BirdDog PLAY recovery flasher beta

Writes a factory .img to a PLAY in Rockchip recovery mode over USB, optionally with a .fw update package injected so it installs itself on first boot. Everything happens in this browser — no upload, no server, no vendor key.

This rewrites the whole device. Bootloader, kernel, rootfs and partition table. It restores factory state, not this unit's own — its serial, hostname and everything under /userdata are gone. Dump a unit you care about first.

Why beta: no PLAY has been flashed with this yet. The image parsing, the filesystem injection and the partition table are covered by tests against real vendor files — e2fsck accepts the patched rootfs, and the partition table is checked by an independent parser. The USB half is written from Rockchip's protocol rather than from observation, so the loader handoff and the first-boot install are the parts still taking your unit's word for it.

1 — Files

Factory image (.img)

The Rockchip recovery image for the PLAY, e.g. PLAY_1.0.30.img. Read directly off disk; a 2.4 GB file is never held in memory.

Update package to inject (.fw, optional)

Stock or custom. It is parked in the unused tail of the rootfs partition, and a one-shot service installs it on first boot through the device's own updater. Leave empty to flash the image unchanged.

2 — Device

Put the PLAY into Rockchip recovery mode, connect it by USB, then pair it with the page. not connected

Chrome will ask which device to allow. A PLAY in recovery mode appears as a Rockchip device (vendor 2207).

3 — Write

Choose an image and connect a device.

verify by reading back

Getting a PLAY into recovery mode, and the Windows driver problem

The recovery button is not on the outside of the case — it sits inside the 3.5 mm headphone socket. Straighten a paperclip or use a SIM-eject tool, push it gently all the way into the socket, and you will feel the button click.

Power the unit off.
Push the pin into the headphone socket and hold the button down.
Still holding it, apply power, and keep holding for a few seconds after.
Connect the USB port to this computer, then release. The unit should enumerate as vendor 2207; the page reports whether it came up in maskrom or loader mode, and handles either.

If the unit boots normally instead, the button was not held down far enough or long enough — the socket is deep and the button is right at the bottom.

Windows: WebUSB can only talk to a device bound to WinUSB. Rockchip's own driver claims the device and will block this page — use Zadig to rebind it to WinUSB first. macOS needs nothing. Linux needs a udev rule granting access to 2207:*.

Installing a .fw on a unit that still boots

You do not need any of this to install an update package on a working PLAY — the device's own web interface does it:

Browse to the PLAY's IP address and log in.
Go to the System tab.
Choose the .fw file and upload it. The device installs it and reboots.

This page is for the case where that is not an option: a unit that will not boot, will not take a web-UI update, or needs the whole device put back to a known state. Injecting the .fw here just saves a second trip once it is back up.