DSC_0391

Bricked TrekStor wintron 7.0

A couple of weeks ago I bought a small 7” tablet with Windows 10 pre-installed, and because I use Linux everywhere, I tried to install Ubuntu on the tablet. Actually I wanted to install it to the micro-SD card and try things out first.
Turns out that there is a bug in Baytrail Atom processors which prevents the UHS-I SD card from being accessed in DDR50 mode. Unfortunately this makes Ubuntu very slow.

DSC_0368 DSC_0369

Even if the default Bios settings disable the high-speed mode, I decided to try to enable DDR50 in spite of the known problems, but I had no success. Linux just reported MMC read errors. After looking around the internet I found some kernel patches that should improve the reliability of the SDIO interface and fix some race conditions with the C-sleep states of the CPU while accessing the MMC card. I really hoped that these patches will help and so I compiled a new kernel for the tablet, but this did not fix the problem.

(You can find those patches at the repository of the wifi/bluetooth card https://github.com/hadess/rtl8723bs)

And here comes my mistake… During some fiddling around in the BIOS settings I accidentally disabled the DMA controller, which is not a smart idea. The result was, that the tablet did not boot anymore and me being a bit frustrated. On a desktop PC I would in this case simply pop-out the BIOS battery on the mainboard, but there is no BIOS battery in this tablet and also the BIOS stores the settings on non-volatile memory, which is in this case a SPI flash chip. On traditional PCs BIOS settings are often stored in battery-backed RAM which can be cleared when the battery is removed. On modern mainboards they are stored in NVRAM but there is a CMOS clear jumper which has the same effect as removing the battery on older PCs. So this was my first idea. Maybe the manufacturer has designed some test-pads onto the PCB that can be used to reset the bios settings.

To check my assumption, I had to open the tablet. This is fairly easy by just using a thin piece of plastic that can slide in the gap between the two halves of the case.

DSC_0372

After the case was opened, I was greeted by the mainboard (this was a very hassle-free disassembly when compared to modern tablets in the higher price-segment), but unfortunately I was unable to find any test-points for resetting the BIOS. I just found an UART port and test-pads for the factory programming of the SPI flash.

DSC_0375 DSC_0381

There is a metal shielding can, which also seems to be used as a heat-sink for the Intel Atom Z3735G processor and the AXP288 voltage regulator. The SPI flash is located on the left of the processor.

DSC_0391DSC_0392

The SPI flash is a 25LQ64 chip. Although I did not find a datasheet, the chip is most likely a 1.8V only chip, because I measured VCC to be 1.8V.

So I decided, that I will have to reflash the BIOS. There is an “Image Update Image” avaliable on the support website of the tablet, which is a 4.8 GB big ZIP file named V1.1.4_WI71C.JGBMRBA05.zip. This file contains the file images/BIOS/TREK.G.WI71C.JGBMRBA05.ROM, which is in fact a complete image of the BIOS flash.

alex@laptop:~$ ls -l TREK.G.WI71C.JGBMRBA05.ROM 
-rw-rw-r-- 1 alex alex 8388608 Mai 10 00:46 TREK.G.WI71C.JGBMRBA05.ROM

alex@laptop:~$ md5sum TREK.G.WI71C.JGBMRBA05.ROM 
4117f6f5e1643774710c7251329d6fa0  TREK.G.WI71C.JGBMRBA05.ROM

Also it would be quite interesting to unpack the bios image, which seems to be LZMA compressed. Binwalk reports lots of Portable Executables, which most likely are the UEFI binaries.

alex@laptop:~$ binwalk TREK.G.WI71C.JGBMRBA05.ROM 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
5406926       0x5280CE        Certificate in DER format (x509 v3), header length: 4, sequence length: 885
5407927       0x5284B7        Certificate in DER format (x509 v3), header length: 4, sequence length: 1512
5409553       0x528B11        Certificate in DER format (x509 v3), header length: 4, sequence length: 1495
5411096       0x529118        Certificate in DER format (x509 v3), header length: 4, sequence length: 1552
5412696       0x529758        Certificate in DER format (x509 v3), header length: 4, sequence length: 885
5836920       0x591078        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 4034576 bytes
7799072       0x770120        Microsoft executable, portable (PE)
7800640       0x770740        Microsoft executable, portable (PE)
7801184       0x770960        SHA256 hash constants, little endian
7804751       0x77174F        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
7828288       0x777340        Microsoft executable, portable (PE)
7831360       0x777F40        Microsoft executable, portable (PE)
7832352       0x778320        Microsoft executable, portable (PE)
7833047       0x7785D7        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
7838784       0x779C40        Microsoft executable, portable (PE)
7839408       0x779EB0        UEFI PI firmware volume
7843616       0x77AF20        Microsoft executable, portable (PE)
7865664       0x780540        Microsoft executable, portable (PE)
7868224       0x780F40        Microsoft executable, portable (PE)
7872064       0x781E40        Microsoft executable, portable (PE)
7873696       0x7824A0        Microsoft executable, portable (PE)
7874624       0x782840        Microsoft executable, portable (PE)
7876320       0x782EE0        Microsoft executable, portable (PE)
7878208       0x783640        Microsoft executable, portable (PE)
7881728       0x784400        Microsoft executable, portable (PE)
7887904       0x785C20        Microsoft executable, portable (PE)
7893984       0x7873E0        Microsoft executable, portable (PE)
8127040       0x7C0240        Microsoft executable, portable (PE)
8136768       0x7C2840        Microsoft executable, portable (PE)
8138336       0x7C2E60        Microsoft executable, portable (PE)
8139808       0x7C3420        Microsoft executable, portable (PE)
8146336       0x7C4DA0        Microsoft executable, portable (PE)
8158528       0x7C7D40        Microsoft executable, portable (PE)
8163264       0x7C8FC0        Microsoft executable, portable (PE)
8168128       0x7CA2C0        Microsoft executable, portable (PE)
8179104       0x7CCDA0        Microsoft executable, portable (PE)
8183232       0x7CDDC0        Microsoft executable, portable (PE)
8186688       0x7CEB40        Microsoft executable, portable (PE)
8201888       0x7D26A0        Microsoft executable, portable (PE)
8202944       0x7D2AC0        Microsoft executable, portable (PE)
8262048       0x7E11A0        Microsoft executable, portable (PE)
8280992       0x7E5BA0        Microsoft executable, portable (PE)
8282688       0x7E6240        Microsoft executable, portable (PE)
8283680       0x7E6620        Microsoft executable, portable (PE)
8290240       0x7E7FC0        Microsoft executable, portable (PE)
8302016       0x7EADC0        Microsoft executable, portable (PE)
8307520       0x7EC340        Microsoft executable, portable (PE)
8308064       0x7EC560        SHA256 hash constants, little endian
8311223       0x7ED1B7        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
8326976       0x7F0F40        Microsoft executable, portable (PE)
8375712       0x7FCDA0        Microsoft executable, portable (PE)
8383984       0x7FEDF0        Microsoft executable, portable (PE)

What I did not know was whether the BIOS image contains the default settings of the NVRAM and if it will work when flashed to the chip.

Before trying to desolder anything, I first disconnected a lead of the battery and insulated it.

DSC_0396

I desoldered the flash by applying lots of solder to the pins and repeatedly heating both sides with a soldering iron until the chip became loose. Then I picked it up with tweezers. If you also want to do this, pay attention to the passives around the chip. They can be damaged very easily.

DSC_0401DSC_0403

To flash a new BIOS, I needed an SPI programmer and I did not want to wait a month for getting one from China (a thing like this would be best suited).

I started searching for an alternative for buying an programmer and even tried using an ESP8266 module as flash programmer. The problem was that the ESP needs a 3.3V supply and I needed a level shifter, which I also did not have for 1.8V. So I built one with NPN transistors.

DSC_0562 DSC_0561

But this did not work out either. Most likely there were signal integrity issues with the long wires to the flash chip. I tried reading the flash chip with esptool but only got unknown error messages.

So after this did not work I tried the same thing with an Arduino flashed with frser-duino, which (suprise) did not work 🙂

Frustrated and prepared to take the risk of a dead flashchip, I used my 3.3V only CH341A programmer and it worked! The flash survived although the voltage was out of spec and even above the maximum ratings.

I used a fork of flashrom for the CH341A programmer that can be found at GitHub.

DSC_0406

After flashing I resoldered the chip and reassembled the tablet.DSC_0394

And it worked just fine. It booted with a message that the default NVRAM values are being initialized.

DSC_0573

 

So what I learned from this was that BIOS updates work by backing up the NVRAM section of the flash to RAM, completely erasing and programming the flash and afterwards restoring the NVRAM to the chip, which is quiet neat in case of damaged settings. But I really hope that in future Tablet manufacturers will include some sort of reset points for the BIOS settings, especially if there are severe bugs which lead to a hard-brick by simply changing a setting.

Also you can sometimes get away with exceeding the specification of an IC for a very short time if you do not need the certainty that it will not blow up.

6 thoughts on “Bricked TrekStor wintron 7.0”

    1. Yes it worked except for the audio, but it felt really slow and the disk access times were quiet high. I decided that I will not wipe Windows 10 from the internal eMMC card, because it is actually really nice on this small tablet.

  1. I have an even cheaper mediacom clone of the trekstor, and I was too looking forward for an ubuntu installation.. the real problem for this tiny machine is that emmc foresee chip, because windows swaps a lot on it and changing is a real difficult rework job. It’s surrounded by passives at just few mills .
    And Ubuntu/linux has very poor bay trail support atm..
    Btw , you did great!

Leave a Reply

Your email address will not be published. Required fields are marked *