Bricked MXPRO 4K [S905X P212 BOARD] - Any help?

[DBNAM]

Hello everyone!!!

I have an MXPRO 4K. This is not the MXQ PRO 4K which is so common! 8)
It has big, capital letters "MX", then small blue letters "pro" at top and boxed red "4K" at the bottom but there is no "Q".

Specs are:

Amlogic/p212_6051/p212_6051
6.0.1/MHC19J/20170920
userdebug/test-keys

1GB FLASH, 8GB STORAGE

I could not access the internal storage with any distro, LIBREELEC, ARMBIAN, OSMC, ETC.
All I could do was boot from SDHC. Using p212 dtb files, everything works except for internal storage.
I was stupid and started flashing stuff I shouldn't and I bricked it with USB BURNING TOOL.

I would love if someone had a stock image for this I could flash back with USB BURNING TOOL.
I am unable to use anything except USB BURNING TOOL as it does not boot from SD and is black screen/constant reboot.
However, USB BURNING TOOL recognizes it.
I really wish there was a tool which would convert between all the various .img formats for the burn card maker, usb burn tool,
recovery.dtb and sd methods, etc.! 8)

I was unable to create a backup because the stock backup didn't work and although TWRP booted, like everything else,
it would not access the internal storage so there was no way for me to backup.

Any help would be appreciated! Is anyone else aware of this model?!?!
If I unbrick, is there a way to access the internal storage so I can install different OS on it?

I appreciate any and all help, much thanks in advance! 8)

[DBNAM]

Hello. I posted the above about a month ago, no replies yet.
If anyone can help and can get this stock IMG, please let me know!

NEEDED: STOCK .IMG FILE FOR p212_6051-userdebug 6.0.1 MHC19J20170920 test-keys

I can communicate with the device through USB BURN TOOL and am positive that all it needs is a correct img
to repartition and reflash the device. Thanks!
P.S. - Nothing else will talk to it, I can't boot from SD/USB so I need something to fix it with USB BURN TOOL.

[kevkis]

Hi DBNAM

http://www.wechipbox.com/-ezp-24.htm...0t88e3alne59q3.
and

http://chinagadgetsreviews.blogspot.co.za/search/label/firmware

Downloads folder has many of the correct images.

[DBNAM]

KEVKIS: Thanks for the links but I don't think they have what I need. Again, I need the MXPRO 4K firmware, NOT MXQ or MXQ PRO.

The first link has tons of images but none are for the MXPRO. There is an MXQ PRO 4K (S905X) but I'm pretty sure that's the image
I've already tried and failed to work. I have not been able to find any info on my weird box anywhere. 8(
The second link I've known about, searching for "MX PRO" brings up nothing.

I am going to search through the first link and try some other stuff - I had an MX95 once that I was able to unbrick by actually
flashing a firmware that was NOT for it's CPU but had all the correct partition layouts however so I flashed the firmware to fix the
partitions, and then, after that, I was able to flash many things again. I think the flash/ram chips on my device are rare and there
aren't any dox on them. However, there must be a stock firmware for it SOMETHERE! 8) The default Android works great but I was
unable to make a backup of it because nothing would read the onboard flash/ram.

Thanks!

P.S. - I tried to flash T6 905X 1/8G but it fails at 7% with this message:
Uboot/Get result/DiskInitial error

It seems to have this happen every time I try to flash anything anymore. I think it needs totally reformatted & partitioned
but it seems no one knows how and no firmware for it or tools that work on it. IS MY DEVICE MORE BRICKED THAN I THINK?

I found my device on the WECHIPBOX site:
http://www.wechipbox.com/wechip-mx-p...l#.WvHR62oh3VM
However, it is listed as an s905 there? Weird. No firmware either. The case is identical WHITE MX, blue PRO, red 4K underneath.
However I am pretty sure my device is an s905x, they're listing it as an s905 on their site and there is no firmware or support offered.


P.S. - If I am unable to unbrick this device, are there any DEVS out there interested in it? I'll send it to you for free so you can research
it and maybe find information and/or be able to unbrick.

[kevkis]

Can you send some photos of the board and the box

[DBNAM]

I have uploaded a picture of the BOX and the BOARD. My phone sucks but you'll get the general idea.

I noticed a slight discrepancy on what I said above about the WECHIPBOX.COM that I was talking about here:

http://www.wechipbox.com/wechip-mx-pro-amlogic-s905-quad-core-android51-18g-tvbox-p-360.html#.WvOnLmoh3VN

The box listed on the WECHIPBOX link above as an "MX PRO 4K" has a RED upper left part of the X, see?
Mine is all white! However, other than that, the boxes are identical. Weird, eh? So many versions of these boxes!!!
The insides are not identical though!

Since you may not be able to read all the chips, here they are:

You can see the board clearly says S905XQ_V2.0 2017.06.16 so it is not an S905 like that box advertized on WECHIPBOX.COM.

Here are the specs for what I assume are the flash roms we can't access -
(Two identical chips next to the heat sync and another two on the bottom of the board.)
NANYA 1705
NT5CB128M16FP-DI
418143WOEF 3 TW

Then there's this HYNIX chip: (More flash?)
SK hynix
H2 UCG8T2FTR
BC 617A
HY17A08103

The white sticker on the sd port =
AK S905XQ D1JF8J
20170920 QC Pass

THANKS!!!

[frake50]

Then there's this HYNIX chip: (More flash?)
SK hynix
H2 UCG8T2FTR
BC 617A
HY17A08103



THANKS!!!

there are many firmware in this forum support your box, one of them i posted one its work to you search the forum

[kevkis]

I have uploaded a picture of the BOX and the BOARD. My phone sucks but you'll get the general idea.

Here are the specs for what I assume are the flash roms we can't access -
(Two identical chips next to the heat sync and another two on the bottom of the board.)
NANYA 1705
NT5CB128M16FP-DI
418143WOEF 3 TW

Then there's this HYNIX chip: (More flash?)
SK hynix
H2 UCG8T2FTR
BC 617A
HY17A08103


THANKS!!!

The NANYA NT5CB128M16FP-DI are your DDR3 which make up the 1 Gig of box Ram. The Hynix is your Nand Flash and is where your software sits and makes up the 8 Gig of flash storage...

When you connect to AMLOGIC BURN SOFTWARE TOOL, Does the box still come up and say connected, waiting for you to flash firmware ? IF YES, try flash S905x 1g+8g version....

Try the T6-S905x 1g+8G image .... at https://1drv.ms/u/s!ArKioz4lbRJGghtJd5tQBpYmYExn

You just have to try different firmware until your box completes the update 100%. Its pretty easy, only snag comes when the nand flash is faulty or damaged.

Where you located? you welcome to ship to me or provide me with team viewer access and we try flash it over remote team viewer session, really up to you, PM me if you want to give it a try. More than willing to try help.

[DBNAM]

kevkis: You must have missed the part above where I wrote this:
"P.S. - I tried to flash T6 905X 1/8G but it fails at 7% with this message:
Uboot/Get result/DiskInitial error"

kevkis wrote: "You just have to try different firmware until your box completes the update 100%. Its pretty easy, only snag comes when the nand flash is faulty or damaged."

Okay, assuming it's faulty or damaged, are there any tools to fix this? I am kinda surprised at the lack of low-level tools to be found.
There should be a flash util that deals with formatting and repartitioning (or the equivalent) a variety of different chips but the only thing I have ever found that even
let's a user directly write to it is the USB BURN TOOL. Unfortuanantly, it has no READ function.
I don't know if it's a different ball game to read or not but it doesn't seem that it should be, just seems like the programmers of USB BURN TOOL simply didn't make
a READ function. I would love a util that would just NOT CARE WHAT is on a chip and just raw dump all the stuff to make a backup, something that would raw dump
to the format USB BURN TOOL uses/writes to ya know?

I understand it *should* be as simple as going through and trying till I find one that works but this case is beyond that.
I have brought many different units back from the dead and am familiar with most of the techniques but I think this
one is messed up in a way I'm either not famlliar with, or it's just totally unfixably bricked. 8)

This box is different, I have not seen it anywhere nor encountered any specs for it before.
Yes, the individual components it has do exist in other boxes but this one is a different "combination" of components.
As I mentioned, even when it was working, the only thing I could get to recognize the onboard storage was the stock Android.
TWRP wouldn't even recognize it and I could not perform any type of backup at all, even with the stock Android OS.
I could boot stuff from SD of course and run from SD but just not access any onboard storage.

I'm located in Illinois. What is Team Viewer, a VNC? I am actually decently knowledgeable so I can work through instructions
you give me - what about the onboard serial and/or jtag? I assume if stuff is fried, that is the last resort?

Thanks for all the help!

P.S. - hehhe yeah I recognize the HYNIX back from the Xbox 1 hacking days, it was in one of the models where you had to close the write
jumper so you could flash it. 8) Also, I still have serial and rudimentary parallel based JTAG tools from back in my cable modem hacking days. 8)
If needed, I can probably dig them out and connect as long as there's a lower level fix that way than what USB BURN TOOL gives us. 8)
I also have no problem with mailing you it and/or even donating it to the scene so various team members can look at it and document it.

[kevkis]

kevkis: You must have missed the part above where I wrote this:
"P.S. - I tried to flash T6 905X 1/8G but it fails at 7% with this message........

Ok I looked closely at your board picture, Looks like you can SERIAL INTERFACE into the device near the top of the board near the power connector, (i have circled it in RED on the photo below, taken from your post above). What does it say on that pc board under the pins i circled, does it have any indication its serial ?

take a look at my post here : http://freaktab.com/forum/tv-player-...x-a95x-bricked

You need to check what it says on the board (if no writing on the pc board) then measure with your multimeter the pins. Pin configuration must be ground, TX, RX and Vcc (3.3v) - something like that and not necessarily in that order. You going to need a MAX 232 type interface and Serial into PUTTY or Serial Terminal. Connect it to the board and you should be able to access the UBOOT. I am almost sure that is what is booting the box. Many embedded systems are using Uboot or Linux boot loader to boot the primary OS. Any how have a look at the board and then try interface via serial and then output the log screen, that will give you and indication as to what is happening with the flash and its partitions or layout and even configuration. I am sure this method will work as the UBOOT must be there as you still can pick up the device in USB BURNING TOOL, and you can boot from SD CARD, correct ? , so there must be boot loader in the first partition of the flash.

Just be careful with this method above because if you delete or rewrite the wrong partition (lets say by accident you delete the boot loader partition) you will not have access to UBOOT and in no way can you reload the boot loader without removing the flash and re-programming it with external programmer. (I suggest making a backup of the boot loader partition before you attempt to write any data to it)

I got my A95x (S905x) going by using the SERIAL interface method, together with USB BURN TOOL, and that way updated firmware to the device. The box was never identified with USB BURNING TOOL until i performed a manual update via the serial console in putty.

Jtag, - I could be under correction, but I do not think there is any options for that on this board and finding those pins can be really difficult if they even exists. Most manufactures will specifically design a JTAG port layout on the pcb. All those pins in JTAG standard will be grouped together, I haven't yet come across jtag port on any S905 pcbs running android. Most jtag pcb ports are for application specific design where its needed by a brand manufacturer to debug/replace the "custom built in firmware" Like set top boxes, Modems, Gaming consoles, embedded pcs with custom software, etc...

[DBNAM]

heheh yeah I think I have a MAX 233 which is the 232 but with added stuff so I didn't have to add resistors.
It's just my hack built from the chip and wired to a 9 pin DIN connector that I can plug into my MB.

It appears to have JTAG near CPU -
TD0, TDK, TMS, TDI, GND

And SERIAL yes as well: (Exactly where you circled yes that is the serial port.)
It's even LABELED, that's why above when I said what about the JTAG and SERIAL ports, I just assumed it as a fact they were there.
The SERIAL is labeled VCC, RX, TX, GND.

I am gonna get my stuff set up and should get back to U in a few days baring any distractions. 8)

P.S. Found it! SP233A CP chip with 9 pin din and a female pin connector. This should work.

So what did you do from serial console with the A95 to get burn tool to work?
Was it giving a similar error as mine/starting but not completing? Is there a force option on console or similar? 8)
Got my curiosity now. Will be neat to look through the serial console's command set.
(Gotta do some soldering first tho.)

[Kick]

Bumping this old thread...

Hey DBNAM, I have the exact same box with exact same issues. Did you ever get it going and if so, how did you do it? Did you find stock firmware? I'm still looking...