Posts by bumerc

Quote from deimos

Okay. I daily drive linux, so I'll dd it to the card, should that suffice?

Regarding shorting the EMMC, do we know if there's a standard BGA169 to solder pad mapping?

You have 48 pins (right/left) around the chip. In this arrangement, in most cases DAT0/1 bus is connected to pins 29/30. The pins are counted from the INDEX ^

Datasheet

I'm just wondering why the manufacturer has integrated an EMCP chip as DDR memory, but solders an extra EMMC chip on the PCB. Maybe because of the encrypted firmware for this chip variant or for other cost reasons.

edit:

Have you perhaps saved the uart log from the original bootloader? It would make configuration easier for us. The most important point would be the RAW/Column addressing, which must match. Unfortunately, I could not find a datasheet for this chip..

deimos

Here is the archive with new u-boot + diff file with the changes I made for now.

The u-boot sources are for android 7 from this repository

u-boot@p201_lpddr3

Write it to the SD card via DD (Description).

# Find out the name of the block device

lsblk

# /dev/sdX, you have to replace sdX with your block device

dd if=u-boot.bin.sd.bin of=/dev/sdX conv=fsync,notrunc bs=512 skip=1 seek=1
dd if=u-boot.bin.sd.bin of=/dev/sdX conv=fsync,notrunc bs=1 count=440

If you are using Windows, use Amlogic BootCardMaker.

Attach the uart output

Quote from deimos

Hi Bumerc,

Thanks for taking the time to respond - I appreciate it! I'll take a look at the attached link, but yes I would appreciate any assistance in trying to keep this out of becoming e-waste

Ok, I'll try to configure a test version tomorrow, you have to write it to the SD card and start it by shorting the emmc pins 29-30, because the device is currently in bootloop.

Quote from deimos

Here are photos of the PCB. Let me know what you find.

If you can't find a suitable IMG, you can try to configure and compile u-boot for your ddr memory type. You could use this log as a configuration basis for gxbb lpddr3 device. If necessary, we could try it together.

You can't get around it without uart..

Quote from kami911

Do you have idea what I do wrong?

Seems to be due to the dtb configuration for Internal PHY. Your box requires External PHY (RGMII). Look for the appropriate dtb..

Quote from thegooddoctor

Define "hardware problem" and elucidate upon "If you fix that (in hardware) the upstream u-boot works fine."

I've been watching this thread for a long time. You created a hardware problem yourself by removing the emmc module by heating the emmc socket. In reality it is enough to use the test point to completely isolate the emmc from the boot sequence code of the BL1 (ROM). Now for the fact - as long as you have this error (..CHK:F3..) (whether it's emmc, nand or sd boot) it means - the data that was burned to the particular block device is corrupt, miswritten, or there is a problem in the block device itself , in your case sd card.

Quote

GXBB:BL1:08dafd:0a8993;FEAT:EDFD718C;POC:3;RCY:0;EMMC:800;NAND:81;SD:0;READ:0;CHK:F3;USB:8;LOOP:1

Quote from chewitt

bumerc ^ all yours apparently

Problem solved with a little trick. If omar_shipyard wants, he will describe what he did and how he did it 🙂

Quote from chewitt

LarsenIt's unlikely that an S905W box has encrypted boot

Well why..

Thread

X96 mini Amlogic S905W Bricked after wrong update

hi all

i have a new X96 mini Amlogic S905W Bricked after wrong update

so after try many ways to unbrick it still dead only red flash



box spec

Amlogic S905W

ram 2GB/16GB Rom



Ram: sec 524 K4B4G0446E ( i think is samsung)

eMMC: KLMAG1JETD-B041 ( samsung)



i connect uart and log the box

i get

this log only



LOOP:1;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;

LOOP:2;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8



and keep same loop with nothing

after i make some search i find out…

wae23

September 21, 2021 at 9:38 PM

Hard puzzle.. extract vendor fw and see if the *.ENC files exist. If you find any then your board is encrypted and in this case only using the vendor fw would be possible. Try to narrow down all possible causes.. )

I can't help you without logs

Try dropping BCM4345C0.hcd into /system/etc/bluetooth. I cannot read your log because of the different character encoding. Use UTF-8.

s4shail

Check if BCM4345C0.hcd FW exists in bluetooth folder.

If necessary, you can download it here..

GitHub - LibreELEC/brcmfmac_sdio-firmware: Broadcom SDIO firmware used with LibreELEC

Broadcom SDIO firmware used with LibreELEC. Contribute to LibreELEC/brcmfmac_sdio-firmware development by creating an account on GitHub.

github.com

s4shail

avc: denied { write } for pid=4700 comm="ndroid.systemui" name="property_service" dev="tmpfs" ino=8243 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0

Sys UI

Try to create a new rule for property_socket in sepolicy, allow write access to the sock_file:

(allow platform_app property_socket (sock_file (open write)))

and recompile sepolicy..

WIFI

[  111.636750@1] dhdsdio_download_code_file: Open firmware file failed /etc/wifi/4335/fw_bcm43455c0_ag.bin
[  111.649276@1] _dhdsdio_download_firmware: dongle image file download failed

Check that the /etc/wifi/4335/ directory contains the correct fw -> fw_bcm43455c0_ag.bin

Quote from wae23

after long short circuit i success enter acces mode

then i use update on sd card with ini file its start update and on 2% its reset

You should update it via UBT as sdc_burn obviously won't work..

dtb is also subject to an RSA signature check. As long as the dtb is not written to emmc, you will have less chance of recovering your device. Put the emmc in acces mode by short-circuiting the pins and start the UBT update

wae23

Looks like this u-boot's loadaddr is wrong. Why are you using the sd card-u-boot version? Try to use the eMMC-U-Boot variant. Unpack the manufacturer's Android IMG and only use the bootloader.PARTITION.. (u-boot.bin.enc).

Or, you can install the IMG via UBT with the Secure Boot option.

Quote from s4shail

Method 1 Steps to install stock android 7.1.2 image

No. Repeated unnecessarily.

1. Write aml_upgrade_package.img on the mSD card with Amlogic Burn Card Maker.

2. Copy _aml_dtb.PARTITION to the FAT partition of the mSD card and rename the * .ini file to * .ini.bak.

3. Start the TV Box from this mSD card and write the * .dtb.PARTITION on eMMC.

4. Remove the mSD card and rename the * .ini.bak to * .ini again.

5. Now start sd card upgrade.

P.S. In your case, the vendor uses the misc partition, which contains certain key signatures for certain applications. A manual installation of individual partitions does not help you, as the misc partition also has to be installed. Otherwise the stock fw will not run.