Intenso TAB744

= Identification =

= Tips, Tricks, Caveats =

Recovery mode

 * 1) Power off the device
 * 2) Hold down the vol+ button
 * 3) Power on the device
 * 4) Release the vol+ button when recovery starts

If it does not work, retry the same, but with vol- button.

FEL (flash/upgrade mode)
See LiveSuit and Sunxi-tools for tools to flash, download or upgrade firmware on TAB744.


 * switch the device off (press power button longer than 10 s)
 * enter FEL mode by holding Vol+ button while connecting USB cable to PC
 * then repeatedly press power button while still holding Vol+ button

If you are using LiveSuit, you need to start and select firmware first, before connecting the device. To troubleshoot the process you can check if you've entered flash mode using e.g. lsusb:

Bus 003 Device 018: ID 1f3a:efe8 Onda (unverified) V972 tablet in flashing mode
 * FEL mode check
 * 1) lsusb

If you get  instead, then tablet is not in flashing mode; the kernel will then attach scsi generic driver with output in 'dmesg' like this:
 * 1) [12514.909226] scsi host27: usb-storage 3-1:1.0
 * 2) [12515.909172] scsi 27:0:0:0: Direct-Access              TAB744           0100 PQ: 0 ANSI: 2
 * 3) [12515.909332] scsi 27:0:0:1: Direct-Access              TAB744           0100 PQ: 0 ANSI: 2
 * 4) [12515.909796] sd 27:0:0:0: Attached scsi generic sg6 type 0
 * 5) [12515.914209] sd 27:0:0:1: Attached scsi generic sg7 type 0
 * 6) [12515.914385] sd 27:0:0:1: [sdg] Attached SCSI removable disk
 * 7) [12515.917020] sd 27:0:0:0: [sdf] Attached SCSI removable disk

$ ./sunxi-fel version AWUSBFEX soc=00001667(A33) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000
 * FEL version example

ADB (remote debug mode)
This device does not have root access enabled by default. If USB debugging is enabled in settings on the tablet, run echo -e '0x1f3a\n0x1002' >> .android/adb_usb.ini sudo bash -c 'echo SUBSYSTEM==\"usb\", ATTR{idVendor}==\"1f3a\", ATTRS{idProduct}==\"1002\", MODE=\"0666\", \ GROUP=\"plugdev\", SYMLINK+=\"android%n\" >> /etc/udev/rules.d/51-android.rules' udevadm control --reload-rules

for android debug bridge to work: adb devices adb shell ..

You can change build.prop after having flashed the firmware. adb shell remount -o remount,rw /system busybox vi /system/build.prop # use :wq to write and quit sync remount -o remount,ro /system
 * change build.prop

Modify firmware
You can unpack, modify and repack firmware images before flashing them. This way build.prop may also be changed before flashing the firmware. /prep.sh automates the steps explained and outlined below all-in-one.

The steps to modify files within system partition are roughly: imgrepacker kk.img cd kk.img.dump simg2img system.fex system.bin mkdir sys sudo mount -o loop system.bin sys sudo vim sys/build.prop # or other files # copy/rm files within sys as necessary sudo umount sys ext2simg system.bin system.fex FileAddSum system.fex Vsystem.fex cd .. imgrepacker kk.img.dump
 * system.fex

To modify boot.fex that contains kernel zImage and cpio ramdisk: imgrepacker kk.img cd kk.img.dump umkbootimg boot.fex unpack_ramdisk initramfs.cpio.gz  #edit files in ramdisk/, see e.g. sun8i.rc files for modules loaded during init repack_ramdisk ramdisk/ mkbootimg --kernel zImage --ramdisk new-ramdisk.cpio.gz --base 0x40000000 -o boot.fex rm -rf zImage *.cpio.gz ramdisk/ FileAddSum boot.fex Vboot.fex cd .. imgrepacker kk.img.dump
 * boot.fex
 * 1) for *bootimg, *ramdisk tools see e.g. xda-developers.com

You can read up on the device gpio settings using a sys_config.fex extract from the stock rom.
 * sys_config.fex

This file contains an ascii-pendant to  (a.k.a.   or  ). It can be thought of as an alternative to a device tree specification used in the mainline linux kernel and newer versions of u-boot. If you want to change it, keep in mind to update its binary representation and files that incorporate it afterwards: imgrepacker kk.img cd kk.img.dump f=sys_config.fex b=${f/.fex/.bin} ../mod_update/script $f # fex2bin $f $b ../mod_update/update_boot0 boot0_sdcard.fex $b SDMMC_CARD ../mod_update/update_boot0 boot0_nand.fex $b NAND ../mod_update/update_fes1 fes1.fex $b ../mod_update/update_uboot u-boot.fex $b # troublesome, see note below mv $b config.fex cd .. imgrepacker kk.img.dump
 * 1) clone pctools/linux/mod_update (alternative), sunxi-tools for tools

A problematic firmware, e.g. black screen, may be fixed by simply overwriting it with u-boot.fex from another, working firmware. There is no Vu-boot.fex checksum in the firmware file, so you can simply replace it. u-boot.fex contains a copy of  at its end. Extracting it may aid in debugging.
 * u-boot.fex

To reverse extract the script.bin in u-boot.fex and convert it to a human readable sys_config.fex use dd if=u-boot.fex bs=1c skip=$(od -A n --skip-bytes=24 --read-bytes=4 -i u-boot.fex | tr -d ' ') \ | od -A n -x --endian=big -w65536 | xxd -r -p | ../sunxi-tools/bin2fex - u-boot_sys_config.fex

You can then verify if the u-boot.fex included version of script.bin actually matches sys_config.fex shipped with the firmware. diff -u u-boot_sys_config.fex \ <(../sunxi-tools/fex2bin sys_config.fex /dev/stdout | ../sunxi-tools/bin2fex - /dev/stdout)

The presence of this file in a firmware sometimes prevents flashing it with LiveSuit. This can be fixed by imgrepacker kk.img cd kk.img.dump rm Vdiskfs.fex for f in image.cfg _img.files/Filelist.txt do sed -i -e '/Vdiskfs.fex/d' $f done f=sys_partition.fex b=${f/.fex/.bin} sed -i -e '/diskfs.fex/,$ s/;\(verify *= *0\)/\1/' $f unix2dos $f ../mod_update/script $f # fex2bin $f $b ../mod_update/update_mbr $b 4 # eventually overwrite u-boot.fex with known-to-work copy, see #cp ../u-boot.fex u-boot.fex cd .. imgrepacker kk.img.dump mv kk.img    kk-mod_$(date +%Y%m%dT%H%M).img mv kk.img.bak kk.img rm -rf kk.img.dump
 * Vdiskfs.fex
 * 1) clone pctools/linux/mod_update (alternative), sunxi-tools for tools

Fixing touchscreen issues
There are reports of misflashed FT5306, another chip of the same FT5x0x family. Judging from various ft5x0x sources found so far, a routine to flash ft5x 02 exists just as well, but is not selected for execution in the driver code. This is easy for vendors to change, so inspect foreign firmware thoroughly. Hints:
 * Try e.g. a hexeditor on the modules to gain a basic understanding of their capabilities, search for upg, fw_upgrade, etc.
 * Eeprom firmware may either reside directly within the kernel module or in a separate file.
 * Check,  ,   or   to eventually find a binary.


 * Re-add the modules to the image of the tablet rom firmware only after other aspects of it have been tested ok.
 * Experiment with the upgrade entries last, if at all. These might be an option to recover broken eeprom.

pcduino/modules ft5x.c (and A80_SDK ft5x.c) employs sunxi style ctp_* settings. Both have fw_upgrade support for ft5x02 and apparently do not make use of it. This is not necessarily a bad thing, since foreign tablet firmware cannot employ these driver revisions to update eeprom either.
 * ft5x_ts.ko
 * M7100AVD rom (2014-06-17) contains   with a   function entry, so it might be based on above or similar sources.
 * INM7102AVD stock rom (2014-09-17) contains two versions   (482719 bytes) and   (368414 bytes) of which the older is used to drive ctp. To search the sources for the working module some strings of this binary will help. For reference find a base64 encoded version of this module which is known to work with FT5302 on TAB744.
 * sunxi-3.4 ft5x_ts driver does not seem to support ft5302 as of 2016-04-20.

According to this Makefile and this line in ft5x0x.c this module is capable of flash-upgrading the eeprom.
 * s_wmt_ts_ft5x0x.ko

Examples for firmware names to feed search engines with can be found here, excerpt: ... FT5302_ERF102C setenv wmt.io.touchft5x 1:FT5302_erf102c:9:480:800:4 setenv wmt.io.tskey 3:93:96:52:56:0:3:1:856:859 setprop ro.wmt.touchpannel 1 setprop ro.wmt.tpdrv s_wmt_ts_ft5406 ... CTP7_8227_FT5206 setenv wmt.io.ts.upg IT_ZC_GBXM_7025_V11_20120608_app setenv wmt.io.touch 1:ft5206:480:800:1:1:0:4 setprop ro.wmt.tpdrv s_wmt_ts_ft5x0x setprop ro.wmt.touchpannel 1 For TAB744 tablet however, we ideally need a FT5302_ERH212C or similar entry.

stands for Wondermedia Technologies. If a wmt firmware is introduced to the TAB744, or if you can   on a non-wmt firmware, then wmt style settings should be configured also:

Most likely we do not need to set. As we learn from the driver sources this is for panel touch keys which the TAB744 does not have.
 * setenv entries -> sys_config.fex (wmt driver only)

However,  is needed. Its value is a colon separated list (sunxi style ctp_* settings have one key for each of these instead): : : : : : ::::: Example entries for sys_config.fex ( untested ): ;GPIO PB05 => GPIO 29 ((2-1)*24 + 5)  (found in M7100AVD firmwares as ctp irq pin) ;GPIO PH01 => GPIO 169 ((8-1)*24 + 1) (   ..                       as ctp wakeup pin) wmt.io.touch=1:ft5302:29:600:1024:169:0:0:0:5:0x38 (needs nt initialized, ft5302 is 5-finger) wmt.io.touchft5x=1:ft5302:29:600:1024:169:0:0:0:5:0x38 (in case driver variant parses touchft5x instead)

Add the following lines to  and eventually   in the ramdisk when fitting foreign firmware. If the entries for FT5302_ERF102C above are not an error, first line might also take s_wmt_ts_ft5406: ro.wmt.tpdrv=s_wmt_ts_ft5x0x ro.wmt.touchpannel=1
 * setprop entries -> build.prop, default.prop (wmt driver only)

Calibration issues in android are fixable by adjusting files  or   (example1, example2).
 * touchpanel calibration -> tp.idc, ft5x0x_ts.idc

Although written in chinese language, A20 CTP v2.0 service manual ( dir link ) may aid in debugging ctp related problems. In particular see pages 28, 29 and forth, they speak about  and putting it in debug mode as well as using   to see lowlevel touch events from the ctp controller. There are also references to the driver source code and setting up sys_config.fex.
 * touchpanel service manuals

Dump firmware from NAND
Using FEL or FES modes, you can dump the NAND to PC for backup and reference purposes. There is a convenience tool called FELix. Its written in Ruby, supports a listing of available partitions in nand by name and many more.

First make sure, LiveSuit is not running. Open up a shell, attach the tablet in FEL mode, double check the device id 01f3a:efe8 with.

If  is not found in the top level directory inside firmware images, the extractor employed by FELix will fail. For this reason FES method is used here instead with which you extract fes1.fex and u-boot.fex manually from available A33 firmwares. ./sunxi-fel write 0x2000 fes1.fex # DDR-RAM in FEL mode was inaccessible without this, ./sunxi-fel exe  0x2000           # need fes1.fex to explicitly enable MMU on A33 # following dumps need trimming at end if they are to be used as u-boot.fex and config.fex ./sunxi-fel read 0x43000000 0x10000 tab_script.bin     # read script.bin copied from device NAND to RAM on boot #./sunxi-fel read 0x49000000 0xb8000 tab_u-boot.bin     # reading u-boot.bin is possible from two addresses in RAM, but #./sunxi-fel read 0x4a000000 0xb8000 tab_u-boot.bin     # may differ at read time from that stored in device flash (?) #./sunxi-fel read 0x40000000 0x40000000 tab_ramdump.bin # read full 1GB if above do not work (takes long @~500kb/s) ./sunxi-fel write 0x4a000000 u-boot.fex ./sunxi-fel fill 0x4a0000e0 1 0x10 ./sunxi-fel exe  0x4a000000       # should be in FES mode now

Now find the device id using  and unbind the driver from the usb port. is an example and may vary. FELix uses libusb and drives the port itself. echo 3-1:1.0 > /sys/bus/usb/drivers/allwinner/unbind

ruby felix --nand on ruby felix --mbr-dump ruby felix -c fes --read tab_mbr.bin -a 0x0 -l $((0x8000*0x200)) dd if=tab_mbr.bin of=tab_sunxi_mbr.fex count=$((0x80)) for part in bootloader env boot system data misc recovery cache metadata private do ruby felix -c fes --read tab_$part.bin -t none -i $part ; sleep 2 done ruby felix -c fes --read tab_UDISK.bin --address 0x4d0000 --length $((0x200000000 - 0x4d0000*0x200))
 * 1) we've already entered FES using sunxi-fel above
 * 2) ruby felix --tofes a33-firmware.img
 * 1) enable read and write access to the nand flash
 * 1) get a partition list
 * 1) get first 16MB of nand and extract sunxi_mbr.fex
 * 1) extract partitions (more info on bootloader backup)
 * 1) optionally extract user disk (last partition; should fill rest of nand flash mem)
 * 2) the mbr-dump above shows the address needed, length is 8G in this case minus address * sector size

The extracted binaries can now be further processed using the tools introduced and outlined in above to build a semi-official stock rom, flashable by LiveSuit and a number of other tools.

To not share any personal data, consider doing a factory reset of the tab beforehand or using an unused one. Since data partition(s) will not be part of the resulting firmware and /system is typically not writeable to by tab users, this might not be strictly necessary.

The steps above have been tested more than once and should work reliably. Info about how to easily extract u-boot.fex from a stock device is still a TODO:
 * INM7102AVD uses a different u-boot.bin than M7100AVD by size, but not by version string. Using the one from the later and updating it with the correct /sys_config.fex is known to work.
 * Using the RAM extracted u-boot.fex(s) advocated above is troublesome. LiveSuit will not get a reply from the device after pushing these to enter FES mode. However, this is not crucial, as same-versioned u-boot.fex from M7100AVD firmware works as a drop-in replacement.

= Device disassembly (voids warranty)=

The back cover uses snap-ins, but sits very tight on the front frame. Where the volume and power buttons sit, the plastic is so thin that it's very likely to break, when trying to remove the back cover. To start opening, be sure to pick a spot about one mm below the display at a place where no buttons or connection holes are situated. Remember that you will loose warranty doing this with most vendors.
 * the lcd connector opens by rotating in a hinge knee, pull the black part up (long side)
 * the touchscreen cable connector aside the FT5302 has a slider, you push the black part horizontally, ideally by getting a nail or some tool between the white and black part on both short sides, using levers synchronously

Adding a serial port
Howto needed: Does the N7 Pro serial port guide to add a serial port work for this device too!?

= Pictures =

= Also known as =

Since there are no firmware files publicly available to this date from Intenso, firmware images from different vendors need to be tried to repair a broken tab. When applied to a TAB744, most of these just show black screens, have wrong display resolutions, non-working sound and/or no touchscreen support. Some can be modified to work, your mileage may vary.
 * Unofficial:


 * The following options seem to be the last resort to unbrick a TAB744 until oem stock firmware file(s) are found or released on the net. Unless stated otherwise all firmwares contain Android 4.4.2 Kitkat.


 * Though dating 2014, the M7100AVD sun8iw5p1 m7100nobt image should be tried first. It has a working recovery and the firmware name matches the label on the pcb board of the TAB744. Sound+Wifi+Display is working ok.


 * Another good working image is from an Unicus U1021C (says U1201C in its sys_config.fex). It has brilliant screen support (as above), WiFi works and ADB is enabled by default. The sound is working, but there is no startup sound in the boot animation.


 * To flash the image from a Softwinner/Yonestoptech BA1078, modify and remove Vdiskfs.fex first. The screen support is as good as in U1021C, sound works, but WiFi does not (although 8188eu.ko is part of the image). The Lollipop images for BA1078 work unmodified, although a verification error appears near the end of the flashing process. Same hardware issues as for Kitkat images apply.


 * Images originally for Y88X may be used too. They need to have Vdiskfs.fex removed in most cases and u-boot.fex needs to be fixed or overwritten, e.g. by the one from BA1078 image.  is a good start, since it advertises rtl8188eu support in the image's filename.


 * If Touchscreen input is broken, access the device using external mouse/keyboard on the usb port or work with . Correct an eventually wrong sensor orientation by setting/changing   and   in , see  or.

If you have links to original stock rom from Intenso please edit and add to this wiki page.

= See also =
 * Android Firmware matching PCB imprint
 * M7100AVD-8188-sp2518-sp0838-v1.0-20140626.rar link broken
 * M7100AVD_单WIFI_A33_SDK V1.0rc7_sun8iw5p1_android_m7100nobt---20140617.rar
 * sun8iw5p1_android_astar-m7100nobt-charge-20140609.rar
 * M7100AVD_A33_单WIFI_sun8iw5p1_android_astar-m7100nobt--20140603.rar
 * M7100AVD（单WIFI)_A33_8188etv_sun8iw5p1_android_astar-y1nobt---20140521.rar


 * Android Firmware sources
 * Download and service support for Yones Toptech


 * chinagadgetsreviews.blogspot.de/search?q=A33+firmware
 * mytabletguru.com/allwinner-a33-firmware-and-tool - 2015/05/12
 * electroniaychinas.wordpress.com/2015/03/06/a33-tablet-fimrware
 * electroniaychinas.wordpress.com/2014/10/07/firmware-tablet-dragon-touch-akaso


 * Y88X firmwares None of Y88X images have display working when applied without modification to TAB744, but see.
 * Q75S firmwares do not work without modification


 * Android Device Info sources
 * Yifang Digital Technology Co., Ltd Tablet Info M7100AVD is not listed, but see M7100AVD-7"
 * Unicus Co., Ltd Tablet Info