Bricked Intel Tablet Lives Again

We’ve probably all taken a look at the rash of cheap Intel-Atom-based tablet computers and wondered whether therein lies an inexpensive route to a portable PC. Such limited hardware laden down with a full-fat Windows installation fails to shine, but maybe if we could get a higher-performance OS on there it could be a useful piece of kit.

[donothingloop] has an Intel tablet, a TrekStore Wintron 7, bought for the princely sum of $60. Windows 10 didn’t excite him, so he decided to put Ubuntu on it, or more specifically to put Ubuntu on an SD card to try it on the Wintron before overwriting the Windows installation. His problem with that was a bug in the Baytrail Atom chipset which limits the speed of SD card access and made Ubuntu very slow, and in trying to fix the speed issue he managed to disable a setting in the BIOS which had the effect of bricking the machine. A show-stopper when the BIOS is in a tiny SPI Flash chip and can’t be wiped or restored.

What followed was an epic of desoldering the BIOS chip and reflashing it, though that description makes the process sound deceptively easy. The specification says it is a 1.8V device, so after attempts to flash it using an ESP8266 and then a home-made level-shifter failed, he was stumped. With nothing but a cheap tablet to lose, he tried the chip in a 3.3V programmer, and to his amazement despite the significant overvoltage, it survived. Resoldering the chip to the motherboard presented him with a working tablet that would live to fight another day.

We’d have said that this work might reside in the “Don’t try this at home” category, but since Hackaday readers are exactly the kind of people who do try this kind of thing at home it’s interesting and reassuring to see that it can be done, and to see how someone else did it. A tablet that can be bricked through a mere BIOS setting though is something a manufacturer should be ashamed of.

We like unbricking stories here at Hackaday, something about winning against the odds appeals to us. In the past we’ve covered Blu-ray drives crippled by dodgy DRM and routers rescued with a Raspberry Pi, but the crown has to be taken by the phone rescued with a resistor made using paperclips and pencil lead.

Unbricking a BluRay Drive

All BluRay player, devices, and drives contain a key that unlocks the encryption and DRM present on BluRay discs. Since 2007, the consortium responsible for this DRM scheme has been pushing updates and revocation lists on individual BluRay releases. Putting one of these discs in your drive will brick the device, and this is the situation [stephen] found himself in when he tried to watch Machete Kills. Not wanting to update his software, he searched for a better solution to unbrick his drive.

Every time [stephen] played or ripped a disc, the software he was using passed a key to the drive. This key was compared to the revocation list present on the drive. When a match was found, the drive bricked itself. Figuring the revocation list must be stored on a chip in the device, [stephen] broke out the screwdriver and started looking around inside the drive.

There aren’t many chips inside a modern BluRay drive, but [stephen] did manage to find a few Flash chips. These Flash chips can be dumped to a computer using a BusPirate, and comparing the dump to a publicly available ‘Host Revocation List Record’, [stephen] was able to find the location on the Flash chip that contained the revocation list.

The next task was to replace the revocation list currently on the drive with an earlier one that wouldn’t brick his drive. [stephen]’s MakeMKV install made this very easy, as it keeps a record of all the revocation lists it runs across. Updating the Flash in the drive with this old list unbricked the drive.

This is only a temporary fix, as [stephen] still can’t put a new disc in the drive. A permanent fix would involve write protecting the Flash and preventing the drive from ever updating the revocation list again. This would be a very complex firmware hack, and [stephen] doesn’t even know what architecture the controller uses. Still, the drive works, saved from terrible DRM.