[project]Port android to meizu M8

Don't believe me?
You're welcome to dig through his posts to find that one reply

[JW's profile]

Hum
Im interested. I dont know if i want android but im interested in the project, so i decided to look at it. Im goung to build a Debug Cable. Once i flashed en PowerPC Board with UBoot Stuff, so i want do have a look at this. I think we are able to tranfer and boot something from such a cable

Originally Posted by nice2know_u

You're welcome to dig through his posts to find that one reply

[JW's profile]

woot that would be a nice job

android is coming with the same ui

time wil tell

Aloha r3wDy !
I do think i (correction : we) could use the help on it!
When needed give me a yell, i have the needed tools distributed by samsung like you could read in the older replies.
This could make work easier.

My current issue on the debug is transfering data to the m8 using the serial debug cable, this to be able to get in the eboot option menu.
So someone would need to double check my pin layout, once fixed
it would be a mather of dumping the flashdisk and modify eboot or even try to upload using wifi/normal usb modus.

Btw i finally found someone who was going to try to solder my pins on the debug cable, so i could do some more testing, now need to find time to drop off my cable there

edit,
r3wDy:
not sure if you have seen this topic (i gues just want to make sure )
[How-To] Serial debug connection

Originally Posted by nice2know_u

Don't believe me?
You're welcome to dig through his posts to find that one reply

[JW's profile]

I can not even log in
So i am just going to trust a admin

Yup, you have to register at the bbs

edit,
r3wDy:
not sure if you have seen this topic (i gues just want to make sure )
[How-To] Serial debug connection

Yes i saw this. I have skilled co workers in my company (they build electric devices) so i think they will help me out Im more the software type

But as i worked with the PPC Board, (there was uboot on) you could flash some code dirct into ram and boot from there without touching the eeprom. So i think such a way must also be avaliable in eboot (need will read about eboot). This would make things at beginning much easier and i think so it wouldnt be possible to brick the phone

BTW to the haret problem: The windows registry doenst need alls the values. If you want to use a key which isnt there, yiu can simply create it, boot again and windows will use it if it finds it Maybe to try the certified thing we just need to create the key

Great :-)

If they build electronic devices i am pretty sure that soldering 5 small pins will not be a big deal for them ;-)

You are correct about uboot, it allows lots of customizations.
But eboot is an MS product, so do not expect to much about it.
i did not be able yet to get in the bootloader options
(due my serial cable problem)
But googling show that there is mostly not much to find :



image source :
https://secure.intrinsyc.com/support...rfPod_270M.htm

But even if there is not a lot to find it should be possible to make changes to create a dualboot option .

On the dualboot part i must say that ive read that there are tools from samsung that could be used to save images in the /disk location to load firmware from there (i thought it was called memorycard boot or something)


About Haret, a few pages back in this topic i posted a dump on why haret would not run (lots of errors), it seems that haret is not compatible with ce 6 due the fact it uses an other programming structure then older ce versions, so except if you fully understand and can mod haret it is useless for now.

Ow the following we could try if we could have a good debug cable:
source : ::: MICROVISON :::

we must be carefull. Writing Code to nand Flash most likely will kill CE completely. I dont know if the meizu loader would fix such a problem. I see download to flash (if we could get there) we could download an image to flash and boot from there. So wince would not be oerwritten and we could try lot of things out. We must be clear, if we can boot an android kernel we are far far from finished, more likely left with a unusable device. So i think we must find a way to preserver windows ce on device

Did you try to set te meizu to upgrade mode while cable connected? maybe there are more informations for us

I have no cable yet. i need to get such an usb/ttl converter first

Okay i got me a cable now (killed Datacable from my samsung :D )
and ... wow the m8 talks very very much im impressed.

But i didnt managed to get into the ebootmenu pressed spaces and enters and much more -> no reaction.

So i think of two reasons:
-> My cable is not correct wired.
ergo: I will doublecheck and solder it tomorow.
But i think reason two is the "better" one:
-> The tx port isnt connected so we can press as much buttons as we want, it wont respond.
this can only be checked if we could see the board of a meizu (anyone with a defect one?)
Maybe when im drun eneugh i will dissasmble mine, but i cant promise (love it :D )

For now i will study the logs from my terminal and do research on eboot on the internet.
greets

And me again
Ive found out (maybe its known already) that there are several samsung debug tool, which are mainly come with eval boards.
On of this tools is dnw.exe seems to be a samsung debug tool, with USB download capabilities.
So i searched and found this website:
ÉÏÔØ/ÏÂÔØÈÕÖ¾

All chineses but there you can download the dnw.exe tool, i hanvt tried but imgound to check this now
We need to try every tool on this page maybe one could be usefull

PS. im registred by pudn and now i need to upload 5 files/docs to activate this acc :/ im working on it

pictures of M8 & M8se
I hope it useful

wow the m8 talks very very much im impressed.

Yes it is indeed surprising, most devices are so closed and do mostly offer little debug output i think Meizu still needs to learn in that option ;-)

But i didnt managed to get into the ebootmenu pressed spaces and enters and much more -> no reaction.

jup i faced the same problem, that´s why i was looking for someone to confirm if they have the same issue. However it could be still a problem of wiring, i think i will agree with your idea that it could be a missing link in the Tx port.

try to set te meizu to upgrade mode while cable connected

errr.. it is been a while can not remember it :P so i do not dare to say.

download an image to flash and boot from there.

it is an option, but if i am following you correctly then you would try to boot an other os from the eboot bootloader, and as far as i found eboot and android are not compatible. if they were the problem allready was solved So just guessing you would like to try to add a bootloader to the android image?

if we can boot an android kernel we are far far from finished

agree with that one!

find a way to preserver windows ce on device

that is why i mentioned the smartq device in this topic, it does dualbooting between android and win ce. It uses the same cpu so theoratical it should be possible to use some input from that device.

(maybe its known already) that there are several samsung debug tool

Yes indeed, i did mention it in this topic, the wince topic and i thought in the serial debug part to (see pictures there it shows the dnw tool).
The Wince topic contains the original BSP from samsung smdk6410, and in one of the subfolders there is the usb driver and DNW tool.

I know that this topic is becomming very long, but maybe it could be usefull for you to read it from the beginning it could point you to some interesting things.

On the "pudn" you will be able to download immediatly after the uploads, best ways to search on it is using the terms : s3c6410 / smdk6410 / 6410
There are some documents about the proccesor, some tools like the ifusing tool, dnw, dualboot tool (=> witch problably is the most interesting to invest)

(anyone with a defect one?)

there are few with a broken device, but they did not answer on the request to open it up.
Mine is also 'broken' but i am not going to open it because i am in the middle of the RMA proces and in one of the following days i will need to ship back to meizu, so i do not want to loose warranty just yet

r3wDy, could you provide me with details on how you attached your pins to the cable? Cause the schematic i provided in the debug topic show that the tx port could be the other pin next to it, but i could not test it due soldering problems.

ps, if we could get busybox on it it should be possible to mount the "drives" that contain bootloaders etc so we could dump the contents.

edit :

(killed Datacable from my samsung :D )

is this a 5 or 10 pins cable ?

Hi!
ive read it form the beginning, but i just cant remeber all the links ive clicked Just noticed that some of my links arnt new

(killed Datacable from my samsung :D )

is this a 5 or 10 pins cable ?

Its not an USB cable, ist an serial Cable, one side it was Serial, other side a samsung mobile connector. But the cable had a rs232 chip init, so i cuted the samsung part and connect4ed an usb. I use only three wires, rx,tx and gnd. because i get all the bootmsgs i think the connections are correct. On USB side i just connected like in you pic. i will try to set the tx to another pin when im at home.

I just read through the manual of the smdk6410 eval bolard and there are shematics of the cpu, so i managed to find the jtag pins. Now im going to look at the pictures if i can find any exter jtag pins.

Got me the DNW tool and the drivers too. I think with this tool we should be able to download an image to the device without the need of the serial connection. But im unsure. i will try at home what dnw is saying . And maybe wo then could download uboot.

But again i must say, that if we manage to get uboot on the device and running, i think it wont be that easy to geht CE back onnit :/

Yes it is indeed surprising, most devices are so closed and do mostly offer little debug output i think Meizu still needs to learn in that option ;-)Yes it is indeed surprising, most devices are so closed and do mostly offer little debug output i think Meizu still needs to learn in that option ;-)

PS i think that because the most meizu devices are somehow development devices So we are lukcy, i dont think the final will talk that much

And again
(lets pump this thread up )
Just s short update:

I just searched for jtag pins.
i thought the pins near the sim card insert would be really nice The problem: i searched the internet and found others who build jtag devices for their mobiles. But non of them found the pins nearly by each other. so i think they are spread all over the mainboard We cant find those pins without measuring the mainboard, and we have no mainboard to measure :/
I will try to measure those pins near the sim but i dont think that they help much.

But fortuantely we still have a bootloader on our device, so i wont give up flashing with dnw or something.

Hellow there ;-)

cant remeber all the links ive clicked

I understand, it happens often for me to:
there are to many links on this matter but non really good enough

Its not an USB cable ....

Great cause i was wondering how you managed it to do without the ttl ;-)

only three wires, rx,tx and gnd

That should be enough to be usefull,
Myself i use the VCC also, that is because i can manually overwrite on my ttl convertor what vcc to use but i like it more that i use the M8 its own vcc for not damaging my hardware.

But i must say that to receive the debug output it is enough to have the rx and ground (i think), so if i am somewhere mistaken there are 3 pins left over that could be the TX connection towards m8.
So if everything works out like it should, it could be that i can confirm this next week if my pins are re-soldered .
One bad connected wire could be the problem we can not enter eboot menu.

shematics of the cpu, so i managed to find the jtag pins. Now im going to look at the pictures if i can find any exter jtag pins.

The schematics are pretty clear, but because i did not open my m8 and used the provided pictures i was unable to confirm/trace back the Jtag headers.
So opening will be the only otherway to find jtag so we could dump the flash through it.

because the most meizu devices are somehow development devices

indeed, this makes me believe that jtag should be there to!
And combined with the debug output , i do really think they did not close the tx pin towards m8.

DNW tool ....... should be able to download an image ...... without the need of the serial connection.

I think not, according the manual (see the wince bsp package : it is included in one of the folders) it claims to work the following way:

*hookup serial
*hookup usb or network link
*enable eboot menu through serial port
*enter memory location in setting for usb transfer
*then start to transfer data

manage to get uboot on the device and running, i think it wont be that easy to geht CE back onnit :/

yes, but if we manage to get uboot on it, we would have the possibility to add a menu to it to select the eboot loader?
And in an old post here it seems that once meizu launched firmware including an eboot, but i never figgured out cause there is little info to find about it.

(if we manage to use both tx/rx it could become interesting to order a 10 pins plug that contains debug ánd usb/activesync modus)

Originally Posted by r3wDy

And again
(lets pump this thread up )

But non of them found the pins nearly by each other

uhu it is true, and even then : i have no idea how you could be able to find the diffrence in the jtag pins wit standard tools...

except if you would desolder the s3c6410 chip, then we would be able to find it. but who is that going to do

Ok really last post this morning.

After research think we should try to go this way:
1. replace eboot with uboot
2. get uboot booting windows ce. (direct or with the help of eboot)
3. From now we can load and execute images from ram without destroying the phone
4. Start expermineting with the android kernel

I found this:
BeagleBoard - Discussions - How to get Windows CE 6.0 on BeagleBoard...

There it is clearly stated that you can boot eboot out of uboot, and so boot an windows ce from uboot (indirect) . And somehow uboot is able to boot wince direct (ive read about it too)

To try, i will use my Windows CE5 pda (ipaq) because im scared of fraggin my phone :D.

The only problem is, i think i neeed kind of dnw.exe for my pda first. then i can try such things.

Man this freaks me out i just cant wait to get home to try all this crazy shit :D

Aloha,

cant wait to get home to try all this crazy shit :D

becarefull!
Make a backup first, it could otherwise ruin everything on the ipaq.

this way:
1. replace eboot with uboot
2. get uboot booting windows ce.

Good then we have an agreement how we are going to do things?

[U-Boot-Users] U-Boot WinCE booting support?
This an other confirmation about the uboot to eboot/winCe story.
So, the following will become required:
*Serial cable with tx support to m8/jtag device
*a backup of the original ebootloader (win ce image is not needed)
*Uboot that comes with SMDK6410 (Most chance it will run from stock on m8)
*Uboot that will be adapted with an end-UI to select to OS when booting
*Uboot with patch to eboot/WinCE support
*Help for development and testing

dnw.exe for my pda

if it has a serial debug port hyperterminal/teraterm will give you acces to read the output.

If we can acces the tx pin to m8 we can continu to write uboot as described a few replies earlier, following we could try to run the smartqs android build as it is the closest to m8 for now.

If we can not use tx to m8 we will need to find yet an other way.
(damn why do we try to load unix from windows and not the other way around, it could be a lot easier ;-) )


Question to all you out there, who could try to figure out what the Meizu m8 firmware with eboot does, needs, produces,... ?
tx

Yesterday ive ordred an 11pin mini USB Cable.
Wen need such a thing to build an usb/serial plug.

Ive read that the HTC datacables have the same connector too, and so i build an HTC cable on ebay (3,5€) there should be an 11pin miniUSB connector onnit.
With this cable we could try to use dnw.

Meanwhile i did research on wince and founf very intersting things.
HaRET doenst run because its not in system (kernel) mode, and direct memory access is forbidden in usermode.
Its not that easy to get an application in windowsce6 in kernelmode, because the functions which did that arnt avaliable in ce6.
On a mircosoftsite ive read:

The kernel mode and user mode concept from Windows CE 5.0 does not exist in the same way in CE 6.0. In CE 6.0, modules (DLLs) are loaded in the kernel process, a user process, or both. Therefore, any thread owned by a module loaded in the kernel process is said to run in kernel mode. In addition, any thread owned by a module loaded in a user process is said to run in user mode.

To get a driver/process in kernel mode, it must be startet from another kernelmode process.
So ive we could get haret startet by a kernel mode process, maybe it could boot uboot for us.
After more research on windows ce 6 i found the following:

Boot Sequence Specifications

• You cannot specify command-line parameters for executables. This is unchanged from previous versions of Windows Embedded CE.
• Application-loading sequences are specified under the HKEY_LOCAL_MACHINE\Init registry key.
• You can specify the load order of system DLLs, executables, and applications under the HKEY_LOCAL_MACHINE\Init registry key. The OS launches executables listed under this key and loads DLLs under this key into the kernel.
• You can specify which DLL entry point to call when the application starts.
• The startup sequence is similar to the service startup sequence in Services.exe and the registry enumerator.

This is the bringer

You can specify the load order of system DLLs, executables, and applications under the HKEY_LOCAL_MACHINE\Init registry key. The OS launches executables listed under this key and loads DLLs under this key into the kernel.

When we set HaRET in this key.... do you think what i think

i need regedit for my meizu couldnt find it yesterday, the only link was down

Here's the registry editor which works for M8

RapidShare: 1-CLICK Web hosting - Easy Filehosting