Boot from sd card

Different u-boot configurations search the SD card in different locations for a boot script. The common locations are:

/scriptcmd
/wmt_scriptcmd
/FirmwareInstall/autorun.1.wmt

All these scripts function the same, and you can create all 3 options at once to give you coverage over different u-boot configurations.

If none of these work, it is relatively painless to determine the correct location from a rooted Android installation.

1. Check dmesg output. There should be some references to partitions being added for an MTD. We are looking for one named 'u-boot-SF' or similar.

[ 2.029736] Creating 4 MTD partitions on "mtdsf device":
[ 2.034999] 0x000000000000-0x000000050000 : "u-boot-SF"
[ 2.041647] 0x000000050000-0x000000060000 : "u-boot env. cfg. 1-SF"
[ 2.049249] 0x000000060000-0x000000070000 : "u-boot env. cfg. 2-SF"
[ 2.056833] 0x000000070000-0x000000080000 : "w-load-SF"
[ 2.063389] wmt sf controller initial ok

2. The serial flash should be added before the NAND so these partitions will be 0-based. In this example the uboot code is the first partition, so it will be mtd0. Dump the partition's data to file.

cat /dev/mtd/mtd0 > mtd0dump.bin

3. mtd0dump.bin is most likely now a compressed uboot image. Open the file in a hexeditor, and locate the gzip header (0x1F 0x8B). It usually follows on from the error message strings for the uncompressed uboot code. Now dump the file from the header location to the end:

dd if=mtd0dump.bin bs=1 skip=<offset> of=uboot.gz where <offset> is the location of the header within the file.

Check the uboot.bin output file, and ensure the first two bytes are 0x1F 0x8B.

4. gunzip uboot.gz - You will now have an uncompressed uboot image which contains the uboot code and some message strings.

5. Search through the uncompressed messages: you are looking for something the suggests the location of an mmc load. Keywords to look for are 'fatload' and 'mmc'. Remember that the string is #0 terminated (It can be hard to determine the end of strings in a hex editor :) )