NOR

From AVIC Hacking
Jump to navigation Jump to search

NOR flash contents[edit | edit source]

Head unit's NOR flash memory (8 MB) is located on daughter board near main SOC and mapped to three different devices in Android:

/dev/mtd/mtd0[edit | edit source]

mtd0 flash region map:

Address   Size
0x000000, 0x0FFE00 // bootloader code
0x0FFE00, 0x000200 // looks like bootloader 512-byte header from fimrware PRG file
0x100000, 0x010000 // model info side A
0x110000, 0x010000 // model info side B
0x120000, 0x010000 // part of opening data PRG file header
0x130000, 0x120000 // opening data
0x250000, 0x010000 // bsp side a
0x260000, 0x010000 // bsp side b

/dev/mtd/mtd1[edit | edit source]

mtd1 contains filesystem mounted to /mnt/backup_flash/ with back.cfg file inside. This file contains device-specific configuration (touchscreen calibration for example)

/dev/mtd/mtd2[edit | edit source]

mtd2 contains EasyRecovery image (linux kernel + additional files + EasyRecovery executable + android toolbox). This image is loading then u-boot bootloader is unable to start kernel from internal sd card.

Writing data to NOR flash[edit | edit source]

To write data to NOR memory you can use simple dd command, for example:

dd if=/mnt/udisk/new.img of=/dev/block/mtdblock0 seek=2424832 count=84 bs=1

but before you can write you must erase NOR flash region using ioctl command:

/system/bin/ioctl -l 8 -a 4 /dev/mtd/mtd0 1074285826 2424832 65536

Where 2424832 is start address, 65536 is memory erase block size. Looks like both this values must be multiple of 0x10000 (Address is aligned to 0x10000 boundary, size is multiple of 0x10000), at least original firmware uses this alignment.