Bl301 injection, problems, help,

How do I find out if my TX3 is capable of using the the injection or not? I got mine via geekbuying, not AliExpress.

Hi, I have a broken M9C Max (S905x_2 / 16) (gxl_p212_2g.dtb) box after having followed the bl301-injection tutorial to the letter.

Process details

*CoreELEC:~ # inject_bl301 *
Starting bootloader blob BL301 injection tool…

This tool can be used to update the bootloader
blob BL301 of the vendor bootloader on the internal
eMMC. This bootloader blob BL301 is customized by
Team CoreELEC to support all wake-up features like
CEC, Wake-On-LAN, IR, and GPIO wake-up from
suspend or power off state!

Device serial number: 210a8200e920b23dc5d3eeaaf7d6e0bf
Using CPU type GXL (21): S805X, S805Y, S905X, S905D, S905W, S905L, S905M2
Using binary type because of CoreELEC DT-ID: Generic
Using /dev/bootloader as bootloader partition

Found a valid Amlogic v2 ToC header (0xC200)
Amlogic magic: AMLC
Old signature ToC: C1575C02C371DCE3981BF3B0020687C0D2588353E21A6B63C8A0DEF06FD7A3F2
Name: AA640001
Serial Number: 12345678
Flags: 0
Found BL30 blob image at: 0x10200 (0xD600)
Found BL31 blob image at: 0x20200 (0x15400)
Amlogic magic: AMLC
Old signature bl30: 562069D80B05CBEA266A6AF91E71EF944BC7C054B1CB1AD39EF58120090074FD
Using bl301 blob: Generic_21_bl301.bin
Using bl30 blob: /gxl/bl30.bin
Use config.ini value: remotewakeup = 0x10015
Use config.ini value: decode_type = 0x00
Use config.ini value: remotewakeupmask = 0x10015
Use config.ini value: cec_osd_name = CoreELEC
New signature bl30: D5BAEF23DC26E1A99F9CE6C19A21EF1763A8724F7C2803FAA7E797885FE254FA
BL301.bin needs to be updated on eMMC
Old signature bl31: B96B87A7707937F374D294A07ACAF4CC8D1B3A290A5E2B14BEDC49A28589C3C2
BL31 time stamp: Built : 18:30:11, Nov 1 2016
Using bl31 blob: /gxl/bl31.img
New signature bl31: FCAE077E75CB84170D8D3E9F731CFDC1F173BC020082F3A5D65A68EFE2F2C30E
BL31.img needs to be updated on eMMC

Please confirm to write the bootloader blob BL301 to
the internal eMMC! Please ensure to update first the device
to the last vendor firmware! And remember if the vendor
firmware get updated you have to do this step again as the
bootloader blob will be overwritten!

Continue? [y/n] y

Warning! GXL support is still experimental!
It is possible that the injection brick your device and it will not boot anymore!
It will be needed to short out the eMMC to recover the Amlogic device.
So there is no warranty by team CoreELEC if the injection will be successful or not!
Please confirm again to write the bootloader blob BL301 to
the internal eMMC on your GXL device!

Continue? [y/n] y

Make backup of vendor bootloader to: /flash/210a8200e920b23dc5d3eeaaf7d6e0bf_bl301.bin

New signature ToC header: EFD4D6371A2AE04DA1DFA5F4BECC7F99390E4D08817478B65DA70D4530FB97D0
ToC header needs to be updated on eMMC

Finished update of BL3 blobs on internal eMMC!*
Please reboot device now and enjoy the new CoreELEC wake-up features!

End

After the process, the box remained with the indicator in intense red and does not respond to anything.
After seeing the output through the serial port, I realized that the problem is a faulty bootloader

I attach the backup of the bootloader210a8200e920b23dc5d3eeaaf7d6e0bf_bl301.bin (4 MB)

Is there any way that bl301-injection works for this box?
Sorry for my English

Did you use latest nightly before injection?

nop, the estable version. https://github.com/CoreELEC/CoreELEC/releases/download/19.0-Matrix/CoreELEC-Amlogic-ng.arm-19.0-Matrix-Generic.img.gz

Your bootloader is from 2016.
Please search a image with Android 7.

For M9C Max there is only Android 6.0.1
A custom ROM would serve as atvx?

Yes, I use ATV Experience v4 so you can dual boot (I only preserved the bootloader and installed CE 19 on nand with ceemmc -x). It’s a ATV Pie iteration. Also, “universal Aidan’s custom ROM”, 7.1.2 worked for this box.

Great. Could you share the bootloader you are using …?

Try here:ATV Exp 4 register and burn the rom with AML tools.
Or you can try this ATV 7 for 905X.

Both bootloaders are ok for -ng CE

I don’t now how to share my bootloader from the nand. If somebody knows how to I could try to get it for you.

Does new CoreELEC 9.2.7 support BL301 on old 912 devices?

No, and it will not be possible for gxbb and gxm devices.

Thank you, I imagined it but I was hoping for it …
a few months ago I booted into android and I am no longer able to repeat the procedure to load the boot.ini which was well explained on the CoreElec / uboot wiki which unfortunately has been lost

Yes, that wiki was lost unfortunately. And unfortunately gxm and gxbb will have to stay in 3.14. as. We always said any help is appreciated and if someone can offer some solution all PR’s are welcome!

Hello, I would like to ask you, to add an installation for Mecool KIII Pro. For the older version the installation was, now unfortunately it is not (but it is still for older device, so maybe they just forgot?). Or please where can I ask? I am sorry for my bad English.

Your device is GXM S912 and not supported by injection.

I already solved, thanks

You’re welcome! Can you tell us how did you do it? Which method did you try? Card, shorting pins, AML flashing tools?

To update the bootloader of the Bqeel M9C Max box (S905x_2 / 16) (gxl_p212_2g.dtb) and be able to use bl301-injection; I flash atvX_p212_Oreo with aml-linux-usb-burn putting the box in amlogic mode by cutting pin # 30 of the Nand memory footprint.
Then I had problems when I wanted to use ceemmc -xv, it gave me an error for not finding the dtb partitions and there if I had to put atvXperience_v4_S905X_RT_BCM.
I also ran into the [usb_download] problem (Bqeel M9C Max - USB OTG port not working) but I was able to solve it without problems. Thanks to this great community.

1 Like

@Portisch I have a question: which software component is in charge to load the bl301 with config.txt settings (namely the remotewakeup code)? Is it the kernel, or some user space application?

The user data is injected by the tool inject_bl301 itself as it maybe require decrypt/encrypt of the bootloader blobs. It get checked on every boot if the checksum of the blob is changed. If yes do automatic a new injection.

About | FAQ | Terms of Service | Privacy Policy | Legal Notice