UPDATE - COuldn't figure out a way to use uboot. Was able to finally get TWRP running. Backed it up. It cannot be used with Amlogic's USB Burning Tool, but, as long as the box has a recovery to boot to, I guess, I am relatively safe.
Posts by noob404
-
-
Have a read of this https://github.com/LibreELEC/amlogic-boot-fip/pull/27 - and please note that this forum really isn't interested in dealing with Android backup/recovery issues (not our OS, not our problem).
Also note that LE does not support install of the OS to the internal storage and while booting LE from an SD card changes the boot process slightly it's not harmful to the Android install - modern upstream kernels cannot see/mount any of the partitions created by the vendor boot firmware due to Amlogic's proprietary partition scheme - so we're not going to mess Android up.
NB: You can easily dump the full content of eMMC storage from inside LE using "dd" although this is a raw image and you will not be able to use it as recovery media in the event of eMMC issues as the u-boot in the dump is for eMMC boot only; magic headers are located at the wrong offset for SD/USB boot due to S905 requiring different offsets.
Thank you for the comment. Pardon me for posting this here. I posted it here, since many members seem to have found the help for these problems on LE forum. Again, pardon me for that. I will definitely go through the link you posted. Any help counts. Thanks. Kindly close the thread if you feel this is offtopic.
-
Hi, I just recently got UART access on my S905 Android Box. I have looked into ways to dump original firmware before I try LE and other distros. I could only find the method that uses uboot, as mentioned in this video by Matt Brown. The method uses bdinfo to see the memory start address (flashstart) and the size (flashsize). Unfortunately, uboot on my box doesn't have this. Here's a list of commands that I have access to, on uboot:-
Code
Display Moreaml_sysrecovery- Burning with amlogic format package from partition sysrecovery amlmmc - AMLMMC sub system amlnf - aml nand sub-system amlnf_test- AMLPHYNAND sub-system autoping- do auto ping test autoscr - run script from memory base - print or set address offset bmp - manipulate BMP image data booti - boot arm64 Linux Image image from memory bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol cbusreg - cbus register read/write clkmsr - measure PLL clock cmp - memory compare cp - memory copy crc32 - checksum calculation cvbs - CVBS sub-system dcache - enable or disable data cache defenv_reserv- reserve some specified envs after defaulting env dhcp - boot image via network using DHCP/TFTP protocol echo - echo args to console efuse - efuse read/write data commands efuse_user- efuse user space read write ops emmc - EMMC sub system env - environment handling commands ethchk - check ethernet status ethdbg - set ethernet debug level ethmode - set ethernet mac mode ethrst - reset ethernet phy exit - exit script false - do nothing, unsuccessfully fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) fatsize - determine a file's size fdt - flattened device tree utility commands get_rebootmode- get reboot mode go - start application at address 'addr' gpio - query and control gpio pins hdmitx - HDMITX sub-system help - print command description/usage i2c - I2C sub-system icache - enable or disable instruction cache imgread - Read the image from internal flash with actual size itest - return true/false on integer compare jtagoff - disable jtag jtagon - enable jtag keyman - Unify key ops interfaces based dts cfg keyunify- key unify sub-system loop - infinite loop on address range macreg - ethernet mac register read/write/dump md - memory display mdc_clk - do mdc clock mm - memory modify (auto-incrementing address) mmc - MMC sub system mmcinfo - display MMC info mw - memory write (fill) netspd_f- enforce eth speed nm - memory modify (constant address) open_scp_log- print SCP messgage osd - osd sub-system phyreg - ethernet phy register read/write/dump ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables rarpboot- boot image via network using RARP/TFTP protocol read_temp- cpu temp-system reboot - set reboot mode and reboot system reset - Perform RESET of the CPU rsvmem - reserve memory run - run commands in an environment variable saveenv - save environment variables to persistent storage sdc_burn- Burning with amlogic format package in sdmmc sdc_update- Burning a partition with image file in sdmmc card set_trim_base- cpu temp-system set_usb_boot- set usb boot mode setenv - set environment variables showvar - print local hushshell variables sleep - delay execution for some time store - STORE sub-system temp_triming- cpu temp-system test - minimal test like /bin/sh tftpboot- boot image via network using TFTP protocol true - do nothing, successfully unpackimg- un pack logo image into pictures update - Enter v2 usbburning mode usb - USB sub-system usb_burn- Burning with amlogic format package in usb usb_update- Burning a partition with image file in usb host usbboot - boot from USB device version - print monitor, compiler and linker version vout - VOUT sub-system vpu - vpu sub-system wipeisb - wipeisb write_trim- cpu temp-system write_version- cpu temp-systemI soon found a Reddit thread with the same issue, but no proper resolution to it. But, when I do run printenv, I find some lines that seem interesting to me, as a noob:-
Code
Display Morebootargs=rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xc81004c0 ramoops.mem_address=0x20000000 ramoops.mem_size=0x100000 ramoops.record_size=0x8000 ramoops.console_size=0x4000 androidboot.selinux=permissive logo=osd1,loaded,0x3f800000,720p60hz hdmimode=720p60hz cvbsmode=576cvbs hdmitx= androidboot.firstboot=0 mac=XX:XX:XX:XX:XX:XX androidboot.mac=XX:XX:XX:XX:XX:XX ............ bootup_offset=0x1080240 bootup_size=0x1c2046 ............ dtb_mem_addr=0x1000000 edid.crcvalue=0xc4020000 ............ fb_addr=0x3f800000 ............ fdt_high=0x20000000Just to test if uboot md would work for the dump, I took bootup_offset as start and bootup_size as size to run md using Matt Brown's video. But, even after running for 30 minutes, all I get is 0s.
My questions
1. Am I on the right track? Can I use any values from the printenv output to actually dump the firmware? If yes, can you point me to the right ones?
2. If you are wondering why I don't just download the stock firmware online, I don't get a perfect match for my box. Checking HW Info app, I get that my box is a p201. The closest stock firmware that I see is Android/p201/p201:5.1.1/LMY47V/20160118:userdebug/test-keys (available on Chinagadgetreview). But, the original one on the box has a different date and says user instead of userdebug, probably cause it was meant to be strictly for production.
3. Can I install the stock firmware linked in question 2 above from Chinagadgetreview using my SD Card and the stock UPDATE&BACKUP app?
-
Check earlier post.
-
Thank you for your comment.
Was able to fix this issue. The baud rate was 115200. But, the pins were wrong. In the image above, if you move a bit below from where the pins in the image are, there is a pin bracket with exactly 4 pins. Upon a closer inspection, I found them properly labelled RX, TX, GND and VCC. Soldered to them and Putty now properly outputs the log.
BTW, did try the smaller pins, but much like the bigger pins to their left, these were weird as well. TX to TX gave me output, which obviously was weird.
I've never seen a device that wasn't 115200,8,n,1 and I would advise against connecting the 3.3v/5v pins on the TTL device (asking for shorting issues and power isn't required). Yes it's possible that UART output is blocked in bootloaders, but that's normally only major-vendor streaming boxes (Amazon, etc.) and you're seeing stuff on-screen so that's unlikely. Not sure what to suggest as the only time I've seen something similar is when I'm connected to the wrong pins, e.g. JTAG not UART.
Tempting though large ones are, and the square one is normally GND .. Have you tried the 3x little round pads that are labelled?
-
Hi,
Just got my hands on an S905 board (it says S905-X8L05-V1.10 above the eMMC) using a mini USB to TTL reader:-
The image below shows the UART pinouts I have tried (The text in black denotes header on the TTL reader).
Case 1
No output at all.
Case 2
Continuous output on Putty (Tx indicator on TTL reader constatly lit, Rx blinks every second or so), but all gibberish. But, if I were to connect the HDMI cable, the output slows down. Here's a sample of Putty output with 115200 set as baud rate:-
Things I've tried with Case 2 pinout:-
1. Tried every baud rate that I could find starting from 4800 to 921600.
2. Tried moving the jumper from 3.3 to 5V and viceversa.
3. Tried different combinations, some absurd (RX to RX, GND to RX, etc.)
4. Checked TTL reader with another device (works as expected)
5. Tried putting the board in recovery mode when booting.
My questions:
1. What am I doing wrong?
2. Is there a chance that the manufacturer has somehow made UART almost impossible on this board?
