|
|
写在前面
朋友发了台天猫魔盒M17变形金刚定制版过来说看能不能玩，网上找了个遍也没有刷机包和刷机教程，今天就给大家分享一下
进入正题
I.准备工具
天猫魔盒M17、USB转串口工具(如：CH341)、电烙铁、连接线
II.连接
1.拆机
首先拆开天猫魔盒M17，找到以下串口连接点
上面4个点从上到下是接地、发送信号、接收信号、3.3V供电。天猫魔盒M17还预留了FPGA调试接口，可以用CH341通过SPI方式或用J-LINK通过JATG方式来连电脑进行调试，如发指令操作CPU和读写EMMC，同时还支持从HDMI连接URAT串口，实现免拆机连PUTTY等串口工具。这点在分析天猫魔盒M17的开机打印信息可以看到：disable A53 JTAG EE
[ 0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[ 0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
因为我用的是直连的串口，没有连接其它接口方式，所以JTAG显示disable，也没找到hdmirx，有兴趣的小伙伴可以试下
HDMI转URAT串口常见的两种接法是：
1： 15：RX、16：TX、17：GND
2： 2：RX、14：TX、17：GND
JATG连接的话就更高级了，如果说一台机子CPU是老大，EMMC是老二，那JATG就是幕后老大，可以直接用指令接管和指挥CPU和读写EMMC
2.焊接
一头接M17串口连接点，一头接CH341，注意两头TX和RX要调换过来。M17上插一个U盘，最好是USB2.0版
GND(机顶盒) -> GND(转接器)
TXD(机顶盒) -> RXD(转接器)
RXD(机顶盒) -> TXD(转接器)
3.3V供电不用连接，使用机顶盒自带供电即可
3.连串口
CH341插电脑装好驱动，查端口，右键这个设备-属性-端口设置，看是COM？比如COM3
这个设备的端口号是3 （COM3），记住这个数字。
打开PUTTY
选择连接类型为Serial，填好端口号和速率就行。
点打开以后，给机顶盒通电，PUTTY 会刷屏输出，这些是天猫魔盒M17的开机命令过程信息，以下是开机流程刷屏打印的信息，有需要的小伙伴可以拿去分析魔盒M17的开机流程：
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125395
BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(debug):46845bf
NOTICE: BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.668743 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01 (Jul 06 2020 - 22:15:28)
DRAM: 1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125393
BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08
set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE: BL3-1: v1.0(debug):46845bf
NOTICE: BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.669671 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9
U-Boot 2015.01 (Jul 06 2020 - 22:15:28)
DRAM: 1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
Net: dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system
Usage:
saradc saradc open <channel> - open a SARADC channel
saradc close - close the SARADC
saradc getval - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =33f4f440
copy done
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
load dtb from 0x3478d440 ......
Uncompressing Kernel Image ... OK
kernel loaded at 0x01080000, end = 0x01ea8040
Loading Ramdisk to 33c99000, end 33eb8000 ... OK
Loading Device Tree to 000000001fff3000, end 000000001ffffc2f ... OK
fdt_instaboot: no instaboot image
Starting kernel ...
uboot time: 2850185 us
[ 0.562839] c0 1 (swapper/0) Initramfs unpacking failed: junk in compressed archive
INFO: HDCP22 key read fail!
INFO: p1d 0
INFO: pd1 0
[ 0.801670] c1 1 (swapper/0) PPMGRDRV: err: ppmgr_driver_probe called
[ 0.810306] c1 1 (swapper/0) don't find match flag_cma
[ 0.810381] c1 1 (swapper/0) vdin_drv_probe: vdin cannot get msr clk !!!
[ 0.816575] c1 6 (kworker/u8:0) sdio: error -22 whilst initialising SDIO card
[ 0.832038] c1 1 (swapper/0) m1-adckp adc_keypad.48: adc_key: faild to get name_len!
disable A53 JTAG EE
[ 0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[ 0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
[ 1.059435] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTL
[ 1.062732] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTL -> direct -> Ext Spk
[ 1.072960] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTR
[ 1.081814] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTR -> direct -> Ext Spk
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000036
[ ▒[ 1.635241] c1 1 (init) init: loading selinux policy
[ 1.793038] c1 1 (init) alisec selinux: selinux_version stat fail
[ 1.797148] c1 1 (init) alisec selinux: selinux_version stat fail
[ 1.800106] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[ 1.840248] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[ 1.848860] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[ 2.556465] c3 1 (init) hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 2.561160] c3 1 (init) init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[ 2.568328] c3 1 (init) init: cannot expan[ 2.586857] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[ 2.590271] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[ 2.601025] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[ 2.609971] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[ 2.838316] c1 6 (kworker/u8:0) sdio: error -110 whilst initialising MMC card
[ 2.875071] c0 3365 (init) fs_mgr: Warning: unknown flag discard
[ 3.477290] c3 1 (init) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[ 3.479804] c3 1 (init) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files, new 0 files||
[ 3.681346] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.682328] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.691570] c1 1 (init) alisec selinux: selinux_version stat fail
[ 3.694247] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[ 3.795178] c1 1 (init) init: Warning! Service check_dolby_dts needs a SELinux domain defined; please fix!
[ 3.799979] c1 1 (init) init: Warning! Service check_submodel needs a SELinux domain defined; please fix!
[ 3.872523] c3 3400 (check_submodel.) amlkey_init() 129: already init!
[ 3.874252] c1 3412 (check_submodel.) amlkey_size() 229: ret 1
[ 3.879462] c1 3412 (check_submodel.) read_show() 975: key product_sub_model may not burned yet!
[ 3.906722] c0 1 (init) init: Warning! Service load_wifidriver needs a SELinux domain defined; please fix!
root@MagicBox_M17:/ # [ 3.933489] c0 1 (init) init: cannot find '/system/bin/fh_recv', disabling 'fh_recv'
[ 3.936694] c0 1 (init) init: process 'remotecfg', pid 3431 exited
[ 3.943137] c2 3432 (pppoe_wrapper) alisec selinux: selinux_version stat fail
[ 3.960260] c3 1 (init) init: process 'check_submodel', pid 3400 exited
[ 3.977270] c3 1 (init) init: process 'preload', pid 3449 exited
[ 3.997683] c3 3406 (vold) fs_mgr: Warning: unknown flag discard
[ 4.005801] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[ 4.008838] c3 3406 (vold) dig: dig start!
[ 4.014629] c2 1 (init) init: process 'check_dolby_dts', pid 3399 exited
[ 4.073237] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files, new 0 files||
[ 4.124024] c0 1 (init) init: process 'uuid_init', pid 3446 exited
[ 4.639739] c2 1 (init) init: process 'flash_recovery', pid 3426 exited
[ 4.816311] c0 3402 (healthd) healthd: No charger supplies found
[ 6.126340] c2 1 (init) init: process 'low_mem', pid 3429 exited
[ 7.465267] c3 3803 (rtk_wifi_driver) amlkey_size() 229: ret 1
[ 7.465479] c3 3803 (rtk_wifi_driver) read_show() 975: key mac_wifi may not burned yet!
[ 7.510449] c2 1 (init) init: process 'load_wifidriver', pid 3444 exited
可以等输出完成或者按ctrl+c强行停止。
可以看见下图已经可以输入命令了，并且是root账户：root@MagicBox_M17:/#
III.备份和刷机
输入setenforce 0，关闭SElinux，现在你就可以对天猫魔盒M17为所欲为了。
输入cd /dev/block/platform/d0074000.emmc进入分区表
示例system分区的备份和刷机，其它分区同样操作：
- 输入df：查询U盘挂载的路径是不是/mnt/media_rw/udisk0，如果不是请自行调整以下命令里的路径
- dd if=system of=/mnt/media_rw/udisk0/system.img：备份固件到U盘
- 可以用ROM助手修改DIY备份出来的固件
- 输入 dd if=/mnt/media_rw/udisk0/system.img of=system：从U盘读取system.img固件，刷入system分区
我把主要的分区备份出来了，有需要的小伙伴可以拿去玩：
链接：https://pan.baidu.com/s/19a4jLqQWYbnHAmv4MX8dFg
提取码：r6j3
![]()
后面会更新更详细的实操视频教程，记得点赞关注哦~~~
好了，今天分享的内容就这么多，关于电子拆修你是手残党吗？欢迎留下你的评论！
-END-
|
评分
-
查看全部评分
上一篇： 求天猫魔盒M13闪存备份，或者线刷救砖固件下一篇： 天猫魔盒6系统更新后，电视机没有声音
|
网站导航
[复制链接]
发表于 2021-8-21 17:17
收藏
淘帖
顶一个
踩
提升卡
置顶卡
变色卡
千斤顶
来自 2#
楼主
znds.com 