We’ve probably all taken a look at the rash of cheap Intel-Atom-based tablet computers and wondered whether therein lies an inexpensive route to a portable PC. Such limited hardware laden down with a full-fat Windows installation fails to shine, but maybe if we could get a higher-performance OS on there it could be a useful piece of kit.
[donothingloop] has an Intel tablet, a TrekStore Wintron 7, bought for the princely sum of $60. Windows 10 didn’t excite him, so he decided to put Ubuntu on it, or more specifically to put Ubuntu on an SD card to try it on the Wintron before overwriting the Windows installation. His problem with that was a bug in the Baytrail Atom chipset which limits the speed of SD card access and made Ubuntu very slow, and in trying to fix the speed issue he managed to disable a setting in the BIOS which had the effect of bricking the machine. A show-stopper when the BIOS is in a tiny SPI Flash chip and can’t be wiped or restored.
What followed was an epic of desoldering the BIOS chip and reflashing it, though that description makes the process sound deceptively easy. The specification says it is a 1.8V device, so after attempts to flash it using an ESP8266 and then a home-made level-shifter failed, he was stumped. With nothing but a cheap tablet to lose, he tried the chip in a 3.3V programmer, and to his amazement despite the significant overvoltage, it survived. Resoldering the chip to the motherboard presented him with a working tablet that would live to fight another day.
We’d have said that this work might reside in the “Don’t try this at home” category, but since Hackaday readers are exactly the kind of people who do try this kind of thing at home it’s interesting and reassuring to see that it can be done, and to see how someone else did it. A tablet that can be bricked through a mere BIOS setting though is something a manufacturer should be ashamed of.
We like unbricking stories here at Hackaday, something about winning against the odds appeals to us. In the past we’ve covered Blu-ray drives crippled by dodgy DRM and routers rescued with a Raspberry Pi, but the crown has to be taken by the phone rescued with a resistor made using paperclips and pencil lead.
I’ve encountered the same problem a week ago – here’s a short worklog: https://hackaday.io/project/9729/log/37685 Also, included are instructions for doing SPI programming on a Raspberry Pi =)
These chips could be re-marked or something. I didn’t see 3.3V anywhere in datasheet, however, it wouldn’t read back correctly at 1.8V and would only behave correctly at 3.3V. Didn’t measure the voltage at which the flash operations in the tablet, though =(
Seems like his webpage couldn’t handle the burden of being referenced ;) Anyway, very interesting story. It could be that the manufacturer specifies the chips according to how do they fare in tests – those able to cope with 1.8V will be marked as such, and the others automatically fall into 2.7-3.6V category. Who knows?
I like those DataFlash chips, having developed a little device using a 4MB DataFlash as file storage accessible through TFTP. Decent storage size and NOR-flash reliability combined.
You are right. I am currently trying to optimize the website (better later than never) :). Should be a bit faster now.
How do you find the right file to reflash some random bios chip? Did the manufacturer provide it?
Yes, there was a support website where a update image could be downloaded. That image can be extracted to get the .ROM file.
i was wondering the same thing, until i read the linked blog post ;-)
Quote: There is an “Image Update Image” avaliable on the support website of the tablet, which is a 4.8 GB big ZIP file named V1.1.4_WI71C.JGBMRBA05.zip. This file contains the file images/BIOS/TREK.G.WI71C.JGBMRBA05.ROM, which is in fact a complete image of the BIOS flash.
For the records, the BeagleBoneBlack provides a very handy 1.8V source to use for level shifting: https://ao2.it/en/blog/2014/12/30/teclast-x98-air-3g-unbricking-bay-trail-tablet
Very cool! We have been working on getting Linux running on this thing and I managed to brick my first tablet, too! I stupidly managed to disable the USB host controller, thus completly locking myself out of the CMOS setup.
Our current progress:
https://github.com/TobleMiner/wintron7.0
cool!
I know this is an old post, but did you ever manage to reset your CMOS? I basically did the same thing to my tablet (see last post.)
I once rescued a nettop using raspberry thanks to flashrom tool. I didn’t trust myself with desoldering the soic type flash chip, so this was a big help: http://img.dxcdn.com/productimages/sku_290713_4.jpg
I thougt that I flashed a wrong bios, true was, official tool didn’t flash right even with setting it to fullflash! It always skipped some parts.
It always skips parts of the BIOS, its suposed to work like that..
I know that, but full flash should be always full flash, which I tried, because the programming batch file, that came with the original tool was no-go too.
I played around with it, when I got it working and the official tool never flashed the same bios image correctly. I flashed 1st time with original tool, dumped and rescued via flashrom and raspberry, 2nd flash with original tool, dumped and rescued with flashrom and raspberry. Always the same commandline on the original tool.
When I compared both the dumps, they were not the same. Not like one or two bytes, but different size chucks of bytes.
I think that isn’t more to be called BIOS, but UEFI?!
So can that SD card speed thing be fixed or not? And did he in the end? Site is dead so I can’t see the story
Oh and out of curiosity: What setting bricked the thing exactly? And doesn’t it have a more simple BIOS reset functionality? Some pins you need to short to reset it?
And talking of which, I think any BIOS can be messed with in such a way that the device stops working, but that’s why all motherboards always have a BIOS reset, so I just think there is some undocumented way to do a simple reset.
I mean I can’t imagine a standard plug-in motherboard like it is used on cheap devices completely missing such a basic functionality.
Addendum: NM site works now, and he did look for the BIOS reset and for some possible reset-pads
To quote:
So what I learned from this was that BIOS updates work by backing up the NVRAM section of the flash to RAM, completely erasing and programming the flash and afterwards restoring the NVRAM to the chip, which is quiet neat in case of damaged settings. But I really hope that in future Tablet manufacturers will include some sort of reset points for the BIOS settings, especially if there are severe bugs which lead to a hard-brick by simply changing a setting
I’ve seen reports that just changing the setting which controls if the machine is off/on/last state after the power supply is reconnected is enough to brick some boxes similar to the pipo x7. Mind you I don’t remember for what box exactly I’ve seen this, just giving the pipo as an example that is easy to google.
Wouldn’t it have been possible to hold the tablet’s CPU in reset state and flash the SPI flash “in system”?
You would think there was some mechanism like that for this kind of situation yeah.
What was wrong with Win 10? lmao you put linux on it for what? To browse the web like you do with Windows? That is all anyone with tablets do. They are info consumers not producers.
Aside from that an informative guide of BIOS repair.
I know where everything is in Linux, I don’t feel like a passenger.
I have a Surface 2 tablet, won it in a contest. It’s great for consuming,
But last year an update went bad, Microsoft’s fault. So I ended up losing the files I’d downloaded to it.
If it had been running Linux, this wouldn’t have happened, but if it did I’d be able to salvage things, I know Linux.
The Surface 2 is the first “main” computer I’ve ever used that ran a Microsoft operating system. That goes back to 1979.
So why would I want to run Windows?
Michael
1979 was the era of the TRS-80. Windows 1.0 wasn’t unyil 1985. Did Microsoft even have operating systems between 1979 and 1985?
MS-DOS @1980
What’s wrong with it?
“I’d give you a list, but by the time I’ve finished it, I’d be coal”
Well, at least your comment is a diamond.
The only Linux distro that worked for me out of the box when I needed was Raspbian on RPi3. Windows works always on normal computers. Linuxes are more server-oriented and they are great there, but on normal desktop/laptop/tablet-pc they either don’t work or are somewhat fragile to configuration of simple things. Yesterday I read complaint of someone, who bricked his Ubuntu by changing wallpaper…
Kindly hand in your hacker card, please.
Perhaps he doesn’t want to spend time on sending every bit of private information including his router/wifi’s passwords to MS (and ‘friends’)?
Perhaps not having to run 20 spy programs and pointless crap on a device with 1GB of RAM total will be a bit beneficial, even when browsing?
> What was wrong with Win 10?
?
Can someone hack the old Baytrail Motherboards found on these tablets to boot without a battery??
I have three 7″ baytrail windows tablets, one battery died and i’m pissed that they can’t Turn on and just run corded to the wall… I saved the battery circuit board from the puffy cell, but a replacement battery for a no-name tablet like this is about 20.00 . For 80.00 $ I can get this generations Cherry Trail with 2gb ram, 32gb storage, Win10 / Android dual boot, 8″ screen, new 14-nanometer process, USB-C … thats what I want.!
But my Old 1gb ram , 16gb hd , 7″ win10 baytrail tablet is a wonderful magical thing, I love it.. It’s my DAILY PC, I wish I could Just hot glue a 12′ USB power cable to the one with the bad battery. Perfect bed side tablet, and without a battery feather light and safe.
Can someone hack the old Baytrail Motherboards found on these tablets to boot without a battery??
Or make your own battery. Li-Ion cells are available as parts for RC models, for example at HobbyKing. Or you can use some 18650s from old laptop batteries…
Internal tablet batteries are ‘smart’ though and report their state, including charge and temperature and ‘good’ status. Which is the whole issue I gather.
They’re smart only with high-end tablets, and even then it’s mostly not the case. With cheap tech (like the one @bop mentioned) you’ll be lucky to have a thermistor pin – gosh, just look at the photo for this article, even this reference phot has only V+ and GND, no thermistor pin connected! So if he takes a good (low-impedance) DC-DC set on 4.2V and powers it from a good PSU, things will be OK. Some say he could power it from 5V, but IMO the charger controller IC might burn up.
Laptops have “smart” batteries, and in most cases it’s easy to either use some special software (expensive to obtain, but there are alternative sources if you know, what I mean) to reprogram the chip or directly rewrite EEPROM with proper values used by controller. Newer battery controllers require NDA’s to read their datasheets with all the magic numbers and formulae needed, but older ones are so obsolete, that their datasheets are available online, and reprogramming them is easy…
not here, look at wires… two wires means no problem to put in a rc chopper lipo bag :)
I was replying to a guy talking about another generic baytrail tablet, one which won’t work without a battery present, which to me indicates that one has a ‘smart’ battery. (else you could just attach any old battery to fool it, even a few AA’s.)
That the one from the article only has two wires is therefore not too relevant.
They most often use an AXP288 ic as power regulator and battery charge controller. I think I have seen this chip also used in some Android TV boxes that are powered via an usb connection. So in theory it should be possible to power the tablet only from usb without any battery.
I just fixed an issue with mine in regards to battery charging as that was faulty. the person who attempted to fix it had left a solder blob on pads and after removing it, it worked. But after doing so the chip died on me (I think). Now when I put charge into it, the AXP chip gets hot to the touch and I cannot turn on the tablet either. I ordered a new AXP288 and now I have to resolder it to the board. Is this the best option?
Thanks.
I’m not sure if it applies in your case, but some manufacturers (I’m thinking old electronic calculators) used the battery as a “load” or “voltage regulator” while running off the wall charger. Running without a working battery could fry the circuits…This makes more sense when you realize that a 4.5 volt battery pack was often charged from a cheap charger at 7.5 (or higher) voltage.
Excuse me, I have to go chase some kids off my lawn…
That was too long ago to be relevant, I’m sure =) Nowadays, even the cheapest manufacturers just throw in an AXP*** controller and it’s working.
Disable the battery ‘smartness’ in the BIOS? They report their state but I think you can disable it ‘Boot on invalid battery’ is a setting you can disable on some tablets for instance.
Or maybe you can take the control circuitry out of the defective battery and trick that into thinking it has a battery. Be careful with messing with those batteries though, they burn easily and fiercely.
I have tried it with exactly this tablet but until now no succeed
you can watch my working on it here: https://youtu.be/CCDE8bFKSS4
So did you try changing the setting in the BIOS? Although I looked it up and the BIOS of that tablet has ‘boot on invalid battery?’ set to ‘enabled’ by default.
However it has another 7 or 8 setting related to the battery, so there’s stuff to try.
An example is that it has a setting “VBattery threshold’ which is set to ‘3700’, although I have no idea what that setting is about at this point, you’d have to do a web search.
The radio operator in “The Red Tent,” a movie about an ill-fated polar expedition, uses the same trick to repair his radio, which was damaged in the crash of the expedition’s dirigible. https://en.m.wikipedia.org/wiki/The_Red_Tent_(film)
Reminds me of a Linksys NAS200 that I hacked a few years ago. It ran an 80386 clone but Linksys provided the source code and a working build system. It wasn’t difficult to hack, but the designers had taken some shortcuts with the Redboot boot loader. If you were just playing around via the serial port, you’d quickly find out that you there was a non-standard command to flash the BIOS, but it expected you to download an image to a specific RAM location via TFTP first and didn’t bother to warn you if you didn’t do that. So yeah, I bricked it less than a week after I bought it.
Fortunately in a dark corner of the Web, I found a development tool that was only supposed to be available under NDA. I had to build a JTAG connector but I got it to work again. Not that I used it much because it was slow as think crap through a funnel and it didn’t provide enough ventilation for the hard disks. But still a nice learning experience, and 15 minutes of fame :)
===Jac
Datasheet found – 3.3v is correct:
http://pdf1.alldatasheet.com/datasheet-pdf/view/761183/AMICC/A25LQ64.html
Same thing happend to me a while ago with a Z3735F tv box. Was dicking around with bios settings and ended with a soft brick.
Reflash back to the factory image fixed it, just like OP
I know this is an old post, but I have a tablet in nearly the same situation.
I inadvertently disabled all USB support on my touch tablet (including the detachable keyboard), then in an attempt to fix things, ended up losing access to Windows, leaving me with a $200 lighted serving tray.
All I need to do is reset the settings saved by the Bios back to their defaults, but there is NO reset button on the tablet. I’ve opened it up and even tried desoldering the battery connection hoping to wipe the saved settings, but it didn’t work.
Part of the confusion is people keep using “BIOS” & “CMOS” interchangeably on me. One person says to “reset the Bios” and another person tells me “resetting the Bios will brick the computer”. Where are Bios settings saved? Bios or Cmos? Can they be on the same chip? Is there a way to clear the settings without erasing/replacing my Bios?
My Bios is fine. My hardware is fine. Windows is fine. Only my settings are bad. Can anyone help?
I had same semptom on my Casper T8W windows tablet, I wrongly disabled XHCI USB and tablet lost OTG ability.
My flash chip was Winbond 25Q64F 1.8V SPI and it’s 7th pin had /RESET property. (I found this on the data sheet)
most winbond chip has reset pin, so you can use small cable that connect this pin to ground, press power button and immediately do this, you will see that everything will be clear include your nandflash.. so when you do reset pin to ground, the flash chip working at the beginning from its software and it will create new efi partition on your flash drive.
Good Luck,
Bulent
did you fix it? same problem here