tigerbox-reverse-engineering / tigerbox

Holds all gathered information. Join our telegram-channel Check out our Telegram Channel https://t.me/tigerbox_reverse_engineering
18 stars 3 forks source link

UART - Starting kernel #5

Closed Dotsch2005 closed 9 months ago

Dotsch2005 commented 1 year ago

I followed the steps according to the instructions, however the UART interface hangs after the "Starting kernel ..."

Is there anything else to consider?

Thanks a lot

U-Boot 2014.10-RK3128-10-g210f35c-dirty (Jan 12 2023 - 15:41:09)

CPU: rk3128 cpu version = 0 CPU's clock information: arm pll = 600000000HZ periph pll = 594000000HZ ddr pll = 792000000HZ codec pll = 400000000HZ Board: Rockchip platform Board Uboot as second level loader DRAM: Found dram banks: 1 Adding bank:0000000060000000(0000000020000000) 128 MiB ▒*Y[[▒R+▒R▒▒▒j▒▒SdmmcInit = 2 0 storage init OK! Using default environment

GetParam Load FDT from boot image. power key: bank-0 pin-5 pmic:rk816 DCDC vdd_arm has been used, pwm regulator not init it. DCDC vdd_logic has been used, pwm regulator not init it. Can't find dts node for fuel guage cw201x can't find dts node for ADC Secure Boot Mode: 0x1 SecureBootEn = 1, SecureBootLock = 1

Boot ver: 2020-11-25#2.31

sn: XXXXXXXXXXXXXXXXXXXXXX checkKey vbus = 1 read logo on state from dts [1] gpio_get_value(bt_gpio)===========0,,,bt_gpio==541 gpio_get_value(bt_gpio)===========0,,,bt_gpio==541 gpio_get_value(uart0rx_gpio) phm= 1 rk_pwm_bl_config: brightness: 150 Hit any key to stop autoboot: 0 ERROR: [get_entry_ram]: Cannot find logo_kernel.bmp! Secure Boot state: 1 kernel @ 0x62000000 (0x006bd2d8) ramdisk @ 0x65bf0000 (0x00181f88) bootrk: do_bootm_linux... Loading Device Tree to 65600000, end 65617241 ... OK Add bank:0000000060000000, 0000000020000000

Starting kernel ...

SciLor commented 1 year ago

I think newer versions of the system of the box disabled the uart output. One thing you may try is to glitch the storage access in the right moment and check if UBoot falls back into a mode where you can enter commands and force the uart input/output or something similar.

h4de5 commented 1 year ago

anyone had any luck with recent models?

user0-07161 commented 1 year ago

You can try the new recovery method to get adb without opening the device. Please refer "UART adb root - via USB android Recovery without opening" you need Linux or Windows Subsystem for Linux (Version 2, Debian or Ubuntu)

chrisUse commented 9 months ago

Hey i have the same issue with hardware version BTS84_V5_20200622. I tested at first with the "recovery without opening" without any luck. Now i open the box and pin on the UART but @Dotsch2005 i don't get access. My test system is linux and i use gtkterm for serial communication. @SciLor i think you are right in newer versions they disable it. The only one reaction for keyboard import that i get is "GPIO0_INTEN: 0x00001920 01c-armoff-2345sram786Kd543210 GPIO0_INTEN: 0x00001920 01c-armoff-2345sram786". Is there any chance to get access?

user0-07161 commented 9 months ago

@chrisUse Where was the problem with the "recovery" option? Got you into the recovery? I created this method so I would be happy to know what wasn't working.

chrisUse commented 9 months ago

Hey @user0-tb, thx for your fast answer, if i run the adb command i get a error:

adb pull /dev/block/mmcblk0p12 image.row
adb: error: failed to copy '/dev/block/mmcblk0p12' to 'image.row': remote Permission denied

In the serial terminal i get this output if i connect the USB cable at recovery mode:

[ 1004.992420] ***************vbus detect*****************
[ 1004.995122] rk_battery_charger_detect_cb , battery_charger_detect 1
[ 1005.002185] rk816-bat: receive bc notifier event: USB..
[ 1005.003426] charge_current=====0,RK816_USB_CTRL_REG===0x40
[ 1005.004301] rk816-bat: set charger type: USB, current: input=450, chrg=1000
[ 1005.007424] healthd: battery l=85 v=3898 t=18.8 h=2 st=2 c=-158 chg=u
V/ [File] : bootable/recovery/recovery.cpp; [Line] : 1066; [Func] : get_menu_selection; got a66123] 1k3.
V/ [Fpmic:: bootan
/recovery/recovery.cpp; [Line] : 1068; [Func] : get_menu_selection; visible : 1
V/ [File] : bootable/recovery/recovery.cpp; [Line] : 1081; [Func] : get_menu_selection; got a action : -1.
V/ [File] : bootable/recovery/recovery.cpp; [Line] : 1066; [Func] : get_menu_selection; got a key : 143.
V/ [File] : bootable/recovery/recovery.cpp; [Line] : 1068; [Func] : get_menu_selection; visible : 1
V/ [File] : bootable/recovery/recovery.cpp; [Line] : 1081; [Func] : get_menu_selection; got a action : -1.
[ 1005.169515] Using Buffer DMA mode
[ 1005.169549] Periodic Transfer Interrupt Enhancement - disabled
[ 1005.169567] Multiprocessor Interrupt Enhancement - disabled
[ 1005.169581] OTG VER PARAM: 0, OTG VER FLAG: 0
[ 1005.169594] ^^^^^^^^^^^^^^^^^Device Mode
[ 1005.169644] *******************soft connect!!!*******************
[ 1005.465157] USB RESET
[ 1005.529438] android_work: sent uevent USB_STATE=CONNECTED
[ 1005.533238] USB RESET
[ 1005.608708] android_usb gadget: high-speed config #1: android
[ 1005.609341] android_work: sent uevent USB_STATE=CONFIGURED

Do you have an idear?

user0-07161 commented 9 months ago

@chrisUse I have an idea, yes. On the "Recovery" method type adb root before pulling. It should work. Should also been fixed in the Manual. I forgot to write it into the Manual.

chrisUse commented 9 months ago

@user0-tb Yes you are right. Thx. In the manual the root command looks for me that the adb server on the client run with root rights and not the adb on android side?

user0-07161 commented 9 months ago

I think the ADB on android side run as root already after boot and on the client not. But however, it's working fine.

chrisUse commented 9 months ago

Ok the adb root command change the local adb into root mode? So it is only a issue on my system thats fine. Thx. I dont understand it because i started the service as root but its fine that it works now. Is it possible that you can add this information to your manual so that others can find it faster if there have the same strange scenario, thats saves lot of time :). Man many thanks for your work and fast support, so make thinks fun!

user0-07161 commented 9 months ago

It is now an PR opened including this in the Manual. You can follow the progress on #10

SciLor commented 9 months ago

Thank you for enhancing the wiki

user0-07161 commented 9 months ago

@SciLor please! I'm happy to help!

user0-07161 commented 9 months ago

@chrisUse it's now described in the Manual.

chrisUse commented 9 months ago

@user0-tb many thx. for your very fast help and update the manual. I have also a tigerbox touch plus and would like to check if there is this way also working. Is it helpful for you to get a feedback of this?

user0-07161 commented 9 months ago

@chrisUse I don't have an Tigerbox Plus and find they to expensive to buy an. Would you Post an Picture of the Recovery Menu?

user0-07161 commented 9 months ago

@chrisUse ?