PRS-T1 PRS-T1 run from SD card / UART recovery from broken internal flash - Page 2

NonaSuomy · 04-30-2022, 03:37 PM

Quote:

Originally Posted by jpa

Yeah, I guess my post wasn't very clear on that. I had the extra complication that my device wouldn't boot even rupor rescue from SD card, so I had to use solder wires to hardware serial port to effect recovery.

Based on your error messages & symptoms, it seems your flash is broken in the user partition area while my was broken in the kernel area. But doesn't matter, as my image moves it all to SD card.

I haven't actually tried this myself, but I think you could get it done this way using the rupor USB shell:

1. Copy the uboot env from my image to a separate file:

Code:

dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072

and copy uboot_new.bin to rupor rescue SD card, along with the other files that are already there.
2. Boot rupor rescue so that you get serial port shell over USB.
3. Find where the file is visible on PRS-T1 shell, [code]mount[code] command probably tells if the sd card is mounted.
4. You can backup the old uboot env to a file:

Code:

dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

5. And then write a new one:

Code:

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

After that it should boot (in normal mode) from SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".

As usual, no warranty and be careful with the numbers

Thank you for further explaining this and uploading your SD image! It was a great help!

Working nice once again WiFi and USB not crashing!

SDCard Boot directions for Sony PRS-T1

Copy contents of https://discord.com/channels/8092057...07186154438686 to root of SDCard folder

Copy uboot_new.bin https://discord.com/channels/8092057...33364454834197 to Rupor Rescue SD Card, along with the other files that are already there…

SD Card Layout

Code:

OS Firmware
|-files
| |-update.img
uboot_new.bin

Boot Rupor Rescue to get serial shell over USB (Hold HOME + MENU buttons before you turn on device).

Remount SD Card as writable.

Code:

mount -o remount,rw /dev/mmcblk0p1 /initrd/mnt/sd

Change directory to the SD Card mounted.

Code:

cd /initrd/mnt/sd

Backup the old uboot env to a file.

Code:

 dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

Write a new one.

Code:

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

Reset device and it should now be booting to the SD Card image.

DoctorM · 11-20-2022, 03:06 PM

I have two broken T1 readers. One gets stuck when 'Opening Book' hits 100%. Holding Home/Menu won't load rupor-rescue from SD either.

I was hoping to try this method, but there is little detail on the hardware aspect.
I get that the OP wired directly to the circuit board, but the only detail I see is "USB-serial converter (3.3V voltage)".

Can anyone tell me what this is or provide a link to this connector and/or what wire colors get connected to which solder points?

JSWolf · 11-20-2022, 03:27 PM

IMHO, it's not worth the hassle. It would be better to just get a new Reader to replace the Sony.

DoctorM · 11-26-2022, 07:04 AM

We have a working T1, two dead T1's and a working T2.
Of the two dead units, one doesn't connect to a USB so it can't even be charged, but the other was my screw up... I was restoring the firmware because the dictionary was really laggy, my computer saw an 'unformatted drive', asked if I wanted to format it and I clicked yes before even realizing what I had done and it bricked the unit. It won't even boot an SD with rupor-rescue.
The unit is otherwise okay, so this seems like my last option to pull it off.

tuer · 07-29-2023, 01:23 AM

Hello jpa, thank you for your welding method,
I am using the method of ch340g usb to ttl, connected to putty but I don't know how to enter the recovery console, my prs t1 keeps restarting, flashing yellow, but the light of the memory card is not on, I suspect it cannot read the memory card. Do you have a similar method to get in, or swipe in the firmware, if you can reply to me, I will be very grateful!
Here is what the putty interface displays:
MMC read: dev # 2, block # 12288, count 5120 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
▒
U-Boot 2009.08 (Nov 14 2011 - 11:16:48)
CPU: Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 66666666Hz
ipg per clock : 66666666Hz
uart clock : 24000000Hz
ahb clock : 133333333Hz
axi_a clock : 400000000Hz
axi_b clock : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 160000000Hz
esdhc1 clock : 80000000Hz
esdhc2 clock : 80000000Hz
esdhc3 clock : 80000000Hz
esdhc4 clock : 80000000Hz
Board: MX50 ARM2 board
Boot Reason: [POR]
Boot Device: MMC
I2C: ready
DRAM: 256 MB
MMC: FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
temperature 29
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz
In: serial
Out: serial
Err: serial
Net: got MAC address from IIM: 00:00:00:00:00:00
FEC0
Hit any key to stop autoboot: 0

MMC read: dev # 2, block # 12288, count 5120 partition # 0 ...
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x1
imx_esdhc.c bus_width 0x4
imx_esdhc.c bus_width 0x4
MMC set clock 50MHz

autoscr - DEPRECATED - use "source" command instead
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
cls - clear screen
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
echo - echo args to console
erase - erase FLASH memory
ext2load- load binary file from a Ext2 filesystem
ext2ls - list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
i2c - I2C sub-system
iminfo - print header information for application image
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - mmcinfo <dev num>-- display MMC info
mtest - simple RAM read/write test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
sleep - delay execution for some time
source - run script from memory
sspi - SPI utility commands
tftpboot- boot image via network using TFTP protocol
version - print monitor version

tuer · 07-29-2023, 01:25 AM

Hello jpa, thank you for your welding method,
I am using the method of ch340g usb to ttl, connected to putty but I don't know how to enter the recovery console, my prs t1 keeps restarting, flashing yellow, but the light of the memory card is not on, I suspect it cannot read the memory card. Do you have a similar method to get in, or swipe in the firmware, if you can reply to me, I will be very grateful!

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
How do I flash update.zip via recovery on T62?	loviedovie	Android Devices	0	01-16-2016 08:36 PM
Boot/flash Custom recovery	ziamrziamr	Onyx Boox	0	11-08-2014 05:32 AM
Touch Bricked Kobo Touch - no internal SD card (flash memory chip instead)	bher	Kobo Reader	6	07-30-2014 07:22 PM
Can't get new f/w - flash site broken again and non-flash not updated	jusmee	Astak EZReader	8	03-13-2010 12:26 PM
PRS-500 PRS-500; UART, U-Boot experts: HELP!	Melongasoil	Sony Reader Dev Corner	0	01-12-2010 05:09 PM

11-20-2022, 03:06 PM	#17
DoctorM Groupie Posts: 169 Karma: 43000 Join Date: Mar 2010 Device: none	I have two broken T1 readers. One gets stuck when 'Opening Book' hits 100%. Holding Home/Menu won't load rupor-rescue from SD either. I was hoping to try this method, but there is little detail on the hardware aspect. I get that the OP wired directly to the circuit board, but the only detail I see is "USB-serial converter (3.3V voltage)". Can anyone tell me what this is or provide a link to this connector and/or what wire colors get connected to which solder points?

11-20-2022, 03:27 PM	#18
JSWolf Resident Curmudgeon Posts: 76,458 Karma: 136564696 Join Date: Nov 2006 Location: Roslindale, Massachusetts Device: Kobo Libra 2, Kobo Aura H2O, PRS-650, PRS-T1, nook STR, PW3	IMHO, it's not worth the hassle. It would be better to just get a new Reader to replace the Sony.

11-26-2022, 07:04 AM	#19
DoctorM Groupie Posts: 169 Karma: 43000 Join Date: Mar 2010 Device: none	We have a working T1, two dead T1's and a working T2. Of the two dead units, one doesn't connect to a USB so it can't even be charged, but the other was my screw up... I was restoring the firmware because the dictionary was really laggy, my computer saw an 'unformatted drive', asked if I wanted to format it and I clicked yes before even realizing what I had done and it bricked the unit. It won't even boot an SD with rupor-rescue. The unit is otherwise okay, so this seems like my last option to pull it off.

07-29-2023, 01:23 AM	#20
tuer Junior Member Posts: 4 Karma: 10 Join Date: Jul 2023 Device: sony prs t1	Hello jpa, thank you for your welding method, I am using the method of ch340g usb to ttl, connected to putty but I don't know how to enter the recovery console, my prs t1 keeps restarting, flashing yellow, but the light of the memory card is not on, I suspect it cannot read the memory card. Do you have a similar method to get in, or swipe in the firmware, if you can reply to me, I will be very grateful! Here is what the putty interface displays: MMC read: dev # 2, block # 12288, count 5120 partition # 0 ... imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz ▒ U-Boot 2009.08 (Nov 14 2011 - 11:16:48) CPU: Freescale i.MX50 family 1.1V at 800 MHz mx50 pll1: 800MHz mx50 pll2: 400MHz mx50 pll3: 216MHz ipg clock : 66666666Hz ipg per clock : 66666666Hz uart clock : 24000000Hz ahb clock : 133333333Hz axi_a clock : 400000000Hz axi_b clock : 200000000Hz weim_clock : 100000000Hz ddr clock : 160000000Hz esdhc1 clock : 80000000Hz esdhc2 clock : 80000000Hz esdhc3 clock : 80000000Hz esdhc4 clock : 80000000Hz Board: MX50 ARM2 board Boot Reason: [POR] Boot Device: MMC I2C: ready DRAM: 256 MB MMC: FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz temperature 29 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz In: serial Out: serial Err: serial Net: got MAC address from IIM: 00:00:00:00:00:00 FEC0 Hit any key to stop autoboot: 0 MMC read: dev # 2, block # 12288, count 5120 partition # 0 ... imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x1 imx_esdhc.c bus_width 0x4 imx_esdhc.c bus_width 0x4 MMC set clock 50MHz autoscr - DEPRECATED - use "source" command instead base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol cls - clear screen cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation dhcp - boot image via network using DHCP/TFTP protocol echo - echo args to console erase - erase FLASH memory ext2load- load binary file from a Ext2 filesystem ext2ls - list files in a directory (default /) fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) flinfo - print FLASH memory information go - start application at address 'addr' help - print online help i2c - I2C sub-system iminfo - print header information for application image imxtract- extract a part of a multi-image itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mii - MII utility commands mm - memory modify (auto-incrementing address) mmc - MMC sub system mmcinfo - mmcinfo <dev num>-- display MMC info mtest - simple RAM read/write test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sf - SPI flash sub-system sleep - delay execution for some time source - run script from memory sspi - SPI utility commands tftpboot- boot image via network using TFTP protocol version - print monitor version

07-29-2023, 01:25 AM	#21
tuer Junior Member Posts: 4 Karma: 10 Join Date: Jul 2023 Device: sony prs t1	Hello jpa, thank you for your welding method, I am using the method of ch340g usb to ttl, connected to putty but I don't know how to enter the recovery console, my prs t1 keeps restarting, flashing yellow, but the light of the memory card is not on, I suspect it cannot read the memory card. Do you have a similar method to get in, or swipe in the firmware, if you can reply to me, I will be very grateful!