Entering Mask Mode / Device Firmware Upgrade mode / Recovery with $2 Tiny88 - Android Stick & Console AMLogic based Computers

Entering mask mode aka device firmware upgrade mode (DFU) can be tricky on some Amlogic devices. Not all boxes come with a supported method to boot into DFU, and you end up having to open up the device to short the eMMC.
There's another Amlogic supported method of entering DFU, by sending a boot to USB message to the SOC through the HDMI port. It was first described using an ARM based Arduino board, later adapted for ATmega boards, and a compact all-in-one HDMI dongle. I prefer the HDMI dongle version (~$4-5), but it requires some skill to make and it won't work on any Amlogic devices that don't provide power to the HDMI port at device power-on.
Looking for the cheapest option, I recently bought an MH-ET LIVE Tiny88 for $2 /w free shipping on eBay, loaded it with the ATmega script and it worked like a charm. I'm including all the files needed to flash the Tiny88 to simplify the process for anyone else (Github mirror). Startup Linux (make a bootable USB with Ubuntu if you need), plug the Tiny88 into your computer with a microUSB cord, the red LED will flash indicating it's ready to be programmed.
To flash the Tiny88 to boot to USB (attach your computer) run:
Code:
sudo ./micronucleus --dump-progress filename i2c-flash_USB.hex
Or to have the Tiny88 boot the Amlogic box from the SDcard, flash it with:
Code:
sudo ./micronucleus --dump-progress filename i2c-flash_SDcard.hex
The Tiny88 needs to be wired to an HDMI connector:
Tiny88 pin A5 SCL (clock) to HDMI pin 15
Tiny88 pin A4 SDA (data) to HDMI pin 16
Tiny88 pin GND (ground) to HDMI pin 17
If you don't want to do any soldering, you can use an HDMI breakout board with screw-in contacts, and wrap the 3 wires around the Tiny88
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I used an old DVI-HDMI adapter I had
To use the device after it's flashed. Plug the device into the HDMI port of the Amlogic device, power the Tiny88 via it's USB port, wait 10sec for the red light to stop flashing, power on the Amlogic device, done.
Visit GitHub for resources and more details

---

Yes very good tips for cheap money! Wish I read this a couple of months ago. I way overpaid. I connected this to this. Paid over $10 and it took me a month to program it because I'm also very lazy. Something I learned is that a larger 24C eeprom can't be substituted for the 24C02 because the address change only works properly on the 02. Also if programming on windows it is easier to program before the jumper wire for the address change is put in. I couldn't get it to program on linux at all it was much easier for me on windows. I didn't know some devices don't supply power. Maybe that is why I couldn't get it to work on other devices. Is it known if this method works on any other certified devices besides the cube? Most every other device uses a password? Hopefully this cheap Tiny88 will make it super easy for others.

---

BigEmpty said:
Yes very good tips for cheap money! Wish I read this a couple of months ago. I way overpaid. I connected this to this.
Click to expand...
Click to collapse
Your dongle is probably more convenient to use, it reminds me of an easier to make version of this one. I saw that passthrough HDMI adapter on eBay and was wondering about it's capabilities and bandwidth. Can you leave that in and play 60fps HDR @ 4K, in YouTube for example? Any issues with DoVi at 4K with it left in? How long is your HDMI cable?
BigEmpty said:
I didn't know some devices don't supply power. Maybe that is why I couldn't get it to work on other devices. Is it known if this method works on any other certified devices besides the cube? Most every other device uses a password?
Click to expand...
Click to collapse
If the device has a SOC password it will still boot to USB, lsusb will show you ID 1b8e:c003 Amlogic, Inc, but SOC commands and flashing will be disabled until you enter the password. The TVBox manufacturer can also disable boot to USB by burning an eFuse (Amazon did this on the 2nd gen Cube with a firmware update) to permanently disable this recovery feature. If that happens, the TVbox will ignore the HDMI message and boot normally.
There are also at least a few devices that don't provide power to the HDMI port immediately (confirmed on the FireTV pendant and 3rd gen Cube). It's easy to tell with this HDMI dongle because it has an LED that indicates it's getting power. I don't know how common this is for Amlogic boxes, but it's something to keep in mind if your device isn't getting you into DFU. You can check pin18 with a multimeter on your HDMI breakout board to verify there is power on boot.
Yeah, I think at this point most certified boxes either ship with a SOC password or USB boot disabled, or a firmware update has been pushed out to do that.

---

Pro-me3us said:
Can you leave that in and play 60fps HDR @ 4K, in YouTube for example? Any issues with DoVi at 4K with it left in? How long is your HDMI cable?
Click to expand...
Click to collapse
I didn't try that yet. So far I've just left it in while booting in order to get root. I will try leaving it in and report back.
Pro-me3us said:
SOC commands and flashing will be disabled until you enter the password.
Click to expand...
Click to collapse
The usb software that runs the scripts doesn't have an option to try any password even if I had it. Is this correct?

---

BigEmpty said:
The usb software that runs the scripts doesn't have an option to try any password even if I had it. Is this correct?
Click to expand...
Click to collapse
Yeah, you can use Amlogic's update program, which my script runs.
Code:
./update password password.bin
password.bin just contains a password which I think is always 16characters (16byes)?
To quickly check if there is a SOC password, you can use pyamlboot (run this 2x):
Code:
python socid.py
Outputs something like:
Code:
Firmware Version :
ROM: 2.4 Stage: 0.0
Need Password: 1 Password OK: 0
Need Password: 1 indicates the SOC is password protected. After entering the correct password with update, the output of socid.py will be:
Code:
Need Password: 1 Password OK: 1

---

Pro-me3us said:
Yeah, you can use Amlogic's update program, which my script runs.
Code:
./update password password.bin
Click to expand...
Click to collapse
Amlogic's update program can talk to a device connected in USB Gadget or DFU mode? I see pyamlboot supports this but the update program does too? Is there a list of the supported functions of USB Gadget mode that involve no exploit? I read the supplied Amlogic PDF for the update program but it doesn't cover USB Gadget mode functions rather only the U-Boot functions of the update program.

---

BigEmpty said:
Amlogic's update program can talk to a device connected in USB Gadget or DFU mode?
Click to expand...
Click to collapse
Yeah, the update program can do a few things before hardware initialization (DFU mode), as well as after the bootloader is loaded. Documentation is skimpy, besides the PDF you can get a list of operations by just running ./update
Options are limited before hardware initialization. There is entering the SOC password, reading the SOC registers (./update rreg), getting the chip ID (./update chipid and ./update chipinfo). I'm sure there is a lot more that update can do in DFU that I'm not aware of, by sending commands to the bootrom.
Update can load Bl2 (./update write bl2.bin 0xfffa0000 and ./update run 0xfffa0000) separately from the rest of the bootloader Bl30-Bl33 (./update bl2_boot u-boot.bin), which is in part what the Cube script uses it for.

---

Pro-me3us said:
Update can load Bl2 (./update write bl2.bin 0xfffa0000 and ./update run 0xfffa0000) separately from the rest of the bootloader Bl30-Bl33 (./update bl2_boot u-boot.bin), which is in part what the Cube script uses it for.
Click to expand...
Click to collapse
Can an image of the entire original bootloader for some device be made into the Bl2 and Bl30-Bl33 parts just by splitting up the whole bootloader image appropriately? Assuming no changes are desired. Just to test how the update program works using these functions.

---

BigEmpty said:
Can an image of the entire original bootloader for some device be made into the Bl2 and Bl30-Bl33 parts just by splitting up the whole bootloader image appropriately? Assuming no changes are desired. Just to test how the update program works using these functions.
Click to expand...
Click to collapse
Sure, I think Bl2 is the first 65k of any G12a/b and SM1 bootloader. To write the first 65k (0x10000) of the bootloader to SRAM:
Code:
./update write u-boot.bin 0xfffa0000 0x10000
To run it in SRAM:
Code:
./update run 0xfffa0000
And to write and run the rest of the bootloader, which will then continue to load the kernel (boot.img) on the eMMC:
Code:
./update bl2_boot u-boot.bin
Note: this assumes the SOC run address is 0xfffa0000, which I again think is the same for all G12a/b and SM1 SOCs (can check the SOC data sheet to confirm).
BTW did you have a chance to test your HDMI passthrough breakout board? To see if you can play 60fps @ 4k HDR and DoVi? I want to get one if it does work.

---

Hi pleas Can you make it work on Attiny85

---

mazjed said:
Hi pleas Can you make it work on Attiny85
Click to expand...
Click to collapse
I've only tried the ATtiny88, but I would guess the original I2C program from Tchebb would work on the ATtiny85 as well. You would need to take his source and compile it for the ATtiny85 instead. I wrote out the steps for the ATtiny88 here that you can use as a guide.
The MH-ET LIVE Tiny88 was the cheapest AVR I found that can be programmed by a computer over USB. I'm not sure if you are working with a developer board that uses an ATTiny85 or the IC itself. If you are only working with the IC then you are going to need another board like an Arduino to program it, in which case it might be easier to just use Arduino board itself to send the [email protected] command to your Amlogic HDMI port.

---

Hi thank you for your effort and sharing .
Actually i have some Digispark attiny85 its very cheap
And my plan is to combined it with this adapter
To make a mini hacking tool
It would be more advanced in future than the Amlogic HDMI Boot Dongle
thanks again for you and Tchebb to make it happen.

---

Ok, I tried to quickly recompile the program for the ATtiny85, but I got errors. It looks like the ATtiny85 doesn't have TWI, and uses a TWI mode implemented through USI. Basically this means that Tchebb's program would have to be modified to work with the ATtiny85. I'm not sure how much work would be involved in doing that. You could ask Tchebb his thoughts over on his github page.
Does the ATtiny85 have an advantage in your case over the ATtiny88? The are both around the same price. What would you be able to do with the ATtinys that you can't do with Superna9999's HDMI dongle?