Remove Advertisement


[GUIDE] Reflash the Linx Tablet Firmware (BIOS)

If you're gonna create a guide... stick it in here!

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Deleted User 1605 » April 10th, 2015, 10:29 pm

Part 8. Opening the tablet, locating the flash chip. Programming the chip.

All of the hard work has been done. All of this effort has been spent in preparing a general tool for a specific use.
Now to open the tablet.
I'll talk specifically about the Linx 10. The other models will be similar. Today I opened a Linx Commtiva N700 7" Android tablet (O.K. there was 1 fixing screw..) using the same techniques. (This one is the next hacking project...)

Ensure that the tablet is powered off... watch that you don't accidently turn the tablet on in the next stage.

Anyway. To work..
Tools: You can buy specific tools for this type of job. Examples here: http://www.ebay.co.uk/itm/5pcs-Black-Ny ... 1c4d030673

I use these: http://www.ebay.co.uk/itm/2-x-Plastic-O ... 3aa6b50609
You could also use a couple of guitar plectrums.. (been there, done that!)

Two important things. Only use plastic tools to separate the tablet and don't lever on the screen edge.

Don't use metal tools as you run a risk of damaging the plastic. It is always worth checking for any hidden fixing screws (none on the Linx 10).

The Linx 10 has internal fixing clips every few cm or so. These hold the two halves of the case together.

Start at the top of the tablet, about 1/3rd of the length from the right hand side. Gently insert/pry with the plastic flat tool until the edge begins to move.. Take your time and be gentle.

When things "start to move", move along the edge slowly and carefully.. You'll get a "feel" for it after a while.
If required, keep changing to another section. Don't rush and force it too much. You **will** get there. Be careful around the sockets.. the plastic is weaker here.

Watch that you don't lose the power & volume button caps. In the linx 10 they are loose... There are also 6 small magnets at the bottom of the case. You'll see what I mean when you get there.

When you have removed the back, look for the firmware chip.
This is where a picture or two is useful. A few more later.

This is it: Image

This is the one in my Linx 10. The chip dimensions are 5mm x 5mm approx. (excluding pins).

The chip on the Linx 10 is underneath some self adhesive thermal sheet near the larger memory chips. I had to peel one corner up to gain access.
Before you attempt to flash the chip, you need to ensure that you are looking at the correct chip. You will also need to identify the particular chip fitted if you are working with a Linx 7 or 8. I haven't worked on one of these (yet!), so I cannot guarantee exactly what is fitted. I'm pretty certain that it will be the same or similar. If it is a 8MB SPI flash chip, then this setup will work.
Sometimes, due to parts availability problems, a larger capacity chip may be fitted (e.g using a 16MB chip where an 8MB part is specified). In cases such as these, only 1/2 the flash memory is used. If anyone finds this, then a slight alteration to the required firmware file would have to be made. Unlikely to occur with these tablets but "never say never". By all means PM me for clarification...

When you have found the flash chip, check the chip number that is etched or printed onto the top.
My Linx 10 has a flash chip marked "Winbond 25Q64FVSIG".
This is a 3.3V 64Mb SPI (serial programming interface) flash memory chip.

You'll probably need a lens to read it.

Connecting the test clip.

Shutdown the Pi for now.

sudo poweroff

Connect the test clip jumper wires to the Pi jumper wires.

Identify Pin 1 on the chip. This is marked with a small circular indentation in the chip surface.
Take your testclip, open the jaws and place the clip with the marked clip pin 1 aligned with pin 1 on the chip. Lower the clip onto the chip, aligning the clip with the chip pins. Try to get the clip as close to the PCB (printed circuit board) as possible. Gently release the clip. It should remain in place under spring pressure. If it pops off, just try again. The test clip should be standing vertically. Check and adjust where required.

Now power the Pi.
Login and change directory to "chipfiles".

cd chipfiles.

We're now ready to rock!

Next: Part 9 Programming and reassembling the tablet. "Liberating" the Product Code and MSDM table.
Last edited by Deleted User 1605 on April 17th, 2015, 3:07 pm, edited 7 times in total.
Deleted User 1605
 

Remove Ad



Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Deleted User 1605 » April 10th, 2015, 10:41 pm

Part 9: Programming and reassembling the tablet. "Liberating" the Product Code and MSDM table.

Type this

sudo flashrom -p linux_spi:dev=/dev/spidev0.0

This tests that the chip can actually be "seen" and "talked to" by the software. Nothing has been done to the chip yet.

The response should be

Calibrating delay loop.. OK.
Found Winbond flash chip "W25Q64.W" (8192 kB, SPI) on linux_spi.
No operations were specified.

A flash chip has been identified. It is a 8MB (64Mb) device.

If the response is:

Found Generic flash chip "unknown SPI chip (RDID)" (0kB, SPI) on linux_spi
{plus further info}

Then the chip cannot be identified or, almost certainly here, the test clip is not making proper contact with the chip pins.
Remove the clip, reconnect and try the command again. This is a good example of a not particularly useful error message.

Now to read the contents of the flashchip and save the contents to a file. Enter the following.
("Read" in this context means "copy the chip memory contents to an external file". This file is then byte identical to the contents of the chip.
"Write" means "create a binary copy of an external file and write it to the flash chip". The file names are irrelevant. It is the file contents that are important.)

There is a need to perform the read here. Although your firmware is borked (actually one or more specific settings within it), a copy of the existing firmware should hold a copy of the windows product key.

If you are ever playing with other flashchips, especially those with unobtainable replacement binary files, then making a copy of a flash chip is a very good idea.

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -r existing.bin

This reads the chip and writes the contents to a file called "existing.bin" in the current directory.
This will take a few minutes. The chip is capable of much faster reading and writing speeds.
We want "slow and accurate" due to the length of the connection leads.

Product key and MSDN table extraction. Modification of the new firmware file.
EDIT: I've still to check that the MSDM is at the same location in the firmware files of the Linx 8.
I've now got a Linx 8 and shall be checking when I've got the time. I'll update here asap.
{{I can confirm that this method is correct for the Linx 7 and 10. I've yet to examine the Linx 8.}}

Now to extract the Product Key. You'll need this to validate windows.
The product key can be found at the following address within the file:

From offset 0x75E014 to 0x75E030 inclusive (7725076 to 7725104 in base ten).

The MSDM table (This is actually only used for the product code here [applies to the Linx 7 and linx 10]) appears at
offset 0x75E000 to 0x75E030 (7725056 to 772514 base ten).

So to view the product code type this:

dd if=existing.bin bs=1 count=29 skip=7725076 2> /dev/null
(N.B. There is a space between "7725076" and "2>", also a space before "/dev/null")

This will be displayed on your screen preceding the system prompt.
The product code is in the following format:

XXXX-XXXX-XXXX-XXXX-XXXX

Write this down, for safe keeping.

[[[If no characters (or all '0's) are shown for the 'X's, then this means that your tablet has already had a software firmware upgrade performed.
When you have returned your tablet to working condition. Obtain and use a software product code extractor to retrieve the product code from the system registry.
I'll check these out and update here for links.]]]

Now to create a copy of the MSDM table and place it in a file called "table.bin".

This is created by:

dd if=existing.bin bs=1 count=49 skip=7725056 of=table.bin

Now to update the new firmware file with the table. The modified file can then be written to the flash chip.

dd if=table.bin bs=1 count=49 of=linx.bin seek=7725056 conv=notrunc

Now to write the prepared firmware file to the chip. Type this
(or cursor up a few times and alter the previously entered line.)

sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -w linx.bin

The current chip contents are read, just in case something goes wrong.
This is followed by the chip being erased.
Next, the file is written to the chip.
Finally, the chip flash is verified with the "linx.bin" file in the "chipfiles" directory.

Now close down the Pi with

sudo poweroff

Switch off the PSU when the Pi has closed down

All done. Very well done indeed for reaching this stage.

Remove the test clip and smooth down the thermal sheet over the chip as it was originally.

Now to reassemble the tablet. Don't forget to ensure that the volume switch cap is positioned correctly.

Place the back section of the tablet on the desk with the hole for the rear camera nearest to you. (inner surface upwards).

Hold the screen section horizontally above the base.

Now tilt the screen downwards slightly towards the left.
Locate the USB socket etc. slightly into the relevant cutouts. Lower the screen onto the base.
Gently press the two halves together.. Work around the edges slowly and carefully. Don't rush and don't apply too much force to anything.

Job Done!!

Now power the tablet up.

If all works now, then you have one important task left...

Say out loud... "Thanks Bob!".

I really do hope that this writeup has helped..

Some pictures to follow.. probably tomorrow.

Bodge99
Last edited by Deleted User 1605 on April 22nd, 2015, 10:20 pm, edited 17 times in total.
Deleted User 1605
 

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Deleted User 1605 » April 11th, 2015, 9:10 am

Hello All.

Piccy time.

Just a few, showing the tablet motherboard, flashchip location and details.. I hope that these help.
Would any others be of use?? If so, what would you like to see??

Image

This shows the opened Linx 10. The grey rectangle with the blue tape on it is the battery. Don't mess with this!!
You can see where I've peeled back the thermal tape to expose the flash chip.


Image

A closer image of the chip.


Image

A closeup of the flash chip. Note that Pin 1 is marked by the indented circle. The red paint mark has probably been left there during the tablet manufacturing process. This is often done to show that a part has passed a testing phase. [edit 17/04/15: I'm now of the opinion that the paint indicates that this chip has been "injected" with the tablet specific windows product code.]


Image

A closeup of the test clip attached to the chip.

Bodge99
Last edited by Deleted User 1605 on April 17th, 2015, 8:32 pm, edited 1 time in total.
Deleted User 1605
 

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Deleted User 1605 » April 11th, 2015, 10:05 am

O.K. now..

Is this lot sufficient for everyone?? Does anything need further clarification??

Feedback appreciated.

Bodge99
Deleted User 1605
 

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Dann » April 11th, 2015, 1:51 pm

Hi bodge, might just be the train's wifi blocking it, but i don't seem to see your images,

If you pop them in a zip folder and drop me a PM, ill host them on our servers so they don't go missing into the inter webs!?
Dann
Admin
Dann
Founder/Admin
Founder/Admin
 
Posts: 1043
Joined: December 20th, 2014, 11:21 pm
Location: York, UK
Linx Tablet: Linx Vision
Retailer: Staples UK
Windows Version: Windows 10 Pro

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby beta992 » April 11th, 2015, 4:43 pm

Thanks Bob! :D
beta992
Member
Member
 
Posts: 6
Joined: April 5th, 2015, 12:12 pm
Linx Tablet: Linx 7
Retailer: Tweakers.net

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby Deleted User 1605 » April 11th, 2015, 6:04 pm

Hello All,

I'm going to be performing a firmware reflash on a Linx 8 shortly (probably towards the end of next week).

Guess how the tablet got bricked??

I'll take some pictures showing the chip location.

That will be 2 down, 1 to go. (tablet versions..)

More later.

Bodge99.
Deleted User 1605
 

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby beta992 » April 15th, 2015, 12:37 pm

Thanks Bob!

Still need to order the stuff.. :/
beta992
Member
Member
 
Posts: 6
Joined: April 5th, 2015, 12:12 pm
Linx Tablet: Linx 7
Retailer: Tweakers.net

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby nememo » April 15th, 2015, 4:25 pm

This topic needs a like button!

*Likes*
Linx 8 Owner
nememo
Premium Member
Premium Member
 
Posts: 490
Joined: December 24th, 2014, 8:04 am
Location: Bracknell, UK
Linx Tablet: Linx 8
Retailer: Staples
Windows Version: Windows 10 Home

Re: [GUIDE] Reflash the Linx Tablet Firmware (BIOS)

Postby beta992 » April 15th, 2015, 9:21 pm

Hi Bob,

Sorry for not replying at your message.
Do you have any other contact method? Like Skype or e-mail? :)
Don't check this forum very often to be honest.

I have ordered de repair parts (since I couldn't get a reply from the manufacturer and want to do the repair myself).
Hope it all arrives this or next week. :)

It would be great if you could tell me the safest way to open the tab (pictures would help me a lot).
If you have the time, it would be great if you could assist me during the reflash. :)

Thanks again for the instructions. Really helps to restore the device back to life (at least I hope so :P).
beta992
Member
Member
 
Posts: 6
Joined: April 5th, 2015, 12:12 pm
Linx Tablet: Linx 7
Retailer: Tweakers.net

PreviousNext

Return to Guides (All Devices)

Who is online

Users browsing this forum: No registered users and 1 guest