Author Topic: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown  (Read 5785 times)

CommanderKitler (OP)

  • Posts: 115
WARNING:VERY RISKY, TRY EVERY OTHER KNOWN UNBRICK METHOD FIRST!!! ONLY DO THIS AS A LAST RESORT!!!

ALSO THIS IS AT YOUR OWN RISK, I WILL NOT TAKE ANY RESPONSIBILITY FOR DEVICES DAMAGED IN THIS PROCESS!!!





Recently I flashed a wrong/corrupt bootloader resulting in the (probably) worst kind of brick achievable without doing physical damage to the device resulting in a state where it won't boot into android, won't boot into recovery, cannot get into flashmode (vol+ while connecting to PC) and will not be recognized by a PC in any way. The only thing that worked was the green led, indicating that it was recieving power from some source.

Without a working bootloader, any kind of standard recovery method didn't have any effect.

As a last resort I disassembled my XD in hope to find a way to get it into MASKROM mode. To be honest I hadn't much hope for this to work but it actually did  ;D but it requires stripping the GPD XD down to the bare PCB including removing the Heatsink/RF-Shield covering the SoC and shorting out two pins on the board.

To do this you'll need:
-A small electronics screwdriver set.
-some plastic tool for prying the gpd open ( a guitar-pick would do)
-(Optional) A soldering-iron and some solder if you break something while disassembling.
- A microUSB cable
- (for now at least) a Windows PC
- RKBatchTool
- RockChip Driver Assistant
- GPD Stock 3.4.9 Rom (Any working rom will work but this is what I used to be save)
(Links provided by sectioneight.com by courtesy of PsyOps)

Follow this teardown thread https://boards.dingoonity.org/gpd-android-devices/teardown-of-gpd-xd-system-(blue-32gb)-and-my-thoughts/

until you're looking at this:
https://imgur.com/a/IVcNJ

Be careful doing this, especially with the ribbon cables as they are very fragile and extremely hard to replace.


Unfortunately the NAND we're looking for is under the Heatsink/shield, fortunately it is actually not soldered to the board but only held in place by tiny little metal clamps. Take your trusty prying tool and carefully pry up the clamps and the thing on top (probably a heat-sensor of some sort) Be Careful not to break them:

https://imgur.com/a/b8j8p


After that you should be able to see the SoC including the CPU, the GPU, some RAM and the NAND:
https://imgur.com/a/0V9Cj


The NAND is the Chip in the lower right corner. It is the one with the white lining around it but as you can see it doesn't have any pins to short out. But with some trial and error we found out that you can get the device into MASKROM mode by shorting these two contacts on the board:
https://imgur.com/a/ZCebs


Make sure to short the right ones because we couldn't figure out what the other ones do to the system.

Ok now to the execution of the recovery:

Start up batchtool and select your firmware IMG.

Plug the battery into the XD board ( without it it will fail to go into MASKROM mode and just turn off)

if the LED is glowing green by this point hold the power button (or whats left of it) until it's off

Use something metallic like a screwdriver  or a paperclip to short the two contacts.

Plug in the USB lead to the pc and keep shorting the contacts until your pc recognizes the Device (having a friend plug in the usb helps) then stop shorting the pins. Your device should now be recognized by batchtool as a MASKROM mode device.

 Now just press upgrade and wait. After that your device LED should light up red, indicating that it is charging off the USB.

Unplug, Reassemble (easier said than done) and your done.

https://imgur.com/a/DX5pl


 Let it boot (takes a long time at first) and charge if the battery is drained.

Can't say yet if my device got any lasting damage from the whole shebang but at least it is booting again.

If this happens again I'm considering soldering a hardware-switch to the pins to short them without opening the device :)
« Last Edit: October 23, 2017, 11:01:55 pm by CommanderKitler »

chent7

  • Posts: 65
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #1 on: October 03, 2017, 10:47:35 pm »
Awesome ;D

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #2 on: October 03, 2017, 11:32:35 pm »
Did you manage to make a twrp or cwm backup first? Before all of this?

I wonder if its possible to add some type of trip button to short it at will, but I do not see this as being a common problem with anyone that isn't a developer.
yep luckily I decided to sit down and do a full backup with twrp before destroying the bootloader. Well it really isn't necessary to mod the device with a dipswitch but I'd do that just for fun also that might come in handy when testing roms and such as this device is completely unbrickable this way. Just gotta be careful not to hit that switch by accident or all your data might get lost  ;D 

ruffnutts

  • Posts: 2648
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #3 on: October 04, 2017, 10:36:34 am »
Nice to know that a GPD XD can be brought back to life, well done and thanks for sharing :)

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #4 on: October 04, 2017, 02:07:36 pm »
A little Update:

After checking my GPD XD for any issues after recovering there is only one thing that doesn't work: The microSD reader seems to have died. Why this is the case I can't say but it might be because we shorted out the wrong pins at some point. The GPD XD has a multitude of contacts seemingly specifically made so that they can be shorted out and without any markings, circuit diagrams or documentation, we had to try around a bit to find the right one. Again if anyone gets into a situation where this is necessary, make sure to only short out the contacts shown in the images, as of now there is no clue to what the other ones do and there is reason to believe that they might break system components.

yeh have to make it same design as a "reset" switch. use a pin or something.

Yeah  soldeing in a small button and drilling a tiny hole for a pin or paperclip into the case should work, just got to make sure you're not pushing the pin into the microphone hole and damage the mic.

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #5 on: October 07, 2017, 12:58:38 pm »
I don't know about that. I'll certainly take a look at it again some time in the future but it's gonna be difficult to find out whats wrong. It's probably not a software issue as I've had the problems in stock aswell as in legacy and it also won't work in TWRP. Without any circuit diagrams or documentation, a lot of testing needs to be done to find the culprit.

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #6 on: October 07, 2017, 03:34:30 pm »
Nah I'm not *that* crazy  ;). I took it out even before flashing the brick. Haven't tried any other card yet but the card works in every other device I tried: PC, Xperia z5, blackberry q10 and a hacked psvita with sdcard mod. They all worked fine with it, the only device that won't react is the XD even after formating the card.

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #7 on: October 10, 2017, 01:33:23 am »
With your permission I am going to put this up on my site. Before this becomes another buried tutorial.

Sure. Feel free to do so.  :)


CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #8 on: October 13, 2017, 07:41:06 am »
Well I don't think it's a good practice to bump my own thread but I got updates on the SD reader issue.
After trying the card in every other device I own (all of 'em read the card) I wrote a new partition table and formatted the card to no effect. All devices recognize the card except the XD  :(

So I had basically given up on the reader.

I can live without the SD card but I'd really like to load my backup onto the XD so I got an OTG cable and tried an 8gig USB flash drive. It worked but sadly it isn't large enough to hold my backup. Sooo I then searched the house for an USB drive large enough and instead found an old 4gig toshiba MicroSDHC.

I thought trying the card wouldn't hurt and color me surprised it actually works  :o .

So yeah that's *really* weird, it seems to read the small SDHC but has problems recognizing the big SDXC.


CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #9 on: October 16, 2017, 02:55:11 pm »
Well I will be trying to load a backup over OTG. Don't have much to lose at this point so might as well try.

CommanderKitler (OP)

  • Posts: 115
Re: [HOWTO] Recover a GPD XD Hardbrick by inducing MASKROM-mode/XD Teardown
« Reply #10 on: October 20, 2017, 11:56:10 am »
Getting a backup to load from OTG doesn't seem to work but it seems thats not TWRPs fault.
When hooking up a USB stick (I tried multiple ones) and opening the location with anything else but the preinstalled file explorer, the app crashes.

logcat output reveals the following:
Code: [Select]
E/memtrack( 3367): Couldn't load memtrack module (No such file or directory)
E/android.os.Debug( 3367): failed to load memtrack module: -2

I guess "memtrack module" is a kernel module e.g. a driver thats missing.

Another wierd thing is, if I open up a Terminal and use cd to enter /storage/sdcard1/ (which i suppose is the mount point of the USB as no SDcard is inserted), it says it needs root permissions to enter the folder. When opening it as root, it is empty indicating that nothing is mounted even though it *has* to be mounted because I can access the files on the USB with the standard built-in explorer.

Looks like I need to get a 16 gig sdhc card to restore my backup  ???

 

Post a new topic