Getting UART on Allwinner sun8i (H2+ and EASiTEK Board)

    I would like to attempt porting LE or at least getting armbian running on an old Android TV box that I got for free. The box looks like a router with a green top. The label underneath says it's a "TVFrog" which I could only locate listing for online and no specifications that actually mean anything. I'm trying to avoid pulling the heat sink off because I don't have any thermal pads lying around. The device is running Android 4.4 KitKat with a sideloaded Netflix and Kodi 16.x.

    Kodi reports that the device is a sun8i. The board is long and narrow. It has RCA audio/video (composite out), 2x USB, 1x HDMI out and 1x Ethernet port. HDMI can operate at up to 1080p@60Hz and it actually plays 1080p content beautifully! Netflix works well, Kodi is somewhat iffy because it's old as ever.

    The board says it's a "T199 v2.0 Designed by EASiTEK". I've soldered a header to the UART pins (which are labeled GND TX RX VCC). Using a CP2102 USB to UART adapter I cannot get any output. I was hoping to get a root shell and possibly dump the existing firmware before I begin tampering. Any ideas? I'm thinking either I've set something up wrong (baud rate 115200 using minicom on /dev/tty0) or there's something that needs to be done on the board (i.e short pins) to enable UART.

    IMAGES:

    main-board

    daughter-board

    io

    top-view

    uart

    sticker

    Edited once, last by vaughng (April 27, 2024 at 3:20 PM).

    The answer lies under the silver heatsink, but if the 512MB RAM sticker is correct we won't support the board even if it can boot something. All recent LE images need 1GB to run Kodi properly.

    Yeaaaahhh I figured as much LOL. Ah damn okay. Might just have to stick with Android I guess. I will still try a few things and see where it gets me. Fingers crossed the 512MB sticker is false. Can't seem to find the RAM chip online, only the ROM and WiFi chip are known to the internet apparently. I'll keep at it and update if I find anything but I do believe (by process of elimination and knowing that my cpu has 4 cores) that the device has either an H3 or H2+.

    I'm blind... If you look between the two USB ports there is a backward facing button which on the board is labelled "UBOOT RECOVER". Still no UART but it's progress nonetheless.

    It's possible to disable UART output in (u-boot) software even if the hardware is correctly wired. It's a little unusual to see that done, but some vendors do more customisation than others. Those chips don't run hot so I wouldn't be too afraid of pulling the heatsink off for a look.

    Quote from vaughng

    "UBOOT RECOVER"

    That's FEL mode on USB. This means one of the USB ports can be used for it. It's supported on USB OTG, but from the image you provided, it's hard to say which one is it. Since I don't see any usual OTG port, it's most likely that you would need non-standard and dangerous USB A to USB A cable for it.

    Sorry for further disappointing you, but this board only has NAND storage, which is not supported by LE. You could still run it from SD card, but I don't see any socket for it.

    jernej I have a USB-A to USB-A, I will try to look more closely at the board to see if I can tell which is the OTG port. Yes the lack of a card slot is a disappointment but I'm hoping I can force some sort of USB boot. Even if I can't run proper LE I'd like to try get some form of linux running even if I have to build my own custom image to install drivers. I've gotten x11 kodi running on armbian on my tanix tx6 before so it would be a nice experiment especially with such little RAM to work with, if it ends up being possible that is.

    It's my first time hearing of FEL but I'll do some research.

    Thanks chewitt ! I tried but I think it's thermal epoxied to the chip /: will try the floss trick later. The only mentions of EASiTEK I've found online are Chinese forums about other Android TV boxes.

    Edited once, last by vaughng: Merged a post created by vaughng into this post. (April 28, 2024 at 4:07 PM).

    The USB port closest to the Ethernet port appears to be the OTG port as there are more traces than necessary for USB that are going directly to the chip and I'm assuming these are the ID/VBUS for OTG although not sure how they're connected to a type A port, maybe faked when forced into FEL? The floss trick worked, I was so close, it's not an H3 but rather an H2+. Cannot identify the RAM but it is a Chinese brand (GCAI). WiFi chip is XR819.

    jernej Installed sunxi-tools (thanks AUR). I see the sunxi-fel command has these options:

    hex[dump] address length        Dumps memory region in hex 
    dump address length             Binary memory dump

    does that mean I can dump firmware from the device's NAND flash by cycling through the addresses? Or does memory in this case mean RAM?

    Now we're getting somewhere. Turns out the extra traces are for power to be fed back into the USB port. After connecting the USB-A to USB-A cable, the device powered on! Never seen this before so it's pretty cool, but I guess it's just a hacked OTG port with a type A connector. In any case, I disconnected the cable, held the recover button and reconnected - success.

    Bus 001 Device 064: ID 1f3a:efe8 Allwinner Technology sunxi SoC OTG connector in FEL/flashing mode


    jernej The output of sunxi-fel ver is:

    AWUSBFEX soc=00001680(H3) 00000001 ver=0001 44 08 scratchpad=00007e00 00000000 00000000


    EDIT: I will check for serial output in a bit, the FEL docs say there may serial output now.

    So I've played around with some binaries but can't seem to find any compatible ones. Running sunxi-fel write xxxxxxxx fes1.bin and sunxi-fel exec xxxxxxxx results in FEL crashing (fes1.bin is the NES Classic binary for dumping firmware I think, read a tutoiral...).

    Can anyone direct me towards resources regarding finding/building binaries that will work with this board? I'm very new to low level stuff but I do understand the basics such as addresses and hex data. Are the binaries board specific or chip specific?


    EDIT: This is the tutorial that I was reading through: https://xor.co.za/post/2018-12-01-fel-bootprocess/

    A huge thanks to everyone who has/is responding to my noob questions. I really appreciate it especially @/jernej (avoiding a mention).

    Follow up question :D

    What uboot compatible board is closest in configuration to mine? [H2+/H3] [512MB RAM] [8GB Sandisk ROM]

    Or is there a way to read find/create a config for my board? I read some of the existing configs but I'm not familiar with all the variables or how to retrieve them. I'm at the "Booting U-Boot over USB" section of the FEL/USBBoot doc.

    Making proper board support means creating device tree file and proper U-Boot configuration. This gives you board specific binaries which can be also used for FEL booting. In the H3/H2+ era, this was done by first dumping firmware from the board and extracting script.bin, which is then converted to human readable named script.fex. This file contains all board specific configuration, which is used for creating device tree file and U-Boot config. In any case, you have to first obtain access to existing system, so you can dump it. Since UART doesn't work, I don't have idea how to do that.

    So... I found this regarding reading the required information via FEL mode. However, running these commands:

    ./sunxi-fel read 0x42400000 0x82d0 boot1.header 
    ./sunxi-fel read 0x43000000 0x20000 script.bin

    fail with usb_bulk_send() ERROR -7: Operation timed out which I believe may be related to size limits as outline here.

    I don't know what length would be appropriate to avoid the error. If I knew how addresses work (I read something about 8 bits but didn't quite grasp it) I could script a read in chunks and concatenate them into a single binary. Apologies, I know I need to learn on my own but if someone could just point me in the right direction I'll figure it out myself. Many thanks <3

    EDIT: Ignore the above, boot1 isn't loaded so cannot be read. My bad!

    Edited 2 times, last by vaughng: I am noob (May 1, 2024 at 9:57 PM).

    This device is oddly secure. Closest I got to any files or partitions is non-root wireless ADB. Here is the result of ls -al in root (/).

    the echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug "backdoor" is not present on the device. All debugging has been disable by the manufacturer. /proc/sunxi_debug doesn't exist.

    adb shell cat default.prop

    # 
    # ADDITIONAL_DEFAULT_PROPERTIES 
    # 
    ro.secure=1 
    ro.allow.mock.location=0 
    ro.debuggable=0 
    persist.sys.usb.config=none


    adb shell id

    uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdc
    ard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)


    adb reboot recovery

    Results in a factory reset. Looks like a custom recovery image that is built to only perform a factory reset.


    adb reboot bootloader

    The device reboots, seemingly hangs for a bit and then continues to boot normally.


    "About Phone"

    Model number: YSM_32H

    Android version: 4.4.2

    Firmware version: Homlet4.4.2-Qin2-v1.2release
    Kernel version: 3.4.39 pro_h2@Master #1 Tue Apr 18 11:27:49 CST 2017
    Build number: KOT49H.20170418 test-keys


    After some research I found that the device was not marketed as a TV box but rather a "free replacement" for cable TV. It was meant for the TVFrog IPTV service and hence came preloaded with Kodi and custom addons. Still at a bit of a loss. currently trying to root the device or at least gain adb root so that I can dump partitions.