Bl301 injection, problems, help,

Is it possible to get it “standalone” without having to update CoreELEC to nightly? I want to check if it solve the issue that leave the box off and require power cycle

I don’t think so as it require also a up-to-date bl301 package to work correctly and this is read only area.
The nightlies are like stable + hot fixes.


For devices with encrypted bootloader, basically all the recent android 9 where the tool says “no magic number” there is any hope/work in progress?

No because of RSA encryption with public/private key set…

So there is no way to replace remote, because I would loose the power button right?

But I can replace the firmware with one having unencrypted bootloader, right?

Actually on this box (X88 Pro X3 with fake 4Gb RAM…) the CEC and suspend wakeup works, what does not work is the poweron after shutdown

Try last nightly, a update of meson-ir was done about IR wakeup with not injected bl301.

Can you please dump your encrypted bootloader?
Just use: dd if=/dev/bootloader of=/storage/backup/bootloader.img. Then send me the img file please somehow.

Hi @Portisch

Please find here the bootloader:

Let me know once you got it, ok?
Looks really encrypted from what I can see


Tried the 20200904 nightly and power on and resume from suspend works now. And it works also with a different remote than the original one! What sorcery is that? :smiley:

Are you updating somehow the power button code or I am just lucky that the code is inside the Uboot? Unfortunately I cannot compare it with the original controller since my kids lost somewhere the remote… :stuck_out_tongue:

It depends what IR codes the vendor implemented. But usually there are around 5 pcs different codes.

The encrypted bootloader do have a length of 1289200 bytes what is a multiple of 16 bytes.
There are 16 “useless” random bytes at address 0x200 what I do not know what are they for. The real bootloader is starting at 0x210. Maybe it’s a simple encryption by these 16 bytes. I need to check it.

It works with all the remote I have, good it :wink:

The only problem is that it turn on at any AVR HDMI input change, which normally it is solved disabling the “active route” as you suggested, but without bl301 it is not possible.

Not a big problem though.

@Portisch are you in also on RAM configuration and dtb stuff? There is a problem with the 4Gb (I have opened a topic on it), I would like to help on it


It seems that at least on my bl301 injected a95x-b7n (GXL) if the box is powered off via CEC after at least one video playback, then it is not possible to turn it on via remote or CEC.

Sorry if I cannot provide logs, if anything is sent by the box attempting to power on, but I waiting for the delivery of the SDIO UART adaptor.

The issue is present with and latest nightly

It’s on the way…

Did you setup the correct ir wakeup code?

Yes sure. It works most of the time, except on this very particular case and actually, seems only with my Samsung TV.

I have an AZW (Beelink?) W95 (S905W) box.

I was running the CoreELEC non -ng version.
The power off/on and suspend off/on worked correctly.
CEC did not work but it isn’t supported by the OEM (it’s not clear to me if BL301 injection is supposed to do anything about this).

I upgraded to the -ng version of CoreELEC.
Power off/on work correctly but the box immediately re-awakes after a suspend command.
CEC does not work.

I injected BL301.
The power off and suspend commands work. However, the power button will not turn on or wake the device once off/suspended. I have to power cycle the box to restart it. I tried all of the different IR Remote Power Codes.
CEC does not work.

I ran ir-keytable and found the codes for the button I assigned.
I put the following lines in my remote.conf file and rebooted:


The assigned button does not power on/wake the box.

Anything else I should try?


Read the guide carefully, remote.conf is not the correct place.

Thanks, that worked.
And, just to help me understand, if CEC wasn’t included with the box from the factory, should I expect to be able to get it to work? Or is that hardware related?


In the last image, there is not bl301 injection menu:

Need I activate it from command line?


If your device is a S905x the answer is yes!

1 Like


I execute the command and now there is BL301 options in the hardware menu.


1 Like

my tv box doesn’t allow me to inject bl301 because the bootloader is encrypted. how do I setup my remote to wake up my tv box when this is the case.

You could try to use remote.conf for you IR remote and possible power button will work for wake up