Mysterious box

[Generic_user]

Greetings,

 

After receiving an "mx10 pro 4k" 4gb 32gb I tried booting armbian on it.

Strangely, after trying multiple images, dtbs I couldn't boot into armbian no matter what.

 

Becoming frustrated I proceed to open the box which surprised me:

both the dusty packaging and PCB advertise an rk3328, but after removing the heat sink I found out that it actually contains an rk3318 as adb and android warned me.

https://imgur.com/a/Hv1Qlw3

 

Not only did I get "scammed" (the box still works on android, and the average user wouldn't even notice), but now I seem to own an unknown box as it seems I can't trust the seller for anything they said.

So here I am, trying to reverse engineer the box, it doesn't contain apparent I2C or any other serial port but I successfully connected with adb root, I would like to extract the blobs but I never did such a thing before with android so help will be appreciated

[hexdump]

@Generic_user - the rk3318 is most probably only a lower quality rk3328, but otherwise identical ... you should give the rk3318 images from @jock a try:

good luck and best wishes - hexdump

[Generic_user]

2 hours ago, hexdump said:

@Generic_user - the rk3318 is most probably only a lower quality rk3328, but otherwise identical ... you should give the rk3318 images from @jock a try:

good luck and best wishes - hexdump

thank you for linking this post, unfortunately even the multitool can't seem to boot or do anything.

I suppose I need a box with a micro sd card for higher rates of success

[jock]

2 hours ago, Generic_user said:

thank you for linking this post, unfortunately even the multitool can't seem to boot or do anything.

I suppose I need a box with a micro sd card for higher rates of success

microsd and sd are the same thing, microsd if just smaller.

Your board is just another rk3328-based board, but with a rk3318 soc installed. Nothing so fancy, just made this way by the manufacturers to cut some more cost plugging in cheaper socs.

Multitool should work fine for you, if you could put images of the whole board and both sides maybe a serial could be spotted.

Also do the multitool freeze at boot or Android just boots even if multitool sdcard is inserted?

My rk3318 box sometimes refuses to boot from sdcard even if the sdcard is inserted, so maybe try three or four times to unplug and replug power before giving up with multitool.

 

 

[Generic_user]

15 hours ago, jock said:

microsd and sd are the same thing, microsd if just smaller.

Your board is just another rk3328-based board, but with a rk3318 soc installed. Nothing so fancy, just made this way by the manufacturers to cut some more cost plugging in cheaper socs.

Multitool should work fine for you, if you could put images of the whole board and both sides maybe a serial could be spotted.

Also do the multitool freeze at boot or Android just boots even if multitool sdcard is inserted?

My rk3318 box sometimes refuses to boot from sdcard even if the sdcard is inserted, so maybe try three or four times to unplug and replug power before giving up with multitool.

 

 

First of, thanks for answering me

Here is the pcb, front and back:

https://imgur.com/a/pQhwSW6

 

after inserting the sd card with different settings, the box ignores the card completely as if not existing.

I also linked the partitions of the sd card, maybe the boot flag should be put differently?

Anyway, after pluging and repluging the power it still boots to android normally, note the sd card is recognized and can be read and written into by android.

I just need to boot into linux, however and I could make my way through.

[jock]

It's uncommon but not so unexpected that the sdcard does not boot. Unfortunately my experience about rk3318 boxes is yet limited.

 

Maybe @fabiobassacan help us spotting a serial port, but also I see that you have three unpopulated and suspect pads near the led panel.

Indeed to be sure of what they really are requires an oscilloscope, but often using a multimeter you can read around 1.5v on both RX/TX pins in reference to ground; this is just a hint though, not a sure way to recognize them.

Indeed such kind of pads are difficult to solder without a proper precision tool and some skills.

What you can also do is put the board in loader/maskrom mode. Pressing the "reset" button behind the AV jack (or spdif, whatever it is) and keeping it pressed while plugging an USB male to male cable in the USB OTG port of the board should bring the SoC in loader mode.

Once there, you can do some advanced maintenance using your computer and rkdeveloptool rockchip tool. Clearing the internal eMMC will force the board to boot from sdcard.

You can backup, restore and clear the eMMC using rkdeveloptool, you can refer to rk322x (beware: rk322x, not rk3318! Don't use images and multitool for that soc for your board!) thread for rkdeveloptool commands. See paragraph "Alternative backup, restore and erase flash for EXPERTS" in this thread: https://forum.armbian.com/topic/12656-csc-armbian-for-rk322x-tv-boxes/

 

[fabiobassa]

@Generic_user

nothing to say, I love those producers every day more

Not easy to say where is the uart, at least without an oscilloscope !!

Join the other conversation may be someone else have your same board

[Generic_user]

@jock

After twisting some wires I was able to connect my computer to the device.

Now as I try to collect information it takes a lot of time (few minutes just to print a partition?), and it seems like downloading boot loaders from the device isn't supported.

At least I learned how to access directly an arm computer and use debug tool which can be valuable in the future

[Generic_user]

Is there something I am doing wrong?

I keep getting errors, as if the connection wasn't stable, yet I can list the device.

I can't read nor write anything to the emmc.

I would want to backup the whole disk, just in case, then try to boot from sd or flash an image into the emmc.

[jock]

19 hours ago, Generic_user said:

Is there something I am doing wrong?

I keep getting errors, as if the connection wasn't stable, yet I can list the device.

I can't read nor write anything to the emmc.

I would want to backup the whole disk, just in case, then try to boot from sd or flash an image into the emmc.

you should just use the rkdeveloptool rd command to make a backup, with appropriate arguments as described in the other thread.

Actually I don't know why the other commands fails and the multitool does not boot from sdcard, but maybe you have some sort of encrypted bootloader or whatever. Maybe @hexdump can give a hand.

[hexdump]

@Generic_user - to find out if the bootloader is encrypted you should maybe try to make a backup of the emmc via rkdeveloptool as described by @jock... then you can do a "hexdump -C your-emmc-dump | less" and if you only see random data and no structure at all on the first screen pages then the boot stuff is most probably encrypted - to give some examples how that looks like, just run the below two files through "zcat bootblock.gz | hexdump -C | less" and you should see the difference:

 

normal boot block: https://github.com/hexdump0815/u-boot-misc/raw/master/misc.rk3328/boot-block.dd/boot-h96max-rk3318-original-emmc.dd.gz

encrypted boot block: https://github.com/hexdump0815/u-boot-misc/raw/master/misc.gxy/dump-in.dd/s905x2-s10-max-plus.dd.gz

 

i never saw an encrypted boot block on any rk3318/rk3328 tv box yet (only rk3288 and amlogic s905x and s905x2 so far), but with tv boxes everything is possible ... the bad news is: in case it is encrypted, there is nothing you can do - for my rk3288 there was luckily a proper boot block around which was able to boot a regular kernel, but i think this was a very special situation.

 

best wishes - hexdump

[jock]

9 minutes ago, hexdump said:

the bad news is: in case it is encrypted, there is nothing you can do

Isn't it possible to use short the eMMC clock pin to ground, boot from sdcard, then erase the eMMC to start fresh?

[hexdump]

as far as i understand it not - i think if encryption for the boot process is enabled, then some fuses are being burned in the soc to switch into that mode and a key for decryption and/or checking the signature is also stored in there and i think this is a non reversible process in the hardware (at least not trivially to work around)

[Generic_user]

@hexdumpturns out it wasn't encrypted!

Just out of curiosity I mounted my Mx linux partition to use rkdeveloptool with my Artix machine and it worked like a charm!

I suppose Mx lacks drivers that Artix and ubuntu has?

 

@jock

I apparently made a back up of the whole emmc before erasing it, and tried to download some sections like trust or boot but I doubt it could be of any use.

but another problem emerges, I can't write or read the empty emmc, I should be able to restore the original image in maskrom?

 

I wish it were as easy as a block device to partition and format, but for the moment I wish to burn an Armbian image in the emmc.

Can anyone help me with that?

 

 

 

[jock]

@Generic_user

If you correctly erased the whole eMMC, when you plug the USB cable in the OTG port it should automatically bring you into maskrom mode without the need to push the reset button with the toothpick.

 

Also consider that if the eMMC is empty, the board should automatically use the sdcard as boot device, so first try to put the Multitool image and see if it boots, if it does not work, try also burning the Armbian image on the sdcard and see if it boots.

 

If you compiled rkdeveloptool yourself, consider using the rockchip provided one, I had severe problems with the version compiled by me, but did not investigate the causes.

 

Reading the partition table is not really useful, to make a full backup you can just use the rl command, specifying sector 0x0 as start and calculating the whole size of the  eMMC in 512 byte sector as length. This is explained in the rk322x post mentioned before.

 

To clear the eMMC use rkdeveloptool ef command; it should not fail to be sure the eMMC has been cleared.

 

If the eMMC is clean, the only rkdeveloptool command that will work is db. Db command uploads a minimal bootloader that enables other commands: you need a bootloader blob which, at the moment, I don't have as it needs to be built from rockchip blobs or extracted from an original firmware upgrade. If you have the original firmware/upgrade provided directly by the manufacturers, this is the right time to point it out.

If rkdeveloptool refuses to execute any command and lsusb tells you the device is in maskrom, probably the eMMC is just clean, so you should be able to boot from sdcard using multitool or armbian image directly.

[Generic_user]

@jock

thanks for your time,

the emmc seems to be completely clean as it directly switches to maskrom mode.

I think I am using a compiled version of the tool, but might try with different ones later.

I might share the back up that I made (gzipped) hopefully it can be of some use to someone.

I tried booting multitool form the sd card, but I will try hard using different images and different settings.

 

will keep you updated

[jock]

5 minutes ago, Generic_user said:

I might share the back up that I made (gzipped) hopefully it can be of some use to someone.

That won't be useful unfortunately. That particular bootloader is only available in the original firmware upgrade images. Maybe @hexdump has some of them.

 

Try first the images from the post @hexdump already gave you. They are specifically for rk3318.

 

 

[jock]

I extracted the bootloader part (usually called MiniLoaderAll, or similarly way) from an original image.

 

This file can be used with rkdeveloptool db when the device is in maskrom mode to load the initial loader that allows the other commands to work. Your mileage may vary, it did not test it at all.

 

If you have a serial adapter attached to the UART you can also read the log messages that the thing is reporting.

 

edit: updated the binary bootloader with a working one

 

 

 

rk3328_loader.bin

[Generic_user]

@jock

I don't know what to do with your image honestly.

So far I tried unpacking it and I saw some files appearing.

I am sure there's a procedure to do that properly if you can link it please?

 

[jock]

@Generic_user

I was referring to your previous post where all the commands were failing.

When the device is in maskrom mode (but not loader mode), the only accepted command is rkdeveloptool db loader.img. Only after db you can use the other commands, including rl or wr to read and write sectors, or ef to clean the whole flash.

 

By the way, did you try armbian from sdcard yet?

 

edit: I updated the binary in the previous post because had the chance to test it and it was not working; the new version instead is working:

paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool rd 3
Reset Device OK.
paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool db rk3328_loader.bin 
Downloading bootloader succeeded.
paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool rid
Flash ID: 45 4D 4D 43 20
paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool rfi
Flash Info:
        Manufacturer: SAMSUNG, value=00
        Flash Size: 14910 MB
        Flash Size: 30535680 Sectors
        Block Size: 512 KB
        Page Size: 2 KB
        ECC Bits: 0
        Access Time: 40
        Flash CS: Flash<0> 
paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool rci
Chip Info:  48 32 32 33 32 29 82 E 21 42 6A 88 78 0 8A 89
paolo@predatorg:~/Scrivania/rk3318-loader$ sudo ./rkdeveloptool rcb
Capability:07 00 00 00 00 00 00 00 
Direct LBA:     enabled
Vendor Storage: enabled
First 4m Access:        enabled
Read Com Log:   enabled

 

[Generic_user]

I tried using burning the images and the multitool into the sdcard with luck, the box still "ignores" the card and goes straight to maskrom (even without usb).

how can I get the binary form of the loader? you gave me rk3328_loader.img, so I suppose I can turn it into a .bin I just don't know how.

 

As expected no command work except list device (ld), all the other supposedly require a loader.

I either have a "<operation> failed!" and for the download boot loader I get "Did not find loader item in config!"

 

I think I just have to convert the .img into .bin so I can make more progress

 

/home/atlas/rkdeveloptool
(o_o)# sudo ./rkdeveloptool rfi
Read Flash Info failed!
/home/atlas/rkdeveloptool
(o_o)# sudo ./rkdeveloptool ld
DevNo=1	Vid=0x2207,Pid=0x320c,LocationID=201	Maskrom
/home/atlas/rkdeveloptool
(o_o)# sudo ./rkdeveloptool db
Did not find loader item in config!

 

[jock]

You don't have to convert anything. The extension is purely cosmetical. Maybe you didn't read, but I edited two posts were I clearly declared that the loader file has been updated because the previous one was not working, as long as I also clearly stated that it was untested.

 

I also posted a live usage example, but you didn't read that too.

 

19 minutes ago, Generic_user said:

I tried using burning the images and the multitool into the sdcard with luck, the box still "ignores" the card and goes straight to maskrom (even without usb).

Ok that's not normal, it should not happen.

No bootloader in internal flash -> the SoC looks for bootloader on sd -> no bootloader on sdcard -> go in maskrom mode.

 

Now there are four options I may guess about:

• you did not expand the multitool image or the armbian image, but burned the .xz file as is
• your microsd is faulty
• the microsd slot is faulty
• your board/soc is so special as we never seen any like that

 

 

[hexdump]

@jock - could it be that the sd card is not connected to the proper mmc slot - i have seen this on rk3328 boxes - for instance https://github.com/hexdump0815/u-boot-misc/issues/2

[jock]

1 hour ago, hexdump said:

@jock - could it be that the sd card is not connected to the proper mmc slot - i have seen this on rk3328 boxes - for instance https://github.com/hexdump0815/u-boot-misc/issues/2

Hmmm, that could really be the issue.

I found only boxes using the alternative mmc controller to allocate the wifi chip, but not the microsd slot so far.

 

In such case there is the need for an alternative bootloader and different dtb than the regular image

However @Generic_user can burn the Armbian image directly on the internal flash using rkdeveloptool.

It's a bit of a hazard though, because if the image does not boot getting maskrom mode back is very difficult

 

Also the dtb of the original image would clarify if the issue is that one.

[Generic_user]

@jock

I tried using precompiled rkbin and compiled rkdeveloptool.

with rkbin, I was able to download the bootloader.

 

 

After doing so, the other commands still don't seems to work.

My final options are trying again with the sd card and burning the image directly into the emmc, in case it bricks can I force maskrom mode with the reset button or should I short a (inaccessible) clock pin?

 

Edit: here is my original android image, if it can help someone

https://drive.google.com/uc?id=1hygVXWKRF8IIezGyRdZqYMjIU27BTr9M&export=download

 

Edit2:

note that the config.ini is empty and I get errors when trying to pack the loader

(-_-)$ cat config.ini 
firmware=
loader=
parameter=
misc=
boot=
kernel=
system=
recovery=
rockusb_id=
msc_id=
rb_check_off=true

 

[jock]

18 hours ago, Generic_user said:

My final options are trying again with the sd card and burning the image directly into the emmc, in case it bricks can I force maskrom mode with the reset button or should I short a (inaccessible) clock pin?

If it was not clear enough from the previous post, the only way to enter maskrom mode when the box is bricked is short the eMMC clock pin. The reset button is useless in such case

 

18 hours ago, Generic_user said:

note that the config.ini is empty and I get errors when trying to pack the loader

I don't know where you get such template, but indeed it is the wrong one.

The right template is this:

[CHIP_NAME]
NAME=RK322H
[VERSION]
MAJOR=2
MINOR=50
[CODE471_OPTION]
NUM=1
Path1=rk3328_ddr_333MHz_v
Sleep=1
[CODE472_OPTION]
NUM=1
Path1=rk322xh_usbplug_v2.
[LOADER_OPTION]
NUM=2
LOADER1=FlashData
LOADER2=FlashBoot
FlashData=rk3328_ddr_333MHz_v
FlashBoot=miniloader.bin
[OUTPUT]
PATH=rk3328_loader.bin

but I really don't understand what are you trying to achieve trying to add up dangerous steps to something that already does not seem to work because of a reason not yet clear enough.

If you don't clarify the reason why you have such issues, creating your own bootloader does not solve anything. The most probable issue is that your sdcard is wired differently than normal, so the SoC does not boot from sdcard.

Also there is another issue that is the bootloader not responding after being downloaded to the board, which is strange and requires attention too.

At last, it is warmly suggested to use the precompiled rkdeveloptool because if you compile from sources you may have issues, so why are you deliberately using a potentially misbehaving software?

 

You may discover something more attaching a serial adapter to the board UART and providing logs (real textual logs, not those annoying screenshot stamps), otherwise it is just walking in the dark where every step is dangerous.

 

edit: this is the dts of your board:dts , your box has SDIO Wifi and sdcard controllers swapped and who knows what other goodies are in this chinese box...