Reader for Mac desktop software.
<pre>
1.0.00.09010 - Installed on some shipping models.
1.0.00.09270 - Installed on some shipping models.
1.0.02.10280 - Released on 17 November 2011, installed on some shipping models.
1.0.03.11140 - Released on 9 December 2011.
1.0.04.12210 - Released on 27 January 2012.
1.0.05.11130 - Released on 26 November 2012.
1.0.06.03210 - Released on 27 March 2014.
1.0.07.05070 - Released on 19 June 2014.
</pre>
==Hardware==
<pre>
PCB PRS-T1/G1 M5047 1-884-610-12 BW1118073202953 Cast 2012/05/05A
PCB PRS-T1/G1 M5047 1-884-610-12 BW1118073202953 Cast 2012/05/05A
https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals
https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals
Line 15: Line 105:


F0513A Renesas MCU 8-bit 78K0 SISC 32KB Flash 5V 44-Pin LQFP (SDCard Controller?)
F0513A Renesas MCU 8-bit 78K0 SISC 32KB Flash 5V 44-Pin LQFP (SDCard Controller?)
https://www.renesas.com/us/en/document/mah/78k0kx2-users-manual-hardware-r01uh0008ej040178k0kx2
WM8321G Wolfson Processor Power Management Subsystem (PMIC)
WM8321G Wolfson Processor Power Management Subsystem (PMIC)
https://pdf1.alldatasheet.com/325b8904-4044-407c-9988-42ce4c2dfbf4
CS42L52-CNZ Cirrus Logic Low-power, Stereo CODEC w/ Headphone & Speaker Amps
CS42L52-CNZ Cirrus Logic Low-power, Stereo CODEC w/ Headphone & Speaker Amps
3611 WC120 Atheros 6k (6002?)
https://statics.cirrus.com/pubs/proDatasheet/CS42L52_F2.pdf
 
3611 WC120 Atheros 6k (6003)
https://cdn.datasheetspdf.com/pdf-down/A/R/6/AR6003-Atheros.pdf
https://developer.ridgerun.com/wiki/index.php/Atheros_AR6003_SDIO_WiFi_Integration
 
TPS65180 Texas Instruments PMIC for E Ink® Vizplex™-Enabled Electronic Paper Display
TPS65180 Texas Instruments PMIC for E Ink® Vizplex™-Enabled Electronic Paper Display
https://www.ti.com/lit/ds/symlink/tps65181.pdf?ts=1653836738327


6 inch E-ink LCD (PRS-T1/NOOK Simple) ED060SCE (LF)C1 RET60C4026(C118) E4K0C6B82M4VS5374AY -2.46
6 inch E-ink LCD (PRS-T1/NOOK Simple) ED060SCE (LF)C1 RET60C4026(C118) E4K0C6B82M4VS5374AY -2.46
 
https://essentialscrap.com/eink/ED060SC4V2.pdf


PVI6inchC118C
PVI6inchC118C
Line 29: Line 129:
The parent company used to make toilet paper, and still does I believe. If you google the parent name "Yuen Fong Yu Group" you can see their website in English and Chinese.   
The parent company used to make toilet paper, and still does I believe. If you google the parent name "Yuen Fong Yu Group" you can see their website in English and Chinese.   


VM15AB LMV65 National Semiconductor  LMV65x 12-MHz, Low Voltage (5V?), Low Power Amplifiers
https://www.ti.com/lit/ds/symlink/lmv651.pdf?ts=1653838936815


VM15AB LMV65 National Semiconductor  LMV65x 12-MHz, Low Voltage (5V?), Low Power Amplifiers
2 x HC4067B 16-channel analog multiplexer/demultiplexer
2 x HC4067B 16-channel analog multiplexer/demultiplexer
https://www.ti.com/lit/ds/symlink/cd74hc4067.pdf?ts=1653837700828
LIS1476MHPPC(SY6) 1-853-104-11 Sony 01 W US304362 3.7V 3.6Wh 1500mA Max Charge 4.30V
LIS1476MHPPC(SY6) 1-853-104-11 Sony 01 W US304362 3.7V 3.6Wh 1500mA Max Charge 4.30V
https://www.aliexpress.c o m/item/2251832682904150.html
</pre>


Install Debian 11 Build Environment
==Install Debian 11 Build Environment==


su - to load env (binary folders etc)
su - to load env (binary folders etc)
su -
<code>su -</code>


Give sudo to your user
Give sudo to the user
usermod -a -G sudo username
<code>usermod -a -G sudo username</code>


Reload your terminal permissions by su username
Reload your terminal permissions by su username
su username
<code>su username</code>
 
Install building items


===Install building items===
<pre>
sudo apt install git linux-headers-$(uname -r) build-essential ncurses-dev docker curl debootstrap qemu qemu-utils qemu-user-static binfmt-support imagemagick vim u-boot-tools lzop
sudo apt install git linux-headers-$(uname -r) build-essential ncurses-dev docker curl debootstrap qemu qemu-utils qemu-user-static binfmt-support imagemagick vim u-boot-tools lzop


sudo modprobe binfmt_misc
sudo modprobe binfmt_misc
</pre>
===Enable i386 package installation support===


Enable i386 package installation support
<pre>
sudo dpkg --add-architecture i386
sudo dpkg --add-architecture i386
sudo apt-get update
sudo apt-get update
Line 57: Line 165:
sudo apt-get install gcc-multilib
sudo apt-get install gcc-multilib
sudo apt-get install zlib1g:i386  
sudo apt-get install zlib1g:i386  
</pre>


Discord
===Discord===
 
<pre>
sudo apt install snapd
sudo apt install snapd
sudo snap install core
sudo snap install core
Line 64: Line 175:
Join InkBox Discord
Join InkBox Discord
https://discord.gg/KyK4dQyuSe
https://discord.gg/KyK4dQyuSe
</pre>


Sony Source Code For Readers
===Sony Source Code For Readers===


https://oss.sony.net/Products/Linux/Audio/category03.html
https://oss.sony.net/Products/Linux/Audio/category03.html


PRS-T1 Source Code
====PRS-T1 Source Code====


https://oss.sony.net/Products/Linux/Audio/PRS-T1JP_20140702.html
https://oss.sony.net/Products/Linux/Audio/PRS-T1JP_20140702.html
==Start==


Open Terminal
Open Terminal
Line 77: Line 191:
Make a directory under users home directory to do all the compilation.
Make a directory under users home directory to do all the compilation.


mkdir ~/code
<code>mkdir ~/code</code>


SDCard Prep
===SDCard Prep===


Thanks to [http://essentialscrap.com Petteri] whom originally created this SDCard boot package.
<pre>
cd ~/code
cd ~/code
wget https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
wget https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
Line 86: Line 203:
sudo dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress
sudo dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress


GCC for Cross Compiling
Backup link: https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin
 
</pre>
 
===GCC for Cross Compiling===


<pre>
cd ~/code
cd ~/code


Line 98: Line 220:
export PATH="${PATH}:${PWD}"
export PATH="${PATH}:${PWD}"
sudo chmod -R 755 /opt
sudo chmod -R 755 /opt
</pre>


BusyBox Compiling
=== BusyBox Compiling ===


<pre>
cd ~/code
cd ~/code


Line 108: Line 232:


cd busybox
cd busybox
</pre>


Add stripped down .config to busybox directory from NiMa/TuxLinux
Add stripped down .config to busybox directory from NiMa/TuxLinux


Save this as below as .config in the root of the busybox directory.
Save this below as .config in the root of the busybox directory.


{{#spoiler:<pre>
#
#
# Automatically generated make config: don't edit
# Automatically generated make config: don't edit
# Busybox version: 1.34.1
# Busybox version: 1.32.1
# Sat Apr 30 00:13:37 2022
# Sat Apr 30 00:13:37 2022
#
#
Line 1,311: Line 1,437:
CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=0
CONFIG_FEATURE_IPC_SYSLOG_BUFFER_SIZE=0
# CONFIG_FEATURE_KMSG_SYSLOG is not set
# CONFIG_FEATURE_KMSG_SYSLOG is not set
</pre>}}
<pre>make menuconfig
</pre>


'''Note:''' ''This is already set in the .config above but run menuconfig anyways and exit save so you don’t get all these y/n questions depending on the busybox version you are using. It will fix these for you doing that.''


make menuconfig
Under Settings enable with an asterisk (spacebar):<pre>
 
Note: This is already set in the .config above but run menuconfig anyways and exit save so you don’t get all these y/n questions depending on the busybox version you are using. It will fix these for you doing that.
 
Under Settings enable with an asterisk (spacebar):
[*] Build static binary (no shared libs) (NEW)
[*] Build static binary (no shared libs) (NEW)
 
</pre>
Fix Sync Error
==== Fix Sync Error ====
 
<pre>
sync.c:(.text.sync_main+0x5c): undefined reference to syncfs
sync.c:(.text.sync_main+0x5c): undefined reference to syncfs
 
</pre><pre>
man syncfs
man syncfs


Line 1,329: Line 1,455:
   syncfs()  first  appeared  in Linux 2.6.39; library support was added to glibc in version
   syncfs()  first  appeared  in Linux 2.6.39; library support was added to glibc in version
   2.14.
   2.14.
</pre>


config FEATURE_SYNC_FANCY [=n] (Don’t disable actual sync just the fancy option under it)
config FEATURE_SYNC_FANCY [=n] (Don’t disable actual sync just the fancy option under it)
Under Coreutils => Sync => Remove the asterisk (Spacebar) =>  
 
Under Coreutils =&gt; Sync =&gt; Remove the asterisk (Spacebar) =&gt;<pre>
[ ]  Enable -d and -f flags (requires syncfs(2) in libc)
[ ]  Enable -d and -f flags (requires syncfs(2) in libc)
</pre>


Exit Exit Save Yes
Exit Exit Save Yes




==== Fix DADFAILED Error ====


Fix DADFAILED Error
'''Note:''' ''Fixed in newer versions but if not.''
 
 
Note: Fixed in newer versions but if not.


<pre>
networking/libiproute/ipaddress.c:345: error: 'IFA_F_DADFAILED' undeclared (first use in this function)
networking/libiproute/ipaddress.c:345: error: 'IFA_F_DADFAILED' undeclared (first use in this function)
 
</pre><pre>
vi ~/code/busybox/networking/libiproute/ipaddress.c  
vi ~/code/busybox/networking/libiproute/ipaddress.c  
</pre>


Find DADFAILED around line 345
Find DADFAILED around line 345


<pre>
if (ifa_flags & IFA_F_DADFAILED) {
if (ifa_flags & IFA_F_DADFAILED) {
   ifa_flags &= ~IFA_F_DADFAILED;
   ifa_flags &= ~IFA_F_DADFAILED;
   printf("dadfailed ");
   printf("dadfailed ");
}
}
</pre>


Change to:
Change to:<pre>
 
#ifdef IFA_F_DADFAILED
#ifdef IFA_F_DADFAILED
if (ifa_flags & IFA_F_DADFAILED) {
if (ifa_flags & IFA_F_DADFAILED) {
Line 1,362: Line 1,493:
}
}
#endif
#endif
</pre>


:wq
===Make Busybox Install===


<pre>
make V=1 ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) install
make V=1 ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) install
</pre>


If you see this last message at the end then hopefully everything went fine.
<pre>
chmod a+x busybox
chmod a+x busybox
DO_INSTALL_LIBS="" \
DO_INSTALL_LIBS="" \
Line 1,470: Line 1,607:
work properly.
work properly.
--------------------------------------------------
--------------------------------------------------
 
</pre>
If you see this last message then hopefully everything went fine.


If busybox needs to be smaller to fit in the same DD space the prior kernel used (2.2MB) use the UPX tool.
If busybox needs to be smaller to fit in the same DD space the prior kernel used (2.2MB) use the UPX tool.


<pre>
upx --ultra-brute _install/bin/busybox
upx --ultra-brute _install/bin/busybox
</pre>
<pre>
                   Ultimate Packer for eXecutables
                   Ultimate Packer for eXecutables
                       Copyright (C) 1996 - 2020
                       Copyright (C) 1996 - 2020
Line 1,485: Line 1,624:


Packed 1 file.
Packed 1 file.
 
</pre>
<pre>
cd ~/code/busybox/_install
cd ~/code/busybox/_install
mkdir -p etc/init.d/
mkdir -p etc/init.d/
</pre>
<pre>
vi etc/init.d/rcS
vi etc/init.d/rcS
 
</pre>
<pre>
#!/bin/sh
#!/bin/sh


Line 1,498: Line 1,641:


/bin/sh
/bin/sh
</pre>


 
<pre>
chmod +x ~/code/busybox/_install/etc/init.d/rcS
chmod +x ~/code/busybox/_install/etc/init.d/rcS
</pre>


Boot the Stock SDCard Image then grab platform-tools and connect to ADB Shell
Boot the Stock SDCard Image then grab platform-tools and connect to ADB Shell
Line 1,510: Line 1,655:
adb shell  
adb shell  


At the prompt # check out the permissions of /dev/ttymxc4


At the prompt check out the permissions of /dev/ttymxc4
<pre>
 
ls -l /dev/ttymxc4
# ls -l /dev/ttymxc4
crw------- root root 207,  20 2010-01-01 02:00 ttymxc4
crw------- root root 207,  20 2010-01-01 02:00 ttymxc4
</pre>


Copy the 207 20 to the ttymxc4 mknod value below.
Copy the 207 20 to the ttymxc4 mknod value below.


Note: Do not put / in front of your dev folders on the following mknod commands or you will create them in your systems dev folder instead of the busybox/_install/dev/ folder.
'''Note:''' ''Do not put / in front of your dev folders on the following mknod commands or you will create them in your systems dev folder instead of the busybox/_install/dev/ folder.''


<pre>
cd ~/code/busybox/_install
cd ~/code/busybox/_install
mkdir dev
mkdir dev
Line 1,525: Line 1,672:
sudo mknod dev/null c 1 3
sudo mknod dev/null c 1 3
sudo mknod dev/ttymxc4 c 207 20
sudo mknod dev/ttymxc4 c 207 20
</pre>


Kernel Compile
===Kernel Compile===


<pre>
cd ~/code
cd ~/code


Line 1,537: Line 1,686:


vi ~/code/linux-2.6.35.2/.config
vi ~/code/linux-2.6.35.2/.config
</pre>


Paste the kernel config below.
{{#spoiler:<pre>
#
#
# Automatically generated make config: don't edit
# Automatically generated make config: don't edit
Line 3,665: Line 3,817:
CONFIG_EPD_STATIC_MEM_WAVEFORM=y
CONFIG_EPD_STATIC_MEM_WAVEFORM=y
CONFIG_EPD_STATIC_MEM_WORKBUFF=y
CONFIG_EPD_STATIC_MEM_WORKBUFF=y
</pre>}}


<pre>
:wq
:wq
</pre>
<pre>
make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- menuconfig
</pre>
Device drivers -> Block devices
<pre>
<*> RAM block device support
</pre>
General setup
<pre>
[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
</pre>
Change Initramfs source file(s) path to
<code>
~/code/busybox/_install
</code>
Turn on Support initial ramdisks compressed using LZMA
Exit General setup
Go into Boot options
Delete everything in the kernel command string:
<code>
noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 rw rootfstype=jffs2 ip=off
</code>
Change to this
<code>
console=ttymxc4,115200 rawtable=0xF40000 root=/dev/ram0 rdinit=/sbin/init rootfstype=ramfs
</code>
Then enable
<pre>
[*]Always use the default kernel command string"
</pre>
Exit Boot Options
Exit Main Menu then save yes.
====Fix timeconst.pl issue====
<pre>
Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at kernel/timeconst.pl line 373.
make[1]: *** [/home/nonasuomy/code/linux-2.6.35.2/kernel/Makefile:138: kernel/timeconst.h] Error 255
make: *** [Makefile:884: kernel] Error 2
</pre>
<pre>
vi kernel/timeconst.pl
</pre>
Go to line 373
replace
<code>
if (!defined(@val)) {
</code>
with
<code>
if (!@val) {
</code>
<code>
make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) uImage EXTRA_CFLAGS=-fno-pic modules
</code>
If you see this message everything is golden ponyboy.
<pre>
  UIMAGE  arch/arm/boot/uImage
Image Name:  Linux-2.6.35.3
Created:  Sun May 15 18:07:18 2022
Image Type:  ARM Linux Kernel Image (uncompressed)
Data Size: 2274788 Bytes = 2221.47 KiB = 2.17 MiB
Load Address: 70008000
Entry Point:  70008000
  Image arch/arm/boot/uImage is ready
</pre>
After the kernel is compiled (make), three files will be generated, one Image, one zImage, and one uImage. Image is a kernel image file, zImage is a kind of image compression file of the kernel, Image is about 4M, and zImage is less than 2M.
uImage is a special image file for uboot. It adds a 64-byte "header" before zImage, indicating the kernel version, loading location, generation time, size and other information; it is no different from zImage after 0x40 (64Bytes).
The 64-byte header structure is as follows:
<pre>
typedef struct image_header {
  uint32_tih_magic;
  uint32_tih_hcrc;
  uint32_tih_time;
  uint32_tih_size;
  uint32_tih_load;
  uint32_tih_ep;
  uint32_tih_dcrc;
  uint8_tih_os;
  uint8_tih_arch;
  uint8_tih_type;
  uint8_tih_comp;
  uint8_tih_name[IH_NMLEN];
} image_header_t;
</pre>
Image name: Linux-2.6.35.3
Created: Wed May 18 22:58:37 2022
Image type: ARM Linux Kernel (uncompressed)
Data size: 2301200 Bytes
Load Address: 0x70008000
Entry Point: 0x70008000
Header CRC: 0x2023fef1 ... OK
Data CRC: 0x58d9686
Therefore, both uImage and zImage are compressed kernel images. And uImage is made from zImage with the mkimage tool. The mkimage tool is introduced as follows:
The mkimage tool in u-boot is used to generate uImage (u-boot source code package/tools/mkimage.c)
Here to explain the meaning of the parameters
<pre>
-A ==> Set architecture to 'arch'
-O ==> Set operating system to 'os'
-T ==> Set image type to'type' "kernel or ramdisk"
-C ==> Set compression type 'comp'
-a ==> Set load address to 'addr' (hex)
-e ==> Set entry point to'ep' (hex) (check the complete kernel impression at this location when the kernel is started)
-n ==> Set image name to 'name'
-d ==> Use image data from 'datafile'
-x ==> Set XIP (execute in place, that is, do not copy the file, execute at the current location)
</pre>
For ARM linux kernel image usage
<pre>
-A arm ------------ The architecture is arm
-O linux ---------- The operating system is linux
-T kernel --------- The type is kernel
-C none/bzip/gzip - Compression type
-a 20008000 ------- Image of the load address (hex), typically 0xX00008000
-e 200080XX ------- Kernel entry address (hex), XX to 0x40 or 0x00
-n linux-XXX ------ Image name, arbitrary
-d nameXXX -------- Image file name without header information, your source kernel file
uImageXXX --------- Image file name with header information added
</pre>
===SDCard Prep # 2===
Flash the customized kernel over the kernel space via dd
<pre>
sudo dd if=~/code/linux-2.6.35.2/arch/arm/boot/uImage of=/dev/mmcblk0 bs=512 seek=2048
sudo sync
</pre>
===Two Methods to Alter Device U-Boot ENV===
====Hardware UART Way====
Take the device apart and connect the USB to 3.3V TTL Adapter to GND TX RX
USB to UART Adapter
Cheap Adapter 3.3/5V (Sony PRS-T1 UART is 3.3V)
https://www.aliexpress.c o m/item/32273550144.html
Expansive Adapter (Multiple voltages to hack even more devices not just the Sony)
https://www.aliexpress.c o m/item/1005003309224312.html
=====Connect With Putty (Windows)=====
Serial COM4 115200
=====Connect With Minicom (Linux)=====
<code>
minicom -D /dev/ttyUSB0
</code>
CTRL + A then Z
Then O (cOnfigure Minicom..O)
======[Configuration]======
<pre>
Serial port setup
A - Serial Device : /dev/ttyUSB0
E - Bps/Par/Bits : 115200 8N1
F - Hardware Flow Control : No
Modem and dialing (Clear all these settings)
A - Init string .........                                       
B - Reset string ........                                       
C - Dialing prefix #1....                                       
D - Dialing suffix #1....                                       
E - Dialing prefix #2....                                       
F - Dialing suffix #2....                                       
G - Dialing prefix #3....                                       
H - Dialing suffix #3....                                       
I - Connect string ...... 
K - Hang-up string .....                         
L - Dial cancel string ..
</pre>
Screen and keyboard (Change BS to DEL)
<pre>
B - Backspace key sends : DEL
</pre>
Save setup as minicomsettings
<pre>
initialize Modem...M
</pre>
To hangup press CTRL + A, Z
<pre>
Hangup.............H
</pre>
=====U-Boot Access=====
Spam any key on your keyboard to get to the U-Boot Prompt.
<pre>
U-Boot 2009.08 (Sep 27 2011 - 09:33:22)
CPU:  Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 66666666Hz
ipg per clock : 66666666Hz
uart clock : 24000000Hz
ahb clock : 133333333Hz
axi_a clock  : 400000000Hz
axi_b clock  : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 160000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C:  ready
DRAM:  256 MB
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 27
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In: serial
Out:  serial
Err:  serial
Net:  got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot:  0
MX50_ARM2 U-Boot >
</pre>
'''Note:''' ''There is an external watchdog running that will reset the device every 30 seconds. Which makes it difficult to type commands in the console. Copy and paste the values to the terminal to get the job done.''
<pre>
MX50_ARM2 U-Boot > printenv
</pre>
Backup what it spits out to a txt file.
Change the env.
This is to boot from the SDCard image.
<pre>
setenv bootargs root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0
saveenv
</pre>
<pre>
MX50_ARM2 U-Boot > printenv
stdin=serial
stdout=serial
stderr=serial
ethact=FEC0
loadaddr=0x70800000
loadaddr_ramdisk=0x70C00000
bootdev=2
rawtable=0xF40000
bootargs=root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
bootcmd=mmc read 0 ${loadaddr} 0x800 0x1400;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0
Environment size: 387/131068 bytes
</pre>
'''Note:''' ''You can use the stock build with adb shell as in the image it has the adb driver running.''
<pre>
sudo apt install adb
adb shell
#
</pre>
To boot recovery from SD card
<pre>
setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'
</pre>
To boot normal system from SD card
<pre>
setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'
</pre>
Change this to boot the customized kernel:
<pre>
setenv bootargs ‘root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait rdinit=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000’
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm
saveenv
</pre>
The device should now boot from the SDCard slot instead of the eMMC.
=====Recovery Mode Boot Way=====
Copy the uboot env from this image to a separate file:
<pre>
dd if=~/code/sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072
</pre>
<pre>
wget https://projects.mobileread.com/reader/users/porkupan/rupor/Releases/rescue/20121208/rupor-rescue.7z
7za e rupor-rescue.7z
</pre>
Copy uboot_new.bin to Rupor Rescue SD Card, along with the other files that are already there…
SD Card Layout
<pre>
OS Firmware
|-files
| |-update.img
uboot_new.bin
</pre>
Boot Rupor Rescue (Hold HOME + MENU during power on)
Remount SD Card as writable.
<pre>
mount -o remount,rw /dev/mmcblk0p1 /initrd/mnt/sd
</pre>
Change directory to the SD Card mounted.
<pre>
cd /initrd/mnt/sd
</pre>
Backup the old uboot env to a file.
<pre>
dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072
</pre>
Write a new one.
<pre>
dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072
</pre>
Reset device and it should now be booting to the SD Card image.
After that it should boot (in normal mode) from the SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".
=RANDOM STUFF=
==Original Stock Boot Log==
{{#spoiler:<pre>
U-Boot 2009.08 (Sep 27 2011 - 09:33:22)
CPU:  Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 66666666Hz
ipg per clock : 66666666Hz
uart clock : 24000000Hz
ahb clock : 133333333Hz
axi_a clock  : 400000000Hz
axi_b clock  : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 160000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C:  ready
DRAM:  256 MB
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 27
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In: serial
Out:  serial
Err:  serial
Net:  got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot:  0
MMC read: dev # 2, block # 2048, count 5120 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
5120 blocks read: OK
MMC read: dev # 2, block # 10240, count 500 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
500 blocks read: OK
## Booting kernel from Legacy Image at 70800000 ...
  Image Name:  Normal Kernel
  Image Type:  ARM Linux Kernel Image (uncompressed)
  Data Size: 2288064 Bytes =  2.2 MB
  Load Address: 70008000
  Entry Point:  70008000
  Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 70c00000 ...
  Image Name:  Normal Rootfs
  Image Type:  ARM Linux RAMDisk Image (uncompressed)
  Data Size: 214400 Bytes = 209.4 kB
  Load Address: 70308000
  Entry Point:  70308000
  Verifying Checksum ... OK
  Loading Kernel Image ... OK
OK
Starting kernel ...
Linux version 2.6.35.3 (hudson@devuntu5) (gcc version 4.4.0 (GCC) ) #1 PREEMPT Wed May 7 15:03:54 JST 2014
CPU: ARMv7 Processor [412fc085] revision 5 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Freescale MX50 ARM2 Board
Ignoring unrecognised tag 0x54410008
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63754
Kernel command line: console=ttymxc2,115200 init=/init bootdev=2 rawtable=0xF40000
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 251MB = 251MB total
Memory: 249220k/249220k available, 7804k reserved, 0K highmem
Virtual kernel memory layout:
vector  : 0xffff0000 - 0xffff1000  (  4 kB)
fixmap  : 0xfff00000 - 0xfffe0000  ( 896 kB)
DMA : 0xf9e00000 - 0xffe00000  (  96 MB)
vmalloc : 0x90000000 - 0xf4000000  (1600 MB)
lowmem  : 0x80000000 - 0x8fb00000  ( 251 MB)
pkmap  : 0x7fe00000 - 0x80000000  (  2 MB)
modules : 0x7f000000 - 0x7fe00000  (  14 MB)
  .init : 0x80008000 - 0x80025000  ( 116 kB)
  .text : 0x80025000 - 0x80424000  (4092 kB)
  .data : 0x80444000 - 0x804be700  ( 490 kB)
SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
    RCU-based detection of stalled CPUs is disabled.
    Verbose stalled-CPUs detection is disabled.
NR_IRQS:396
MXC GPIO hardware
MXC IRQ initialized
You should not call the gpmi_set_parent
MXC_Early serial console at MMIO 0x63f90000 (options '115200')
bootconsole [ttymxc2] enabled
Console: colour dummy device 80x30
Mix log static memory : 7fe00000 - 7fffffff
          address : 90400000
  There is not the last log.
Initialize a static memory for mix_logger.
##### LOG START #####
Calibrating delay loop... 799.53 BogoMIPS (lpj=3997696)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
regulator: core version 0.5
NET: Registered protocol family 16
i.MX IRAM pool: 128 KB@0x90040000
CPU is i.MX50 Revision 1.1
IR Power is LDO4
This is TPS65181.
PWR3DET:power 3 detect
FEC disable
Using SDMA I.API
MXC DMA API initialized
IMX usb wakeup probe
IMX usb wakeup probe
bio: create slab <bio-0> at 0
CSPI: mxc_spi-0 probed
CSPI: mxc_spi-2 probed
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
wm831x 0-0034: WM8321 revision C
wm831x 0-0034: Security key had non-zero value 1
regulator: VCORE: 850 <--> 1100 mV at 1000 mV at 0 uA
regulator: VPERI: 950 <--> 1250 mV at 1250 mV at 0 uA
regulator: DCDC3: at 1800 mV
regulator: DCDC4: at 2900 mV
regulator: LDO1: 900 <--> 3300 mV at 1200 mV
regulator: LDO2: 900 <--> 3300 mV at 1200 mV
regulator: LDO3: 900 <--> 3300 mV at 2500 mV
regulator: LDO4: 900 <--> 3300 mV at 3200 mV
regulator: LDO5: 900 <--> 3300 mV at 2900 mV
regulator: LDO6: 900 <--> 3300 mV at 2500 mV
regulator: LDO7: 1000 <--> 3500 mV at 1800 mV
regulator: LDO8: 1000 <--> 3500 mV at 2500 mV
regulator: LDO9: 1000 <--> 3500 mV at 3100 mV
regulator: LDO10: 1000 <--> 3500 mV at 3200 mV
regulator: LDO11: 800 <--> 1550 mV at 1200 mV
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource mxc_timer1
mxsdhci: MXC Secure Digital Host Controller Interface driver
mxsdhci: MXC SDHCI Controller Driver.
SDHC:sdhci_set_power:slot pwr off
mmc_detect_change: id=0
mmc0: SDHCI detect irq 179 irq 1 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc_rescan:detect done(id=0)
mmc_detect_change: id=1
mmc1: SDHCI detect irq 0 irq 2 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc_detect_change: id=2
mmc2: SDHCI detect irq 228 irq 3 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc_detect_change: id=3
mmc3: SDHCI detect irq 0 irq 4 INTERNAL DMA
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Unpacking initramfs...
Freeing initrd memory: 208K
LPMode driver module loaded
Static Power Management for Freescale i.MX5
PM driver module loaded
sdram autogating driver module loaded
Bus freq driver module loaded
mxc_dvfs_core_probe
DVFS driver module loaded
i.MXC CPU frequency driver
DVFS PER driver module loaded
ashmem: initialized
msgmni has been set to 487
alg: No test for stdrng (krng)
cryptodev: driver loaded.
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
regulator: DISPLAY:
regulator: VCOM: at 1250 mV
regulator: V3P3_CTRL:
regulator: PMIC_TEMP:
regulator: PWR0_CTRL:
regulator: PWR2_CTRL:
regulator: VSYS_EPD:
tps65180 1-0048: PMIC TPS6518x for eInk display
mmc2: new high speed MMC card at address 0001
mmc_rescan:wake_lock_timeout (2)
mmc_rescan:wifi:wake unlock (3)
Serial: MXC Internal UART driver
mxcuart register
mxcintuart.2: ttymxc2 at MMIO 0x5000c000 (irq = 33) is a Freescale i.MX
console [ttymxc2] enabled, bootconsole disabled
</pre>}}
==Customized Kernel Boot Log==
{{#spoiler:<pre>
U-Boot 2009.08 (Dec 21 2011 - 14:48:38)
CPU:  Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock    : 66666666Hz
ipg per clock : 66666666Hz
uart clock    : 24000000Hz
ahb clock    : 133333333Hz
axi_a clock  : 400000000Hz
axi_b clock  : 200000000Hz
weim_clock    : 100000000Hz
ddr clock    : 160000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C:  ready
DRAM:  256 MB
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 25
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In:    serial
Out:  serial
Err:  serial
Net:  got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot:  0
MMC read: dev # 0, block # 2048, count 5120 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
SD set clock 50MHz
5120 blocks read: OK
MMC read: dev # 0, block # 10240, count 600 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
SD set clock 50MHz
600 blocks read: OK
## Booting kernel from Legacy Image at 70800000 ...
  Image Name:  Linux-2.6.35.3
  Image Type:  ARM Linux Kernel Image (uncompressed)
  Data Size:    2292964 Bytes =  2.2 MB
  Load Address: 70008000
  Entry Point:  70008000
  Verifying Checksum ... OK
  Loading Kernel Image ... OK
OK
Starting kernel ...
Linux version 2.6.35.3 (nonasuomy@Marceline) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #6 PREEMPT Sun May 15 01:14:15 EDT 2022
CPU: ARMv7 Processor [412fc085] revision 5 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Freescale MX50 ARM2 Board
Ignoring unrecognised tag 0x54410009
Ignoring unrecognised tag 0x54410008
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63754
Kernel command line: console=ttymxc4,115200 rawtable=0xF40000 root=/dev/ram0 rdinit=/sbin/init rootfstype=ramfs
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 251MB = 251MB total
Memory: 248884k/248884k available, 8140k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000  (  4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000  ( 896 kB)
    DMA    : 0xf9e00000 - 0xffe00000  (  96 MB)
    vmalloc : 0x90000000 - 0xf4000000  (1600 MB)
    lowmem  : 0x80000000 - 0x8fb00000  ( 251 MB)
    pkmap  : 0x7fe00000 - 0x80000000  (  2 MB)
    modules : 0x7f000000 - 0x7fe00000  (  14 MB)
      .init : 0x80008000 - 0x800bb000  ( 716 kB)
      .text : 0x800bb000 - 0x804ac000  (4036 kB)
      .data : 0x804ca000 - 0x805447e0  ( 490 kB)
SLUB: Genslabs=9, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:396
MXC GPIO hardware
MXC IRQ initialized
You should not call the gpmi_set_parent
MXC_Early serial console at MMIO 0x63f90000 (options '115200')
bootconsole [ttymxc4] enabled
Console: colour dummy device 80x30
Mix log static memory : 7fe00000 - 7fffffff
              address : 90400000
  There is not the last log.
Initialize a static memory for mix_logger.
##### LOG START #####
Calibrating delay loop... 799.53 BogoMIPS (lpj=3997696)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
regulator: core version 0.5
NET: Registered protocol family 16
i.MX IRAM pool: 128 KB@0x90040000
CPU is i.MX50 Revision 1.1
IR Power is LDO4
This is TPS65181.
PWR3DET:power 3 detect
FEC disable
Using SDMA I.API
MXC DMA API initialized
IMX usb wakeup probe
IMX usb wakeup probe
bio: create slab <bio-0> at 0
CSPI: mxc_spi-0 probed
CSPI: mxc_spi-2 probed
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
wm831x 0-0034: WM8321 revision C
wm831x 0-0034: Security key had non-zero value 1
regulator: VCORE: 850 <--> 1100 mV at 1000 mV at 0 uA
regulator: VPERI: 950 <--> 1250 mV at 1250 mV at 0 uA
regulator: DCDC3: at 1800 mV
regulator: DCDC4: at 2900 mV
regulator: LDO1: 900 <--> 3300 mV at 1200 mV
regulator: LDO2: 900 <--> 3300 mV at 1200 mV
regulator: LDO3: 900 <--> 3300 mV at 2500 mV
regulator: LDO4: 900 <--> 3300 mV at 3200 mV
regulator: LDO5: 900 <--> 3300 mV at 2900 mV
regulator: LDO6: 900 <--> 3300 mV at 2500 mV
regulator: LDO7: 1000 <--> 3500 mV at 1800 mV
regulator: LDO8: 1000 <--> 3500 mV at 2500 mV
regulator: LDO9: 1000 <--> 3500 mV at 3100 mV
regulator: LDO10: 1000 <--> 3500 mV at 3200 mV
regulator: LDO11: 800 <--> 1550 mV at 1200 mV
Advanced Linux Sound Architecture Driver Version 1.0.23.
Switching to clocksource mxc_timer1
mxsdhci: MXC Secure Digital Host Controller Interface driver(all reset on error version)
mxsdhci: MXC SDHCI Controller Driver.
mmc0: SDHCI detect irq 179 irq 1 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc1: SDHCI detect irq 0 irq 2 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc2: SDHCI detect irq 228 irq 3 INTERNAL DMA
mxsdhci: MXC SDHCI Controller Driver.
mmc3: SDHCI detect irq 0 irq 4 INTERNAL DMA
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
LPMode driver module loaded
Static Power Management for Freescale i.MX5
PM driver module loaded
sdram autogating driver module loaded
Bus freq driver module loaded
mxc_dvfs_core_probe
DVFS driver module loaded
i.MXC CPU frequency driver
DVFS PER driver module loaded
ashmem: initialized
msgmni has been set to 486
alg: No test for stdrng (krng)
cryptodev: driver loaded.
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
regulator: DISPLAY:
regulator: VCOM: at 1250 mV
regulator: V3P3_CTRL:
regulator: PMIC_TEMP:
regulator: PWR0_CTRL:
regulator: PWR2_CTRL:
regulator: VSYS_EPD:
tps65180 1-0048: PMIC TPS6518x for eInk display
mmc0: new high speed SDHC card at address e624
mmc2: new high speed MMC card at address 0001
Serial: MXC Internal UART driver
mxcuart register
mxcintuart.2: ttymxc2 at MMIO 0x5000c000 (irq = 33) is a Freescale i.MX
mxcintuart.3: ttymxc3 at MMIO 0x53ff0000 (irq = 13) is a Freescale i.MX
mxcintuart.4: ttymxc4 at MMIO 0x63f90000 (irq = 86) is a Freescale i.MX
console [ttymxc4] enabled, bootconsole disabled
console [ttymxc4] enabled, bootconsole disabled
mxcswuart register
mxcintswuart.0: ttymxc0 at MMIO 0x53fbc000 (irq = 31) is a Freescale i.MX
SSW:ssw port register 0
mxcintswuart.1: ttymxc1 at MMIO 0x53fc0000 (irq = 32) is a Freescale i.MX
SSW:ssw port register 1
brd: module loaded
loop: module loaded
FEC Ethernet Driver
PPP generic driver version 2.4.2
usbcore: registered new interface driver asix
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver net1080
usbcore: registered new interface driver cdc_subset
input: gpio-keys as /devices/platform/gpio-keys/input/input0
irtp_init
irtp_connect
input: SONY IR Touchpanel as /devices/virtual/input/input1
IRTP: register early_suspend
input: wm831x_on as /devices/platform/imx-i2c.0/i2c-0/0-0034/wm831x-on/input/input2
input: phxlit_vbus as /devices/platform/phxlit_vbus.0/input/input3
phxlit_vbus phxlit_vbus.0: event(type 5 code 12)
wm831x-rtc wm831x-rtc: rtc core: registered wm831x as rtc0
mxc_rtc mxc_rtc.0: rtc core: registered mxc_rtc as rtc1
using rtc device, wm831x, for alarms
i2c /dev entries driver
APM Battery Driver
MXC WatchDog Driver 2.0
MXC Watchdog # 0 Timer: initial timeout 60 sec
mmcblk0: mmc0:e624 SU04G 3.69 GiB
mmcblk0: p1 p2 p3 < p5 p6 p7 p8 p9 p10 > p4
mmcblk2: mmc2:0001 SEM02G 1.82 GiB
mmcblk2:
logger: created 64K log 'log_main'
logger: created 64K log 'log_events'
logger: created 64K log 'log_radio'
logger: created 64K log 'log_system'
logger: created 2047K log 'log_mix'
logger: created 64K log 'log_kernel'
Past log manager.
[PASTLOG Err:past_mmc_initialize(502)]Open error
CS42L52: CODEC revision C1
DMA Sound Buffers Allocated:UseIram=1 buf->addr=f8006000 buf->area=90046000 size=24576
DMA Sound Buffers Allocated:UseIram=1 buf->addr=79380000 buf->area=f9e01000 size=24576
asoc: CS42L52 dai <-> imx-ssi-2-0 mapping ok
ALSA device list:
  #0: imx-3stack (CS42L52 codec)
nf_conntrack version 0.5.0 (3888 buckets, 15552 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 2
tps65180_vsys_enable : wait VSYS_EPD.
regulator_init_complete: incomplete constraints, leaving PWR2_CTRL on
regulator_init_complete: incomplete constraints, leaving PMIC_TEMP on
epdc_progress_work_func start progress.
tps65180_display_enable fail to read vcom from eMMC. -1
mxc_epdc_fb mxc_epdc_fb: Unable to enable DISPLAY regulator.err = 0xffffffff
------------[ cut here ]------------
WARNING: at drivers/regulator/core.c:1423 _regulator_disable+0x30/0x118()
unbalanced disables for DISPLAY
Modules linked in:
[<800c066c>] (unwind_backtrace+0x0/0xec) from [<800e0ca8>] (warn_slowpath_common+0x4c/0x64)
[<800e0ca8>] (warn_slowpath_common+0x4c/0x64) from [<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c)
[<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c) from [<80250178>] (_regulator_disable+0x30/0x118)
[<80250178>] (_regulator_disable+0x30/0x118) from [<80250338>] (regulator_disable+0x1c/0x30)
regulator_init_complete: incomplete constraints, leaving LDO11 on
[<80250338>] (regulator_disable+0x1c/0x30) from [<8024a4bc>] (epdc_powerup+0x2ac/0x32c)
[<8024a4bc>] (epdc_powerup+0x2ac/0x32c) from [<8024ba28>] (epdc_progress_work_func+0x58/0x13c)
[<8024ba28>] (epdc_progress_work_func+0x58/0x13c) from [<800f358c>] (worker_thread+0x178/0x228)
[<800f358c>] (worker_thread+0x178/0x228) from [<800f68c8>] (kthread+0x78/0x80)
[<800f68c8>] (kthread+0x78/0x80) from [<800bc9c0>] (kernel_thread_exit+0x0/0x8)
---[ end trace 8f4ec0588801be75 ]---
regulator_init_complete: incomplete constraints, leaving LDO7 on
regulator_init_complete: incomplete constraints, leaving LDO6 on
regulator_init_complete: incomplete constraints, leaving LDO5 on
powerup retry.
tps65180_display_enable fail to read vcom from eMMC. -1
mxc_epdc_fb mxc_epdc_fb: Unable to enable DISPLAY regulator.err = 0xffffffff
------------[ cut here ]------------
WARNING: at drivers/regulator/core.c:1423 _regulator_disable+0x30/0x118()
unbalanced disables for DISPLAY
Modules linked in:
regulator_init_complete: incomplete constraints, leaving LDO3 on
[<800c066c>] (unwind_backtrace+0x0/0xec) from [<800e0ca8>] (warn_slowpath_common+0x4c/0x64)
[<800e0ca8>] (warn_slowpath_common+0x4c/0x64) from [<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c)
[<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c) from [<80250178>] (_regulator_disable+0x30/0x118)
[<80250178>] (_regulator_disable+0x30/0x118) from [<80250338>] (regulator_disable+0x1c/0x30)
[<80250338>] (regulator_disable+0x1c/0x30) from [<8024a4bc>] (epdc_powerup+0x2ac/0x32c)
[<8024a4bc>] (epdc_powerup+0x2ac/0x32c) from [<8024ba28>] (epdc_progress_work_func+0x58/0x13c)
[<8024ba28>] (epdc_progress_work_func+0x58/0x13c) from [<800f358c>] (worker_thread+0x178/0x228)
[<800f358c>] (worker_thread+0x178/0x228) from [<800f68c8>] (kthread+0x78/0x80)
regulator_init_complete: incomplete constraints, leaving LDO2 on
[<800f68c8>] (kthread+0x78/0x80) from [<800bc9c0>] (kernel_thread_exit+0x0/0x8)
---[ end trace 8f4ec0588801be76 ]---
powerup retry out. (powerup error count: 1
epdc_progress_work_func Fails to powerup.-1
epdc_progress_work_func end progress.
regulator_init_complete: incomplete constraints, leaving LDO1 on
input: sub_cpu_pwrbutton as /devices/platform/mxc_spi.2/spi3.2/sub_cpu_pwrbutton/input/input4
wm831x-rtc wm831x-rtc: setting system clock to 2010-01-02 09:45:56 UTC (1262425556)
tps65180_display_enable fail to read vcom from eMMC. -1
------------[ cut here ]------------
WARNING: at drivers/regulator/core.c:1423 _regulator_disable+0x30/0x118()
unbalanced disables for DISPLAY
Modules linked in:
[<800c066c>] (unwind_backtrace+0x0/0xec) from [<800e0ca8>] (warn_slowpath_common+0x4c/0x64)
[<800e0ca8>] (warn_slowpath_common+0x4c/0x64) from [<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c)
[<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c) from [<80250178>] (_regulator_disable+0x30/0x118)
[<80250178>] (_regulator_disable+0x30/0x118) from [<80250338>] (regulator_disable+0x1c/0x30)
[<80250338>] (regulator_disable+0x1c/0x30) from [<802c0410>] (get_temperature+0x40/0x50)
[<802c0410>] (get_temperature+0x40/0x50) from [<802c042c>] (calculate_battery_capacity+0xc/0x8c)
[<802c042c>] (calculate_battery_capacity+0xc/0x8c) from [<803aa958>] (sub_cpu_bci_probe+0x2b4/0x36c)
[<803aa958>] (sub_cpu_bci_probe+0x2b4/0x36c) from [<80279930>] (platform_drv_probe+0x18/0x1c)
[<80279930>] (platform_drv_probe+0x18/0x1c) from [<80278ad0>] (driver_probe_device+0xc8/0x184)
[<80278ad0>] (driver_probe_device+0xc8/0x184) from [<80278bec>] (__driver_attach+0x60/0x84)
[<80278bec>] (__driver_attach+0x60/0x84) from [<802782ec>] (bus_for_each_dev+0x44/0x74)
[<802782ec>] (bus_for_each_dev+0x44/0x74) from [<80277c40>] (bus_add_driver+0x98/0x214)
[<80277c40>] (bus_add_driver+0x98/0x214) from [<80278ed8>] (driver_register+0xa8/0x138)
[<80278ed8>] (driver_register+0xa8/0x138) from [<800bb370>] (do_one_initcall+0x58/0x1a8)
[<800bb370>] (do_one_initcall+0x58/0x1a8) from [<80008408>] (kernel_init+0xa8/0x168)
[<80008408>] (kernel_init+0xa8/0x168) from [<800bc9c0>] (kernel_thread_exit+0x0/0x8)
---[ end trace 8f4ec0588801be77 ]---
Freeing init memory: 716K
/bin/sh: can't access tty; job control turned off
/ # tps65180_display_enable fail to read vcom from eMMC. -1
------------[ cut here ]------------
WARNING: at drivers/regulator/core.c:1423 _regulator_disable+0x30/0x118()
unbalanced disables for DISPLAY
Modules linked in:
[<800c066c>] (unwind_backtrace+0x0/0xec) from [<800e0ca8>] (warn_slowpath_common+0x4c/0x64)
[<800e0ca8>] (warn_slowpath_common+0x4c/0x64) from [<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c)
[<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c) from [<80250178>] (_regulator_disable+0x30/0x118)
[<80250178>] (_regulator_disable+0x30/0x118) from [<80250338>] (regulator_disable+0x1c/0x30)
[<80250338>] (regulator_disable+0x1c/0x30) from [<802c0410>] (get_temperature+0x40/0x50)
[<802c0410>] (get_temperature+0x40/0x50) from [<802c042c>] (calculate_battery_capacity+0xc/0x8c)
[<802c042c>] (calculate_battery_capacity+0xc/0x8c) from [<802c0604>] (sub_cpu_check_battery_state_work+0xac/0x194)
[<802c0604>] (sub_cpu_check_battery_state_work+0xac/0x194) from [<802859cc>] (sub_main_irq_thread+0x9c/0x100)
[<802859cc>] (sub_main_irq_thread+0x9c/0x100) from [<800f68c8>] (kthread+0x78/0x80)
[<800f68c8>] (kthread+0x78/0x80) from [<800bc9c0>] (kernel_thread_exit+0x0/0x8)
---[ end trace 8f4ec0588801be78 ]---
tps65180_display_enable fail to read vcom from eMMC. -1
------------[ cut here ]------------
WARNING: at drivers/regulator/core.c:1423 _regulator_disable+0x30/0x118()
unbalanced disables for DISPLAY
Modules linked in:
[<800c066c>] (unwind_backtrace+0x0/0xec) from [<800e0ca8>] (warn_slowpath_common+0x4c/0x64)
[<800e0ca8>] (warn_slowpath_common+0x4c/0x64) from [<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c)
[<800e0d40>] (warn_slowpath_fmt+0x2c/0x3c) from [<80250178>] (_regulator_disable+0x30/0x118)
[<80250178>] (_regulator_disable+0x30/0x118) from [<80250338>] (regulator_disable+0x1c/0x30)
[<80250338>] (regulator_disable+0x1c/0x30) from [<802c0410>] (get_temperature+0x40/0x50)
[<802c0410>] (get_temperature+0x40/0x50) from [<802c042c>] (calculate_battery_capacity+0xc/0x8c)
[<802c042c>] (calculate_battery_capacity+0xc/0x8c) from [<802c0604>] (sub_cpu_check_battery_state_work+0xac/0x194)
[<802c0604>] (sub_cpu_check_battery_state_work+0xac/0x194) from [<802859cc>] (sub_main_irq_thread+0x9c/0x100)
[<802859cc>] (sub_main_irq_thread+0x9c/0x100) from [<800f68c8>] (kthread+0x78/0x80)
[<800f68c8>] (kthread+0x78/0x80) from [<800bc9c0>] (kernel_thread_exit+0x0/0x8)
---[ end trace 8f4ec0588801be79 ]---
/ # ls
bin      dev      etc      linuxrc  proc    sbin    sys      usr
</pre>}}
==Binwalk==
<pre>
~/code$ binwalk -B sd_card_PRS-T1_1.0.07_adb_enabled.bin
</pre>
{{#spoiler:<pre>
DECIMAL  HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3921      0xF51      Unix path: /home/hudson/slave/workspace/build_sydney_gen_pwr3_production/bootable/bootloader/uboot-imx/cpu/arm_cortexa8
137388    0x218AC    CRC32 polynomial table, little endian
169017    0x29439    Unix path: /opt/eldk/arm
1048576  0x100000    uImage header, header size: 64 bytes, header CRC: 0xC62947B6, created: 2014-05-07 06:23:24, image size: 2288064 bytes, Data Address: 0x70008000, Entry Point: 0x70008000, data CRC: 0xE71034E4, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Normal Kernel"
1048640  0x100040    Linux kernel ARM boot executable zImage (little-endian)
1065353  0x104189    gzip compressed data, maximum compression, from Unix, last modified: 2014-05-07 06:03:56
5242880  0x500000    uImage header, header size: 64 bytes, header CRC: 0x81959F98, created: 2020-04-26 18:13:04, image size: 286848 bytes, Data Address: 0x70308000, Entry Point: 0x70308000, data CRC: 0x47F3B07F, OS: Linux, CPU: ARM, image type: RAMDisk Image, compression type: none, image name: "Normal Rootfs"
5242944  0x500040    gzip compressed data, from Unix, last modified: 2020-04-26 18:11:40
6291456  0x600000    uImage header, header size: 64 bytes, header CRC: 0x91DDBCA9, created: 2011-09-27 00:54:19, image size: 2284836 bytes, Data Address: 0x70008000, Entry Point: 0x70008000, data CRC: 0xCB85C7A2, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Recovery Kernel"
6291520  0x600040    Linux kernel ARM boot executable zImage (little-endian)
6308233  0x604189    gzip compressed data, maximum compression, from Unix, last modified: 2011-09-27 00:34:34
16122880  0xF60400    PEM RSA private key
20950321  0x13FAD31  Unix path: /sys/class/rfkill/rfkill0/type) failed: No such file or directory (2)
20955380  0x13FC0F4  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
20955567  0x13FC1AF  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
21193781  0x1436435  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
21193968  0x14364F0  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
21226147  0x143E2A3  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
21226334  0x143E35E  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
21275250  0x144A272  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
21275437  0x144A32D  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
21394155  0x14672EB  Intel x86 or x64 microcode, sig 0x6e72654b, pf_mask 0x206f4e20, 2090-04-29, rev 0x-7c000000, size 1919903264
23794958  0x16B150E  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23795145  0x16B15C9  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
23820741  0x16B79C5  Unix path: /dev/block/vold/179:10 does not contain a FAT filesystem
23821173  0x16B7B75  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23821360  0x16B7C30  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
23840940  0x16BC8AC  Unix path: /dev/block/vold/179:10 does not contain a FAT filesystem
23841128  0x16BC968  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23841315  0x16BCA23  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
23877426  0x16C5732  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23877613  0x16C57ED  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
23931364  0x16D29E4  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23931551  0x16D2A9F  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
23990688  0x16E11A0  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
23990875  0x16E125B  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
24027527  0x16EA187  Unix path: /sys/class/rfkill/rfkill0/type) failed: No such file or directory (2)
24031919  0x16EB2AF  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
24032106  0x16EB36A  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
24070136  0x16F47F8  Unix path: /sys/class/rfkill/rfkill0/type) failed: No such file or directory (2)
24074528  0x16F5920  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
24074715  0x16F59DB  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
24112355  0x16FECE3  Unix path: /sys/class/rfkill/rfkill0/type) failed: No such file or directory (2)
24116747  0x16FFE0B  Unix path: /dev/block/vold/179:9 does not contain a FAT filesystem
24116934  0x16FFEC6  Unix path: /dev/block/vold/179:8 does not contain a FAT filesystem
24150738  0x17082D2  Unix path: /sys/class/rfkill/rfkill0/type) failed: No such file or directory (2)
26214400  0x1900000  Linux EXT filesystem, blocks count: 10240, image size: 10485760, rev 0.0, ext4 filesystem data, UUID=fd4953cc-74e3-40b8-b300-7a90e7cae7ca, volume name "Recovery"
36700160  0x2300000  CramFS filesystem, little endian, size: 7667712, version 2, sorted_dirs, CRC 0xFE1B1DBA, edition 0, 4321 blocks, 576 files
47194112  0x2D02000  CramFS filesystem, little endian, size: 12984320, version 2, sorted_dirs, CRC 0x8DD1DAAD, edition 0, 4687 blocks, 45 files
64004096  0x3D0A000  Linux EXT filesystem, blocks count: 137250, image size: 140544000, rev 0.0, ext2 filesystem data, UUID=ecab395c-586a-4667-91ec-a677f0cff0cf, volume name "dictionaries"
206684672 0xC51C200  Microsoft executable, portable (PE)
207206400 0xC59B800  Copyright string: "Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED."
207233544 0xC5A2208  Object signature in DER format (PKCS header length: 4, sequence length: 5936
207233693 0xC5A229D  Certificate in DER format (x509 v3), header length: 4, sequence length: 1120
207234817 0xC5A2701  Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
207235967 0xC5A2B7F  Certificate in DER format (x509 v3), header length: 4, sequence length: 1181
207237152 0xC5A3020  Certificate in DER format (x509 v3), header length: 4, sequence length: 1181
207239680 0xC5A3A00  Microsoft executable, portable (PE)
207866376 0xC63CA08  Object signature in DER format (PKCS header length: 4, sequence length: 5949
207866525 0xC63CA9D  Certificate in DER format (x509 v3), header length: 4, sequence length: 1120
207867649 0xC63CF01  Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
207868799 0xC63D37F  Certificate in DER format (x509 v3), header length: 4, sequence length: 1181
207869984 0xC63D820  Certificate in DER format (x509 v3), header length: 4, sequence length: 1194
207872512 0xC63E200  XML document, version: "1.0"
207874560 0xC63EA00  Microsoft executable, portable (PE)
208206344 0xC68FA08  Object signature in DER format (PKCS header length: 4, sequence length: 5456
208206493 0xC68FA9D  Certificate in DER format (x509 v3), header length: 4, sequence length: 890
208207387 0xC68FE1B  Certificate in DER format (x509 v3), header length: 4, sequence length: 964
208208355 0xC6901E3  Certificate in DER format (x509 v3), header length: 4, sequence length: 1276
208209635 0xC6906E3  Certificate in DER format (x509 v3), header length: 4, sequence length: 1290
208209796 0xC690784  Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,
208212483 0xC691203  XML document, version: "1.0"
208214528 0xC691A00  Microsoft executable, portable (PE)
208314880 0xC6AA200  XML document, version: "1.0"
208316928 0xC6AAA00  XML document, version: "1.0"
208323072 0xC6AC200  PNG image, 52 x 9, 8-bit/color RGBA, non-interlaced
208325120 0xC6ACA00  JPEG image data, JFIF standard 1.02
208333312 0xC6AEA00  PNG image, 56 x 11, 8-bit colormap, non-interlaced
208335360 0xC6AF200  PNG image, 140 x 128, 8-bit/color RGBA, non-interlaced
208335488 0xC6AF280  Zlib compressed data, compressed
208339456 0xC6B0200  PNG image, 76 x 36, 8-bit/color RGBA, non-interlaced
208339541 0xC6B0255  Zlib compressed data, best compression
208342213 0xC6B0CC5  Zlib compressed data, best compression
208343552 0xC6B1200  PNG image, 300 x 32, 8-bit/color RGBA, non-interlaced
208343630 0xC6B124E  Zlib compressed data, best compression
208345600 0xC6B1A00  PNG image, 26 x 72, 8-bit/color RGBA, non-interlaced
208347648 0xC6B2200  PNG image, 56 x 11, 8-bit/color RGBA, non-interlaced
208349696 0xC6B2A00  XML document, version: "1.0"
208351744 0xC6B3200  XML document, version: "1.0"
208353792 0xC6B3A00  XML document, version: "1.0"
208355840 0xC6B4200  XML document, version: "1.0"
208364032 0xC6B6200  XML document, version: "1.0"
208364908 0xC6B656C  Copyright string: "Copyright</key>"
208370368 0xC6B7AC0  Unix path: /usr/lib/dyld
208385634 0xC6BB662  Unix path: /usr/bin/hdiutil
208441856 0xC6C9200  XML document, version: "1.0"
208443904 0xC6C9A00  PNG image, 300 x 32, 8-bit/color RGBA, non-interlaced
208443982 0xC6C9A4E  Zlib compressed data, best compression
208468480 0xC6CFA00  PNG image, 76 x 36, 8-bit/color RGBA, non-interlaced
208468565 0xC6CFA55  Zlib compressed data, best compression
208471237 0xC6D04C5  Zlib compressed data, best compression
208579072 0xC6EAA00  Microsoft executable, portable (PE)
208920276 0xC73DED4  PNG image, 256 x 256, 8-bit/color RGBA, non-interlaced
208920317 0xC73DEFD  Zlib compressed data, best compression
208998912 0xC751200  JPEG image data, JFIF standard 1.01
209000960 0xC751A00  SQLite 3.x database,, user version 14
209005056 0xC752A00  JPEG image data, JFIF standard 1.01
209006604 0xC75300C  SQLite 3.x database,
209007104 0xC753200  JPEG image data, JFIF standard 1.01
209037824 0xC75AA00  JPEG image data, JFIF standard 1.01
209039872 0xC75B200  SQLite 3.x database,, user version 14
209043968 0xC75C200  JPEG image data, JFIF standard 1.01
209046016 0xC75CA00  JPEG image data, JFIF standard 1.01
209058304 0xC75FA00  JPEG image data, JFIF standard 1.01
209070365 0xC76291D  JPEG image data, JFIF standard 1.01
209072640 0xC763200  JPEG image data, JFIF standard 1.01
209094701 0xC76882D  JPEG image data, JFIF standard 1.01
209097216 0xC769200  JPEG image data, JFIF standard 1.01
209106749 0xC76B73D  JPEG image data, JFIF standard 1.01
209109504 0xC76C200  JPEG image data, JFIF standard 1.01
209120845 0xC76EE4D  JPEG image data, JFIF standard 1.01
209123840 0xC76FA00  JPEG image data, JFIF standard 1.01
209132893 0xC771D5D  JPEG image data, JFIF standard 1.01
209136128 0xC772A00  JPEG image data, JFIF standard 1.01
209144941 0xC774C6D  JPEG image data, JFIF standard 1.01
209146368 0xC775200  JPEG image data, JFIF standard 1.01
209156989 0xC777B7D  JPEG image data, JFIF standard 1.01
209160704 0xC778A00  JPEG image data, JFIF standard 1.01
209169037 0xC77AA8D  JPEG image data, JFIF standard 1.01
209170944 0xC77B200  JPEG image data, JFIF standard 1.01
209181085 0xC77D99D  JPEG image data, JFIF standard 1.01
209183232 0xC77E200  JPEG image data, JFIF standard 1.01
209193133 0xC7808AD  JPEG image data, JFIF standard 1.01
209207808 0xC784200  JPEG image data, JFIF standard 1.01
209209856 0xC784A00  JPEG image data, JFIF standard 1.01
209216000 0xC786200  JPEG image data, JFIF standard 1.01
209220096 0xC787200  JPEG image data, JFIF standard 1.01
209222144 0xC787A00  JPEG image data, JFIF standard 1.01
209226240 0xC788A00  JPEG image data, JFIF standard 1.01
209230336 0xC789A00  JPEG image data, JFIF standard 1.01
209236480 0xC78B200  JPEG image data, JFIF standard 1.01
209238528 0xC78BA00  JPEG image data, JFIF standard 1.01
209240576 0xC78C200  JPEG image data, JFIF standard 1.01
209244672 0xC78D200  JPEG image data, JFIF standard 1.01
209248768 0xC78E200  JPEG image data, JFIF standard 1.01
209252864 0xC78F200  JPEG image data, JFIF standard 1.01
209256960 0xC790200  JPEG image data, JFIF standard 1.01
209259008 0xC790A00  JPEG image data, JFIF standard 1.01
209261056 0xC791200  JPEG image data, JFIF standard 1.01
209263104 0xC791A00  JPEG image data, JFIF standard 1.01
209265152 0xC792200  JPEG image data, JFIF standard 1.01
209269248 0xC793200  JPEG image data, JFIF standard 1.01
209271296 0xC793A00  JPEG image data, JFIF standard 1.01
209273344 0xC794200  JPEG image data, JFIF standard 1.01
209275392 0xC794A00  JPEG image data, JFIF standard 1.01
209277440 0xC795200  JPEG image data, JFIF standard 1.01
209279488 0xC795A00  JPEG image data, JFIF standard 1.01
217161728 0xCF1A000  Linux EXT filesystem, blocks count: 36739, image size: 37620736, rev 0.0, ext2 filesystem data, UUID=72c0c5fc-6229-443f-96d1-0278739f739f, volume name "preload"
259137536 0xF722000  Linux EXT filesystem, blocks count: 49153, image size: 50332672, rev 1.0, ext4 filesystem data, UUID=10b2c3e0-6584-48fb-8839-a94797cf97cf, volume name "data"
309501952 0x1272A000  Linux EXT filesystem, blocks count: 1178401, image size: 1206682624, rev 0.0, ext2 filesystem data, UUID=d71243ed-680a-43aa-89ed-4b01162b162b, volume name "system"
1521335296 0x5AADBC00  gzip compressed data, from Unix, last modified: 1970-01-01 00:00:00 (null date)
1521339392 0x5AADCC00  Linux EXT filesystem, blocks count: 25600, image size: 26214400, rev 1.0, ext2 filesystem data (mounted or unclean), UUID=ddaa282f-f831-4e1e-a80e-04c2a71da71d
1547586560 0x5C3E4C00  SQLite 3.x database,, user version 14
1547592204 0x5C3E620C  SQLite 3.x database,
1547596300 0x5C3E720C  SQLite 3.x database,
1547627520 0x5C3EEC00  SQLite 3.x database,, user version 14
1547633164 0x5C3F020C  SQLite 3.x database,
1547637260 0x5C3F120C  SQLite 3.x database,
</pre>}}
==Watchdog Stuff==
WM8321G Address R16388(4004h) Watchdog, Bit 14 WDOG_DEBUG, Default 0, Watchdog Pause 0=Disable 1=Enabled (halts the watchdog timer for system debugging) Protected by user key
This would show if you can't modify the watchdog bit without the code
i2c dev 0
i2c probe
i2c md.w 0x34 0x4008  -> default value is 0x0000
We have to write a magic value 0x9716 to this register, to allow writes to WDOG_DEBUG etc.
MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4008 0x9716
Print out the bit set for 4004
MX50_ARM2 U-Boot > i2c md.w 0x34 0x4004
Then you should be abled to activate the watchdog debug mode
MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4004 (change bit 14 of whatever you get from above to 1)
==Backup / Restore==
<pre>
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024
sync
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024
sync
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024
sync
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024
sync
</pre>
<pre>
#!/bin/sh
PATH=/diag/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin
mount -t vfat -o rw,shortname=winnt /dev/mmcblk0p1 /initrd/mnt/sd
/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp
sleep 3
# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading.bmp
# sleep 3
# # Reading
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/old.ramdisk.uimg skip=10240 count=600 bs=512
# # sync
# # dd if=/dev/mmcblk2 of=/ initrd/mnt/sd/old.nboote.bin skip=30720 count=256 bs=512
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/mmcblk2.img
# # sync
# # dd if=/dev/mmcblk2p1 of=/initrd/mnt/sd/mmcblk2p1.img
# # sync
# # dd if=/dev/mmcblk2p2 of=/initrd/mnt/sd/mmcblk2p2.img
# # sync
# # dd if=/dev/mmcblk2p3 of=/initrd/mnt/sd/mmcblk2p3.img
# # sync
# # dd if=/dev/mmcblk2p4 of=/initrd/mnt/sd/mmcblk2p4.img
# # sync
# # dd if=/dev/mmcblk2p5 of=/initrd/mnt/sd/mmcblk2p5.img
# # sync
# # dd if=/dev/mmcblk2p6 of=/initrd/mnt/sd/mmcblk2p6.img
# # sync
# # dd if=/dev/mmcblk2p7 of=/initrd/mnt/sd/mmcblk2p7.img
# # sync
# # dd if=/dev/mmcblk2p8 of=/initrd/mnt/sd/mmcblk2p8.img
# # sync
# # dd if=/dev/mmcblk2p9 of=/initrd/mnt/sd/mmcblk2p9.img
# # sync
# # dd if=/dev/loop0 of=/initrd/mnt/sd/loop0.img
# # sync
# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading_done.bmp
# sleep 3
/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing.bmp
sleep 3
</pre>
<pre>
Writing
dd if=/initrd/mnt/sd /new.mmcblk2p4.img of=/dev/mmcblk2p4 conv=notruc
sync
dd if=/initrd/mnt/sd/new.mmcblk2.img of=/dev/mmcblk2
sync
dd if=/initrd/mnt/sd/mmcblk2p8. img of=/dev/mmcblk2p8 bs=1024
sync
dd if=/initrd/mnt/sd/ new.mmcblk2p7.img of=/dev/ mmcblk2p7 bs=1024
sync dd if=/initrd/mnt/sd/mmcblk2p9.img of=/dev/mmcblk2p9 bs=1024 sync cd /initrd/mnt/sd/ /diag/bin/version_check.sh > /initrd/mnt/sd/version.txt # mkfs.ext4 /dev/mmcblk2p6 -L dictionaries # mkfs.ext4 -m 0 -L data /dev/mmcblk2p8 # /diag/bin/epd_fb_test gettemp > /initrd/mnt/sd/epd_fb_test.txt # sync # dmesg > / initrd/mnt/sd/dmesg.txt ls -la /dev > /initrd/mnt/sd/dev.txt # /diag/bin/device_id.sh > /initrd/mnt/sd/device-id.txt # /diag /bin/serial_number.sh > /initrd/mnt/sd/serial_number.txt
# cat /sys/module/rawdatatable/parameters/rawdata_param > /initrd/mnt/sd/rawdata_param.txt
# cat /sys/module/rawdatatable/parameters/partition_param > /initrd/mnt/sd/partition_param.txt
# sync
# cat /proc/cpuinfo > /initrd/mnt/sd/cpuinfo.txt
# cat /proc/meminfo > /initrd/mnt/sd/meminfo.txt
/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing_done. bmp
sleep 3
/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp
sleep 3
# /sbin/getty -L 9600 ttyGS0 vt102
</pre>
==Raw Data Parameters==
cat /sys/module/rawdatatable/parameters/rawdata_param
<pre>
MBR :0x00000000:0x00000400
uBoot :0x00000400:0x000bfc00
Boot Env :0x000c0000:0x00020000
Reserved1 :0x000e0000:0x00020000
Normal Kernel :0x00100000:0x00400000
Normal Rootfs :0x00500000:0x00100000
Recovery Kernel :0x00600000:0x00400000
Reserved2 :0x00a00000:0x00500000
Normal Boot Env :0x00f00000:0x00020000
Recovery Boot Env :0x00f20000:0x00020000
Raw Data Table :0x00f40000:0x00020000
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000
</pre>
Bytes in Decimal
<pre>
MBR :0:1024
uBoot :1024:785408
Boot Env :786432:131072
Reserved1 :917504:131072
Normal Kernel :1048576:4194304
Normal Rootfs :5242880:1048576
Recovery Kernel :6291456:4194304
Reserved2 :10485760:5242880
Normal Boot Env :15728640:131072
Recovery Boot Env :15859712:131072
Raw Data Table :15990784:131072
Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880
</pre>
rawdatatable.h
<pre>
#define RAWLABEL_BOOTIMAGE "Boot Image"
#define RAWLABEL_WAVEFORM "Waveform"
#define RAWLABEL_INFO "Info"
#define RAWLABEL_ID "Id"
#define RAWLABEL_LOG "LOG"
</pre>
If this table says:
<pre>
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000
</pre>
Hex to Decimal
<pre>
Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880
</pre>
How do you compute these values of dd to the above?
<pre>
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024
sync
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024
sync
</pre>
<pre>
Waveform to Decimal: 17825792Bytes : 2097152Bytes
skip=17408Blocks. Skip 17408 ibs-sized blocks at start of input
bs=1024Bytes. Read and write up to BYTES bytes at a time (default: 512);overrides ibs and obs
count=2048Blocks. Copy only 2048 input blocks
Starting Point of DD Copy
17408Blocks * 1024Bytes = 17825792Bytes ☑️
Count
2048Blocks * 1024Bytes = 2097152Bytes
17825792Bytes + 2097152Bytes = 19922944Bytes ☑️
Next Data Point
LOG :19922944 ☑️:5242880
</pre>
The second number is how many bytes added to the starting point
So now we can see where VCOM is ripped from
<pre>
dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024
</pre>
<pre>
skip=15876
count=1
bs=1024
VCOM Start: 15876 * 1024 = 16257024
1*1024 = 1024
VCOM End: 16257024 + 1024 = 16258048
</pre>
<pre>
Id :0x00f80000:0x00020000
Id :16252928:131072
</pre>
Therefore VCOM is inside Id of the 26MB Raw Data Area
<pre>
Id Start:  16252928
VCOM Start: 16257024
BW1118073202953
BU1156245100493
148427352023999
PVI6inchC118C
60
2460
AudioOK
2012/05/21-14:53:11
VCOM End:  16258048
Id End:    16384000
</pre>
<pre>
PRS-T1          UC,CEW^@^@^@^@^@^@^@^@^@^@0800461001BB6D47148427352023999.PRST1^
f_mass_storage.c
/* string buffer for SCSI Inquiry product base name */
static char _scsi_inquiry_product_name[] = "PRS-XXX ";
#define STRING_PRODUCT_EMMC_ID_OFFSET (0x00)
static char _scsi_inquiry_sku_name[] = "        ";
#define STRING_SKU_EMMC_ID_OFFSET (0x10)
STRING_PRODUCT_EMMC_ID_OFFSET 0x00 PRS-T1 “PRS-XXX”
STRING_SKU_EMMC_ID_OFFSET 0x10 UC,CEW (US) Also RU JP
"        "
android.c
/* string buffer for "iSerial" */
static char _usb_string_descriptor_iSerial[] = "000000000000000";
#define STRING_SERIAL_EMMC_ID_OFFSET (0x30)
STRING_SERIAL_EMMC_ID_OFFSET 0x30 148427352023999
</pre>
<pre>
mkdir -p /mount/p7;mount /dev/mmcblk0p7 /mount/p7;cd “/mount/p7/Sony_
Reader/”
</pre>
===Interesting Links===
https://www.mobileread.com/forums/showthread.php?t=178248
https://www.mobileread.com/forums/showthread.php?p=2207783#post2207783
https://www.mobileread.com/forums/showthread.php?t=165938
https://gitlab.com/phreakuencies/prstux/
https://web.archive.org/web/20121010183954/http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMXANDROID
https://community.nxp.com/t5/i-MX-Processors/New-Android-R10-3-2-Patch-BSP-for-i-MX51-and-i-MX53-blog-archive/m-p/207936
https://forum.doozan.com/read.php?2,126699
https://www.mobileread.com/forums/showthread.php?t=329270
https://projects.mobileread.com/reader/users/porkupan/
https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals
https://archive.org/download/sd_card_PRS-T1_1.0.07_adb_enabled.bin/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin

Latest revision as of 20:21, 29 May 2022

Stock Information

Stock Sony PRS-T1
Stock Sony PRS-T1
Sony-PRS-T1 Bottom
Sony-PRS-T1 Bottom
Sony-PRS-T1 Back
Sony-PRS-T1 Back

Sony Reader Wi-Fi (PRS-T1) 

Made by: Sony
Released: October 2011
Predecessor: None
Languages Supported: English
File Types Supported: PDF, TXT, ePUB, MP3, AAC, JPG, GIF, PNG, BMP

Overview

The PRS-T1 also known as "Reader Wi-Fi" is the world's lightest 6" e-Reader with a glare-free, paper-like display designed for hours of comfortable reading, even in direct sunlight. Use your fingertips to select a title, turn the page or zoom in and out. Wirelessly shop books, magazines and newspapers at Reader™ Store and get instantaneous access to websites like Wikipedia® and Google™ search.


Features direct access to public libraries in several countries. Uses E-Ink® Pearl V220 glare-free screen. Includes 12 Built-in Dictionaries with 2 English and 10 others with to and from French, German, Spanish, Dutch and Italian. Reader allows you to write on the page or highlight text as you would in a real book using your finger or a supplied stylus for Note taking.


The USB port supports mounting as a USB Mass Storage Device, and allows for syncing to Sony Reader for PC and Sony Reader for Mac. Installers for these are included.

Specifications

Color: White, black or red.
Size: 173 x 110 x 8.9mm (6 7/8 x 4 3/8 x 3/8 inches).
Weight: 168g (5.9oz).
Display: 6" E-Ink Pearl™ with Clear Touch Infrared Technology 16 level grayscale.
    Resolution: 600 x 800 pixels 167ppi.
Operating Temperature: 5°C to 35°C (41°F to 95°F).
Memory Size: Internal: 2 GB Approx. 1.3 GB after initial setting.
    External: Micro SD card up to 32GB.
DRM Support: Adobe on ePub and PDF. ePub support is OPS 2.0, PDF is version 1.6.
MP3 Support: No DRM.
    Bit Rate: 8 to 320 kbps.
    Sampling Frequency: 8 to 48 kHz.
AAC Support: .mp4, .m4a (not raw AAC) no DRM.
Power: Built-in rechargeable battery: 3.7 V DC 1000mAh.
    Battery Life (Approx) : A single charge lasts over one month with wireless off based upon a half-hour of daily reading time.; Read on a single battery charge for 3-4 weeks with wireless on.; Up to 14,000 continuous page turns when reading only. Recharging Time: Fully charges in approximately 2 hours via the approved U.S. power adapter. Approx. 2.5 hours supports charging from your computer via the included USB 2.0 cable.
Wireless/Networking:
    Wi-Fi: Atheros AR6003 IEEE 802.11b/g/n (not 5GHz).
    Wireless Security: WEP (Open System), WEP (Shared Key), WPA-PSK (TKIP), WPA-PSK (AES), WPA2-PSK (TKIP), WPA2-PSK (AES).

Details

Micro USB port
In the Box
    Quick Start Guide, Warranty, Audio tips
    Important Product Information
    USB 2.0 (micro to standard) Cable
    Stylus Pen

Unofficial Details

Android 2.2.1-based
256MB RAM
800MHz Freescale ARMv7 CPU
Freescale MX50 board

Applications Included

eBook Reader - Supports dictionary lookup, notes, bookmarks, highlighting.
Music Player
Photo Viewer
Web Browser
Text Memo Maker
Handwriting Program - Supports freehand drawing.
eBook, periodical purchasing - Sony Reader store, provides access to Public Domain Google 
    books as well.
Overdrive App - Browse and checkout Public Library books in the USA, UK.

Firmware Updates

Sony has released several firmware updates for the T1, which are all installed using the provided Sony Reader for PC/Sony Reader for Mac desktop software. 

1.0.00.09010 - Installed on some shipping models.
1.0.00.09270 - Installed on some shipping models.
1.0.02.10280 - Released on 17 November 2011, installed on some shipping models.
1.0.03.11140 - Released on 9 December 2011.
1.0.04.12210 - Released on 27 January 2012.
1.0.05.11130 - Released on 26 November 2012.
1.0.06.03210 - Released on 27 March 2014.
1.0.07.05070 - Released on 19 June 2014.

Hardware

PCB PRS-T1/G1 M5047 1-884-610-12 BW1118073202953 Cast 2012/05/05A
https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals
https://fccid.io/AK8PRST1/

MCIMX508CVK8B NXP i.MX50 32-bit MPU, ARM Cortex-A8 core, 800MHz, MAPBGA 416.
https://www.nxp.com/docs/en/user-guide/IMX50SDG.pdf

K4X2G323PC-8GD8 Samsung DRAM Chip Mobile LPDDR SDRAM 256Mbit 64Mx32 90-Pin FBGA

SDIN5D1-2G SanDisk e.MMC 2GB 4.41 BGA
https://datasheet.octopart.com/SDIN5D1-2G-SanDisk-datasheet-10977782.pdf

F0513A Renesas MCU 8-bit 78K0 SISC 32KB Flash 5V 44-Pin LQFP (SDCard Controller?)
https://www.renesas.com/us/en/document/mah/78k0kx2-users-manual-hardware-r01uh0008ej040178k0kx2

WM8321G Wolfson Processor Power Management Subsystem (PMIC)
https://pdf1.alldatasheet.com/325b8904-4044-407c-9988-42ce4c2dfbf4

CS42L52-CNZ Cirrus Logic Low-power, Stereo CODEC w/ Headphone & Speaker Amps
https://statics.cirrus.com/pubs/proDatasheet/CS42L52_F2.pdf

3611 WC120 Atheros 6k (6003)
https://cdn.datasheetspdf.com/pdf-down/A/R/6/AR6003-Atheros.pdf
https://developer.ridgerun.com/wiki/index.php/Atheros_AR6003_SDIO_WiFi_Integration

TPS65180 Texas Instruments PMIC for E Ink® Vizplex™-Enabled Electronic Paper Display
https://www.ti.com/lit/ds/symlink/tps65181.pdf?ts=1653836738327

6 inch E-ink LCD (PRS-T1/NOOK Simple) ED060SCE (LF)C1 RET60C4026(C118) E4K0C6B82M4VS5374AY -2.46
https://essentialscrap.com/eink/ED060SC4V2.pdf

PVI6inchC118C

PVI, Prime View International, in Taiwan, is very close to owning the E-Ink technology very soon, I think the contract will be signed this month between CEO Scott Liu in Taiwan and the E-Ink people in Boston. One thing I found in researching PVI is that it is part of an old Taiwan paper company called The Yuen Fong Yu Group, that started ops in 1935 during the Japanese occupation of Taiwan island (1895-1945). The founders were Taiwanese and the owners still are. Yuen Fong Yu means "Forever Wealth Remnants" in a loose translation of the three Mandarin words, and the company name might mean something like "Remnants of Infinite Prosperity." E-Ink will be in good hands in Taiwan, and PVI looks poised to hit the bigtime globally, since 90 percent of all e-readers use the E-Ink technology.

The parent company used to make toilet paper, and still does I believe. If you google the parent name "Yuen Fong Yu Group" you can see their website in English and Chinese.   

VM15AB LMV65 National Semiconductor  LMV65x 12-MHz, Low Voltage (5V?), Low Power Amplifiers
https://www.ti.com/lit/ds/symlink/lmv651.pdf?ts=1653838936815

2 x HC4067B 16-channel analog multiplexer/demultiplexer
https://www.ti.com/lit/ds/symlink/cd74hc4067.pdf?ts=1653837700828

LIS1476MHPPC(SY6) 1-853-104-11 Sony 01 W US304362 3.7V 3.6Wh 1500mA Max Charge 4.30V
https://www.aliexpress.c o m/item/2251832682904150.html

Install Debian 11 Build Environment

su - to load env (binary folders etc) su -

Give sudo to the user usermod -a -G sudo username

Reload your terminal permissions by su username su username

Install building items

sudo apt install git linux-headers-$(uname -r) build-essential ncurses-dev docker curl debootstrap qemu qemu-utils qemu-user-static binfmt-support imagemagick vim u-boot-tools lzop

sudo modprobe binfmt_misc

Enable i386 package installation support

sudo dpkg --add-architecture i386
sudo apt-get update
gcc-multilib is the package which will enable running 32bit (x86) binaries on 64bit (amd64/x86_64) system.
sudo apt-get install gcc-multilib
sudo apt-get install zlib1g:i386

Discord

sudo apt install snapd
sudo snap install core
snap install discord
Join InkBox Discord
https://discord.gg/KyK4dQyuSe

Sony Source Code For Readers

https://oss.sony.net/Products/Linux/Audio/category03.html

PRS-T1 Source Code

https://oss.sony.net/Products/Linux/Audio/PRS-T1JP_20140702.html

Start

Open Terminal

Make a directory under users home directory to do all the compilation.

mkdir ~/code

SDCard Prep

Thanks to Petteri whom originally created this SDCard boot package. 

cd ~/code
wget https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
tar -xvf https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
sudo dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress

Backup link: https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin

GCC for Cross Compiling

cd ~/code

wget https://github.com/onyx-intl/toolchain/raw/master/imx508/gcc-4.4.4-glibc-2.11.1-multilib-1.0.tar.gz

tar -xvf gcc-4.4.4-glibc-2.11.1-multilib-1.0.tar.gz

mv opt/freescale /opt/
cd /opt/freescale/usr/local/gcc-4.4.4-glibc-2.11.1-multilib-1.0/arm-fsl-linux-gnueabi/bin
export PATH="${PATH}:${PWD}"
sudo chmod -R 755 /opt

BusyBox Compiling

cd ~/code

wget https://busybox.net/downloads/busybox-1.32.1.tar.bz2
tar -xvf busybox-1.32.1.tar.bz2
mv busybox-1.32.1 busybox

cd busybox

Add stripped down .config to busybox directory from NiMa/TuxLinux

Save this below as .config in the root of the busybox directory. 

make menuconfig

Note: This is already set in the .config above but run menuconfig anyways and exit save so you don’t get all these y/n questions depending on the busybox version you are using. It will fix these for you doing that.

Under Settings enable with an asterisk (spacebar):

[*] Build static binary (no shared libs) (NEW)

Fix Sync Error

sync.c:(.text.sync_main+0x5c): undefined reference to syncfs

man syncfs

VERSIONS



  	syncfs()  first  appeared  in Linux 2.6.39; library support was added to glibc in version
  	2.14.


config FEATURE_SYNC_FANCY [=n] (Don’t disable actual sync just the fancy option under it)

Under Coreutils => Sync => Remove the asterisk (Spacebar) =>

[ ]   Enable -d and -f flags (requires syncfs(2) in libc)

Exit Exit Save Yes


Fix DADFAILED Error

Note: Fixed in newer versions but if not. 

networking/libiproute/ipaddress.c:345: error: 'IFA_F_DADFAILED' undeclared (first use in this function)

vi ~/code/busybox/networking/libiproute/ipaddress.c

Find DADFAILED around line 345 

if (ifa_flags & IFA_F_DADFAILED) {
  ifa_flags &= ~IFA_F_DADFAILED;
  printf("dadfailed ");
}

Change to:

#ifdef IFA_F_DADFAILED
if (ifa_flags & IFA_F_DADFAILED) {
  ifa_flags &= ~IFA_F_DADFAILED;
  printf("dadfailed ");
}
#endif

Make Busybox Install

make V=1 ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) install

If you see this last message at the end then hopefully everything went fine. 

chmod a+x busybox
DO_INSTALL_LIBS="" \
    /bin/sh /home/nonasuomy/code/busybox/applets/install.sh "./_install" --symlinks
  ./_install//bin/ash -> busybox
  ./_install//bin/base64 -> busybox
  ./_install//bin/cat -> busybox
  ./_install//bin/chattr -> busybox
  ./_install//bin/chgrp -> busybox
  ./_install//bin/chmod -> busybox
  ./_install//bin/chown -> busybox
  ./_install//bin/cp -> busybox
  ./_install//bin/cttyhack -> busybox
  ./_install//bin/date -> busybox
  ./_install//bin/dd -> busybox
  ./_install//bin/dmesg -> busybox
  ./_install//bin/echo -> busybox
  ./_install//bin/false -> busybox
  ./_install//bin/grep -> busybox
  ./_install//bin/kill -> busybox
  ./_install//bin/ln -> busybox
  ./_install//bin/login -> busybox
  ./_install//bin/ls -> busybox
  ./_install//bin/lsattr -> busybox
  ./_install//bin/mkdir -> busybox
  ./_install//bin/mknod -> busybox
  ./_install//bin/mount -> busybox
  ./_install//bin/mv -> busybox
  ./_install//bin/pidof -> busybox
  ./_install//bin/ping -> busybox
  ./_install//bin/ps -> busybox
  ./_install//bin/pwd -> busybox
  ./_install//bin/rm -> busybox
  ./_install//bin/sed -> busybox
  ./_install//bin/sh -> busybox
  ./_install//bin/sleep -> busybox
  ./_install//bin/stat -> busybox
  ./_install//bin/sync -> busybox
  ./_install//bin/touch -> busybox
  ./_install//bin/true -> busybox
  ./_install//bin/umount -> busybox
  ./_install//bin/uname -> busybox
  ./_install//bin/vi -> busybox
  ./_install//linuxrc -> bin/busybox
  ./_install//sbin/devmem -> ../bin/busybox
  ./_install//sbin/fsck -> ../bin/busybox
  ./_install//sbin/getty -> ../bin/busybox
  ./_install//sbin/halt -> ../bin/busybox
  ./_install//sbin/ifconfig -> ../bin/busybox
  ./_install//sbin/ifdown -> ../bin/busybox
  ./_install//sbin/ifenslave -> ../bin/busybox
  ./_install//sbin/ifup -> ../bin/busybox
  ./_install//sbin/init -> ../bin/busybox
  ./_install//sbin/insmod -> ../bin/busybox
  ./_install//sbin/losetup -> ../bin/busybox
  ./_install//sbin/lsmod -> ../bin/busybox
  ./_install//sbin/poweroff -> ../bin/busybox
  ./_install//sbin/reboot -> ../bin/busybox
  ./_install//sbin/rmmod -> ../bin/busybox
  ./_install//sbin/route -> ../bin/busybox
  ./_install//sbin/run-init -> ../bin/busybox
  ./_install//sbin/watchdog -> ../bin/busybox
  ./_install//usr/bin/[ -> ../../bin/busybox
  ./_install//usr/bin/[[ -> ../../bin/busybox
  ./_install//usr/bin/awk -> ../../bin/busybox
  ./_install//usr/bin/cut -> ../../bin/busybox
  ./_install//usr/bin/env -> ../../bin/busybox
  ./_install//usr/bin/fold -> ../../bin/busybox
  ./_install//usr/bin/free -> ../../bin/busybox
  ./_install//usr/bin/fuser -> ../../bin/busybox
  ./_install//usr/bin/killall -> ../../bin/busybox
  ./_install//usr/bin/lsof -> ../../bin/busybox
  ./_install//usr/bin/mkfifo -> ../../bin/busybox
  ./_install//usr/bin/nc -> ../../bin/busybox
  ./_install//usr/bin/nohup -> ../../bin/busybox
  ./_install//usr/bin/nproc -> ../../bin/busybox
  ./_install//usr/bin/printf -> ../../bin/busybox
  ./_install//usr/bin/reset -> ../../bin/busybox
  ./_install//usr/bin/rx -> ../../bin/busybox
  ./_install//usr/bin/sha256sum -> ../../bin/busybox
  ./_install//usr/bin/sort -> ../../bin/busybox
  ./_install//usr/bin/split -> ../../bin/busybox
  ./_install//usr/bin/test -> ../../bin/busybox
  ./_install//usr/bin/timeout -> ../../bin/busybox
  ./_install//usr/bin/tr -> ../../bin/busybox
  ./_install//usr/bin/unlink -> ../../bin/busybox
  ./_install//usr/bin/xxd -> ../../bin/busybox
  ./_install//usr/bin/yes -> ../../bin/busybox
  ./_install//usr/sbin/chroot -> ../../bin/busybox
  ./_install//usr/sbin/fbset -> ../../bin/busybox
  ./_install//usr/sbin/fdformat -> ../../bin/busybox
  ./_install//usr/sbin/i2cdetect -> ../../bin/busybox
  ./_install//usr/sbin/i2cdump -> ../../bin/busybox
  ./_install//usr/sbin/i2cget -> ../../bin/busybox
  ./_install//usr/sbin/i2cset -> ../../bin/busybox
  ./_install//usr/sbin/i2ctransfer -> ../../bin/busybox
  ./_install//usr/sbin/ifplugd -> ../../bin/busybox


--------------------------------------------------
You will probably need to make your busybox binary
setuid root to ensure all configured applets will
work properly.
--------------------------------------------------

If busybox needs to be smaller to fit in the same DD space the prior kernel used (2.2MB) use the UPX tool. 

upx --ultra-brute _install/bin/busybox

                   	Ultimate Packer for eXecutables
                      	Copyright (C) 1996 - 2020
UPX 3.96    	Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

    	File size     	Ratio  	Format  	Name
   --------------------   ------   -----------   -----------
   1396208 ->	582216   41.70%	linux/arm	busybox                  	 

Packed 1 file.

cd ~/code/busybox/_install
mkdir -p etc/init.d/

vi etc/init.d/rcS

#!/bin/sh

mkdir -p /sys /proc /dev
mount -t sysfs sysfs /sys
mount -t proc proc /proc
mount -t devtmpfs devtmpfs /dev

/bin/sh

chmod +x ~/code/busybox/_install/etc/init.d/rcS

Boot the Stock SDCard Image then grab platform-tools and connect to ADB Shell

https://developer.android.com/studio/releases/platform-tools#downloads

With the device connected via USB run:

adb shell

At the prompt # check out the permissions of /dev/ttymxc4 

ls -l /dev/ttymxc4
crw------- root 	root 	207,  20 2010-01-01 02:00 ttymxc4

Copy the 207 20 to the ttymxc4 mknod value below.

Note: Do not put / in front of your dev folders on the following mknod commands or you will create them in your systems dev folder instead of the busybox/_install/dev/ folder. 

cd ~/code/busybox/_install
mkdir dev
sudo mknod dev/console c 5 1
sudo mknod dev/null c 1 3
sudo mknod dev/ttymxc4 c 207 20

Kernel Compile

cd ~/code

wget https://prodgpl.blob.core.windows.net/download/Audio/common/2UrziX9Zanih0kfZRY4U3Q/linux-2.6.35.2-20140522-2.tgz

tar -xvf linux-2.6.35.2-20140522-2.tgz

cd ~/code/linux-2.6.35.2

vi ~/code/linux-2.6.35.2/.config

Paste the kernel config below. 

:wq

make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- menuconfig

Device drivers -> Block devices 

<*> RAM block device support

General setup 

[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support

Change Initramfs source file(s) path to

~/code/busybox/_install

Turn on Support initial ramdisks compressed using LZMA

Exit General setup

Go into Boot options

Delete everything in the kernel command string:

noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 rw rootfstype=jffs2 ip=off

Change to this

console=ttymxc4,115200 rawtable=0xF40000 root=/dev/ram0 rdinit=/sbin/init rootfstype=ramfs

Then enable 

[*]Always use the default kernel command string"

Exit Boot Options

Exit Main Menu then save yes.

Fix timeconst.pl issue

Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at kernel/timeconst.pl line 373.
make[1]: *** [/home/nonasuomy/code/linux-2.6.35.2/kernel/Makefile:138: kernel/timeconst.h] Error 255
make: *** [Makefile:884: kernel] Error 2

vi kernel/timeconst.pl

Go to line 373

replace

if (!defined(@val)) {

with

if (!@val) {

make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) uImage EXTRA_CFLAGS=-fno-pic modules

If you see this message everything is golden ponyboy. 

  UIMAGE  arch/arm/boot/uImage
Image Name:   Linux-2.6.35.3
Created:  	Sun May 15 18:07:18 2022
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:	2274788 Bytes = 2221.47 KiB = 2.17 MiB
Load Address: 70008000
Entry Point:  70008000
  Image arch/arm/boot/uImage is ready

After the kernel is compiled (make), three files will be generated, one Image, one zImage, and one uImage. Image is a kernel image file, zImage is a kind of image compression file of the kernel, Image is about 4M, and zImage is less than 2M.

uImage is a special image file for uboot. It adds a 64-byte "header" before zImage, indicating the kernel version, loading location, generation time, size and other information; it is no different from zImage after 0x40 (64Bytes).

The 64-byte header structure is as follows: 

typedef struct image_header {
  uint32_tih_magic;
  uint32_tih_hcrc;
  uint32_tih_time;
  uint32_tih_size;
  uint32_tih_load;
  uint32_tih_ep;
  uint32_tih_dcrc;
  uint8_tih_os;
  uint8_tih_arch;
  uint8_tih_type;
  uint8_tih_comp;
  uint8_tih_name[IH_NMLEN];
} image_header_t;

Image name: Linux-2.6.35.3 Created: Wed May 18 22:58:37 2022 Image type: ARM Linux Kernel (uncompressed) Data size: 2301200 Bytes Load Address: 0x70008000 Entry Point: 0x70008000 Header CRC: 0x2023fef1 ... OK Data CRC: 0x58d9686

Therefore, both uImage and zImage are compressed kernel images. And uImage is made from zImage with the mkimage tool. The mkimage tool is introduced as follows:

The mkimage tool in u-boot is used to generate uImage (u-boot source code package/tools/mkimage.c)

Here to explain the meaning of the parameters 

-A ==> Set architecture to 'arch'
-O ==> Set operating system to 'os'
-T ==> Set image type to'type' "kernel or ramdisk"
-C ==> Set compression type 'comp'
-a ==> Set load address to 'addr' (hex)
-e ==> Set entry point to'ep' (hex) (check the complete kernel impression at this location when the kernel is started)
-n ==> Set image name to 'name'
-d ==> Use image data from 'datafile'
-x ==> Set XIP (execute in place, that is, do not copy the file, execute at the current location)

For ARM linux kernel image usage 

-A arm ------------ The architecture is arm 
-O linux ---------- The operating system is linux
-T kernel --------- The type is kernel
-C none/bzip/gzip - Compression type
-a 20008000 ------- Image of the load address (hex), typically 0xX00008000
-e 200080XX ------- Kernel entry address (hex), XX to 0x40 or 0x00
-n linux-XXX ------ Image name, arbitrary
-d nameXXX -------- Image file name without header information, your source kernel file
uImageXXX --------- Image file name with header information added

SDCard Prep # 2

Flash the customized kernel over the kernel space via dd 

sudo dd if=~/code/linux-2.6.35.2/arch/arm/boot/uImage of=/dev/mmcblk0 bs=512 seek=2048
sudo sync

Two Methods to Alter Device U-Boot ENV

Hardware UART Way

Take the device apart and connect the USB to 3.3V TTL Adapter to GND TX RX





USB to UART Adapter

Cheap Adapter 3.3/5V (Sony PRS-T1 UART is 3.3V)

https://www.aliexpress.c o m/item/32273550144.html

Expansive Adapter (Multiple voltages to hack even more devices not just the Sony)

https://www.aliexpress.c o m/item/1005003309224312.html

Connect With Putty (Windows)

Serial COM4 115200

Connect With Minicom (Linux)

minicom -D /dev/ttyUSB0

CTRL + A then Z

Then O (cOnfigure Minicom..O)

[Configuration]
Serial port setup
A - Serial Device : /dev/ttyUSB0
E - Bps/Par/Bits : 115200 8N1
F - Hardware Flow Control : No

Modem and dialing (Clear all these settings)
A - Init string .........                                         	 
B - Reset string ........                                         	 
C - Dialing prefix #1....                                         	 
D - Dialing suffix #1....                                         	 
E - Dialing prefix #2....                                         	 
F - Dialing suffix #2....                                         	 
G - Dialing prefix #3....                                         	 
H - Dialing suffix #3....                                         	 
I - Connect string ......   	
K - Hang-up string .....                           	 
L - Dial cancel string ..

Screen and keyboard (Change BS to DEL) 

B - Backspace key sends	: DEL

Save setup as minicomsettings 

initialize Modem...M

To hangup press CTRL + A, Z 

Hangup.............H
U-Boot Access

Spam any key on your keyboard to get to the U-Boot Prompt. 

U-Boot 2009.08 (Sep 27 2011 - 09:33:22)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock 	: 66666666Hz
ipg per clock : 66666666Hz
uart clock	: 24000000Hz
ahb clock 	: 133333333Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock	: 100000000Hz
ddr clock 	: 160000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C:   ready
DRAM:  256 MB
MMC:   FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 27
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In:	serial
Out:   serial
Err:   serial
Net:   got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot:  0

MX50_ARM2 U-Boot >

Note: There is an external watchdog running that will reset the device every 30 seconds. Which makes it difficult to type commands in the console. Copy and paste the values to the terminal to get the job done. 

MX50_ARM2 U-Boot > printenv

Backup what it spits out to a txt file.

Change the env.

This is to boot from the SDCard image. 

setenv bootargs root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0
saveenv

MX50_ARM2 U-Boot > printenv
stdin=serial
stdout=serial
stderr=serial
ethact=FEC0
loadaddr=0x70800000
loadaddr_ramdisk=0x70C00000
bootdev=2
rawtable=0xF40000
bootargs=root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
bootcmd=mmc read 0 ${loadaddr} 0x800 0x1400;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0

Environment size: 387/131068 bytes

Note: You can use the stock build with adb shell as in the image it has the adb driver running. 

sudo apt install adb
adb shell
#

To boot recovery from SD card 

setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'

To boot normal system from SD card 

setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'

Change this to boot the customized kernel: 

setenv bootargs ‘root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait rdinit=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000’
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm
saveenv

The device should now boot from the SDCard slot instead of the eMMC.

Recovery Mode Boot Way

Copy the uboot env from this image to a separate file: 

dd if=~/code/sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072

wget https://projects.mobileread.com/reader/users/porkupan/rupor/Releases/rescue/20121208/rupor-rescue.7z
7za e rupor-rescue.7z

Copy uboot_new.bin to Rupor Rescue SD Card, along with the other files that are already there…

SD Card Layout 

OS Firmware
|-files
| |-update.img
uboot_new.bin

Boot Rupor Rescue (Hold HOME + MENU during power on)

Remount SD Card as writable. 

mount -o remount,rw /dev/mmcblk0p1 /initrd/mnt/sd

Change directory to the SD Card mounted. 

cd /initrd/mnt/sd

Backup the old uboot env to a file. 

dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

Write a new one. 

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

Reset device and it should now be booting to the SD Card image.

After that it should boot (in normal mode) from the SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".


RANDOM STUFF

Original Stock Boot Log

Customized Kernel Boot Log

Binwalk

~/code$ binwalk -B sd_card_PRS-T1_1.0.07_adb_enabled.bin

Watchdog Stuff

WM8321G Address R16388(4004h) Watchdog, Bit 14 WDOG_DEBUG, Default 0, Watchdog Pause 0=Disable 1=Enabled (halts the watchdog timer for system debugging) Protected by user key

This would show if you can't modify the watchdog bit without the code i2c dev 0 i2c probe i2c md.w 0x34 0x4008 -> default value is 0x0000

We have to write a magic value 0x9716 to this register, to allow writes to WDOG_DEBUG etc. MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4008 0x9716

Print out the bit set for 4004 MX50_ARM2 U-Boot > i2c md.w 0x34 0x4004

Then you should be abled to activate the watchdog debug mode MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4004 (change bit 14 of whatever you get from above to 1)

Backup / Restore

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024 
sync 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
sync

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
sync 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024 
sync

#!/bin/sh 

PATH=/diag/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin 

mount -t vfat -o rw,shortname=winnt /dev/mmcblk0p1 /initrd/mnt/sd 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp 
sleep 3 

# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading.bmp 
# sleep 3 

# # Reading 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/old.ramdisk.uimg skip=10240 count=600 bs=512 
# # sync 
# # dd if=/dev/mmcblk2 of=/ initrd/mnt/sd/old.nboote.bin skip=30720 count=256 bs=512 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/mmcblk2.img 
# # sync 
# # dd if=/dev/mmcblk2p1 of=/initrd/mnt/sd/mmcblk2p1.img 
# # sync 
# # dd if=/dev/mmcblk2p2 of=/initrd/mnt/sd/mmcblk2p2.img 
# # sync 
# # dd if=/dev/mmcblk2p3 of=/initrd/mnt/sd/mmcblk2p3.img 
# # sync 
# # dd if=/dev/mmcblk2p4 of=/initrd/mnt/sd/mmcblk2p4.img 
# # sync 
# # dd if=/dev/mmcblk2p5 of=/initrd/mnt/sd/mmcblk2p5.img 
# # sync 
# # dd if=/dev/mmcblk2p6 of=/initrd/mnt/sd/mmcblk2p6.img 
# # sync
# # dd if=/dev/mmcblk2p7 of=/initrd/mnt/sd/mmcblk2p7.img 
# # sync 
# # dd if=/dev/mmcblk2p8 of=/initrd/mnt/sd/mmcblk2p8.img 
# # sync 
# # dd if=/dev/mmcblk2p9 of=/initrd/mnt/sd/mmcblk2p9.img 
# # sync 
# # dd if=/dev/loop0 of=/initrd/mnt/sd/loop0.img 
# # sync 

# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading_done.bmp 
# sleep 3 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing.bmp 
sleep 3 

Writing 
dd if=/initrd/mnt/sd /new.mmcblk2p4.img of=/dev/mmcblk2p4 conv=notruc 
sync 
dd if=/initrd/mnt/sd/new.mmcblk2.img of=/dev/mmcblk2 
sync 
dd if=/initrd/mnt/sd/mmcblk2p8. img of=/dev/mmcblk2p8 bs=1024 
sync
dd if=/initrd/mnt/sd/ new.mmcblk2p7.img of=/dev/ mmcblk2p7 bs=1024 
sync dd if=/initrd/mnt/sd/mmcblk2p9.img of=/dev/mmcblk2p9 bs=1024 sync cd /initrd/mnt/sd/ /diag/bin/version_check.sh > /initrd/mnt/sd/version.txt # mkfs.ext4 /dev/mmcblk2p6 -L dictionaries # mkfs.ext4 -m 0 -L data /dev/mmcblk2p8 # /diag/bin/epd_fb_test gettemp > /initrd/mnt/sd/epd_fb_test.txt # sync # dmesg > / initrd/mnt/sd/dmesg.txt ls -la /dev > /initrd/mnt/sd/dev.txt # /diag/bin/device_id.sh > /initrd/mnt/sd/device-id.txt # /diag /bin/serial_number.sh > /initrd/mnt/sd/serial_number.txt

# cat /sys/module/rawdatatable/parameters/rawdata_param > /initrd/mnt/sd/rawdata_param.txt 
# cat /sys/module/rawdatatable/parameters/partition_param > /initrd/mnt/sd/partition_param.txt 
# sync 

# cat /proc/cpuinfo > /initrd/mnt/sd/cpuinfo.txt 
# cat /proc/meminfo > /initrd/mnt/sd/meminfo.txt 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing_done. bmp 
sleep 3 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp 
sleep 3 

# /sbin/getty -L 9600 ttyGS0 vt102

Raw Data Parameters

cat /sys/module/rawdatatable/parameters/rawdata_param 

MBR :0x00000000:0x00000400
uBoot :0x00000400:0x000bfc00
Boot Env :0x000c0000:0x00020000
Reserved1 :0x000e0000:0x00020000
Normal Kernel :0x00100000:0x00400000
Normal Rootfs :0x00500000:0x00100000
Recovery Kernel :0x00600000:0x00400000
Reserved2 :0x00a00000:0x00500000
Normal Boot Env :0x00f00000:0x00020000
Recovery Boot Env :0x00f20000:0x00020000
Raw Data Table :0x00f40000:0x00020000
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000

Bytes in Decimal 

MBR :0:1024
uBoot :1024:785408
Boot Env :786432:131072
Reserved1 :917504:131072
Normal Kernel :1048576:4194304
Normal Rootfs :5242880:1048576
Recovery Kernel :6291456:4194304
Reserved2 :10485760:5242880
Normal Boot Env :15728640:131072
Recovery Boot Env :15859712:131072
Raw Data Table :15990784:131072
Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880

rawdatatable.h 

#define RAWLABEL_BOOTIMAGE	"Boot Image"
#define RAWLABEL_WAVEFORM	"Waveform"
#define RAWLABEL_INFO		"Info"
#define RAWLABEL_ID			"Id"
#define RAWLABEL_LOG		"LOG"

If this table says: 

Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000

Hex to Decimal 

Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880

How do you compute these values of dd to the above? 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
sync

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
sync

Waveform to Decimal: 17825792Bytes : 2097152Bytes

skip=17408Blocks. Skip 17408 ibs-sized blocks at start of input

bs=1024Bytes. Read and write up to BYTES bytes at a time (default: 512);overrides ibs and obs

count=2048Blocks. Copy only 2048 input blocks

Starting Point of DD Copy
17408Blocks * 1024Bytes = 17825792Bytes ☑️ 

Count
2048Blocks * 1024Bytes = 2097152Bytes
17825792Bytes + 2097152Bytes = 19922944Bytes ☑️

Next Data Point
LOG :19922944 ☑️:5242880

The second number is how many bytes added to the starting point

So now we can see where VCOM is ripped from 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 

skip=15876
count=1 
bs=1024 
VCOM Start: 15876 * 1024 = 16257024
1*1024 = 1024
VCOM End: 16257024 + 1024 = 16258048

Id :0x00f80000:0x00020000
Id :16252928:131072

Therefore VCOM is inside Id of the 26MB Raw Data Area 

Id Start:   16252928

VCOM Start: 16257024
BW1118073202953
BU1156245100493
148427352023999
PVI6inchC118C
60
2460
AudioOK
2012/05/21-14:53:11
VCOM End:   16258048

Id End:     16384000

PRS-T1          UC,CEW^@^@^@^@^@^@^@^@^@^@0800461001BB6D47148427352023999.PRST1^

f_mass_storage.c

/* string buffer for SCSI Inquiry product base name */
static	char	_scsi_inquiry_product_name[] = "PRS-XXX ";
#define	STRING_PRODUCT_EMMC_ID_OFFSET		(0x00)
static	char	_scsi_inquiry_sku_name[] = "        ";
#define	STRING_SKU_EMMC_ID_OFFSET			(0x10)

STRING_PRODUCT_EMMC_ID_OFFSET 0x00 PRS-T1 “PRS-XXX”
STRING_SKU_EMMC_ID_OFFSET 0x10 UC,CEW (US) Also RU JP
"        "
android.c
/* string buffer for "iSerial" */
static	char	_usb_string_descriptor_iSerial[] = "000000000000000";
#define	STRING_SERIAL_EMMC_ID_OFFSET		(0x30)


STRING_SERIAL_EMMC_ID_OFFSET 0x30 148427352023999

mkdir -p /mount/p7;mount /dev/mmcblk0p7 /mount/p7;cd “/mount/p7/Sony_
Reader/”

Interesting Links

https://www.mobileread.com/forums/showthread.php?t=178248

https://www.mobileread.com/forums/showthread.php?p=2207783#post2207783

https://www.mobileread.com/forums/showthread.php?t=165938

https://gitlab.com/phreakuencies/prstux/

https://web.archive.org/web/20121010183954/http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMXANDROID

https://community.nxp.com/t5/i-MX-Processors/New-Android-R10-3-2-Patch-BSP-for-i-MX51-and-i-MX53-blog-archive/m-p/207936

https://forum.doozan.com/read.php?2,126699

https://www.mobileread.com/forums/showthread.php?t=329270

https://projects.mobileread.com/reader/users/porkupan/

https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals

https://archive.org/download/sd_card_PRS-T1_1.0.07_adb_enabled.bin/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz

https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin

Retrieved from "https://inkbox.ddns.net/wiki/index.php?title=Sony_PRS-T1&oldid=72"