Posts by bumerc

I can't help you without logs

Try dropping BCM4345C0.hcd into /system/etc/bluetooth. I cannot read your log because of the different character encoding. Use UTF-8.

s4shail

Check if BCM4345C0.hcd FW exists in bluetooth folder.

If necessary, you can download it here..

GitHub - LibreELEC/brcmfmac_sdio-firmware: Broadcom SDIO firmware used with LibreELEC

Broadcom SDIO firmware used with LibreELEC. Contribute to LibreELEC/brcmfmac_sdio-firmware development by creating an account on GitHub.

github.com

s4shail

avc: denied { write } for pid=4700 comm="ndroid.systemui" name="property_service" dev="tmpfs" ino=8243 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0

Sys UI

Try to create a new rule for property_socket in sepolicy, allow write access to the sock_file:

(allow platform_app property_socket (sock_file (open write)))

and recompile sepolicy..

WIFI

[  [email protected]] dhdsdio_download_code_file: Open firmware file failed /etc/wifi/4335/fw_bcm43455c0_ag.bin
[  [email protected]] _dhdsdio_download_firmware: dongle image file download failed

Check that the /etc/wifi/4335/ directory contains the correct fw -> fw_bcm43455c0_ag.bin

Quote from wae23

after long short circuit i success enter acces mode

then i use update on sd card with ini file its start update and on 2% its reset

You should update it via UBT as sdc_burn obviously won't work..

dtb is also subject to an RSA signature check. As long as the dtb is not written to emmc, you will have less chance of recovering your device. Put the emmc in acces mode by short-circuiting the pins and start the UBT update

wae23

Looks like this u-boot's loadaddr is wrong. Why are you using the sd card-u-boot version? Try to use the eMMC-U-Boot variant. Unpack the manufacturer's Android IMG and only use the bootloader.PARTITION.. (u-boot.bin.enc).

Or, you can install the IMG via UBT with the Secure Boot option.

Quote from s4shail

Method 1 Steps to install stock android 7.1.2 image

No. Repeated unnecessarily.

1. Write aml_upgrade_package.img on the mSD card with Amlogic Burn Card Maker.

2. Copy _aml_dtb.PARTITION to the FAT partition of the mSD card and rename the * .ini file to * .ini.bak.

3. Start the TV Box from this mSD card and write the * .dtb.PARTITION on eMMC.

4. Remove the mSD card and rename the * .ini.bak to * .ini again.

5. Now start sd card upgrade.

P.S. In your case, the vendor uses the misc partition, which contains certain key signatures for certain applications. A manual installation of individual partitions does not help you, as the misc partition also has to be installed. Otherwise the stock fw will not run.

However, these commands are no longer necessary. I've already sent you another bootloader.

Now install dtb as already described. Then install aml_upgrade_package.img.

Quote from s4shail

it seems nothing happened (log was blank, after it)

Strange. Ok, I will set selinux to engorcing in uboot config by default.

As long as we do not do this, access to some kernel resources (in permissive mode) will be denied by sepolicy…

Quote from s4shail

but wifi and bluetooth not working in this image

uart log of successful boot is attached...

I only see problems in the incompatibility of Sepolicy rules..

Try to put the SELinux into Enforce mode.

Abort autoboot and change the mode:

setenv EnableSelinux enforcing
saveenv
reset

Quote from wae23

FEAT:BDFC31BC

Quote from wae23

aml log : R1024 check fail with ERR = 85 aml log : SIG CHK : 85 for address 0x01700000

In your case, the box manufacturer has activated secure boot. Information about whether the board is actually encrypted can be extracted from the SEC_AO_SEC_SD_CFG10 register. You can only boot with an encrypted FIP. The error “wrong chip..”: The chip id is defined in BL30 blob (closed source). This id is also used for MAC generation in BL33, u-boot. As long as the chip id is not known, the uboot will perform the reset, which leads to a boot loop. I managed to convert the normal, unencrypted bl30 blob to an ELF binary through small manipulations and to decompile its code into a legible format. With a small change in ELF binary, the fake "s905w" was now running and was recognized as s905l Soc. If you still have one of these encrypted boards where the original u-boot is not damaged, you could read the bl30 dump into a file and compile it into an executable file to create an ELF binary from it..

It is best to contact the manufacturer regarding original fw

Send me stock dtb

You need to replace 4 files:

bootloader.PARTITION = u-boot.bin

aml_sdc_burn.UBOOT = u-boot.bin.sd.bin

u-boot.bin.usb.bl2 = DDR.USB

u-boot.bin.usb.tpl = UBOOT.USB

Quote from s4shail

new boot log attached

Do a clean installation with aml_upgrade_package.img, either with UBT, or sdcard update. Repack the stock fw with the new uboot files I sent you

Quote from s4shail

box stopped booting on mbox flashing logo..

It's not entirely clear why you burned uboot and dtb 2 times.. And where is the android's boot log?

hudyj

My guess is that you have a clone device and it is a gxbb (s905) platform, that would explain the PLL error. I'll send you gxbb blobs, well worth a try…

Quote from hudyj

[email protected]:~$ '/media/jaroslaw/30BAD20DBAD1CF88/utils/aml-flash-tool/tools/linux-x86/update' run 0xd9000000

[update]Run at Addr d9000000

AmlUsbRunBinCode:ram_addr=d9000000

[email protected]:~$ '/media/jaroslaw/30BAD20DBAD1CF88/utils/aml-flash-tool/tools/linux-x86/update' write '/media/jaroslaw/30BAD20DBAD1CF88/utils/aml-flash-tool/tools/linux-x86/DDR.USB' 0xd9000000

ERR: write data to device failed

Here you have already initialized RAM. In this step, instead of DDR.USB, load the TPL UBOOT.USB to the address described above

media/jaroslaw/30BAD20DBAD1CF88/utils/aml-flash-tool/tools/linux-x86/update write media/jaroslaw/30BAD20DBAD1CF88/utils/aml-flash-tool/tools/linux-x86/UBOOT.USB 0x200c000

then

update write ..yourpath../gxl/usbbl2runpara_runfipimg.bin 0xd900c000
update run 0xd9000000