移动cm101s 救砖求思路
本帖最后由 山阴路的夏天 于 2018-3-7 17:22 编辑手里的cm101s突然变砖，开机卡中移动logo，用论坛的短接包刷机没任何反应。尝试ttl刷机，ptuuy跑码如下，无法输入命令
Bootrom start
Boot from eMMC
Starting fastboot ...
System startup
DDRS
Reg Version:v1.1.0
Reg Time: 2015-12-29 11:36:59
Reg Name: hi3798mdmo1g_hi3798mv100_ddr3_1gbyte_16bitx2_4layers_8Q40E_emmc.reg
Jump to DDR
Fastboot 3.3.0 (yuchangming@ubuntu) (Mar 23 2016 - 20:15:31)
Fastboot: Version 3.3.0
Build Date: Mar 23 2016, 20:16:37
CPU: Hi3798Mv100
Boot Media: eMMC
DDR Size: 1GB
Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
No NAND device found!!!
MMC/SD controller initialization.
MMC/SD Card:
MID: 0x70
Read Block:512 Bytes
Write Block: 512 Bytes
Chip Size: 7456M Bytes (High Capacity)
Name: "M3250"
Chip Type: MMC
Version: 4.0
Speed: 52000000Hz
Bus Width: 8bit
Boot Addr: 0 Bytes
HI_OTP_LockIdWord,327: ID_WORD have already been locked
SDK Version: HiSTBAndroidV600R001C00SPC063_v2016022921
begin
begin
partition addr :
BaseAddress:0x200000, DataSize:0x100000, offset:0x0, bytes:0xb10
cksum , ptable->checksum
data at 0xd1ec is ok
BaseAddress:0x300000, DataSize:0x100000, offset:0x0, bytes:0xb10
cksum , ptable->checksum
0 fastboot 0x000000000 0x000200000
0 partition 0x000200000 0x000200000
0 recovery 0x000400000 0x001000000
0 deviceinfo 0x001400000 0x000200000
0 baseparam 0x001600000 0x000800000
0 pqparam 0x001E00000 0x000800000
0 logo 0x002600000 0x000800000
0 fastplay 0x002E00000 0x002800000
0 boot 0x005600000 0x001000000
0 misc 0x006600000 0x000200000
0 userapi 0x006800000 0x000800000
0 hibdrv 0x007000000 0x000800000
0 qbflag 0x007800000 0x000800000
0 qbdata 0x008000000 0x012C00000
0 system 0x01AC00000 0x027000000
0 cache 0x041C00000 0x019000000
0 swdb 0x05AC00000 0x003000000
0 userdata 0x05DC00000 0x149C00000
ptable info:2M(fastboot),2M(partition),16M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),8M(logo),40M(fastplay),16M(boot),2M(misc),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),624M(system),400M(cache),48M(swdb),5276M(userdata)
ok
begin
deviceinfo addr :
BaseAddress:0x1400000, DataSize:0x100000, offset:0x0, bytes:0x514
start...
ok,checksum:0x194a
data at 0x001400000 is ok
count: name: value:
count: name: value:
count: name: value:
count: name: value:
ok
BaseAddress:0x5600000, DataSize:0x100000, offset:0x0, bytes:0x2000
tmp_cmdline:mem=1Gconsole=ttyAMA0,115200 blkdevparts=mmcblk0:
use boot cmdline,enable serial, cmdline:
get standard swstandard:1080p_50Hz g_auto_adp:0
bootargs:
sw_ir_detect_recovery begin500 count
sw_ir_detect_recovery ok
BaseAddress:0x6600000, DataSize:0x100000, offset:0x0, bytes:0x10000
boot normal!!!
bootimg now: mmc read 0 0x1FFFFC0 2b000 8000;bootimg 0x1FFFFC0
ok
SDK Version: HiSTBAndroidV600R001C00SPC063_v2016022921
Reserve Memory
Start Addr: 0xFFFE000
Bound Addr: 0x8D49000
FreeAddr: 0xE9C9000
Alloc Block:Addr Size
0xFBFD000 4194304
0xF8FC000 3145728
0xF8F9000 8192
0xF8C4000 212992
0xF7C3000 1048576
0xF7BF000 12288
0xF5FC000 1843200
0xF466000 1658880
0xF2A3000 1843200
0xE9CC000 9265152
0xE9C9000 8192
Hibernate!! drvphyaddr 0xFC00000
Hibernate!! user api phyaddr 0xF900000
Hibernate!! userapistart 0x6800000, size 0x800000
Hibernate!! drvstart 0x7000000, size 0x800000
Hibernate!! flag start 0x7800000, size 0x800000
Hibernate!! data start 0x8000000, size 0x12C00000
begin
open loader keyed
Press Ctrl+C to stop autoboot
MMC read: dev # 0, block # 176128, count 32768 ... 32768 blocks read: OK
87231101 Bytes/s
kernel@ 3e08000 (7855000 bytes)
ramdisk @ 4e00000 (649173 bytes)
page size @ 2048 bytes
initrd rd_start = 4e00000,rd_end = 4e9e7d5
## Booting kernel from Legacy Image at 020007c0 ...
Image Name: Linux-3.10.0_s40
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 7854936 Bytes = 7.5 MiB
Load Address: 02000000
Entry Point:02000000
XIP Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux... done, booting the kernel.
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 3.10.0_s40 (jenkins@Jenkins-CI03) (gcc version 4.4.1 (Hisilicon_v200(gcc4.4-290+glibc-2.11+eabi+nptl)) ) #1 SMP Tue Mar 22 18:34:35 CST 2016
[ 0.000000] CPU: ARMv7 Processor revision 5 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine: bigfish
[ 0.000000] cma: CMA: reserved 380 MiB at 28400000
[ 0.000000] cma: CMA: reserved 4 MiB at 28000000
[ 0.000000] Memory policy: ECC disabled, Data cache writealloc
[ 0.000000] CPU: Hi3798Mv100
[ 0.000000] PERCPU: Embedded 8 pages/cpu @81a90000 s12224 r8192 d12352 u32768
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on.Total pages: 260096
[ 0.000000] Kernel command line: mem=1Gconsole=ttyAMA0,115200 blkdevparts=mmcblk0:2M(fastboot),2M(partition),16M(recovery),2M(deviceinfo),8M(baseparam),8M(pqparam),8M(logo),40M(fastplay),16M(boot),2M(misc),8M(userapi),8M(hibdrv),8M(qbflag),300M(qbdata),624M(system),400M(cache),48M(swdb),5276M(userdata) androidboot.force_open_console=none androidboot.mac=08:A5:C8:5C:4D:E0 androidboot.standard=1080p_50Hz androidboot.serialno=004104162107181001F808A5C85C4DE0 mmz=ddr,0,0,380M
[ 0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[ 0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[ 0.000000] Memory: 1024MB = 1024MB total
[ 0.000000] Memory: 622388k/622388k available, 426188k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector: 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap: 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] vmalloc : 0xc0800000 - 0xff000000 (1000 MB)
[ 0.000000] lowmem: 0x80000000 - 0xc0000000 (1024 MB)
[ 0.000000] pkmap : 0x7fe00000 - 0x80000000 ( 2 MB)
[ 0.000000] modules : 0x7f000000 - 0x7fe00000 (14 MB)
[ 0.000000] .text : 0x80008000 - 0x80eea2ac (15241 kB)
[ 0.000000] .init : 0x80eeb000 - 0x80f5bfc0 ( 452 kB)
[ 0.000000] .data : 0x80f5c000 - 0x810a33c8 (1309 kB)
[ 0.000000] .bss : 0x810a33c8 - 0x8128961c (1945 kB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:192
[ 0.000000] sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 178956ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000199] Calibrating delay loop... 1949.69 BogoMIPS (lpj=974848)
[ 0.007044] pid_max: default: 32768 minimum: 301
[ 0.007199] Mount-cache hash table entries: 512
[ 0.007866] CPU: Testing write buffer coherency: ok
[ 0.007916] ftrace: allocating 33084 entries in 98 pages
[ 0.056310] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[ 0.056382] Setting up static identity map for 0x80b2fc08 - 0x80b2fc60
[ 0.065347] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[ 0.073346] CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
[ 0.081347] CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
[ 0.081430] Brought up 4 CPUs
[ 0.081447] SMP: Total of 4 processors activated (7829.50 BogoMIPS).
[ 0.081453] CPU: All CPU(s) started in SVC mode.
[ 0.109953] :DRV_PQ_GetFlashPqBin:PQ bin param may not burned
[ 0.109971] :HI_DRV_PQ_Init:Load PQBin failed!
[ 0.124376] :DispAddIntf:DISP 1 acquire(0) failed
[ 0.127835] :MCE_Init:ERR: get PDM Param
[ 0.128052] NET: Registered protocol family 16
[ 0.129437] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 0.130944] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[ 0.130955] hw-breakpoint: maximum watchpoint size is 8 bytes.
[ 0.131089] Serial: AMBA PL011 UART driver
[ 0.131165] uart:0: ttyAMA0 at MMIO 0xf8b00000 (irq = 81) is a PL011 rev2
[ 0.492321] console enabled
[ 0.496223] uart:1: ttyAMA1 at MMIO 0xf8006000 (irq = 82) is a PL011 rev2
[ 0.503227] uart:2: ttyAMA2 at MMIO 0xf8b02000 (irq = 83) is a PL011 rev2
[ 0.557456] bio: create slab <bio-0> at 0
[ 0.562566] SCSI subsystem initialized
[ 0.566929] usbcore: registered new interface driver usbfs
[ 0.572560] usbcore: registered new interface driver hub
[ 0.578029] usbcore: registered new device driver usb
[ 0.583503] Linux video capture interface: v2.00
[ 0.588862] Advanced Linux Sound Architecture Driver Initialized.
[ 0.595744] Bluetooth: Core ver 2.16
[ 0.599490] NET: Registered protocol family 31
[ 0.603941] Bluetooth: HCI device and connection manager initialized
[ 0.610316] Bluetooth: HCI socket layer initialized
[ 0.615200] Bluetooth: L2CAP socket layer initialized
[ 0.620269] Bluetooth: SCO socket layer initialized
[ 0.625770] Switching to clocksource timer3
[ 0.654390] NET: Registered protocol family 2
[ 0.659302] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[ 0.666503] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[ 0.673086] TCP: Hash tables configured (established 8192 bind 8192)
[ 0.679506] TCP: reno registered
[ 0.682747] UDP hash table entries: 512 (order: 2, 16384 bytes)
[ 0.688717] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[ 0.695292] NET: Registered protocol family 1
[ 0.699916] RPC: Registered named UNIX socket transport module.
[ 0.705859] RPC: Registered udp transport module.
[ 0.710575] RPC: Registered tcp transport module.
[ 0.715281] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.721899] Trying to unpack rootfs image as initramfs...
[ 0.767692] Freeing initrd memory: 632K (84e00000 - 84e9e000)
[ 0.773805] NetWinder Floating Point Emulator V0.97 (double precision)
[ 0.780398] CPU PMU: probing PMU on CPU 0
[ 0.784427] hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available
[ 0.804597] VFS: Disk quotas dquot_6.5.2
[ 0.808873] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 0.818407] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.826403] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 0.833101] fuse init (API version 7.22)
[ 0.837889] msgmni has been set to 1984
[ 0.843451] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[ 0.850860] io scheduler noop registered
[ 0.854793] io scheduler deadline registered (default)
[ 0.859956] io scheduler cfq registered
[ 0.872510] brd: module loaded
[ 0.879859] loop: module loaded
[ 0.883868] input: Hi keyboard as /devices/virtual/input/input0
[ 0.890187] input: Hi mouse as /devices/virtual/input/input1
[ 0.896143] input: qwerty as /devices/virtual/input/input2
[ 0.901647] Hi Android vinput driver init successful!
[ 0.907931] Found Nand Flash Controller V610.
[ 0.912637] Nand ID: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
[ 0.918324] No NAND device found
[ 0.921592] tun: Universal TUN/TAP device driver, 1.6
[ 0.926646] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 1.151636] libphy: himii: probed
[ 1.919835] Up port phy at 0x01 is connect
[ 1.944043] libphy: PHY himii:1f not found
[ 1.950470] PPP generic driver version 2.4.2
[ 1.955057] PPP BSD Compression module registered
[ 1.959774] PPP Deflate Compression module registered
[ 1.964839] PPP MPPE Compression module registered
[ 1.969636] NET: Registered protocol family 24
[ 1.974299] usbotg: usb otg driver registered[ 1.978537] usbcore: registered new interface driver cdc_wdm
[ 1.984371] usbcore: registered new interface driver usb-storage
[ 1.990678] usbcore: registered new interface driver usbserial
[ 1.996657] usbcore: registered new interface driver option
[ 2.002360] usbserial: USB Serial support registered for GSM modem (1-port)
[ 2.009401] dwc_otg: version 3.00a 10-AUG-2012
[ 2.052095] Core Release: 3.10a
[ 2.055253] Setting default values for core params
[ 2.072620] WARN::dwc_otg_core_reset:5176: dwc_otg_core_reset() HANG! Soft Reset GRSTCTL=80000001
[ 2.074126]
[ 2.196552] WARN::dwc_otg_core_reset:5176: dwc_otg_core_reset() HANG! Soft Reset GRSTCTL=80000001
[ 2.196552]
[ 2.307017] Using Buffer DMA mode
按Ctrl c可以进fastboot，使用hitool烧录emmc后问题依旧，开机卡logo，跑码进dma mode。
system分区文件已经尝试过4种了，至此进入死循环，求路过的大佬指点迷津啊啊{:140:}{:141:}
顶顶顶，求各位大佬指点一下吧 版主救救我
老铁666！必须支持一波！ {znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6}{znds6} fksbq 发表于 2017-9-28 01:23
顶顶顶，求各位大佬指点一下吧
完整的烧录包试过吗？或者可以试试强刷包刷成第三方
【新提醒】破解魔百盒cm101s不要TTL线了，直接刷机即可，简单有效_中国移动魔百盒https://www.znds.com/tv-622033-1-1.html hao501802766 发表于 2017-9-28 11:24
完整的烧录包试过吗？或者可以试试强刷包刷成第三方
【新提醒】破解魔百盒cm101s不要TTL线了，直接刷机即 ...
有人给我发过完整烧写包，烧玩连dma都进不去，短接包刚刷了没反应，{:134:} HI_OTP_LockIdWord,327: ID_WORD have already been locked
操作问题,导致锁定 Using Buffer DMA mode 无解 fksbq 发表于 2017-9-28 01:23
顶顶顶，求各位大佬指点一下吧
楼主，解决了吗？我的也这样了
页:
[1]
