Sonoff NSPanel Pro 120: Backup

In the previous article, we already got the partitions read out. Now it's time to make a backup and save it so that whatever we do, we can at least revert all the changes.

rkdeveloptool Options:

We will use the rkdeveloptool rl command to read all the sectors. After reading the entire dump, it turned out that only 32 MB of the eMMC could be read; the other bytes are filled with 0xCC bytes. Therefore, the only partitions that could be read are:

00 00000000 partition + miniloader
01 00004000 uboot
02 00006000 trust
03 00008000 misc
04 0000A000 resource

However, we can easily patch U-Boot to allow us to dump without limitations. Follow these steps:

1. Grab uboot.img from dump
2. Unpack uboot.img with loaderimage tool
3. Open uboot.bin with an hex editor and search for 81 00 01 8B 24 00 02 8B 9F 40 40 F1 49 01 00 54
4. Replace 40 40 with 00 60 and save it
5. Repack uboot.img & flash it with rkdeveloptool wl 0x4000 uboot_patched.img

Patched uboot for NSpanel 120 could be found here: uboot_patched.img

After uploading the patched U-Boot, reset the panel with the following command:

rkdeveloptool rd

Then, proceed to make a backup of all partitions using the commands below:

rkdeveloptool rl 0x00 0x4000 stl_loader.img
rkdeveloptool rl 0x4000 0x2000 uboot.img
rkdeveloptool rl 0x6000 0x2000 trust.img
rkdeveloptool rl 0x8000 0x2000 misc.img
rkdeveloptool rl 0xA000 0x8000 resource.img
rkdeveloptool rl 0x12000 0x10000 kernel.img
rkdeveloptool rl 0x22000 0x10000 boot.img
rkdeveloptool rl 0x32000 0x20000 recovery.img
rkdeveloptool rl 0x52000 0x38000 backup.img
rkdeveloptool rl 0x8A000 0x2000 security.img
rkdeveloptool rl 0x8C000 0xC0000 cache.img
rkdeveloptool rl 0x14C000 0x300000 system.img
rkdeveloptool rl 0x44C000 0x8000 metadata.img
rkdeveloptool rl 0x454000 0xC0000 vendor.img
rkdeveloptool rl 0x514000 0x80000 oem.img
rkdeveloptool rl 0x594000 0x400 frp.img
rkdeveloptool rl 0x594400 0x8000 smatek.img
rkdeveloptool rl 0x59C400 0x200 keypart.img
rkdeveloptool rl 0x59C600 0x200 STSN.img
rkdeveloptool rl 0x59C800 0x8F3800 stback.img

Backup is available here

That's it! Now we have a full backup. In the next article, we will examine the backup and attempt to create a Linux/Android firmware for the panel.