|
|
寫(xiě)在前面
朋友發(fā)了臺(tái)天貓魔盒M17變形金剛定制版過(guò)來(lái)說(shuō)看能不能玩，網(wǎng)上找了個(gè)遍也沒(méi)有刷機(jī)包和刷機(jī)教程，今天就給大家分享一下
e65a4c7082dc2804544de5c8c4c4a34.jpg (54.99 KB, 下載次數(shù): 448)
下載附件
保存到相冊(cè)
2021-8-21 17:06 上傳
進(jìn)入正題
I.準(zhǔn)備工具
天貓魔盒M17、USB轉(zhuǎn)串口工具(如：CH341)、電烙鐵、連接線
II.連接
1.拆機(jī)
首先拆開(kāi)天貓魔盒M17，找到以下串口連接點(diǎn)
微信圖片_20210821155808.jpg (285.4 KB, 下載次數(shù): 452)
下載附件
保存到相冊(cè)
2021-8-22 08:52 上傳
上面4個(gè)點(diǎn)從上到下是接地、發(fā)送信號(hào)、接收信號(hào)、3.3V供電。天貓魔盒M17還預(yù)留了FPGA調(diào)試接口，可以用CH341通過(guò)SPI方式或用J-LINK通過(guò)JATG方式來(lái)連電腦進(jìn)行調(diào)試，如發(fā)指令操作CPU和讀寫(xiě)EMMC，同時(shí)還支持從HDMI連接URAT串口，實(shí)現(xiàn)免拆機(jī)連PUTTY等串口工具。這點(diǎn)在分析天貓魔盒M17的開(kāi)機(jī)打印信息可以看到：disable A53 JTAG EE
[ 0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[ 0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
因?yàn)槲矣玫氖侵边B的串口，沒(méi)有連接其它接口方式，所以JTAG顯示disable，也沒(méi)找到hdmirx，有興趣的小伙伴可以試下
HDMI轉(zhuǎn)URAT串口常見(jiàn)的兩種接法是：
1： 15：RX、16：TX、17：GND
2： 2：RX、14：TX、17：GND
JATG連接的話就更高級(jí)了，如果說(shuō)一臺(tái)機(jī)子CPU是老大，EMMC是老二，那JATG就是幕后老大，可以直接用指令接管和指揮CPU和讀寫(xiě)EMMC
2.焊接
一頭接M17串口連接點(diǎn)，一頭接CH341，注意兩頭TX和RX要調(diào)換過(guò)來(lái)。M17上插一個(gè)U盤(pán)，最好是USB2.0版
GND(機(jī)頂盒) -> GND(轉(zhuǎn)接器)
TXD(機(jī)頂盒) -> RXD(轉(zhuǎn)接器)
RXD(機(jī)頂盒) -> TXD(轉(zhuǎn)接器)
3.3V供電不用連接，使用機(jī)頂盒自帶供電即可
微信圖片_20210821155816.jpg (437.15 KB, 下載次數(shù): 481)
下載附件
保存到相冊(cè)
2021-8-21 16:36 上傳
3.連串口
CH341插電腦裝好驅(qū)動(dòng)，查端口，右鍵這個(gè)設(shè)備-屬性-端口設(shè)置，看是COM？比如COM3
這個(gè)設(shè)備的端口號(hào)是3 （COM3），記住這個(gè)數(shù)字。
打開(kāi)PUTTY
選擇連接類型為Serial，填好端口號(hào)和速率就行。
165140vjcc8baj456y8ezv.png (39.81 KB, 下載次數(shù): 436)
下載附件
保存到相冊(cè)
2021-8-22 09:07 上傳
點(diǎn)打開(kāi)以后，給機(jī)頂盒通電，PUTTY 會(huì)刷屏輸出，這些是天貓魔盒M17的開(kāi)機(jī)命令過(guò)程信息，以下是開(kāi)機(jī)流程刷屏打印的信息，有需要的小伙伴可以拿去分析魔盒M17的開(kāi)機(jī)流程：
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125395
BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(debug):46845bf
NOTICE: BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.668743 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01 (Jul 06 2020 - 22:15:28)
DRAM: 1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125393
BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(debug):46845bf
NOTICE: BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.669671 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01 (Jul 06 2020 - 22:15:28)
DRAM: 1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =33f4f440
copy done
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
load dtb from 0x3478d440 ......
Uncompressing Kernel Image ... OK
kernel loaded at 0x01080000, end = 0x01ea8040
Loading Ramdisk to 33c99000, end 33eb8000 ... OK
Loading Device Tree to 000000001fff3000, end 000000001ffffc2f ... OK
fdt_instaboot: no instaboot image
Starting kernel ...
uboot time: 2850185 us
[ 0.562839] c0 1 (swapper/0) Initramfs unpacking failed: junk in compressed archive
INFO: HDCP22 key read fail!
INFO: p1d 0
INFO: pd1 0
[ 0.801670] c1 1 (swapper/0) PPMGRDRV: err: ppmgr_driver_probe called
[ 0.810306] c1 1 (swapper/0) don't find match flag_cma
[ 0.810381] c1 1 (swapper/0) vdin_drv_probe: vdin cannot get msr clk !!!
[ 0.816575] c1 6 (kworker/u8:0) sdio: error -22 whilst initialising SDIO card
[ 0.832038] c1 1 (swapper/0) m1-adckp adc_keypad.48: adc_key: faild to get name_len!
disable A53 JTAG EE
[ 0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[ 0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
[ 1.059435] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTL
[ 1.062732] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTL -> direct -> Ext Spk
[ 1.072960] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTR
[ 1.081814] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTR -> direct -> Ext Spk
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000036
[ ?[ 1.635241] c1 1 (init) init: loading selinux policy
[ 1.793038] c1 1 (init) alisec selinux: selinux_version stat fail
[ 1.797148] c1 1 (init) alisec selinux: selinux_version stat fail
[ 1.800106] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[ 1.840248] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[ 1.848860] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[ 2.556465] c3 1 (init) hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 2.561160] c3 1 (init) init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[ 2.568328] c3 1 (init) init: cannot expan[ 2.586857] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[ 2.590271] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[ 2.601025] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[ 2.609971] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[ 2.838316] c1 6 (kworker/u8:0) sdio: error -110 whilst initialising MMC card
[ 2.875071] c0 3365 (init) fs_mgr: Warning: unknown flag discard
[ 3.477290] c3 1 (init) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[ 3.479804] c3 1 (init) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files, new 0 files||
[ 3.681346] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.682328] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.691570] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.694247] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[ 3.795178] c1 1 (init) init: Warning! Service check_dolby_dts needs a SELinux domain defined; please fix!
[ 3.799979] c1 1 (init) init: Warning! Service check_submodel needs a SELinux domain defined; please fix!
[ 3.872523] c3 3400 (check_submodel.) amlkey_init() 129: already init!
[ 3.874252] c1 3412 (check_submodel.) amlkey_size() 229: ret 1
[ 3.879462] c1 3412 (check_submodel.) read_show() 975: key product_sub_model may not burned yet!
[ 3.906722] c0 1 (init) init: Warning! Service load_wifidriver needs a SELinux domain defined; please fix!
root@MagicBox_M17:/ # [ 3.933489] c0 1 (init) init: cannot find '/system/bin/fh_recv', disabling 'fh_recv'
[ 3.936694] c0 1 (init) init: process 'remotecfg', pid 3431 exited
[ 3.943137] c2 3432 (pppoe_wrapper) alisec selinux: selinux_version stat fail
[ 3.960260] c3 1 (init) init: process 'check_submodel', pid 3400 exited
[ 3.977270] c3 1 (init) init: process 'preload', pid 3449 exited
[ 3.997683] c3 3406 (vold) fs_mgr: Warning: unknown flag discard
[ 4.005801] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[ 4.008838] c3 3406 (vold) dig: dig start!
[ 4.014629] c2 1 (init) init: process 'check_dolby_dts', pid 3399 exited
[ 4.073237] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files, new 0 files||
[ 4.124024] c0 1 (init) init: process 'uuid_init', pid 3446 exited
[ 4.639739] c2 1 (init) init: process 'flash_recovery', pid 3426 exited
[ 4.816311] c0 3402 (healthd) healthd: No charger supplies found
[ 6.126340] c2 1 (init) init: process 'low_mem', pid 3429 exited
[ 7.465267] c3 3803 (rtk_wifi_driver) amlkey_size() 229: ret 1
[ 7.465479] c3 3803 (rtk_wifi_driver) read_show() 975: key mac_wifi may not burned yet!
[ 7.510449] c2 1 (init) init: process 'load_wifidriver', pid 3444 exited
可以等輸出完成或者按ctrl+c強(qiáng)行停止。
可以看見(jiàn)下圖已經(jīng)可以輸入命令了，并且是root賬戶：root@MagicBox_M17:/#
微信圖片_20210821155756.jpg (133.21 KB, 下載次數(shù): 463)
下載附件
保存到相冊(cè)
2021-8-21 16:48 上傳
III.備份和刷機(jī)
輸入setenforce 0，關(guān)閉SElinux，現(xiàn)在你就可以對(duì)天貓魔盒M17為所欲為了。
輸入cd /dev/block/platform/d0074000.emmc進(jìn)入分區(qū)表
示例system分區(qū)的備份和刷機(jī)，其它分區(qū)同樣操作：
- 輸入df：查詢U盤(pán)掛載的路徑是不是/mnt/media_rw/udisk0，如果不是請(qǐng)自行調(diào)整以下命令里的路徑
- dd if=system of=/mnt/media_rw/udisk0/system.img：備份固件到U盤(pán)
- 可以用ROM助手修改DIY備份出來(lái)的固件
- 輸入 dd if=/mnt/media_rw/udisk0/system.img of=system：從U盤(pán)讀取system.img固件，刷入system分區(qū)
我把主要的分區(qū)備份出來(lái)了，有需要的小伙伴可以拿去玩：
鏈接：https://pan.baidu.com/s/19a4jLqQWYbnHAmv4MX8dFg
提取碼：r6j3
![]()
后面會(huì)更新更詳細(xì)的實(shí)操視頻教程，記得點(diǎn)贊關(guān)注哦~~~
好了，今天分享的內(nèi)容就這么多，關(guān)于電子拆修你是手殘黨嗎？歡迎留下你的評(píng)論！
-END-
|
評(píng)分
-
查看全部評(píng)分
上一篇： 求天貓魔盒M13閃存?zhèn)浞?，或者線刷救磚固件下一篇： 天貓魔盒6系統(tǒng)更新后，電視機(jī)沒(méi)有聲音
|
網(wǎng)站導(dǎo)航
[復(fù)制鏈接]
發(fā)表于 2021-8-21 17:17
收藏
淘帖
頂一個(gè)
踩
提升卡
置頂卡
變色卡
千斤頂
來(lái)自 2#
樓主
znds.com 