Cracking the firmware of HiBy's linux devices

This repo is for:

• Tools to unpack/repack hiby os firmwares
• Documentation on the structure of the firmware
• Documentation on the device (datasheets, ISA, etc.)
• Other tools and information helpful for creating custom firmwares

This project is part of the hiby-modding organization. Also see:

• hiby-r3proii-custom-firmware by noisetta — complementary firmware modding project that adds Arabic text rendering support and documents the proprietary OTA firmware format.

• For now, this project focuses on the HiBy R3 Pro II, as it's the only one I have. As far as I know, there are some minor differences between the firmwares on the different HiBy linux devices, but most things apply universally.
• The goal of this project is to make it possible to modify the HiBy OS firmware to add custom functionality.
• For now, this project also only focuses on the HiBy OS firmware used by the generation including the R1, R3, and R3 Pro II
  • Older devices such as the R3 Pro and the R3 Pro Saber used a different format. see hiby-firmware-tools by SuperTaiyaki on GitHub for that older type of firmware

For equivalent functionality on Windows, please see docs/WIN_INSTALL.md.

• this README
• project TODO
• firmware file system structure
• Guides
  • firmware unpacking
  • firmware repacking
• R3ProII
  • specs
  • qemu readme
  • squashfs-root-example readme
• R1
  • specs
  • qemu readme
• Third Party
  • HiBy User Manuals
    • R3 Pro II
    • R1
  • Ingenic x1600e (SOC)
    • x1600e datasheet
    • XBurst ISA MXU
    • XBurst ISA MXU2
    • XBurst1 Programming Manual
  • Halley 6 (Ingenic x1600 development board)
    • hardware manual (translated)
    • baseboard schematic
    • coreboard schematic
  • Ingenic Docs Git
    • X16XX-halley6

For HiBy R3 Pro II

1. go to r3proii/unpacking_and_repacking
2. run unpack.sh (it will ask for sudo permissions for part of the script). this will create a gitignored folder called squashfs-root.
3. modify the contents of squashfs-root to make whatever custom firmware you want
4. run repack.sh (it will ask for sudo permissions for part of the script). this will create a gitignored file called r3proii.upt
5. flash that firmware file onto the device (how to do that is explained below)

Workflow Notes

• squashfs-root represents the root filesystem that will be flashed with the firmware.
• most/all of the files in squashfs-root will be owned by root, so it can be annoying to modify sometimes. This is also why it's gitignored
• r3proii.upt is the firmware file

• (TODO, make sure the following is correct) The HiBy OS filesystem is read-only, since it's a squashfs image. Only mounted storage, like sd_0 can be written to.