The WinCE binary (e.g. nk8.bin) is a sparse file format which needs
to be laid out in memory first. This utility does this erase block
by erease block. Once an erase block size worth of data have been
read, it tries to find a good erase block and writes the data to it.
Good erase blocks are searched from the end of the image partition
(64Mb) backwards... Every valid/good erase block is recorded in the
partition table, which is written at the first valid block starting
from 0x00380000 (U-Boot environment partition)
This utility expects to have access to the flat/full MTD device, use Kernel CONFIG_MTD_PARTITIONED_MASTER which provides the master MTD device allowing access to the complete NAND...
The MTD RAM test driver can be used to test the utility on x86:
modprobe mtdram total_size=524288 erase_size=128
Let flash_wince read it from stdin:
# cat nk7.bin | ./flash_wince -n 64 /dev/mtd0 -
A valid partition table/config block should look somewhat like this:
00380000 54 4f 52 41 44 45 58 43 4f 4e 46 49 47 42 4c 4b |TORADEXCONFIGBLK|
00380010 00 40 01 cf 02 40 10 00 40 00 00 00 00 02 ff 01 |.@...@..@.......|
00380020 fe 01 fd 01 fc 01 fb 01 fa 01 f9 01 f8 01 f7 01 |................|
00380030 f6 01 f5 01 f4 01 f3 01 f2 01 f1 01 f0 01 ef 01 |................|
00380040 ee 01 ed 01 ec 01 eb 01 ea 01 e9 01 e8 01 e7 01 |................|
00380050 e6 01 e5 01 e4 01 e3 01 e2 01 e1 01 e0 01 df 01 |................|
00380060 de 01 dd 01 dc 01 db 01 da 01 d9 01 d8 01 d7 01 |................|
00380070 d6 01 d5 01 d4 01 d3 01 d2 01 d1 01 d0 01 cf 01 |................|
00380080 ce 01 cd 01 cc 01 cb 01 ca 01 c9 01 c8 01 c7 01 |................|
00380090 c6 01 c5 01 c4 01 c3 01 c2 01 c1 01 c0 01 bf 01 |................|
003800a0 be 01 bd 01 bc 01 bb 01 ba 01 b9 01 b8 01 b7 01 |................|
003800b0 b6 01 b5 01 b4 01 b3 01 b2 01 b1 01 b0 01 af 01 |................|
003800c0 ae 01 ad 01 ac 01 ab 01 aa 01 a9 01 a8 01 a7 01 |................|
003800d0 a6 01 a5 01 a4 01 a3 01 a2 01 a1 01 a0 01 9f 01 |................|
003800e0 9e 01 9d 01 9c 01 9b 01 9a 01 99 01 98 01 97 01 |................|
003800f0 96 01 95 01 94 01 93 01 92 01 91 01 90 01 8f 01 |................|
00380100 8e 01 8d 01 8c 01 8b 01 8a 01 89 01 88 01 87 01 |................|
00380110 86 01 85 01 84 01 83 01 82 01 81 01 80 01 7f 01 |................|
00380120 7e 01 7d 01 7c 01 7b 01 7a 01 79 01 78 01 77 01 |~.}.|.{.z.y.x.w.|
00380130 76 01 75 01 74 01 73 01 72 01 71 01 70 01 6f 01 |v.u.t.s.r.q.p.o.|
00380140 6e 01 6d 01 6c 01 6b 01 6a 01 69 01 68 01 67 01 |n.m.l.k.j.i.h.g.|
00380150 66 01 65 01 64 01 63 01 62 01 61 01 60 01 5f 01 |f.e.d.c.b.a.`._.|
00380160 5e 01 5d 01 5c 01 5b 01 5a 01 59 01 58 01 57 01 |^.].\.[.Z.Y.X.W.|
00380170 56 01 55 01 54 01 53 01 52 01 51 01 50 01 4f 01 |V.U.T.S.R.Q.P.O.|
00380180 4e 01 4d 01 4c 01 4b 01 4a 01 49 01 48 01 47 01 |N.M.L.K.J.I.H.G.|
00380190 46 01 45 01 44 01 43 01 42 01 41 01 40 01 3f 01 |F.E.D.C.B.A.@.?.|
003801a0 3e 01 3d 01 3c 01 3b 01 3a 01 39 01 38 01 37 01 |>.=.<.;.:.9.8.7.|
003801b0 36 01 35 01 34 01 33 01 32 01 31 01 30 01 2f 01 |6.5.4.3.2.1.0./.|
003801c0 2e 01 2d 01 2c 01 2b 01 2a 01 29 01 28 01 27 01 |..-.,.+.*.).(.'.|
003801d0 26 01 25 01 24 01 23 01 22 01 21 01 20 01 1f 01 |&.%.$.#.".!. ...|
003801e0 1e 01 1d 01 1c 01 1b 01 1a 01 19 01 18 01 17 01 |................|
003801f0 16 01 15 01 14 01 13 01 12 01 11 01 10 01 0f 01 |................|
00380200 0e 01 0d 01 0c 01 0b 01 0a 01 09 01 08 01 07 01 |................|
00380210 06 01 05 01 04 01 03 01 02 01 01 01 00 00 00 00 |................|
00380220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
The Windows CE image on flash is layed out on flash, afaict as it should be in memory later. The last block typically has the start of the image, this hexdump shows a valid WinCE image start on flash:
$ sudo hexdump /dev/mtd0 -s $((0x200 * 0x0020000)) -C | head
04000000 96 1e 00 fa ff ff ff ff ff ff ff ff ff ff ff ff |................|
04000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
04000040 45 43 45 43 70 86 08 82 70 d6 fd 01 ff ff ff ff |ECECp...p.......|
04000050 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
04001000 00 00 00 00 e2 ae e7 58 00 00 00 00 02 00 00 00 |.......X........|
04001010 20 00 00 00 30 7a 00 00 30 7a 00 00 00 00 00 00 | ...0z..0z......|
04001020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
04001030 00 00 00 00 00 00 00 00 70 86 08 82 00 00 00 00 |........p.......|