search

HybridELEC / hepacker

HybridELEC image packer
GNU Affero General Public License v3.0
15 stars 4 forks source link

Unable to flash self compiled Hybrid- 3-1-image on 905x2 via USB Burning Tool. #2

Closed worstcase-scenario closed 3 months ago

worstcase-scenario commented 3 months ago

Device details can be found here: https://www.geekbuying.com/item/A95X-F2-Amlogic-S905X2-Android-9-0-4GB-64GB-TV-Box-Dual-Band-WiFi-416313.html

My used source files are:

  1. Android Stock firmware (which can be flashed without problems to the box), found here; https://www.mediafire.com/file/b3mr513uc4kr2na/aml_upgrade_package_senk.img/file

  2. CoreELEC-Amlogic-ng.arm-21.0-Omega.tar, found here: https://github.com/CoreELEC/CoreELEC/releases/download/21.0-Omega/CoreELEC-Amlogic-ng.arm-21.0-Omega.tar

  3. EmuELEC-Amlogic-ng.aarch64-4.7.tar, found here: https://github.com/EmuELEC/EmuELEC/releases/download/v4.7/EmuELEC-Amlogic-ng.aarch64-4.7.tar

I'm using ARCH LINUX WSL under Windows 11, the building instructions are: python hepacker.py firmware.img coreelec.tar g12a_s905x2_4g 4G emuelec.tar g12a_s905x2_4g 4G hybrid.img

USB Burning Tool used with version 2.2.0 checks the image and starts burning. Around 10 %, the process is interrupted. Here is the log:

[15:43:31 950][HUB2-4][Inf]--Device is connected [15:43:31 950][HUB2-4][Inf]--Close device handle 0x00000470 [15:43:32 005][HUB2-4][Inf]--Open device handle \?\usb#vid_1b8e&pid_c003#6&205b6da8&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed} 0x00000470 [15:43:35 077][HUB2-4][Inf]--0-7-0-16 [15:43:35 077][HUB2-4][Inf]--CheckFileRunState succeed [15:43:35 077][HUB2-4][Inf]-- low_power [15:43:35 081][HUB2-4][Inf]--Send command success [15:43:35 087][HUB2-4][Inf]--Read command status success [15:43:35 087][HUB2-4][Inf]-------------Download meson1.dtb----------- [15:43:35 087][HUB2-4][Inf]--0-7-0-16 [15:43:35 087][HUB2-4][Inf]--Enc(0xf0f831b0) [15:43:35 087][HUB2-4][Err]--meson1.dtb changed to meson1_ENC.dtb [15:43:35 101][HUB2-4][Inf]-- download mem dtb normal 154656 [15:43:35 102][HUB2-4][Inf]--Send download command success [15:43:35 113][HUB2-4][Inf]--Read command status success [15:43:35 126][HUB2-4][Inf]--Transfer complete [15:43:35 126][HUB2-4][Inf]--Send download get_status command succeed [15:43:35 134][HUB2-4][Inf]--get_status success [15:43:35 646][HUB2-4][Inf]-------------ERASE FLASH----------- [15:43:37 651][HUB2-4][Inf]--send command diskinit [15:43:37 651][HUB2-4][Inf]--disk_initial 1 [15:43:37 652][HUB2-4][Inf]--Send command success [15:43:41 792][HUB2-4][Inf]--Read command diskinit status [15:43:41 792][HUB2-4][Inf]--Read command status success [15:43:41 792][HUB2-4][Inf]-------------Download _aml_dtb.PARTITION----------- [15:43:41 792][HUB2-4][Inf]--0-7-0-16 [15:43:41 792][HUB2-4][Inf]--download store _aml_dtb normal 153600 [15:43:41 792][HUB2-4][Inf]--Send download command success [15:43:41 804][HUB2-4][Inf]--Read command status success [15:43:41 885][HUB2-4][Inf]--Transfer complete [15:43:41 885][HUB2-4][Inf]--Send download get_status command succeed [15:43:41 901][HUB2-4][Inf]--get_status success [15:43:41 902][HUB2-4][Inf]--verify sha1sum 9c9bdb5f3948a6c941ee70ff93ec4d254e6e0653 [15:43:41 902][HUB2-4][Inf]--Send verify cmd succeed [15:43:41 902][HUB2-4][Inf]--ItemSize: 153600 [15:43:41 930][HUB2-4][Inf]--Get verify status success [15:43:42 432][HUB2-4][Inf]-------------Download boot.PARTITION----------- [15:43:42 432][HUB2-4][Inf]--0-7-0-16 [15:43:42 432][HUB2-4][Inf]--download store boot normal 9497088 [15:43:42 432][HUB2-4][Inf]--Send download command success [15:43:42 450][HUB2-4][Inf]--Read command status success [15:43:43 383][HUB2-4][Inf]--Transfer complete [15:43:43 383][HUB2-4][Inf]--Send download get_status command succeed [15:43:43 385][HUB2-4][Inf]--get_status success [15:43:43 385][HUB2-4][Inf]--verify sha1sum f837ef9d6d9885294a8278d9b8c124eb403f8c32 [15:43:43 385][HUB2-4][Inf]--Send verify cmd succeed [15:43:43 385][HUB2-4][Inf]--ItemSize: 9497088 [15:43:43 811][HUB2-4][Inf]--Get verify status success [15:43:44 326][HUB2-4][Inf]-------------Download ce_storage.PARTITION----------- [15:43:44 327][HUB2-4][Inf]--0-7-0-16 [15:43:44 327][HUB2-4][Inf]--download store ce_storage sparse 3286416 [15:43:44 327][HUB2-4][Inf]--Send download command success [15:43:44 602][HUB2-4][Err]--failed: [15:43:44 619][HUB2-4][Err]--[0x30402004]UBOOT/Partition ce_storage/Initialize partition/Error result [15:43:44 621][HUB2-4][Inf]--Close device handle 0x00000470 [15:43:50 603][Global][War]--User click stop button [15:43:50 606][Global][Inf]--Enable burning 0 [15:44:14 359][Global][War]--Close tool

worstcase-scenario commented 3 months ago

Another question: is it possible to flash the hybrid.img directly via the terminal of my android box by using the "dd"-command?

worstcase-scenario commented 3 months ago

After converting the IMG to a update.zip file via https://rdsoftwaregineering.wordpress.com/customization-tool/, I tried installing it via the recovery menu directly... But it didn't work, unfortunately. Here's the output:

Supported API: 3

Somehow there has to be something wrong with the .img / .zip file, although both the USB burning tool and the customization tool verify and open / check it without any errors...I don't get it...

@7Ji :Perhaps you could be so kind and build that IMG for me on your arch Linux environment and then upload it so that I can check if your compiled version is either working or not?

This would be a really really great help in order to rule out if my process of building the image could be the reason for it...

7Ji commented 3 months ago

Can you share a screenshot of Amlogic USB Burning Tool with the rightside bars? I.e. Which option you picked for "erase flash", "erase bootloader", etc.

I have a doubt that, as you're not completely erasing the eMMC, your box is refusing partitions that it didn't have in the original partition layout.

After converting the IMG to a update.zip file via https://rdsoftwaregineering.wordpress.com/customization-tool/, I tried installing it via the recovery menu directly... But it didn't work, unfortunately. Here's the output:

The same goes for this, an update.zip would not work. The hybrid image only works with a complete flash erasing, and by update.zip partitions are always kept, and only Android partitions would be accepted by the Android upgrade tool.

Another question: is it possible to flash the hybrid.img directly via the terminal of my android box by using the "dd"-command?

You can not directly do that, but could somehow emulate that behaviour. The .img here is in Amlogic's proprietary format and it contains a lot of different "parts" that each needs to be written to corresponding offsets on eMMC. What you could do is to:

The burning image I made with the same sources, but I doubt whether it works: https://drive.google.com/file/d/1mMq-WRSUwvkFwns5QwA9nnkw13w0Alb4/view?usp=sharing

worstcase-scenario commented 3 months ago

Thank you kindly for both your answers and the img. Here is my feedback:

Can you share a screenshot of Amlogic USB Burning Tool with the rightside bars? I.e. Which option you picked for "erase flash", "erase bootloader", etc.

I have a doubt that, as you're not completely erasing the eMMC, your box is refusing partitions that it didn't have in the original partition layout.

I already tried every combination of the options, none of them worked unfortunately with the image. The same error always comes up...

After converting the IMG to a update.zip file via https://rdsoftwaregineering.wordpress.com/customization-tool/, I tried installing it via the recovery menu directly... But it didn't work, unfortunately. Here's the output:

The same goes for this, an update.zip would not work. The hybrid image only works with a complete flash erasing, and by update.zip partitions are always kept, and only Android partitions would be accepted by the Android upgrade tool.

Thanks you for explaining, that makes sense. I just tried every alternative option to flashing an .img I could find in the internet.

Another question: is it possible to flash the hybrid.img directly via the terminal of my android box by using the "dd"-command?

You can not directly do that, but could somehow emulate that behaviour. The .img here is in Amlogic's proprietary format and it contains a lot of different "parts" that each needs to be written to corresponding offsets on eMMC. What you could do is to:

  • ampack unpack the output image, or use the stuffs in building/everything
  • get the size of your eMMC
  • dd or truncate to create an empty image with equal size
  • write dtb into your pseudo eMMC image by dd if=meson1.dtb of=emmc.img bs=256K seek=160 conv=notrunc then dd if=meson1.dtb of=emmc.img bs=256K seek=161 conv=notrunc
  • create the eMMC partition table by ampart --mode dtoe emmc.img, the log should tell you the offsets of partitions in the fake eMMC image
  • use file to check partitions, if they're Android Sparse Image then simg2img to convert them to raw partition files.
  • use dd to write each of the parts to their corresponding offsets in the pseudo eMMC image.
  • dd your pseudo eMMC image to your actual eMMC.

Okay, this will take me a bit of time and work, hopefully I can do that, thank you for the instructions! I will try it out...

The burning image I made with the same sources, but I doubt whether it works: https://drive.google.com/file/d/1mMq-WRSUwvkFwns5QwA9nnkw13w0Alb4/view?usp=sharing

Unfortunately, it didn't work. Even with all the options enabled/disabled/in variations...

worstcase-scenario commented 3 months ago

FYI: I was curious to see if I could install the newest CoreElec to my emmc. It didn't work, here's the output:

CoreELEC:/ # ceemmc -x

Starting CoreELEC eMMC installation tool...

System is not supported: g12a_s905x2_4g!

There is NO official support by Team CoreELEC if you continue to run this tool! Continue? [y]: y

eMMC size: 0x000e8f800000 [64GB]

No CoreELEC installation found on eMMC

Install in dual boot mode, CoreELEC and Android on eMMC Use CoreELEC data from [1] current used SD or USB device [2] existing backup on current used SD or USB device

Install in single boot mode, only CoreELEC on eMMC Use CoreELEC data from [3] current used SD or USB device [4] existing backup on current used SD or USB device

Please choose one option? [1/2/3/4]: 3

Free space of 'partition CE_FLASH': 512MB Warning: Could not find 'dto' partition! Could not find 'CE_STORAGE' partition! Failed to read size of partition 'CE_STORAGE'! Failed to create new partition table! CoreELEC:/ #

@7Ji Do these warnings and fails say something to you? Especially the one "Could not find CE_STORAGE partition" caught my eye, because it is similar to the error that USB Burning Tool gives...

7Ji commented 3 months ago

Those shouldn't have anything to do with the burning image. Both ceemmc and Amlogic's burning process are proprietary and closed-source so I can't say what they actually do internally. But ceemmc runs on an existing system to modify the partitions while the eMMC burning process just erases everything and re-create them on the empty eMMC. My guess is ceemmc breaks because it failed to adjust the partition layout, different from the burning process where it breaks failing to "verify" a to-be-burned part.

However I don't think digging this is any much helpful. If we want real answer we would need serial log, that at least provides more info than the GUI program.

worstcase-scenario commented 3 months ago

That makes sense... I was just wondering if it even is possible to create a DUAL boot system on my box, so I tried it out with CoreElec. And also with EmuElec 4.0. The installation runs without any errors, but when I try to reboot into Emuelec / CoreElec, it doesn't load the partition, the A95 logo just stays there. .

But anyways, here's the verbose output of the EmuElec-installation, perhaps that can help a little (even if it's ceemmc and not the eMMC burning process as you explained...)

Starting EmuELEC eMMC installation tool... System is not supported: g12a_s905x2_4g! There is NO official support by Team CoreELEC DO NOT ASK THEM FOR SUPPORT! if you continue to run this tool! Continue? [y]: y

eMMC size: 0x000e8f800000 [64GB]

Original partition table: [mmcblk0p01] bootloader offset 0x000000000000, size 0x000000400000 [4 MB], unkn [mmcblk0p02] reserved offset 0x000002400000, size 0x000004000000 [64 MB], unkn [mmcblk0p03] cache offset 0x000006c00000, size 0x000046000000 [1120 MB], cache [mmcblk0p04] env offset 0x00004d400000, size 0x000000800000 [8 MB], unkn [mmcblk0p05] logo offset 0x00004e400000, size 0x000000800000 [8 MB], code [mmcblk0p06] recovery offset 0x00004f400000, size 0x000001800000 [24 MB], code [mmcblk0p07] misc offset 0x000051400000, size 0x000000800000 [8 MB], code [mmcblk0p08] dtbo offset 0x000052400000, size 0x000000800000 [8 MB], code [mmcblk0p09] cri_data offset 0x000053400000, size 0x000000800000 [8 MB], cache [mmcblk0p10] param offset 0x000054400000, size 0x000001000000 [16 MB], cache [mmcblk0p11] boot offset 0x000055c00000, size 0x000001000000 [16 MB], code [mmcblk0p12] rsv offset 0x000057400000, size 0x000001000000 [16 MB], code [mmcblk0p13] metadata offset 0x000058c00000, size 0x000001000000 [16 MB], code [mmcblk0p14] vbmeta offset 0x00005a400000, size 0x000000200000 [2 MB], code [mmcblk0p15] tee offset 0x00005ae00000, size 0x000002000000 [32 MB], code [mmcblk0p16] vendor offset 0x00005d600000, size 0x000010000000 [256 MB], code [mmcblk0p17] odm offset 0x00006de00000, size 0x000008000000 [128 MB], code [mmcblk0p18] system offset 0x000076600000, size 0x000060000000 [1536 MB], code [mmcblk0p19] product offset 0x0000d6e00000, size 0x000008000000 [128 MB], code [mmcblk0p20] data offset 0x0000df600000, size 0x000db0200000 [56066 MB], data

No EmuELEC installation found on eMMC

Install in dual boot mode, EmuELEC and Android on eMMC Use EmuELEC data from [1] current used SD or USB device [2] existing backup on current used SD or USB device

Install in single boot mode, only EmuELEC on eMMC Use EmuELEC data from [3] current used SD or USB device [4] existing backup on current used SD or USB device

Please choose one option? [1/2/3/4]: 1

Free space of 'partition CE_FLASH': 2048MB Free space of 'partition CE_STORAGE': 51534MB

New partition table: [mmcblk0p01] bootloader offset 0x000000000000, size 0x000000400000 [4 MB], unkn [mmcblk0p02] reserved offset 0x000002400000, size 0x000004000000 [64 MB], unkn [mmcblk0p03] cache offset 0x000006c00000, size 0x000046000000 [1120 MB], cache [mmcblk0p04] env offset 0x00004d400000, size 0x000000800000 [8 MB], unkn [mmcblk0p05] logo offset 0x00004e400000, size 0x000000800000 [8 MB], code [mmcblk0p06] recovery offset 0x00004f400000, size 0x000001800000 [24 MB], code [mmcblk0p07] misc offset 0x000051400000, size 0x000000800000 [8 MB], code [mmcblk0p08] dtbo offset 0x000052400000, size 0x000000800000 [8 MB], code [mmcblk0p09] cri_data offset 0x000053400000, size 0x000000800000 [8 MB], cache [mmcblk0p10] param offset 0x000054400000, size 0x000001000000 [16 MB], cache [mmcblk0p11] boot offset 0x000055c00000, size 0x000001000000 [16 MB], code [mmcblk0p12] rsv offset 0x000057400000, size 0x000001000000 [16 MB], code [mmcblk0p13] metadata offset 0x000058c00000, size 0x000001000000 [16 MB], code [mmcblk0p14] vbmeta offset 0x00005a400000, size 0x000000200000 [2 MB], code [mmcblk0p15] tee offset 0x00005ae00000, size 0x000002000000 [32 MB], code [mmcblk0p16] vendor offset 0x00005d600000, size 0x000010000000 [256 MB], code [mmcblk0p17] odm offset 0x00006de00000, size 0x000008000000 [128 MB], code [mmcblk0p18] system offset 0x000076600000, size 0x000060000000 [1536 MB], code [mmcblk0p19] product offset 0x0000d6e00000, size 0x000008000000 [128 MB], code [mmcblk0p20] data offset 0x0000df600000, size 0x000d30200000 [54018 MB], data [mmcblk0p21] CE_STORAGE offset 0x0000df600000, size 0x000d30200000 [54018 MB], data [mmcblk0p22] CE_FLASH offset 0x000e0f800000, size 0x000080000000 [2048 MB], data

Used space of '/flash': 926MB Used space of '/storage': 473MB

There is enough free space on eMMC for installation!

Install EmuELEC on eMMC. Continue? [y]: y e2fsck 1.45.3 (14-Jul-2019)

resize2fs 1.45.3 (14-Jul-2019)

Starting to format the new 'CE_FLASH' partition... mkfs.fat 4.1 (2017-01-24) Stopping Kodi before start of copy process! Failed to stop kodi.service: Unit kodi.service not loaded.

Starting copying of data to the eMMC! Please do NOT interrupt this progress till it's finished!

Copy all data from '/flash' to '/media/CE_FLASH' 926.25M 100% 16.26MB/s 0:00:54 (xfr#48, to-chk=0/58)

Syncthing, please wait... Copy all data from '/storage' to '/media/CE_STORAGE/coreelec_storage' 473.72M 99% 12.98MB/s 0:00:34 (xfr#7065, to-chk=0/7733)

Syncthing, please wait... Start Kodi again to have a user interface! Failed to start kodi.service: Unit kodi.service not found.

Success!

But if this output doesn't quite help you / us, how do we get a serial log? Is there a possibility software-wise - or do you mean I need to somehow connect the hardware of the box and reading out the output?

7Ji commented 3 months ago

Is there a possibility software-wise - or do you mean I need to somehow connect the hardware of the box and reading out the output?

You must find a way to solder a UART header and read the box's log there, the software-only log doesn't help.

worstcase-scenario commented 3 months ago

Okay, thank you for the clarification. This is in the moment unfortunately above my technical skills. So I guess we kind of reached a dead end for my problem. I will try to continue fiddling around sofrwarewise and see if I can get any other results... because this has to be somehow possible, right? Because I can flash any other firmware on my box,... I will keep you posted, thanks a lot for your time and your insights and patience with me!

7Ji commented 3 months ago

I don't think you would have any luck finding anything useful. You're fighting against a black box that starts to work before any software is ready to be analyzed by you. The only way you could ever get any advantage is to get a log that it directly outputs, the serial log. And please don't re-open this issue or ping me unless you have serial log.

7Ji commented 3 months ago

Can you post a full log of hepacker？From another report ampart seems to fail to adjust the partition layout in DTB as it does not recognize the dclone mode.

https://github.com/HybridELEC/HybridELEC/issues/42#issuecomment-2308353687

If your log is similar please also post the result of ampart --version, I'm afraid I broke ampart in a previous update.