ZNDS智能电视网 推荐当贝市场

TV应用下载 / 资源分享区

软件下载 | 游戏 | 讨论 | 社区App下载

综合交流 / 评测 / 活动区

交流区 | 测硬件 | 网站活动 | Z币中心

新手入门 / 进阶 / 社区互助

新手 | 你问我答 | 免费刷机救砖 | ROM固件

查看: 42954|回复: 54
[刷机固件]

天猫魔盒M17连接串口TTL获取root权限的ADB备份固件和刷机教程

  [复制链接]
发表于 2021-8-21 17:17 | 显示全部楼层 |阅读模式
本帖最后由 xoukar123 于 2021-8-22 09:37 编辑

写在前面
朋友发了台天猫魔盒M17变形金刚定制版过来说看能不能玩,网上找了个遍也没有刷机包和刷机教程,今天就给大家分享一下


e65a4c7082dc2804544de5c8c4c4a34.jpg

进入正题


I.准备工具

天猫魔盒M17、USB转串口工具(如:CH341)、电烙铁、连接线

II.连接

1.拆机
首先拆开天猫魔盒M17,找到以下串口连接点
微信图片_20210821155808.jpg

上面4个点从上到下是接地、发送信号、接收信号、3.3V供电。天猫魔盒M17还预留了FPGA调试接口,可以用CH341通过SPI方式或用J-LINK通过JATG方式来连电脑进行调试,如发指令操作CPU和读写EMMC,同时还支持从HDMI连接URAT串口,实现免拆机连PUTTY等串口工具。这点在分析天猫魔盒M17的开机打印信息可以看到:disable A53 JTAG EE
[    0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[    0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
因为我用的是直连的串口,没有连接其它接口方式,所以JTAG显示disable,也没找到hdmirx,有兴趣的小伙伴可以试下
HDMI转URAT串口常见的两种接法是:
1:   15:RX、16:TX、17:GND
2:     2:RX、14:TX、17:GND
JATG连接的话就更高级了,如果说一台机子CPU是老大,EMMC是老二,那JATG就是幕后老大,可以直接用指令接管和指挥CPU和读写EMMC
2.焊接
一头接M17串口连接点,一头接CH341,注意两头TX和RX要调换过来。M17上插一个U盘,最好是USB2.0版
GND(机顶盒) -> GND(转接器)
TXD(机顶盒) -> RXD(转接器)
RXD(机顶盒) -> TXD(转接器)
3.3V供电不用连接,使用机顶盒自带供电即可

微信图片_20210821155816.jpg

3.连串口
CH341插电脑装好驱动,查端口,右键这个设备-属性-端口设置,看是COM?比如COM3
这个设备的端口号是3 (COM3),记住这个数字。
打开PUTTY
选择连接类型为Serial,填好端口号和速率就行。
165140vjcc8baj456y8ezv.png
点打开以后,给机顶盒通电,PUTTY 会刷屏输出,这些是天猫魔盒M17的开机命令过程信息,以下是开机流程刷屏打印的信息,有需要的小伙伴可以拿去分析魔盒M17的开机流程:
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
Net:   dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system


Usage:
saradc saradc open <channel>            - open a SARADC channel
saradc close    - close the SARADC
saradc getval   - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel


wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125395


BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08


set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE:  BL3-1: v1.0(debug):46845bf
NOTICE:  BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.668743 Inits done]
secure task start!
high task start!
low task start!
INFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9




U-Boot 2015.01 (Jul 06 2020 - 22:15:28)


DRAM:  1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC:   aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
Net:   dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system


Usage:
saradc saradc open <channel>            - open a SARADC channel
saradc close    - close the SARADC
saradc getval   - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel


wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
GXL:BL1:9ac50e:a1974b;FEAT:BDFC31BC;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 125393


BL2 Built : 11:26:24, Jun 28 2016.
gxl gc783966 - dianzhong.huo@droid08


set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DDR3 chl: Rank0+1 @ 912MHz - FAIL
DDR3 chl: Rank0 @ 912MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R1024 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R1024 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x00014400
aml log : R1024 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x000a8a00
aml log : R1024 check pass!
NOTICE:  BL3-1: v1.0(debug):46845bf
NOTICE:  BL3-1: Built : 14:27:39, Sep 30 2016
aml log : bl31 detect secure boot !
[Image: gxl_v1.1.3139-ea96ccc 2017-03-16 14:05:55 qiufang.dai@droid07]
OPS=0x82
fc 1 83 b7 a6 ef d3 5d 57 cd 62 ee [0.669671 Inits done]
secure task start!
high task start!
low task start!
INFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9




U-Boot 2015.01 (Jul 06 2020 - 22:15:28)


DRAM:  1 GiB
Relocation Offset is: 36eca000
register usb cfg[0][1] = 0000000037f5eec8
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC:   aml_priv->desc_buf = 0x0000000033eca6b0
aml_priv->desc_buf = 0x0000000033ecc9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
get_dtb_struct: Get emmc dtb OK!
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x6c00000
In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
Net:   dwmac.c9410000
get_cpu_id flag_12bit=1
saradc - saradc sub-system


Usage:
saradc saradc open <channel>            - open a SARADC channel
saradc close    - close the SARADC
saradc getval   - get the value in current channel
saradc get_in_range <min> <max> - return 0 if current value in the range of current channel


wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
usb flag: 4
[imgread]szTimeStamp[2020070622234686]
[imgread]secureKernelImgSz=0x852800
aml log : R1024 check pass!
aml log : R1024 check pass!
aml log : R1024 check pass!
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =33f4f440
copy done
      Support 2 dtbs.
        aml_dt soc: gxl platform: p212 variant: 1g
        dtb 0 soc: gxl   plat: p212   vari: 1g
        dtb 1 soc: gxl   plat: p212   vari: 2g
      Find match dtb: 0
load dtb from 0x3478d440 ......
   Uncompressing Kernel Image ... OK
   kernel loaded at 0x01080000, end = 0x01ea8040
   Loading Ramdisk to 33c99000, end 33eb8000 ... OK
   Loading Device Tree to 000000001fff3000, end 000000001ffffc2f ... OK
fdt_instaboot: no instaboot image


Starting kernel ...


uboot time: 2850185 us
[    0.562839] c0 1 (swapper/0) Initramfs unpacking failed: junk in compressed archive
INFO:    HDCP22 key read fail!
INFO:    p1d 0
INFO:    pd1 0
[    0.801670] c1 1 (swapper/0) PPMGRDRV: err: ppmgr_driver_probe called
[    0.810306] c1 1 (swapper/0) don't find  match flag_cma
[    0.810381] c1 1 (swapper/0) vdin_drv_probe: vdin cannot get msr clk !!!
[    0.816575] c1 6 (kworker/u8:0) sdio: error -22 whilst initialising SDIO card
[    0.832038] c1 1 (swapper/0) m1-adckp adc_keypad.48: adc_key: faild to get name_len!
disable A53 JTAG EE
[    0.843552] c1 1 (swapper/0) cectx aocec: no hdmirx reg resource
[    0.843996] c1 1 (swapper/0) cectx aocec: can't find hdmirx
[    1.059435] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTL
[    1.062732] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTL -> direct -> Ext Spk
[    1.072960] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTR
[    1.081814] c1 1 (swapper/0) aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTR -> direct -> Ext Spk
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000035
WARNING: Unimplemented Sip Call: 0x82000036
[   ▒[    1.635241] c1 1 (init) init: loading selinux policy
[    1.793038] c1 1 (init) alisec selinux: selinux_version stat fail
[    1.797148] c1 1 (init) alisec selinux: selinux_version stat fail
[    1.800106] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[    1.840248] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[    1.848860] c3 2502 (ueventd) alisec selinux: selinux_version stat fail
[    2.556465] c3 1 (init) hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    2.561160] c3 1 (init) init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[    2.568328] c3 1 (init) init: cannot expan[    2.586857] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[    2.590271] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[    2.601025] c3 1 (init) init: property 'ro.serialno' doesn't exist while expanding '${ro.serialno}'
[    2.609971] c3 1 (init) init: cannot expand '${ro.serialno}' while writing to '/sys/class/android_usb/android0/iSerial'
[    2.838316] c1 6 (kworker/u8:0) sdio: error -110 whilst initialising MMC card
[    2.875071] c0 3365 (init) fs_mgr: Warning: unknown flag discard
[    3.477290] c3 1 (init) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[    3.479804] c3 1 (init) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files,  new 0 files||
[    3.681346] c1 1 (init) alisec selinux: selinux_version stat fail
[    3.682328] c1 1 (init) alisec selinux: selinux_version stat fail
[    3.691570] c1 1 (init) alisec selinux: selinux_version stat fail
[    3.694247] c1 1 (init) init: SELinux: Loaded property contexts from /property_contexts
[    3.795178] c1 1 (init) init: Warning!  Service check_dolby_dts needs a SELinux domain defined; please fix!
[    3.799979] c1 1 (init) init: Warning!  Service check_submodel needs a SELinux domain defined; please fix!
[    3.872523] c3 3400 (check_submodel.) amlkey_init() 129: already init!
[    3.874252] c1 3412 (check_submodel.) amlkey_size() 229: ret 1
[    3.879462] c1 3412 (check_submodel.) read_show() 975: key product_sub_model may not burned yet!
[    3.906722] c0 1 (init) init: Warning!  Service load_wifidriver needs a SELinux domain defined; please fix!
root@MagicBox_M17:/ # [    3.933489] c0 1 (init) init: cannot find '/system/bin/fh_recv', disabling 'fh_recv'
[    3.936694] c0 1 (init) init: process 'remotecfg', pid 3431 exited
[    3.943137] c2 3432 (pppoe_wrapper) alisec selinux: selinux_version stat fail
[    3.960260] c3 1 (init) init: process 'check_submodel', pid 3400 exited
[    3.977270] c3 1 (init) init: process 'preload', pid 3449 exited
[    3.997683] c3 3406 (vold) fs_mgr: Warning: unknown flag discard
[    4.005801] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|udpateSecureInfo enter||
[    4.008838] c3 3406 (vold) dig: dig start!
[    4.014629] c2 1 (init) init: process 'check_dolby_dts', pid 3399 exited
[    4.073237] c0 3447 (alitvsecureboot) SysFileCheck: udpateSecureInfo|After udpate, update 0 files, delete 0 files,  new 0 files||
[    4.124024] c0 1 (init) init: process 'uuid_init', pid 3446 exited
[    4.639739] c2 1 (init) init: process 'flash_recovery', pid 3426 exited
[    4.816311] c0 3402 (healthd) healthd: No charger supplies found
[    6.126340] c2 1 (init) init: process 'low_mem', pid 3429 exited
[    7.465267] c3 3803 (rtk_wifi_driver) amlkey_size() 229: ret 1
[    7.465479] c3 3803 (rtk_wifi_driver) read_show() 975: key mac_wifi may not burned yet!
[    7.510449] c2 1 (init) init: process 'load_wifidriver', pid 3444 exited


可以等输出完成或者按ctrl+c强行停止。
可以看见下图已经可以输入命令了,并且是root账户:root@MagicBox_M17:/#
微信图片_20210821155756.jpg
III.备份和刷机
输入setenforce 0,关闭SElinux现在你就可以对天猫魔盒M17为所欲为了
输入cd /dev/block/platform/d0074000.emmc进入分区表
示例system分区的备份和刷机,其它分区同样操作:
游客,如果您要查看本帖隐藏内容请回复

我把主要的分区备份出来了,有需要的小伙伴可以拿去玩:
链接:https://pan.baidu.com/s/19a4jLqQWYbnHAmv4MX8dFg
提取码:
游客,如果您要查看本帖隐藏内容请回复





后面会更新更详细的实操视频教程,欢迎你在快手/抖音/西瓜视频/好看视频/搜索“拆修玩评”收看,记得点赞关注哦~~~
好了,今天分享的内容就这么多,关于电子拆修你是手残党吗?欢迎留下你的评论!
      -END-






上一篇:求天猫魔盒M13闪存备份,或者线刷救砖固件
下一篇:天猫魔盒6系统更新后,电视机没有声音
 楼主| 发表于 2021-8-22 09:35 | 显示全部楼层
有更新更好玩的玩法,欢迎留言讨论
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
看看教程学习学习
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
大佬内容很不错
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
学习学习
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
这就是大神啊
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
内容完美
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
学习学习
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:26 | 显示全部楼层
感谢大神带来的内容分享
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:27 | 显示全部楼层
学习学习
回复 支持 反对

使用道具 举报

发表于 2021-8-21 17:27 | 显示全部楼层
顶顶
回复 支持 反对

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

关闭

站长推荐 上一条 /3 下一条

Archiver|新帖|标签|软件|Sitemap|ZNDS智能电视网 ( 浙ICP备14000780号-1 )

网络信息服务信用承诺书 | 增值电信业务经营许可证:浙B2-20150411 丨 浙公网安备 33010802006145号

浙网文(2016)6491-366号 | GMT+8, 2021-9-28 18:13 , Processed in 0.066999 second(s), 13 queries , MemCache On.

Powered by Discuz!

监督举报:report#znds.com (请将#替换为@)

© 2007-2021 ZNDS.Com

快速回复 返回顶部 返回列表