BatVanko Posted March 1, 2023 Posted March 1, 2023 I found the TV box that played couple of years ago... and bricked 😞 The box looks like this one https://bestedshop.com/index.php?route=product/product&product_id=213 Seems like I flashed it with Khadas VIM bootloader and now it enters a boot loop because it's failing the vim_check preboot script. I tried all sorts of images via the SD card but it seems it ignores all of them. The serial console output: GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0; TE: 138075 BL2 Built : 11:58:42, May 27 2017. gxl gc3c9a84 - xiaobo.gu@droid05 set vcck to 1120 mv set vddee to 1000 mv Board ID = 1 CPU clk: 1200MHz DQS-corr enabled DDR scramble enabled DDR3 chl: Rank0+1 @ 768MHz - PASS Rank0: 1024MB(auto)-2T-11 Rank1: 1024MB(auto)-2T-11 DataBus test pass! AddrBus test pass! -s Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000 New fip structure! Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600 Load bl31 from eMMC, src: 0x00020200, des: 0x05100000, size: 0x00018400 Load bl33 from eMMC, src: 0x0003c200, des: 0x01000000, size: 0x00066800 NOTICE: BL3-1: v1.0(release):3348978 NOTICE: BL3-1: Built : 15:44:01, May 12 2017 [BL31]: GXL CPU setup! NOTICE: BL3-1: BL33 decompress pass mpu_config_enable:ok [Image: gxl_v1.1.3221-2cfba69 2017-05-27 16:03:58 qiufang.dai@droid07] OPS=0x82 48 e4 7a 44 9d 15 28 2d 57 4d 27 1 [0.347298 Inits done] secure task start! high task start! low task start! ERROR: Error initializing runtime service opteed_fast U-Boot 2015.01-gec7adb5 (Oct 28 2017 - 16:44:13) DRAM: 2 GiB Relocation Offset is: 76eaf000 register usb cfg[0][1] = 0000000077f56810 [CANVAS]canvas init vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters vpu: clk_level = 7 vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300) vpu: vpu_clk_gate_init_off vpp: vpp_init boot_device_flag : 1 Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc. init bus_cycle=6, bus_timing=7, system=5.0ns reset failed get_chip_type and ret:fffffffe get_chip_type and ret:fffffffe chip detect failed and ret:fffffffe nandphy_init failed and ret=0xfffffff1 MMC: aml_priv->desc_buf = 0x0000000073eaf6b0 aml_priv->desc_buf = 0x0000000073eb19d0 SDIO Port B: 0, SDIO Port C: 1 emmc/sd response timeout, cmd8, status=0x1ff2800 emmc/sd response timeout, cmd55, status=0x1ff2800 init_part() 293: PART_TYPE_AML [mmc_init] mmc init success dtb magic edfe0dd0 start dts,buffer=0000000073eb4200,dt_addr=0000000073eb4200 parts: 10 00: logo 0000000002000000 1 01: recovery 0000000002000000 1 02: rsv 0000000000800000 1 03: tee 0000000000800000 1 04: crypt 0000000002000000 1 05: misc 0000000002000000 1 06: boot 0000000002000000 1 07: system 0000000080000000 1 08: cache 0000000020000000 2 09: data ffffffffffffffff 4 init_part() 293: PART_TYPE_AML eMMC/TSD partition table have been checked OK! check pattern success mmc env offset: 0x27400000 In: serial Out: serial Err: serial ## defenv_reserve Saving Environment to aml-storage... mmc env offset: 0x27400000 Writing to MMC(1)... done reboot_mode=normal hpd_state=1 [1080p60hz] is invalid for cvbs. set hdmitx VIC = 16 config HPLL = 2970000 HPLL: 0xc000027b config HPLL done j = 4 vid_clk_div = 1 hdmitx: set enc for VIC: 16 HDMITX-DWC addr=0x10004006 rd_data=0x40 Error: HDMITX-DWC exp_data=0xff mask=0x9f rx version is 1.4 or below div=10 hdmtix: set audio hdmitx phy setting done [store]To run cmd[emmc dtb_read 0x1000000 0x40000] _verify_dtb_checksum()-917: calc 4c291ff3, store 4c291ff3 _verify_dtb_checksum()-917: calc 4c291ff3, store 4c291ff3 dtb_read()-1039: total valid 2 dtb_read()-1106: do nothing Net: dwmac.c9410000amlkey_init() enter! [EFUSE_MSG]keynum is 4 [BL31]: tee size: 0 Start read misc partition datas! info->attemp_times = 0 info->active_slot = 0 info->slot_info[0].bootable = 1 info->slot_info[0].online = 1 info->slot_info[1].bootable = 0 info->slot_info[1].online = 0 info->attemp_times = 0 attemp_times = 0 active slot = 0 wipe_data=successful wipe_cache=successful upgrade_step=2 [OSD]load fb addr from dts [OSD]fb_addr for logo: 0x7f851000 [OSD]load fb addr from dts [OSD]fb_addr for logo: 0x7f851000 [CANVAS]addr=0x7f851000 width=3840, height=2160 amlkey_init() enter! amlkey_init() 71: already init! [EFUSE_MSG]keynum is 4 [BL31]: tee size: 0 [KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet [KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet saradc - saradc sub-system Usage: saradc saradc open <channel> - open a SARADC channel saradc close - close the SARADC saradc getval - get the value in current channel saradc get_in_range <min> <max> - return 0 if current value in the range of current channel gpio: pin GPIOAO_2 (gpio 102) value is 1 saradc - saradc sub-system Usage: saradc saradc open <channel> - open a SARADC channel saradc close - close the SARADC saradc getval - get the value in current channel saradc get_in_range <min> <max> - return 0 if current value in the range of current channel Product checking: fail! reboot use default mode: normal bl31 reboot reason: 0xd bl31 reboot reason: 0x1 system cmd 1. So my question is: Is there any hope? ...and if yes: How?
SteeMan Posted March 1, 2023 Posted March 1, 2023 Best bet would be to find the original android firmware for your box and then use the amlogic tools (amlogic usb burning tool) to reinstall that firmware. There are many posts around the internet that describe the process.
BatVanko Posted March 2, 2023 Author Posted March 2, 2023 @SteeMan Thank you for the advice! That's my other problem. The only link to the stock firmware I can find is dead and in addition the board doesn't seem to switch to recovery mode by pushing the button (no USB device pops up). I was thinking of a trick where I can interrupt these pre-boot scripts through the serial console. I'm not very familiar with the u-boot internals, but apparently I have to start reading the code to find a backdoor. Thanks for the response though!
Recommended Posts