[ROOT] Mecool KM2 - Root posibilities? - Android Stick & Console AMLogic based Computers

Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Looking for someone who help me root this device.
Code:
CPU: Amlogic S905X2 Quad Core ARM Cortex A53
GPU: ARM Mail-G31 MP2
OS: Android 10.0 ATV
Memory: DDR4 2GB, eMMC 8GB
Review: https://www.wirelesshack.org/review-mecool-km2-android-10-tv-box-2gb-ram-s905x2-cpu.html

---

reserved for future updates

---

LifelessLife said:
Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Click to expand...
Click to collapse
I don't think this will happen. This box is certified by Netflix.
Once you can root it, Mecool will lose the Netflix certification and most probably Mecool won't get certification in the future.

---

Noter2017 said:
Once you can root it, Mecool will lose the Netflix certification and most probably Mecool won't get certification in the future.
Click to expand...
Click to collapse
That's not true. Nvidia Shield is rooted, doesn't mean they cannot get future certifications.

---

rajricardo said:
That's not true. Nvidia Shield is rooted, doesn't mean they cannot get future certifications.
Click to expand...
Click to collapse
Can you name another box?
The Shield is a complete exception. Not even the certificated Xiaomi boxes can be rooted, even though they have a huge community.
Mecool also has to be super careful. Not that long ago they have been selling boxes with fake/illegal certificates that could play Netflix in HD. Netflix blocked all of these boxes at some point.

---

Hi All,
I'm fairly new to this android tv scene, but have been following these discussions for a couple months now... I'm a hardware guy, so I picked up a couple of these units, and dissected one, ie took off the CPU and emmc.
I'm still not quite understanding of what exactly is happening with 'unlocking' bootloaders, and how this AMLogic 'tee' environment fully works, maybe you all can try to help me out a bit..
but I did want to share that I see we can still USB boot this thing, and use the AMLogic burning tool to at least re-write an image to the flash... the 'boot_5' pin I've shown in the attached pics..
you can catch it from that via (or trace) in the pic, and just touch it to gnd while powering on the unit, and it goes into USB boot via the amlogic rom... world cup device comes up and you can indeed use the burning tool..
I also dumped the emmc flash if anyone wants it? I'm not sure if that helps for being able to root it though, that's where I need some help understanding... I realize there are BL1, BL2, and BL3 boot stages, BL2 & BL3 I believe are the 'boot.img' and 'bootloader.img' that are present in the flash? that right?
I can put the emmc dump up on a mega.nz link if anyone wants it, but wasn't sure if it matters...

---

Principal-McVicker said:
but I did want to share that I see we can still USB boot this thing,
Click to expand...
Click to collapse
By, "USB boot" do you mean actually boot operating system files from USB, or do you mean just the ability to obtain a burn mode (worldcup) connection over USB?
Principal-McVicker said:
I'm still not quite understanding of what exactly is happening with 'unlocking' bootloaders,
Click to expand...
Click to collapse
Skyworth has modified u-boot (bl33) for this device such that u-boot won't recognize an unlocked status for the bootloader.
Principal-McVicker said:
use the AMLogic burning tool to at least re-write an image to the flash...
Click to expand...
Click to collapse
For the above reason (no recognition of an unlocked status), flashing images that are not unmodified stock will fail verification and not boot.
Principal-McVicker said:
I also dumped the emmc flash if anyone wants it?
Click to expand...
Click to collapse
What version does it contain?

---

Hi,
So hopefully this will clarify a bit... the AmLogic S905X2/X3 uses the 'boot4/boot5/boot6' pins for the power-on boot order (power-on config) pins... these are shared pins, that are also DAT4,DAT5,DA6 (data bits 4,5,6) for the emmc interface.
So internally the amlogic has boot4/5/6 pull up, ie '111' for the boot order. When you pull boot5 low, it goes 101, ie USB first.... this is essentially what this is doing, so the amlogic bootRom is now in USB boot first, versus emmc.
(I'm assuming you can prob. also do this by just shorting any of the emmc data bits to gnd (versus just bit 5), cause corruption, and it should also fail over to usb..
I haven't tried to actually flash any image yet, but at least I see the worldcup device, and connect with the burning tool...
so I'll attach the bootup log, as well as the 'build.prop' from the /vendor folder in the image... I think this should tell you what version it's running...
*** BTW: forgot to mention, most of these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin... and it's coded into the AmLogic u-boot code is 'AMLOGIC_KEY' or something like that... so when you hold it... u-boot eventually see's it and halts, and starts up the usb device ***
This is much later then when doing the above, putting the CPU into usb-boot.. just FYI....

---

Another thing I wanted to mention, regarding the BL33 (which I now understand is u-boot), in the image dump, it starts at offset 0x200, and appears to probably be AES encrypted, there's not even a header on it?
I also took apart an X96 Max+ for comparison, since that box is pretty much open, and the flash image has u-boot unencrypted at the same location, and it starts with the @aml header...
I've been going through the AMLogic tools trying to understand where/how the encryption is done, but I don't understand yet how this BL33 is encrypted, and how BL32 knows what the keys are? and what's the difference from the X96 having u-boot unencrypted..
and in this one, the BL33 is encrypted? How did 'Skyworth' decrypt the bootloader to patch it?
(I'll follow-up with a mega.nz link with the mecool image once it finishes uploading)
Here's the full emmc dump:
734.74 MB file on MEGA
mega.nz

---

LifelessLife said:
Mecool KM2 - Root
Hi
Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?
Looking for someone who help me root this device.
Code:
CPU: Amlogic S905X2 Quad Core ARM Cortex A53
GPU: ARM Mail-G31 MP2
OS: Android 10.0 ATV
Memory: DDR4 2GB, eMMC 8GB
Review: https://www.wirelesshack.org/review-mecool-km2-android-10-tv-box-2gb-ram-s905x2-cpu.html
Click to expand...
Click to collapse

---

Principal-McVicker said:
but at least I see the worldcup device, and connect with the burning tool...
Click to expand...
Click to collapse
Note that there are two types of worldcup connections. One is invoked entirely from bootrom, it is sometimes called usb download mode. It is sort of a DFU mode that has limited functionality.
In the uart console, a connection to this type of worldcup connection will look something like this;
Code:
G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:800;NAND:81;SD?:20000;USB:8
Note that nothing can be done using the burning tool, or the command-line update tool, with the above type of worldcup connection on the km2, due to download mode access being password protected on this device. Notwithstanding the fact that the usb burning tool will report the connection.
The second type of worldcup connection is invoked from an application in u-boot named "update". This type of worldcup connection can work with the usb burning tool or the command-line update tool. There is no password protection. In the uart console, a connection to this type of worldcup connection will look something like this;
Code:
InUsbBurn
wait for phy ready count is 0
[MSG]sof
Set Addr 1
Get DT cfg
Get DT cfg
Get DT cfg
set CFG
Get DT cfg
Get DT cfg

---

Principal-McVicker said:
I've been going through the AMLogic tools trying to understand where/how the encryption is done, but I don't understand yet how this BL33 is encrypted, and how BL32 knows what the keys are? and what's the difference from the X96 having u-boot unencrypted..
Click to expand...
Click to collapse
Read all of the stuff at the following link, starting from oldest to newest;
Code:
https://fredericb.info/tag/amlogic.html
Principal-McVicker said:
How did 'Skyworth' decrypt the bootloader to patch it?
Click to expand...
Click to collapse
Maybe it is not most correct to call it a "patch" I use that terminology because that is what skyworth uses. You'll see something like this in the uart console;
Code:
[sk_patch,24]amlogic's uboot for Android10().date:Apr 8 2021
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
[sk_usb_cfg_init,422]load file "/skyworth/factory_mode/uboot/check_udisk.cfg" from u disk failed!
[sk_boot,182]general boot.
Whatever skyworth does to u-boot, it is done at the source level before the bootloader is compiled.
Principal-McVicker said:
most of these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin... and it's coded into the AmLogic u-boot code is 'AMLOGIC_KEY' or something like that... so when you hold it... u-boot eventually see's it and halts, and starts up the usb device ***
This is much later then when doing the above, putting the CPU into usb-boot.. just FYI....
Click to expand...
Click to collapse
You can define the upgrade_key to be any gpio pin you like that is not otherwise used.
You can use GPIOA0_3, but I think skyworth also uses that for some usb power mode. I think I used GPIOA0_5, which is one of the pins on the uninstalled infrared led near the micro sd slot.
The factory location for the reset button is a side mounted smd switch below the microsd slot (opposite side of the board). In the fcc photo's this switch is actually installed along with some smd resistors near it. I never figured out what gpio pin it uses. But it could never work without being defined in the environment, which it is not!
What's your end goal here? Modifying the bootloader will be rough unless you can get the bootrom keys. If you don't modify the bootloader so that an unlocked status is recognized, you can't flash non-stock partitions.
If you just want root, that can be done with a workaround. If you want to use the device to boot an alternate operating system, this probably can be done, with a workaround.

---

G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:800;NAND:81;SD?:20000;USB:8
Note that nothing can be done using the burning tool, or the command-line update tool, with the above type of worldcup connection. Notwithstanding the fact that the usb burning tool will report the connection.
Click to expand...
Click to collapse
Heya,
Just wanted to clarify on this... that is the USB connection right from bootROM that I get... and the burning tool would work if I had the bootrom pwd, as this unit reports PWD is needed...
I just did this last night on a 'banana pi M5', which does not have a pwd locked bootrom, and I did the usb burn from this boot method, as it did not have any code on it whatsoever prior to me loading it....
Thanks for all of the info BTW, I'll read over it all, what I really wanted to know about was how that BL33 was encrypted... I'll get back if I have more questions, but I really appreciate all the info
My end goal was really just to understand what all of you already knew, I just couldn't get my head around all of it... I wanted to either just load another OS on this entirely, or figure out a way to hack the bootloader....

---

Principal-McVicker said:
Just wanted to clarify on this... that is the USB connection right from bootROM that I get... and the burning tool would work if I had the bootrom pwd, as this unit reports PWD is needed...
Click to expand...
Click to collapse
Right, in order to use usb download mode, you need the password (if one is employed).
But this is the very odd case use of a worldcup connection. Unheard of for end-user use.
End users use the reset button, which runs the u-boot "update" application to establish a more robust worldcup connection that can flash and read, and even run u-boot shell commands, without any password.

---

yeah, so I've been looking at compiling source, as its all up there for the banana pi, so I can play with all the pieces..
Is this skyworth info up in another thread here on this site?
Also, how did he actually write this re-compiled BL33 to the device? he re-program the flash and re-mount it? or just tap the lines and program in place?
Or, I'm taking a guess he may have used the unsigned loader exploit? I'm guessing that may not be patched in current bootROMs? or at least not all of them?

---

Principal-McVicker said:
these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin...
Click to expand...
Click to collapse
goapy said:
The factory location for the reset button is a side mounted smd switch below the microsd slot (opposite side of the board). In the fcc photo's this switch is actually installed along with some smd resistors near it. I never figured out what gpio pin it uses. But it could never work without being defined in the environment, which it is not!
Click to expand...
Click to collapse
Since you have an extra km2 with the x2 SoC removed, can you trace back the factory reset button traces to the gpio location on the SoC?
I tried finding it by shorting the traces, and using u-boot's gpio command to see which pins had a status change, but I still couldn't find which gpio pin is being used by the factory reset switch location.
Principal-McVicker said:
Here's the full emmc dump:
734.74 MB file on MEGA
mega.nz
Click to expand...
Click to collapse
Thanks for this. This contains version;
MECOOL/HP4035-Mecool/LAS:10/QTT5.200819.003/C2.0.6_20210723:user/release-keys
Although over a year old, it is 4 months newer than what I had.

---

Since you have an extra km2 with the x2 SoC removed, can you trace back the factory reset button traces to the gpio location on the SoC?
I tried finding it by shorting the traces, and using u-boot's gpio command to see which pins had a status change, but I still couldn't find which gpio pin is being used by the factory reset switch location.
Click to expand...
Click to collapse
Sure thing... I'll do this tonight when I get back home from work, no problem at all...
I think the first step I'd like to try with this thing is just get root? if possible... or at least do something fun to it...
(best way to try and really get a better understanding of this arm tee is to work on a fully locked implementation like this one)

---

Principal-McVicker said:
I think the first step I'd like to try with this thing is just get root? if possible... or at least do something fun to it...
Click to expand...
Click to collapse
Since doing this is a rather technical process and requires verbose instructions, I'll send the details via direct message.
Principal-McVicker said:
(best way to try and really get a better understanding of this arm tee is to work on a fully locked implementation like this one)
Click to expand...
Click to collapse
It might help to turn on full log level console output for the stock build. Then at least you'll see all of the tee interactions during bootup.

---

goapy said:
Since doing this is a rather technical process and requires verbose instructions, I'll send the details via direct message.
It might help to turn on full log level console output for the stock build. Then at least you'll see all of the tee interactions during bootup.
Click to expand...
Click to collapse
Heya, Ok... that would be great if you could PM me whatever you can help with...
I double-checked myself, as I thought maybe I missed a u-boot console, but I don't see one on this thing, I don't see any way for it to break into u-boot or any stage while it's booting up? nothing I hammer on the keyboard stops the process from what I can tell?
So, I was trying to identify which pads you are saying are for the smd switch.. but I waasn't totally sure, figured it would be faster to just post the top/bottom pics from that side, and you just circle the spot you want me to trace out?
(FYI, I took down my mega.nz link for the dump, since it sounds like you pulled it down, I hate leaving that stuff up for long unless someone else needs it, they can always PM me)

---

See attached image. The purple arrow identifies the pad that I want to trace.
But I just remembered that it is difficult to trace because it goes to a via to the opposite side of the board underneath the card slot.
I don't want to make work for you, I was just curious.