xDuoo X3 Firmware

---

This page describes the details of the XDuooX3 firmware.

Firmware update format

Firmware updates takes the form of a RAR file containing instructions and an update.zip file. To update the device, navigate to TopMenu->Setting->Upgrade->Yes. The new firmware must be a file named update.zip placed in the root directory of a uSD card formatted with FAT32.

update.zip

The update.zip files contains the following files:

file	type	usage
u-boot-nand.bin	raw nand image	raw image of u-boot
ubifs_cache_carina.img	raw UBIFS nand image	unknown and empty file system
ubifs_ro_carina.img	raw UBIFS nand image	unknown and empty file system (mounted read-only)
ubifs_rw_carina.img	raw UBIFS nand image	unknown and empty file system (mounted read-write)
ubifs_rootfs_carina.img	raw UBIFS nand image	root filesystem
uImage-normal	Linux image	Normal Linux image
uImage-revy	Linux image	Recovery Linux image ?
tools/update_binary	ELF file	file executed on update ?
tools/scripts/updater_script	script	script executed by update_binary ?

U-Boot file

TODO

UBIFS files

It is possible to extract the content of the UBIFS file using the extract_ubi.sh script attached to this page. Please note that:

• these are RAW UBIFS file, ie the content of the raw flash, typically produced by ubinize (and NOT by mkfs.ubifs)
• it seems that the flash has page size 2048 and does not support (or use) sub-page, in other word sub-page size is also 2048

More information about UBI and UBIFS can be found here.

All but the rootfs seem empty.

Root file system

The root file system contains a busybox distribution. The init RC files eventually execute /etc/init.d/rcS that takes care of mounting the various UBIFS volumes and then execute /usr/sbin/startup.sh. This scripts seems to starts nano-X (a small X server ?) and then /ihifi/bin/ihifiplay which is the main binary.

Linux kernel version seems to be 2.6.31.3. The only kernel function compiled as a module seems to be the USB mass storage. The rootfs does not seem particularly cleaned up, with a lot of network-related binaries (which an hypothetical remote debug can't justify alone). Remote debug does not seem to be documented by Ingenic in their SDK, except over serial.

The two ro and rw images above seem to be deemed to be mounted on the 2 available mount points in the tree : /mnt/config_ro and /mnt/config_rw (these are not referenced in /etc/fstab however).

Updater files

The binary has not been investiagted but the update script is readable and seems to simply write the various images to the MTD volumes. Interestingly, the u-boot-image.bin file does not seem to be used, so it is unclear what its purpose is.

-- AmauryPouly - 24 Dec 2015