Sony PRS-T1

From InkBox
Jump to navigation Jump to search

Stock Information

Stock Sony PRS-T1
Stock Sony PRS-T1
Sony-PRS-T1 Bottom
Sony-PRS-T1 Bottom
Sony-PRS-T1 Back
Sony-PRS-T1 Back

Sony Reader Wi-Fi (PRS-T1) 

Made by: Sony
Released: October 2011
Predecessor: None
Languages Supported: English
File Types Supported: PDF, TXT, ePUB, MP3, AAC, JPG, GIF, PNG, BMP

Overview

The PRS-T1 also known as "Reader Wi-Fi" is the world's lightest 6" e-Reader with a glare-free, paper-like display designed for hours of comfortable reading, even in direct sunlight. Use your fingertips to select a title, turn the page or zoom in and out. Wirelessly shop books, magazines and newspapers at Reader™ Store and get instantaneous access to websites like Wikipedia® and Google™ search.


Features direct access to public libraries in several countries. Uses E-Ink® Pearl V220 glare-free screen. Includes 12 Built-in Dictionaries with 2 English and 10 others with to and from French, German, Spanish, Dutch and Italian. Reader allows you to write on the page or highlight text as you would in a real book using your finger or a supplied stylus for Note taking.


The USB port supports mounting as a USB Mass Storage Device, and allows for syncing to Sony Reader for PC and Sony Reader for Mac. Installers for these are included.

Specifications

Color: White, black or red.
Size: 173 x 110 x 8.9mm (6 7/8 x 4 3/8 x 3/8 inches).
Weight: 168g (5.9oz).
Display: 6" E-Ink Pearl™ with Clear Touch Infrared Technology 16 level grayscale.
    Resolution: 600 x 800 pixels 167ppi.
Operating Temperature: 5°C to 35°C (41°F to 95°F).
Memory Size: Internal: 2 GB Approx. 1.3 GB after initial setting.
    External: Micro SD card up to 32GB.
DRM Support: Adobe on ePub and PDF. ePub support is OPS 2.0, PDF is version 1.6.
MP3 Support: No DRM.
    Bit Rate: 8 to 320 kbps.
    Sampling Frequency: 8 to 48 kHz.
AAC Support: .mp4, .m4a (not raw AAC) no DRM.
Power: Built-in rechargeable battery: 3.7 V DC 1000mAh.
    Battery Life (Approx) : A single charge lasts over one month with wireless off based upon a half-hour of daily reading time.; Read on a single battery charge for 3-4 weeks with wireless on.; Up to 14,000 continuous page turns when reading only. Recharging Time: Fully charges in approximately 2 hours via the approved U.S. power adapter. Approx. 2.5 hours supports charging from your computer via the included USB 2.0 cable.
Wireless/Networking:
    Wi-Fi: Atheros AR6003 IEEE 802.11b/g/n (not 5GHz).
    Wireless Security: WEP (Open System), WEP (Shared Key), WPA-PSK (TKIP), WPA-PSK (AES), WPA2-PSK (TKIP), WPA2-PSK (AES).

Details

Micro USB port
In the Box
    Quick Start Guide, Warranty, Audio tips
    Important Product Information
    USB 2.0 (micro to standard) Cable
    Stylus Pen

Unofficial Details

Android 2.2.1-based
256MB RAM
800MHz Freescale ARMv7 CPU
Freescale MX50 board

Applications Included

eBook Reader - Supports dictionary lookup, notes, bookmarks, highlighting.
Music Player
Photo Viewer
Web Browser
Text Memo Maker
Handwriting Program - Supports freehand drawing.
eBook, periodical purchasing - Sony Reader store, provides access to Public Domain Google 
    books as well.
Overdrive App - Browse and checkout Public Library books in the USA, UK.

Firmware Updates

Sony has released several firmware updates for the T1, which are all installed using the provided Sony Reader for PC/Sony Reader for Mac desktop software. 

1.0.00.09010 - Installed on some shipping models.
1.0.00.09270 - Installed on some shipping models.
1.0.02.10280 - Released on 17 November 2011, installed on some shipping models.
1.0.03.11140 - Released on 9 December 2011.
1.0.04.12210 - Released on 27 January 2012.
1.0.05.11130 - Released on 26 November 2012.
1.0.06.03210 - Released on 27 March 2014.
1.0.07.05070 - Released on 19 June 2014.

Hardware

PCB PRS-T1/G1 M5047 1-884-610-12 BW1118073202953 Cast 2012/05/05A
https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals
https://fccid.io/AK8PRST1/

MCIMX508CVK8B NXP i.MX50 32-bit MPU, ARM Cortex-A8 core, 800MHz, MAPBGA 416.
https://www.nxp.com/docs/en/user-guide/IMX50SDG.pdf

K4X2G323PC-8GD8 Samsung DRAM Chip Mobile LPDDR SDRAM 256Mbit 64Mx32 90-Pin FBGA

SDIN5D1-2G SanDisk e.MMC 2GB 4.41 BGA
https://datasheet.octopart.com/SDIN5D1-2G-SanDisk-datasheet-10977782.pdf

F0513A Renesas MCU 8-bit 78K0 SISC 32KB Flash 5V 44-Pin LQFP (SDCard Controller?)
https://www.renesas.com/us/en/document/mah/78k0kx2-users-manual-hardware-r01uh0008ej040178k0kx2

WM8321G Wolfson Processor Power Management Subsystem (PMIC)
https://pdf1.alldatasheet.com/325b8904-4044-407c-9988-42ce4c2dfbf4

CS42L52-CNZ Cirrus Logic Low-power, Stereo CODEC w/ Headphone & Speaker Amps
https://statics.cirrus.com/pubs/proDatasheet/CS42L52_F2.pdf

3611 WC120 Atheros 6k (6003)
https://cdn.datasheetspdf.com/pdf-down/A/R/6/AR6003-Atheros.pdf
https://developer.ridgerun.com/wiki/index.php/Atheros_AR6003_SDIO_WiFi_Integration

TPS65180 Texas Instruments PMIC for E Ink® Vizplex™-Enabled Electronic Paper Display
https://www.ti.com/lit/ds/symlink/tps65181.pdf?ts=1653836738327

6 inch E-ink LCD (PRS-T1/NOOK Simple) ED060SCE (LF)C1 RET60C4026(C118) E4K0C6B82M4VS5374AY -2.46
https://essentialscrap.com/eink/ED060SC4V2.pdf

PVI6inchC118C

PVI, Prime View International, in Taiwan, is very close to owning the E-Ink technology very soon, I think the contract will be signed this month between CEO Scott Liu in Taiwan and the E-Ink people in Boston. One thing I found in researching PVI is that it is part of an old Taiwan paper company called The Yuen Fong Yu Group, that started ops in 1935 during the Japanese occupation of Taiwan island (1895-1945). The founders were Taiwanese and the owners still are. Yuen Fong Yu means "Forever Wealth Remnants" in a loose translation of the three Mandarin words, and the company name might mean something like "Remnants of Infinite Prosperity." E-Ink will be in good hands in Taiwan, and PVI looks poised to hit the bigtime globally, since 90 percent of all e-readers use the E-Ink technology.

The parent company used to make toilet paper, and still does I believe. If you google the parent name "Yuen Fong Yu Group" you can see their website in English and Chinese.   

VM15AB LMV65 National Semiconductor  LMV65x 12-MHz, Low Voltage (5V?), Low Power Amplifiers
https://www.ti.com/lit/ds/symlink/lmv651.pdf?ts=1653838936815

2 x HC4067B 16-channel analog multiplexer/demultiplexer
https://www.ti.com/lit/ds/symlink/cd74hc4067.pdf?ts=1653837700828

LIS1476MHPPC(SY6) 1-853-104-11 Sony 01 W US304362 3.7V 3.6Wh 1500mA Max Charge 4.30V
https://www.aliexpress.c o m/item/2251832682904150.html

Install Debian 11 Build Environment

su - to load env (binary folders etc) su -

Give sudo to the user usermod -a -G sudo username

Reload your terminal permissions by su username su username

Install building items

sudo apt install git linux-headers-$(uname -r) build-essential ncurses-dev docker curl debootstrap qemu qemu-utils qemu-user-static binfmt-support imagemagick vim u-boot-tools lzop

sudo modprobe binfmt_misc

Enable i386 package installation support

sudo dpkg --add-architecture i386
sudo apt-get update
gcc-multilib is the package which will enable running 32bit (x86) binaries on 64bit (amd64/x86_64) system.
sudo apt-get install gcc-multilib
sudo apt-get install zlib1g:i386

Discord

sudo apt install snapd
sudo snap install core
snap install discord
Join InkBox Discord
https://discord.gg/KyK4dQyuSe

Sony Source Code For Readers

https://oss.sony.net/Products/Linux/Audio/category03.html

PRS-T1 Source Code

https://oss.sony.net/Products/Linux/Audio/PRS-T1JP_20140702.html

Start

Open Terminal

Make a directory under users home directory to do all the compilation.

mkdir ~/code

SDCard Prep

Thanks to Petteri whom originally created this SDCard boot package. 

cd ~/code
wget https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
tar -xvf https://jpa.kapsi.fi/stuff/other/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
sudo dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress

Backup link: https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin

GCC for Cross Compiling

cd ~/code

wget https://github.com/onyx-intl/toolchain/raw/master/imx508/gcc-4.4.4-glibc-2.11.1-multilib-1.0.tar.gz

tar -xvf gcc-4.4.4-glibc-2.11.1-multilib-1.0.tar.gz

mv opt/freescale /opt/
cd /opt/freescale/usr/local/gcc-4.4.4-glibc-2.11.1-multilib-1.0/arm-fsl-linux-gnueabi/bin
export PATH="${PATH}:${PWD}"
sudo chmod -R 755 /opt

BusyBox Compiling

cd ~/code

wget https://busybox.net/downloads/busybox-1.32.1.tar.bz2
tar -xvf busybox-1.32.1.tar.bz2
mv busybox-1.32.1 busybox

cd busybox

Add stripped down .config to busybox directory from NiMa/TuxLinux

Save this below as .config in the root of the busybox directory. 

make menuconfig

Note: This is already set in the .config above but run menuconfig anyways and exit save so you don’t get all these y/n questions depending on the busybox version you are using. It will fix these for you doing that.

Under Settings enable with an asterisk (spacebar):

[*] Build static binary (no shared libs) (NEW)

Fix Sync Error

sync.c:(.text.sync_main+0x5c): undefined reference to syncfs

man syncfs

VERSIONS



  	syncfs()  first  appeared  in Linux 2.6.39; library support was added to glibc in version
  	2.14.


config FEATURE_SYNC_FANCY [=n] (Don’t disable actual sync just the fancy option under it)

Under Coreutils => Sync => Remove the asterisk (Spacebar) =>

[ ]   Enable -d and -f flags (requires syncfs(2) in libc)

Exit Exit Save Yes


Fix DADFAILED Error

Note: Fixed in newer versions but if not. 

networking/libiproute/ipaddress.c:345: error: 'IFA_F_DADFAILED' undeclared (first use in this function)

vi ~/code/busybox/networking/libiproute/ipaddress.c

Find DADFAILED around line 345 

if (ifa_flags & IFA_F_DADFAILED) {
  ifa_flags &= ~IFA_F_DADFAILED;
  printf("dadfailed ");
}

Change to:

#ifdef IFA_F_DADFAILED
if (ifa_flags & IFA_F_DADFAILED) {
  ifa_flags &= ~IFA_F_DADFAILED;
  printf("dadfailed ");
}
#endif

Make Busybox Install

make V=1 ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) install

If you see this last message at the end then hopefully everything went fine. 

chmod a+x busybox
DO_INSTALL_LIBS="" \
    /bin/sh /home/nonasuomy/code/busybox/applets/install.sh "./_install" --symlinks
  ./_install//bin/ash -> busybox
  ./_install//bin/base64 -> busybox
  ./_install//bin/cat -> busybox
  ./_install//bin/chattr -> busybox
  ./_install//bin/chgrp -> busybox
  ./_install//bin/chmod -> busybox
  ./_install//bin/chown -> busybox
  ./_install//bin/cp -> busybox
  ./_install//bin/cttyhack -> busybox
  ./_install//bin/date -> busybox
  ./_install//bin/dd -> busybox
  ./_install//bin/dmesg -> busybox
  ./_install//bin/echo -> busybox
  ./_install//bin/false -> busybox
  ./_install//bin/grep -> busybox
  ./_install//bin/kill -> busybox
  ./_install//bin/ln -> busybox
  ./_install//bin/login -> busybox
  ./_install//bin/ls -> busybox
  ./_install//bin/lsattr -> busybox
  ./_install//bin/mkdir -> busybox
  ./_install//bin/mknod -> busybox
  ./_install//bin/mount -> busybox
  ./_install//bin/mv -> busybox
  ./_install//bin/pidof -> busybox
  ./_install//bin/ping -> busybox
  ./_install//bin/ps -> busybox
  ./_install//bin/pwd -> busybox
  ./_install//bin/rm -> busybox
  ./_install//bin/sed -> busybox
  ./_install//bin/sh -> busybox
  ./_install//bin/sleep -> busybox
  ./_install//bin/stat -> busybox
  ./_install//bin/sync -> busybox
  ./_install//bin/touch -> busybox
  ./_install//bin/true -> busybox
  ./_install//bin/umount -> busybox
  ./_install//bin/uname -> busybox
  ./_install//bin/vi -> busybox
  ./_install//linuxrc -> bin/busybox
  ./_install//sbin/devmem -> ../bin/busybox
  ./_install//sbin/fsck -> ../bin/busybox
  ./_install//sbin/getty -> ../bin/busybox
  ./_install//sbin/halt -> ../bin/busybox
  ./_install//sbin/ifconfig -> ../bin/busybox
  ./_install//sbin/ifdown -> ../bin/busybox
  ./_install//sbin/ifenslave -> ../bin/busybox
  ./_install//sbin/ifup -> ../bin/busybox
  ./_install//sbin/init -> ../bin/busybox
  ./_install//sbin/insmod -> ../bin/busybox
  ./_install//sbin/losetup -> ../bin/busybox
  ./_install//sbin/lsmod -> ../bin/busybox
  ./_install//sbin/poweroff -> ../bin/busybox
  ./_install//sbin/reboot -> ../bin/busybox
  ./_install//sbin/rmmod -> ../bin/busybox
  ./_install//sbin/route -> ../bin/busybox
  ./_install//sbin/run-init -> ../bin/busybox
  ./_install//sbin/watchdog -> ../bin/busybox
  ./_install//usr/bin/[ -> ../../bin/busybox
  ./_install//usr/bin/[[ -> ../../bin/busybox
  ./_install//usr/bin/awk -> ../../bin/busybox
  ./_install//usr/bin/cut -> ../../bin/busybox
  ./_install//usr/bin/env -> ../../bin/busybox
  ./_install//usr/bin/fold -> ../../bin/busybox
  ./_install//usr/bin/free -> ../../bin/busybox
  ./_install//usr/bin/fuser -> ../../bin/busybox
  ./_install//usr/bin/killall -> ../../bin/busybox
  ./_install//usr/bin/lsof -> ../../bin/busybox
  ./_install//usr/bin/mkfifo -> ../../bin/busybox
  ./_install//usr/bin/nc -> ../../bin/busybox
  ./_install//usr/bin/nohup -> ../../bin/busybox
  ./_install//usr/bin/nproc -> ../../bin/busybox
  ./_install//usr/bin/printf -> ../../bin/busybox
  ./_install//usr/bin/reset -> ../../bin/busybox
  ./_install//usr/bin/rx -> ../../bin/busybox
  ./_install//usr/bin/sha256sum -> ../../bin/busybox
  ./_install//usr/bin/sort -> ../../bin/busybox
  ./_install//usr/bin/split -> ../../bin/busybox
  ./_install//usr/bin/test -> ../../bin/busybox
  ./_install//usr/bin/timeout -> ../../bin/busybox
  ./_install//usr/bin/tr -> ../../bin/busybox
  ./_install//usr/bin/unlink -> ../../bin/busybox
  ./_install//usr/bin/xxd -> ../../bin/busybox
  ./_install//usr/bin/yes -> ../../bin/busybox
  ./_install//usr/sbin/chroot -> ../../bin/busybox
  ./_install//usr/sbin/fbset -> ../../bin/busybox
  ./_install//usr/sbin/fdformat -> ../../bin/busybox
  ./_install//usr/sbin/i2cdetect -> ../../bin/busybox
  ./_install//usr/sbin/i2cdump -> ../../bin/busybox
  ./_install//usr/sbin/i2cget -> ../../bin/busybox
  ./_install//usr/sbin/i2cset -> ../../bin/busybox
  ./_install//usr/sbin/i2ctransfer -> ../../bin/busybox
  ./_install//usr/sbin/ifplugd -> ../../bin/busybox


--------------------------------------------------
You will probably need to make your busybox binary
setuid root to ensure all configured applets will
work properly.
--------------------------------------------------

If busybox needs to be smaller to fit in the same DD space the prior kernel used (2.2MB) use the UPX tool. 

upx --ultra-brute _install/bin/busybox

                   	Ultimate Packer for eXecutables
                      	Copyright (C) 1996 - 2020
UPX 3.96    	Markus Oberhumer, Laszlo Molnar & John Reiser   Jan 23rd 2020

    	File size     	Ratio  	Format  	Name
   --------------------   ------   -----------   -----------
   1396208 ->	582216   41.70%	linux/arm	busybox                  	 

Packed 1 file.

cd ~/code/busybox/_install
mkdir -p etc/init.d/

vi etc/init.d/rcS

#!/bin/sh

mkdir -p /sys /proc /dev
mount -t sysfs sysfs /sys
mount -t proc proc /proc
mount -t devtmpfs devtmpfs /dev

/bin/sh

chmod +x ~/code/busybox/_install/etc/init.d/rcS

Boot the Stock SDCard Image then grab platform-tools and connect to ADB Shell

https://developer.android.com/studio/releases/platform-tools#downloads

With the device connected via USB run:

adb shell

At the prompt # check out the permissions of /dev/ttymxc4 

ls -l /dev/ttymxc4
crw------- root 	root 	207,  20 2010-01-01 02:00 ttymxc4

Copy the 207 20 to the ttymxc4 mknod value below.

Note: Do not put / in front of your dev folders on the following mknod commands or you will create them in your systems dev folder instead of the busybox/_install/dev/ folder. 

cd ~/code/busybox/_install
mkdir dev
sudo mknod dev/console c 5 1
sudo mknod dev/null c 1 3
sudo mknod dev/ttymxc4 c 207 20

Kernel Compile

cd ~/code

wget https://prodgpl.blob.core.windows.net/download/Audio/common/2UrziX9Zanih0kfZRY4U3Q/linux-2.6.35.2-20140522-2.tgz

tar -xvf linux-2.6.35.2-20140522-2.tgz

cd ~/code/linux-2.6.35.2

vi ~/code/linux-2.6.35.2/.config

Paste the kernel config below. 

:wq

make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- menuconfig

Device drivers -> Block devices 

<*> RAM block device support

General setup 

[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support

Change Initramfs source file(s) path to

~/code/busybox/_install

Turn on Support initial ramdisks compressed using LZMA

Exit General setup

Go into Boot options

Delete everything in the kernel command string:

noinitrd console=ttymxc0,115200 root=/dev/mtdblock2 rw rootfstype=jffs2 ip=off

Change to this

console=ttymxc4,115200 rawtable=0xF40000 root=/dev/ram0 rdinit=/sbin/init rootfstype=ramfs

Then enable 

[*]Always use the default kernel command string"

Exit Boot Options

Exit Main Menu then save yes.

Fix timeconst.pl issue

Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at kernel/timeconst.pl line 373.
make[1]: *** [/home/nonasuomy/code/linux-2.6.35.2/kernel/Makefile:138: kernel/timeconst.h] Error 255
make: *** [Makefile:884: kernel] Error 2

vi kernel/timeconst.pl

Go to line 373

replace

if (!defined(@val)) {

with

if (!@val) {

make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabi- -j$(nproc) uImage EXTRA_CFLAGS=-fno-pic modules

If you see this message everything is golden ponyboy. 

  UIMAGE  arch/arm/boot/uImage
Image Name:   Linux-2.6.35.3
Created:  	Sun May 15 18:07:18 2022
Image Type:   ARM Linux Kernel Image (uncompressed)
Data Size:	2274788 Bytes = 2221.47 KiB = 2.17 MiB
Load Address: 70008000
Entry Point:  70008000
  Image arch/arm/boot/uImage is ready

After the kernel is compiled (make), three files will be generated, one Image, one zImage, and one uImage. Image is a kernel image file, zImage is a kind of image compression file of the kernel, Image is about 4M, and zImage is less than 2M.

uImage is a special image file for uboot. It adds a 64-byte "header" before zImage, indicating the kernel version, loading location, generation time, size and other information; it is no different from zImage after 0x40 (64Bytes).

The 64-byte header structure is as follows: 

typedef struct image_header {
  uint32_tih_magic;
  uint32_tih_hcrc;
  uint32_tih_time;
  uint32_tih_size;
  uint32_tih_load;
  uint32_tih_ep;
  uint32_tih_dcrc;
  uint8_tih_os;
  uint8_tih_arch;
  uint8_tih_type;
  uint8_tih_comp;
  uint8_tih_name[IH_NMLEN];
} image_header_t;

Image name: Linux-2.6.35.3 Created: Wed May 18 22:58:37 2022 Image type: ARM Linux Kernel (uncompressed) Data size: 2301200 Bytes Load Address: 0x70008000 Entry Point: 0x70008000 Header CRC: 0x2023fef1 ... OK Data CRC: 0x58d9686

Therefore, both uImage and zImage are compressed kernel images. And uImage is made from zImage with the mkimage tool. The mkimage tool is introduced as follows:

The mkimage tool in u-boot is used to generate uImage (u-boot source code package/tools/mkimage.c)

Here to explain the meaning of the parameters 

-A ==> Set architecture to 'arch'
-O ==> Set operating system to 'os'
-T ==> Set image type to'type' "kernel or ramdisk"
-C ==> Set compression type 'comp'
-a ==> Set load address to 'addr' (hex)
-e ==> Set entry point to'ep' (hex) (check the complete kernel impression at this location when the kernel is started)
-n ==> Set image name to 'name'
-d ==> Use image data from 'datafile'
-x ==> Set XIP (execute in place, that is, do not copy the file, execute at the current location)

For ARM linux kernel image usage 

-A arm ------------ The architecture is arm 
-O linux ---------- The operating system is linux
-T kernel --------- The type is kernel
-C none/bzip/gzip - Compression type
-a 20008000 ------- Image of the load address (hex), typically 0xX00008000
-e 200080XX ------- Kernel entry address (hex), XX to 0x40 or 0x00
-n linux-XXX ------ Image name, arbitrary
-d nameXXX -------- Image file name without header information, your source kernel file
uImageXXX --------- Image file name with header information added

SDCard Prep # 2

Flash the customized kernel over the kernel space via dd 

sudo dd if=~/code/linux-2.6.35.2/arch/arm/boot/uImage of=/dev/mmcblk0 bs=512 seek=2048
sudo sync

Two Methods to Alter Device U-Boot ENV

Hardware UART Way

Take the device apart and connect the USB to 3.3V TTL Adapter to GND TX RX





USB to UART Adapter

Cheap Adapter 3.3/5V (Sony PRS-T1 UART is 3.3V)

https://www.aliexpress.c o m/item/32273550144.html

Expansive Adapter (Multiple voltages to hack even more devices not just the Sony)

https://www.aliexpress.c o m/item/1005003309224312.html

Connect With Putty (Windows)

Serial COM4 115200

Connect With Minicom (Linux)

minicom -D /dev/ttyUSB0

CTRL + A then Z

Then O (cOnfigure Minicom..O)

[Configuration]
Serial port setup
A - Serial Device : /dev/ttyUSB0
E - Bps/Par/Bits : 115200 8N1
F - Hardware Flow Control : No

Modem and dialing (Clear all these settings)
A - Init string .........                                         	 
B - Reset string ........                                         	 
C - Dialing prefix #1....                                         	 
D - Dialing suffix #1....                                         	 
E - Dialing prefix #2....                                         	 
F - Dialing suffix #2....                                         	 
G - Dialing prefix #3....                                         	 
H - Dialing suffix #3....                                         	 
I - Connect string ......   	
K - Hang-up string .....                           	 
L - Dial cancel string ..

Screen and keyboard (Change BS to DEL) 

B - Backspace key sends	: DEL

Save setup as minicomsettings 

initialize Modem...M

To hangup press CTRL + A, Z 

Hangup.............H
U-Boot Access

Spam any key on your keyboard to get to the U-Boot Prompt. 

U-Boot 2009.08 (Sep 27 2011 - 09:33:22)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock 	: 66666666Hz
ipg per clock : 66666666Hz
uart clock	: 24000000Hz
ahb clock 	: 133333333Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock	: 100000000Hz
ddr clock 	: 160000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C:   ready
DRAM:  256 MB
MMC:   FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 27
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In:	serial
Out:   serial
Err:   serial
Net:   got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot:  0

MX50_ARM2 U-Boot >

Note: There is an external watchdog running that will reset the device every 30 seconds. Which makes it difficult to type commands in the console. Copy and paste the values to the terminal to get the job done. 

MX50_ARM2 U-Boot > printenv

Backup what it spits out to a txt file.

Change the env.

This is to boot from the SDCard image. 

setenv bootargs root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0
saveenv

MX50_ARM2 U-Boot > printenv
stdin=serial
stdout=serial
stderr=serial
ethact=FEC0
loadaddr=0x70800000
loadaddr_ramdisk=0x70C00000
bootdev=2
rawtable=0xF40000
bootargs=root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000
bootcmd=mmc read 0 ${loadaddr} 0x800 0x1400;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258;bootm ${loadaddr} ${loadaddr_ramdisk} bootdev=0

Environment size: 387/131068 bytes

Note: You can use the stock build with adb shell as in the image it has the adb driver running. 

sudo apt install adb
adb shell
#

To boot recovery from SD card 

setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'

To boot normal system from SD card 

setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'

Change this to boot the customized kernel: 

setenv bootargs ‘root=/dev/mmcblk0p1 rootfstype=ext4 rw rootwait rdinit=/linuxrc console=ttymxc4,115200 bootdev=0 rawtable=0xF40000’
setenv bootcmd mmc read 0 ${loadaddr} 0x800 0x1400\;mmc read 0 ${loadaddr_ramdisk} 0x2800 0x258\;bootm
saveenv

The device should now boot from the SDCard slot instead of the eMMC.

Recovery Mode Boot Way

Copy the uboot env from this image to a separate file: 

dd if=~/code/sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072

wget https://projects.mobileread.com/reader/users/porkupan/rupor/Releases/rescue/20121208/rupor-rescue.7z
7za e rupor-rescue.7z

Copy uboot_new.bin to Rupor Rescue SD Card, along with the other files that are already there…

SD Card Layout 

OS Firmware
|-files
| |-update.img
uboot_new.bin

Boot Rupor Rescue (Hold HOME + MENU during power on)

Remount SD Card as writable. 

mount -o remount,rw /dev/mmcblk0p1 /initrd/mnt/sd

Change directory to the SD Card mounted. 

cd /initrd/mnt/sd

Backup the old uboot env to a file. 

dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

Write a new one. 

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

Reset device and it should now be booting to the SD Card image.

After that it should boot (in normal mode) from the SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".


RANDOM STUFF

Original Stock Boot Log

Customized Kernel Boot Log

Binwalk

~/code$ binwalk -B sd_card_PRS-T1_1.0.07_adb_enabled.bin

Watchdog Stuff

WM8321G Address R16388(4004h) Watchdog, Bit 14 WDOG_DEBUG, Default 0, Watchdog Pause 0=Disable 1=Enabled (halts the watchdog timer for system debugging) Protected by user key

This would show if you can't modify the watchdog bit without the code i2c dev 0 i2c probe i2c md.w 0x34 0x4008 -> default value is 0x0000

We have to write a magic value 0x9716 to this register, to allow writes to WDOG_DEBUG etc. MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4008 0x9716

Print out the bit set for 4004 MX50_ARM2 U-Boot > i2c md.w 0x34 0x4004

Then you should be abled to activate the watchdog debug mode MX50_ARM2 U-Boot > i2c mm.w 0x34 0x4004 (change bit 14 of whatever you get from above to 1)

Backup / Restore

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024 
sync 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
sync

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
sync 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024 
sync

#!/bin/sh 

PATH=/diag/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin 

mount -t vfat -o rw,shortname=winnt /dev/mmcblk0p1 /initrd/mnt/sd 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp 
sleep 3 

# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading.bmp 
# sleep 3 

# # Reading 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/old.ramdisk.uimg skip=10240 count=600 bs=512 
# # sync 
# # dd if=/dev/mmcblk2 of=/ initrd/mnt/sd/old.nboote.bin skip=30720 count=256 bs=512 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Id.img skip=15872 count=128 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
# # sync
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/SN_OLD.img skip=15872 count=1 bs=1024 
# # sync 
# # dd if=/dev/mmcblk2 of=/initrd/mnt/sd/mmcblk2.img 
# # sync 
# # dd if=/dev/mmcblk2p1 of=/initrd/mnt/sd/mmcblk2p1.img 
# # sync 
# # dd if=/dev/mmcblk2p2 of=/initrd/mnt/sd/mmcblk2p2.img 
# # sync 
# # dd if=/dev/mmcblk2p3 of=/initrd/mnt/sd/mmcblk2p3.img 
# # sync 
# # dd if=/dev/mmcblk2p4 of=/initrd/mnt/sd/mmcblk2p4.img 
# # sync 
# # dd if=/dev/mmcblk2p5 of=/initrd/mnt/sd/mmcblk2p5.img 
# # sync 
# # dd if=/dev/mmcblk2p6 of=/initrd/mnt/sd/mmcblk2p6.img 
# # sync
# # dd if=/dev/mmcblk2p7 of=/initrd/mnt/sd/mmcblk2p7.img 
# # sync 
# # dd if=/dev/mmcblk2p8 of=/initrd/mnt/sd/mmcblk2p8.img 
# # sync 
# # dd if=/dev/mmcblk2p9 of=/initrd/mnt/sd/mmcblk2p9.img 
# # sync 
# # dd if=/dev/loop0 of=/initrd/mnt/sd/loop0.img 
# # sync 

# /diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Reading_done.bmp 
# sleep 3 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing.bmp 
sleep 3 

Writing 
dd if=/initrd/mnt/sd /new.mmcblk2p4.img of=/dev/mmcblk2p4 conv=notruc 
sync 
dd if=/initrd/mnt/sd/new.mmcblk2.img of=/dev/mmcblk2 
sync 
dd if=/initrd/mnt/sd/mmcblk2p8. img of=/dev/mmcblk2p8 bs=1024 
sync
dd if=/initrd/mnt/sd/ new.mmcblk2p7.img of=/dev/ mmcblk2p7 bs=1024 
sync dd if=/initrd/mnt/sd/mmcblk2p9.img of=/dev/mmcblk2p9 bs=1024 sync cd /initrd/mnt/sd/ /diag/bin/version_check.sh > /initrd/mnt/sd/version.txt # mkfs.ext4 /dev/mmcblk2p6 -L dictionaries # mkfs.ext4 -m 0 -L data /dev/mmcblk2p8 # /diag/bin/epd_fb_test gettemp > /initrd/mnt/sd/epd_fb_test.txt # sync # dmesg > / initrd/mnt/sd/dmesg.txt ls -la /dev > /initrd/mnt/sd/dev.txt # /diag/bin/device_id.sh > /initrd/mnt/sd/device-id.txt # /diag /bin/serial_number.sh > /initrd/mnt/sd/serial_number.txt

# cat /sys/module/rawdatatable/parameters/rawdata_param > /initrd/mnt/sd/rawdata_param.txt 
# cat /sys/module/rawdatatable/parameters/partition_param > /initrd/mnt/sd/partition_param.txt 
# sync 

# cat /proc/cpuinfo > /initrd/mnt/sd/cpuinfo.txt 
# cat /proc/meminfo > /initrd/mnt/sd/meminfo.txt 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Writing_done. bmp 
sleep 3 

/diag/bin/epd_fb_test file GC16 FULL /initrd/mnt/sd/Updating_en.bmp 
sleep 3 

# /sbin/getty -L 9600 ttyGS0 vt102

Raw Data Parameters

cat /sys/module/rawdatatable/parameters/rawdata_param 

MBR :0x00000000:0x00000400
uBoot :0x00000400:0x000bfc00
Boot Env :0x000c0000:0x00020000
Reserved1 :0x000e0000:0x00020000
Normal Kernel :0x00100000:0x00400000
Normal Rootfs :0x00500000:0x00100000
Recovery Kernel :0x00600000:0x00400000
Reserved2 :0x00a00000:0x00500000
Normal Boot Env :0x00f00000:0x00020000
Recovery Boot Env :0x00f20000:0x00020000
Raw Data Table :0x00f40000:0x00020000
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000

Bytes in Decimal 

MBR :0:1024
uBoot :1024:785408
Boot Env :786432:131072
Reserved1 :917504:131072
Normal Kernel :1048576:4194304
Normal Rootfs :5242880:1048576
Recovery Kernel :6291456:4194304
Reserved2 :10485760:5242880
Normal Boot Env :15728640:131072
Recovery Boot Env :15859712:131072
Raw Data Table :15990784:131072
Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880

rawdatatable.h 

#define RAWLABEL_BOOTIMAGE	"Boot Image"
#define RAWLABEL_WAVEFORM	"Waveform"
#define RAWLABEL_INFO		"Info"
#define RAWLABEL_ID			"Id"
#define RAWLABEL_LOG		"LOG"

If this table says: 

Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000

Hex to Decimal 

Info :16121856:131072
Id :16252928:131072
Reserved3 :16384000:393216
Boot Image :16777216:1048576
Waveform :17825792:2097152
LOG :19922944:5242880

How do you compute these values of dd to the above? 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/WF_OLD.img skip=17408 count=2048 bs=1024 
sync

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 
sync

Waveform to Decimal: 17825792Bytes : 2097152Bytes

skip=17408Blocks. Skip 17408 ibs-sized blocks at start of input

bs=1024Bytes. Read and write up to BYTES bytes at a time (default: 512);overrides ibs and obs

count=2048Blocks. Copy only 2048 input blocks

Starting Point of DD Copy
17408Blocks * 1024Bytes = 17825792Bytes ☑️ 

Count
2048Blocks * 1024Bytes = 2097152Bytes
17825792Bytes + 2097152Bytes = 19922944Bytes ☑️

Next Data Point
LOG :19922944 ☑️:5242880

The second number is how many bytes added to the starting point

So now we can see where VCOM is ripped from 

dd if=/dev/mmcblk2 of=/initrd/mnt/sd/Vcom_OLD.img skip=15876 count=1 bs=1024 

skip=15876
count=1 
bs=1024 
VCOM Start: 15876 * 1024 = 16257024
1*1024 = 1024
VCOM End: 16257024 + 1024 = 16258048

Id :0x00f80000:0x00020000
Id :16252928:131072

Therefore VCOM is inside Id of the 26MB Raw Data Area 

Id Start:   16252928

VCOM Start: 16257024
BW1118073202953
BU1156245100493
148427352023999
PVI6inchC118C
60
2460
AudioOK
2012/05/21-14:53:11
VCOM End:   16258048

Id End:     16384000

PRS-T1          UC,CEW^@^@^@^@^@^@^@^@^@^@0800461001BB6D47148427352023999.PRST1^

f_mass_storage.c

/* string buffer for SCSI Inquiry product base name */
static	char	_scsi_inquiry_product_name[] = "PRS-XXX ";
#define	STRING_PRODUCT_EMMC_ID_OFFSET		(0x00)
static	char	_scsi_inquiry_sku_name[] = "        ";
#define	STRING_SKU_EMMC_ID_OFFSET			(0x10)

STRING_PRODUCT_EMMC_ID_OFFSET 0x00 PRS-T1 “PRS-XXX”
STRING_SKU_EMMC_ID_OFFSET 0x10 UC,CEW (US) Also RU JP
"        "
android.c
/* string buffer for "iSerial" */
static	char	_usb_string_descriptor_iSerial[] = "000000000000000";
#define	STRING_SERIAL_EMMC_ID_OFFSET		(0x30)


STRING_SERIAL_EMMC_ID_OFFSET 0x30 148427352023999

mkdir -p /mount/p7;mount /dev/mmcblk0p7 /mount/p7;cd “/mount/p7/Sony_
Reader/”

Interesting Links

https://www.mobileread.com/forums/showthread.php?t=178248

https://www.mobileread.com/forums/showthread.php?p=2207783#post2207783

https://www.mobileread.com/forums/showthread.php?t=165938

https://gitlab.com/phreakuencies/prstux/

https://web.archive.org/web/20121010183954/http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMXANDROID

https://community.nxp.com/t5/i-MX-Processors/New-Android-R10-3-2-Patch-BSP-for-i-MX51-and-i-MX53-blog-archive/m-p/207936

https://forum.doozan.com/read.php?2,126699

https://www.mobileread.com/forums/showthread.php?t=329270

https://projects.mobileread.com/reader/users/porkupan/

https://www.sony.ca/en/electronics/support/reader-digital-book-prs-t-series/prs-t1/manuals

https://archive.org/download/sd_card_PRS-T1_1.0.07_adb_enabled.bin/sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz

https://archive.org/details/sd_card_PRS-T1_1.0.07_adb_enabled.bin

Retrieved from "https://inkbox.ddns.net/wiki/index.php?title=Sony_PRS-T1&oldid=72"