X96 max plus a100 - how to identify a fake device?

[karatepisser]

Hello coreelec community,

I purchased a new x96 max plus device, sold as the 4/32GB version with BT and GBit LAN.
I have another x96 max plus device which is working fine with the sm1_s905x3_4g_1gbit.dtb.
So after preparing a uSD card and copying the sm1_s905x3_4g_1gbit.dtb I tried booting the new device. Device was stuck at the x96+ boot logo. So I researched the forums in an attempt to get this booting.
Eventually I got it booting with the sm1_s905x3_2g.dtb image.

Still I am not convinced that this is a fake device.

So I booted up android again in an attempt to check the functionality.
The device is reported as X96_MAX_PLUS_A100.

First checked Bluetooth in Android and successfully paired that with my PC blueetoth. Sending a file from PC to Android worked. So I consider bluetooth working.

Next I tried checking the RAM in Android. cat /proc/meminfo reports a total of almost 4GB. I also tried a App Fake Device Test and that passed every test. I tried other apps, but all report the RAM size to be 4GB.
I also tried an app called Easily fill RAM! and when it crashed (was cleared by the oom killer?) near the 2000MB mark I suspected that this is evidence for less RAM then advertised. But comparing that to the other box and my mobile phone where the app was also cleared at around 2000MB of RAM usage, I think this is something else - maybe android limiting the RAM per app usage.

Then I installed iperf and I could only reach 100Mbit speeds. Then compared that to my old box which gives me the advertised 1GBit speed.

Still in Andorid the free space is reported with 26 GB. Adding everything from df -H gives approximately 30 GB.

So to summarize,

• Bluetoth is working
• 32GB storage seems legit
• LAN is only 100MBit instead of 1GBit
• RAM still unclear, but I would expect that Fill RAM App to be killed much earlier on a 2GB device.

Since this was purchased from China and I don’t expect any “warranty” I opened the box up.

Left = old working box - Right = new working with 2GB dtb only

old box - top

new box - top

old box - bottom

new box - bottom

So if anyone can help me identifying hardware (RAM size, LAN chip, NAND size, …) that would be really appreciated. If additional pictures are required, just ask and I will provide.

My thoughts are to continue by obtaining the device tree used by the Android system. And from that construct a dtb image file for coreelec. And here I need some help where to start - maybe someone can point me in the correct direction.

TLDR:
How do I correctly identify the Hardware specs of my tvbox?

kp

[Compent]

Taking a cursory look at the images, each component looks clearly labelled, with the WiFi/BT looking the most obvious difference.

Some of what look like the RAM chips have different identifiers but if you google the reference numbers I would have thought that you could discover more about them and their total capacities.

Post the same questions and images over at Freaktab to give you more chances of getting an answer.

[Portisch]

FBGA and Component Marking Decoder

D9QBQ: MT41K1G4RH-107:E
So it’s MT41K1G4 – 128 Meg x 4 x 8 banks, DDR3-1866

D9PQL: MT41K1G4RH-125:E
So it’s MT41K1G4 – 128 Meg x 4 x 8 banks, DDR3-1600

So maybe the bootloader is configured wrong and not all memory get detected. Only way to show the “truth” is to get a u-boot log. This can be done by UART log. The pin header is next to the HDMI port, marked with RX, TX & GND.

Maybe the 4g CE dtb need to be modified to be able to boot the device. For this the Android dtb needs to be compared. Dump the dtb when booted into CE:
dd if=/dev/dtb | gzip > /storage/downloads/dtb.img.gz

The old/new pictures shows clear the RTL8211f is not assembled anymore → 100MBit

[karatepisser]

Thank you @Portisch,
the link to the Micron Decoder is really helpful - I could not figure out how to map that RAM chip marking to a part number.

Since 19.2 rc3 has been released I wrote the image again to a new uSD card. This time I directly started with the sm1_s905x3_4g.dtb.
It worked. I am sorry for stating that it does not work and I don’t know where I messed this up during my first trials.

The “THGBMFG8C4LBAIR” is indeed a 32GB emmc from Toshiba.
AM7256 seems to be the WiFi/BT chip. I got around to testing this after bootet with the sm1_s905x3_4g.dtb - and WiFi and BT is working although I don’t intend to use it.

As you already wrote the RTL8211f is not equipped and I couldn’t find any of the other chips carrying GBit LAN capability. I am so sad, because that was the only reason I bought the 4/32G model instead of 2/16G.

Anyway if it is of any help, please find attached the dtb.img created from /dev/dtb.
dtb.img.gz (173.1 KB)

Regarding the u-boot log via UART - just to confirm the correct pin outs are those marked in the below picture?

Thanks again
kp