If the stock firmware doesn't work for you, have you tried installing the excellent android pie firmware from https://slimboxtv.ru/glavnaya/x96mini/ to restore your device?
i try those soft no luck
If the stock firmware doesn't work for you, have you tried installing the excellent android pie firmware from https://slimboxtv.ru/glavnaya/x96mini/ to restore your device?
i try those soft no luck
dtb is also subject to an RSA signature check. As long as the dtb is not written to emmc, you will have less chance of recovering your device. Put the emmc in acces mode by short-circuiting the pins and start the UBT update
after long short circuit i success enter acces mode
then i use update on sd card with ini file its start update and on 2% its reset
Looks like this u-boot's loadaddr is wrong. Why are you using the sd card-u-boot version? Try to use the eMMC-U-Boot variant. Unpack the manufacturer's Android IMG and only use the bootloader.PARTITION.. (u-boot.bin.enc).
Or, you can install the IMG via UBT with the Secure Boot option.
i use uboot from sd because box dosent accept soft or uboot from burning tools
i extract this bootloader from other working box my box finally unbricked but working only with sd
so i try to install stock firmware to fix uboot problem this stock contain not supported dtb
after install this firmware with uboot i got this problem
"Synchronous Abort" handler, esr 0x96000210
ELR: 37ec0168
LR: 37ec0168
x0 : 0000000000000000 x1 : 000000000000000c
x2 : 0000000000000038 x3 : 0000000000009acc
x4 : 0000000000000070 x5 : 0000000000000069
x6 : 0000000033ec1bc4 x7 : 0000000000000020
x8 : 0000000000000001 x9 : 0000000000000000
x10: 000000000000000f x11: 0000000037f384d8
x12: 0000000000000000 x13: 0000000000000000
x14: 0000000000000000 x15: 0000000000000000
x16: 0000000000000000 x17: 0000000000000000
x18: 0000000033ea1e28 x19: 0000000033eb7200
x20: 0000000000000000 x21: 0000000033eb7a00
x22: 0000000037f61a68 x23: 0000000000080000
x24: 0000000037f72000 x25: 0000000000000000
x26: 0000000000004bc8 x27: 0000000000000000
x28: 0000000033eb6a70 x29: 0000000033e91b70
Resetting CPU ...
any way to fix this ?
In your case, the box manufacturer has activated secure boot. Information about whether the board is actually encrypted can be extracted from the SEC_AO_SEC_SD_CFG10 register. You can only boot with an encrypted FIP. The error “wrong chip..”: The chip id is defined in BL30 blob (closed source). This id is also used for MAC generation in BL33, u-boot. As long as the chip id is not known, the uboot will perform the reset, which leads to a boot loop. I managed to convert the normal, unencrypted bl30 blob to an ELF binary through small manipulations and to decompile its code into a legible format. With a small change in ELF binary, the fake "s905w" was now running and was recognized as s905l Soc. If you still have one of these encrypted boards where the original u-boot is not damaged, you could read the bl30 dump into a file and compile it into an executable file to create an ELF binary from it..
It is best to contact the manufacturer regarding original fw
after success install recovery in the box i install a stock firmware
but i got new error
GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;LOOP:1;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;LOOP:2;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0;
no sdio debug board detected
TE: 10692501
BL2 Built : 11:04:41, Jan 26 2018.
gxl g034b32c - xingyu.chen@droid12-sz
set vcck to 1120 mv
set vddee to 1050 mv
Board ID = 2
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz
bist_test rank: 0 26 04 48 3b 1b 5c 27 00 4e 3f 20 5f 32 32 32 32 32 32 33 33 33 33 33 33 637
Rank0: 1024MB-2T-11
AddrBus test pass!
Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from SD, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from SD, src: 0x00020200, des: 0x01700000, size: 0x0002c600
aml log : R1024 check pass!
Load bl33 from SD, src: 0x00050200, des: 0x01700000, size: 0x00066400
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(release):35dd647
NOTICE: BL3-1: Built : 15:20:30, Feb 7 2018
[BL31]: GXL CPU setup!
NOTICE: BL31: BL33 decompress pass
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0xe5
66 3 11 a4 cb 60 90 37 1 b4 50 f3 [11.325683 Inits done]
secure task start!
high task start!
low task start!
ERROR: Error initializing runtime service opteed_fast
U-Boot 2015.01 (Apr 09 2019 - 10:51:05)
DRAM: 1 GiB
Relocation Offset is: 36eb2000
register usb cfg[0][1] = 0000000037f5a348
[CANVAS]canvas init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eb26b0
aml_priv->desc_buf = 0x0000000033eb49d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 5f4c4d41
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p281 variant: 1g
dtb 0 soc: gxl plat: p281 vari: 1g
dtb 1 soc: gxl plat: p281 vari: 2g
Find match dtb: 0
start dts,buffer=0000000033eb7200,dt_addr=0000000033eb7a00
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p281 variant: 1g
dtb 0 soc: gxl plat: p281 vari: 1g
dtb 1 soc: gxl plat: p281 vari: 2g
Find match dtb: 0
"Synchronous Abort" handler, esr 0x96000210
ELR: 37ec0168
LR: 37ec0168
x0 : 0000000000000000 x1 : 000000000000000c
x2 : 0000000000000038 x3 : 0000000000009acc
x4 : 0000000000000070 x5 : 0000000000000069
x6 : 0000000033ec1bc4 x7 : 0000000000000020
x8 : 0000000000000001 x9 : 0000000000000000
x10: 000000000000000f x11: 0000000037f384d8
x12: 0000000000000000 x13: 0000000000000000
x14: 0000000000000000 x15: 0000000000000000
x16: 0000000000000000 x17: 0000000000000000
x18: 0000000033ea1e28 x19: 0000000033eb7200
x20: 0000000000000000 x21: 0000000033eb7a00
x22: 0000000037f61a68 x23: 0000000000080000
x24: 0000000037f72000 x25: 0000000000000000
x26: 0000000000004bc8 x27: 0000000000000000
x28: 0000000033eb6a70 x29: 0000000033e91b70
Resetting CPU ...
resetting ...
Display More
In your case, the box manufacturer has activated secure boot. Information about whether the board is actually encrypted can be extracted from the SEC_AO_SEC_SD_CFG10 register. You can only boot with an encrypted FIP. The error “wrong chip..”: The chip id is defined in BL30 blob (closed source). This id is also used for MAC generation in BL33, u-boot. As long as the chip id is not known, the uboot will perform the reset, which leads to a boot loop. I managed to convert the normal, unencrypted bl30 blob to an ELF binary through small manipulations and to decompile its code into a legible format. With a small change in ELF binary, the fake "s905w" was now running and was recognized as s905l Soc. If you still have one of these encrypted boards where the original u-boot is not damaged, you could read the bl30 dump into a file and compile it into an executable file to create an ELF binary from it..
It is best to contact the manufacturer regarding original fw
thnx
i can get a board from a friend in a couple of days
for the manufactuer he offer only stock firmware
Chase the vendor for the correct ROM image to restore the box, or their u-boot sources (which are GPLv2 .. but good luck with that) or keep experimenting with u-boot(s) from ROM images (as you've been doing, from SD card).
install same Uboot with different Sd Card that give me log
i got different log
no sdio debug board detected
TE: 74533937
BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000
sd/emmc read data error: ret=16
aml log : R1024 check fail with ERR = 85
aml log : SIG CHK : 85 for address 0x01700000
reset...
GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0;
Display More
The u-boot you found only partially works. It looks to be compatible with the RAM, but there is some form of chip detection going on (from the error) so it's probably been created for another type of GXL device, e.g. S905X not S905W. The one good thing is .. you are experimenting from an SD card. Keep doing this, because if you flash the wrong u-boot to eMMC it becomes a major pain to recover the box (not impossible, but complicated).
The only mainline u-boot(s) that I have pre-compiled are here: Index of /testing/u-boot/ .. vim/lafrite/lepotato are all GXL devices (S905X, S905X) but the mainline sources don't really have device detection like vendor sources so from SD card they will either work or fail cleanly.
thank you
i try most of them not working
any sugg ?
hi all
i have a new X96 mini Amlogic S905W Bricked after wrong update
so after try many ways to unbrick it still dead only red flash
box spec
Amlogic S905W
ram 2GB/16GB Rom
Ram: sec 524 K4B4G0446E ( i think is samsung)
eMMC: KLMAG1JETD-B041 ( samsung)
i connect uart and log the box
i get
this log only
LOOP:1;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8;
LOOP:2;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:800;USB:8
and keep same loop with nothing
after i make some search i find out that U-boot is erased from box
i try many uboot from many flash on web with no luck
today i success getting log from box
i find a uboot i install it on sd card using BootcardMaker tools ( the uboot that work is from this img on web "X96mini Q6X v2.2 17355 чип Samsung")
and the box give me this log with loop ( i try with sd card recovey using same uboot+factory_update_param.aml+recovery.img+otasoft.zip on sd= nothing on tv )
log :
BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from SD, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from SD, src: 0x00020200, des: 0x01700000, size: 0x0002c600
aml log : R1024 check pass!
Load bl33 from SD, src: 0x00050200, des: 0x01700000, size: 0x00065e00
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(release):a625749
NOTICE: BL3-1: Built : 11:25:15, Aug 25 2017
[BL31]: GXL CPU setup!
NOTICE: BL31: BL33 decompress pass
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0xe5
Wrong chip e0
GXL:BL1:9ac50e:bb16dc;FEAT:BDFC31BC:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:A7;READ:0;CHK:A7;READ:0;CHK:A7;SD:0;READ:0;0.0;0.0;CHK:0;
no sdio debug board detected
TE: 280423
Display More
any help plz
thnk you .