OK, finally I successfully recovery this set-top box to a stock firmware coming from its vendor. Seems the reason is that the way I use a straight screwdriver to short-connect SPI's PIN is not stable. OK, let me describe the whole process that might be useful for somebody someday:
Mistake I made:
1. First, I made a wrong decision to install LibreELEC on this TV-box cause it is no a dual boot solution. I haven't researched carefully but just saw the tutorial video from MPXproject has used one USB key and one SDcard. So I think it will burn LibreELEC to SDcard. But it isn't.
2. Second, I made another mistake that I used the default dtb.img in this release. That is for MX2/G18. I should try to find the exact dtb.img for this TV-box or try to get this TV-box device tree file by the mothod that "https://www.cnx-software.com/2014/05/12/how…firmware-files/" has told.
Process I did:
1) Extract "LibreELEC-Amlogic_MX2.arm-8.0.2.zip" to any FAT32 USB key;
2) Use "LibreELEC.USB-SD.Creator.Win32.exe" to burn "storage.img" into an empty SD card;
3) plug both USB key and SD card to the set-box;
4) make the set-box enter recovery mode (This 10moons D6-dual core TV-box has no reset button but hold the power button for longer than 3 or 5 seconds) and then select "apply update from EXT" and choose udisk as source;
5) The messages shows everything is OK and almost the same as video from "https://www.youtube.com/embed/Ni4jN0JHoeU";
6) And then the TV-box will hang on startup. It can show a "MATRICOM" splash screen and then show "LibreELEC" splash screen and then hang;
7) I made a bootable recovery sdcard with "Amlogic_SDcardMaker_BootcardMaker_burnBootCard_v1.0.1" as "https://www.cnx-software.com/2016/11/19/how…logic-tv-boxes/" told.
The TV-box cannot reboot to enter recovery process though I tried to hold the power button for many times. -- Here, I guess that is because the uboot has been replaced with the uboot for MX2/G18 that shipped with LibreELEC firmware. And that uboot won't response to hold power button behavior;
9) So, the only way is to force TV-box booted with the uboot in SDcard. I can't remember where I found a method that short pins of NAND in "http://freaktab.com/forum/tv-playe…id-4-2-2/page11" or "https://www.slatedroid.com/topic/41478-ho…ies-tablet-v20/". But the pin is too small. I cannot easily short it with tools in hand.
10) Then I found somebody has said short-pin of SPI will have the same effect. Then I tried this method with a and finally I successfully make the TV-box enter recovery mode and flash with a stock android firmware. That means short-pin of SPI and click power button together (no need to hold the power button, actually holding the power button won't work). If you see HDMI signal coming to TV screen, you can finished short-pin and wait. The position I have marked in the picture I posted.
11) To successfully flash the stock firmware, I have tried many times.
11.1) One possible failure reason is the short pin not stable because I just use a word screwdriver to short pin; That is true. If I failed to make it, the TV-box will booted with MX2/G18's uboot. And "MATRICOM“ splash screen and "LibreELEC" splash screen will show on TV;
11.2) Another possible failure reason is that the stock firmware I used is not correct. I have tried three version of stock firmware. All are coming from vender's website. So I am sure it is correct. I have seen someone said that sometime if the stock firware is older than the one stay in NAND, the flash will failed with a message "Script aborted (no error message)Installation aborted.". That might be true. I have made the TV-box enter recovery state many times. Every time it will failed to flash the firmware except the last one. And the last successful one is the newest stock firmware.
11.3) The last reason is the luck. The page that I learn short-pin SPI has said that this method is not stable. That could be also true. Many times short-pin seems work, TV won't show "MATRICOM" splash screen. But it didn't enter recovery mode successfully and TV screen keep showing nothing but gray.
That's all. Seems we need correct tools and operation, correct stock firmware and patience.