Unbrick Scishion V88 Pro (S905X)

Hello guys, I need your help.

I bricked an old tvbox Scishion V88 Pro (S905X - 1 GB of RAM) that I wanted to update for my cousin.

CoreELEC (old 3.14 kernel) was installed in the internal memory and I tried to update to the new 4.9 kernel using the tar file. The terminal warned me that the update could brick the box, but I was dumb enough to go head…

This resulted in a bricked box.

Since it doesn’t have a reset button, I had to open it and short some pins so the computer could detect it. Now the computer always detects the box after connecting the USB.

However every method I try fails to completely flash an image.

  1. On my Linux laptop using aml-flash 4.7.1 (modified by Stane1983):
[pedro@R2-D2 aml-linux-usb-burn]$ ./aml-flash --img=atvx-s905x.img --parts=all
Waiting for Amlogic device to be connected...
Unpacking image [OK]
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
awk: linha de comandos:1: aviso: sequência de escape de regexp "\"" não é um operador regexp conhecido
Initializing ddr ........[OK]
Running u-boot ........[OK]
Create partitions [KO]
  1. On my Windows 10 virtual machine with USB Burning Tool, it always fails at 7 % with Uboot/Get result/DiskInitial error.

  2. Using Amlogic Burn Card Maker and SD card also fails with the green bar stopping early in the process.

  3. Putting a TWRP recovery.img on the SD card doesn’t help much, since there are no partitions on the tvbox that I can choose to flash.

Also tried multiple firmwares, stock and custom and flashing always fails when trying to create partitions.

I already unbricked plenty of Android tvboxs before and this is the first time I can’t do it. What else can I try?

Thanks in advance!

See here and here.

1 Like

Thanks for the fast reply, but I already tried those methods.

It seems that the partition that can’t be created is the bootloader.

Have you tried different versions of the USB Burning Tool? For example, one of my devices can only be flashed with v2.1.2.

See if you can boot CoreELEC from SD or USB.

1 Like

Yes, I did try multiple versions of USB Burning Tool.

I can partly boot CoreELEC for a few seconds from the SD card if I write u-boot.bin with BootcardMaker (method shared by @Nebojsa). However, after the initial boot it goes all black/green and never enters into Kodi.

Thsi confirms you are using the wrong firmware.

1 Like

It’s strange because I already tried every stock firmware for this tvbox available at 4PDA, as well as multiple custom roms.

I even opened the tvbox again to confirm what board it is.

Board:

2016-07-15
MX6_RTL8189FTV_V02

I’m thinking that maybe the firmwares I’ve been trying don’t have all the required files for a full restore.

This is what I get when unpack stock firmwares:

aml_sdc_burn.ini
aml_sdc_burn.UBOOT
boot.PARTITION
bootloader.PARTITION
DDR.USB
image.cfg
logo.PARTITION
manifest.xml
meson1.dtb
platform.conf
projectname.txt
recovery.PARTITION
system.PARTITION
UBOOT.USB

This is what I get when unpack custom slimBOXtv and atvXperience firmwares:

_aml_dtb.PARTITION
aml_sdc_burn.ini
aml_sdc_burn.UBOOT
boot.PARTITION
bootloader.PARTITION
DDR.USB
dtbo.PARTITION
image.cfg
logo.PARTITION
odm.PARTITION
platform.conf
product.PARTITION
projectname.txt
recovery.PARTITION
system.PARTITION
UBOOT.USB
vbmeta.PARTITION
vendor.PARTITION

Are there any files missing from these firmwares to do a full restore? Are they only suitable for partial updates (OTA)?

As you can see, the stock firmwares have 14 files, while the custom have 18…

Someone suggested that the problem could be with the dtb file.

Sorry for late reply. Your error means that bootloader can’t find matching device tree in dtb.img. You have mismatch somewhere in IMG file.

Curiously, if I flash individual partitions with the Linux tool, the only partition that shows an error is bootloader.

For example:

[pedro@R2-D2 aml-linux-usb-burn]$ sudo ./aml-flash --soc=gxl --wipe --img=aml_upgrade_package.img --parts=bootloader
Unpacking image [OK]
Initializing ddr ........[OK]
Running u-boot ........[OK]
Create partitions [KO]
[pedro@R2-D2 aml-linux-usb-burn]$ sudo ./aml-flash --soc=gxl --wipe --img=aml_upgrade_package.img  --parts=recovery
Unpacking image [OK]
Wiping  data partition [OK]
Wiping  cache partition [OK]
Writing recovery partition [OK]

Any thoughts guys?

Maybe you could try Aidan’s Custom Android TV Firmware for S905X?

1 Like

Same result with Aidan’s ROM. It also has 18 files inside the img file.

_aml_dtb.PARTITION
aml_sdc_burn.ini
aml_sdc_burn.UBOOT
boot.PARTITION
bootloader.PARTITION
DDR.USB
dtbo.PARTITION
image.cfg
logo.PARTITION
odm.PARTITION
platform.conf
product.PARTITION
projectname.txt
recovery.PARTITION
system.PARTITION
UBOOT.USB
vbmeta.PARTITION
vendor.PARTITION
[pedro@R2-D2 aml-linux-usb-burn]$ sudo ./aml-flash --soc=gxl --parts=all --img=/home/pedro/Box/v9-Aidan-S905X-ATV9.img
Unpacking image [OK]
Initializing ddr ........[OK]
Running u-boot ........[OK]
Create partitions [KO]

The only remaining suggestion I’d have is to contact the vendor/manufacturer and ask for the stock firmware.

1 Like

This is a false problem, a firmware itself should contain all it needs for a clean flash by itself. The flahsing process includeds re-partitioning the eMMC before any other writing, it must contain all files for all partitions it want to create and have data on (it can create some empty partitions that don’t have data, in which case those corresponding files are not needed, which is usually the case for e.g. cache, data, etc), otherwise the box won’t be bootable and the firmware shouldn’t be released and even used by the OEM themselves in the first place. (Technically you can have a firmware that does less writing than that, if you create one by yourself)

This is probably caused by bad eMMC or shoring eMMC for too long, the DDR and u-boot are loaded in RAM, so these two steps do not involve writing to eMMC, but the step Create partitions needs to create the partition table on eMMC, which needs the eMMC to be writable. If the eMMC is fried, or you are shorting the pins to make eMMC un-recognizable so you could flash the firmware yet you are holding it too long (so eMMC is still un-recognizable during the flash, which then is of course not writable), then this could happen

1 Like

Try this maybe

Need factory/stock firmware 6.01
As close to date you posted 2016 07 15

UBT 2.08 version

Open Tool load factory hit start
DO NOT PLUG IN USB CABLE YET.

From sd card either CoreElec or bootcard you made
Insert sd and partial boot

At boot
Now plug in USB cable
Pop sd card out

Should burn/flash firmware
Hopefully

Happy Testing

1 Like

I need to add to my description, if your ‘stock firmware’ here refers to ‘v88 pro s905X 8189 10 22aml_upgrade_package’, then the different partitions included in custom firmware is not ‘missing’ from the stock firmware, those are partitions required by the newer Android spec, which old Android firmware does not need at all

The DTB in your ‘stock firmware’ has a partitions node that describe the following partitions:

DTS report partitions: 11 partitions in the DTB:
=======================================================
ID| name            |            size|(   human)| masks
-------------------------------------------------------
 0: logo                      2000000 (  32.00M)      1
 1: recovery                  2000000 (  32.00M)      1
 2: rsv                        800000 (   8.00M)      1
 3: tee                        800000 (   8.00M)      1
 4: crypt                     2000000 (  32.00M)      1
 5: misc                      2000000 (  32.00M)      1
 6: instaboot                20000000 ( 512.00M)      1
 7: boot                      2000000 (  32.00M)      1
 8: system                   40000000 (1024.00M)      1
 9: cache                    20000000 ( 512.00M)      2
10: data                              (AUTOFILL)      4
=======================================================

With which, Amlogic’s u-boot will construct a partition table like the following if the eMMC is 32G

EPT report: 14 partitions in the table:
===================================================================================
ID| name            |          offset|(   human)|            size|(   human)| masks
-----------------------------------------------------------------------------------
 0: bootloader                      0 (   0.00B)           400000 (   4.00M)      0
    (GAP)                                                 2000000 (  32.00M)
 1: reserved                  2400000 (  36.00M)          4000000 (  64.00M)      0
    (GAP)                                                  800000 (   8.00M)
 2: cache                     6c00000 ( 108.00M)         20000000 ( 512.00M)      2
    (GAP)                                                  800000 (   8.00M)
 3: env                      27400000 ( 628.00M)           800000 (   8.00M)      0
    (GAP)                                                  800000 (   8.00M)
 4: logo                     28400000 ( 644.00M)          2000000 (  32.00M)      1
    (GAP)                                                  800000 (   8.00M)
 5: recovery                 2ac00000 ( 684.00M)          2000000 (  32.00M)      1
    (GAP)                                                  800000 (   8.00M)
 6: rsv                      2d400000 ( 724.00M)           800000 (   8.00M)      1
    (GAP)                                                  800000 (   8.00M)
 7: tee                      2e400000 ( 740.00M)           800000 (   8.00M)      1
    (GAP)                                                  800000 (   8.00M)
 8: crypt                    2f400000 ( 756.00M)          2000000 (  32.00M)      1
    (GAP)                                                  800000 (   8.00M)
 9: misc                     31c00000 ( 796.00M)          2000000 (  32.00M)      1
    (GAP)                                                  800000 (   8.00M)
10: instaboot                34400000 ( 836.00M)         20000000 ( 512.00M)      1
    (GAP)                                                  800000 (   8.00M)
11: boot                     54c00000 (   1.32G)          2000000 (  32.00M)      1
    (GAP)                                                  800000 (   8.00M)
12: system                   57400000 (   1.36G)         40000000 (1024.00M)      1
    (GAP)                                                  800000 (   8.00M)
13: data                     97c00000 (   2.37G)        768400000 (  29.63G)      4
===================================================================================

Only several of them will be written according to the config in image.cfg:

[LIST_VERIFY]
file="boot.PARTITION"		main_type="PARTITION"		sub_type="boot"
file="bootloader.PARTITION"		main_type="PARTITION"		sub_type="bootloader"
file="logo.PARTITION"		main_type="PARTITION"		sub_type="logo"
file="recovery.PARTITION"		main_type="PARTITION"		sub_type="recovery"
file="system.PARTITION"		main_type="PARTITION"		sub_type="system"

Other than these 5, bootloader, reserved, env are populated by u-boot itself; cache, rsv, tee, crypt, misc, instaboot, data are populated by Andoird, and some of which will also be written by u-boot (e.g., misc can be both R/W by u-boot and Android)

These partitions that you only see in the custom FW do not exist at all, so they’re not needed. Don’t think the FW is ‘broken’ just because it lacks images for several partitions.

1 Like

This “short-circuit” method is risky, and should just prevent the CPU to boot from eMMC, making it temporary unavailable. After removal of Short-circuit, the eMMC is usually available again (and bootable). But not in your case, it seems to have disappeared completely.
Looks like you killed the eMMC, maybe you shorted wrong pins causing EOS.

1 Like

Yes, I think that you’re right and the eMMC is in bad shape. I probably damaged it while shorting the pins.

I already tried all the methods suggested by the people trying to help.

Is there any way to know for sure? For example, I can boot to a TWRP recovery with the SD card and access the terminal.

Another question, with a dead eMMC should I be able to boot and use CoreELEC with a SD card? In my attempts, I see the CoreELEC logo but then procedes to a bootloop showing strange colors on the TV.

As I saw in your pic your eMMC chip seems to be packaged in the “Small-outline integrated circuit” style (or other names, I don’t know its name for sure, but it’s that type of packaging that a series of pins to be soldered are located on two opposite sides of the package).

I have a S905L box with the same eMMC packaging, and I also “fried” the eMMC when flashing the firmware around continuously for tens of times to test things, same error in Amlogic Burning Tool. I thought it was broken, but checked for one last time before dropping it to trash bin. With carefully checking, I noticed the tins on the pins I short for too many times are scratched and spreaded and effectively connected. I then cut the connected tins open with a mini-knife carefully and then — it went back to life. After which I only issue burning through u-boot due to being afraid to cause the same issue again.

Maybe you can also look carefully at the pins, especially the two pins you use to short for burning, to check if they’re effectively permanently connected/shorted (better if you can check it with a multimeter), and try to cut it open if that’s case.

1 Like

Hmmmmmm
When you boot to twrp
Have you tried wipe?
Advanced wipe
Options there
System

Also have tried another linux system on sd card?

Happy Testing

1 Like

Thanks @7Ji for suggesting cleaning up the pins, I opened the box and did it with a needle. The pins did look “connected”.

@freddy I just tried LibreELEC and it worked. The only thing missing it’s the WiFi.

I tried booting up CoreELEC with the dtb from LibreELEC but it didn’t work.

As for the TWRP I can’t wipe anything, it always gives errors, but I can see the Android system files if I type “ls” on the terminal. This means that the eMMC isn’t dead right?

Anyway, with the Linux flash tool, I can flash all partitions individually (system, boot, recovery, logo, etc). The only partition that I can’t flash is the bootloader.

Maybe the box isn’t going to the bin just yet.

My box is alive again!

@7Ji your tip worked! I just tried again a stock firmware with Burn Card Maker and it completed the process. The pins were always in contact and that prevented flashing the bootloader to the eMMC.

I’m super happy because I hate breaking things, especially when they aren’t mine.

Thanks again everybody that tried to help me. Next step is installing CoreELEC in the internal memory.

1 Like