Hi everyone,
Updates:
2021-08-17 - Added patched Magisk boot for this device. (Conceptum Stock ROM)
I'm starting this thread to collect information and files regarding this particular version of X96 box and to explain to anyone interested what I have discovered so far..
The company who has repackaged the firmware for this box for the Greek market, CONCEPTUM, refuses to release the original firmware for this device.
So currently, I have dumped two types of firmware from a stock box in case it is needed. A standard TWRP backup, and a dd image.
At the moment, I actually am NOT having any luck restoring the firmware using the TWRP restore. Not sure why.
I was able to restore the original firmware using the dd image. So for anyone who screws up their stock firmware, you can use the dd image from the mega drive. Punchline: The stock image has terrible wifi speed as well. I have yet to try restoring the firmware via dd yet but when I do I will write if it works or not.
Here is a link to the folder where I will be updating what compatible files I can find.
4.38 GB folder on MEGA
13 files and 6 subfolders
mega.nz
This post is very incomplete and I will be adding to it shortly.
--------------------------------------
SPECIFICATIONS
4GB RAM/32GB Storage
Ethernet Speed: 1000mbps / 1gbs
Ethernet Chipset: Realtek RTL8211F
Wifi : 5ghz & 2.4 ghz support
Wifi / Bluetooth Chipset: Cdtech 4761743 (which is a Qualcomm QCA6174A design? See links below.)
https://discourse.coreelec.org/t/looking-for-users-with-no-working-wifi-or-bt/9649/248
https://discourse.coreelec.org/t/looking-for-users-with-no-working-wifi-or-bt/9649/249
https://blog.csdn.net/u012851408/article/details/86605778
Motherboard Markings: BM805H_141 V3.2 20352 4020
Motherboard Sticker: 4+32+CDW ZF210129
---------------------------
How to get into recovery
The button needed to access recovery is hidden. It is deep inside the stereo jack. (You can see it if you shine a flashlight into there.
My suggested tool to press this button easily is a qtip with the cotton from one end removed.
Insert the tool, and press it in until you feel the click.
Apply power to the device and as soon as you can see the logo come on, release the tool pressure.
It should enter recovery in 5 to 10 seconds.
---------------------------
CoreELEC
I was able to boot CoreELEC via sdcard, with bluetooth and wifi working with the following device tree:
sm1_s905x3_4g_1gbit.dtb
I forgot to check the speed of the wifi, but if I recall, both 2.4 & 5ghz was working with that dtb.
---------------------------
TWRP
The TWRP_AML_ViT_3.3.1_2020.zip (in the Mega folder) is a "hinged" version. Not sure if its the right term, but it can be run from the stock recovery, (Apply update from external). It does NOT install, it just runs it and lets you do stuff from there.
If anyone knows the source or an update for the Amlogic TWRP Hinged version, please post it here.
I used a previous "hinged version" TWRP_322.zip but this version did not backup properly all the partitions, ex it totally skipped the Vendor partition, which is why I have 2 of these Tvboxes as my first one the backup was bad and it was essentially bricked.
---------------------------
Amlogic USB Burning Tool
This seems to work fine, but something that is always missing from peoples instructions,
The Male to Male USB cable, on this device must be plugged into the USB 3 port.
The power cable must also be removed, and when plugging in the USB cable to the correct port, will provide power for the "fastboot" equivalent mode needed to flash from the Amlogic tool.
So the procedure to flash is (after installing the USB Flash tool)
Device is powered off.
Insert USB cable into your pc end.
Insert tool and press recovery mode button.
Plug in other end of USB cable into the tvbox.
It should power on, keep the recovery button pressed until you hear the device connect to Windows (USB being plugged in sound)
They you should be able to flash.
---------------------------
Compatible ROMS
Long story short, due to a initial TWRP backup that was missing certain important partitions, I bricked my first box.
While trying to get the box working again, I have found the following firmware to work mostly. I am not reccomending them, as I am not sure they are working optimally, but if needed these can boot the system and work in some capacity.
X96Max_Plus_Q2_20201209-1446.img
Original firmware for X96 Max Plus Q2 version
sbx_x96max_plus_q2_v12
Slimbox Version 12 for X96 Max Plus Q2
This version does not come with Google framework which I needed so I didn't work with it much.
---------------------------
Magisk
Patched boot image for this device.
9.67 MB file on MEGA
mega.nz
Download and extract this file and put it somewhere you can flash from.
Install Magisk Manager.
Boot from Hinged TWRP, goto Install, Install image, select the file and flash to Boot partition. BE CAREFUL AND DON'T FLASH TO BOOTLOADER
Magisk Should be working, try running a root app and magisk should pop up
Magisk is complicated. On all the Amlogic boxes as far as I know, Magisk will install but NOT function properly.
The geniuses at 4pda have figured out a procedure to make Magisk work properly, but it requires hex editing the boot partition and reflashing it.
I have done the procedure successfully when I was using the X96Max_Plus_Q2_20201209-1446.img firmware. It does work.
I will upload this to the mega folder when I have time.
When I manage to hex edit the stock boot image, I will also upload it. Its an involved process and takes some time.
Reserved for future shenanigans.
my device has the same mainboard as you mentioned above ,but mine is 4/64 , my device bricked after burning non related image and after i plug in the power , for first 5 minutes nothing happens and then in vfd it shows boot and then clock and on tv screen only boot logo appears after 5 min but non consistent if you change tv source and back again it shows no hdmi connection and nothing more happens.
i tried out all p3 version of x96 air images but useless because they have different main board i wanted to try your dd imade backup (twrp is impossible bacause of no recovery) and burn it with amlogic usb tool but extraction of image ended with error with more than 15 gigabytes .
i appreciate anyone who can help me to unbrick my device , i am hopeless because this device has no support mine is named,x96 air 4/64
effgee said:
Hi everyone,
Updates:
2021-08-17 - Added patched Magisk boot for this device. (Conceptum Stock ROM)
I'm starting this thread to collect information and files regarding this particular version of X96 box and to explain to anyone interested what I have discovered so far..
The company who has repackaged the firmware for this box for the Greek market, CONCEPTUM, refuses to release the original firmware for this device.
So currently, I have dumped two types of firmware from a stock box in case it is needed. A standard TWRP backup, and a dd image.
At the moment, I actually am NOT having any luck restoring the firmware using the TWRP restore. Not sure why.
I was able to restore the original firmware using the dd image. So for anyone who screws up their stock firmware, you can use the dd image from the mega drive. Punchline: The stock image has terrible wifi speed as well. I have yet to try restoring the firmware via dd yet but when I do I will write if it works or not.
Here is a link to the folder where I will be updating what compatible files I can find.
4.38 GB folder on MEGA
13 files and 6 subfolders
mega.nz
This post is very incomplete and I will be adding to it shortly.
--------------------------------------
SPECIFICATIONS
4GB RAM/32GB Storage
Ethernet Speed: 1000mbps / 1gbs
Ethernet Chipset: Realtek RTL8211F
Wifi : 5ghz & 2.4 ghz support
Wifi / Bluetooth Chipset: Cdtech 4761743 (which is a Qualcomm QCA6174A design? See links below.)
https://discourse.coreelec.org/t/looking-for-users-with-no-working-wifi-or-bt/9649/248
https://discourse.coreelec.org/t/looking-for-users-with-no-working-wifi-or-bt/9649/249
https://blog.csdn.net/u012851408/article/details/86605778
Motherboard Markings: BM805H_141 V3.2 20352 4020
Motherboard Sticker: 4+32+CDW ZF210129
---------------------------
How to get into recovery
The button needed to access recovery is hidden. It is deep inside the stereo jack. (You can see it if you shine a flashlight into there.
My suggested tool to press this button easily is a qtip with the cotton from one end removed.
Insert the tool, and press it in until you feel the click.
Apply power to the device and as soon as you can see the logo come on, release the tool pressure.
It should enter recovery in 5 to 10 seconds.
---------------------------
CoreELEC
I was able to boot CoreELEC via sdcard, with bluetooth and wifi working with the following device tree:
sm1_s905x3_4g_1gbit.dtb
I forgot to check the speed of the wifi, but if I recall, both 2.4 & 5ghz was working with that dtb.
---------------------------
TWRP
The TWRP_AML_ViT_3.3.1_2020.zip (in the Mega folder) is a "hinged" version. Not sure if its the right term, but it can be run from the stock recovery, (Apply update from external). It does NOT install, it just runs it and lets you do stuff from there.
If anyone knows the source or an update for the Amlogic TWRP Hinged version, please post it here.
I used a previous "hinged version" TWRP_322.zip but this version did not backup properly all the partitions, ex it totally skipped the Vendor partition, which is why I have 2 of these Tvboxes as my first one the backup was bad and it was essentially bricked.
---------------------------
Amlogic USB Burning Tool
This seems to work fine, but something that is always missing from peoples instructions,
The Male to Male USB cable, on this device must be plugged into the USB 3 port.
The power cable must also be removed, and when plugging in the USB cable to the correct port, will provide power for the "fastboot" equivalent mode needed to flash from the Amlogic tool.
So the procedure to flash is (after installing the USB Flash tool)
Device is powered off.
Insert USB cable into your pc end.
Insert tool and press recovery mode button.
Plug in other end of USB cable into the tvbox.
It should power on, keep the recovery button pressed until you hear the device connect to Windows (USB being plugged in sound)
They you should be able to flash.
---------------------------
Compatible ROMS
Long story short, due to a initial TWRP backup that was missing certain important partitions, I bricked my first box.
While trying to get the box working again, I have found the following firmware to work mostly. I am not reccomending them, as I am not sure they are working optimally, but if needed these can boot the system and work in some capacity.
X96Max_Plus_Q2_20201209-1446.img
Original firmware for X96 Max Plus Q2 version
sbx_x96max_plus_q2_v12
Slimbox Version 12 for X96 Max Plus Q2
This version does not come with Google framework which I needed so I didn't work with it much.
---------------------------
Magisk
Patched boot image for this device.
9.67 MB file on MEGA
mega.nz
Download and extract this file and put it somewhere you can flash from.
Install Magisk Manager.
Boot from Hinged TWRP, goto Install, Install image, select the file and flash to Boot partition. BE CAREFUL AND DON'T FLASH TO BOOTLOADER
Magisk Should be working, try running a root app and magisk should pop up
Magisk is complicated. On all the Amlogic boxes as far as I know, Magisk will install but NOT function properly.
The geniuses at 4pda have figured out a procedure to make Magisk work properly, but it requires hex editing the boot partition and reflashing it.
I have done the procedure successfully when I was using the X96Max_Plus_Q2_20201209-1446.img firmware. It does work.
I will upload this to the mega folder when I have time.
When I manage to hex edit the stock boot image, I will also upload it. Its an involved process and takes some time.
Click to expand...
Click to collapse
i have a full twrp backup but unable to go to recovery to unbrick my device or will you change twrp backup to img file so that i can burn that with usb burning tool ? full detail of the problem in the previous post
reza0511 said:
i have a full twrp backup but unable to go to recovery to unbrick my device or will you change twrp backup to img file so that i can burn that with usb burning tool ? full detail of the problem in the previous post
Click to expand...
Click to collapse
Regular Air firmware's do not work.
P1-P3 don't work for sure, P4 I don't know but I think not.
I haven't found a photo yet of the P4 hardware.
Try USB Flashtool 4/64 image for X96Max_Plus_Q2 to get your recovery back if such a firmware exists, otherwise try the 4/32. X96 Max Plus Q2 firmware (X96Max_Plus_Q2_20201209-1446.img)
You should be able to get recovery back via flashing one of those images.
X96 Max Plus Q2 firmware is compatible, but if you use the 4/32 image you will only see the half of your storage.
Restoring your TWRP full backup again once you get the max firmware (for twrp) installed will not work unfortunately. Already went through this.
reza0511 said:
my device has the same mainboard as you mentioned above ,but mine is 4/64 , my device bricked after burning non related image and after i plug in the power , for first 5 minutes nothing happens and then in vfd it shows boot and then clock and on tv screen only boot logo appears after 5 min but non consistent if you change tv source and back again it shows no hdmi connection and nothing more happens.
i tried out all p3 version of x96 air images but useless because they have different main board i wanted to try your dd imade backup (twrp is impossible bacause of no recovery) and burn it with amlogic usb tool but extraction of image ended with error with more than 15 gigabytes .
i appreciate anyone who can help me to unbrick my device , i am hopeless because this device has no support mine is named,x96 air 4/64
Click to expand...
Click to collapse
You have a Conceptum box or just the same motherboard?
If you have a Conceptum, you are pretty much ****ed. They wont release the original firmware. You will have to buy a second box and get the image via dd.
I had to buy a second box and get the disk image via dd, and then restore the dd image using dd from within TWRP, overwriting the entire storage with the image. This was using the terminal built into TWRP.
In general, restoring from TWRP doesn't work well on these boxes, especially going from rom to rom as the partition layouts are different and TWRP doesn't handle it correct.
Conversion of the dd image to usb flashable is tricky and I haven't done it.
The person that MAY be able to do such a thing is Ricky ( https://forum.xda-developers.com/t/...w-milestone-donate-version-available.3786991/ ) but I dont know and I don't think there is any point as my dd image has partition layout for 32 gb version, you will lose half your storage unless he can also expand the partition.
Even if you manage to get TWRP back, there will probably be a partition layout difference from the firmware you use to get TWRP on the box, and the TWRP image backup you did. It probably will not work.
You need to get your original firmware, or a dd image of the same box.
You can also use the Slimbox for x96max_plus_q2. I did NOT like Slimbox 12 because it was missing google play and a lot of other things. But it will restore recovery.
solved !!
i save my box by below two steps
1- burning veitnami atv version of x96air img file (google for link )
2- restoring my full twrp via recovery
reza0511 said:
решено !!
Я сохраняю свою коробку, выполнив следующие два шага
1- сжигание veitnami atv версии файла img x96air (гугл для ссылки)
2- восстановление моего полного twrp через рекавери
Click to expand...
Click to collapse
is there a link?
Я уже решил свой вопрос. Спасибо за ваш сайт. Меня интересовало восстановление кирпича x96air_100. Я из Украины.
I have already solved my question. Thank you for your site. I was interested in the restoration of the brick x96air_100. I am from Ukraine.
How you did get MAGISK working? I own x96 AIR P3 and would like to use MAGISK
Soldiaz said:
How you did get MAGISK working? I own x96 AIR P3 and would like to use MAGISK
Click to expand...
Click to collapse
Hi.
To get Magisk working, its a bit of a difficult process.
Essentially, Amlogic released / built their kernels with a kernel boot option "skip_initramfs" which magisk needs "want_initramfs" for this to work.
The process is complicated as you must hex edit your boot.img after you have patched it with the Magisk Manager patching method called "Recovery Mode"
4pda where this was discovered - https://4pda.to/forum/index.php?showtopic=774072&st=25020#entry91068157
Video from 4PDA that shows the hex editing process - https://mega.nz/file/pJ1RTChR#b5rLNs-4GF2qlZXKzbL0P5lmAeLLYObJ_w3_Yf8h16U
You can also get the video from the above thread but if I recall you must register to download and unless you know russian its difficult to register there.
A guide I wrote that you can follow along with the video to understand the process - https://rentry.co/wgu9u
Every detail matters, I studied the video for many hours to understand the process, good luck.
My thread about this process here: https://forum.xda-developers.com/t/...ide-to-accompany-video.4320923/#post-85493037
Thanks!!!! Dam looking not that easy .
The Boot img from x96 Air you edited, is it Stock?
Sorry i dont check my mesages here very often.
I don't know which boot image you are talking about, it would be very helpful for you to link me which one specifically I need to answer the question for..
If you are talking about the image for my Air Extreme, it is stock and patched by magisk, and then hex edited for magisk. But I dont know its compatibility for any of the other Air versions.
effgee, just wanted to let you know there is a lot of information and multiple versions of the X96 Air TV Box Firmware available at...
Original Google link... (Vietnamese)
https://www.google.com/url? sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiDtPO9yZj0AhUOXM0KHYnzCIUQFnoECA8QAQ&url=https %3A%2F%2Ftinhte.vn%2Fthread%2Ftong-hop-cac-ban-firmware-cua-android-tv-box-x96- air.3050996%2F&usg=AOvVaw1it1QO7hR_e5XsrdSZH-Rj
Google Translated (English) link...
https://tinhte-vn.translate.goog/thread/tong-hop-cac-ban-firmware-cua-android-tv-box-x96-air.3050996/? _x_tr_sl=vi&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=nui,sc
Direct link... (Vietnamese)
https://tinhte.vn/thread/tong-hop-cac-ban-firmware-cua-android-tv-box-x96-air.3050996/
"X96 Air" search via direct link... (Vietnamese)
https://tinhte.vn/search/333184298/?q=x96+air&o=relevance
Hope they help!
Mr350
Ps... If you have trouble with the Google translation links not working try a Google search for... x96 air tinhte.vn ... that might work then click Translate this page.
Hi dear friends,
thank you in advance for your help. I have a strange stuation (at least for me) with this box from Foyu x96 mini.As you can see in photo and also written on paper box , it has Amlogic S905W 4G 32G rom, but if i go inside Kodi for example in System it says it has Rockchip 3229... then also on recovery mode on boot mode it states "android recovery rockchip 322x ..... I've tried with Amlogic burning tool but it doesn't recognize the hub connection and it doesn't burn another rom for S905w. I've tried shortening nand pins..nothing
Have you got any suggestions to erase all and burn an Amlogic s905w Rom , considering there's an S905w cpu?? i don't think it's a false one! there's no Rockchip inside!
thank you
Isn'it strange? Any suggestions?
..seems i found the million dollar question.. the only post that puts in crisis all the forum...
ive seen amlogic devices recovery reporting as rockchip, its usally just a mismatched recovery, i would try and figure out mask rom mode for this board, see my video here for some info
aidanmacgregor said:
ive seen amlogic devices recovery reporting as rockchip, its usally just a mismatched recovery, i would try and figure out mask rom mode for this board, see my video here for some info
Click to expand...
Click to collapse
Thank you for your kind answer,but i tried also with mask mode,it only sound but no connection. For me it's a fake chip,otherwise why with rockchip tool it normally connects? Also on kodi it's incredibly slow,and in system maximum resolution is 1280*720!! Absurd
Hi , I have exactly the same problem with a tv box x96 mini locked in the logo screen. If you find a way to recover, please post it.
gherghe said:
Hi , I have exactly the same problem with a tv box x96 mini locked in the logo screen. If you find a way to recover, please post it.
Click to expand...
Click to collapse
I can't see if yours has amlogic s905w chip,anyway mine it's not locked,you can try with rockchip tool to burn image if you got Rockchip inside
yes I have a S905x chip, it doesn't look very good but I managed to take a picture.I tried with usb burninig tools but my box is not seen by the computer and I don't know how to use the nand method.
If your x96mini is not locked, you can help me with a stock firmware of your box, to try a rewrite of my box with the sd card method. Thanks anyway for the help. I have been looking for a solution to unlock the box for some time.
gherghe said:
If your x96mini is not locked, you can help me with a stock firmware of your box, to try a rewrite of my box with the sd card method. Thanks anyway for the help. I have been looking for a solution to unlock the box for some time.
Click to expand...
Click to collapse
Yours is s905w, seems same situation.. i haven't got original firmware,in my case mine is made by Foyu,you can try to find them on internet, i don't know.. don't know why they're recognized as Rockchip..
ok , thanks
cipposo said:
...i don't know.. don't know why they're recognized as Rockchip..
Click to expand...
Click to collapse
Maybe, because is it "faked" remarked RK3229 as S905W.
Try to setup mSD card with LibreELEC...
Release RK322x first mainline release · knaerzche/LibreELEC.tv
Kernel 5.5.0 uboot 202001 lima drm / mesa 20.0 (beta) hdmi up to 2160p hantro video hw decoding for MPEG2/VP8/H264 up to 1080p Wifi only for chipsets that have mainline support no preconfigured rc ...
github.com
mAtvXk said:
Maybe, because is it "faked" remarked RK3229 as S905W.
Try to setup mSD card with LibreELEC...
Release RK322x first mainline release · knaerzche/LibreELEC.tv
Kernel 5.5.0 uboot 202001 lima drm / mesa 20.0 (beta) hdmi up to 2160p hantro video hw decoding for MPEG2/VP8/H264 up to 1080p Wifi only for chipsets that have mainline support no preconfigured rc ...
github.com
Click to expand...
Click to collapse
Sure,probably it is,but with librelec would be only kodi...
Hello, thank you for your help. If I install the firmware from the link you sent me, can I then write another firmware? If I find the original firmware.
cipposo said:
Sure,probably it is,but with librelec would be only kodi...
Click to expand...
Click to collapse
Just to confirm if you have Rockchip inside, anyway LE is runned from SD card, nothing will be installed onto the box.
Ok thank you.
Hi, I tried LibreELEC but it doesn't work. I'm attaching the image with the received error, maybe you know what the problem is. Thanks
gherghe said:
Hi, I tried LibreELEC but it doesn't work. I'm attaching the image with the received error...
Click to expand...
Click to collapse
Did you create bootable media...
Create Media - LibreELEC.wiki
wiki.libreelec.tv
Yes I created a bootable sd card, with LibreELEC rk322x the box does not start, the LED remains off.
Well it look like you guys have a fake amlogic like me on the tag is 4GB RAM and 32GB flash store. All the inside chip has been marked like the real one but are fake. Main chip is RK3229 and the ram is just 1GB and 8GB flash. I successfully unbrick this **** using rkfactory tool and a rom for RK3229 chip. step to follow: 1. install rockcip drivers, 2. start factory tool, 3. load firmware in factory tool, 4. conect USB A - A cable to pc, 5. tooth pick in the AV port and pres the restore switch from inside, 6. connect USB A - A to the OTG USB port on the box the port is the one next to the tf card reader, 7, the hub is recognized by the pc and it be detected by the tool factory, 8. flash the firmware, enjoy.
Files:
1 Drivers: https://mega.nz/file/q8kk0ayA#XA3ZCoZK-Lu0LW1alqq6qKBmzFTj4gDDnlLWqq0Joso
2 factory tool: https://mega.nz/file/ihVnBC5L#Ri-IY7uVxcbaXEMkgb_bSXKMcwbkbAnYFxnEuizREaE
3 firmware: https://mega.nz/file/2k8EzJxY#cY_NWvIyof8Rnd7syOK9OYc5Fot19Ub76L46nzTrAAU
Hello my tv box does not give any kind of life after flashing attempt, the only application that recognizes me on the pc is amlogic burning tool but all firmwares remain at 2%,7%,8%, etc.. Bach tool and android tool do not recognize me as if it was not connected my tv box is a mxq pro 4k amlogic s905x quad core a53, android 7.1.2, cpu 64 bit, 1 gb ram and 8 gb storage.
I also tried touching pins 4-5, 5-6 and 7-8 as they say on the internet but it didn't work.
Text on board: S905XQ4_V1.0 2017.11.23
Nand flash: ESSENCORE i3t-8GQ8T2h5TARC
Wifi chip: SV6051P TTB1805 1WT98
White sticker text: AK1805AB-3 D1/F8G 2D1805A26QC S905X SX HYH9
extra info: when it was turned on at startup it showed the amlogic 905w logo but it's really s905x.