If the stock firmware doesn't work for you, have you tried installing the excellent android pie firmware from https://slimboxtv.ru/glavnaya/x96mini/ to restore your device?
i try those soft no luck 
Posts by wae23
-
-
dtb is also subject to an RSA signature check. As long as the dtb is not written to emmc, you will have less chance of recovering your device. Put the emmc in acces mode by short-circuiting the pins and start the UBT update
after long short circuit i success enter acces mode
then i use update on sd card with ini file its start update and on 2% its reset
-
Looks like this u-boot's loadaddr is wrong. Why are you using the sd card-u-boot version? Try to use the eMMC-U-Boot variant. Unpack the manufacturer's Android IMG and only use the bootloader.PARTITION.. (u-boot.bin.enc).
Or, you can install the IMG via UBT with the Secure Boot option.
i use uboot from sd because box dosent accept soft or uboot from burning tools
i extract this bootloader from other working box my box finally unbricked but working only with sd
so i try to install stock firmware to fix uboot problem this stock contain not supported dtb
after install this firmware with uboot i got this problem
"Synchronous Abort" handler, esr 0x96000210
ELR: 37ec0168
LR: 37ec0168
x0 : 0000000000000000 x1 : 000000000000000c
x2 : 0000000000000038 x3 : 0000000000009acc
x4 : 0000000000000070 x5 : 0000000000000069
x6 : 0000000033ec1bc4 x7 : 0000000000000020
x8 : 0000000000000001 x9 : 0000000000000000
x10: 000000000000000f x11: 0000000037f384d8
x12: 0000000000000000 x13: 0000000000000000
x14: 0000000000000000 x15: 0000000000000000
x16: 0000000000000000 x17: 0000000000000000
x18: 0000000033ea1e28 x19: 0000000033eb7200
x20: 0000000000000000 x21: 0000000033eb7a00
x22: 0000000037f61a68 x23: 0000000000080000
x24: 0000000037f72000 x25: 0000000000000000
x26: 0000000000004bc8 x27: 0000000000000000
x28: 0000000033eb6a70 x29: 0000000033e91b70
Resetting CPU ...any way to fix this ?
-
In your case, the box manufacturer has activated secure boot. Information about whether the board is actually encrypted can be extracted from the SEC_AO_SEC_SD_CFG10 register. You can only boot with an encrypted FIP. The error “wrong chip..”: The chip id is defined in BL30 blob (closed source). This id is also used for MAC generation in BL33, u-boot. As long as the chip id is not known, the uboot will perform the reset, which leads to a boot loop. I managed to convert the normal, unencrypted bl30 blob to an ELF binary through small manipulations and to decompile its code into a legible format. With a small change in ELF binary, the fake "s905w" was now running and was recognized as s905l Soc. If you still have one of these encrypted boards where the original u-boot is not damaged, you could read the bl30 dump into a file and compile it into an executable file to create an ELF binary from it..
It is best to contact the manufacturer regarding original fw
after success install recovery in the box i install a stock firmware
but i got new error
Code
Display MoreGXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;LOOP:1;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;LOOP:2;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0; no sdio debug board detected TE: 10692501 BL2 Built : 11:04:41, Jan 26 2018. gxl g034b32c - xingyu.chen@droid12-sz set vcck to 1120 mv set vddee to 1050 mv Board ID = 2 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR3 chl: Rank0 16bit @ 792MHz bist_test rank: 0 26 04 48 3b 1b 5c 27 00 4e 3f 20 5f 32 32 32 32 32 32 33 33 33 33 33 33 637 Rank0: 1024MB-2T-11 AddrBus test pass! Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000 aml log : R1024 check pass! New fip structure! Load bl30 from SD, src: 0x00010200, des: 0x01700000, size: 0x0000d600 aml log : R1024 check pass! Load bl31 from SD, src: 0x00020200, des: 0x01700000, size: 0x0002c600 aml log : R1024 check pass! Load bl33 from SD, src: 0x00050200, des: 0x01700000, size: 0x00066400 aml log : R1024 check pass! NOTICE: BL3-1: v1.0(release):35dd647 NOTICE: BL3-1: Built : 15:20:30, Feb 7 2018 [BL31]: GXL CPU setup! NOTICE: BL31: BL33 decompress pass mpu_config_enable:ok [Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07] OPS=0xe5 66 3 11 a4 cb 60 90 37 1 b4 50 f3 [11.325683 Inits done] secure task start! high task start! low task start! ERROR: Error initializing runtime service opteed_fast U-Boot 2015.01 (Apr 09 2019 - 10:51:05) DRAM: 1 GiB Relocation Offset is: 36eb2000 register usb cfg[0][1] = 0000000037f5a348 [CANVAS]canvas init boot_device_flag : 1 Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc. init bus_cycle=6, bus_timing=7, system=5.0ns reset failed get_chip_type and ret:fffffffe get_chip_type and ret:fffffffe chip detect failed and ret:fffffffe nandphy_init failed and ret=0xfffffff1 MMC: aml_priv->desc_buf = 0x0000000033eb26b0 aml_priv->desc_buf = 0x0000000033eb49d0 SDIO Port B: 0, SDIO Port C: 1 emmc/sd response timeout, cmd8, status=0x1ff2800 emmc/sd response timeout, cmd55, status=0x1ff2800 init_part() 293: PART_TYPE_AML [mmc_init] mmc init success dtb magic 5f4c4d41 Amlogic multi-dtb tool Multi dtb detected Multi dtb tool version: v2 . Support 2 dtbs. aml_dt soc: gxl platform: p281 variant: 1g dtb 0 soc: gxl plat: p281 vari: 1g dtb 1 soc: gxl plat: p281 vari: 2g Find match dtb: 0 start dts,buffer=0000000033eb7200,dt_addr=0000000033eb7a00 Amlogic multi-dtb tool Multi dtb detected Multi dtb tool version: v2 . Support 2 dtbs. aml_dt soc: gxl platform: p281 variant: 1g dtb 0 soc: gxl plat: p281 vari: 1g dtb 1 soc: gxl plat: p281 vari: 2g Find match dtb: 0 "Synchronous Abort" handler, esr 0x96000210 ELR: 37ec0168 LR: 37ec0168 x0 : 0000000000000000 x1 : 000000000000000c x2 : 0000000000000038 x3 : 0000000000009acc x4 : 0000000000000070 x5 : 0000000000000069 x6 : 0000000033ec1bc4 x7 : 0000000000000020 x8 : 0000000000000001 x9 : 0000000000000000 x10: 000000000000000f x11: 0000000037f384d8 x12: 0000000000000000 x13: 0000000000000000 x14: 0000000000000000 x15: 0000000000000000 x16: 0000000000000000 x17: 0000000000000000 x18: 0000000033ea1e28 x19: 0000000033eb7200 x20: 0000000000000000 x21: 0000000033eb7a00 x22: 0000000037f61a68 x23: 0000000000080000 x24: 0000000037f72000 x25: 0000000000000000 x26: 0000000000004bc8 x27: 0000000000000000 x28: 0000000033eb6a70 x29: 0000000033e91b70 Resetting CPU ... resetting ... -
In your case, the box manufacturer has activated secure boot. Information about whether the board is actually encrypted can be extracted from the SEC_AO_SEC_SD_CFG10 register. You can only boot with an encrypted FIP. The error “wrong chip..”: The chip id is defined in BL30 blob (closed source). This id is also used for MAC generation in BL33, u-boot. As long as the chip id is not known, the uboot will perform the reset, which leads to a boot loop. I managed to convert the normal, unencrypted bl30 blob to an ELF binary through small manipulations and to decompile its code into a legible format. With a small change in ELF binary, the fake "s905w" was now running and was recognized as s905l Soc. If you still have one of these encrypted boards where the original u-boot is not damaged, you could read the bl30 dump into a file and compile it into an executable file to create an ELF binary from it..
It is best to contact the manufacturer regarding original fw
thnx
i can get a board from a friend in a couple of days
for the manufactuer he offer only stock firmware
-
Chase the vendor for the correct ROM image to restore the box, or their u-boot sources (which are GPLv2 .. but good luck with that) or keep experimenting with u-boot(s) from ROM images (as you've been doing, from SD card).
install same Uboot with different Sd Card that give me log
i got different log
Code
Display Moreno sdio debug board detected TE: 74533937 BL2 Built : 20:32:17, Sep 8 2017. gxl g6296b83 - xiaobo.gu@droid12 set vcck to 1120 mv set vddee to 1000 mv Board ID = 2 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR3 chl: Rank0 16bit @ 792MHz Rank0: 1024MB(auto)-2T-11 DataBus test pass! AddrBus test pass! Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000 sd/emmc read data error: ret=16 aml log : R1024 check fail with ERR = 85 aml log : SIG CHK : 85 for address 0x01700000 reset... GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0; -
The u-boot you found only partially works. It looks to be compatible with the RAM, but there is some form of chip detection going on (from the error) so it's probably been created for another type of GXL device, e.g. S905X not S905W. The one good thing is .. you are experimenting from an SD card. Keep doing this, because if you flash the wrong u-boot to eMMC it becomes a major pain to recover the box (not impossible, but complicated).
The only mainline u-boot(s) that I have pre-compiled are here: Index of /testing/u-boot/ .. vim/lafrite/lepotato are all GXL devices (S905X, S905X) but the mainline sources don't really have device detection like vendor sources so from SD card they will either work or fail cleanly.
thank you
i try most of them not working
any sugg ?
-
hi all
i have a new X96 mini Amlogic S905W Bricked after wrong update
so after try many ways to unbrick it still dead only red flash
box spec
Amlogic S905W
ram 2GB/16GB Rom
Ram: sec 524 K4B4G0446E ( i think is samsung)
eMMC: KLMAG1JETD-B041 ( samsung)
i connect uart and log the box
i get
this log only
LOOP:1;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;
LOOP:2;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8
and keep same loop with nothing
after i make some search i find out that U-boot is erased from box
i try many uboot from many flash on web with no luck
today i success getting log from box
i find a uboot i install it on sd card using BootcardMaker tools ( the uboot that work is from this img on web "X96mini Q6X v2.2 17355 чип Samsung")
and the box give me this log with loop ( i try with sd card recovey using same uboot+factory_update_param.aml+recovery.img+otasoft.zip on sd= nothing on tv )
log :
Code
Display MoreBL2 Built : 20:32:17, Sep 8 2017. gxl g6296b83 - xiaobo.gu@droid12 set vcck to 1120 mv set vddee to 1000 mv Board ID = 2 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR3 chl: Rank0 16bit @ 792MHz Rank0: 1024MB(auto)-2T-11 DataBus test pass! AddrBus test pass! Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000 aml log : R1024 check pass! New fip structure! Load bl30 from SD, src: 0x00010200, des: 0x01700000, size: 0x0000d600 aml log : R1024 check pass! Load bl31 from SD, src: 0x00020200, des: 0x01700000, size: 0x0002c600 aml log : R1024 check pass! Load bl33 from SD, src: 0x00050200, des: 0x01700000, size: 0x00065e00 aml log : R1024 check pass! NOTICE: BL3-1: v1.0(release):a625749 NOTICE: BL3-1: Built : 11:25:15, Aug 25 2017 [BL31]: GXL CPU setup! NOTICE: BL31: BL33 decompress pass mpu_config_enable:ok [Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07] OPS=0xe5 Wrong chip e0 GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0; no sdio debug board detected TE: 280423any help plz
thnk you .
