Zidoo X8 recovery

Short guide how to recover from completely wiped eMMC in case you have full eMMC backup and a bootlog from working device.

Connect via UART

Connect an USB-TTL adapter according to following photo:

R – Rx
T – Tx
+ – Vcc – do not connect
– – GND

Notice that the pin pitch is 2mm. I have used 2mm to 2.54mm DuPont wires.

Prepare files

1. Find following lines in boot log:

HwSetting:
hwsetting_blk_no:00000100
hwsetting_total_size:00000680
hwsetting_blk_count:00000004
Bootcode:
bootcode_blk_no:00000104
bootcode_total_size:000B21E0
bootcode_blk_count:00000591
rtk_preload_bootimages : load U-Boot 64 from 0x00028125 to 0x01500000 with size 0x00100000
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x000b1000
Jumping to 2nd bootloader...

2. Extract parts from your eMMC dump
eMMC block size is 512 so we will multiply by 0x200 and then back to decimal:
00000100 * 0x200 = 0x20000 = 131072
00000680 = 1664

dd if=emmc.bin of=hwconfig.bin bs=1 skip=2097152 count=1664

00000104 * 0x200 = 0x20800 = 133120
000B21E0 = 729568

dd if=emmc.bin of=uboot32.bin bs=1 skip=133120 count=729568

0x00028125 * 0x200 = 0x5024A0 = 84036096
0x00100000 = 1048576

dd if=emmc.bin of=uboot64.bin bs=1 skip=84036096 count=1048576

Booting U-Boot 32:

Add pure ymodem file transfer protocol to minicom according to https://github.com/danielkucera/minicom-ymodem.

Find following line in log to find where to load uboot:

j bootcode jump address:00020000
64b

1. start minicom
2. connect power to your board while holding Ctrl+q. You should get d/g/r> prompt.
3. press h and load hwconfig.bin via ymodem
4. set address where to load uboot by entering:

s98007058
00020000

5. press d to download uboot and load uboot32.bin via ymodem
6. press g to boot and U-Boot should start

You should see U-Boot starting and getting to prompt:

Realtek> 

Booting rescue linux

1. prepare USB drive with

2. from U-Boot 32 write U-Boot 64 to eMMC where it needs to be:

Realtek> usb start
...
Realtek> fatload usb 0 0x01500000 uboot64X8.bin
reading uboot64X8.bin
Filesize: 160000 bytes
160000 bytes
Size: 160000, got: 160000

160000 bytes read (take 58ms)
Realtek> mmc write 0x01500000 0x28125 313
MMC write: block # 164133, count 787 ...
787 blocks write: OK

3. boot from USB – this should end with a working bash prompt in rescue Linux:

Realtek> go ru
(Re)start USB...
USB0: USB EHCI 1.00
scanning bus 0 for devices... 3 USB Device(s) found
USB1: USB XHCI 1.10
scanning bus 1 for devices... Unknown request , typeReq = 0x200c
1 USB Device(s) found
USB2: USB XHCI 1.10
scanning bus 2 for devices... Unknown request , typeReq = 0x200c
1 USB Device(s) found
scanning usb for storage devices... 1 Storage Device(s) found

1: Hub, USB Revision 2.0
- u-boot EHCI Host Controller
- Class: Hub
- PacketSize: 64 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

2: Hub, USB Revision 2.0
- USB2.0 Hub
- Class: Hub
- PacketSize: 64 Configurations: 1
- Vendor: 0x05e3 Product 0x0610 Version 50.152
Configuration: 1
- Interfaces: 1 Self Powered Remote Wakeup 100mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms
- Endpoint 1 In Interrupt MaxPacket 1 Interval 12ms

3: Mass Storage, USB Revision 2.0
- Kingston DataTraveler 2.0 AC220B280602BE41599A0150
- Class: (from Interface) Mass Storage
- PacketSize: 64 Configurations: 1
- Vendor: 0x0951 Product 0x1665 Version 1.0
Configuration: 1
- Interfaces: 1 Bus Powered 200mA
Interface: 0
- Alternate Setting 0, Endpoints: 2
- Class Mass Storage, Transp. SCSI, Bulk only
- Endpoint 1 In Bulk MaxPacket 512
- Endpoint 2 Out Bulk MaxPacket 512

4: Hub, USB Revision 3.0
- u-boot XHCI Host Controller
- Class: Hub
- PacketSize: 9 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

5: Hub, USB Revision 3.0
- u-boot XHCI Host Controller
- Class: Hub
- PacketSize: 9 Configurations: 1
- Vendor: 0x0000 Product 0x0000 Version 1.0
Configuration: 1
- Interfaces: 1 Self Powered 0mA
Interface: 0
- Alternate Setting 0, Endpoints: 1
- Class Hub
- Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms

USB device 0: Vendor: Kingston Rev: PMAP Prod: DataTraveler 2.0
Type: Removable Hard Disk
Capacity: 15000.0 MB = 14.6 GB (30720000 x 512)
reading rescue.emmc.dtb
Filesize: 61692 bytes
61692 bytes
Size: 61692, got: 61692

61692 bytes read (take 47ms)
Loading "rescue.emmc.dtb" to 0x01F00000 is OK.

reading emmc.uImage
Filesize: 14690304 bytes
14690304 bytes
Size: 14690304, got: 14690304

14690304 bytes read (take 683ms)
Loading "emmc.uImage" to 0x03000000 is OK.

reading rescue.root.emmc.cpio.gz_pad.img
Filesize: 12582912 bytes
12582912 bytes
Size: 12582912, got: 12582912

12582912 bytes read (take 591ms)
Loading "rescue.root.emmc.cpio.gz_pad.img" to 0x02200000 is OK.

reading bluecore.audio
Filesize: 3212505 bytes
3212505 bytes
Size: 3212505, got: 3212505

3212505 bytes read (take 189ms)
Loading "bluecore.audio" to 0x01b00000 is OK.
Start Audio Firmware ...
EXPORT ENV AT 0x10000000
rtk_preload_bootimages : load U-Boot 64 from 0x00028125 to 0x01500000 with size 0x00100000
copy_2nd_bootloader_and_run : src:0x01500000, dst:0x00021000, size:0x000b1000
Jumping to 2nd bootloader...

U-Boot 2015.07-ge1162f1 (Aug 02 2016 - 11:24:56 +0800)

CPU : Cortex-A53 Quad Core
Board: Realtek QA Board
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
[ERR] Fall back to using CONFIG_SYS_RAM_DCU1_SIZE
DRAM: 1 GiB
mapping memory 0x20000000-0x40000000 non-cached
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
rtk_plat_set_fw not port yet, use default configs
## Flattened Device Tree blob at 01f00000
Booting using the fdt blob at 0x1f00000
reserving fdt memory region: addr=0 size=30000
reserving fdt memory region: addr=1f000 size=1000
reserving fdt memory region: addr=1ffe000 size=4000
reserving fdt memory region: addr=2200000 size=c00000
reserving fdt memory region: addr=3000000 size=100000
reserving fdt memory region: addr=3100000 size=6000000
reserving fdt memory region: addr=10000000 size=14000
reserving fdt memory region: addr=1fc00000 size=1000
reserving fdt memory region: addr=22000000 size=17bb000
Using Device Tree in place at 0000000001f00000, end 0000000001f120fb
Bring UP slave CPUs
Jump to BL31 entrypoint
VERBOSE: bl31_setup
NOTICE: BL31: v1.2(debug):415dc83
NOTICE: BL31: Built : 11:30:42, Jun 30 2016
INFO: BL31: Initializing runtime services
INFO: Start to init service std_svc
INFO: Finish to init service std_svc
INFO: Start to init service opteed_fast
INFO: Finish to init service opteed_fast
INFO: BL31: Initializing BL32
ERROR: Core_0 TEESMC_OPTEED_RETURN_ENTRY_DONE
ERROR: Core_0 got optee_vectors (0x1020093c)
INFO: BL31: Initialized BL32
INFO: EXIT BL31
INFO: bl31_to_kernel: kernel_resume_entry = 0x1e000
INFO: bl31 jumps to EL2 entry
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 4.1.35-04005-dirty (root@bld2) (gcc version 4.9.4 (OpenWrt/Linaro GCC 4.9-2015.06 r48422) ) #7 SMP PREEMPT Mon Jan 14 10:40:45 CST 2019

4. after booting, write your full backup back to eMMC:

/ # cd /mnt/usb/
/mnt/usb # dd if=/mnt/usb/emmc.bin of=/dev/block/mmcblk0 bs=1M

In case of problems, ask in comments.

Bye!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.