Projects

Zidoo X8 recovery

13 Comments

Short guide how to recover from completely wiped eMMC in case you have full eMMC backup and a bootlog from working device.

Connect via UART

Connect an USB-TTL adapter according to following photo:

R – Rx
T – Tx
+ – Vcc – do not connect
– – GND

Notice that the pin pitch is 2mm. I have used 2mm to 2.54mm DuPont wires.

Prepare files

1. Find following lines in boot log:

HwSetting:
hwsetting_blk_no:00000100
hwsetting_total_size:00000680
hwsetting_blk_count:00000004
Bootcode:
bootcode_blk_no:00000104
bootcode_total_size:000B21E0
bootcode_blk_count:00000591
rtk_preload_bootimages : load U-Boot 64 from 0x00028125 to 0x01500000 with size 0x00100000
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x000b1000
Jumping to 2nd bootloader...

2. Extract parts from your eMMC dump
eMMC block size is 512 so we will multiply by 0x200 and then back to decimal:
00000100 * 0x200 = 0x20000 = 131072
00000680 = 1664

dd if=emmc.bin of=hwconfig.bin bs=1 skip=131072 count=1664

00000104 * 0x200 = 0x20800 = 133120
000B21E0 = 729568

dd if=emmc.bin of=uboot32.bin bs=1 skip=133120 count=729568

0x00028125 * 0x200 = 0x5024A0 = 84036096
0x00100000 = 1048576

dd if=emmc.bin of=uboot64.bin bs=1 skip=84036096 count=1048576

Booting U-Boot 32:

Add pure ymodem file transfer protocol to minicom according to https://github.com/danielkucera/minicom-ymodem.

Find following line in log to find where to load uboot:

j bootcode jump address:00020000
64b

1. start minicom
2. connect power to your board while holding Ctrl+q. You should get d/g/r> prompt.
3. press h
4. press Ctrl-a, z, s and load hwconfig.bin via ymodem
5. set address where to load uboot by entering:

s98007058
00020000

6. press d to download uboot and load uboot32.bin via ymodem
7. press g to boot and U-Boot should start

You should see U-Boot starting and getting to prompt:

Realtek>

Booting rescue linux

1. prepare USB drive with

2. from U-Boot 32 write U-Boot 64 to eMMC where it needs to be:

Realtek> usb start
...
Realtek> fatload usb 0 0x01500000 uboot64X8.bin
reading uboot64X8.bin
Filesize: 160000 bytes
160000 bytes
Size: 160000, got: 160000

160000 bytes read (take 58ms)
Realtek> mmc write 0x01500000 0x28125 313
MMC write: block # 164133, count 787 ...
787 blocks write: OK

3. boot from USB – this should end with a working bash prompt in rescue Linux:

Realtek> go ru
(Re)start USB...
USB0: USB EHCI 1.00
scanning bus 0 for devices... 3 USB Device(s) found
USB1: USB XHCI 1.10
scanning bus 1 for devices... Unknown request , typeReq = 0x200c
1 USB Device(s) found
USB2: USB XHCI 1.10
scanning bus 2 for devices... Unknown request , typeReq = 0x200c
1 USB Device(s) found
scanning usb for storage devices... 1 Storage Device(s) found

1: Hub, USB Revision 2.0
- u-boot EHCI Host Controller
- Class: Hub
- PacketSize: 64 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

2: Hub, USB Revision 2.0
- USB2.0 Hub
- Class: Hub
- PacketSize: 64 Configurations: 1
- Vendor: 0x05e3 Product 0x0610 Version 50.152
Configuration: 1
- Interfaces: 1 Self Powered Remote Wakeup 100mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms
- Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms

3: Mass Storage, USB Revision 2.0
- Kingston DataTraveler 2.0 AC220B280602BE41599A0150
- Class: (from Interface) Mass Storage
- PacketSize: 64 Configurations: 1
- Vendor: 0x0951 Product 0x1665 Version 1.0
Configuration: 1
- Interfaces: 1 Bus Powered 200mA
Interface: 0
- Alternate Setting 0, Endpoints: 2
- Class Mass Storage, Transp. SCSI, Bulk only
- Endpoint 1 In Bulk MaxPacket 512
- Endpoint 2 Out Bulk MaxPacket 512

4: Hub, USB Revision 3.0
- u-boot XHCI Host Controller
- Class: Hub
- PacketSize: 9 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

5: Hub, USB Revision 3.0
- u-boot XHCI Host Controller
- Class: Hub
- PacketSize: 9 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

USB device 0: Vendor: Kingston Rev: PMAP Prod: DataTraveler 2.0
Type: Removable Hard Disk
Capacity: 15000.0 MB = 14.6 GB (30720000 x 512)
reading rescue.emmc.dtb
Filesize: 61692 bytes
61692 bytes
Size: 61692, got: 61692

61692 bytes read (take 47ms)
Loading "rescue.emmc.dtb" to 0x01F00000 is OK.

reading emmc.uImage
Filesize: 14690304 bytes
14690304 bytes
Size: 14690304, got: 14690304

14690304 bytes read (take 683ms)
Loading "emmc.uImage" to 0x03000000 is OK.

reading rescue.root.emmc.cpio.gz_pad.img
Filesize: 12582912 bytes
12582912 bytes
Size: 12582912, got: 12582912

12582912 bytes read (take 591ms)
Loading "rescue.root.emmc.cpio.gz_pad.img" to 0x02200000 is OK.

reading bluecore.audio
Filesize: 3212505 bytes
3212505 bytes
Size: 3212505, got: 3212505

3212505 bytes read (take 189ms)
Loading "bluecore.audio" to 0x01b00000 is OK.
Start Audio Firmware ...
EXPORT ENV AT 0x10000000
rtk_preload_bootimages : load U-Boot 64 from 0x00028125 to 0x01500000 with size 0x00100000
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x000b1000
Jumping to 2nd bootloader...

U-Boot 2015.07-ge1162f1 (Aug 02 2016 - 11:24:56 +0800)

CPU : Cortex-A53 Quad Core
Board: Realtek QA Board
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
[ERR] Fall back to using CONFIG_SYS_RAM_DCU1_SIZE
DRAM: 1 GiB
mapping memory 0x20000000-0x40000000 non-cached
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
rtk_plat_set_fw not port yet, use default configs
## Flattened Device Tree blob at 01f00000
Booting using the fdt blob at 0x1f00000
reserving fdt memory region: addr=0 size=30000
reserving fdt memory region: addr=1f000 size=1000
reserving fdt memory region: addr=1ffe000 size=4000
reserving fdt memory region: addr=2200000 size=c00000
reserving fdt memory region: addr=3000000 size=100000
reserving fdt memory region: addr=3100000 size=6000000
reserving fdt memory region: addr=10000000 size=14000
reserving fdt memory region: addr=1fc00000 size=1000
reserving fdt memory region: addr=22000000 size=17bb000
Using Device Tree in place at 0000000001f00000, end 0000000001f120fb
Bring UP slave CPUs
Jump to BL31 entrypoint
VERBOSE: bl31_setup
NOTICE: BL31: v1.2(debug):415dc83
NOTICE: BL31: Built : 11:30:42, Jun 30 2016
INFO: BL31: Initializing runtime services
INFO: Start to init service std_svc
INFO: Finish to init service std_svc
INFO: Start to init service opteed_fast
INFO: Finish to init service opteed_fast
INFO: BL31: Initializing BL32
ERROR: Core_0 TEESMC_OPTEED_RETURN_ENTRY_DONE
ERROR: Core_0 got optee_vectors (0x1020093c)
INFO: BL31: Initialized BL32
INFO: EXIT BL31
INFO: bl31_to_kernel: kernel_resume_entry = 0x1e000
INFO: bl31 jumps to EL2 entry
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 4.1.35-04005-dirty (root@bld2) (gcc version 4.9.4 (OpenWrt/Linaro GCC 4.9-2015.06 r48422) ) #7 SMP PREEMPT Mon Jan 14 10:40:45 CST 2019

4. after booting, write your full backup back to eMMC:

/ # cd /mnt/usb/
/mnt/usb # dd if=/mnt/usb/emmc.bin of=/dev/block/mmcblk0 bs=1M

In case of problems, ask in comments.

Bye!

13 thoughts on “Zidoo X8 recovery”

  1. Hello, thanks for your detailed guide. I have a my home cloud duo, and im trying to install debian on it, I wasnt careful and write bad data on the first 4 mb of emmc. I can access the special mode with ctrl + q and download the data, but when i try to boot u-boot freezes on “bootcode jump address:00020000
    64b”
    May tou know the reason?

    Reply

    1. Hi Jose,
      can you share full boot log? Do you have full dump of original eMMC data and boot logs?

      Reply

      1. Hello, thanks, that was a fast anwer. i have a full eMMC dump https://mega.nz/file/xwJwxSKZ#b55HX_nDHmJpnCXr6aA7Bq2L5ybOi7hE-hW9k2ruuag , but i don´t have a boot log (before brick), at first it can load fsbl, b31, etc. and stops, but i was messing with it trought d/g/r mode, and right now cannot load fsbl, i was careless enough to try and and use banana pi w2 dvrboot file, and it works and wrote something on the eMMC (the bootloader) and now is worse, i can still access d/g/r mode, and i was thinking on extract your files (boot32, etc.) and try to boot with them, i think that maybe if i can get to recovery, i can write the original files to the eMMC (if i don´t mess anything more, thing that maybe already happen). By the way i already tried to boot with the extracted files of my dump (i compared them with the ones i compiled from sources to see that they are the similar), and i try with a dvrboot file that WD sources compile on the bootloader folder, it loads but it says something about “trying to write to SPI, nor flash ID”, maybe i need to change something in the source to write to an eMMC? or maybe I destroyed the device. this is the link to the logs of the dvrboot install that i did, with the tool from bananapi: https://we.tl/t-bt3LZ6Wb8h

        Reply

          2. Hello again, i try with files extracted from your dump (in armbian forum) and don’t work (nothing work, except for bootloaders intallers), right now i´m studying the sources of my device (pelican) to see if i can make work the bootloader installer, i´m still don´t know if my device has an SPI flash, but i think i don´t mess with it if it have it (maybe) because banana pi bootloader says that it writes on eMMC (maybe i´m wrong), so I think I only mess with eMMC and that´s why i´m still capable of accessing d/g/r. so right now i´m looking of a way that the installer skip the SPI and write directly to eMMC (like banana pi bootloader). I am wrong? maybe i´m saying stupid things. I send you the bootloader source in case that you want to look at it https://we.tl/t-SCWxMO9T60

            Reply

  2. Hi, new update, so i just don´t know if i´m lucky, or i know more about this that I think :P. I just edited a lot of files (right know i don´t remember what files) on the sources changing SPI for EMMC, and the compiled file installed the bootloader, now the board it´s looking for the recovering files :D. IT´S ALIVE!!!!!. Thank you so much Danman for you rapid answer, if you need any of the files, or i can help you with anything with your board, please tell me, you have a new follower of your blog (your guide and develop on armbian forum help me a lot), and now i´m gonna try to install debian on this board (lucckily i don´t break it again :P)

    Reply

  3. On the beginning after i try to instal banana pi bootloader i only get the boot until C4 f, then it stays …waiting… waiting and with some error (sorry I dont take a log of that, i´m a little lazy:S). and now this is my new log https://justpaste.it/6kloj . right now i cannot acces to it by adb or telnet as before, but i think that i can manage that (at least is alive). The sources are from official WD page http://downloads.wdc.com/gpl/MyCloudHome_GPL_v4.1.1.827_20170912.zip (this version doesnt compile the bootloader installer), and https://downloads.wdc.com/gpl/GPL_MCH_6.6.1-123_20191114.tar.xz (this compile the installer and you can change a lot of parameters), to compile you need openssl 1.0, and erase the word “defined” from every perl script. I use the banana pi w2 bootloader recovery tool (RTK MP_Tool without “LK option” choosen) https://drive.google.com/file/d/10kfP142Jw0sA92uwaIYZt7CeXcDKelO1/view?usp=sharing , with my hwinfo file (on source) and the binary file compiled (wd_pelican.uboot32.fb.dvrboot.exe.bin). Really I don’t know exactly what I did, i go-with mate search tool and find every file with the words “flash_type” and change everything that I think it was logic from SPI to EMMC, if you need the file I send to yo, but I don´t think is gonna work on your device, but I think that you can change the bootloader sources, and use it to make an installer with the correct hwinfo of your device

    Reply

  5. Can you tell which program to use to connect? To edit information with the box Because I am also encountering this problem

    Reply

  6. Trying to understand your process… where does the “skip” value come from in the first dd command?

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.