[project]Port android to meizu M8

evow04 · 07-19-2009

MaikelRunia,
thanks for the research!

question to you all, does anyone have wince 5?
thing is i would like to try and run ce 5 rom to start haret from there.

in case the wince 5 rom wont run it could be reversed to an original one this way;
source:
http://translate.google.com/translat...84057-1-1.html

Methods: power + music keys , and then connect the computer to copy original xip.bin, disconnected, and then reset machine

MaikelRunia · 07-20-2009

Hmm.. i think we need help? =D

evow04 · 07-20-2009

Yes indeed,

I have send an email to meizu to request a bsp (source file for m8)
for the bootloader, kernel etc, but the answer i got was a big no, we do not support foreigners.
I was a bit disappointed

And at the moment i am thinking if it has still some use that i am spending time on android for m8 due the rumors that they will launch an android version .

MaikelRunia · 07-20-2009

Yes but i think we have to wait for a few ''years''.. Maybe spend your time to search for someone who can help us.. Thats what i`m trying now

groove · 07-20-2009

hi,

i just joined because of your topic :-)
i don't have a meizu jet, but i'm going to order one.

so at the moment the problem is code signing with wm6 and that there is no proper kernel for the meizu?

well i do not have skills in kernel porting but i had a few linux pda's in the past and cross compiling is not that hard...

how can i help?

thanks
chris

evow04 · 07-20-2009

Hi Chris,
first of all welcome!

The kernel is not really a problem,
the mean issue is something like a bootloader.
Safest for now is using haret like used in most android build on htc.
this would allow us to reset the ce core and run android kernel.

Now main problem is indeed getting haret to run properly.
It can not run in usermode, this could be due certificate problem,
but like posted here somewhere the m8 uses Wince 6 , and in win ce 6 tha api´s are rebuild so this means that haret should be rebuild to run properly on m8.

hope you follow me :-) if not ask ill try to be more clearly.

groove · 07-20-2009

ok, perhaps it's stupid because we don't know the keycodes...

anyone tried this: Boot from SDCARD

read through everything again and i don't think it is going to help... only a suggestion that something like this could work for the m8 as well...

evow04 · 07-20-2009

hi groove
booting from the internal disk is indeed like you mention the same as from a cf card,
so it is important to know how it is done once you get passed the 'bootloader'.
do you have by any chance experience on signing apps for windows ce?
cause to be honest i did not try it yet.

evow04 · 07-22-2009

just been reseaching a bit on the kernel/user mode for win ce 6,
It seems that it could be necessairly to edit oalioctl.dll
to allow calls for some ioctl functions.

mm yet another interesting thing :
http://msdn.microsoft.com/en-us/libr...ded.60%29.aspx

this tool checks what is compatible with the ce 6 , maybe this could be a better starting point to find out what is not compatible.

If i got some time i will try to run it with the haret.exe and post the output.
this will save a lot of pain when we now what is not compatible and what will need to be rebuild.

evow04 · 07-22-2009

ok i ran the ce application compatibility tool,
seems that there is some work to do.
who´s in?
html source :
print.html

text source :

Automated Scan of all Dlls/Exes

(Scanned Module: c:\temp\haret_m8.exe )

*LocalAllocInProcess
This is no longer supported. One possible alternative is to use remote heap mechanism to share heap data.
*LocalFreeInProcess
This is no longer supported. One possible alternative is to use remote heap mechanism to share heap data.
*LocalSizeInProcess
This is no longer supported. One possible alternative is to use remote heap mechanism to share heap data.
*DumpKCallProfile
This is no longer supported. API call is a no-op.
*ProfileSyscall
This is no longer supported. API call is a no-op.
*AddTrackedItem
This is no longer supported. API call will return failure. Use Application Verifier to track heap memory.
*DeleteTrackedItem
This is no longer supported. API call will return failure. Use Application Verifier to track heap memory.
*PrintTrackedItem
This is no longer supported. API call will return failure. Use Application Verifier to track heap memory.
*RegisterTrackedItem
This is no longer supported. API call will return failure. Use Application Verifier to track heap memory.
*FilterTrackedItem
This is no longer supported. API call is a no-op. Use Application Verifier to track heap memory.
*MapPtrToProcess
This is no longer supported. If this is being used to access an API argument, you can remove the mapping call. If this is
being used to access a pointer that is passed inside a structure or through some other means, you would need to explicitly switch to calling
buffer marshalling and unmarshalling APIs.
*MapPtrUnsecure
This is no longer supported. If this is being used to access an API argument, you can remove the mapping call. If this is
being used to access a pointer that is passed inside a structure or through some other means, you would need to explicitly switch to calling
buffer marshalling and unmarshalling APIs.
*GetProcFromPtr
This is no longer supported. Use OpenProcess API to get a process handle.
*GetProcAddrBits
This is no longer supported. Process VMBase is always at the same fixed location (64K).
*SetProcPermissions
Completely impossible, remove it. Likely this call wraps code that accesses another process virtual memory space;
verify that the addresses youre using are now getting duplicated / aliased for you, or else you will need to do so yourself.
*GetCurrentPermissions
Completely impossible, remove it. Likely this call wraps code that accesses another process virtual memory space;
verify that the addresses youre using are now getting duplicated / aliased for you, or else you will need to do so yourself.
*SetHandleOwner
Update code to use DuplicateHandle to create a new handle for the other process, and then close the original handle. Also,
if your code is part of a kernel-mode server, you need to move the ownership assignment out into the external method that is only invoked
when your API is called by a different process.
*SetKMode
Completely impossible, remove it. Likely this call wraps code that accesses another process virtual memory space; verify that the
addresses youre using are now getting duplicated / aliased for you, or else you will need to do so yourself.
*ConnectDebugger
This is no longer supported.
*GetProcessIndexFromID
This is no longer supported. If this API is being used to implement process reference counting, you should revise
your reference counting to track processes in a linked list instead of an array.
*GetCallerProcessIndex
This is no longer supported. If this API is being used to implement process reference counting, you should revise
your reference counting to track processes in a linked list instead of an array.
*FlushViewOfFileMaybe
This is no longer supported.
*CeGetCurrentTrust
Trust/Untrusted mechanism doesn't exist anymore. One can limit the code which runs on the system by using certmod component.
*CeGetCallerTrust
Trust/Untrusted mechanism doesn't exist anymore. One can limit the code which runs on the system by using certmod component.
*CeMapArgumentArray
This is no longer supported.
*MapCallerPtr
This is no longer supported. If this is being used to access an API argument, you can remove the mapping call. If this is
being used to access a pointer that is passed inside a structure or through some other means, you would need to explicitly switch to calling
buffer marshalling and unmarshalling APIs.
*MapPtrToProcWithSize
This is no longer supported. If this is being used to access an API argument, you can remove the mapping call. If this
is being used to access a pointer that is passed inside a structure or through some other means, you would need to explicitly switch to calling
buffer marshalling and unmarshalling APIs.
*RemoteHeapAlloc
This is no longer supported. Use the new remote heap mechanism (API CeRemoteHeapCreate) to share heap data.
*RemoteHeapReAlloc
This is no longer supported. Use the new remote heap mechanism (API CeRemoteHeapCreate) to share heap data.
*RemoteHeapFree
This is no longer supported. Use the new remote heap mechanism (API CeRemoteHeapCreate) to share heap data.
*RemoteHeapSize
This is no longer supported. Use the new remote heap mechanism (API CeRemoteHeapCreate) to share heap data.
*GetProcessIDFromIndex
This is no longer supported.
*CeZeroPointer
This is no longer supported.
*ConnectHdstub
This is no longer supported.
*ConnectOsAxsT0
This is no longer supported.
*ConnectOsAxsT1
This is no longer supported.
*AttachHdstub
This is no longer supported.
*AttachOsAxsT0
This is no longer supported.
*AttachOsAxsT1
This is no longer supported.
*CeGetProcessTrust
Trust/Untrusted mechanism doesn't exist anymore. One can limit the code which runs on the system by using certmod component.

evow04 · 07-22-2009

/PSLNotify//RemoteLocalAlloc//RemoteLocalReAlloc//RemoteLocalSize//RemoteLocalFree/
/ForcePageout//GetRomFileInfo//GetRomFileBytes//GetKPhys//GiveKPhys/
/StringCompress//StringDecompress//BinaryCompress//BinaryDecompress/
/GetFSHeapInfo//SetLowestScheduledPriority//PowerOffSystem/
This API can only be called from kernel mode code.

/InterruptInitialize//InterruptDone//InterruptDisable/
This API can only be called from kernel mode code or from user mode drivers.

/SetPowerOffHandler//SetGwesPowerHandler//SetHardwareWatch//ReadRegistryFromOEM/
/WriteRegistryToOEM//LockPages//UnlockPages//SetRAMMode//SetStoreQueueBase//PerformCallBack4/
/VirtualSetAttributes//DecompressBinaryBlock/
/PageOutModule//CeVirtualSharedAlloc//CeCreateToken/
This API can only be called from kernel mode code.

/LoadIntChainHandler//FreeIntChainHandler//CreateStaticMapping//InterruptMask/
This API can only be called from kernel mode code or from user mode drivers.

IsAPIReady
Usage discouraged. We expanded the number of API sets and
changed the API set IDs. Use WaitForAPIReady API or use ready event
signaling mechanism.
RegisterDevice
Usage discouraged. Use ActivateDeviceEx instead.
DeregisterDevice
Usage discouraged. Use DeactivateDevice instead.
VirtualProtect
This API can only be called on an address previously allocated through VirtualAlloc in the caller's process space.
CreateFileForMapping
Usage of this API is discouraged. You should consider switching to CreateFile and CreateFileMapping. (Please note
that the handle-closing semantics for CreateFile are different from those of CreateFileForMapping: the kernel automatically closes the
handle you receive from CreateFileForMapping, while you must close the handle you receive from CreateFile.)
VirtualCopy
This API can only be used to alias in the current active process. For kernel mode threads, one can use the new API VirtualCopyEx
to create an alias of virtual address between two different processes. Also if you are using this API to access hardware directly, then you
need to run your code in a kernel mode driver.
CreateAPISet
New function descriptors are required.
GetCallerProcess
Usage discouraged. Use GetDirectCallerProcessId or GetCallerVMProcessId instead.
RegisterAPISet
New function descriptors are required.
CreateFileForMappingW
Usage of this API is discouraged. You should consider switching to CreateFile. (Please note that the handle-closing
semantics for CreateFile are different from those of CreateFileForMapping: the kernel automatically closes the handle you
receive from CreateFileForMapping, while you must close the handle you receive from CreateFile.)
ActivateDevice
Driver load flags have changed to account for kernel mode and user mode srivers.
ActivateDeviceEx
Driver load flags have changed to account for kernel mode and user mode srivers.
ServiceIoControl
Service handles are no longer exposed to applications - applications always deal with filesystem based handles now. Replace
these calls with DeviceIoControl instead.
GetServiceHandle
Use of this API will leak a file handle since internally this is now implemented as CreateFile and there is no
CloseServiceHandle API call; new code should not use this.

Report generated on: 22/07/2009 19:34:21

seems a lot of work isnt ?

eum i found wince 5 setup,
does anyone has experiences on how to build a rom from scrap?
it does not need to work perfect,
aslong as i am able to boot in to a browser to run haret from there.. :-)

evow04 · 07-23-2009

No responses from anyone?
pitty...

anyway check this out :
Run Both Windows and Android On Your Cellphone Using MVP Hypervisor | DeviceAce

deepsilence · 07-23-2009

Originally Posted by evow04

anyway check this out :
Run Both Windows and Android On Your Cellphone Using MVP Hypervisor | DeviceAce

That one have already been posted once before, but it indeed is interesting

Lets just hope the price tag aint that high when they release it!

Anyhow, I've been following your progress from the start, and you are making a damn good job! Keep up the work guys!

I dont know anything about how to compile and that stuff

But if I could be to some kind of help, just let me know!

evow04 · 07-24-2009

Hey deepsilence, thanks did not know that one!
Everyone could be helpfull just by researching cause none of this is well documented.

Currently i am thinking to forget the haret part cause if i look at the above dump there is just to much work to be done before it will ever support ce 6,
reverting to ce 5 is a good alternative and will open the door immediatly, but then we need support from guys who have experience on building raw ce 5 kernels.

But nobody responds so i gues it means nobody has the knowledge on it?

Currently i am still looking on an other way to get it started,
this by dumping the original flash/nand/rom that comes in the m8, then overwriting with uboot. (with option to restore original backup if needed)

But i dont wanna open my own m8 to look for or add serial support on the mainboard,
buying one for testing is to expensive to do without sponsering
and the other way on it i still need to test it:
I am guessing that using the usb cable in unix with a terminal client could acces this flash memory. But i will need to figure out how to activate serial output then. It could be like pushing a combination of buttons for reseting registry or acces upgrade menu...

So you could help on that one for example, pushing buttons is not that hard

For people who think this approach is too hard to do are very wrong.
Currently i´m researching how they managed to get around with the smartq 5 mid that like i mentioned before runs the same samsung processor.

JT’s World Search Results smartq 5 is an example with lots of info on this device, and there you may notice that there are android builds to support the processor, and they even got a multiboot option to select wheter they run wince 6 or android , mer ,.. !

So if we could find on how to overwrite the bootloader in nand flash, with for example the uboot for smartq 5, we could end up with or a bricked phone, or an open platform to work on.

Now once again the problem for myself is that i dont understand chinese language so it is very hard to gain some decent and detailed info on how they did it, maybe people with chinese knowledge could find intersting clou´s?

update:
seems there is serial usb support after all, but it is hidden and secured: serialusbfn.dll, now i will need to figure out how to communicate with it
update 2:
browsing the registry it comes completely clear that m8 is build on smdk6410,
found a good pdf on it with info on jtag (maybe we could solder our own connector on to it ?) tvout etc ,
but still no ce/android bsp

pdf:
http://www.mt-system.ru/documents/sm...ual_rev1.0.pdf

evow04 · 07-25-2009

to all who are developing,
i would say make a backup on data found here:

S3C6410

it contains :

SMDK6410 WinCE 6.0 BSP

!!

ps i would say be fast, not sure how long it will stay there:-)

groove · 07-25-2009

hey evow,

great! please stay behind it.

i read a lot about the ce6 security and i think you are right with haret will be very hard...

there is a rootkit for windows cd6 but in fact the code was never released... it's from the bluepill guys...

the bootloader from the smartq would be great!

i recently ordered the m8 and i will disassemble it asap...

evow04 · 07-26-2009

I will do my best

do you have some more info on the root kit?
About the bootloader, i still did not figure out if they use qi, uboot or eboot:s
Cause they have multiuboot option :s

Great, hope you will enjoy youre m8!

There are floating around some pictures of m8 internals on the forum,
but i am not sure if it was the definitive version.
If you decide to open the device let me know, i can advise you on how to find a serial com connector.

anyone tested

SMDK6410 WinCE 6.0 BSP

ive tried to install it on my vs 2005 with win ce 6 r2 but i cant select the bsp for smdk6410

any help is welcome

evow04 · 07-28-2009

groove or to whom it may concern,

i have less sparetime to work on this but i thought i will save some research to others.
It will be easier to communicate with the m8 on hardware level then modding some software to mod an other software package to run on m8.

So finding a jtag port that can communicate with samsung´ s s3c6410 Jflash programming tool or finding a serial uart debug port that can communicate with a hyperterminal or ms platform builder will really help us to deploy other os on m8.

Without schematics for m8 it will be really hard to find a jtag pin layout,
luckily we have mentioned above links to schematic for the smdk6410 that gives a clou where to find the jtag port.
This can be done by tracing the pins coming from the soc (s3c6410 cpu) to available pin on the mainboard or by direct soldering onto the soc itself.

On finding a serial debug port, it is much easier, cause such a port contains 4 pins that can be connected to a ttl converter.
Those 4 pins are :
GROUND - VCC - TX - RX
this means that you can trace them with a normal multimeter:
GROUND : obvious 0 voltage
VCC : should be 3.3 or 5 volt all the time
TX : connecting an internal pc speaker should provide "kliks" while m8 is used
RX : it is passive, it means it will have a powerpeak while m8 is been booted.
*note that those voltages are been shown while connecting multimeter to the m8 chassis
example ttl convertor:

So if you or anyone opens the m8 we could find an serial port and get started. like you do notice above the 4 wires found on m8 could esaily be connected to an ttl convertor.

While browsing the forum i found some interesting topics:
Actual M8 Motherboard? and New M8 Motherboard Picture

I will provide feedback on what is important for us:
we should have higher resolution pics on thos that are shown in the above topics.

internal m8:

SMDK kit connected to a jtag/serial convertor

Have a look on the first of 3 pictures and then have a look on the actual m8 internal.
You will notice that it is an actual finished or nearly finished m8 device
with an ttl and JTag connection board onto it.
This means that we could use or real target device itself to work on.

Now problem is the above pictures should have a higer resolution, then we could see what pins they used to connect with and more, we should have pics from the otherside of the m8 mainboard (there where the lcd fits)
Cause looking at current pictures i guess that on this side there are more interesting connection pins..

I know that the extensionboard could solve a lot of issues but meizu wont sell it, on the other hand a ttl convertor can be bought for 5 $ online :-)

update:
it could be that a serial connection can be build like for a g1 (using the usb connection), take a look here :
Android G1 Serial to USB Cable
this how it looks on the end :

But the main difference is that the G1 has an 11 pins usb connector, and m8 has a 10 pins connector.

this is the g1 connector board :

a default usb connector has only 4 pins ( for type a - b - mini)
example:

(source usb layout : USB pinout and wiring @ pinouts.ru )

so this means that on meizu m8 there are 6 pins left without any use.
This lets me think that the pins 'could' have the following use:
4 pins for usb (see above)
+4 pins for debug/uart/rs232 (see above)
+2 pins for tv out (audio comes through jack output on top of m8)
----
10 pins in total

Now i do now 10 pins usb connector is not easy to find , and using a multimeter wont work cause it is to small, so the device should be opened or we need a custom plug to make the tests

found a mini usb female 10 pins connector here, so a male version should exist too.
WELCOME TO AMTAC

male connector i could find:
source Alcatel OT-E801 USB/audio connector pinout pinout and wiring @ pinouts.ru

source MINI USB Connector (10P Solder) - China Mini Usb Connector, Usb Connector, Usb Plug in Connector

problem is i only find oem orders what means orde from 10000 pieces minimum.

evow04 · 07-30-2009

i noticed +100 new views after my post but no responds except elsi06?

Maybe someone of you guys know where to find such connector or have one?
Some help would be nice ;-)

dark13 · 07-30-2009

I tried Farnell & Radiospares but I could only find one male with 5 contacts... not 10...