斐讯N1救砖记之TTL大法
本帖最后由 Pretender. 于 2019-9-17 14:19 编辑变砖过程
先前刷的CoreELEC9.0.2版本，想升级9.0.3。这个时候9.0.3的优盘已做好，错误的插在了N1靠近HDMI的USB插口，ssh输入命令reboot update，然后去N1那里看，出错了！再重启就卡在开机画面不动了，感觉是砖了……{:141:}
总结
降级、刷错包、刷机时断电，都可能变砖。
工具
电烙铁和焊锡、公母、公公头杜邦线若干、排针、镊子、螺丝刀等拆机工具
RX - TX
TX - RX
GND - GND
用USB转串口，连接电脑，设置串口号（设备管理器中查看）和波特率115200
https://cdn.iyuu.cn/usr/uploads/2019/09/2954444808.png
盒子上电看到串口打印信息（论坛玩家说，有回显说明没真砖，BootLoader还在）。
进入Uboot命令行：uboot命令行的启动方式，板子启动后在PC端的putty界面中通过串口快速按任意键或者输入ctrl+c，即可进入uboot命令行模式。
用户由p230# 变成了 gxl_p230_v1#
在这个模式下，将N1降级恢复线刷的3个文件boot.img、bootloader.img、recovery.img三个文件拷到一个fat32格式的U盘中，（U盘必须是单分区的），一定要确定文件，没有问题，必须是v2.19版本的。
将U盘插入N1盒子，putty中逐条输入如下三条命令更新系统boot：usb_updatebootloader bootloader.imgusb_updaterecovery recovery.imgusb_updatebootboot.img逐条执行命令后，串口返回的信息：usb_update bootloader bootloader.img 执行返回：gxl_p230_v1#usb_updatebootloader bootloader.img
usb_start_count 0
(Re)start USB...
USB0: USB3.0 XHCI init start
Register 2000140 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
scanning usb for storage devices... init_part() 278: PART_TYPE_DOS
1 Storage Device(s) found
Filesize is 0xa4200B
0x:leftSz 2000 < BPS 4000, gotSz 2000
Down(store) part(bootloader) sz(0xa4200) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 11
Filesize is 0xa4200B
0x:leftSz 200 < BPS 4000, gotSz 4200
Burn Start...
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
align bootloader sz from 0xa4200 to 0xa8000
Burn complete
BURN bootloader.img to part bootloader OK!usb_update recovery recovery.img 执行返回：gxl_p230_v1#usb_updaterecovery recovery.img
usb_start_count 1
Filesize is 0x1172a00B
0x:leftSz 2000 < BPS 4000, gotSz 2000
flash LOGIC partCap 0x2000000B
Down(store) part(recovery) sz(0x1172a00) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 1
Filesize is 0x1172a00B
Burn Start...
0x:leftSz 2a00 < BPS 4000, gotSz 2a00
Burn complete
BURN recovery.img to part recovery OK!
=====>Burn part recovery in fmt normal OK<======usb_update boot boot.img 执行返回：gxl_p230_v1#usb_updatebootboot.img
usb_start_count 1
Filesize is 0xd88a00B
0x:leftSz 2000 < BPS 4000, gotSz 2000
flash LOGIC partCap 0x2000000B
Down(store) part(boot) sz(0xd88a00) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 1
Filesize is 0xd88a00B
Burn Start...
0x:leftSz a00 < BPS 4000, gotSz 8a00
Burn complete
BURN boot.img to part boot OK!
=====>Burn part boot in fmt normal OK<======
gxl_p230_v1#如图：
降级3个文件后，如果还是不能通过网络进入线刷模式或者短接触点刷机依然失败的，可以继续看！终极TTL大法N1通过USB转串口和双公头线同时连接电脑，putty进入uboot命令行模式后，打开刷机工具选好刷机包，点击开始！
在uboot命令行，可以通过putty输入
update串口返回信息见下面。
刷机开始，祝您成功！！！2019年9月11日补充：**** Hidden Message *****救砖成功记录gxl_p230_v1#update
InUsbBurn
sof
Set Addr 14
Get DT cfg
Get DT cfg
Get DT cfg
set CFG
ID
BULKcmd
Down(mem) part(0xc8100228) sz(0x4) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 0
success
Burn Start...
Burn complete
ID
tplcmd[ echo 12345]
12345
ret = 0
success
BULKcmd[ low_power]
success
ID
tplcmd[ download mem dtb normal 89120]
Down(mem) part(dtb) sz(0x15c20) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 2
success
Burn Start...
load dt.img to 0x0000000001000000, sz=0x15c20
Burn complete
BULKcmd
success
BULKcmd
Exit before re-init
command: storeexit
dtb magic 71b104da
aml log : R2048 check pass!
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
start dts,buffer=0000000001000000,dt_addr=000000000100b000
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
parts: 10
00: logo 0000000002000000 1
01:recovery 0000000002000000 1
02: rsv 0000000000800000 1
03: tee 0000000000800000 1
04: crypt 0000000002000000 1
05: misc 0000000002000000 1
06: boot 0000000002000000 1
07: system 0000000050000000 1
08: cache 0000000020000000 2
09: data ffffffffffffffff 4
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
mmc init success
switch to partitions #0, OK
mmc1(part 0) is current device
Device: SDIO Port C
Manufacturer ID: 15
OEM: 100
Name: 8GTF4
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.1
High Capacity: Yes
Capacity: 7.3 GiB
mmc clock: 40000000
Bus Width: 8-bit
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
success
ID
tplcmd
Down(store) part(_aml_dtb) sz(0x15c20) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 2
success
Burn Start...
optimus_download_dtb_image:dataSzReceived=0x15c20
start erase dtb......
start = 81920,end = 82943
dev # 1,, several blocks erased OK
To run cmd
dtb_write()-1140: valid 2
dtb_write()-1160: new stamp 3, checksum 0x96094b56, version 1, magic A~D
dtb magic 71b104da
aml log : R2048 check pass!
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
start dts,buffer=0000000007700000,dt_addr=000000000770b000
dtb magic 5f4c4d41
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
start dts,buffer=0000000007700000,dt_addr=000000000770b000
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p230 variant: 2g
dtb 0 soc: gxl plat: p230 vari: 1g
dtb 1 soc: gxl plat: p230 vari: 2g
Find match dtb: 1
parts: 10
00: logo 0000000002000000 1
01:recovery 0000000002000000 1
02: rsv 0000000000800000 1
03: tee 0000000000800000 1
04: crypt 0000000002000000 1
05: misc 0000000002000000 1
06: boot 0000000002000000 1
07: system 0000000050000000 1
08: cache 0000000020000000 2
09: data ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
partition table success
Burn complete
BULKcmd
success
BULKcmd
To run cmd
dtb_read_shortcut()-975: short cut in...
VERIFY OK
success
ID
tplcmd
flash LOGIC partCap 0x2000000B
Down(store) part(boot) sz(0xd88a00) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 1
success
Burn Start...
Burn complete
BULKcmd
success
BULKcmd
Verify Start...
To verify part boot in fmt normal
Verify End
VERIFY OK
success
ID
tplcmd
flash LOGIC partCap 0x14ac00000B
Down(store) part(data) sz(0xe808b08) fmt(sparse)
totalSlotNum = 0, nextWriteBackSlot 1024
success
Burn Start...
Burn complete
BULKcmd
success
BULKcmd
Verify Start...
To verify part data in fmt sparse
Verify End
VERIFY OK
success
ID
tplcmd
flash LOGIC partCap 0x2000000B
Down(store) part(logo) sz(0x11b5c0) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 1
success
Burn Start...
Burn complete
BULKcmd
success
BULKcmd
Verify Start...
To verify part logo in fmt normal
Verify End
VERIFY OK
success
ID
tplcmd
flash LOGIC partCap 0x2000000B
Down(store) part(recovery) sz(0x1172a00) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 1
success
Burn Start...
Burn complete
BULKcmd
success
BULKcmd
Verify Start...
To verify part recovery in fmt normal
Verify End
VERIFY OK
success
ID
tplcmd
flash LOGIC partCap 0x50000000B
Down(store) part(system) sz(0x436c4e38) fmt(sparse)
totalSlotNum = 0, nextWriteBackSlot 1024
success
Burn Start...
Burn complete
Downloading %100
BULKcmd
success
BULKcmd
Verify Start...
To verify part system in fmt sparse
Verify End
VERIFY OK
success
ID
tplcmd
Down(store) part(bootloader) sz(0xa4200) fmt(normal)
totalSlotNum = 0, nextWriteBackSlot 11
success
Burn Start...
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
align bootloader sz from 0xa4200 to 0xa8000
Burn complete
BULKcmd
success
BULKcmd
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
VERIFY OK
success
BULKcmd
Set upgrade_step to 1
Saving Environment to aml-storage...
mmc env offset: 0x27400000
Writing to MMC(1)... done
success
BULKcmd
Pls un-plug USB line to poweroff
success分享网友：大卫科技Blog如果觉着内容不错，请给小编留言评论点个赞~如果想要了解更多相关资讯，欢迎下载ZNDS智能电视网APP（下载地址：https://www.znds.com/downapp.html）
https://data.znds.com/attachment/album/201908/05/182846izjhz54zajhqmgg8.jpg
感谢分享 高难度，牛逼了 先把机器刷成砖，再把砖头刷成机器，我都佩服自己在ZNDS学到的刷机技术！ b4el 学习学习！ 老铁666！必须支持一波！ 谢谢分享 看看 先把机器刷成砖，再把砖头刷成机器，我都佩服自己在ZNDS学到的刷机技术！
