See here for my review of the M001.

Eken M001

This teardown shows the V006 revision of the board, a quick serial port install, and includes some console/dmesg output. The main difference between V005 and V006/V007 board revisions seems to be relocating the USB WiFi dongle to a better position.

EDIT: It took me a while to post this article, and Slatedroid is down this past week. So links to there will be broken (hopefully not for good.)

This isn’t the first teardown of the Eken M001, the first one was the “Aimless Teardown” and there is also a disassembly howto video by another community member.

Warning

I’ve had lots of hardware problems with my Eken since I took it apart. They may have been there before, but maybe not. YMMV, but be careful and remember you may not still have a warranty after the device has been opened, and especially after it’s been modified.

Specifically, I have two problems. There is a cold solder joint in one corner of the board (I’m currently warming it up before it will boot at all.) Also I get occasional failure of the LCD (totally black) on reassembly, which requires me to press on the front of the unit until it clicks back on.

Getting In

  1. Remove the two phillips screws on each side of the base:
    Base of Eken
  2. The only other thing holding the back on is a series of plastic clips around the outside of the unit. Working from the base (the first clip is half-way between the two screws), carefully insert a plastic spudger or a knife (worse, but what I used) and jiggle it around until each clip snaps open. Some clips may break, they’re not very strong.

    Then work your way along towards the top of the unit:
    Eken part open

    Eken more open

  3. Once all the clips have popped, remove the plastic back. Take care not to disturb the small speaker
    Small speaker in the plastic back
    Plastic back

Main Board

Main board as installed
(Click through for a high-res version.)

You can see:

  • Battery and backlight connectors bottom-left
  • Internal USB soldered to pads bottom-right (leading up to the USB WiFi module, installed top left.)
  • LCD and touchscreen ribbon connectors on the left side.
  • Main CPU daughterboard in DIMM socket.
  • CPU Board

    Here’s some shots of the CPU daughterboard:
    CPU daughterboard front
    CPU daughterboard back
    The board is hosting a VIA/Wondermedia WM8505 SoC. Datasheet shared here (courtesy Slatedroid, again.

    Serial Connector

    J17 on the back of the board is a RvTTL (3.3v) serial port. 115200 8N1. Pinout, left to right, is Vcc Tx Rx Gnd.

    I didn’t take any photos of it before I soldered on my serial port, but here it is after:
    Eken M001 serial port

    The only other interesting thing I saw on the back of the board was the 2Gb NAND flash:
    2Gb NAND flash

    Boot logs

    Once you have the serial port connected, you can grab some log data easily (and you also get a root shell once startup completes.)

    EDIT: As of firmware release 1.7.4, no more automatic root shell on serial console. It’s still a boot console, but for root you need to log in… Poor show, Eken.

    Standard kernel boot log, plus some /proc entries
    Log of a factory upgrade via SD card

    I meant to capture and post some of the ‘logcat’ Android log output as well, from standard startup, but it doesn’t look like I kept any.

47 thoughts on “Eken M001 teardown & serial console

  1. NO NO NO! DO NOT USE RS-232!!

    The tablets have 3.3v LVTTL (aka RvTTL) serial ports. RS-232 is 12v, not compatible and could possibly fry the board!

    There are converter chips that will convert RS232 voltage levels to LVTTL for you.

    However, by far the easiest way to get LVTTL is to get an old mobile phone data cable. I have a whole bunch I’ve picked up from op shops (aka thrift stores) because people threw them out, but you can still get them new on ebay for a couple of bucks. Here’s a good page with some model numbers and a description of how to rewire one:
    http://buffalo.nas-central.org/wiki/Use_a_Nokia_Serial_Cable_on_an_ARM9_Linkstation

    For mine, I’ve only wired Rx Tx and Gnd. Vcc is not a required connection for most of the mobile phone style USB< ->Serial cables.

    Good luck. :)

  2. Hi. My M001 was damaged after an unsuccessful firmware update. Now he does not start, the screen goes black, sometimes the screen flashes when tightening the power button.
    How can I use the serial port to insert the boot files in the flash memory?
    Another thing, what kind of connector should I solder on the motherboard to get root access and what cable I use to connect the device to pc?

    Thank you!

  3. ok, i have dissasembled my bricked m001, tomorrow i will find my old nokia cable and sold cable into the mainboard (tx with tx or tx with rx??? sorry for the question[…]), but i have no idea what is the next move… i want to know what data (and where to find this) i need to write to memory, what soft i need to write data and all for revive my m001

    thanks for all,i think your work is very useful for a lot of people!!!

  4. Slideman/jose (I’m guessing you two are the same person?):

    – Serial cable goes tx< ->rx rx< ->tx. I recommend testing the connection before you solder anything in place, just in case you have it backwards (have learned this the hard way.)

    – While you have it apart, be careful not to flex the board or damage anything. I think these boards are pretty fragile, mine now has a variety of “quirks” that are probably caused by me tearing it down so many times.

    – If your M001 is completely bricked (ie no “Android logo” boot screen) then it’s possible part of the bootloader (either or both of W-Load and u-boot) has been corrupted in the flash. If this is the case, the serial cable cannot save you. The only way to fix the machine would be to rewrite the flash directly or via JTAG, and AFAIK there is no known way to do that on the M001. Sorry.

    – However, the only way to be sure is to plug in the serial cable and look at the boot log. If you want to see what the normal output from W-load and u-boot looks like, please see the boot log that’s linked from the post.

    – It is possible the bootloader is not corrupt, but something else is, and you’ll find yourself dropped to a W-load or a u-boot console (if it boots past this stage, you can press any key during the boot process to drop to the u-boot console, as well.)

    – If the bootloader does work, you may get some clues as to what went wrong by trying a firmware upgrade from the SD card and looking at the console output as it runs.

    – Do the power lights come on as expected when you power your M001 up? Does it make any sounds?

    Good luck. :).

    – Angus

  5. Hi. When I turn on the tablet, nothing appears on screen. Sometimes the screen flashes. The only thing visible is the red light on, indicating that the device is connected.
    The device does not boot and does not read the sd card. When I turn off the tablet, it happens immediately, without having to hold the power button for several seconds.
    The behavior of the device is looking for a switch light bulb, turns on and off, without any response from the tablet.
    I’ll have to write the boot files directly into flash, I think.
    Do you know a link with instructions to build a Jtag cable?
    Is there a way to connect the cable to the device?
    Thank you for your attention.

    PS: I am not Jose.

  6. hi, no, i’m not slideman, bit i have same error, press start and red light on, nothing more. as i comment i need to know what program need to use with jtag to try to read memory and see what is wrong. sorry for my english and thanks for all

  7. Slideman/jose – Noone has identified JTAG pins on the board, so I don’t think you’ll have any luck with it unless you can track them down (if they exist).

    If I were you, I’d connect the serial cable and see how far the boot process gets. If the bootloader is corrupt then I’m afraid the cheapest and easiest option is probably to buy a new tablet.

    Then again, if you’re lucky and the bootloader is still there then you can probably unbrick it.

  8. ahh sorry i was confused with the serial connector that you put i was thinking that this was the jtag!!!. ok, but my question is that when i make the connection like you, what soft can i use to read/write flash???

  9. jose – if it works, you’ll find yourself able to drop into an interactive u-boot prompt. If you google u-boot you’ll find the command guide.

    Also, if you look in the scriptcmd file that comes in the upgrade (tail -c +73 scriptcmd) then you’ll see all of the u-boot commands that the upgrade runs to reflash various sections, which should give you some idea what’s going on.

    Your first step is still to find out if you have u-boot running at all, and how far the boot process is actually getting.

  10. good and bad notices, serial connected, this is the good :(
    only this is shown:
    WonderMedia Technologies, Inc.
    W-Load Version : 0.17.00.01
    ethaddr…………found
    W-Load loading…
    i can’t do nothing no???

  11. Hello,
    I have a big problem, I updated my tablet M001 EKEN with SlateDroid version and all went well. but when I rebooted my tablet, I forgot to change the folder SCRIPT and I turned off the system, but unfortunately too late. Now when it starts, it displays the boot page of Android. I think he lost the bootloader. Question: Is it possible with the USB connector, to directly program the VIA WM8505? otherwise possible, with the mounting RS232, to directly program the VIA WM8505? if so, do you have the software programming of the bootloader program? thank you for your help.

  12. Someone find a solution?

    I have my M001 inthe state of turning on and off with red light but nothing else.screen flasjh for few milisecond and off.

    Anyway to unbrick yet?

    Thank you

  13. Hi Guys

    i have accidentally messed up my spi flash, i thought it would be a hassle as my iped has jtag lines. but this is proving harder than i thought to revive as there is near zero docs available on the wm8505+

    i can connect to it via openocd , and get a tisngle tap 0x07926f0f. but cant seem to
    get the flash or spi to reveal themselves. i can send it a load image u-boot.elf file.

    then run it, but nothing happens.

    any pointers?

  14. Zianna,

    Sorry to hear that. JTAG is one step better than on any of my tablets! So I don’t have any hints for you, sorry.

    Someone on slatedroid.com desoldered their SPI flash and replaced it with another reflashed one, the site is down at the moment so I can’t find you a link. So you could try that if you’re keen.

    Good luck. :)

    – Angus

  15. How do I actually connect this to a computer to look at the logs. I have an arduino with TX and RX so could I plug it into that and use the arduino serial monitor? What baud rate should I use?

    • Hi Scytheon,

      I use a hacked up mobile phone cable, as described a few comments up.

      You can use an Arduino, but bear in mind Arduinos are TTL (5v) level whereas the M001 is RvTTL (3.3v) level. I don’t know if the chip is 5v-tolerant or not. Otherwise, you can look online for ways to build a “level shifter” circuit to let the M001 talk to the Arduino, which then talks to the computer.

      Might be easier to just buy a $2 Nokia cable on ebay, though.

      Good luck. – Angus

  16. Thanks Angus

    so i gave in, and desoldered the spi chip and reflashed it off the board.
    hopefully one day we can get to use the jtag on this puppy..

    i dont give up easily ;)

  17. Hi Guys,

    so after desoldering and doing it the long way i took te time to figure out how to do it via jtag, for those who may be intereseted ….

    when turning on the device it got stuck at

    WonderMedia Technologies, Inc.
    W-Load Version : 0.19.00.01

    hmm no u-boot there… so get out your jtag cable and tools (i used openocd 0.4.0)

    once its all connected openocd should display

    Open On-Chip Debugger 0.4.0 (2010-02-22-19:05)
    Licensed under GNU GPL v2
    For bug reports, read
    http://openocd.berlios.de/doc/doxygen/bugs.html
    trst_and_srst separate srst_gates_jtag trst_push_pull srst
    Info : clock speed 6000 kHz
    Info : JTAG tap: WM.cpu tap/device found: 0x07926f0f (mfg:
    ver: 0x0)
    Info : Embedded ICE version 6
    Info : WM.cpu: hardware has 2 breakpoint/watchpoint units

    now telnet to localhost on port 4444
    , and issue a soft_reset_halt, followed by a reset init

    now you need to load a full 512K image of the spi

    > load_image 4m.bin
    524288 bytes written at address 0x00000000
    downloaded 524288 bytes in 37.466145s (13.666 kb/s)

    and resume the processor
    > resume 0x00000000

    #### SUCCESSS #####

    on my serial console i get

    U-Boot 1.1.4 (Apr 26 2010 – 20:48:31)
    WonderMedia Technologies, Inc.
    WMT U-Boot Version : 0.12.01.00.16
    U-Boot code: 03F80000 -> 03FB8134 BSS: -> 04006544
    RAM Configuration:
    Bank #0: 00000000 128 MB
    boot from spi flash.
    flash:
    Bank1: FF800000 — FFFFFFFF
    Bank2: FF000000 — FF7FFFFF
    Flash: 16 MB
    In: serial
    Out: serial
    Err: serial
    ### main_loop entered: bootdelay=1

    bootcmd=”nand readblob 3c00000 600000;logo show;run text1″
    maddr = 0x3c00000, naddr = 0x600000

    Read header
    CE0: NAND FLASH ID: 0xECD59429
    Err : Can not find any nand flash
    Init Flash Failed rc=-1
    Header is 0x00000000 0x00000000
    error: magicNum = 0x0, it should be 0x80101000

    show logo …..
    LCD param (setting): 1,30000,8,800,480,48,40,40,3,29,13
    PWM param (setting): 0,4,599,599
    LCD FrameBuffer = 0x0FD00000, BMP Address = 0x03C00000
    Error : Not BMP Format
    Unknown command ‘textout2’ – try ‘help’
    Execute register operation:
    reg op: 0xD8110064 | 0x8
    reg op: 0xD811008C | 0x8
    reg op: 0xD81100B4 | 0x8
    reg op: 0xD8110064 | 0x4
    reg op: 0xD811008C | 0x4
    reg op: 0xD81100B4 & 0xFFFFFFFB
    reg op: 0xD8130054 | 0x1
    ### main_loop: bootcmd=”nand readblob fc00000 b00000;nand read 0 0 300000;bootm
    0″
    Hit any key to stop autoboot: 0
    ATSMB Host 390KHz
    SD Card is not inserted
    maddr = 0xfc00000, naddr = 0xb00000

    Read header
    CE0: NAND FLASH ID: 0xECD59429
    Err : Can not find any nand flash
    Init Flash Failed rc=-1
    Header is 0x00000000 0x00000000
    error: magicNum = 0x0, it should be 0x80101000

    CE0: NAND FLASH ID: 0xECD59429
    Err : Can not find any nand flash
    Init Flash Failed rc=-1
    ## Booting image at 00000000 …
    Bad Magic Number
    WMT #

    NOT IDEAL, but it’s alive

    at this point inser your sd card with the correct script folder and then use fatload etc/// to reflash the tablet as normal

    hope this helped some one ;)

  18. (I should add that I asked Ziann123 how they got JTAG in the first place, and apparently the newer revision boards have a well-labelled JTAG header on them!)

  19. HI, take note of just the processor, the only pic i could find which looks like min (cept this one has no RAM)..

    i have already solderd a connection onto my board so a pic would be useless as you cant see the connections

    [IMG]http://i53.tinypic.com/2qcjdw1.jpg[/IMG]

  20. Hi can anyone please help?
    I have soldered a Nokia CA-42 Cable to the JTAG on the mainboard.
    and tested the port and it is connected OK.
    I was woundering of someone could tell me the Terminal commands to see the log file on my Moo1?

    I am running Ubuntu 10.10 and Moserial Terminal.

    Thanks Paul.

  21. Major mobile phone manufacturers have agreed to standardized power connector. Why this approch is not used in other technology fields? I have many JTAG cables and still there are boards that need special adapter.

  22. Wanted to thank you for your log posts AND the nokia info!

    I have been fighting a ‘no logo’ and SD-only-boot condition for awhile, and I believe your logs have shown ‘the cheese at the end of the maze’.
    (plus one that needs the serial connection IF it can come back at all…)

    Will update with progress! Thanks again!
    Lee

  23. Update:
    Got the Nokia cable and rigged up a ‘fancy’ connector for it…
    Got inside and learned EVERYTHING I needed to know…
    Except for ONE THING…
    Do NOT write a script that changes the bootcmd variable to the logocmd variable.
    The command now loads the logo into RAM and then…. sits there.
    Never makes it to a ‘boot’ condition so it does not allow for console-override.

    I LIKE my battery operated paperweight!
    I am going to consider attempting an SPI programmer and SPI-removal/reinstall… sometime in the future.
    Regards!
    Lee

  24. Lee, so it breaks just before “### main_loop: bootcmd=…” “Hit any key to stop autoboot”? That’s unfortunate, the logo text must be overflowing whatever buffer bootcmd is intended to load into. I’m guessing you tried sending serial input to interrupt the boot anyhow, just in case?

    Before going the SPI route, double-check you don’t have a JTAG enabled board (see Ziann’s comment above), though.

  25. Hello there,
    great Work!!!!

    I have one simple question: is the serial Port, which you have used, a real serial port? For example: Can i solder a GPS Mouse with a serial cable (RX TX etc.) directly to the Pins and select this Port in any software? The great benefit would be that there is no need for drivers when the navigation software talks directly to the GPS receiver via Serial port and gets it datas via RX TX…
    Please gimme a answer… :-)

  26. Thasso,

    It’s a serial port, with some caveats:

    First, it’s just a LVTTL (3.3v) serial port not an RS-232 serial port. Different signal voltage levels.

    Second, Linux kernel console is running on that serial port so AFAIK you’d need to change the console= boot parameter to put the console somewhere else, before you could use it.

    Another 3.3v serial port (ttyS1) is apparently available on the dock connector. I don’t know the details, but you might want to try and find out about that one (although USB is also available on the dock connector, and internally, you could always hook up a USB GPS device or a USB< ->Serial adapter with a GPS device.)

  27. @hoppo Not trying to act the Martinet or anything here, but you don’t solder the Nokia CA42 USB to LVTTL serial port adapter to your JTAG pads. JTAG sigals are stuff like TCLK, TDI, TDO, TMS etc.(on the CPU card of my (Maylong?) ‘Pad.)
    whereas our serial console port has good ol’ TXD RXD power gnd.
    (that’s in ‘The Dongle Box’ for my ‘Pad, thought I didn’t have one for a minute there)
    BTW 115000 baud no flo control for serial console.
    if it stays ‘dead looking’ then it’s JTAG time.
    Michael from iLSD

  28. Hello again!

    I found out later that the ‘soft brick’ (what I call it now) DOES in fact have JTAG pads on it, and I (supposedly) connected to it with a BLACKCAT-USB unit…

    Does not do much more than questioning if the device has power.
    As the BC is also setup to program SPI directly I have ordered the chip adapter and wait for its arrival. I have already removed the SPI from the ‘hard brick’ (different device. same chip) and intend to ‘practice’ on it before swapping out the chip into the ‘soft brick’…

    But I DO have a Sylvania board (more like the ‘hard brick’ in design) that works! :D

  29. It looks like Im closer to a working unit BWO the SPI method…
    Still cannot get a response from the JTAG connector, but only a couple days away from the SPI fix…

    Will drop by again to say ‘yay or nay’! :D

  30. i have same light on of easily problem
    th ‘ding’ vibration is also
    i opened the tab
    while charger is in
    the red light flashes
    on then off …..
    any idea abt my problem
    and any solution??

  31. Thanks for this. I just hooked up my broken M001 (smashed touch screen, broken lcd) fire up Putty and up come the linux boot messages. Command line fun! Now all I have to do is to work out whether it’s worth forking out $45 for replacement parts. To tell the truth the M001 aint very good – horrible, horrible 256 colour(in 2011) LCD and laughable battery life. ( But I do like the guess at what the ipad was going to look like – attractive if not very functional). The M009s is thankfully much better.

    Francis Boyle (Ae7flux on Slatedroid)

  32. Hi Francis,

    I wouldn’t pay $45 for a brand new M001, let alone for parts! The market has moved on a lot in the last 12 months.

    You might be able to find someone whose M001 has died in a different way and get a touchscreen more simply, though. Good luck!

  33. question for Ziann123 – I have Jtag connectors or at least I think I do. It shows pad with GND, TX, Rx, 3v3. Do you picture of your connector you used to connect to the jtag connector? should the device have power or does the power come from the Jtag?

  34. I try to connect to the board at 150200 or 150000 speeds, but I get rubbish. Putty shows me strange charachters maybe one or two. When I press the off button I get: “…………….” thats all… I’m stumped…

Leave a Reply

Your email address will not be published. Required fields are marked *