Creating bootable SD card

From Linux Rockchip
Jump to: navigation, search


Creating the Structure

The header and code areas are scrambled by RC4.


openssl rc4 -K 7C4E0304550509072D2C7B38170D1711 < header > header.rc4


split -b 512 --filter='openssl rc4 -K 7C4E0304550509072D2C7B38170D1711' < code > code.rc4

The script in contains:


dd if=orig/sd_header_64 conv=sync | split -b 512 --filter='openssl rc4 -K \
7c4e0304550509072d2c7b38170d1711' > sd_header_64.enc

dd if=orig/3188_LPDDR2_300MHz_DDR3_300MHz_20130830.bin conv=sync | split -b 512 \
--filter='openssl rc4 -K 7c4e0304550509072d2c7b38170d1711' > FlashData.bin

dd if=orig/u-boot.bin conv=sync | split -b 512 --filter='openssl rc4 -K \
7c4e0304550509072d2c7b38170d1711' > FlashBoot.bin

rkcrc -p orig/parameter parameter.img

See also naobsd's excerpt from sarg's gist.

FlashData and FlashBoot contained in RK3188Loader(L)_Vx.xx.bin can be extracted with sarg's tools.

Prepare the Files

As stated above, the binary format for code that can be written to SC Card partitions and the binary format for NAND code is the same.

To wrap the code into the right binary format (it adds some header bytes and CRCsums) use:

  • for parameter files:
    rkcrc -p <parameters.txt>
    See also the rkcrc-call in
  • for kernel, boot and recovery images:
    rkcrc -k <{kernel|boot|recovery}.img> 
    alternatively there is a command for boot and recovery images (for the kernel image the above rkcrc-command has to be used):
    mkbootimage <{boot|recovery}.img>

Write the Code to SD Card

Once prepared, the files can now be flashed to the SD Card using the dd command. Unless you defined your own layout the sectors given to the command are the same as in the table above. For user defined partitions write the files to the corresponding sectors/addresses.

The parameters go to SD Card sector 16 at sector 0x2000 (would be NAND logical sector 0x0):

dd if=parameters.img of=/dev/XXX conv=sync,fsync seek=$((0x2000+0x0))

The SD Card header (RC4 scrambled) goes to sector 64:

dd if=sd_header_64.rc4 of=/dev/XXX conv=sync,fsync seek=64 

Presumably some proprietary code (cleartext or RC4 scrambled, too?) goes to sector 65 (but might be omitted, to be verified):

dd if=proprietary_sd_header_65 of=/dev/XXX conv=sync,fsync seek=65 

DDR initialization routines (RC4 encrypted) go to sector 68:

dd if=FlashData.bin.rc4 of=/dev/XXX conv=sync,fsync seek=68 

The bootloader (RC4 scrambled) lives in sector 92:

dd if=FlashBoot.bin.rc4 of=/dev/XXX conv=sync,fsync seek=92 

Finally, the kernel and/or RFS/initrd/initramfs go to addresses far beyond, at sectors 160ff.:

dd if=kernel.img of=/dev/XXX conv=sync,fsync seek=$((0x2000+0x4000))
dd if=boot.img of=/dev/XXX conv=sync,fsync seek=$((0x2000+0xc000))


The size of the bootloader section (sector 92 and up) is sufficient for the proprietary Rockchip bootloaders. But it is too small for u-boot or barebox to fit in.

naobsd: in my sdboot img, size of loader are is good for RK proprietary loaders, but 
too small for u-boot/barebox

See also: