TAP 1 TV Box - s905x 2+16G flashed with wrong bootloader

[BatVanko]

I found the TV box that played couple of years ago... and bricked 😞 The box looks like this one https://bestedshop.com/index.php?route=product/product&product_id=213

Seems like I flashed it with Khadas VIM bootloader and now it enters a boot loop because it's failing the vim_check preboot script.

I tried all sorts of images via the SD card but it seems it ignores all of them.

The serial console output:

GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 138075

BL2 Built : 11:58:42, May 27 2017. 
gxl gc3c9a84 - xiaobo.gu@droid05

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0+1 @ 768MHz - PASS
Rank0: 1024MB(auto)-2T-11
Rank1: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from eMMC, src: 0x00020200, des: 0x05100000, size: 0x00018400
Load bl33 from eMMC, src: 0x0003c200, des: 0x01000000, size: 0x00066800
NOTICE:  BL3-1: v1.0(release):3348978
NOTICE:  BL3-1: Built : 15:44:01, May 12 2017
[BL31]: GXL CPU setup!
NOTICE:  BL3-1: BL33 decompress pass
mpu_config_enable:ok

[Image: gxl_v1.1.3221-2cfba69 2017-05-27 16:03:58 qiufang.dai@droid07]

OPS=0x82

48 e4 7a 44 9d 15 28 2d 57 4d 27 1 [0.347298 Inits done]

secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01-gec7adb5 (Oct 28 2017 - 16:44:13)

DRAM:  2 GiB
Relocation Offset is: 76eaf000
register usb cfg[0][1] = 0000000077f56810
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC:   aml_priv->desc_buf = 0x0000000073eaf6b0
aml_priv->desc_buf = 0x0000000073eb19d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic edfe0dd0
start dts,buffer=0000000073eb4200,dt_addr=0000000073eb4200
parts: 10
00:      logo	0000000002000000 1
01:  recovery	0000000002000000 1
02:       rsv	0000000000800000 1
03:       tee	0000000000800000 1
04:     crypt	0000000002000000 1
05:      misc	0000000002000000 1
06:      boot	0000000002000000 1
07:    system	0000000080000000 1
08:     cache	0000000020000000 2
09:      data	ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000 
In:    serial
Out:   serial
Err:   serial
## defenv_reserve
Saving Environment to aml-storage...
mmc env offset: 0x27400000 
Writing to MMC(1)... done
reboot_mode=normal
hpd_state=1
[1080p60hz] is invalid for cvbs.
set hdmitx VIC = 16
config HPLL = 2970000
HPLL: 0xc000027b
config HPLL done
j = 4  vid_clk_div = 1
hdmitx: set enc for VIC: 16
HDMITX-DWC addr=0x10004006 rd_data=0x40
Error: HDMITX-DWC exp_data=0xff mask=0x9f
rx version is 1.4 or below  div=10
hdmtix: set audio
hdmitx phy setting done
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 4c291ff3, store 4c291ff3
_verify_dtb_checksum()-917: calc 4c291ff3, store 4c291ff3
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
Net:   dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0 
active slot = 0 
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
saradc - saradc sub-system

Usage:
saradc saradc open <channel>		- open a SARADC channel
saradc close	- close the SARADC
saradc getval	- get the value in current channel
saradc get_in_range <min> <max>	- return 0 if current value in the range of current channel

gpio: pin GPIOAO_2 (gpio 102) value is 1
saradc - saradc sub-system

Usage:
saradc saradc open <channel>		- open a SARADC channel
saradc close	- close the SARADC
saradc getval	- get the value in current channel
saradc get_in_range <min> <max>	- return 0 if current value in the range of current channel

Product checking: fail!
reboot use default mode: normal
bl31 reboot reason: 0xd
bl31 reboot reason: 0x1
system cmd  1.

 

 

So my question is: Is there any hope?  ...and if yes: How?

[SteeMan]

Best bet would be to find the original android firmware for your box and then use the amlogic tools (amlogic usb burning tool) to reinstall that firmware. There are many posts around the internet that describe the process.

[BatVanko]

@SteeMan Thank you for the advice!

That's my other problem. The only link to the stock firmware I can find is dead and in addition the board doesn't seem to switch to recovery mode by pushing the button (no USB device pops up). I was thinking of a trick where I can interrupt these pre-boot scripts through the serial console. I'm not very familiar with the u-boot internals, but apparently I have to start reading the code to find a backdoor.

Thanks for the response though!