Bl301 injection, problems, help,

Hi everyone,
I am quite new to Coreelec and I bought a box just to run it as it was the kind of OS I needed.
However, after applying the bl301 injection through Coreelec hardware settings, my box never rebooted…
Now, it seems that it won’t power on, it does nothing when pressing the reset/recovery button and I don’t see it on my wired network so I can’t use SSH…
I am wondering if my box is bricked and thus, if I need to try the guide from JohnBoyz or if I am missing something?
The box I have is X96 Max+ 4/64.
Any help will be much appreciated.
Cheers.

Edit: if it is bricked, is there a way to just use the USB burning tool to restore the box to its initial state or is the short circuit the only option?

2nd edit: I opened up my box to check how it was inside and the PCB of teh X96 Max+ is different from the one shown in the guide from JohnBoyz.

What CE version you had installed when applying bl301? Does you see a vendor logo when plug in DC?

When you have the box already open can you attach a UART adapter?

The reset button does normally nothing. It’s only for push and hold when apply DC power.

1 Like

Hi Portisch, thanks for your reply.

I was using CE 9.2.4.2 when I applied bl301. Now, nothing happens when I plug in DC, no vendor logo, really nothing. However, on one of my HDMI hub, I can see that there is some electric activity as there is a LED on this HDMI hub when DC is plugged on my board.

I do not have a UART adapter and I don’t know if it’s compatible with my board. However, considering how cheap it is, I can buy one if it can solve my problem. I also need to buy a USB type A-A cable as I don’t have one at the moment as I have no way to link the board to my PC at the moment.

Here are 2 pics of my board if it can help: https://postimg.cc/gallery/0s5DS8p

Thanks again for your help.

Edit: Updated the link to the pics with better images.

Edit 09/13: if anyone happens to have the same problem with its X96 Max Plus at some point, here are the pins to short: https://forum.freaktab.com/forum/main-category/main-forum/637675-nand-chip-mask-rom-mode-short-location?p=813603#post813603

@Portisch
I have the inject bl301 in the GUI on my gxl device.
Is it because I had 9.2.4.0 then upgraded to 9.2.4.2?

Actually it appeared also for me, I do not know if because of some reboot or because I have actually injected bl301

It’s only visible on GXL if it got injected manually in console before. When you disable it in CE settings it will be hidden on next reboot.

I made some test on my four A95x-B7N

It works but often the device is turned on for no reason if the TV is switched on, even if I do not go to the HDMI input where the box is connected. It happens with two different TV (hisense and samsung).

And at least once I needed to power cycle the box because I could not switch it on with remote or HDMI CEC

Disable “active route” for CEC in CE settings.

I will do it. What this option is supposed to do? The description is quite cryptic

Since 30.08.2020 inject_bl301 should bring 100% GXL support. It also fix the non working suspend mode on bootloader older than 31.08.2018.

But be warned - it is still maintained as experimental for GXL platform.

1 Like

Is it possible to get it “standalone” without having to update CoreELEC to nightly? I want to check if it solve the issue that leave the box off and require power cycle

I don’t think so as it require also a up-to-date bl301 package to work correctly and this is read only area.
The nightlies are like stable + hot fixes.

Hi

For devices with encrypted bootloader, basically all the recent android 9 where the tool says “no magic number” there is any hope/work in progress?

No because of RSA encryption with public/private key set…

So there is no way to replace remote, because I would loose the power button right?

But I can replace the firmware with one having unencrypted bootloader, right?

Actually on this box (X88 Pro X3 with fake 4Gb RAM…) the CEC and suspend wakeup works, what does not work is the poweron after shutdown

Try last nightly, a update of meson-ir was done about IR wakeup with not injected bl301.

Can you please dump your encrypted bootloader?
Just use: dd if=/dev/bootloader of=/storage/backup/bootloader.img. Then send me the img file please somehow.

Hi @Portisch

Please find here the bootloader: https://drive.google.com/file/d/1NntkNIvC9OToXQO1BHiYvseJTNXaEj-0/view?usp=sharing

Let me know once you got it, ok?
Looks really encrypted from what I can see

–edit–

Tried the 20200904 nightly and power on and resume from suspend works now. And it works also with a different remote than the original one! What sorcery is that? :smiley:

Are you updating somehow the power button code or I am just lucky that the code is inside the Uboot? Unfortunately I cannot compare it with the original controller since my kids lost somewhere the remote… :stuck_out_tongue:

It depends what IR codes the vendor implemented. But usually there are around 5 pcs different codes.

The encrypted bootloader do have a length of 1289200 bytes what is a multiple of 16 bytes.
There are 16 “useless” random bytes at address 0x200 what I do not know what are they for. The real bootloader is starting at 0x210. Maybe it’s a simple encryption by these 16 bytes. I need to check it.

It works with all the remote I have, good it :wink:

The only problem is that it turn on at any AVR HDMI input change, which normally it is solved disabling the “active route” as you suggested, but without bl301 it is not possible.

Not a big problem though.

@Portisch are you in also on RAM configuration and dtb stuff? There is a problem with the 4Gb (I have opened a topic on it), I would like to help on it

Hi

It seems that at least on my bl301 injected a95x-b7n (GXL) if the box is powered off via CEC after at least one video playback, then it is not possible to turn it on via remote or CEC.

Sorry if I cannot provide logs, if anything is sent by the box attempting to power on, but I waiting for the delivery of the SDIO UART adaptor.

The issue is present with 9.2.4.2 and latest nightly