vx767 firmware flash procedure
note: the usbtool steps are taken from usbtool.c

1. plug device into usb socket

2. run this code

    _GET_CPU;
    _SET_ADDR(0x8000 << 16);
    _SEND_FILE("1.bin");
    _GET_CPU;
    _VERIFY_DATA("1.bin", 0x8000 << 16);
    _STAGE1(0x8000 << 16);
    _SLEEP(3);
    _VERIFY_DATA("2.bin", 0xB3020060);
    _GET_CPU;
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _GET_CPU;
    _SET_ADDR(0x8000 << 16);
    _SEND_FILE("3.bin");
    _GET_CPU;
    _VERIFY_DATA("3.bin", 0x8000 << 16);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _GET_CPU;
    _SET_ADDR(0x80D0 << 16);
    _SEND_FILE("4.bin");
    _GET_CPU;
    _VERIFY_DATA("4.bin", 0x80D0 << 16);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _GET_CPU;
    _SET_ADDR(0x80E0 << 16);
    _SEND_FILE("5.bin");
    _GET_CPU;
    _VERIFY_DATA("5.bin", 0x80E0 << 16);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _GET_CPU;
    _SET_ADDR(0x80004000);
    _SEND_FILE("6.bin");
    _GET_CPU;
    _VERIFY_DATA("6.bin", 0x80004000);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _GET_CPU;
    _SET_ADDR(0x80FD << 16);
    _SEND_FILE("7.bin");
    _GET_CPU;
    _VERIFY_DATA("7.bin", 0x80FD << 16);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _STAGE2(0x80FD0004);
    _VERIFY_DATA("8.bin", 0x80004004);
    _VERIFY_DATA("9.bin", 0x80004008);
    _SLEEP(2);
    _GET_CPU;
    _SET_ADDR(0x80E0 << 16);
    _SEND_FILE("onda.bin");
    _GET_CPU;
    _VERIFY_DATA("onda.bin", 0x80E0 << 16);
    _GET_CPU;
    _FLUSH;
    _GET_CPU;
    _STAGE2(0x80E10008);

   note: this is very similar to vx747, with the exception that vx747 uses
     _STAGE2(0x80E00008);
   while vx767 uses
     _STAGE2(0x80E10008);

3. at this point, the device will reset and present itself as a 65 MB (127488 * 512-byte sectors) storage device

4. put the appropriate IHFS image onto the device

5. unplug, the device will now boot into the system, probably directly from the IHFS image




explanation for each bin file (ALL integer values are stored as little-endian)

1.bin: this is a resource in onda's writer (2936 bytes)
2.bin: this is some kind of return code from the device, after writing 1.bin.
       this file is 4 bytes long and contains: 0x00000000
3.bin: this is also a resource (6288 bytes)
4.bin: this contains the parameters of 3.bin:
    uint32     sum of all bytes in 3.bin (0x00059335)
    uint32     filesize of 3.bin (0x00001890 == 6288)
5.bin: this is a packed file, with this format:
    uint32     total filesize (0x0004efe0 == 323552)
    uint32     sum of all bytes in VX767_V1.0.dl (0x00059335)
    uint32     filesize of VX767_V1.0.dl (0x0x00005ad0 == 23248)
    char[65524]     VX767_V1.0.dl padded with zeros up to (65536-4-4-4) bytes
    char[258016]     resource in onda's writer with size 258016 bytes
6.bin: some kind of parameter, 4 bytes, 0x00000001
7.bin: resource from onda's writer, 24256 bytes
8.bin: some kind of return code, 4 bytes, 0x00000001
9.bin: some kind of return code, 1 byte, 0x01
onda.bin: this is also a packed file, with this format:
    uint32     total filesize (0x00045380 == 283520)
    uint32     sum of all bytes in VX767_V1.0.dl (0x00059335)
    uint32     filesize of VX767_V1.0.dl (0x0x00005ad0 == 23248)
    char[65524]     VX767_V1.0.dl padded with zeros up to (65536-4-4-4) bytes
    char[217984]     resource in onda's writer with size 217984 bytes