Seth

@jock yes please. and can i have a walkthrough on the differences are and how you fixed the leds. i'm currently working on reversing an antenna for 2.4GHz for use with the box, well at least the usb wifi i'm using on it. i'm planning on making one made up of more segments to increase gain as i will make this my main access point (and mqtt server) at home for solar IoT projects.

@fabiobassa well, i'm gonna tinker with it a bit more and post any progress. i put files there for others to use as reference just in case they encounter same problems as mine. cheers.

@dale congrats for successful setup! Anyway, i got a hold of the device tree copy from android as well as dmesg. I figured, i'm gonna follow @hexdump's instructions. hope it all works out fine. device-tree-copy.tar.gz dmesg_android.txt

@hexdump thanks. i managed to get device tree from android box. nice guide. @jock i got the dmesg, will upload tomorrow, i need some sleep. @fabiobassa box is working fine as headless super router at the moment, running soho dhcp, dns server/cache, squid transparent proxy/cache. will slowly try to improve it as i learn more about these little things. i remember, i used to install debian/pfsense on old p3 and p4 boards just to get a reliable mega router/firewall and run squid and squidguard on em. now i can do that at the fraction of the size and power consumption. Just when i thought those boxes couldn't get any wierder. I found an s9012.ko in /lib/modules folder btw.

@hexdump thanks, will try to extract dtb from original firmware. @fabiobassa thanks, i still have a lot to learn configuring these boxes. waaay harder than sbc's that already have preconfigured distros. any recommended reading about rockchip devices? these tv boxes are everywhere and cheap too.

I ordered another box and i got the exact same board with the exact same hardware marked R28-MXQ. the wifi chip is identified as ap6210. mainline should have a driver available right? i will also attempt to backup firmware later and the first 4MB of the emmc. i'm gonna use rkdumper. i hope it goes without a hitch. It seems wifi chip is connected in SDIO mode. will have to do a little digging on the led config and hdmi too. hdmi audio is in i2s mode. @jock @fabiobassa Do you guys have a guide on extracting those configuration from the original firmware?

A better pic of the wifi chip. I think it's supposed to be an el cheapo substitute for AP series wifi chips ( similar to what happened to stm32 and cs32/gd32 microcontroller cloning). this drove me bonkers to say the least. *pic cropped and edited in markup with palma filter

@jock Maybe you turned off the board before it was first completing the partition resize? Indeed i have, i removed the plug because i thought i made a mistake with the flashing procedure . Silly me About the wifi, S9012 is not a name I recognize and the photo is not clear enough to say what you have there. I sort of tried and made sense of what i can see with my deteriorating vision. but crawling the web lead me to others that have the same wifi chip S9012p. I already succcessfully installed armbian 5.9 focal, and it gets identified as unknown wifi with vid:pid 02e7:9086. Anyway, i disabled the desktop service and will connect it to lan for the moment so i can play with it using putty. A 1.2GHz quad core processor and 1G ram and 8G flash can do a lot of things. I only flashed the desktop version to be sure i get sshd package and just in case someone gets the hdmi and wifi working someday. This is a nice break from my mundane day job and my other hobbies. also, i have attached dmesg output. dmesg.txt

@fabiobassa @jock For further infos and helping more people would you be so kind to post some screenshots and a more detailled procedure !? Hi again. so i got the box for about $13.00 online. it was marketed as an MXQ Pro 5G 4G/32G which was totally fake so i opened it and found out that is was just 1G/8G and that it was an RK3228. I tried backing up the firmware with rkdevtool in loader mode and only got about 0x0h to 0x10000h. i tried to write it back and it wouldn't boot anymore. I tried flashing it with armbian and rkdevtool and still no luck then i saw @qiheng's post (thank god he posted pictures) and copied his rkdevtool config and placed the box in maskrom using the pin short method. pinout is here. i just shorted clk to vss/gnd pin. and the flashing worked! Here are the pics of the board, it's marked R28-MXQ-00813, has DDR3 and 8GB flash. I also found the UART pins at the back of the board the 2 pads close to a bunch of capacitors under the cpu, the closest pad to the capacitors is the TX pin and the pad next to it is the RX pin, i just connected the gnd pin to power gnd. Here's the pic, green is tx and white is rx. uboot boots fine but it can't continue booting. i used legacy buster with 4.4 kernel. Orange led is blinking and i got the log below from putty. Apparently, it can't find boot.env. Serial baud rate is 115200 DDR Version V1.10 20190926 In ID:0xFFF 600MHz DDR3 Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=16 Size=1024MB mach:4 OUT U-Boot SPL 2020.10-armbian (Dec 12 2020 - 01:47:28 +0100) Trying to boot from MMC2 I/TC: I/TC: Non-secure external DT found I/TC: Switching console to device: /serial@11030000 I/TC: OP-TEE version: 3.10.0-40-ga1d5c81f (gcc version 9.2.1 20191025 (GNU Toolc hain for the A-profile Architecture 9.2-2019.12 (arm-9.10))) #6 Wed Sep 16 21:36 :15 UTC 2020 arm I/TC: Primary CPU initializing M/TC: Not protecting region 1: 0x68400000-0x68600000 I/TC: Primary CPU switching to normal world boot U-Boot 2020.10-armbian (Dec 12 2020 - 01:47:28 +0100) Model: Generic Rockchip rk322x TV Box board DRAM: 992 MiB MMC: dwmmc@30000000: 1, dwmmc@30020000: 0 Loading Environment from EXT4... ** File not found /boot/boot.env ** ** Unable to read "/boot/boot.env" from mmc0:1 ** In: serial@11030000 Out: serial@11030000 Err: serial@11030000 Model: Generic Rockchip rk322x TV Box board Net: eth0: ethernet@30200000 starting USB... Bus usb@30040000: USB DWC2 scanning bus usb@30040000 for devices... 1 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found stopping USB.. starting USB... Bus usb@30040000: USB DWC2 scanning bus usb@30040000 for devices... 1 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found Hit any key to stop autoboot: 0 Card did not respond to voltage select! Device 0: unknown device switch to partitions #0, OK mmc0(part 0) is current device Scanning mmc 0:1... Found U-Boot script /boot/boot.scr 2909 bytes read in 3 ms (946.3 KiB/s) ## Executing script at 60000000 Boot script loaded from mmc 0 214 bytes read in 3 ms (69.3 KiB/s) 5694356 bytes read in 140 ms (38.8 MiB/s) 8771432 bytes read in 206 ms (40.6 MiB/s) 49812 bytes read in 7 ms (6.8 MiB/s) Failed to load '/boot/dtb/overlay/-fixup.scr' ## Loading init Ramdisk from Legacy Image at 64000000 ... Image Name: uInitrd Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 5694292 Bytes = 5.4 MiB Load Address: 00000000 Entry Point: 00000000 Verifying Checksum ... OK ## Flattened Device Tree blob at 61f00000 Booting using the fdt blob at 0x61f00000 Loading Ramdisk to 67e91000, end 683ff354 ... OK Loading Device Tree to 67e1c000, end 67e90fff ... OK Starting kernel ... I/TC: Secondary CPU 1 initializing I/TC: Secondary CPU 1 switching to normal world boot I/TC: Secondary CPU 2 initializing I/TC: Secondary CPU 2 switching to normal world boot I/TC: Secondary CPU 3 initializing I/TC: Secondary CPU 3 switching to normal world boot I tried flashing kernel 5.9 minimal buster and i get this: DDR Version V1.10 20190926 In ID:0xFFF 600MHz DDR3 Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=16 Size=1024MB mach:4 OUT U-Boot SPL 2020.10-armbian (Dec 12 2020 - 01:48:33 +0100) Trying to boot from MMC2 I/TC: I/TC: Non-secure external DT found I/TC: Switching console to device: /serial@11030000 I/TC: OP-TEE version: 3.10.0-40-ga1d5c81f (gcc version 9.2.1 20191025 (GNU Toolchain for the A-profile Architecture 9.2-2019.12 (arm-9.10))) #6 Wed Sep 16 21:36:15 UTC 2020 arm I/TC: Primary CPU initializing M/TC: Not protecting region 1: 0x68400000-0x68600000 I/TC: Primary CPU switching to normal world boot U-Boot 2020.10-armbian (Dec 12 2020 - 01:48:33 +0100) Model: Generic Rockchip rk322x TV Box board DRAM: 992 MiB MMC: dwmmc@30000000: 1, dwmmc@30020000: 0 Loading Environment from EXT4... ** File not found /boot/boot.env ** ** Unable to read "/boot/boot.env" from mmc0:1 ** In: serial@11030000 Out: serial@11030000 Err: serial@11030000 Model: Generic Rockchip rk322x TV Box board Net: eth0: ethernet@30200000 starting USB... Bus usb@30040000: USB DWC2 scanning bus usb@30040000 for devices... 1 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found stopping USB.. starting USB... Bus usb@30040000: USB DWC2 scanning bus usb@30040000 for devices... 1 USB Device(s) found scanning usb for storage devices... 0 Storage Device(s) found Hit any key to stop autoboot: 0 Card did not respond to voltage select! Device 0: unknown device switch to partitions #0, OK mmc0(part 0) is current device Scanning mmc 0:1... Found U-Boot script /boot/boot.scr 2909 bytes read in 3 ms (946.3 KiB/s) ## Executing script at 60000000 Boot script loaded from mmc 0 243 bytes read in 3 ms (79.1 KiB/s) 6017211 bytes read in 148 ms (38.8 MiB/s) 9681360 bytes read in 226 ms (40.9 MiB/s) 40937 bytes read in 6 ms (6.5 MiB/s) 410 bytes read in 5 ms (80.1 KiB/s) Applying kernel provided DT overlay rk322x-emmc-nand.dtbo 1286 bytes read in 6 ms (209 KiB/s) Applying kernel provided DT overlay rk322x-led-conf1.dtbo 232 bytes read in 6 ms (37.1 KiB/s) Applying kernel provided DT fixup script (rk322x-fixup.scr) ## Executing script at 600f0000 ## Loading init Ramdisk from Legacy Image at 64000000 ... Image Name: uInitrd Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 6017147 Bytes = 5.7 MiB Load Address: 00000000 Entry Point: 00000000 Verifying Checksum ... OK ## Flattened Device Tree blob at 61f00000 Booting using the fdt blob at 0x61f00000 Loading Ramdisk to 67e42000, end 683ff07b ... OK Loading Device Tree to 67dcf000, end 67e41fff ... OK Starting kernel ... I/TC: Secondary CPU 1 initializing I/TC: Secondary CPU 1 switching to normal world boot I/TC: Secondary CPU 2 initializing I/TC: Secondary CPU 2 switching to normal world boot I/TC: Secondary CPU 3 initializing I/TC: Secondary CPU 3 switching to normal world boot Armbian 20.11.3 Buster ttyS2 rk322x-box login: iamgroot Password: Last login: Sat Dec 12 10:39:28 UTC 2020 on ttyS2 _ _________ ____ _ _ __| | _|___ /___ \|___ \__ __ | |__ _____ __ | '__| |/ / |_ \ __) | __) \ \/ /____| '_ \ / _ \ \/ / | | | < ___) / __/ / __/ > <_____| |_) | (_) > < |_| |_|\_\____/_____|_____/_/\_\ |_.__/ \___/_/\_\ Welcome to Armbian 20.11.3 Buster with Linux 5.9.14-rk322x No end-user support: community creations System load: 27% Up time: 0 min Memory usage: 5% of 960M IP: CPU temp: 63°C Usage of /: 8% of 7.0G [ 0 security updates available, 17 updates total: apt upgrade ] Last check: 2020-12-12 10:40 iamgroot@rk322x-box:~$ No wifi or x yet but it's a start. serial seems to freeze sometimes, maybe because of my cloned pl2303 usb ttl. maybe i should get a better usb to uart. after repeated reboots, i managed to run rk322x-config successfully. i don't know what the wifi chip, it's marked S9012 and when i searched for it only transistors came up. lol.

weeee! i got it booting. orange light blinks. flashed it in maskrom mode. flashed the loader from first post at 0xcccccccc and armbian image at 0x0. it worked. now i need to hunt for uart rx and tx pins. thanks @jock and @fabiobassa. i just hope i don't break the board while searching for uart pins.

I gave up using rkdevtool in windows. maybe i'll have better luck with windows subsystem for linux and use rkdeveloptool instead.

So if i boot in maskrom by shorting clk pin to ground and start flashing armbian image at 0x0 with rkdevtool for windows, i don't have to go through the sd card and usb booting steps? i'll try that right away.

Hello, i managed to find the emmc pinout for the clk pin here, i was able to flash my backup from 0x0 to 0x10000h. Now the box can be detected in loader mode. My question is, should i flash a uboot to support booting from usb flash drive or should i just use the multitool? how much and what part of the flash should i erase so i can boot from multitool? i never tried finding the rx and tx pins on the board so i have not tried debugging it with uart yet.

I tried to flash an android firmware i found on the net. and now it's dead. doesn't even get detected when i plug in usb. rkdevtool on windows doesn't recognize it anymore (maskrom or loader) i think the firmware i downloaded has the wrong idb loader or something. here are the images of the board. boardpics i was hoping i could short the flash clk pin to ground so i can go into force maskrom mode but the pinouts from fabiobassa's pics are not the same. P.S. i got an smd rework station and an assortment of maker tools and fine soldering skills so i'm not afraid to go full on hardware mode. just need someone to point me in the right direction. thanks in advance.

hello, i'm new to this forum. i also bought a tv box similar to JVMS. it's marked r28-mxq-00813. ram is marked k4b1g0446F, searched for the datasheet and it looks like ddr3 ram 667MHz . it has an 8G flash marked EPNA6M4-0808-AE. i was able to readback at least 32MB of the flash with rkdevtool v2.79. i can't however backup idbloader and everything else after 0x10000h. i seem to have borked the firmware trying to writeback my 32MB backup. i tried booting the board using a usb flash drive flashed with multitool. i used balena etcher, still no luck. i'll upload photos later.