HiBy OS Crack

Cracking the firmware of HiBy's linux devices

Tip

If you just want to see instructions on how to install custom firmware onto your device: here's the guide)

---

This repo is for:

• Tools to unpack/repack hiby os firmwares
• Documentation on the structure of the firmware
• Documentation on the device (datasheets, ISA, etc.)
• Other tools and information helpful for creating custom firmwares

---

Note

This project is part of the hiby-modding organization. Also see:

• hiby-r3proii-custom-firmware by noisetta — complementary firmware modding project that adds Arabic text rendering support and documents the proprietary OTA firmware format.

Tip

How Can I Help❓: If you want to help with this project, whether you're a developer or not, look at HOW_CAN_I_HELP.md.

Tip

To talk with the community whether you're a developer or not, you can join the HiBy OS Modding discord: https://discord.gg/mSEuafxPH

I host the discord, and it has the same scope as this project (current HiBy OS devices)

The discord link will expire every once in a while. If you want to join but the link is expired, you can make an issue in this repo, or contact me in whatever other way to inform me.

Scope

• The goal of this project is to make it possible to modify the HiBy OS firmware to add custom functionality.
• For now, this project also only focuses on the HiBy OS firmware used by the generation including the R1, R3 II 2025, R3 Pro II, and Tempotec V1. These devices all use the .upt firmware format and have an Ingenic X1600E CPU.
  • Older devices such as the R3 Pro and the R3 Pro Saber used a different format. see hiby-firmware-tools by SuperTaiyaki on GitHub for that older type of firmware

Note for Windows

For equivalent functionality on Windows, please see docs/WIN_INSTALL.md.

Supported Devices

This repo is applicable to any HiBy OS device that uses the .upt firmware type. However, each device has it's own stock firmware and slightly different hardware.

We have collected documentation and created firmware unpacking/repacking scripts for the following devices:

• HiBy R1
• HiBy R3Pro II
• Hiby R3II 2025

Guides

• installing firmware
• firmware unpacking
• firmware repacking
• accessing ADB
• easter egg

Tools

• general upt firmware unpacking script (no helper)
  • Can unpack any .upt firmware
• general upt firmware repacking script (no helper)
  • Can repack any unpacked .upt firmware
• Unpacking and repacking helper scripts. Called unpack-helper.sh and repack-helper.sh exist in the unpacking_and_repacking directory for the relevant device.
  • Base firmwares are already provided
  • No configuring needed, just run the script and select what you want
  • This helper (automatic) script has only been written for devices that we've collected documentation and firmware for already, so we don't have it for every supported device yet. Feel free to contribute those for new devices.

Documentation

• this README
• project TODO
• firmware file system structure
• R3ProII
  • specs
  • output modes
  • qemu readme
    • QEMU functionality is very experimental, we haven't gotten very far into making it work
• R1
  • specs
  • qemu readme
    • QEMU functionality is very experimental, we haven't gotten very far into making it work
• Third Party
  • Curated
    • HiBy User Manuals
      • R3 Pro II
      • R1
    • Ingenic x1600e (SOC)
      • x1600e datasheet
      • XBurst ISA MXU
      • XBurst ISA MXU2
      • XBurst1 Programming Manual
    • Components
      • CW2015 datasheet
      • MP2731 datasheet
      • AXP2101 datasheet
    • Halley 6 (Ingenic x1600 development board)
      • hardware manual (translated)
      • baseboard schematic
      • coreboard schematic
      • software platform rapid development
      • uboot development
      • kernel development
      • platform application development
      • linux 4.4 kernel modularity
      • reserved memory configuration description
  • Sources
    • Ingenic Docs Git
      • X16XX-halley6
    • Ingenic Public FTP Server
      • URL: ftp://ftp.ingenic.com.cn
      • Username: ingenic_public
      • Password: BFdg2f9B12

Unpacking and Repacking Workflow Overview

Tip

For more specific and detailed instructions, look at UNPACKING.md and REPACKING.md.

1. Depending on your device, enter either the r1 directory or the r3proii directory
2. if you want to unpack a firmware not in this repo already, add it in the firmware/custom directory
3. enter the unpacking_and_repacking directory for your device
4. to unpack your firmware use the unpack-helper.sh script and choose the firmware you want to unpack
   • The linux root filesystem of the firmware will be extracted into a folder
5. to repack your firmware, just run the repack-helper.sh script

Note

• You might need to create the firmware/custom directory if it doesn't exist
• I've made it so that the unpacking and repacking scripts no longer need sudo in order to run