Bricked s905x4(pro vision 4k)

Unlikeall3 · 22 April 2026 11:31

Bricked device,need help,won’t pass 3% with AML tool(bl2 is corrupted or missing) tried different cables,12v2a psu,short USB A USB A cable,still same error,tried shorting pins on back panel,still no luck,device won’t enter maskrom mode,if anyone has u boot bin,bl2 or recovery image file or other advice how to fix it,any help welcome.

flowfailinidentifyhost(bootbl2).txt (129.7 KB)
s905x4errorlog.txt (1.6 KB)

Uart log:

SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-0:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-1:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-2:0;CHK:0;FPC:E0010140;RST:FFFEC988▒SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;NAND:SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;NAND:81;SPINAND:2FF;SD:2002;USB:ADFU;RST:FFFE83C0SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:1;USB:0;RD-00:0;:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;RST:FFFE8504▒SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-0:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-1:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;eMMC:0;RD-2:0;CHK:0;FPC:E0010140;RST:FFFEC988SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;NAND:SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:0;NAND:81;SPINAND:2FF;SD:2002;USB:ADFU;RST:FFFE83C0▒SC2:BL:635f8f;ID:8096B21840A00F11;FEAT:3FF0F0F:1FFE0000:9002F:1;POC:FF;RCY:0;OVD:0;DFU:1;USB:0;RD-00:0;

Unlikeall3 · 22 April 2026 14:37

In Linux it would appear as Device 005: ID 1b8e:c004 Amlogic, Inc. DNL but still no luck shorting 2 pins on back plate and it won’t enter maskrom mode:

Ubuntu@ubuntu:~/aml-flash-tool-master$ sudo ./flash-tool.sh --img=/media/ubuntu/2C33-57FD/SEI804HM-user-burn-20221102-v11.8.3236-secureboot-flag.img --parts=all --wipe --soc=g12a
Amlogic device not found
ubuntu@ubuntu:~/aml-flash-tool-master$ lsusb 
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 003: ID 5986:0295 Bison Electronics Inc. Lenovo Integrated Webcam
Bus 001 Device 004: ID 8087:07da Intel Corp. Centrino Bluetooth Wireless Transceiver
Bus 001 Device 005: ID 1b8e:c004 Amlogic, Inc. DNL
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 002: ID 048d:1234 Integrated Technology Express, Inc. Chipsbank CBM2199 Flash Drive
Bus 002 Device 003: ID 058f:6366 Alcor Micro Corp. Multi Flash Reader
Bus 002 Device 005: ID 14cd:1212 Super Top microSD card reader (SY-T18)
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

Portisch · 22 April 2026 18:23

You don’t need to shorten anything, the emmc is just empty.
Flash Android IMG to the device with usb burning tool or khadas Linux tool:

Unlikeall3 · 22 April 2026 22:55

Hello,thank you,can you suggest which IMG file I should try to flash? I couldn’t find the one exactly for my board.

Unlikeall3 · 23 April 2026 04:17

Some errors still persist,probably because IMG file is for homatics s905x4 box and not for pro vision 4K,ddr timings mismatch or something,but I couldn’t find correct image for flashing:

ubuntu@ubuntu:~/utils$ lsusb | grep Amlogic
Bus 002 Device 007: ID 1b8e:c004 Amlogic, Inc. DNL
ubuntu@ubuntu:~/utils$ sudo ./burn-tool -v aml -b VIM4 -i /media/ubuntu/9C2F-C432/3660.img
Try to burn Amlogic image...
Burning image '/media/ubuntu/9C2F-C432/3660.img' for 'VIM4' to eMMC...
next try index 3, current opt arg /media/ubuntu/9C2F-C432/3660.img
MSG[TLS]pkg path /media/ubuntu/9C2F-C432/3660.img
next try index 5, current opt arg 1
MSG[TLS]erase_flash 1
MSG[TLS]exe run path:/home/ubuntu/utils/aml-flash-tool/tools/adnl
MSG[FLW]Aml_flow_init version V1.1-trunk Nov  1 2019!
MSG[FLW]Tooltype 3
DBG[FLW]ok in load lib AmlImagePack.so
MSG[FLW]OK leave Aml_flow_init

ERR[FLW]f(lua_res_release)L134:lua_res_release!
[Msg]Image package version 0x2
MSG[FLW]open img ok
MSG[FLW]dll modulePath /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
MSG[FLW]Read usb_flow.aml with sz 189008
MSG[FLW]plug[0] add loader[usb_flow_dnl]
MSG[FLW]plug[0] add loader[aml_mod_imgdec]
MSG[FLW]plug[0] add loader[aml_mod_util]
MSG[FLW]plug[0] add loader[aml_mod_key_burn]
MSG[FLW]plug[0] add loader[aml_mod_tool_apis]
MSG[FLW]plug[0] add loader[aml_mod_fastboot_dev]
MSG[FLW]plug[0] add loader[aml_mod_key_init]
MSG[FLW]plug[0] add loader[usb_flow_image_load]
MSG[FLW]plug[0] add loader[aml_mod_worldcup_dev]
MSG[FLW]plug[0] add loader[usb_flow_worldcup]
MSG[FLW]plug[0] add loader[json]
MSG[FLW]Decrypt and load lua flow ok
MSG[FLW]dll modulePath /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
MSG[FLW]mod run time path /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
package.path=	/usr/local/share/lua/5.3/?.lua;/usr/local/share/lua/5.3/?/init.lua;/usr/local/lib/lua/5.3/?.lua;/usr/local/lib/lua/5.3/?/init.lua;./?.lua;./?/init.lua
package.cpath=	/home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow/?.so;/usr/local/lib/lua/5.3/?.so;/usr/local/lib/lua/5.3/loadall.so;./?.so;/usr/local/lib/lua/5.3/lib?53.so;./lib?53.so
MSG[AUL]_libInstallPath=/home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
DBG[AUL]ok in load lib /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow/AmlImagePack.so
DBG[AUL]ok in load lib /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow/libamlfastboot.so
[FLW]LMsg[ImgLoad]--[Trunk]flow V2.7.1 version 97c5c4a-clean at Tue Apr 13 14:23:57 CST 2021
[FLW]LMsg[ImgLoad]imgPath[/media/ubuntu/9C2F-C432/3660.img]
DBG[AUL]to open [/media/ubuntu/9C2F-C432/3660.img]
[Msg]Image package version 0x2
MSG[AUL]OK in open pkg(/media/ubuntu/9C2F-C432/3660.img)
LMsg[Imgdec]item[conf,platform] sz 29, buf cap 29
LMsg[Imgdec]-----platform conf------
LMsg[Imgdec][Platform] 0x0812
LMsg[Imgdec][soctype] SC2
LMsg[Imgdec]-----platform conf------
[FLW]LMsg[ImgLoad]maintype    	subtype     	FileFormat verify Cmd
[FLW]LMsg[ImgLoad]USB         	UBOOT_ENC   	normal	3248128
[FLW]LMsg[ImgLoad]USB         	UBOOT       	normal	3248128
[FLW]LMsg[ImgLoad]USB         	DDR_ENC     	normal	3248128
[FLW]LMsg[ImgLoad]USB         	DDR         	normal	3248128
[FLW]LMsg[ImgLoad]PARTITION   	dtbo        	normal	2097152	verify sha1sum 9efbb9809b14385616707b76fddbd02cdd8c60c3
[FLW]LMsg[ImgLoad]PARTITION   	super       	sparse	1764804620	verify sha1sum b808e4253292a472d616571b2886ed85b9fe3cc9
[FLW]LMsg[ImgLoad]PARTITION   	vbmeta_system	normal	4096	verify sha1sum df0e0f8937f19df7cb1e044e826511edd86aa232
[FLW]LMsg[ImgLoad]PARTITION   	_aml_dtb    	normal	258048	verify sha1sum 535dbf3cbdaa4aa97e5cead8f7224e5d92a057d8
[FLW]LMsg[ImgLoad]PARTITION   	logo        	normal	5729072	verify sha1sum 5af1f882dd9edaa5619892db3503e48d0ec6fc77
[FLW]LMsg[ImgLoad]PARTITION   	recovery    	normal	25165824	verify sha1sum 149512e5f1a6021f93a276912d4290f15f426a88
[FLW]LMsg[ImgLoad]PARTITION   	odm_ext     	sparse	6922316	verify sha1sum 7097d70bf8fefec7a62d6c3834160b86268c3108
[FLW]LMsg[ImgLoad]PARTITION   	vbmeta      	normal	8192	verify sha1sum c85e647bec0ad24431cb3fb7ec3f87264f8dd438
[FLW]LMsg[ImgLoad]PARTITION   	boot        	normal	67108864	verify sha1sum 52b935870eaedf922c1990cea122c69183b26b90
[FLW]LMsg[ImgLoad]PARTITION   	oem         	normal	52428800	verify sha1sum d7e831b5393f1aa47968ee6d66fcea521a910334
[FLW]LMsg[ImgLoad]PARTITION   	vendor_boot 	normal	25165824	verify sha1sum 601bae7bdfada8af58e82e8ffa60080177057599
[FLW]LMsg[ImgLoad]PARTITION   	bootloader  	normal	3248128	verify sha1sum 5d1d26704dc567d7ece80a943ec685b729e1f38a
[FLW]LMsg[ImgLoad]aml         	usb_flow    	normal	189008
[FLW]LMsg[ImgLoad]conf        	platform    	normal	29
[FLW]LMsg[ImgLoad]conf        	keys        	normal	17
[FLW]LMsg[ImgLoad]dtb         	meson1      	normal	258048
[FLW]LMsg[ImgLoad]UBOOT.ENC   	aml_sdc_burn	normal	3248640
[FLW]LMsg[ImgLoad]ini         	aml_sdc_burn	normal	602
[FLW]LMsg[ImgLoad]UBOOT       	aml_sdc_burn	normal	3248640
[FLW]LMsg[ImgLoad]end parse image items
[FLW]LMsg[ImgLoad]Use extern key module
[FLW]LMsg[ImgLoad]internal key module init called
[FLW]LMsg[ImgLoad]use external key_provider_init xx
[FLW]LMsg[ImgLoad]use external aml_key
[FLW]LMsg[ImgLoad]Supported usb type nil
[FLW]LMsg[ImgLoad]json cfg /tmp/lua_IbqCfm
[FLW]LMsg[ImgLoad]Load jason OK
[FLW]LMsg[ImgLoad]Save ltype to jason OK
DBG[FLW]pcall ret true, errcode 0
MSG[FLW]imgCfgPath /tmp/lua_IbqCfm
MSG[TLS]Waiting for Amlogic DNL device ANY
MSG[TLS]Update path for existed dev
MSG[TLS]serial not specified, assign to 8096b21840a00f1100000000
MSG[TLS]cb: devicePath /dev/bus/usb/002/007
MSG[FLW]cDevType dnl
MSG[TLS]Get para ox0x139e8b68
MSG[FLW]device para 0x0x139e8b68
MSG[FLW]CREATE state for[8096b21840a00f1100000000]
MSG[FLW]plug[0] add loader[usb_flow_dnl]
MSG[FLW]plug[0] add loader[aml_mod_imgdec]
MSG[FLW]plug[0] add loader[aml_mod_util]
MSG[FLW]plug[0] add loader[aml_mod_key_burn]
MSG[FLW]plug[0] add loader[aml_mod_tool_apis]
MSG[FLW]plug[0] add loader[aml_mod_fastboot_dev]
MSG[FLW]plug[0] add loader[aml_mod_key_init]
MSG[FLW]plug[0] add loader[usb_flow_image_load]
MSG[FLW]plug[0] add loader[aml_mod_worldcup_dev]
MSG[FLW]plug[0] add loader[usb_flow_worldcup]
MSG[FLW]plug[0] add loader[json]
MSG[FLW]Decrypt and load lua flow ok
MSG[FLW]dll modulePath /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
DBG[FLW]to call usb_flow_dnl.lua
package.path=	/usr/local/share/lua/5.3/?.lua;/usr/local/share/lua/5.3/?/init.lua;/usr/local/lib/lua/5.3/?.lua;/usr/local/lib/lua/5.3/?/init.lua;./?.lua;./?/init.lua
package.cpath=	/home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow/?.so;/usr/local/lib/lua/5.3/?.so;/usr/local/lib/lua/5.3/loadall.so;./?.so;/usr/local/lib/lua/5.3/lib?53.so;./lib?53.so
MSG[AUL]_libInstallPath=/home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow
DBG[AUL]ok in load lib /home/ubuntu/utils/aml-flash-tool/tools/adnl/./usb_flow/AmlImagePack.so
LMsg[usbFlw]imgCfgPath /tmp/lua_IbqCfm
LMsg[usbFlw]get img cfg from json file /tmp/lua_IbqCfm
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]modUsb function: 0x13a70420
DBG[AUL]p1 is 1, p2 is 2
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]Load mod dnl ok
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]to open img["/media/ubuntu/9C2F-C432/3660.img"]
DBG[AUL]to open [/media/ubuntu/9C2F-C432/3660.img]
[Msg]Image package version 0x2
MSG[AUL]OK in open pkg(/media/ubuntu/9C2F-C432/3660.img)
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]device path [/dev/bus/usb/002/007]
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]portXY=[[8096b21840a00f1100000000]]
DBG[AUL]To open dev: /dev/bus/usb/002/007
MSG[FB]busnum 2, devnum 7
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]Use extern key module
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]key module loaded
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]identifyHost 6-0-0-0-0-0-0-15
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]soctype is 0x32,SC2
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]DV usb boot existed for BL1
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]downloadsize len 7, 0x3F800
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]0x812 download bl2 okay!
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]ready for bl2_boot!
ERR[FB]data transfer failure (19)
ERR[AUL]f(l_aml_fastboot.cpp)L145:Fail in bulk out, ret=-85
MSG[TLS][8096b21840a00f1100000000]737LErr[usbFlw]Fail in bulk OUT transfer, err -85
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]stack traceback:
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "usb_flow_dnl"]:921: in upvalue 'prERR'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_fastboot_dev"]:737: in local 'p1'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_util"]:467: in function <[string "aml_mod_util"]:461>
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	(...tail calls...)
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_fastboot_dev"]:146: in upvalue 'usb_send_cmd'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_fastboot_dev"]:155: in function <[string "aml_mod_fastboot_dev"]:154>
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	(...tail calls...)
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_fastboot_dev"]:265: in upvalue 'usb_cmd_getvar_bytes'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "aml_mod_fastboot_dev"]:273: in method 'Identify'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "usb_flow_dnl"]:300: in upvalue 'bl2_or_bl2e_flow'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "usb_flow_dnl"]:524: in function <[string "usb_flow_dnl"]:365>
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[C]: in function 'xpcall'
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]	[string "usb_flow_dnl"]:998: in main chunk
LMsg[UTIL]setErr mod, no USB 3
MSG[TLS][8096b21840a00f1100000000]148LErr[usbFlw]Fail in send cmd[getvar:identify]
MSG[TLS][8096b21840a00f1100000000]157LErr[usbFlw]Fail in write cmd
MSG[TLS][8096b21840a00f1100000000]266LErr[usbFlw]io err while getvar:identify
MSG[TLS][8096b21840a00f1100000000]302LErr[usbFlw]Fail in identifyHost
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]protocol is 6, wait BL2E
ERR[FB]data transfer failure (19)
ERR[AUL]f(l_aml_fastboot.cpp)L145:Fail in bulk out, ret=-85
MSG[TLS][8096b21840a00f1100000000]737LErr[usbFlw]Fail in bulk OUT transfer, err -85
MSG[TLS][8096b21840a00f1100000000]148LErr[usbFlw]Fail in send cmd[getvar:identify]
MSG[TLS][8096b21840a00f1100000000]157LErr[usbFlw]Fail in write cmd
MSG[TLS][8096b21840a00f1100000000]266LErr[usbFlw]io err while getvar:identify
MSG[TLS][8096b21840a00f1100000000]302LErr[usbFlw]Fail in identifyHost
MSG[TLS][8096b21840a00f1100000000]burn disconnect
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]FAILURE!! in [romboot] flow(true, nil)
MSG[TLS]UI:[8096b21840a00f1100000000][flow]Fail in identifyHost

LMsg[UTIL]_errno stage [bl1,2] mod [USB,3]
MSG[TLS][8096b21840a00f1100000000]LMsg[usbFlw]status,ret,errcode (true,nil, 0x01020103)
DBG[FLW]pcall ret true, errcode 16908547
DBG[FLW]END call usb_flow_dnl.lua, errcode 16908547
MSG[TLS][8096b21840a00f1100000000]burn FAIL!!Oh-Oh-Oh!!

Portisch · 23 April 2026 05:42

You can’t just flash a homatics img because it’s protected.
We do not have Android images. Ask your vendor for a recover img or move the device to your round bin.

Unlikeall3 · 25 April 2026 16:40

One more question,how to force maskrom mode,instead of adnl mode? This board has Emmc memory and spi memory. Shorting 2 pins on backplate doesn’t do anything.

Unlikeall3 · 26 April 2026 10:22

Also I found that boot.img and bootloader.img are the same from official DFF update and for homatics 4K recovery image,the problem is fingerprint mismatch,my hardware ID 8096B21840A00F11 and
Feature/Security Fuses (FEAT) 3FFOFOF:1FFE000O:9002F:1
If could somehow modify recovery image to match them,this should work,currently I have no clue how to do that,official support is silent and don’t provide recovery images.

This is homatics ini file:
erase_bootloader=1
erase_flash=1
reboot=1
[burn_ex]
license_addr=0x153625A0
hw_fingerprint=0x51253b50e27db36f02fb30d5b6e56bdb
hw_id=aml_sei804hm_dune
package=aml_sei804hm_dune.img

p750mmx · 26 April 2026 10:56

In what way is this CE related? You should ask somewhere else, like over at AVS, regarding your USB recover method (which is not originally coming from Homatics/Sei Robotics/Dune).

Unlikeall3 · 7 May 2026 13:14

If this bothers you,don’t read this thread.

Unlikeall3 · 7 May 2026 13:16

Update,with help from other very kind person,I am amble now to boot into CoreElec,the Emmc was totally empty.

Uart log:
coreeleclog.txt (58.2 KB)

neqwdtkukwjaanti · 7 May 2026 14:04

that’s not coreelec, that’s avdvplus, you must have a low opinion of people’s intelligence here if you thought nobody would notice

Unlikeall3 · 7 May 2026 14:27

Okay,you got me,I am guilty.