Intenso TAB744

= Identification =

= Tips, Tricks, Caveats =

Recovery mode

 * 1) Power off the device
 * 2) Hold down the vol+ button
 * 3) Power on the device
 * 4) Release the vol+ button when recovery starts

If it does not work, retry the same, but with vol- button.

FEL (flash/upgrade mode)
See LiveSuit and Sunxi-tools for tools to flash, download or upgrade firmware on TAB744.


 * switch the device off (press power button longer than 10 s)
 * enter FEL mode by holding Vol+ button while connecting USB cable to PC
 * then repeatedly press power button while still holding Vol+ button

If you are using LiveSuit, you need to start and select firmware first, before connecting the device. To troubleshoot the process you can check if you've entered flash mode using e.g. lsusb:

Bus 003 Device 018: ID 1f3a:efe8 Onda (unverified) V972 tablet in flashing mode
 * FEL mode check
 * 1) lsusb

If you get  instead, then tablet is not in flashing mode; the kernel will then attach scsi generic driver with output in 'dmesg' like this:
 * 1) [12514.909226] scsi host27: usb-storage 3-1:1.0
 * 2) [12515.909172] scsi 27:0:0:0: Direct-Access              TAB744           0100 PQ: 0 ANSI: 2
 * 3) [12515.909332] scsi 27:0:0:1: Direct-Access              TAB744           0100 PQ: 0 ANSI: 2
 * 4) [12515.909796] sd 27:0:0:0: Attached scsi generic sg6 type 0
 * 5) [12515.914209] sd 27:0:0:1: Attached scsi generic sg7 type 0
 * 6) [12515.914385] sd 27:0:0:1: [sdg] Attached SCSI removable disk
 * 7) [12515.917020] sd 27:0:0:0: [sdf] Attached SCSI removable disk

$ ./sunxi-fel version AWUSBFEX soc=00001667(A33) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000
 * FEL version example

ADB (remote debug mode)
This device does not have root access enabled by default. If USB debugging is enabled in settings on the tablet, run echo -e '0x1f3a\n0x1002' >> .android/adb_usb.ini sudo bash -c 'echo SUBSYSTEM==\"usb\", ATTR{idVendor}==\"1f3a\", ATTRS{idProduct}==\"1002\", MODE=\"0666\", \ GROUP=\"plugdev\", SYMLINK+=\"android%n\" >> /etc/udev/rules.d/51-android.rules' udevadm control --reload-rules

for android debug bridge to work: adb devices adb shell ..

You can change build.prop after having flashed the firmware. adb shell remount -o remount,rw /system busybox vi /system/build.prop # use :wq to write and quit sync remount -o remount,ro /system
 * change build.prop

Modify firmware
You can unpack, modify and repack firmware images before flashing them. This way build.prop may also be changed before flashing the firmware. /prep.sh automates the steps explained and outlined below all-in-one.

The steps to modify files within system partition are roughly: imgrepacker kk.img cd kk.img.dump simg2img system.fex system.bin mkdir sys sudo mount -o loop system.bin sys sudo vim sys/build.prop # or other files # copy/rm files within sys as necessary sudo umount sys ext2simg system.bin system.fex FileAddSum system.fex Vsystem.fex cd .. imgrepacker kk.img.dump
 * system.fex

To modify boot.fex that contains kernel zImage and cpio ramdisk: imgrepacker kk.img cd kk.img.dump umkbootimg boot.fex unpack_ramdisk initramfs.cpio.gz  #edit files in ramdisk/, see e.g. sun8i.rc files for modules loaded during init repack_ramdisk ramdisk/ mkbootimg --kernel zImage --ramdisk new-ramdisk.cpio.gz --base 0x40000000 -o boot.fex rm -rf zImage *.cpio.gz ramdisk/ FileAddSum boot.fex Vboot.fex cd .. imgrepacker kk.img.dump
 * boot.fex
 * 1) for *bootimg, *ramdisk tools see e.g. xda-developers.com

You can read up on the device gpio settings using a sys_config.fex extract from the stock rom.
 * sys_config.fex

This file contains an ascii-pendant to  (a.k.a.   or  ). It can be thought of as an alternative to a device tree specification used in the mainline linux kernel and newer versions of u-boot. If you want to change it, keep in mind to update its binary representation and files that incorporate it afterwards: imgrepacker kk.img cd kk.img.dump f=sys_config.fex b=${f/.fex/.bin} ../mod_update/script $f # fex2bin $f $b ../mod_update/update_boot0 boot0_sdcard.fex $b SDMMC_CARD ../mod_update/update_boot0 boot0_nand.fex $b NAND ../mod_update/update_fes1 fes1.fex $b ../mod_update/update_uboot u-boot.fex $b # troublesome, see note below mv $b config.fex cd .. imgrepacker kk.img.dump
 * 1) clone pctools/linux/mod_update (alternative), sunxi-tools for tools

A problematic firmware, e.g. black screen, may be fixed by simply overwriting it with u-boot.fex from another, working firmware. There is no Vu-boot.fex checksum in the firmware file, so you can simply replace it. u-boot.fex contains a copy of  at its end. Extracting it may aid in debugging.
 * u-boot.fex

To reverse extract the script.bin in u-boot.fex and convert it to a human readable sys_config.fex use dd if=u-boot.fex bs=1c skip=$(od -A n --skip-bytes=24 --read-bytes=4 -i u-boot.fex | tr -d ' ') \ | od -A n -x --endian=big -w65536 | xxd -r -p | ../sunxi-tools/bin2fex - u-boot_sys_config.fex

You can then verify if the u-boot.fex included version of script.bin actually matches sys_config.fex shipped with the firmware. diff -u u-boot_sys_config.fex \ <(../sunxi-tools/fex2bin sys_config.fex /dev/stdout | ../sunxi-tools/bin2fex - /dev/stdout)

The presence of this file in a firmware sometimes prevents flashing it with LiveSuit. This can be fixed by imgrepacker kk.img cd kk.img.dump rm Vdiskfs.fex for f in image.cfg _img.files/Filelist.txt do sed -i -e '/Vdiskfs.fex/d' $f done f=sys_partition.fex b=${f/.fex/.bin} sed -i -e '/diskfs.fex/,$ s/;\(verify *= *0\)/\1/' $f unix2dos $f ../mod_update/script $f # fex2bin $f $b ../mod_update/update_mbr $b 4 # eventually overwrite u-boot.fex with known-to-work copy, see #cp ../u-boot.fex u-boot.fex cd .. imgrepacker kk.img.dump mv kk.img    kk-mod_$(date +%Y%m%dT%H%M).img mv kk.img.bak kk.img rm -rf kk.img.dump
 * Vdiskfs.fex
 * 1) clone pctools/linux/mod_update (alternative), sunxi-tools for tools

Fixing touchscreen issues
Calibration issues in android are fixable by adjusting files  or   (example1, example2).
 * touchpanel calibration -> tp.idc, ft5x0x_ts.idc

Although written in chinese language, A20 CTP v2.0 service manual ( dir link ) may aid in debugging ctp related problems. In particular see pages 28, 29 and forth, they speak about  and putting it in debug mode as well as using   to see lowlevel touch events from the ctp controller. There are also references to the driver source code and setting up sys_config.fex.
 * touchpanel service manuals

Dump firmware from NAND
Using FEL or FES modes, you can dump the NAND to PC for backup and reference purposes. There is a convenience tool called FELix. Its written in Ruby, supports a listing of available partitions in nand by name and many more.

First make sure, LiveSuit is not running. Open up a shell, attach the tablet in FEL mode, double check the device id 01f3a:efe8 with.

If  is not found in the top level directory inside firmware images, the extractor employed by FELix will fail. For this reason FES method is used here instead with which you extract fes1.fex and u-boot.fex manually from available A33 firmwares. ./sunxi-fel write 0x2000 fes1.fex # DDR-RAM in FEL mode was inaccessible without this, ./sunxi-fel exe  0x2000           # need fes1.fex to explicitly enable MMU on A33 # following dumps need trimming at end if they are to be used as u-boot.fex and config.fex ./sunxi-fel read 0x43000000 0x10000 tab_script.bin     # read script.bin copied from device NAND to RAM on boot #./sunxi-fel read 0x49000000 0xb8000 tab_u-boot.bin     # reading u-boot.bin is possible from two addresses in RAM, but #./sunxi-fel read 0x4a000000 0xb8000 tab_u-boot.bin     # may differ at read time from that stored in device flash (?) #./sunxi-fel read 0x40000000 0x40000000 tab_ramdump.bin # read full 1GB if above do not work (takes long @~500kb/s) ./sunxi-fel write 0x4a000000 u-boot.fex ./sunxi-fel fill 0x4a0000e0 1 0x10 ./sunxi-fel exe  0x4a000000       # should be in FES mode now

Now find the device id using  and unbind the driver from the usb port. is an example and may vary. FELix uses libusb and drives the port itself. echo 3-1:1.0 > /sys/bus/usb/drivers/allwinner/unbind

ruby felix --nand on ruby felix --mbr-dump ruby felix -c fes --read tab_mbr.bin -a 0x0 -l $((0x8000*0x200)) dd if=tab_mbr.bin of=tab_sunxi_mbr.fex count=$((0x80)) for part in bootloader env boot system data misc recovery cache metadata private do ruby felix -c fes --read tab_$part.bin -t none -i $part ; sleep 2 done ruby felix -c fes --read tab_UDISK.bin --address 0x4d0000 --length $((0x200000000 - 0x4d0000*0x200))
 * 1) we've already entered FES using sunxi-fel above
 * 2) ruby felix --tofes a33-firmware.img
 * 1) enable read and write access to the nand flash
 * 1) get a partition list
 * 1) get first 16MB of nand and extract sunxi_mbr.fex
 * 1) extract partitions (more info on bootloader backup)
 * 1) optionally extract user disk (last partition; should fill rest of nand flash mem)
 * 2) the mbr-dump above shows the address needed, length is 8G in this case minus address * sector size

The extracted binaries can now be further processed using the tools introduced and outlined in above to build a semi-official stock rom, flashable by LiveSuit and a number of other tools.

To not share any personal data, consider doing a factory reset of the tab beforehand or using an unused one. Since data partition(s) will not be part of the resulting firmware and /system is typically not writeable to by tab users, this might not be strictly necessary.

The steps above have been tested more than once and should work reliably. Info about how to easily extract u-boot.fex from a stock device is still a TODO:
 * INM7102AVD uses a different u-boot.bin than M7100AVD by size, but not by version string. Using the one from the later and updating it with the correct /sys_config.fex is known to work.
 * Using the RAM extracted u-boot.fex(s) advocated above is troublesome. LiveSuit will not get a reply from the device after pushing these to enter FES mode. However, this is not crucial, as same-versioned u-boot.fex from M7100AVD firmware works as a drop-in replacement.

= Device disassembly (voids warranty)= The back cover uses snap-ins, but sits very tight on the front frame. Where the volume and power buttons sit, the plastic is so thin that it's very likely to break, when trying to remove the back cover. To start opening, be sure to pick a spot about one mm below the display at a place where no buttons or connection holes are situated. Remember that you will loose warranty doing this with most vendors.
 * the lcd connector opens by rotating in a hinge knee, pull the black part up (long side)
 * the touchscreen cable connector aside the FT5302 has a slider, you push the black part horizontally, ideally by getting a nail or some tool between the white and black part on both short sides, using levers synchronously

Adding a serial port
Howto needed: Does the N7 Pro serial port guide to add a serial port work for this device too!?

= Pictures =

= Manufacturer images = Original Firmware on Github