Related
Hello All,
So here's the situation: I am trying to use my cheap virtually unbrickable tablet to learn more about kernel development and eventually ROM building.
I have extracted the manufacturers (WoPad) LiveSuit image and used split_bootimg.pl to break up the boot image.
I extracted the config file from the kernel image using extract-ikconfig and it created a config file. I didn't see the config in /proc.
So, I have the factory ramdisk and the factory kernel config.
I have downloaded several kernel sources (lichee-3.0.8, ChritianTroy's 3.0.36, and another one from linux-sunxi 3.0.72). I can successfully compile all of them without errors and they all generate zImages, uImages, etc using the factory config as well as the sun4i_crane configs they come with.
When I repack the boot.img with the newly created kernel and install it on nandc it wont' boot past the android icon (u-boot). I was hoping someone could shed light where I'm messing up. When I compare my boot.img to the factory one, they both have the same offset where the kernel starts (0x00000800). I have also ensured I'm replacing the kernel modules when I'm changing kernel versions.
Here is the line I'm using to repack the boot.img
Code:
mkbootimg --base 0x40000000 --pagesize 2048 --kernel zImage --ramdisk ramdisk-repack.cpio.gz --board sun4i --cmdline \"console=ttyS0,115200 rw init=/init loglevel=8\" -o boot.img
OR
mkbootimg --base 0x40000000 --pagesize 2048 --kernel bImage --ramdisk ramdisk-repack.cpio.gz --board sun4i --cmdline \"console=ttyS0,115200 rw init=/init loglevel=8\" -o boot.img
OR
mkbootimg --base 0x40000000 --pagesize 2048 --kernel uImage --ramdisk ramdisk-repack.cpio.gz --board sun4i --cmdline \"console=ttyS0,115200 rw init=/init loglevel=8\" -o boot.img
Any help will be appreciated. Also, I'm building on Ubuntu 13.04 with Google GCC 4.6 from the ndk. I have built kernels for other devices without issues. This one has me stumped.
Thanks
Here is an output from UART
Code:
CPU: SUNXI Family
Board: A10-EVB
DRAM: 512 MiB
NAND: 3800 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
--------fastboot partitions--------
-total partitions:9-
-name- -start- -size-
bootloader : 100000 1000000
env : 1100000 200000
boot : 1300000 2000000
system : 3300000 10000000
data : 13300000 40000000
misc : 53300000 100000
recovery : 53400000 2000000
cache : 55400000 8000000
UDISK : 5d400000 90400000
-----------------------------------
Hit any key to stop autoboot: 0
NAND read: device 0 offset 0x1300000, size 0x2000000
33554432 bytes read: OK
Starting kernel ...
Since I posted my question, I have managed to work my way through some errors but I'm stuck again. Now I'm having issues getting past init. It is stuck in a loop because of this:
Code:
<4>ft5x_ts: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
[ 8.740000] ft5x_ts: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
<6>init: command 'insmod' r=-1
[ 8.780000] init: command 'insmod' r=-1
<4>hv2605: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
[ 8.840000] hv2605: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
<6>init: command 'insmod' r=-1
[ 8.850000] init: command 'insmod' r=-1
<4>ump: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
[ 9.000000] ump: Unknown symbol _GLOBAL_OFFSET_TABLE_ (err 0)
<6>init: command 'insmod' r=-1
Again, if any kernel devs out there are reading this your assistance is appreciated.
I was able to solve this on my own too. Ended up being the tool chain I was using. I used 4.4.3 and all is well. Only bug I'm having is a WiFi driver issue now.
Sent from my YP-G70 using xda premium
rjwil1086 said:
I was able to solve this on my own too. Ended up being the tool chain I was using. I used 4.4.3 and all is well. Only bug I'm having is a WiFi driver issue now.
Sent from my YP-G70 using xda premium
Click to expand...
Click to collapse
dude i know its a bit late but can you walk me through your entire kernel compilation procedure starting by sharing the source and the tricks of booting the newly created kernel ?
Xperia Boot Menu v1.0
Disclaimer:
- Me (munjeni) is not responsible for anything related to the our project, you using our project on your own risk! If you no want to risk than don't play with Boot Menu! You can play with Boot Menu but on your own risk!
Feature:
- multiboot based on kexec
- posibility for defining: menu title, path to the kernel, path to the ramdisk, kernel cmdline
- posibility for defining max 10 menus
- autoreboot to the first kernel if menu is not moved (stop timer on menu move)
- graphic timer
Instructions:
- create folder "bootmenu", add settings.ini to these folder, modify settings.ini for your needs
- flash bootmenu using fastboot command (fastboot flash boot recovery.img)
- since internal sdcard is only supported by now, you can define only kernel and ramdisk from internal sdcard path! Make sure you define right path and make sure create folders in bootmenu on your internal sdcard
- make sure settings.ini is in internal sdcard in folder bootmenu!!!
- kexec can boot only kexec patched kernels, so your kernel need to have kexec patch!!! Complete kexec patch you can find on my git!
Simple settings.ini (example):
[rom-1]
menutitle=recovery touch white
kernel=/sdcard/bootmenu/examplerom/zImage
ramdisk=/sdcard/bootmenu/examplerom/initrd.gz
cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-2]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-3]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-4]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-5]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-6]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-7]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-8]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-9]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
# [rom-10]
# menutitle=recovery touch black
# kernel=/sdcard/bootmenu/zImage
# ramdisk=/sdcard/bootmenu/initrd.gz
# cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
Click to expand...
Click to collapse
Download:
- http://d-h.st/UXm
Kernel source code:
- https://github.com/munjeni/android_kernel_xperiago/tree/jb-dev
You're simply the best :beer: :beer: :beer:
Inviato dal mio Xperia U usando Tapatalk 4
Not sure if kexec working on Xperia U, I will post kernel, kernel modules, boot menu and my new CWM Touch Recovery v6.0.3.6 ramdisk for test.
Need your help, need output of the command:
adb shell cat /proc/iomem
Xperia U have 1gb ram???
Xperia Go by now have:
00000000-05ffffff : System RAM
0005e000-008fa4c7 : Kernel text
008fc000-00f2e797 : Kernel data
06000000-06efffff : db8500-trace-area
08000000-09ffffff : System RAM
0e800000-1fdfffff : System RAM
1fe00000-1fefffff : kexec_hardboot
1ffe0000-1fffffff : ram_console
40010000-400107ff : lcpa
40010000-400107ff : dma40 I/O lcpa
Click to expand...
Click to collapse
So I am not sure about X-U
munjeni said:
Not sure if kexec working on Xperia U, I will post kernel, kernel modules, boot menu and recovery ramdisk for test.
Need your help, need output of the command:
adb shell cat /proc/iomem
Xperia U have 1gb ram???
Xperia Go by now have:
So I am not sure about X-U
Click to expand...
Click to collapse
Xperia u have 512mb ram
Sent from my Xperia U using xda app-developers app
munjeni said:
Not sure if kexec working on Xperia U, I will post kernel, kernel modules, boot menu and recovery ramdisk for test.
Need your help, need output of the command:
adb shell cat /proc/iomem
Xperia U have 1gb ram???
Xperia Go by now have:
So I am not sure about X-U
Click to expand...
Click to collapse
Here's the output..
And no XU has only 512 mb of ram
Boot menu download link ready, please let me know if booting!
First of all create bootmenu folder inside your internal sdcard, create settings.ini file in bootmenu folder:
Code:
[rom-1]
menutitle=recovery touch white
kernel=/sdcard/bootmenu/examplerom/zImage
ramdisk=/sdcard/bootmenu/examplerom/initrd.gz
cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
Since cmdline settings is from Xperia Go please edit these line and add cmdline for Xperia U !!!
Than create "examplerom" folder in your bootmenu folder, put initrd.gz and zImage from attachment to the example rom folder, reboot to the fastboot and flash bootmenu:
fastboot flash boot recovery.img
Click to expand...
Click to collapse
Reboot and let me know if working!
AD9295 said:
Here's the output..
And no XU has only 512 mb of ram
Click to expand...
Click to collapse
Thanks, so kexec will working I am sure Enjoy guys!
For example if you want to boot your android rom, simple extract ramdisk from boot image, create new folder in bootmenu folder for example my_stock_rom, add [rom-2 settings lines for your new rom, modify path to "my_stock_rom", use zImage from cwm.rar, use modules from cwm.rar and put into your android /system/lib/modules folder... new menu will apear in boot menu... etc Note: autoreboot is automatically set to the [rom-1] (first menu) so if you want to automatically boot "my_stock_rom" simple move them to the top of the settings.ini ... Enjoy!!!
munjeni said:
Boot menu download link ready, please let me know if booting!
First of all create bootmenu folder inside your internal sdcard, create settings.ini file in bootmenu folder:
Code:
[rom-1]
menutitle=recovery touch white
kernel=/sdcard/bootmenu/examplerom/zImage
ramdisk=/sdcard/bootmenu/examplerom/initrd.gz
cmdline=cachepolicy=writealloc noinitrd init=init board_id=1 logo.nologo root=/dev/ram0 rw rootwait console=null androidboot.console=null androidboot.hardware=st-ericsson [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] mpcore_wdt.mpcore_margin=359 end lpj=24019
Since cmdline settings is from Xperia Go please edit these line and add cmdline for Xperia U !!!
Than create "examplerom" folder in your bootmenu folder, put initrd.gz and zImage from attachment to the example rom folder, reboot to the fastboot and flash bootmenu:
Reboot and let me know if working! If not working please give me output of the command "adb shell cat /proc/iomem"
Click to expand...
Click to collapse
I would like to help but I dont know hot add and modify settings.ini..
Edit: I learnt how to do that.. will post results when I get back from college.. Sorry but i have to attend today..
Another example:
Since I not sucesfully booted android from sdcard, we need to prepare ramdisk of the future sdcard rom boot, modify them to use partitions from sdcard instead of using partitions from emmc!!! Need help for them!!!
So example is:
kexec cwm which have modified partitions table (sdcard partitions) -> load them into bootmenu -> boot them -> since these cwm will load sdcard partitions we can install an rom.zip regulary to these partitions using these cwm (cwm will install android to these sdcard partition) -> rom.zip updater-script need allso modification because we need to edit for example all lines which contain for example /dev/block/mmcblk0p** and change for example to the /dev/block/loop**
Ramdisk cwm or rom need allso reparation -> /dev/block/mmcblk0p** need changes to the /dev/block/loop** since for sdcard boot we need to mount system,data,cache partitions to the /dev/loop devices.
ETC...BLABLA Thats all we need for multiboot!!!
AD9295 said:
I would like to help but I dont know hot add and modify settings.ini..
Edit: I learnt how to do that.. will post results when I get back from college.. Sorry but i have to attend today..
Click to expand...
Click to collapse
No problem mate, I am sure most experienced users will help and get them working, and post the results Good thing is we have boot menu and kexec working, so all other things will come soon, I am sure
Waiting your creations and modifications. Want to see message "sucesfully booted rom from sdcard" :laugh: First of all waiting confirmation about working Boot Menu v1.0 in Xperia U !
munjeni said:
No problem mate, I am sure most experienced users will help and get them working, and post the results Good thing is we have boot menu and kexec working, so all other things will come soon, I am sure
Waiting your creations and modifications. Want to see message "sucesfully booted rom from sdcard" :laugh: First of all waiting confirmation about working Boot Menu v1.0 in Xperia U !
Click to expand...
Click to collapse
How can I modify sdcard since its emmc,I dont understand.
How to create partitions on it for system,data,cache or this supports kernels only?
XperianPro said:
How can I modify sdcard since its emmc,I dont understand.
How to create partitions on it?
Click to expand...
Click to collapse
You no need to modify emmc! Simple create file based ext4 partition and mount them on boot time to the loop device For get these to work you need to modify ramdisk, fstab...etc of the rom
munjeni said:
Not sure if kexec working on Xperia U, I will post kernel, kernel modules, boot menu and my new CWM Touch Recovery v6.0.3.6 ramdisk for test.
Need your help, need output of the command:
adb shell cat /proc/iomem
Xperia U have 1gb ram???
Xperia Go by now have:
So I am not sure about X-U
Click to expand...
Click to collapse
i know this is too noob but does xperia go have 1 gb ram?isnt it 512m?
can i flash the attached recovery.img in an unlocked xperia u running ics??
bibhu059 said:
can i flash the attached recovery.img in an unlocked xperia u running ics??
Click to expand...
Click to collapse
No, only JB !
chessmanyaki said:
i know this is too noob but does xperia go have 1 gb ram?isnt it 512m?
Click to expand...
Click to collapse
have 512 !
Guys, found a bug in Boot Menu! For example shifting trought menu failed to select right thing, for examle it select an submenu but boot another rom ...I will fix them in next version! You ca duplicate menus and experiment by now
munjeni said:
Guys, found a bug in Boot Menu! For example shifting trought menu failed to select right thing, for examle it select an submenu but boot another rom ...I will fix them in next version! You ca duplicate menus and experiment by now
Click to expand...
Click to collapse
I've got to say I'm really impressed anytimes you release/post something, many thanks for your progress
I guess that, at first look, it is not working for locked bootloader, but it seems your recovery handles the boot menu and kexec thing : would it be possible to port your recovery to our locked bootloader "a la" atis' patch ? I guess we won't be able to straight boot your recovery because of its' kernel, but would it be portable to ICS kernel&codes to, lets say => load your recovery by loading ramdisk like atis', then kexec to an unsigned kernel ?
edit: partially answered myself: we need to enable kexec support therefore I guess "official kernels" don't =/
Sympnotic said:
I've got to say I'm really impressed anytimes you release/post something, many thanks for your progress
I guess that, at first look, it is not working for locked bootloader, but it seems your recovery handles the boot menu and kexec thing : would it be possible to port your recovery to our locked bootloader "a la" atis' patch ? I guess we won't be able to straight boot your recovery because of its' kernel, but would it be portable to ICS kernel&codes to, lets say => load your recovery by loading ramdisk like atis', then kexec to an unsigned kernel ?
edit: partially answered myself: we need to enable kexec support therefore I guess "official kernels" don't =/
Click to expand...
Click to collapse
Stock kernel doesn't support it. He has said it earlier himself
Yup, I read too fast, was excited about this post and I've used to read "kexec could be our way out of locked bootloader" (@Xperianpro, some of his posts)
Anyone knows if an official kernel had kexec support in the past ? Even if it's GB *not really hoping*
cat cmdline with my mobile phone
Display
Console=ram loglevel=4 sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.debug_level=0x4f4c [email protected] s3cfb.bootloaderfb=0x67000000 lcdtype=4358215 consoleblank=0 lpcharge=0 lpj=3977216 vmalloc=384m oops=panic pmic_info=53 cordon= 0653ef15a4c428c90f5475ff4ea5b4f0 connie=SCH-I959_CTC_CHN_327f22b16468ca830ca01968a36fb3ad androidboot.emmc_checksum=3 androidboot.odin_download=1 androidboot.bootloader=I959KEUBMG2 androidboot.serialno=4d006707773d4071 snd_soc_core.pmdown_time=1000
BoardConfig.mk
The kernel configuration
BOARD_KERNEL_BASE: = 0x10000000
BOARD_KERNEL_PAGESIZE: = 2048
BOARD_KERNEL_CMDLINE: = console=ttySAC2115200n8 vmalloc=512M androidboot.console=ttySAC2
IS boardConfig.mk not configured incorrectly? so core do not start up.
Can samsung bootloader check the boot.img CSC?
Check this out: http://docs.kali.org/armel-armhf/kali-linux-on-galaxy-note
I looked over the recovery and thought it looked ok (though thats an area i usually leave to pros), and attempted to make a x86 image so altering
Code:
dd if=/dev/block/mmcblk0p6 of=recovery.img_orig
and
dd if=recovery.img of=/dev/block/mmcblk0p6
and inputting this
Code:
dd if=/dev/block/mmcblk0p11 of=recovery.img_orig
and
dd if=recovery.img of=/dev/block/mmcblk0p11
then I rebooted and it hung up at the samsung galaxy tab 3 screen
How hard would it be to rewrite the recovery image linked to there to work on our device. Or if its in good shape I guess i screwed up making my x86 image of Kali any input of on either subject would be appreciated.
Had an idea as soon as I reflash and reroot and download a couple more files and reboot and finish updating this laptop I'm working on, ill try to break my gtab again
You can't. Those versions of Kali is for ARM (armel = ARM soft-float / armhf = ARM hard-float), while the GTab3 10.1. is x86.
But you should be able to modify any x86 (tablet-)linux for use with GTab3 10.1
Setialpha said:
You can't. Those versions of Kali is for ARM (armel = ARM soft-float / armhf = ARM hard-float), while the GTab3 10.1. is x86.
But you should be able to modify any x86 (tablet-)linux for use with GTab3 10.1
Click to expand...
Click to collapse
So you obviously didn't read the whole post.
I know the note 10.1 is arm and the gtab 10.1 is x86 I attempted to make a .img from the x86 live disc which obviously failed
I really just wanted someone to glance over the recovery.img and say with better authority than me if Offensive Security's recovery img needed anything.
However i will take your advise and toy around with some other distros that are x86 tablet ready in conjunction with that recovery. It only takes 5 min to reflash anyway.
hey
xkwr27 said:
So you obviously didn't read the whole post.
I know the note 10.1 is arm and the gtab 10.1 is x86 I attempted to make a .img from the x86 live disc which obviously failed
I really just wanted someone to glance over the recovery.img and say with better authority than me if Offensive Security's recovery img needed anything.
However i will take your advise and toy around with some other distros that are x86 tablet ready in conjunction with that recovery. It only takes 5 min to reflash anyway.
Click to expand...
Click to collapse
are you still up for this ?
i tried the same thing, i also tried swapping out the zimage from the kali recovery with p5210 stock
then changed any mmcblk refs i found in the init and instead of screen hang got it reboot, [over and over]
but didn't catch. this is totally doable and i wish i'd found this thread before starting another on the same subject.
but anyway i could go on forever.....we need to recruit people somehow... i would like a setup on this
tab so i could distro hop like i used to on pc :good:
Yes I'm still down for this, I've been so busy with work, and keeping my car running(done with the car now, motor/Trans rebuild) since my last post. Now I have my days off if not totally free free enough to put a few hours into this on my days off. I also know 2 people who could help if I can convince them one a relative with a name in the security industry and the other a relatively new guy to all things computer but with a knack for finding fixes that will be a help but for tonight I'm going to compare the two recoveries side by side during break and take notes. Then tomorrow I am going to see if I can put those notes to good use after I get back from taking my daughter and wife blackberry picking on my father's land.i figure I'll start on it noonish us central time and keep you updated...
xkwr27 said:
Yes I'm still down for this, I've been so busy with work, and keeping my car running(done with the car now, motor/Trans rebuild) since my last post. Now I have my days off if not totally free free enough to put a few hours into this on my days off. I also know 2 people who could help if I can convince them one a relative with a name in the security industry and the other a relatively new guy to all things computer but with a knack for finding fixes that will be a help but for tonight I'm going to compare the two recoveries side by side during break and take notes. Then tomorrow I am going to see if I can put those notes to good use after I get back from taking my daughter and wife blackberry picking on my father's land.i figure I'll start on it noonish us central time and keep you updated...
Click to expand...
Click to collapse
good deal, okay noob warning, but gleefully brick happy tester here.
right now i on the samsung open source site looking p5210 but not sure which
git-hub isn't an option for me as my surviving pc is a bit screwy but i still want to see the source
and try to get what the devs are saying, anyway i'm glad to hear from you
just thought i'd let you in on what i'm up to. hope to get something working.
:good:
do i need to get ubuntu 64bit for kernel stuff?
If you plan to tear into the recovery.img you'll need linux I use debian or debian based distro's, but ubuntu will work just fine.
https://01.org/android-ia
Not sure if this site will help but i'll post it anyways
I'll keep trying to post useful stuff
http://forum.xda-developers.com/showthread.php?t=1916936
Hope this helps somehow
Can we not change the partitions to whatever sizes we want using ODIN and .pit files ? if yes then we can do ANYTHING
Excercise caution. This MAY have the pit file for our device
http://forum.xda-developers.com/showthread.php?t=2526119
hey
Nitro_123 said:
https://01.org/android-ia
Not sure if this site will help but i'll post it anyways
I'll keep trying to post useful stuff
http://forum.xda-developers.com/showthread.php?t=1916936
Hope this helps somehow
Can we not change the partitions to whatever sizes we want using ODIN and .pit files ? if yes then we can do ANYTHING
Excercise caution. This MAY have the pit file for our device
http://forum.xda-developers.com/showthread.php?t=2526119
Click to expand...
Click to collapse
cool :good: reading:good:
as for repartitiong hold off for now but, read this anyway,
copy every command you see and keep in organized file for reference
http://forum.xda-developers.com/showthread.php?t=1388996
this command in term should pull pit file [get it right,check,double,check,triple check] must su first i believe
dd if=/dev/block/mmcblk0 of=/sdcard/out.pit bs=8 count=481 skip=2176
to xkwr27 hi, you're comparing with stock recovery right?
In terms of custom bootloaders we could install grub onto the device. but first we need to figure out the boot order.
http://forum.xda-developers.com/showthread.php?t=1018862 This thread is an amazing thread for samsung related stuff but kind of off topic for us.
Is there any way of figuring out the way the device boots ?
Sorry for stressing boot order and stuff so much but I really think it's the key to everything.
If we install GRUB after that everything else will be a piece of cake.
http://www.gnu.org/software/grub/
hey
Nitro_123 said:
In terms of custom bootloaders we could install grub onto the device. but first we need to figure out the boot order.
http://forum.xda-developers.com/showthread.php?t=1018862 This thread is an amazing thread for samsung related stuff but kind of off topic for us.
Is there any way of figuring out the way the device boots ?
Sorry for stressing boot order and stuff so much but I really think it's the key to everything.
If we install GRUB after that everything else will be a piece of cake.
http://www.gnu.org/software/grub/
Click to expand...
Click to collapse
the boot sequence is more where my thinking is going to.
my understanding is there are three stages , power on the boot loader does it's work, the kernel get's up and lays out the ramdrive and hardware
and get's the usual/basic/expected linux stuff going [yes, linux is already present,a form of it anyway] and finally, the android user space stuff.
altering something in the process to halt/bypass that last stage and get to , for now at least, a command prompt is the thought.
the hardware hacking looks really neat and is a good find as far as gaining insight on the basic boot process so thank you for
pointing me to it. having no up to speed modern pc i'm left to do what i can on my tab and can't risk it. but i DID find a
a kernel/boot img pack/repack/editing setup that i'm already using on my tab!!!
the link is http://forum.xda-developers.com/showthread.php?t=2073775
read the op then go to my post on the last page.
grub would be sweet though, wouldn't it ?
round one
okay this is what i did today
swapped busybox [arm] for [x86]
added parted in bin
replaced symlink named mtab==>/proc/self/mounts with actual file
corrected [?] mmcblk,loop references in hooks/looproot
changed this in init to experiment [attempt to return to android if fail,] marked edit and commented
if [ "$(stat -c %D /)" = "$(stat -c %D /new_root)" ]; then
#if [ "$(stat -c %D /)" = "$(stat -c %D /new_root)" ]; then
# Nothing got mounted on /new_root. This is the end, we don't know what to do anymore
# We fall back into a shell, but the shell has now PID 1
# This way, manual recovery is still possible.
init=/init
# err "Failed to mount the real root device." [edit]
# echo "Bailing out, you are on your own. Good luck." [edit]
# echo [edit]
# launch_interactive_shell --exec [edit]
elif [ ! -x "/new_root${init}" ]; then
# Successfully mounted /new_root, but ${init} is missing
# The same logic as above applies
err "Root device mounted successfully, but ${init} does not exist."
echo "Bailing out, you are on your own. Good luck."
echo
launch_interactive_shell --exec
fi
swapped zimage [from stock reco]
added modules [from stock reco]
result=fail, continuous reboot, re-odin recovery
try again tomorrow [yawn] uploaded experiment, contains .img ramdisk.gz and zimage
okay upload fail, i'll try again tomorrow grrrr.
moonbutt74 said:
okay this is what i did today
swapped busybox [arm] for [x86]
added parted in bin
replaced symlink named mtab==>/proc/self/mounts with actual file
corrected [?] mmcblk,loop references in hooks/looproot
changed this in init to experiment [attempt to return to android if fail,] marked edit and commented
if [ "$(stat -c %D /)" = "$(stat -c %D /new_root)" ]; then
#if [ "$(stat -c %D /)" = "$(stat -c %D /new_root)" ]; then
# Nothing got mounted on /new_root. This is the end, we don't know what to do anymore
# We fall back into a shell, but the shell has now PID 1
# This way, manual recovery is still possible.
init=/init
# err "Failed to mount the real root device." [edit]
# echo "Bailing out, you are on your own. Good luck." [edit]
# echo [edit]
# launch_interactive_shell --exec [edit]
elif [ ! -x "/new_root${init}" ]; then
# Successfully mounted /new_root, but ${init} is missing
# The same logic as above applies
err "Root device mounted successfully, but ${init} does not exist."
echo "Bailing out, you are on your own. Good luck."
echo
launch_interactive_shell --exec
fi
swapped zimage [from stock reco]
added modules [from stock reco]
result=fail, continuous reboot, re-odin recovery
try again tomorrow [yawn] uploaded experiment, contains .img ramdisk.gz and zimage
okay upload fail, i'll try again tomorrow grrrr.
Click to expand...
Click to collapse
hahaha i wish you good luck
thanks
FurFur_ said:
hahaha i wish you good luck
Click to expand...
Click to collapse
i've been through roughly 17 different experiments by now
but i'm too stupid to quit so we'll see :laugh:
---------- Post added at 10:46 PM ---------- Previous post was at 10:38 PM ----------
xkwr27 said:
So you obviously didn't read the whole post.
I know the note 10.1 is arm and the gtab 10.1 is x86 I attempted to make a .img from the x86 live disc which obviously failed
I really just wanted someone to glance over the recovery.img and say with better authority than me if Offensive Security's recovery img needed anything.
However i will take your advise and toy around with some other distros that are x86 tablet ready in conjunction with that recovery. It only takes 5 min to reflash anyway.
Click to expand...
Click to collapse
so if i'm understanding this right the samsung bootloader [which we don't mess with....snicker]
is initiating the command which grabs the kernel and get's things rolling..?
even if i'm not right in the init.rc scripting language is there a means to repeat that process ===> initramfs,bzimage ?
Ok the 3 key combos tell the tablet what to do 1 is power only boots normal 2 is power + volume up boots recovery 3 is power + volume down boots to download mode (odin)... what offensive security did was rewrite the recovery.img so that instead of launching you to the normal recovery all it does is tells the tab to boot the kali img in /SdCard/ so if you just power up with combo 1 it should still boot normal and 3 should still put you in odin mode but 2 will tell the tab to boot kali instead so all we should need is busybox maybe , a x86 kali img and a recovery img similar to the offensive security one. That is why I'm working to pick this recovery.img apart.
hey
i flashed the image as is first ; mmcblk's dont matchup in hook/looproot ; corrected[?] them no dice
aside from zimage&module&busybox mixing and matching
i think something with the hooks is the stumper
this is the ramdisk, i wasn't sure if you were asking or me to crack the image open or not,
i was hoping you might have a handle on kernel command lines.
if it comes to kernel building/compiling i'm boned:crying:
if there's something you want me to try or test let me know. :good:
kernel command
no_console_suspend=1 console=null
xkwr27 said:
Ok the 3 key combos tell the tablet what to do 1 is power only boots normal 2 is power + volume up boots recovery 3 is power + volume down boots to download mode (odin)... what offensive security did was rewrite the recovery.img so that instead of launching you to the normal recovery all it does is tells the tab to boot the kali img in /SdCard/ so if you just power up with combo 1 it should still boot normal and 3 should still put you in odin mode but 2 will tell the tab to boot kali instead so all we should need is busybox maybe , a x86 kali img and a recovery img similar to the offensive security one. That is why I'm working to pick this recovery.img apart.
Click to expand...
Click to collapse
Mate that sounds very good I'm so busy with life nowadays Final year of school I don't know too much and I can't learn anything cause I have literally no time
I won't be posting too often Good luck with your project. Eager to see some success :fingers-crossed::good:
Santos10 Bootloader trace:
Code:
IA32 CPU Firmware
Copyright (C) 1999-2013, Intel Corporation. All rights reserved.
7[0;23r[24;75H[1K[24;1H[1mIntel(R) Atom(TM) Z2560 CPU FW 00.73 (INTELFDK)[0m8------------------------------>FOR Teewinot ONLY<-----------------------------
******************************************************************************
************** Customer release based on Rel 00.49 + TWN changes**************
**************** BZ=115220 Bypass time/date check for product ****************
****************** BZ=118523 Cold Reset on ExecuteOS failure *****************
****** BZ=124478[TW 346-500-676] Request for logging enhancement in IAFW *****
************* BZ=127192 Disable Active Refresh during JEDEC Init *************
******************* BZ=none include ucode patch M013065110E ******************
**************************** New in this code drop ***************************
***** BZ=none Changed trace to match TWN RAMDUMP application requirement *****
*************** BZ=none Removed UART and PTI HW output methods ***************
******** Short circuiting the emInit when a fixed battery is detected. *******
********************* Customization done 201308261512 MST ********************
******************************************************************************
[37;41m******************************INTEL CONFIDENTIAL******************************
[0m
0x1E, 0x20, 0x21,
ERROR:::::SPID Not Programmed, Fake data being used based on IFWI version
ERROR:::::SPID FRU Not Programmed, Fake data being used based on IFWI version
OSC_CLK3 defaults only
0x22,
OEM board; Skip spidBasedPanelNdxUpdate
0x23,
Forced Battery via SMIP FPO Bit 2
0x28, 0x2A, 0x2B, in csSFIDevsEntries, HW Id 0x0019
SFI Dev...PR3
in csSFIGpioEntries, HW Id 0x0019
SFIOEMBInit:tbl->spidTbl update
0x2C, 0x2D, 0x2F PostCodes Done
IA32 FW: CPU v000.073/00.49; SUPP v000.073/00.49; VH: 000.081/00.51
IA Timestamp: 2013.08.26:18.00 (INTELFDK)
SCU FW: ROM 177.000/B1.00; RT 033.046/21.2E
PUNIT FW: v160.064/A0.40
IFWI: v249.086/F9.56
PL: 0000010E
Config & PCB: OEM Platform, C, CLV+ B1, Samsung (01,00) SR 4Gb 1067 1GB
FHOB DW0/DW1: 00000104:00010140
I2C Expander: FFFFFFFC:0000000F
IA Options: 024020A1:00000000:03E00000:80005C00:00000101;1264
[OS HASH VERIFY] [EIST] [eMMC] [VALID BATT][WDT]
Loading OS...
pOsip = 1000000
-->OSIP verified
00000000 E0000000
[COLOR="Red"]Android COS path taken
E0000000 D303000A[/COLOR]
[COLOR="red"]Boot path override selected OS image 0[/COLOR] (OS Attribute 0x00, Reboot Reason 0x0A)
D303000A D303000A
Splash disabled in GCT
Splash display time: 2 ms
[COLOR="red"]-->Bootable OS image 0 found for requested type 2 [/COLOR](OSII attribute 0x00)
-->[COLOR="red"]Loading OS image 0 from eMMC block 0x00000032 to DRAM address 0x010FFE20[/COLOR]
-->Starting transfer of 0xA11 512-byte blocks to DRAM
-->Done loading OS Image to DRAM
-->platformConfigBuffer_pt.scuFhobDw0.osven != 0
-->osIndex: 0, Signed Image
OS image 0 PASSED verify
Booting COS
*********************************
Starting command line:
-init=/init pci=noearly console=ttyMFD2 console=ttyS0 console=logk0 earlyprintk=nologger loglevel=8 hsu_dma=7 kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=ctp_pr1 emmc_ipanic.ipanic_part_number=1 ip=50.0.0.2:50.0.0.1::255.255.255.0::usb0:on hsu_rx_wa g_android.fastboot=1 droidboot.scratch=100
-
OSNIB.wakesrc = 0x3
OSNIB.RR = 0xA
Battery is high enough for normal boot
4166mV > 0mV
Ending command line:
-init=/init pci=noearly console=ttyMFD2 console=ttyS0 console=logk0 earlyprintk=nologger loglevel=8 hsu_dma=7 kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=ctp_pr1 emmc_ipanic.ipanic_part_number=1 ip=50.0.0.2:50.0.0.1::255.255.255.0::usb0:on hsu_rx_wa g_android.fastboot=1 droidboot.scratch=100 androidboot.wakesrc=03 androidboot.mode=charger-
*********************************
WDT aka Timer7 setup
Warn Duration for Timer7: 00 seconds
Start Timer7 bit 0 -> 1: 00000000000000000000000000000000
[0;24r[24;1H[2KM
Calling OS entry point --> 0x01101000 ...
Using NEW OSHOB structure size = 176 bytes
OSNIB size = 32 bytes OEMNIB size = 64 bytes
0xFF00_0510 FullChipRegister: Status flag = 0x0
0xFF10_0510 SCFabricRegister: Status flag = 0x0
Watchdog Disabled!
usb is connected, skip to set uart path
__stmpe811_write : fail
MUIC: CONTROL1:0x00
MUIC: CONTROL1:0x00
MUIC: CONTROL2:0x3b
MUIC: CONTROL2:0x3b
[SCU_IPC_DEBUG] board ID: NOT_IDENTIFIED(8)
VERSION : 0xa501
mmc_read_ext_csd : ext_csd_rev = 0x7
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
!!!Enter 8 Bit mode.!!!
clt_mmc_init: mmc->capacity = 0x1d56000
[BOOT] RESETIRQ1=0x00 RESETIRQ2=0x00 (interrupt tree)
[BOOT] SCU_TR=0x00020013 IA_TR=0xffffffff (oshob)
[BOOT] RR=0x00 WD=0x00 ALARM=0x00 (osnib)
[BOOT] WAKESRC=0x03 RESETIRQ1=0x20 RESETIRQ2=0x00 (osnib)
Samsung S-Boot 4.0-1816966 for GT-P5200 (Nov 26 2013 - 01:43:08)
CLT(EVT 0.0) / 1024MB / 15020MB / Rev 8 / P5200XXUAMK8
pit_check_signature (PIT) valid.
initialize_ddi_data: usable! (159:0xc)
PARAM ENV VERSION: v1.0..
pressed_key = 0x1
clt_charger_init : [battery] using external charger init(3)
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
[check_cable_type] : Output of USB Charger Detection 3
[max77693_init_charger] : attached device(0x02) : TA
clt_max77693_set_charger_state: chg_cnfg_02 (0x1f) -> (0x1f) -> (0x1f)
clt_max77693_set_charger_state: chg_cnfg_03 (0x00) -> (0x00) -> (0x00)
clt_max77693_set_charger_state: chg_cnfg_04 (0xdd) -> (0xdd) -> (0xdd)
clt_max77693_set_charger_state: chg_cnfg_09 (0x64) -> (0x64) -> (0x64)
set_charger_state : buck(1), chg(0), reg(0x04)
init_fuel_gauge: Start!!
[0] get_adc_battid() = 92
[1] get_adc_battid() = 92
[2] get_adc_battid() = 92
get_adc_battid() = 92
init_fuel_gauge: Battery type : SDI
init_fuel_gauge: Already initialized (0x32cd, SDI type)
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
fuel_gauge_compensate_soc: Start!!
fuel_gauge_read_soc: SOC(73), data(0x491b)
fuel_gauge_read_vcell: VCELL(4071), data(0xcb92)
calculate_table_soc: Get table SOC in case of charging!!
calculate_table_soc: i(1), vcell(4071), table_soc(88)
differ(15), table_soc(88), RepSOC(73)
clt_charger_init : cable_type(0x02)
set_charger_state : buck(1), chg(1), reg(0x05)
intel_scu_ipc_cmd_oemnib : done => 0x0
check_reboot_cmd: nCmd = 0 ... skip check_reboot_cmd
debug level = 0x4f4c
disable max77693 manual reset
clt_max77693_disable_manual_reset: set max77693 MANCTRL1 val = 0x4
clt_max77693_disable_manual_reset: read max77693 MANCTRL1 val = 0x4
disable PMIC cod off triggered by PWRBTN#: 6
do_keypad: 0x1
intel_scu_ipc_cmd_oemnib : done => 0x0
check_download: 0
Is_lpm_boot : boot-mode saved in param = 0
Is_lpm_boot : jig-on level = 0, ignore...
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
stat=0x1031f, adc=0x1f, chg=0x3, vbvolt=1, pinLevel=1
fuel_gauge_read_vcell: VCELL(4071), data(0xcb92)
fuel_gauge_read_soc: SOC(73), data(0x491b)
check_low_battery : rb=0 jig=0
check_low_battery : v=4071 soc=73
skip check low battery
scr_draw_image: draw 'logo.jpg'...
read 'logo.jpg'(105420) completed.
<start_checksum:355>CHECKSUM_HEADER_SECTOR :4096
<start_checksum:357>offset:6144, size:6296
<start_checksum:361>CHECKSUM_HEADER_INFO : NeedChecksum:0 PartNo:27
Not Need Movinand Checksum
Movinand Checksum Confirmation Pass
load_kernel: loading boot image from 106496..
total size : 8495104
pit_check_signature (BOOT) valid.
Set valid sign flag
if_ddi_data: succeeded. (159:0xc)
BOOT_MAGIC == ANDROID!
CMDLINE LENGTH = 538
CMDLINE = init=/init console=sec_log_buf kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=santos103g sec_debug.level=0 loglevel=0 androidboot.debug_level=0x4f4c vmalloc=256m [email protected] sec_bootfb=0x3f000000 lcd_panel_id=0 androidboot.revision=8 switch_sel=3 cordon=615d013e557994c8ad53b3325c31b124 connie=GT-P5200_OPEN_EUR_cf878c59e3c2eeb1cdb40863938b834d androidboot.emmc_checksum=3 androidboot.bootloader=P5200XXUAMK8 androidboot.serialno=4300b61fdc125000 snd_soc_core.pmdown_time=1000 jig=0
Bootstub: map SFI MMAP to e820 table
add mmap: 0x00000000 0x00098000 1
add mmap: 0x00100000 0x00580000 2
add mmap: 0x00680000 0x00680000 1
add mmap: 0x00d00000 0x00300000 2
add mmap: 0x01000000 0x35ff0000 1
add mmap: 0x36ff0000 0x0090d000 2
add mmap: 0x378fd400 0x00100000 2
add mmap: 0x379fd400 0x02602000 1
add mmap: 0x3a000000 0x02200000 2
add mmap: 0x3c200000 0x02d00000 1
add mmap: 0x3ef00000 0x00100000 2
add mmap: 0x3f000000 0x01000000 2
add mmap: 0xfec00000 0x00001000 2
add mmap: 0xfee00000 0x00001000 2
add mmap: 0xff000000 0x01000000 2
IMR6 start=0x3a000000 end=0x3c1fffff
new mmap: 0x3a000000 0x02200000 2
IMR7 start=0x00100000 end=0x0067ffff
new mmap: 0x00100000 0x00580000 2
Final E820 table:
e820: 0x00000000 0x00098000 1
e820: 0x00100000 0x00580000 2
e820: 0x00680000 0x00680000 1
e820: 0x00d00000 0x00300000 2
e820: 0x01000000 0x35ff0000 1
e820: 0x36ff0000 0x0090d000 2
e820: 0x378fd400 0x00100000 2
e820: 0x379fd400 0x02602000 1
e820: 0x3a000000 0x02200000 2
e820: 0x3c200000 0x02d00000 1
e820: 0x3ef00000 0x00100000 2
e820: 0x3f000000 0x01000000 2
e820: 0xfec00000 0x00001000 2
e820: 0xfee00000 0x00001000 2
e820: 0xff000000 0x01000000 2
Final mb_mmap table:
mb_mmap: 0x00000000 0x00098000 1
mb_mmap: 0x00100000 0x00580000 0
mb_mmap: 0x00680000 0x00680000 1
mb_mmap: 0x00d00000 0x00300000 0
mb_mmap: 0x01000000 0x35ff0000 1
mb_mmap: 0x36ff0000 0x0090d000 0
mb_mmap: 0x378fd400 0x00100000 0
mb_mmap: 0x379fd400 0x02602000 1
mb_mmap: 0x3a000000 0x02200000 0
mb_mmap: 0x3c200000 0x02d00000 1
mb_mmap: 0x3ef00000 0x00100000 0
mb_mmap: 0x3f000000 0x01000000 0
mb_mmap: 0xfec00000 0x00001000 0
mb_mmap: 0xfee00000 0x00001000 0
mb_mmap: 0xff000000 0x01000000 0
Using bzImage to boot
Relocating initramfs to high memory ...
usb is connected, skip to set uart path
0xFF00_0510 FullChipRegister: Status flag = 0x0
0xFF10_0510 SCFabricRegister: Status flag = 0x0
Jump to kernel 32bit entry ...0x05003c00
I check interesting rows by red color. But there is easy way: need to compile x86 binaries and inject some code to twrp recovery. After that Linux OS must load from any img or partition on internal or external SD. Manual for coding this: link. This method accept to boot any second linux-based OS from any defined partition. It's on Russian - use translator to read.
Santos10 partiton table:
Code:
major minor #blocks name
7 0 61362 loop0
7 1 7308 loop1
179 0 15380480 mmcblk0
179 1 3072 mmcblk0p1
179 2 20480 mmcblk0p2
179 3 16384 mmcblk0p3
179 4 2048 mmcblk0p4
179 5 2048 mmcblk0p5
179 6 358400 mmcblk0p6
179 7 4096 mmcblk0p7
179 8 2416640 mmcblk0p8
179 9 12337152 mmcblk0p9
259 0 20480 mmcblk0p10
259 1 20480 mmcblk0p11
259 2 20480 mmcblk0p12
259 3 102400 mmcblk0p13
259 4 4096 mmcblk0p14
259 5 4096 mmcblk0p15
259 6 4096 mmcblk0p16
259 7 12288 mmcblk0p17
259 8 2048 mmcblk0p18
259 9 2048 mmcblk0p19
259 10 1024 mmcblk0p20
259 11 8192 mmcblk0p21
179 40 8192 mmcblk0gp0
179 30 1 mmcblk0rpmb
[COLOR="Red"]179 20 4096 mmcblk0boot1[/COLOR]
[COLOR="red"]179 10 4096 mmcblk0boot0[/COLOR]
252 0 307200 zram0
179 50 1955840 mmcblk1
179 51 1954816 mmcblk1p1
253 0 61362 dm-0
253 1 7308 dm-1]
Look at the red text i marked. I think we already have dual boot bootloader by Samsung.
Angel_666 said:
Santos10 Bootloader trace:
Code:
IA32 CPU Firmware
Copyright (C) 1999-2013, Intel Corporation. All rights reserved.
7[0;23r[24;75H[1K[24;1H[1mIntel(R) Atom(TM) Z2560 CPU FW 00.73 (INTELFDK)[0m8------------------------------>FOR Teewinot ONLY<-----------------------------
******************************************************************************
************** Customer release based on Rel 00.49 + TWN changes**************
**************** BZ=115220 Bypass time/date check for product ****************
****************** BZ=118523 Cold Reset on ExecuteOS failure *****************
****** BZ=124478[TW 346-500-676] Request for logging enhancement in IAFW *****
************* BZ=127192 Disable Active Refresh during JEDEC Init *************
******************* BZ=none include ucode patch M013065110E ******************
**************************** New in this code drop ***************************
***** BZ=none Changed trace to match TWN RAMDUMP application requirement *****
*************** BZ=none Removed UART and PTI HW output methods ***************
******** Short circuiting the emInit when a fixed battery is detected. *******
********************* Customization done 201308261512 MST ********************
******************************************************************************
[37;41m******************************INTEL CONFIDENTIAL******************************
[0m
0x1E, 0x20, 0x21,
ERROR:::::SPID Not Programmed, Fake data being used based on IFWI version
ERROR:::::SPID FRU Not Programmed, Fake data being used based on IFWI version
OSC_CLK3 defaults only
0x22,
OEM board; Skip spidBasedPanelNdxUpdate
0x23,
Forced Battery via SMIP FPO Bit 2
0x28, 0x2A, 0x2B, in csSFIDevsEntries, HW Id 0x0019
SFI Dev...PR3
in csSFIGpioEntries, HW Id 0x0019
SFIOEMBInit:tbl->spidTbl update
0x2C, 0x2D, 0x2F PostCodes Done
IA32 FW: CPU v000.073/00.49; SUPP v000.073/00.49; VH: 000.081/00.51
IA Timestamp: 2013.08.26:18.00 (INTELFDK)
SCU FW: ROM 177.000/B1.00; RT 033.046/21.2E
PUNIT FW: v160.064/A0.40
IFWI: v249.086/F9.56
PL: 0000010E
Config & PCB: OEM Platform, C, CLV+ B1, Samsung (01,00) SR 4Gb 1067 1GB
FHOB DW0/DW1: 00000104:00010140
I2C Expander: FFFFFFFC:0000000F
IA Options: 024020A1:00000000:03E00000:80005C00:00000101;1264
[OS HASH VERIFY] [EIST] [eMMC] [VALID BATT][WDT]
Loading OS...
pOsip = 1000000
-->OSIP verified
00000000 E0000000
[COLOR="Red"]Android COS path taken
E0000000 D303000A[/COLOR]
[COLOR="red"]Boot path override selected OS image 0[/COLOR] (OS Attribute 0x00, Reboot Reason 0x0A)
D303000A D303000A
Splash disabled in GCT
Splash display time: 2 ms
[COLOR="red"]-->Bootable OS image 0 found for requested type 2 [/COLOR](OSII attribute 0x00)
-->[COLOR="red"]Loading OS image 0 from eMMC block 0x00000032 to DRAM address 0x010FFE20[/COLOR]
-->Starting transfer of 0xA11 512-byte blocks to DRAM
-->Done loading OS Image to DRAM
-->platformConfigBuffer_pt.scuFhobDw0.osven != 0
-->osIndex: 0, Signed Image
OS image 0 PASSED verify
Booting COS
*********************************
Starting command line:
-init=/init pci=noearly console=ttyMFD2 console=ttyS0 console=logk0 earlyprintk=nologger loglevel=8 hsu_dma=7 kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=ctp_pr1 emmc_ipanic.ipanic_part_number=1 ip=50.0.0.2:50.0.0.1::255.255.255.0::usb0:on hsu_rx_wa g_android.fastboot=1 droidboot.scratch=100
-
OSNIB.wakesrc = 0x3
OSNIB.RR = 0xA
Battery is high enough for normal boot
4166mV > 0mV
Ending command line:
-init=/init pci=noearly console=ttyMFD2 console=ttyS0 console=logk0 earlyprintk=nologger loglevel=8 hsu_dma=7 kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=ctp_pr1 emmc_ipanic.ipanic_part_number=1 ip=50.0.0.2:50.0.0.1::255.255.255.0::usb0:on hsu_rx_wa g_android.fastboot=1 droidboot.scratch=100 androidboot.wakesrc=03 androidboot.mode=charger-
*********************************
WDT aka Timer7 setup
Warn Duration for Timer7: 00 seconds
Start Timer7 bit 0 -> 1: 00000000000000000000000000000000
[0;24r[24;1H[2KM
Calling OS entry point --> 0x01101000 ...
Using NEW OSHOB structure size = 176 bytes
OSNIB size = 32 bytes OEMNIB size = 64 bytes
0xFF00_0510 FullChipRegister: Status flag = 0x0
0xFF10_0510 SCFabricRegister: Status flag = 0x0
Watchdog Disabled!
usb is connected, skip to set uart path
__stmpe811_write : fail
MUIC: CONTROL1:0x00
MUIC: CONTROL1:0x00
MUIC: CONTROL2:0x3b
MUIC: CONTROL2:0x3b
[SCU_IPC_DEBUG] board ID: NOT_IDENTIFIED(8)
VERSION : 0xa501
mmc_read_ext_csd : ext_csd_rev = 0x7
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
!!!Enter 8 Bit mode.!!!
clt_mmc_init: mmc->capacity = 0x1d56000
[BOOT] RESETIRQ1=0x00 RESETIRQ2=0x00 (interrupt tree)
[BOOT] SCU_TR=0x00020013 IA_TR=0xffffffff (oshob)
[BOOT] RR=0x00 WD=0x00 ALARM=0x00 (osnib)
[BOOT] WAKESRC=0x03 RESETIRQ1=0x20 RESETIRQ2=0x00 (osnib)
Samsung S-Boot 4.0-1816966 for GT-P5200 (Nov 26 2013 - 01:43:08)
CLT(EVT 0.0) / 1024MB / 15020MB / Rev 8 / P5200XXUAMK8
pit_check_signature (PIT) valid.
initialize_ddi_data: usable! (159:0xc)
PARAM ENV VERSION: v1.0..
pressed_key = 0x1
clt_charger_init : [battery] using external charger init(3)
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
[check_cable_type] : Output of USB Charger Detection 3
[max77693_init_charger] : attached device(0x02) : TA
clt_max77693_set_charger_state: chg_cnfg_02 (0x1f) -> (0x1f) -> (0x1f)
clt_max77693_set_charger_state: chg_cnfg_03 (0x00) -> (0x00) -> (0x00)
clt_max77693_set_charger_state: chg_cnfg_04 (0xdd) -> (0xdd) -> (0xdd)
clt_max77693_set_charger_state: chg_cnfg_09 (0x64) -> (0x64) -> (0x64)
set_charger_state : buck(1), chg(0), reg(0x04)
init_fuel_gauge: Start!!
[0] get_adc_battid() = 92
[1] get_adc_battid() = 92
[2] get_adc_battid() = 92
get_adc_battid() = 92
init_fuel_gauge: Battery type : SDI
init_fuel_gauge: Already initialized (0x32cd, SDI type)
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
fuel_gauge_compensate_soc: Start!!
fuel_gauge_read_soc: SOC(73), data(0x491b)
fuel_gauge_read_vcell: VCELL(4071), data(0xcb92)
calculate_table_soc: Get table SOC in case of charging!!
calculate_table_soc: i(1), vcell(4071), table_soc(88)
differ(15), table_soc(88), RepSOC(73)
clt_charger_init : cable_type(0x02)
set_charger_state : buck(1), chg(1), reg(0x05)
intel_scu_ipc_cmd_oemnib : done => 0x0
check_reboot_cmd: nCmd = 0 ... skip check_reboot_cmd
debug level = 0x4f4c
disable max77693 manual reset
clt_max77693_disable_manual_reset: set max77693 MANCTRL1 val = 0x4
clt_max77693_disable_manual_reset: read max77693 MANCTRL1 val = 0x4
disable PMIC cod off triggered by PWRBTN#: 6
do_keypad: 0x1
intel_scu_ipc_cmd_oemnib : done => 0x0
check_download: 0
Is_lpm_boot : boot-mode saved in param = 0
Is_lpm_boot : jig-on level = 0, ignore...
STATUS1:0x3f, 2:0x43
vbvolt=0x1, chgtyp=0x3, adc=0x1f, ret=0x1031f
stat=0x1031f, adc=0x1f, chg=0x3, vbvolt=1, pinLevel=1
fuel_gauge_read_vcell: VCELL(4071), data(0xcb92)
fuel_gauge_read_soc: SOC(73), data(0x491b)
check_low_battery : rb=0 jig=0
check_low_battery : v=4071 soc=73
skip check low battery
scr_draw_image: draw 'logo.jpg'...
read 'logo.jpg'(105420) completed.
<start_checksum:355>CHECKSUM_HEADER_SECTOR :4096
<start_checksum:357>offset:6144, size:6296
<start_checksum:361>CHECKSUM_HEADER_INFO : NeedChecksum:0 PartNo:27
Not Need Movinand Checksum
Movinand Checksum Confirmation Pass
load_kernel: loading boot image from 106496..
total size : 8495104
pit_check_signature (BOOT) valid.
Set valid sign flag
if_ddi_data: succeeded. (159:0xc)
BOOT_MAGIC == ANDROID!
CMDLINE LENGTH = 538
CMDLINE = init=/init console=sec_log_buf kmemleak=off ptrace.ptrace_can_access=1 androidboot.bootmedia=sdcard androidboot.hardware=santos103g sec_debug.level=0 loglevel=0 androidboot.debug_level=0x4f4c vmalloc=256m [email protected] sec_bootfb=0x3f000000 lcd_panel_id=0 androidboot.revision=8 switch_sel=3 cordon=615d013e557994c8ad53b3325c31b124 connie=GT-P5200_OPEN_EUR_cf878c59e3c2eeb1cdb40863938b834d androidboot.emmc_checksum=3 androidboot.bootloader=P5200XXUAMK8 androidboot.serialno=4300b61fdc125000 snd_soc_core.pmdown_time=1000 jig=0
Bootstub: map SFI MMAP to e820 table
add mmap: 0x00000000 0x00098000 1
add mmap: 0x00100000 0x00580000 2
add mmap: 0x00680000 0x00680000 1
add mmap: 0x00d00000 0x00300000 2
add mmap: 0x01000000 0x35ff0000 1
add mmap: 0x36ff0000 0x0090d000 2
add mmap: 0x378fd400 0x00100000 2
add mmap: 0x379fd400 0x02602000 1
add mmap: 0x3a000000 0x02200000 2
add mmap: 0x3c200000 0x02d00000 1
add mmap: 0x3ef00000 0x00100000 2
add mmap: 0x3f000000 0x01000000 2
add mmap: 0xfec00000 0x00001000 2
add mmap: 0xfee00000 0x00001000 2
add mmap: 0xff000000 0x01000000 2
IMR6 start=0x3a000000 end=0x3c1fffff
new mmap: 0x3a000000 0x02200000 2
IMR7 start=0x00100000 end=0x0067ffff
new mmap: 0x00100000 0x00580000 2
Final E820 table:
e820: 0x00000000 0x00098000 1
e820: 0x00100000 0x00580000 2
e820: 0x00680000 0x00680000 1
e820: 0x00d00000 0x00300000 2
e820: 0x01000000 0x35ff0000 1
e820: 0x36ff0000 0x0090d000 2
e820: 0x378fd400 0x00100000 2
e820: 0x379fd400 0x02602000 1
e820: 0x3a000000 0x02200000 2
e820: 0x3c200000 0x02d00000 1
e820: 0x3ef00000 0x00100000 2
e820: 0x3f000000 0x01000000 2
e820: 0xfec00000 0x00001000 2
e820: 0xfee00000 0x00001000 2
e820: 0xff000000 0x01000000 2
Final mb_mmap table:
mb_mmap: 0x00000000 0x00098000 1
mb_mmap: 0x00100000 0x00580000 0
mb_mmap: 0x00680000 0x00680000 1
mb_mmap: 0x00d00000 0x00300000 0
mb_mmap: 0x01000000 0x35ff0000 1
mb_mmap: 0x36ff0000 0x0090d000 0
mb_mmap: 0x378fd400 0x00100000 0
mb_mmap: 0x379fd400 0x02602000 1
mb_mmap: 0x3a000000 0x02200000 0
mb_mmap: 0x3c200000 0x02d00000 1
mb_mmap: 0x3ef00000 0x00100000 0
mb_mmap: 0x3f000000 0x01000000 0
mb_mmap: 0xfec00000 0x00001000 0
mb_mmap: 0xfee00000 0x00001000 0
mb_mmap: 0xff000000 0x01000000 0
Using bzImage to boot
Relocating initramfs to high memory ...
usb is connected, skip to set uart path
0xFF00_0510 FullChipRegister: Status flag = 0x0
0xFF10_0510 SCFabricRegister: Status flag = 0x0
Jump to kernel 32bit entry ...0x05003c00
I check interesting rows by red color. But there is easy way: need to compile x86 binaries an inject some code to twrp recovery. After that Linux OS must load from any img or partition on internal or external SD. Manual for coding this: link. It's on Russian - use translator to read.
Click to expand...
Click to collapse
Awesome work on that manual dude, now I have something to do while I'm at work bored... and we'll know what we can and can't remove/put in...
xkwr27 said:
Awesome work on that manual dude
Click to expand...
Click to collapse
If you mean manual on that site - it's not mine.
Post updated. Take a look at device partitions.
Hey Guys,
I've been tinkering with my MI Box as I've been having packet loss issues with it, long story short its bricked, here is the bootlog + UART Pins if anyone is interested:
Boot Log:
Code:
TE: 98645
BL2 Built : 18:13:36, Jun 17 2016.
gxl g176ecdb - [email protected]
rn5t567_power_init
Board ID = 1
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
Rank1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl32 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x0002ee00
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00068200, des: 0x01700000, size: 0x0007f800
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(debug):ed1aadc
NOTICE: BL3-1: Built : 11:06:24, May 31 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3118-31ffc57 2016-09-27 10:04:49 [email protected]]
OPS=0x82
ef be ad de d f0 ad ba ef be ad de bl30:thermal init err
[0.626102 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
INFO: BL3-1: Initializing BL3-2
INFO: BL3-2: ATOS-V1.4-gb959fd4 #13 Tue Sep 6 15:28:58 CST 2016 arm
INFO: BL3-2: chip version = RevA (21:A - 0:0)
INFO: BL3-2: crypto engine DMA
INFO: BL3-2: secure time TEE
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01-g57a5217-dirty (Jan 25 2017 - 11:17:54), Build: jenkins-Once_MP-750
DRAM: 2 GiB
Relocation Offset is: 76ef5000
register usb cfg[0][1] = 0000000077f64870
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
SARADC channel(1) is 0x1d2.
adcAvg hw_version is 353
MMC: aml_priv->desc_buf = 0x0000000073ef56e0
aml_priv->desc_buf = 0x0000000073ef7870
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
[mmc_init] mmc init success
mmc read lba=0x4000, blocks=0x400
start dts,buffer=0000000073ef9f30,dt_addr=0000000073ef9f30
parts: 12
00: cache 0000000010000000 2
01: logo 0000000000300000 1
02: encrypt 0000000000100000 1
03: recovery 0000000002000000 1
04: tee 0000000000800000 1
05: crypt 0000000002000000 1
06: misc 0000000002000000 1
07: boot 0000000001400000 1
08: system 0000000060000000 1
09: persist 0000000000800000 4
10: panic 0000000000400000 4
11: data ffffffffffffffff 4
get_dtb_struct: Get emmc dtb OK!
overide_emmc_partition_table: overide cache
[mmc_get_partition_table] skip partition cache.
Partition table get from SPL is :
name offset size flag
===================================================================================
0: bootloader 0 400000 0
1: reserved 400000 800000 0
2: cache c00000 10000000 2
3: env 10c00000 400000 0
4: logo 11000000 300000 1
5: encrypt 11300000 100000 1
6: recovery 11400000 2000000 1
7: tee 13400000 800000 1
8: crypt 13c00000 2000000 1
9: misc 15c00000 2000000 1
10: boot 17c00000 1400000 1
11: system 19000000 60000000 1
12: persist 79000000 800000 4
13: panic 79800000 400000 4
14: data 79c00000 158400000 4
mmc read lba=0x2000, blocks=0x2
mmc read lba=0x2002, blocks=0x2
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x10c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hardware_version =1
Saving Environment to aml-storage...
mmc env offset: 0x10c00000
Writing to MMC(1)... done
hpd_state=0
cvbs performance type = 6, table = 0
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
read emmc dtb
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L507:key[sn2] not programed yet
wipe_data=successful
wipe_cache=successful
Boot command:
Boot status:
Boot message
""
upgrade_step=2
[OSD]load fb addr from dts
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]fb_addr for logo: 0x3d800000
[OSD]load fb addr from dts
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]fb_addr for logo: 0x3d800000
[CANVAS]canvas init
[CANVAS]addr=0x3d800000 width=5760, height=2160
pull down bt_reset
pull up bt_reset
set hci reset
04 0e 04 01 03 0c 00
set scan parameters
04 0e 04 01 0b 20 00
set scan enable
04 0e 04 01 0c 20 00
pull down bt_enable
IR init done!
[imgread]szTimeStamp[2017012511355519]
[imgread]secureKernelImgSz=0x778000
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =73f7a130
copy done
load dtb from 0x1000000 ......
Uncompressing Kernel Image ... OK
kernel loaded at 0x01080000, end = 0x01fa8620
Loading Ramdisk to 73e02000, end 73ee3000 ... OK
Loading Device Tree to 000000001fff4000, end 000000001fffff5e ... OK
Starting kernel ...
uboot time: 2832461 us
...
<See Attached>
UART Pins:
<See Attached>
You can hook the TX and RX lines into the 3.5mm headphone jack for easy UART use.
See attached
It turns out JTAG is enabled according to the Android dmesg log, this could mean a neat little BootROM dump...
Can someone makes a flash able rom for Almogic burning tool for mi tv box 3 mdz 16-ab?
Can you boot from usb device (libreelec)?
My mi tv box 3 is totally bricked no boot to recovery, only pc recognize like WorldCub device.
gyb001 said:
Can you boot from usb device (libreelec)?
Click to expand...
Click to collapse
I haven't looked at that yet, I don't really have any expirence playing with AMLogic SoCs, you can boot via USB? This would actually work if you can as I have boot.img and system...
(dylanger) said:
I haven't looked at that yet, I don't really have any expirence playing with AMLogic SoCs, you can boot via USB? This would actually work if you can as I have boot.img and system...
Click to expand...
Click to collapse
Thanks.
unfortunatelly i haven't img.
But i find intresting things
once#usb start
(Re)start USB...
USB0: USB3.0 XHCI init start
Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.00
This box have usb3?
Do you know how can i make full backup from emmc?
I think we can run somehow twrp with this env:
recovery_from_udisk=if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then echo udisk dtb.img loaded; fi;bootm ${loadaddr};fi;
I won
amlogic login: root
Password:
Last login: Sat Nov 4 12:30:06 UTC 2017 on ttyS0
/etc/update-motd.d/30-sysinfo: line 37: read: read error: 0: Invalid argument
/etc/update-motd.d/30-sysinfo: line 38: [: -le: unary operator expected
____ ___
/ ___|/ _ \__ ____ ____ __
\___ \ (_) \ \/ /\ \/ /\ \/ /
___) \__, |> < > < > <
|____/ /_//_/\_\/_/\_\/_/\_\
Welcome to ARMBIAN 5.34 user-built Debian GNU/Linux 9 (stretch) 3.14.29
System load: 0.44 0.12 0.04 Up time: 0 min
Memory usage: 4 % of 1790MB IP:
Usage of /: 18% of 7.1G storage/: 56% of 128M
[email protected]:~# ls
fstab install.sh
[email protected]:~# uname -a
Linux amlogic 3.14.29 #108 SMP PREEMPT Sat Nov 4 14:50:04 MSK 2017 aarch64 GNU/Linux
[email protected]:~# cat /proc/cpuinfo
Processor : AArch64 Processor rev 4 (aarch64)
processor : 0
processor : 1
processor : 2
processor : 3
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: AArch64
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
Hardware : Amlogic
Serial : 210a82005fb86cbf061167e2b0552e2f
Revision : 020a
gyb001 said:
I won
amlogic login: root
Password:
Last login: Sat Nov 4 12:30:06 UTC 2017 on ttyS0
/etc/update-motd.d/30-sysinfo: line 37: read: read error: 0: Invalid argument
/etc/update-motd.d/30-sysinfo: line 38: [: -le: unary operator expected
____ ___
/ ___|/ _ \__ ____ ____ __
\___ \ (_) \ \/ /\ \/ /\ \/ /
___) \__, |> < > < > <
|____/ /_//_/\_\/_/\_\/_/\_\
Welcome to ARMBIAN 5.34 user-built Debian GNU/Linux 9 (stretch) 3.14.29
System load: 0.44 0.12 0.04 Up time: 0 min
Memory usage: 4 % of 1790MB IP:
Usage of /: 18% of 7.1G storage/: 56% of 128M
[email protected]:~# ls
fstab install.sh
[email protected]:~# uname -a
Linux amlogic 3.14.29 #108 SMP PREEMPT Sat Nov 4 14:50:04 MSK 2017 aarch64 GNU/Linux
[email protected]:~# cat /proc/cpuinfo
Processor : AArch64 Processor rev 4 (aarch64)
processor : 0
processor : 1
processor : 2
processor : 3
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: AArch64
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
Hardware : Amlogic
Serial : 210a82005fb86cbf061167e2b0552e2f
Revision : 020a
Click to expand...
Click to collapse
Woot! Nice work! So you've managed to boot into a Debian build? Damn nice work! Do you know if its possible to do that without having access to Android in the first place?
Like from UBOOT?
Yes i used to uart.
Write this command to uboot:
setenv bootcmd "run start_autoscript; run storeboot;"
setenv start_autoscript "if usb start ; then run start_usb_autoscript; fi; if mmcinfo; then run start_mmc_autoscript; fi;"
setenv start_mmc_autoscript "if fatload mmc 0 1020000 s905_autoscript; then autoscr 1020000; fi;"
setenv start_usb_autoscript "if fatload usb 0 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 1 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 2 1020000 s905_autoscript; then autoscr 1020000; fi; if fatload usb 3 1020000 s905_autoscript; then autoscr 1020000; fi;"
setenv upgrade_step "0"
saveenv
Click to expand...
Click to collapse
I'm not sure it necessary, but i set the selinux disabled.
Download and write the image to usb drive
https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN
gyb001 said:
Yes i used to uart.
Write this command to uboot:
I'm not sure it necessary, but i set the selinux disabled.
Download and write the image to usb drive
https://yadi.sk/d/srrtn6kpnsKz2/Linux/ARMBIAN
Click to expand...
Click to collapse
Can we use this image with Amlogic usb burning tool ?
venioni said:
Can we use this image with Amlogic usb burning tool ?
Click to expand...
Click to collapse
No, the image will not pass the burning tool vertify.
I think you can use the amlogic burning tool only with uart. In uboot write "update" command.
gyb001 said:
No, the image will not pass the burning tool vertify.
I think you can use the amlogic burning tool only with uart. In uboot write "update" command.
Click to expand...
Click to collapse
Can you help me to unbrick my mind that box 3 international?
is totally bricked,no boot to recovery mode.
venioni said:
Can you help me to unbrick my mind that box 3 international?
is totally bricked,no boot to recovery mode.
Click to expand...
Click to collapse
Unfortunately i don't know how its possibile, but That sure, you have to use u boot.
You should buy uart usb device. I have cp2102
gyb001 said:
Unfortunately i don't know how its possibile, but That sure, you have to use u boot.
You should buy uart usb device. I have cp2102
Click to expand...
Click to collapse
If i buy this uart usb device cp 2102 can you make a tutorial how can i use this to unbrick my mi tv box3 and what firmwares i need to do all this?
venioni said:
If i buy this uart usb device cp 2102 can you make a tutorial how can i use this to unbrick my mi tv box3 and what firmwares i need to do all this?
Click to expand...
Click to collapse
Now, i can boot only Armbian.
Stock rom img file
https://mega.nz/#F!BDRG3J4B!VZqB0qJ9fseMhy4Y8anIaA
gyb001 said:
Stock rom img file
https://mega.nz/#F!BDRG3J4B!VZqB0qJ9fseMhy4Y8anIaA
Click to expand...
Click to collapse
Can we flash this stock rom image with Almogic burning tool for unbrick mi tv box 3 ?
venioni said:
Can we flash this stock rom image with Almogic burning tool for unbrick mi tv box 3 ?
Click to expand...
Click to collapse
No.
You have to use uboot