Igor Kromin |   Consultant. Coder. Blogger. Tinkerer. Gamer.

Just over two years ago I did a teardown of a VideoPak video brochure that was powered by an Allwinner E200 chip. The teardown didn't find anything too exciting and when I tried to see if the device could be hacked, I had little to show. I did promise to follow up when I got an FTDI but somehow I completely forgot about this project...until now.

So two years later I did hook up the FTDI to my laptop and started to poke around on the VideoPak PCB.


From the documentation (linked above), I could see that Port A pin PA2 was the UART TX line. This pin mapped to pin 123 on the chip. This pin is the 6th pin from the corner and luckily I could see that there was a trace connecting this pin to a resistor.

I soldered on a wire to this resistor and since this was the TX line, I connected it to the RX pin on the FTDI. I also soldered on a wire to a GND pad and connected that to the FTDI GND pin. Nothing unusual.

For the serial port monitor, I used the Arduino IDE and the 115200 baud (though it also worked as slow as 9600 too).

Now before I get onto what the serial port showed, I'll cover the RX pin on the E200. Documentation says it should be Port A PA4, which is pin 127. I've tried but nothing seemed to work on this pin. I'm guessing that this pin is either rewired or shorted with another pin to prevent tampering with the built in firmware.

This meant that I couldn't really do much more hacking of this device...or so I thought. I actually did manage to get it working in a manner I wanted to (with automatic reset, video looping, etc) - more on that in another post though!

So back to the serial port monitor, here's a close up of the TX pin solder point...

When power was given to the video brochure, it immediately started to output text on the serial console. There wasn't much information there, but it was something...
 Serial Port Monitor
HELLO! BOOT0 is starting!
current block is 2 and last block is 6.
current block is 3 and last block is 6.
The file stored in start block 2 is perfect.
[NAND] nand driver version: 0x0x00000002, 0x0x00000011, data: 0x20120926
NAND_RequestDMA ok
[SCAN_DBG] Nand flash chip id is:0x0x000000ad 0x0x000000da 0x0x00000010 0x0x00000000 0x0x80424f54 0x0x00000095
Source clock is HOSC, preScale=64, interval=375
MSG:L293(drv_twi.c): drv_twi:Init!
BUS TWI0 registered Successed!
BUS TWI1 registered Successed!
request BAT-DET pin!
Mount Parts Thread running.....

At this point no more human readable text is shown, but the device does output some characters while it's running. Maybe some sort of a progress indicator? I don't know. When the brochure displays all of its content, it powers down.

After a bit of messing around I must have broken something and started to get ECC errors during startup...
 Serial Port Monitor
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000001
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000000
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000001,page 0x00000001
PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000001,page 0x00000000

Those errors didn't seem to impact any functionality of the device however.

Well that's about it for this instalment but I will return to this to describe how I was able to get this brochure to keep looping through its videos without turning off. I'll also cover how I was able to power it from USB without needing a battery and without using the default micro-USB port (if you use that it goes into charge mode and will not show any videos). Till then!

Update: I used this brochure in a real project, check it out - Adding reset circuitry and external power to an E200 Allwinner based video brochure.


A quick disclaimer...

Although I put in a great effort into researching all the topics I cover, mistakes can happen. Use of any information from my blog posts should be at own risk and I do not hold any liability towards any information misuse or damages caused by following any of my posts.

All content and opinions expressed on this Blog are my own and do not represent the opinions of my employer (Oracle). Use of any information contained in this blog post/article is subject to this disclaimer.
Hi! You can search my blog here ⤵
NOTE: (2022) This Blog is no longer maintained and I will not be answering any emails or comments.

I am now focusing on Atari Gamer.