Igor Kromin |   Consultant. Coder. Blogger. Tinkerer. Gamer.

Just over two years ago I did a teardown of a VideoPak video brochure that was powered by an Allwinner E200 chip. The teardown didn't find anything too exciting and when I tried to see if the device could be hacked, I had little to show. I did promise to follow up when I got an FTDI but somehow I completely forgot about this project...until now.

So two years later I did hook up the FTDI to my laptop and started to poke around on the VideoPak PCB.
IMG_5566.jpg


portatable.png
pinout.png

From the documentation (linked above), I could see that Port A pin PA2 was the UART TX line. This pin mapped to pin 123 on the chip. This pin is the 6th pin from the corner and luckily I could see that there was a trace connecting this pin to a resistor.

I soldered on a wire to this resistor and since this was the TX line, I connected it to the RX pin on the FTDI. I also soldered on a wire to a GND pad and connected that to the FTDI GND pin. Nothing unusual.

For the serial port monitor, I used the Arduino IDE and the 115200 baud (though it also worked as slow as 9600 too).

Now before I get onto what the serial port showed, I'll cover the RX pin on the E200. Documentation says it should be Port A PA4, which is pin 127. I've tried but nothing seemed to work on this pin. I'm guessing that this pin is either rewired or shorted with another pin to prevent tampering with the built in firmware.

This meant that I couldn't really do much more hacking of this device...or so I thought. I actually did manage to get it working in a manner I wanted to (with automatic reset, video looping, etc) - more on that in another post though!




So back to the serial port monitor, here's a close up of the TX pin solder point...
IMG_5441.jpg


When power was given to the video brochure, it immediately started to output text on the serial console. There wasn't much information there, but it was something...
 Serial Port Monitor
HELLO! BOOT0 is starting!
current block is 2 and last block is 6.
current block is 3 and last block is 6.
The file stored in start block 2 is perfect.
1
[NAND] nand driver version: 0x0x00000002, 0x0x00000011, data: 0x20120926
NAND_RequestDMA ok
[SCAN_DBG] Nand flash chip id is:0x0x000000ad 0x0x000000da 0x0x00000010 0x0x00000000 0x0x80424f54 0x0x00000095
0
Source clock is HOSC, preScale=64, interval=375
MSG:L293(drv_twi.c): drv_twi:Init!
BUS TWI0 registered Successed!
BUS TWI1 registered Successed!
request BAT-DET pin!
Mount Parts Thread running.....


At this point no more human readable text is shown, but the device does output some characters while it's running. Maybe some sort of a progress indicator? I don't know. When the brochure displays all of its content, it powers down.

After a bit of messing around I must have broken something and started to get ECC errors during startup...
 Serial Port Monitor
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000001
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000000
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000001,page 0x00000001
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000001,page 0x00000000


Those errors didn't seem to impact any functionality of the device however.

Well that's about it for this instalment but I will return to this to describe how I was able to get this brochure to keep looping through its videos without turning off. I'll also cover how I was able to power it from USB without needing a battery and without using the default micro-USB port (if you use that it goes into charge mode and will not show any videos). Till then!

-i

Skip down to comments...
Hope you found this post useful...

...so please read on! I love writing articles that provide beneficial information, tips and examples to my readers. All information on my blog is provided free of charge and I encourage you to share it as you wish. There is a small favour I ask in return however - engage in comments below, provide feedback, and if you see mistakes let me know.

If you want to show additional support and help me pay for web hosting and domain name registration, donations, no matter how small, are always welcome!

Use of any information contained in this blog post/article is subject to this disclaimer.
 
comments powered by Disqus
Other posts you may like...