Nixie Posted June 5 Share Posted June 5 I have a "G96 mini" box that is bricked, I don't know its history but wrong firmware is a likely candidate- It contains a RK3228A and 08emcp08-el3cv100 ram & flash in a single chip. After some investigation I found how to boot from SD, boot in maskrom mode and access it with AndroidTool and capture the serial messages. I found very little info about this specific box, only that looks similar to the H20 mentioned in this thread: I tried all the bootloaders I could find including multitool-1.11 and the armbian indicated in that thread and this is what happens: DDR Version V1.11 20200910_dbg In ID:0xFFF unknow device ERR Another older bootloader I found around there seems to go a step further: DDR Version V1.06 20171130_1_xintu_en_rd_odt In 300MHz LPDDR3 Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=32 Size=1024MB mach:4 rd addr 0x60000004 = 0xE0808004 ERR Do you think it requires some special customized bootloader or is it that the RAM is not working properly? Thanks in advance, 0 Quote Link to comment Share on other sites More sharing options...
jock Posted June 6 Share Posted June 6 Hello, AFAIK you have two options: - broken board/DDR memories - bad command rate timing The former problem cannot be solved unless you are capable of fixing the board at industrial level, but most probably your problem is the latter. Usually most boards/ddr memories work with 2T (2 clock cycles) command rate, which is more compatible because more "relaxed". For some reasons I don't know, some DDRs want 1T Command Rate. You can edit the multitool.img file with an hex editor and change the byte at position 0xABFC. You should find it to be 0x01 (2T CR), and you should turn it to 0x00 (1T CR): then write again the multitool on sdcard and try again via maskrom The multitool is also capable to switch from 1T to 2T and viceversa when the loader is installed in the eMMC, so if you burn armbian on eMMC, don't forget to use the Command Rate multitool menu option to select the right CR option! 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted June 6 Author Share Posted June 6 Hello, thank you! I tried changing this bit in multitool-1.11 but the result is the same. I could not locate the bit in the older bootloader, the one that ran one step further. The bootloader is RK322XMiniLoaderAll_V2.47_MarcosTvBox.bin mentioned here in the last message: 0 Quote Link to comment Share on other sites More sharing options...
jock Posted June 6 Share Posted June 6 I guess the older bootloaders does not work at all with eMCP chip, if I remember correctly you need at least ddrbin v1.09 when you have an eMCP. It could be that your board came with an even newer ddrbin or something a bit customized. I guess you should ask the vendor for the original firmware and install it again to solve the issue if the command rate switching did not change anything. 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted June 8 Author Share Posted June 8 (edited) Thank you! Well, it is not obvious who actually made this, in the box there is a reference to "Shenzhen Chensen Technology Co., Ltd" but that seems a led lamp manufacturer, and a phone and mail that look like the importer. I asked an aliexpress seller that is selling these but don't have much hope. In a thread here someone came with a different box having exactly the same chips and said that multiboot worked. To me it is starting to look like a hardware problem, maybe some bad solder ball on the BGA chips, as a last resort I may try a reflow. Edited June 8 by Nixie 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted August 23 Author Share Posted August 23 (edited) For now I could not find the original firmware, none of the aliexpress sellers responded. Attached pictures of the G96mini board. To force MASKROM mode short to ground any of the 8 pads nearest the EMMC chip that I highlighted, then power on and remove the short 1 second later. Once in MASKROM mode the USB plug nearest the jack sockets can be connected to the PC with a male to male cable. Serial out messages are output in the marked pads on the bottom side, notice that above it there are two pads that have to be jumped. Don't try to solder wires to them directly, they are very delicate and you will wipe them out (I had to solder a fine wire to the PCB track). Wifi IC is LG642. Edited August 23 by Nixie 0 Quote Link to comment Share on other sites More sharing options...
jock Posted August 23 Share Posted August 23 @Nixie do you have some logging on the serial? BTW, once you're in maskrom mode, you can wipe the internal flash with rkdeveloptool and do test and tricks on a sdcard with armbian/multitool on it, without the hassle of triggering the maskrom mode each time 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted August 23 Author Share Posted August 23 Hello, The serial logging has not changed: DDR Version V1.11 20200910_dbg In ID:0xFFF unknow device ERR RKDevTool says Fail on everything, for example trying to flash a firmware or any of the buttons in the Advanced tab. 0 Quote Link to comment Share on other sites More sharing options...
jock Posted August 23 Share Posted August 23 I'm not used to rkdevtool for windows, but indeed if the board does not get past the ddrbin, any tool won't work. The first thing the utilities do is upload a small binary (which contains the ddrbin as well) to initialize the board. The binary/executable then has the service functions that are invoked by the GUI utility when you click the button. You should be able to read the serial log while rkdevtool uploads the binary and tries to initialize the board, but this will probably give you the same errors you already know. The problem is that if you don't have the original firmware and nothing changes switching from 2T to 1T, there is nothing more you can do other than randomly trying firmwares, with the doubt your eMCP chip is even broken. 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted August 25 Author Share Posted August 25 (edited) Mistery solved - hardware problem. Pressing hard on the EMMC IC slightly bending the board makes it come to life, it even boots to the original Android and runs as long as the pressure is kept. When removed it hangs with lines all over the picture. Original DDRbin is V1.09 and Android is the one shown in this review: G96mini review I tried to reflow both EMMC and CPU but no luck Maybe some board interconnect. Edited August 25 by Nixie 0 Quote Link to comment Share on other sites More sharing options...
jock Posted August 25 Share Posted August 25 It could also be some broken welding among the small SMD components. You may try with a hot air gun. 0 Quote Link to comment Share on other sites More sharing options...
Nixie Posted August 25 Author Share Posted August 25 For now this is a working solution, a screw clamp pressing on the EMMC iC (second picture has the heat sink placed). It's been playing videos for over an hour and seems reliable. I can't mount its casing but at least works I reflowed both IC with a hot air gun and liquid flux but no luck, maybe needs reballing. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.