diff --git a/README.md b/README.md new file mode 100644 index 0000000..80942d1 --- /dev/null +++ b/README.md @@ -0,0 +1,32 @@ +# reMarkable 2 Recovery / Unbricking + +Tools for recovery (works only under Linux) + + +## Prerequisites + +To put the rM2 in recovery, you will need: +- USB-C breakout board +- Pogo pin adapter to usb +- [imx_usb_loader](https://github.com/boundarydevices/imx_usb_loader) a binary is included, but feel free to compile it + + +![Pogo](images/pogo1.jpg) +![USB-C Breakout](images/usb1.jpg) + + +## Recovery Mode +* run `dmesg -w` on your host to monitor +* power off the device +* connect the USB-C breakout board +* pull down **B8** (connect a 10K resistor to GND) +* connect the pogo pins to the tablet and to the host usb +* if the device does not start on its own, press the Power Button +* you should see a new device *USB HID v1.10 Device [Freescale SemiConductor Inc SE Blank ULT1]* +* run `./imx_usb` +* should see *USB Mass Storage device detected* +* should see a new mountable block device + + + + diff --git a/imx_usb b/imx_usb new file mode 100755 index 0000000..152bdfd Binary files /dev/null and b/imx_usb differ diff --git a/imx_usb.conf b/imx_usb.conf new file mode 100644 index 0000000..aecb9e1 --- /dev/null +++ b/imx_usb.conf @@ -0,0 +1,2 @@ +#vid:pid, config_file +0x15a2:0x0076, mx7_usb_work.conf diff --git a/mx7_usb_work.conf b/mx7_usb_work.conf new file mode 100644 index 0000000..4d34a45 --- /dev/null +++ b/mx7_usb_work.conf @@ -0,0 +1,36 @@ +mx7 +#hid/bulk,[old_header,]max packet size,dcd_addr,{ram start, ram size}(repeat valid ram areas) +hid,1024,0x910000,0x80000000,1G,0x00900000,0x20000 +#u-boot.imx:dcd,plug +#zImage-4.14.78:load 0x80800000 +#zero-sugar.dtb:load 0x83000000 +#initramfs.cpio.gz.uboot:load 0x83800000 +#u-boot.imx:clear_dcd,plug,jump header2 +u-boot-ums.imx:jump header +#file:dcd,plug,load nnn,jump [nnn/header/header2] +#jump nnn - header is after last downloaded word +# entire file is loaded before jump, needs load nnn as well +# i.e. file:load nnn,jump nnn +#jump header - only length parameter is downloaded +#header - uses existing header(error if none), but clears plug and dcd values unless plug also specified +#header2 - uses 2nd header found(error if none) +#plug - without jump uses header but clears plug flag to stop after plug execution +#load nnn - load entire file to address +#../u-boot-imx6/u-boot.bin:dcd,plug,jump header +#:modify,020e02a8,7,1 +#:modify,020e00bc,7,4 +#:read,020e02a8 +#:read,020e00bc +#:read,020c4078 +#:modify,020c407c,0,0f000000 +#:modify,020c4080,0,c00 +#:read,020c4084 +#../imx_utils/mx6_ddr_init_xm.bin:dcd +#../u-boot-imx6/u-boot.bin:load 0x13effc00 +#../u-boot-imx6/u-boot.imx:load 0x13f00000 +#../u-boot-dirk/u-boot.imx:load 0x13f00000 +#u-boot-6w.bin:load 0x13effc00 +#u-boot_1103.bin:load 0x13effc00 +#u-boot_1103.bin:jump header +#../imx_utils/mx6_ecspi_ram_write_xm.bin:clear_dcd,plug +#../imx6_obds/output/mx61/bin/diag-obds-mx61qsb-rev1.bin:jump header diff --git a/u-boot-ums.imx b/u-boot-ums.imx new file mode 100644 index 0000000..f40ccb4 Binary files /dev/null and b/u-boot-ums.imx differ