Need help in unbricking T95x 1G/8G

[hieppo]

I have been hacking away at trying to resurrect this box. Luckily this is a spare box I wanted to just run Amlogic-ng COREELEC on it. To make the story short, 1G/8G would not boot the next gen kernel and someone suggested to flash the Android to 7.1 instead of stock 6.0. I never took a backup of the firmware (didn't know Android recovery allows backup, i never installed TWRP).

After playing around the past couple days, here is what I learned so far. I have a USB-TTL so was able to see some info. Other than that no output out of HDMI or AV

1. box is boot looping without any SD card with some sort of UBOOT created using AMLogic flash card maker
GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EM MC:0;READ:0;CHK:AA;SD:800;USB:8;LOOP:1;EMMC:0;READ :0;CHK:AA;SD:800;USB:8;

2. USB Burn tool able to detect HUB.
Boot loop message pauses and does not continue to show looping
a) tried to burn about 6 to 7 different various Android firmware download from various sources. Every single one fail at 4% where it is download UBOOT. Error message

[23:40:35 014][Global][Inf]--Burning thread HUB2-1 start
[23:40:35 068][HUB2-1][Inf]--Open device handle \\?\usb#vid_1b8e&pid_c003#5&c1e6cce&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed} 0x00000194
[23:40:35 121][HUB2-1][Inf]--Connect path=Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C/P0/P0
[23:40:35 121][HUB2-1][Inf]--Start burning...
[23:40:35 175][HUB2-1][Inf]--------------ERASE BOOTLOADER------------
[23:40:35 275][HUB2-1][Inf]--start SendIdentifyCmd
[23:40:35 275][HUB2-1][Inf]--2-2-0-0
[23:40:35 275][HUB2-1][Inf]-------------Download DDR.USB-----------
[23:40:35 275][HUB2-1][Inf]--2-2-0-0
[23:40:35 275][HUB2-1][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[23:40:35 780][HUB2-1][Inf]--Control write pll reg1 0xd9000000:0x00005183
[23:40:36 270][HUB2-1][Inf]--Control write pll reg1 0xd9000000:0x000000b1
[23:40:36 760][HUB2-1][Inf]--Control write pll reg1 0xd9000000:0x00005183
[23:40:37 250][HUB2-1][Inf]--Write initial succeed
[23:40:37 250][HUB2-1][Inf]--Upload encrypt at 0xc8100228
[23:40:37 250][HUB2-1][Inf]--ulValue = 0xadfc318c
[23:40:37 250][HUB2-1][Inf]--Read encrypt value succeed
[23:40:37 250][HUB2-1][Inf]--Download DDR.USB,size: 49152!
[23:40:37 281][HUB2-1][Inf]--Transfer complete 49152
[23:40:37 281][HUB2-1][Inf]--Run at address 0xd9000000
[23:40:37 296][HUB2-1][Inf]--RunInRam success
[23:40:37 419][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:37 419][HUB2-1][Inf]--CheckFileRunState succeed
[23:40:37 419][HUB2-1][Inf]--runResult:0x 0,paraMagic:0x7856efab
[23:40:37 419][HUB2-1][Inf]--ddrCapacity:0x 400
[23:40:37 419][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:37 419][HUB2-1][Inf]--Get Encrpt ulValue = 0xadfc318c
[23:40:37 419][HUB2-1][Err]--download 1 time!
[23:40:37 419][HUB2-1][Inf]--Download UBOOT.USB buffer at 0x0200c000
[23:40:38 031][HUB2-1][Inf]--Transfer complete
[23:40:38 230][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:38 230][HUB2-1][Inf]--Download DDR.USB buffer at 0xd9000000
[23:40:38 261][HUB2-1][Inf]--Transfer complete
[23:40:38 276][HUB2-1][Inf]--DownCheckPara succeed
[23:40:38 276][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:38 276][HUB2-1][Inf]--RunInAddr at address 0xd9000000
[23:40:38 322][HUB2-1][Inf]--ReadCheckPara succeed
[23:40:38 322][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:38 322][HUB2-1][Inf]--Get Encrpt ulValue = 0xadfc318c
[23:40:38 322][HUB2-1][Inf]--Download DDR.USB buffer at 0xd9000000
[23:40:38 368][HUB2-1][Inf]--Transfer complete
[23:40:38 368][HUB2-1][Inf]--DownRunPara succeed
[23:40:38 368][HUB2-1][Inf]--2-2-0-0-0-1-0-0
[23:40:38 368][HUB2-1][Inf]--RunInRam at address 0xd9000000
[23:40:45 032][Global][Inf]--Catch DBT_DEVICEREMOVECOMPLETE
[23:40:45 032][Global][Inf]--Scan usb device
[23:40:45 032][Global][Inf]--Aml scan WorldCup Device
[23:40:45 032][Global][Inf]--Host: Standard OpenHCD USB Host Controller
[23:40:45 032][Global][Inf]--DevPath:\\?\pci#ven_106b&dev_003f&subsys_00000000& rev_00#3&267a616a&0&30#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}
[23:40:45 032][Global][Inf]---->Roothub:USB#ROOT_HUB#4&24d6eb65&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}
[23:40:45 032][Global][Inf]-------->[Port0]Other device
[23:40:45 032][Global][Inf]-------->[Port1]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port2]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port3]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port4]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port5]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port6]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port7]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port8]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port9]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port10]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port11]NoDeviceConnected
[23:40:45 032][Global][Inf]--Host: Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C
[23:40:45 032][Global][Inf]--DevPath:\\?\pci#ven_8086&dev_265c&subsys_00000000& rev_00#3&267a616a&0&58#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}
[23:40:45 032][Global][Inf]---->Roothub:USB#ROOT_HUB20#4&6a987e4&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}
[23:40:45 032][Global][Inf]-------->[Port0]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port1]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port2]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port3]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port4]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port5]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port6]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port7]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port8]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port9]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port10]NoDeviceConnected
[23:40:45 032][Global][Inf]-------->[Port11]NoDeviceConnected
[23:40:45 032][Global][Inf]--Scan USB host controller complete
[23:40:45 032][Global][Inf]--Update data center with HubMap
[23:40:45 032][Global][Inf]--Update hub2 device data
[23:40:45 032][Global][Inf]--Update HUB2-1
[23:40:45 032][HUB2-1][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-2
[23:40:45 032][HUB2-2][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-3
[23:40:45 032][HUB2-3][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-4
[23:40:45 032][HUB2-4][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-5
[23:40:45 032][HUB2-5][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-6
[23:40:45 032][HUB2-6][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-7
[23:40:45 032][HUB2-7][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-8
[23:40:45 032][HUB2-8][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-9
[23:40:45 032][HUB2-9][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-10
[23:40:45 032][HUB2-10][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-11
[23:40:45 032][HUB2-11][Inf]--Update device path
[23:40:45 032][Global][Inf]--Update HUB2-12
[23:40:45 032][HUB2-12][Inf]--Update device path
[23:40:45 032][Global][Inf]--Scan end
[23:40:45 048][HUB2-1][Inf]--Device is removed
[23:40:48 000][Global][War]--User click stop button

TE: 57664592

BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
BL2 USB
DQS-corr enabled
DDR scramble enabled
STICKY_REG0: 0x00000000
STICKY_REG1: 0x00000000
STICKY_REG9: 0x00000000
DDR3 chl: Rank0+1 @ 792MHz - FAIL
DDR3 chl: Rank0 @ 792MHz - PASS
Rank0: 1024MB(auto)-2T-11
0.0;
TE: 58639224

BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
BL2 USB
0.0;
TE: 58735986

BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
BL2 USB
Load fip header from USB, src: 0x0000c000, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from USB, src: 0x00010000, des: 0x01100000, size: 0x0000d600
Load bl31 from USB, src: 0x00020000, des: 0x05100000, size: 0x0002c600
Load bl33 from USB, src: 0x00050000, des: 0x01000000, size: 0x00066c00
NOTICE: BL3-1: v1.0(release):a625749
NOTICE: BL3-1: Built : 11:25:15, Aug 25 2017
[BL31]: GXL CPU setup!
NOTICE: BL31: BL33 decompress fail
NOTICE: BL3-1: FIP process fail 4
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0x82
b7 a5 1 e2 87 55 6d 9f a7 2e da 19 [58.983335 Inits done]
secure task start!
high task start!
low task start!
ERROR: Error initializing runtime service opteed_fast

3. Try to flash from AMLogic card maker went a bit better. One of odd thing I noticed was that I was not able to start the boot of the SDCard until I pulled the power plug several times before the SD card starts to boot Other wise it gets stuck at the same place as when trying to USB Burn Tool.
When it did manage to boot, my led went from RED to BLUE and HDMI was output a bright green sometime white screen and nothing else.

no sdio debug board detected
TE: 205616

BL2 Built : 20:32:17, Sep 8 2017.
gxl g6296b83 - xiaobo.gu@droid12

set vcck to 1120 mv
set vddee to 1000 mv
Board ID = 1
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
STICKY_REG0: 0x00000000
STICKY_REG1: 0x00000000
STICKY_REG9: 0x00000000
DDR3 chl: Rank0+1 @ 792MHz - FAIL
DDR3 chl: Rank0 @ 792MHz - PASS
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from SD, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from SD, src: 0x00020200, des: 0x05100000, size: 0x0002c600
Load bl33 from SD, src: 0x00050200, des: 0x01000000, size: 0x00066c00
NOTICE: BL3-1: v1.0(release):a625749
NOTICE: BL3-1: Built : 11:25:15, Aug 25 2017
[BL31]: GXL CPU setup!
NOTICE: BL31: BL33 decompress pass
mpu_config_enable:ok
[Image: gxl_v1.1.3243-377db0f 2017-09-07 11:28:58 qiufang.dai@droid07]
OPS=0x82
b7 a5 1 e2 87 55 6d 9f a7 2e da 19 [0.655099 Inits done]
secure task start!
high task start!
low task start!
ERROR: Error initializing runtime service opteed_fast


U-Boot 2015.01-g2d1a155-dirty (Oct 11 2017 - 15:26:01)

DRAM: 1 GiB
Relocation Offset is: 36eb1000
register usb cfg[0][1] = 0000000037f59d90
[CANVAS]canvas init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033eb16b0
aml_priv->desc_buf = 0x0000000033eb39d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 5f4c4d41
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
start dts,buffer=0000000033eb6200,dt_addr=0000000033eb6a 00
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
parts: 11
00: logo 0000000002000000 1
01: recovery 0000000002000000 1
02: rsv 0000000000800000 1
03: tee 0000000000800000 1
04: crypt 0000000002000000 1
05: misc 0000000002000000 1
06: instaboot 0000000020000000 1
07: boot 0000000002000000 1
08: system 0000000040000000 1
09: cache 0000000020000000 2
10: data ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000
In: serial
Out: serial
Err: serial
reboot_mode=watchdog_reboot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 0, store 0
dtb_read()-1034: cpy 1 is not valid
_verify_dtb_checksum()-917: calc 3a7dd35f, store 0
dtb_read()-1034: cpy 0 is not valid
dtb_read()-1039: total valid 0
Amlogic multi-dtb tool
Multi dtb detected
Multi dtb tool version: v2 .
Support 2 dtbs.
aml_dt soc: gxl platform: p212 variant: 1g
dtb 0 soc: gxl plat: p212 vari: 1g
dtb 1 soc: gxl plat: p212 vari: 2g
Find match dtb: 0
vpu: clk_level in dts: 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
hpd_state=1
[1080p60hz] is invalid for cvbs.
set hdmitx VIC = 16
config HPLL = 2970000
HPLL: 0xc000027b
config HPLL done
j = 4 vid_clk_div = 1
hdmitx: set enc for VIC: 16
HDMITX-DWC addr=0x10004006 rd_data=0x40
Error: HDMITX-DWC exp_data=0xff mask=0x9f
rx version is 1.4 or below div=10
hdmtix: set audio
hdmitx phy setting done
card in
init_part() 278: PART_TYPE_DOS
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 1b
OEM: 534d
Name: ED4QT
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 119.3 GiB
mmc clock: 40000000
Bus Width: 4-bit
** Unrecognized filesystem type **
setenv ddrclk 792 MHz
Net: dwmac.c9410000
Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=0
[OSD]load fb addr from dts
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]fb_addr for logo: 0x3d800000
[OSD]load fb addr from dts
[OSD]failed to get fb addr for logo
[OSD]use default fb_addr parameters
[OSD]fb_addr for logo: 0x3d800000
[CANVAS]addr=0x3d800000 width=3840, height=2160

I don't think it flash anything to internal eMMC. I took the SD card out and reboot and it was stuck on recovery (RED LED).

I believe something wrong with all the parititions in eMMC like bootloader and recovery.

BTW, the sample output is just from one firmware I tried. All firmwares shows similar output from the terminal.

Anyone has any suggestion/help? I would appreciate anything at this point. I am stuck not knowing that to do next.

Thanks

[hieppo]

Thanks everyone. After hacking around, since the box seems to be booting from the SD card at least, I was able to find a firmware that booted from the SDcard into Android. I then ADB into the box and turns I could reboot update/recovery. I found another firmware, ZIP file this time and flash it with recovery that I put on another SD card. This flash process is what finally flashed into the eMMC which allows me to finally boot from the box instead of SDCard.

So finally box resurrected.

Now, my next challenge which was the original challenge is to find a compatible Android 7 firmware and flash it.

Thanks again.

[Guest]

Hi Hieppo,

I have the same box T95x running aidan's custom rom here is the link. It's running 7.4 but it may run his newer version as well.


ATV 7.4 link

http://aidansrom.freecluster.eu/features-download/?i=1

ATV 9 link

https://www.aidansrom.ml/

Cheers

[hieppo]

Hi Hieppo,

I have the same box T95x running aidan's custom rom here is the link. It's running 7.4 but it may run his newer version as well.


ATV 7.4 link

http://aidansrom.freecluster.eu/features-download/?i=1

ATV 9 link

https://www.aidansrom.ml/

Cheers

Thank you Kyle222. I have tried Aidan's ATV 7.1.2 v7.5 to flash both on my T95x and my other Edal box (I think they are some form of MXQ clone or another). However, The T95x box uses the FORESEE vs the Edal Hynix NAND. I was able to USB Burn the Edal up to 99% but it failed duing the bootloader checksum "failed:Verify Failed with sha1sum, origin sum"

That was the closest I got with any rom that is higher than Android 6. The only one I successfully flash on both box is Android 6.

I am almost too tired to try more and give up and just use as is.

UPDATE:

I download the file from the link above. I downloaded the MXQ version instead of the UNIVERSAL one and USB Burn completed 100%. However, the boot up process is really slow and logn. It stuck at the androidtv bootscreen.

[Guest]

first boot after flashed is always slow .... as it's configing the firmware and running scripts in the background. Let if fully boot about 6-9 minutes depending on build. Then reboot after wifi connected up. Should be quickers... with regard to 99% fail... that is the burn tool version... buggy or the temp settings change to 10 - 80 try it... if not do 20 -70 on temp setting. if neither work uncheck it off completely. If that fails switch to burning tool version 2.1.7

The foresee is very common on these boxes... it does not have to be Edal or Micron, Samsung ....


Provide good pics of board both sides.... easier to see what's going on cheers