G96 mini with RK3228A bricked or bad RAM

[Nixie]

I have a "G96 mini" box that is bricked, I don't know its history but wrong firmware is a likely candidate- It contains a RK3228A and 08emcp08-el3cv100 ram & flash in a single chip. After some investigation I found how to boot from SD, boot in maskrom mode and access it with AndroidTool and capture the serial messages.

 

I found very little info about this specific box, only that looks similar to the H20 mentioned in this thread: 

 

 

I tried all the bootloaders I could find including multitool-1.11 and the armbian indicated in that thread and this is what happens:

 

DDR Version V1.11 20200910_dbg                                             
In                                                                          
ID:0xFFF                                                                    
unknow device                                                         
ERR

 

Another older bootloader I found around there seems to go a step further:

DDR Version V1.06 20171130_1_xintu_en_rd_odt
In                                                                          
300MHz                                                                      
LPDDR3                                                                  
Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=32 Size=1024MB
mach:4
rd addr 0x60000004 = 0xE0808004
ERR

 

Do you think it requires some special customized bootloader or is it that the RAM is not working properly?

Thanks in advance,

[jock]

Hello, AFAIK you have two options:

- broken board/DDR memories

- bad command rate timing

 

The former problem cannot be solved unless you are capable of fixing the board at industrial level, but most probably your problem is the latter.

 

Usually most boards/ddr memories work with 2T (2 clock cycles) command rate, which is more compatible because more "relaxed".

For some reasons I don't know, some DDRs want 1T Command Rate.

 

You can edit the multitool.img file with an hex editor and change the byte at position 0xABFC. You should find it to be 0x01 (2T CR), and you should turn it to 0x00 (1T CR):

 

 

then write again the multitool on sdcard and try again via maskrom

The multitool is also capable to switch from 1T to 2T and viceversa when the loader is installed in the eMMC, so if you burn armbian on eMMC, don't forget to use the Command Rate multitool menu option to select the right CR option!

 

[Nixie]

Hello, thank you! I tried changing this bit in multitool-1.11 but the result is the same.

 

 

I could not locate the bit in the older bootloader, the one that ran one step further. The bootloader is RK322XMiniLoaderAll_V2.47_MarcosTvBox.bin mentioned here in the last message:

 

 

[jock]

I guess the older bootloaders does not work at all with eMCP chip, if I remember correctly you need at least ddrbin v1.09 when you have an eMCP.

 

It could be that your board came with an even newer ddrbin or something a bit customized.

 

I guess you should ask the vendor for the original firmware and install it again to solve the issue if the command rate switching did not change anything.

 

 

[Nixie]

Thank you!

Well, it is not obvious who actually made this, in the box there is a reference to "Shenzhen Chensen Technology Co., Ltd" but that seems a led lamp manufacturer, and a phone and mail that look like the importer. I asked an aliexpress seller that is selling these but don't have much hope.

 

In a thread here someone came with a different box having exactly the same chips and said that multiboot worked. To me it is starting to look like a hardware problem, maybe some bad solder ball on the BGA chips, as a last resort I may try a reflow.

 

Edited June 8 by Nixie

[Nixie]

For now I could not find the original firmware, none of the aliexpress sellers responded.

 

Attached pictures of the G96mini board.

To force MASKROM mode short to ground any of the 8 pads nearest the EMMC chip that I highlighted, then power on and remove the short 1 second later. Once in MASKROM mode the USB plug nearest the jack sockets can be connected to the PC with a male to male cable.

Serial out messages are output in the marked pads on the bottom side, notice that above it there are two pads that have to be jumped. Don't try to solder wires to them directly, they are very delicate and you will wipe them out (I had to solder a fine wire to the PCB track).

 

Wifi IC is LG642.

 

 

Edited August 23 by Nixie

[jock]

@Nixie do you have some logging on the serial?

BTW, once you're in maskrom mode, you can wipe the internal flash with rkdeveloptool and do test and tricks on a sdcard with armbian/multitool on it, without the hassle of triggering the maskrom mode each time

[Nixie]

Hello,

The serial logging has not changed:

 

DDR Version V1.11 20200910_dbg                                             
In                                                                          
ID:0xFFF                                                                    
unknow device                                                         
ERR

 

RKDevTool says Fail on everything, for example trying to flash a firmware or any of the buttons in the Advanced tab.

 

 

 

 

 

[jock]

I'm not used to rkdevtool for windows, but indeed if the board does not get past the ddrbin, any tool won't work. The first thing the utilities do is upload a small binary (which contains the ddrbin as well) to initialize the board. The binary/executable then has the service functions that are invoked by the GUI utility when you click the button.

 

You should be able to read the serial log while rkdevtool uploads the binary and tries to initialize the board, but this will probably give you the same errors you already know.

 

The problem is that if you don't have the original firmware and nothing changes switching from 2T to 1T, there is nothing more you can do other than randomly trying firmwares, with the doubt your eMCP chip is even broken.

 

[Nixie]

Mistery solved - hardware problem. Pressing hard on the EMMC IC slightly bending the board makes it come to life, it even boots to the original Android and runs as long as the pressure is kept. When removed it hangs with lines all over the picture.

 

Original DDRbin is V1.09 and Android is the one shown in this review: G96mini review

 

I tried to reflow both EMMC and CPU but no luck  Maybe some board interconnect.

Edited August 25 by Nixie

[jock]

It could also be some broken welding among the small SMD components. You may try with a hot air gun.

[Nixie]

For now this is a working solution, a screw clamp pressing on the EMMC iC (second picture has the heat sink placed). It's been playing videos for over an hour and seems reliable. I can't mount its casing but at least works

 

I reflowed both IC with a hot air gun and liquid flux but no luck, maybe needs reballing.