Reverse engineering and bare-metal development for the AIPC netbook (a.k.a. Zenithink ZT-N670 or Disgo 3000), a retro WinCE-based handheld netbook built on the Anyka AK7802 SoC (ARM926EJ-S). The long-term goal is a working Linux (and DOOM) port.
See https://aipc-os.catme0w.org/ for the project homepage.
| Booting Linux 7.0-rc3 | Booting DOOM | Booting AOSC OS Afterglow |
|---|---|---|
 |
 |
 |
Documentation (docs/)
- bootrom -- The mask ROM baked into the AK7802 die. USB boot mode, NAND/SPI boot, UART console, GPIO naming crosswalk, full memory map.
- nboot -- First-stage NAND bootloader. DDR init script, EBOOT loading.
- EBOOT -- WinCE second-stage bootloader. LCD bring-up, ENC28J60 SPI Ethernet, CH374 USB HID keyboard, NAND driver, vendor partition table, TFTP/EDBG download protocol, maintenance mode password and menu, GPIO driver with two independent pin numbering systems, CPU PLL formula.
- NK -- WinCE kernel and vendor drivers.
- AIPC OS Original -- Original research from us. Johnson–Nyquist noise TRNG, faster SD/MMC driver.
Reverse-engineered from scratch.
Bare-metal DOOM (doom/)
A doomgeneric-based DOOM port that runs directly on AIPC.
Boot methods (boot/)
coldboot/-- Boot Linux directly from internal disk, bypassing WinCE entirely.opennboot/-- Custom firmware openNBOOT. Replaces the stock nboot and enables booting arbitrary ARM payloads from SD.
warmboot/-- HaRET-based Linux boot from within WinCE.
Linux kernel (kernel/)
Kernel sources and patches.
Tools (tools/)
Python CLI tools (uv workspace) for talking to the device:
| AK7802 SoC Tool | Purpose |
|---|---|
ak7802-nand-dump-min |
Universal AK7802 NAND dump tool |
ak7802-usbboot |
USB boot mode protocol: peek, poke, upload, execute |
| AIPC-specific Tool | Purpose |
|---|---|
aipc-coldboot-dump |
Cold-boot attack RAM extraction |
aipc-ddr-init |
Standalone DDR SDRAM init via USB boot |
aipc-nand-dump |
Fast NAND dump tool for AIPC |
aipc-nand-extract |
Extract partitions from a raw NAND dump |
| Extra | Purpose |
|---|---|
gdbstub |
GDB stub, a replacement for the bootrom USB boot mode |
probes |
Lab reports and ARM assembly probes for investigating hardware behavior (e.g. SD/MMC) |
old |
Deprecated tools and scripts from early experimentation |
Website (website/)
Source for aipc-os.catme0w.org.
uv sync
This installs all Python tools into a shared virtualenv. CLI entry points are available immediately:
uv run ak7802-usbboot --help
To build ARM stubs or the DOOM binary, you need arm-none-eabi-gcc.
- SoC: Anyka AK7802 (ARM926EJ-S, 248/266 MHz typical)
- RAM: 64 MB DDR SDRAM
- Storage: 512 MB MLC NAND (Hynix typical), 4x528-byte interleaved ECC layout
- Display: 800x480 TFT LCD, RGB565, ~48 Hz
- Ethernet: Davicom DM9000A, 8-bit parallel bus bit-banged over GPIO
- USB HID: WCH CH374 USB host bridge on SPI, internal keyboard + 2 external USB-A ports
- USB: MUSB (Mentor Graphics) integrated in SoC, 1 external USB-A port
See LICENSE for details. In short: tools and scripts are MIT, kernel patches are GPLv2, docs are CC-BY-SA 4.0, DOOM is GPLv2.