Extracting original firmware from S905 Box using uboot md?

noob404 · October 30, 2024 at 1:16 PM

Hi, I just recently got UART access on my S905 Android Box. I have looked into ways to dump original firmware before I try LE and other distros. I could only find the method that uses uboot, as mentioned in this video by Matt Brown. The method uses bdinfo to see the memory start address (flashstart) and the size (flashsize). Unfortunately, uboot on my box doesn't have this. Here's a list of commands that I have access to, on uboot:-

Code

aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
amlmmc  - AMLMMC sub system
amlnf   - aml nand sub-system
amlnf_test- AMLPHYNAND sub-system
autoping- do auto ping test
autoscr - run script from memory
base    - print or set address offset
bmp     - manipulate BMP image data
booti   - boot arm64 Linux Image image from memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cbusreg - cbus register read/write
clkmsr  - measure PLL clock
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
cvbs    - CVBS sub-system
dcache  - enable or disable data cache
defenv_reserv- reserve some specified envs after defaulting env
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
efuse   - efuse read/write data commands
efuse_user- efuse user space read write ops
emmc    - EMMC sub system
env     - environment handling commands
ethchk  - check ethernet status
ethdbg  - set ethernet debug level
ethmode - set ethernet mac mode
ethrst  - reset ethernet phy
exit    - exit script
false   - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatsize - determine a file's size
fdt     - flattened device tree utility commands
get_rebootmode- get reboot mode
go      - start application at address 'addr'
gpio    - query and control gpio pins
hdmitx  - HDMITX sub-system
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imgread - Read the image from internal flash with actual size
itest   - return true/false on integer compare
jtagoff - disable jtag
jtagon  - enable jtag
keyman  - Unify key ops interfaces based dts cfg
keyunify- key unify sub-system
loop    - infinite loop on address range
macreg  - ethernet mac register read/write/dump
md      - memory display
mdc_clk - do mdc clock
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mw      - memory write (fill)
netspd_f- enforce eth speed
nm      - memory modify (constant address)
open_scp_log- print SCP messgage
osd     - osd sub-system
phyreg  - ethernet phy register read/write/dump
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
read_temp- cpu temp-system
reboot  - set reboot mode and reboot system
reset   - Perform RESET of the CPU
rsvmem  - reserve memory
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdc_burn- Burning with amlogic format package in sdmmc
sdc_update- Burning a partition with image file in sdmmc card
set_trim_base- cpu temp-system
set_usb_boot- set usb boot mode
setenv  - set environment variables
showvar - print local hushshell variables
sleep   - delay execution for some time
store   - STORE sub-system
temp_triming- cpu temp-system
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
unpackimg- un pack logo image into pictures
update  - Enter v2 usbburning mode
usb     - USB sub-system
usb_burn- Burning with amlogic format package in usb
usb_update- Burning a partition with image file in usb host
usbboot - boot from USB device
version - print monitor, compiler and linker version
vout    - VOUT sub-system
vpu     - vpu sub-system
wipeisb - wipeisb
write_trim- cpu temp-system
write_version- cpu temp-system

Display More

I soon found a Reddit thread with the same issue, but no proper resolution to it. But, when I do run printenv, I find some lines that seem interesting to me, as a noob:-

Code

bootargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.mem_address=0x20000000 ramoops.mem_size=0x100000 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissive logo=osd1,loaded,0x3f800000,720p60hz hdmimode=720p60hz cvbsmode=576cvbs hdmitx= androidboot.firstboot=0 mac=XX:XX:XX:XX:XX:XX androidboot.mac=XX:XX:XX:XX:XX:XX
............
bootup_offset=0x1080240
bootup_size=0x1c2046
............
dtb_mem_addr=0x1000000
edid.crcvalue=0xc4020000
............
fb_addr=0x3f800000
............
fdt_high=0x20000000

Display More

Just to test if uboot md would work for the dump, I took bootup_offset as start and bootup_size as size to run md using Matt Brown's video. But, even after running for 30 minutes, all I get is 0s.

My questions

1. Am I on the right track? Can I use any values from the printenv output to actually dump the firmware? If yes, can you point me to the right ones?

2. If you are wondering why I don't just download the stock firmware online, I don't get a perfect match for my box. Checking HW Info app, I get that my box is a p201. The closest stock firmware that I see is Android/p201/p201:5.1.1/LMY47V/20160118:userdebug/test-keys (available on Chinagadgetreview). But, the original one on the box has a different date and says user instead of userdebug, probably cause it was meant to be strictly for production.

3. Can I install the stock firmware linked in question 2 above from Chinagadgetreview using my SD Card and the stock UPDATE&BACKUP app?

**chewitt** · October 30, 2024 at 1:56 PM

Have a read of this https://github.com/LibreELEC/amlogic-boot-fip/pull/27 - and please note that this forum really isn't interested in dealing with Android backup/recovery issues (not our OS, not our problem).

Also note that LE does not support install of the OS to the internal storage and while booting LE from an SD card changes the boot process slightly it's not harmful to the Android install - modern upstream kernels cannot see/mount any of the partitions created by the vendor boot firmware due to Amlogic's proprietary partition scheme - so we're not going to mess Android up.

NB: You can easily dump the full content of eMMC storage from inside LE using "dd" although this is a raw image and you will not be able to use it as recovery media in the event of eMMC issues as the u-boot in the dump is for eMMC boot only; magic headers are located at the wrong offset for SD/USB boot due to S905 requiring different offsets.

noob404 · October 30, 2024 at 2:10 PM

Quote from chewitt

Have a read of this https://github.com/LibreELEC/amlogic-boot-fip/pull/27 - and please note that this forum really isn't interested in dealing with Android backup/recovery issues (not our OS, not our problem).
Also note that LE does not support install of the OS to the internal storage and while booting LE from an SD card changes the boot process slightly it's not harmful to the Android install - modern upstream kernels cannot see/mount any of the partitions created by the vendor boot firmware due to Amlogic's proprietary partition scheme - so we're not going to mess Android up.
NB: You can easily dump the full content of eMMC storage from inside LE using "dd" although this is a raw image and you will not be able to use it as recovery media in the event of eMMC issues as the u-boot in the dump is for eMMC boot only; magic headers are located at the wrong offset for SD/USB boot due to S905 requiring different offsets.

Thank you for the comment. Pardon me for posting this here. I posted it here, since many members seem to have found the help for these problems on LE forum. Again, pardon me for that. I will definitely go through the link you posted. Any help counts. Thanks. Kindly close the thread if you feel this is offtopic.

noob404 · November 1, 2024 at 8:29 AM

UPDATE - COuldn't figure out a way to use uboot. Was able to finally get TWRP running. Backed it up. It cannot be used with Amlogic's USB Burning Tool, but, as long as the box has a recovery to boot to, I guess, I am relatively safe.