Tuesday, March 1, 2011

Unbricking Gome/Fake FlyTouch Android tablet

By Syahmi 11:00 AM , , , , , , 31 comments
Update2:
See this post too: http://write-code.blogspot.com/2012/08/parallel-port-spi-flash-programmer-and-unbrick-wm8650.html
 Update:
This blog post about total bricked Fake Flytouch - bootloader failed to start. If the devices turned on, the Blue LED will lit but the screen will remain black.
If you flash the wrong firmware, it might not fully bricked. Try to flash with new firmware, see comment post for the download link.

Introduction:
I bricked Gome/Fake? FlyTouch when upgrade its firmware by accidentally removing microSD card when upgrading w-load/u-boot in process. I don't know the exact name as the device itself doesn't have anything written on it except MID written on box.
It looks exactly like in this post: http://www.androidtablets.net/forum/gome-flytouch/1411-help-detecting-model-device-2-6-29-00236-g4f8dbbb-dirty.html#post8372

 

Reading through this thread, i found an interesting post about using LPT or Parallel port to reflash the bootloader IC using SPIPGM by Martin Rehak/RayeR. The SPIPGM can be found here: http://rayer.ic.cz/programm/programm.htm#SPIPGM



So, I begin disassemble FlyTouch by following this youtube video:

Then, I take out the cpu daughter board and begin identifying the chip needed to desolder. The chips have marking F40-100GCP (You can see the picture below). I just use a soldering iron and a solder suction as I don't have anything like hot-air station/solder wick. Before desolder, I use some kind of heatsink to protect the IC from being damaged by excessive solder heat.

The result

As you can see, I damaged the PCB! PCB traces peeled off. So if you want to desolder, make sure not to apply too much heat on the PCB.

Then, I start wiring the IC to the LPT according to the circuit diagram posted on RayeR's website: http://rayer.ic.cz/elektro/spipgm/spipgm.gif


Then, launch spipgmw.exe /i to identify the chip but it wont recognize and show parity Error. I recheck the connection, change the resistor and capacitor... then tried again... still no. After few days struggle with this, I found out bad connection between the chips and wire. So I changed by soldering the chips and use alligator clips instead.




The chips identified as EON EN25F40!, Then I tried to dump the SPI Flash by using this command
spipgmw.exe /d dump.bin

...
Dump successful!

Finally, it's time to reflash the chip. So, I made out my own binary file by combining w-load and u-boot and flash it into the chip (I cannot remember where I put the file, but you can get from here, not made by me). Before flash, it is important to erase it first.
spipgmw.exe /e
spipgmw.exe /p 4mb.bin

Then, I solder it back with new hope, Insert SD Card with new firmware and android boot!


Helpful link:
http://img840.imageshack.us/i/spipgmv2.gif/ - Circuit diagram
http://www.slatedroid.com/index.php?showtopic=5668 - De-Brick discussion
http://rayer.ic.cz/elektro/spipgm.htm - Post about spipgm
http://rayer.ic.cz/programm/programm.htm#SPIPGM - spipgm download
http://rayer.g6.cz/elektro/spipgm.htm
http://rayer.g6.cz/programm/programe.htm#SPIPGM
http://retired.beyondlogic.org/wp/4Mb_spi_flash.zip - Rom (Link updated on 19 May 2012)
http://projectgus.com/2010/08/unbricking-wm8505-based-tablets/

31 comments :

  1. AnonymousMarch 10, 2011 at 3:51 AM

    Hi, which Android ROM have you used here?

    ReplyDelete
  2. SyahmiMarch 16, 2011 at 7:23 AM

    Hi Rory, I used HcH's ROM which you can get here: http://techknow.freeforums.org/roms-f51.html

    http://www.androidtablets.net/forum/gome-flytouch-firmware/6767-rom-fake-flytouch-mid-blue-led-wmt2-1-2-2-1-1-a.html

    ReplyDelete
  3. UnknownMarch 18, 2011 at 6:42 AM

    Hello i did everything as you stated here, and i have same problems with the pins, seems no connection with the chip and wire..

    Unidentified but if i use spipgm.exe only it seems to respond!! dump flash rom success!!

    And it also responds positive to spipgm /e to erase the flash rom.

    Even when i type the /p command it starts working and reports the advance and sector writen (100%).

    Is this possible, my chip is okay this way?

    BTW chip is same as yours just spipgmw /i does not work, and it seems to work with spipgm.exe

    Let me know so i can put my chip back and try to boot with sd card

    ReplyDelete
  4. SyahmiMarch 18, 2011 at 5:37 PM

    Try to dump the rom back, if you find your dumped rom same as the rom you programmed, then its fine to put it back to its place.

    ReplyDelete
  5. nanofxApril 18, 2011 at 12:49 PM

    Hi i have similar android tablet like flytouch and i bricked it so can i send spi flash to you and you try to reprogram?

    ReplyDelete
  6. semofoMay 21, 2011 at 6:51 AM

    que tal a todos, yo lo solucione de otra forma meti una rom que me me hizo NAND FLASH, y terminar el flash la pagas inmediatamente, cargas en la sd alguna rom que si te haya funcionada en mi caso la 1.9.88 y wuala, me funciono, dure cerca de 3 meses con la tablet brikeada, cualquier cosa mi correo semofo@htmail.com

    ReplyDelete
  7. kawiwara.my.idSeptember 26, 2011 at 12:32 AM

    hi...where your locations ?

    ReplyDelete
  8. kawiwara.my.idDecember 6, 2011 at 2:44 AM

    hello any one can send me any spi flash (epproom) to indonesia ????

    ReplyDelete
  9. SyahmiDecember 6, 2011 at 6:45 AM

    Hi, Seloka.

    Do you want the new chip? - Which I don't have

    or the ROM file?
    http://www.beyondlogic.org/wp/4Mb_spi_flash.zip

    The ROM can be constructed by concatenate the two files w-load first then u-boot.

    Syahmi

    ReplyDelete
  10. kawiwara.my.idDecember 7, 2011 at 1:35 PM

    C:\Documents and Settings\dimyati\My Documents\Downloads\spipgm\SPIPGM>spipgmw.e
    xe /i

    SPI FlashROM Programmer 1.9c (C) 2008-2011 by Martin Rehak; rayer@seznam.cz
    Compiled by GCC 4.4.0 at 23:20:41, Mar 22 2011
    (Win9x/NT/2K/XP compatability)

    SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
    FlashROM JEDEC ID, type: FFFFFFh - parity error!
    Unknown manufacturer
    Status = FFh (SRP, RES, TB , BP2, BP1, BP0, WEL, BSY)
    1 1 1 1 1 1 1 1
    Status register is protected, you will need to set WP# high
    ... please help me for solutions

    ReplyDelete
  11. SyahmiDecember 7, 2011 at 2:35 PM

    Make sure the connection is good, the wire is good.

    It must be properly connected without any noise or loosen wire contact. Try change the resistor/capacitor too...

    ReplyDelete
  12. linhcentrioMay 19, 2012 at 6:04 PM

    hello i have 1 pc 128MB 2GB 300MHz Yoshima M70003 MID 7 “, it was Brick.
    spi flash chip 25Q80SCP my, can I use to load uboot-wm8505.bin 512KB.
    I know the chip is 8Mbit 25Q80SCP.
    if one bin file for this chip for my share.
    Thank you!
    linhcentrio_her0@yahoo.com

    ReplyDelete
  13. SyahmiMay 19, 2012 at 6:57 PM

    Hi linhcentrio,

    I'm not sure but you can always try it out if its not troubling you.

    If desoldering the chip was too difficult, then I recommend to find original firmware files for that tablet and find the bin file inside that package.

    For my tablet Gome Flytouch, the ROM update comes with both w-load.bin and u-boot.bin and both of this files needs to be flashed on the flash chip altogether. So I concatenated both files first before flashing.

    To concat the files, on windows you can open command prompt and type this command:
    copy /b w-load.bin+u-boot.bin flash.bin
    The new file flash.bin will be generated.

    ReplyDelete
  14. linhcentrioMay 19, 2012 at 8:54 PM

    thank you, I will try.

    ReplyDelete
  15. UnknownJune 10, 2012 at 2:18 PM

    Hi. I got a big trouble with my EPAD since when i start up my tablet it starts showing animation WMT 2.1.2_105, after, a shining text "loading"... but when it start in graphic mode i can see the desk but blured. There is a message who indicates: power off, shuting down.

    I checked the power button but it appears like ok. Any idea? it will be great. I come from other forums and Mr Google without a good thing to do. Excuse me for my english, it is not my native language. Thanks.

    ReplyDelete
  16. UnknownJune 12, 2012 at 1:00 PM

    Linhcentrio did you solve your problem? i have the same problem with my wm8505 7' netbook, i d like to know how to put uboot and wload back, and what software and connection to use.

    thanks for any help.

    ReplyDelete
  17. linhcentrioJune 19, 2012 at 9:12 PM

    I still stop at the connector. although I did like the circuit diagram but the software still does not recognize the chip.

    http://nn1.upanh.com/b4.s28.d2/f4ac7b14f00fa76eed2a98543796d1fd_46323571.spipgm25q80scp.jpg

    ReplyDelete
  18. Syahmi AzharJune 21, 2012 at 3:32 PM

    linhcentrio, makes this batch file and save it as read.bat on the same folder where spi program is
    --- SNIP ---
    @echo off
    :loop
    spipgmw /i 0 512 /d=0
    sort readme.txt > nul
    sort readme.txt > nul
    sort readme.txt > nul
    sort readme.txt > nul
    sort readme.txt > nul
    sort readme.txt > nul
    sort readme.txt > nul
    goto loop
    --- SNIP ---
    readme.txt is spi readme file for delay.

    Then open this batch file, double click and it will try to read from the ic infinitely. This will helps you "debug". Try to check the connection/wire/component until you have some reading. Fix the problem first.

    In my case the wire connection is loose and when I touch it, I have the reading but when I leave untouched, SPI program still can read but for another minute. So I have to solder it.

    After that, close batch file and then flash it.

    ReplyDelete
  19. Syahmi AzharJune 21, 2012 at 3:36 PM

    This is a new link for spipgm, http://rayer.g6.cz/programm/programe.htm#SPIPGM

    ReplyDelete
  20. linhcentrioJune 29, 2012 at 11:21 AM

    thank very much i will try it. have a good day!

    ReplyDelete
  21. SyahmiJuly 5, 2012 at 12:34 PM

    Good luck!

    ReplyDelete
  22. UnknownAugust 8, 2012 at 6:56 PM

    Hi. Could you add some photos how to connect ic to lpt? Link is broken. I really need to make my flytouch work. Please.

    ReplyDelete
  23. SyahmiAugust 8, 2012 at 8:47 PM

    The diagram can be found here: http://rayer.g6.cz/elektro/spipgm.htm

    ReplyDelete
  24. UnknownAugust 8, 2012 at 10:34 PM

    Thank you. I examined that, but i'm new at it and i dont unterstand these diagrams. Can I connect ic to parallel wire directly? Sorry for my english.

    ReplyDelete
    Replies
    1. SyahmiAugust 11, 2012 at 12:50 PM

      @Kristijonas Aviženis

      see this post: http://write-code.blogspot.com/2012/08/parallel-port-spi-flash-programmer-and-unbrick-wm8650.html

      Delete
  25. UnknownAugust 17, 2012 at 8:09 PM

    My pad is superpad 3 and i cannot identify which chip should i reflash. there are few chips like in picture in this post. Can help?

    ReplyDelete
  26. UnknownOctober 25, 2012 at 9:54 PM

    I conceive feeling to have the accumulation that you are card.
    one click root software

    ReplyDelete
  27. AnonymousFebruary 2, 2013 at 6:23 PM

    Can you show me on this site:
    http://www.tme.eu/en/katalog/?f_zamowienie=1#id_category=112309&page=1&s_field=artykul&s_order=ASC
    what kind of resistors do I need?

    ReplyDelete
  28. AnonymousFebruary 14, 2013 at 2:16 AM

    sveikas,Kristijonai .....ar pajungus prie LPT porto pagal visa ta schema programa turi pati ,,pamatyti,, cipa,......man niekaip nepavyksta,......esu zalias.Arturas

    ReplyDelete
  29. คาสิโนออนไลน์ Gclub sbobetOctober 24, 2017 at 3:56 PM

    One of the fun things to do is play 24 hours a day.

    Goldclub Slot Top Game Sites of the Industry Gambling for fun is your choice. One of the fun things to do is create a new skill for yourself. The game can be played at any time at any time. Financial value Who wants to be all. Exciting fun opportunities. Nowadays casinos are considered as games developed in continuous online gaming. To meet the wishes of the player in the game that everyone can play at home. Create value The value of gambling at anyone. Can play at home One of the fun things to do is play 24 hours a day. We are the top web games. The best option for a comfortable stay. We always give new things to gambling at the same time, this is a modern era. Advanced technology. Open your way to a fun online game. Do not waste time traveling. Go to the real casino. Bet on the web คาสิโนออนไลน์

    ReplyDelete
  30. balexarOctober 1, 2018 at 6:16 PM

    It's a great job that has been accomplished.

    Katia

    ReplyDelete