I need help reverse engineering my ereader (trying to get into the shell)

Question

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down here), but I'm not sure what my next steps should be.

Any help is greatly appreciated!

    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.05.27 18:56:10 =~=~=~=~=~=~=~=~=~=~=~=
   Âÿ ÿHELLO! BOOT0 is starting!
initializing SDRAM OK.
NAND_RequestDMA  ok
Succeed in opening nand flash.
Succeed in reading Boot1 file head.
The size of Boot1 is 0x00034000.
The file stored in 0X00000000 of block 2 is perfect.
Check is correct.
Ready to disable icache.
Succeed in loading Boot1.
Jump to Boot1.
begin to init file system
bat vol = 4046
1
NB1 : enter NFB_Init

nand_for_boot1.c 135get the good blk ratio from hwscan : 631571392 

NB1 : enter phy init

[NAND] nand driver version: 0x0x00000002, 0x0x00000011, data: 0x20120926

NAND_RequestDMA  ok

[SCAN_DBG] Nand flash chip id is:0x0x0000002c 0x0x00000044 0x0x00000044 0x0x00000000 0x0x8042506c 0x0x0000004b





[SCAN_DBG] ==============Nand Architecture Parameter==============

[SCAN_DBG]    Nand Chip ID:         0x0x4b44442c 0x0xffffffff

[SCAN_DBG]    Nand Chip Count:      0x0x00000001

[SCAN_DBG]    Nand Chip Connect:    0x0x00000001

[SCAN_DBG]    Nand Rb Connect Mode:      0x0x00000001

[SCAN_DBG]    Sector Count Of Page: 0x0x00000010

[SCAN_DBG]    Page Count Of Block:  0x0x00000100

[SCAN_DBG]    Block Count Of Die:   0x0x00000800

[SCAN_DBG]    Plane Count Of Die:   0x0x00000002

[SCAN_DBG]    Die Count Of Chip:    0x0x00000001

[SCAN_DBG]    Bank Count Of Chip:   0x0x00000001

[SCAN_DBG]    Optional Operation:   0x0x00000008

[SCAN_DBG]    Access Frequence:     0x0x00000028

[SCAN_DBG]    ECC Mode:             0x0x00000005

[SCAN_DBG]    Read Retry Type:      0x0x00000000

[SCAN_DBG]    DDR Type:             0x0x00000000

[SCAN_DBG] =======================================================



[SCAN_DBG] ==============Optional Operaion Parameter==============

[SCAN_DBG]    MultiPlaneReadCmd:      0x0x00000000, 0x0x00000030

[SCAN_DBG]    MultiPlaneWriteCmd:     0x0x00000011, 0x0x00000080

[SCAN_DBG]    MultiPlaneCopyReadCmd:  0x0x00000000, 0x0x00000000, 0x0x00000035

[SCAN_DBG]    MultiPlaneCopyWriteCmd: 0x0x00000085, 0x0x00000011, 0x0x00000080

[SCAN_DBG]    MultiPlaneStatusCmd:    0x0x00000070

[SCAN_DBG]    InterBnk0StatusCmd:     0x0x00000078

[SCAN_DBG]    InterBnk1StatusCmd:     0x0x00000078

[SCAN_DBG]    BadBlockFlagPosition:   0x0x00000001

[SCAN_DBG]    MultiPlaneBlockOffset:  0x0x00000001

[SCAN_DBG] =======================================================

NB1 : nand phy init ok

src\format\nand_format.c 2623[FORMAT_ERR] format nand flash*********!

PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000001 

PHY_PageReadSpare : too much ecc err,bank 0x00000000 block 0x00000000,page 0x00000000 

NB1 : init ok

mount successfully.
0
Source clock is HOSC, preScale=64, interval=375

 Mount Parts Thread runniMInit : enter init nand flash driver
 nand driver version: 0x2 0x11
 nand_drv.c 166 ---------------
 ------
  nand_drv.c 192 --nand disk size: 0x780000

 partition [D] plug in..

 partition [Z] plug in..
 Mount Parts Thread work now.....

 partition [E] plug in..
 Mount Parts Thread work end....
 $$$$ eink clock is 8 $$$$$
 eink_GetFileCntFromDir path = v:\
 eLIBs_opendir failed!
 AWF fp=0
 -------------open awf file failed, try to open backup awf-----------
 AWF file length=545 K
 LCD TCON OPEN
 MSG:L3723(Drv_eink.c): set vcom mode as IO contrl, not pwm
 .....................................................................................................................
 .Please press enter key(keypad or irkey) to continue!
..............................................................
 .....................................................................................................................
 Esh_StartUp 
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  1 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 Execute startup script begin..............
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  -382909968 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  1 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 Esh Error:  OpenConfigFile y:\config\config.bin failed.
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  -382909968 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  1 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_t41 set tmpNewCpu = 37yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  1 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  -382909968 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ===================yyparse start====================
 yynerrs.1 =  0 
 yynerrs.2 =  0 
 outtree->op_type =  1 
 yynerrs.3 =  0 
 &&&&&&&&&&&&&&&&&&&yyparse end&&&&&&&&&&&&&&&&&&&&&&&&&&&
 ...............Execute startup script end
 Esh_StartUp finish
 Esh msg:  shell maidesktop_server_init plug tp start
 desktop_server_init plug tp over
 dsk_orchid_createDisk over
 d_createDisk over
  dsk_orchid_check over
 dsk_voice_set_volume over
 dsk_display_set_lcd_bright over
 dsk_keytone_init over
 dsk_keytone_set_state over
 dsk_app_reg_init over
 dsk_langres_set_type over
 214 Date parameter is invalid!(Y2020, M5, D28)
 214 Date parameter is invalid!(Y2020, M5, D28)
 214 Date parameter is invalid!(Y2020, M5, D28)

 eink_GetFileCntFromDir path = v:\
 eLIBs_opendir failed!
 AWF fp=0
 -------------open awf file failed, try to open backup awf-----------
 AWF file length=545 K
 LCD TCON OPEN
 MSG:L3723(Drv_eink.c): set vcom mode as IO contrl, not pwm
 LCD TCON close
 B þ           `     €ÿ

EDIT: Sorry I forgot to say that this ereader indeed runs on an allwinner E200 chip. So most likely it's the allwinner os (probably 2.0, but that's not sure).

Answer 1

The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository.

Another option could be to dump the flash and analyze it.