• Login:

Welcome to the Acer Tablet forum.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed.

Results 1 to 4 of 4
  1. #1
    Iconia Lurker
    Member #
    Join Date
    Mar 2015
    0 times

    Bruteforce eMMC Flash Hacking of the Acer A200 - Thoughts and proposal

    I am newbie on this site, but I am an Engineer & not a complete novice when it comes to tablet hacking. However, I didn't think to "backup" whatever was on the damned thing before I totally killed the bootloader (not that it would really have made any difference in this case).

    Circumstances that led to my issue:
    I have completely "hard-bricked" a A200 that was originally "soft-bricked". It was "soft-bricked" in the sense that I could not mount, delete, or format the /DATA partition no matter what I had attempted. (Yeah, tried Fastboot userdata and with the -w context, and also that Wipe utiility ,etc.) Finally, I ended up trying to revert back to a stock ROM using the CWM Recovery. Btw, I had unlocked the bootloader when I first installed the CWM. As the tablet updated to the stock ROM, I saw something flash on the screen for a couple of seconds that stated ".blob failed" in red before all went dark.

    Current state:
    I've lost all ADB and Fastboot ability, and am left only with the APX mode. I've researched this method for a few days. While it seems to be a viable approach for the A500; Unfortunately, it is close to impossible (maybe is indeed impossible) to recover the A200 tablet by way of nvFlash unless you are able to calculate a magic number (SBK) with a unique CPUID for your particular tablet. Correct me if I am wrong, I don't think anyone was able to ever revive an A200 through APX? (If I am incorrect, please do call me out on that statement, and then help me out with the nvFlash process for the A200.)

    Determine the pin-out of the eMMC device, and find all the required connections on the board, and wire them directly to a modified USB SDCARD reader. Finally, write the image directly to the eMMC device. Keep in mind that I have already successfully hacked the Kindlefire2 with this exact same method by writing a raw image directly to the eMMC flash. The Kindlefire processor did not allow writing an image via the OMAP for the same reason that the A200 Tegra 2 does not allow it; simple because of the magic number is not unique to the CPU. This brute force should work on the A200. I still have the modified USB SDCARD reader that I'd used on the Kindlefire 2.

    I haven't yet opened up the hood of the tablet.

    I need a detailed good partition table, the eMMC Flash used on the tablet, and I need a raw image (.bin) to burn.

    Any comments are appreciated. Please post a good partition table, the eMMC part used on the mobo, and/or upload a binary for the A200 (if one exists). If I can't get a raw binary, I will need a good A200 motherboard for which to experiment. Does anyone have a busted A200 laying around that has a good motherboard that they are willing to part with?

    UPDATE1: I found the eMMC devices that are used on the tablets "Hard Disk Drive Interface." In fact, I found the complete field service manual for the A200.

    16GB: Kingston KE44B-26BN/16GB OR SanDisk SDIN5C1-16G
    8GB: Kingston KE44B-26BN/8GB OR SanDisk SDIN5C2-8G

    UPDATE2: I found this in one of the stock ROM scripts: package_extract_file("bootloader.blob","/dev/block/mmcblk0p5"); At least now I (think that I) have the bootloader if I have a partition structure left on the eMMC to look at. I still would prefer just a raw .bin or .img file of the eMMC to just write. Anyone have it?

    UPDATE3: Found Blobtools to extract .blob files. Found stock OS as UPDATE.ZIP wit the bootloader.blob file for the Acer A200. I will try extract the contents of this .blob file. Also found NVFLASH utility for another Tegra 250 tablet (Viewsonic Gtablet) that works directly with APX mode. I will see if this yields anything before I rip the tablet open. I will have to edit the gtablet.cfg file for the Acer A200 partition structure & figure out how to make a .bct file too. Anyone have a detailed printout of the partition table with address location & size parameters? Still looking for a raw image (.img) of the A200 FLASH or even a bootloader.bin, anyone???

    UPDATE4: Purchased a cheap 16GB A200 motherboard for $10 on E-Bay of unknown state. Hopefully will boot. Will plug in the 12V adapter and the USB, and then see if the the PC recognizes the board. If it's a good board, I might just try to wire in my FLASH reader to the EMMC, and read the raw image. After I replace the bricked mobo with the (hopefully) good one, I will try to write the image to it. Will update this at some point.

    {{{ Lots of reads on this topic.....but no comments, no help, and no suggestions though.....disappointing }}}

    Last edited by kevin_d; 03-25-2015 at 10:47 PM.

  2. #2
    Iconia Lurker
    Member #
    Join Date
    Jul 2012
    0 times
    whats the update on this?

  3. #3
    Iconia Lurker
    Member #
    Join Date
    Nov 2013
    0 times

    Sbk and cpuid backup

    hi, i found a backup of my cpuid and sbk, can i do anything with those?

    0xCF2D1100 0xCB95D506 0x0BF93304 0xF6302103
    Iconia a200 32gb wifi:

    Rom: stock (ics)
    Kernel: Onyx oc 1.5Ghz
    Recovery: TWRP

  4. #4
    Iconia Lurker
    Member #
    Join Date
    Jun 2012
    0 times

    Sorry for necro

    Hey Kevin, been a few years and I'm not generally a fan of necroing old threads, but I found my old a200 in a box this weekend and it is in virtually the same state. I was just wondering if you had any luck resolving the issues?


Remove Ads

Sponsored Links

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Search tags for this page

acer a200 emmc


acer emmc tool


emmc raw mode


emmc utility

Click on a term to search our site for related topics.

Tags for this Thread