四川电信IHO-3300AD线刷卡1%报错 TTL也破解不了

spj0001

四川电信IHO-3300AD线刷准备了小白刷机网的固件，
高安和非高安的都试了卡在1%处，
另外一个公版固件也试了一下也是卡1%
请教各位大佬怎么破呀?

后面焊接了TTL，但是system无法挂载为可读写

以下贴出TTL日志
TE: 275078

BL2 Built : 19:28:17, Oct 24 2018. \ngxl gce1e6a7-dirty - xianjun.liu@droid09-sz

Board ID = 7, adc=557
set vcck to 1070 mv
set vddee to 1070 mv
CPU clk: 1200MHz
DDR3
DDR3 chl: Rank0 @ 792MHz

bist_test rank: 0 2c 0b 4d 3a 18 5d 25 00 4a 45 24 66 25 06 44 45 29 61 1f 00 3f 43 25 62 579  
Rank0: 1024MB(auto)-2T-11
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R2048 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00007600
aml log : R2048 check pass!
Load bl301 from eMMC, src: 0x00018200, des: 0x01700000, size: 0x00002200
aml log : R2048 check pass!
Load bl31 from eMMC, src: 0x0001c200, des: 0x01700000, size: 0x00019600
aml log : R2048 check pass!
Load bl33 from eMMC, src: 0x00038200, des: 0x01700000, size: 0x00069200
aml log : R2048 check pass!
NOTICE:  BL3-1: v1.0(debug):521e8c3
NOTICE:  BL3-1: Built : 14:22:49, Jun  5 2018
NOTICE:  BL31: GXL secure boot!
NOTICE:  BL31: BL33 decompress pass
[Image: gxl_v1.1.3101-a78fa1e 2018-06-04 16:24:21 huan.biao@droid12]
efuse init ops = c5
efuse init hdcp = c, cf9=7
bl30: check_permit, count is 1
bl30: check_permit: ok!
chipid: 0 0 7 1c c 0 93 b3 70 a0 0 c5 not ES chip
[1.251003 Inits done]
INFO:    BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR:   Error initializing runtime service opteed_fast
INFO:    BL3-1: Preparing for EL3 exit to normal world
INFO:    BL3-1: Next image address = 0x1000000
INFO:    BL3-1: Next image spsr = 0x3c9


U-Boot 2015.01 (Apr 30 2019 - 18:29:52), Build: jenkins-SC_IHO-3300AD_1820027_40801-36

DRAM:  1 GiB
Relocation Offset is: 36eb1000
gpio: pin GPIODV_25 (gpio 44) value is 1
register usb cfg[0][1] = 0000000037f5d298
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC:   aml_priv->desc_buf = 0x0000000033ea1ac0
aml_priv->desc_buf = 0x0000000033ea3de0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x1ff2800
emmc/sd response timeout, cmd55, status=0x1ff2800
[mmc_init] mmc init success
dtb magic 08088b1f
      Amlogic multi-dtb tool
      GZIP format, decompress...
      Multi dtb detected
      2layers board, board id use 7
      Multi dtb tool version: v2 .
      Support 8 dtbs.
        aml_dt soc: gxlx2 platform: p291 variant: 1g
        dtb 0 soc: gxl   plat: p211   vari: 1g
        dtb 1 soc: gxl   plat: p215   vari: 1g
        dtb 2 soc: gxlx   plat: p261   vari: 1g
        dtb 3 soc: gxlx   plat: p261   vari: 2g
        dtb 4 soc: gxlx   plat: p265   vari: 1g
        dtb 5 soc: gxlx   plat: p265   vari: 2g
        dtb 6 soc: gxlx2   plat: p291   vari: 1g
        dtb 7 soc: gxlx2   plat: p295   vari: 1g
      Find match dtb: 6
start dts,buffer=0000000033ea6610,dt_addr=0000000033ea6610
      Amlogic multi-dtb tool
      Single dtb detected
parts: 14
00:      logo   0000000002000000 1
01:  recovery   0000000002000000 1
02:       rsv   0000000000800000 1
03:       tee   0000000000800000 1
04:     crypt   0000000002000000 1
05:      misc   0000000002000000 1
06: instaboot   0000000020000000 1
07:      boot   0000000002000000 1
08:    system   0000000040000000 1
09:     cache   0000000020000000 2
10:    params   0000000004000000 2
11:       ctc   0000000012c00000 2
12: bootfiles   0000000020000000 2
13:      data   ffffffffffffffff 4
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x27400000
In:    serial
Out:   serial
Err:   serial
board id is : 7
hpd_state=0
cvbs performance type = 7, table = 0
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-924: calc 31c7d3c4, store 31c7d3c4
_verify_dtb_checksum()-924: calc 31c7d3c4, store 31c7d3c4
dtb_read()-1046: total valid 2
dtb_read()-1113: do nothing
      Amlogic multi-dtb tool
      GZIP format, decompress...
      Multi dtb detected
      2layers board, board id use 7
      Multi dtb tool version: v2 .
      Support 8 dtbs.
        aml_dt soc: gxlx2 platform: p291 variant: 1g
        dtb 0 soc: gxl   plat: p211   vari: 1g
        dtb 1 soc: gxl   plat: p215   vari: 1g
        dtb 2 soc: gxlx   plat: p261   vari: 1g
        dtb 3 soc: gxlx   plat: p261   vari: 2g
        dtb 4 soc: gxlx   plat: p265   vari: 1g
        dtb 5 soc: gxlx   plat: p265   vari: 2g
        dtb 6 soc: gxlx2   plat: p291   vari: 1g
        dtb 7 soc: gxlx2   plat: p295   vari: 1g
      Find match dtb: 6
wipe_data=successfulSecd
wipe_cache=successful
bmp pixel: 24
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x3dc00000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x3dc00000
[CANVAS]addr=0x3dc00000 width=5760, height=2160
upgrade_step=2
amlkey_init() enter!
[EFUSE_MSG]keynum is 2
[BL31]: tee size: 0
key1 = 31ce4cb3
key2 = 7e814cb3
key3 = 728ddd22
time_out = 7a120
ir init
irkey - irkey key_value1 key_value2 key_value3 time_value

Usage:
irkey
rebootmode=cold_boot
Hit ctrl+c to stop autoboot:  0
[imgread]szTimeStamp[2021020720340993]
[imgread]secureKernelImgSz=0x7e4000
aml log : R2048 check pass!
aml log : R2048 check pass!
aml log : R2048 check pass!
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =33f26860
copy done
      Amlogic multi-dtb tool
      Single dtb detected
load dtb from 0x1000000 ......
   Uncompressing Kernel Image ... OK
   kernel loaded at 0x01080000, end = 0x02080b58
   Loading Ramdisk to 33da5000, end 33e9f000 ... OK
   Loading Device Tree to 000000000fff3000, end 000000000ffffbd1 ... OK
signature:
fdt_instaboot: get header err

Starting kernel ...

uboot time: 3770230 us
[    0.000000@0] Initializing cgroup subsys cpu
[    0.000000@0] Initializing cgroup subsys cpuacct
[    0.000000@0] Linux version 3.14.29 (jenkins@ubuntu) (gcc version 4.9.2 20140904 (prerelease) (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09) ) #1 SMP PREEMPT Sun Feb 7 19:46:36 CST 2021
[    0.000000@0] CPU: ARMv71 Processor [410fd034] revision 4
[    0.000000@0] bootconsole [earlycon0] enabled
get_dvfs_info 0007
INFO:    HDCP22 key read fail!
INFO:    p1d 0
INFO:    pd1 0
(root)Password:
root@p201_iptv:/ # mount -o remount,rw /system
mount: Invalid argument
255|root@p201_iptv:/ # df
Filesystem               Size     Used     Free   Blksize
/dev                   493.0M   128.0K   492.9M   4096
/sys/fs/cgroup         493.0M    12.0K   493.0M   4096
/mnt/asec              493.0M     0.0K   493.0M   4096
/mnt/obb               493.0M     0.0K   493.0M   4096
/tmp                   493.0M     0.0K   493.0M   4096
/tmp/playInfoLog       493.0M     0.0K   493.0M   4096
/tmp/capture           493.0M     0.0K   493.0M   4096
/storage/external_storage   493.0M     0.0K   493.0M   4096
/system                991.9M   593.9M   398.0M   4096
/cache                 495.9M   496.0K   495.5M   4096
/ctc                   290.6M   204.0K   290.4M   4096
/data                    3.9G   269.6M     3.6G   4096
/backup                 59.0M    44.0K    58.9M   4096
/mnt/shell/emulated      3.8G   269.6M     3.5G   4096
/swap_zram0            484.3M    20.0K   484.3M   4096
root@p201_iptv:/ # / # mount               
mksh: /: can't execute: Is a directory
126|root@p201_iptv:/ # mount
rootfs / rootfs ro 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
configfs /sys/kernel/config configfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
none /sys/fs/cgroup tmpfs rw,relatime,mode=750,gid=1000 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
tmpfs /tmp/playInfoLog tmpfs rw,relatime 0 0
tmpfs /tmp/capture tmpfs rw,relatime 0 0
tmpfs /storage/external_storage tmpfs rw,relatime,mode=775,uid=1000,gid=1023 0 0
/dev/block/system /system ext4 ro,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,data=ordered 0 0
/dev/block/cache /cache ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/ctc /ctc ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/data /data ext4 rw,nosuid,nodev,noatime,nodiratime,discard,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/block/params /backup ext4 rw,nosuid,nodev,noatime,nodiratime,nodelalloc,noauto_da_alloc,data=ordered 0 0
/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
/dev/block/zram0 /swap_zram0 ext2 rw,relatime,errors=continue 0 0
root@p201_iptv:/ # mount  -o remount,rw /dev/block/system
mount: Invalid argument
255|root@p201_iptv:/ # mount -o remount,rw /system
mount: Invalid argument
255|root@p201_iptv:/ #

爱上你是错888

ttl是百分百能破解的

spj0001

爱上你是错888 发表于 2021-6-27 07:11
ttl是百分百能破解的

主要是能力有限，system无法挂在为可读写就没招了

chuangg

请问，板子上TTL接口是如何连接的，可以给个图吗？

chuangg

请问楼主，sh login 和Password 如何输入？

spj0001

chuangg 发表于 2021-6-29 14:59
请问楼主，sh login 和Password 如何输入？

sh login：root
Password：Ch4008111666

1988888

系没法挂载系统分区是系统问题，系统没有坏的话，先用ttl连接备份各分区，然后网上找个相同型号的刷机包，用晶晨解包工具解压出系统分区文件，文件名修改为system.img放U盘根目录，再开机开始按回车进入ttl的U-boot模式，输入help命令后查看U-boot模式支持不支持usb_update命令，如果支持那就直接刷系统分区，命令为usb_update system system.img
刷完提示ok，再reboot重启，进系统恢复出厂设置，再试试看ttl能不能挂载系统，还不能再换，不兼容就刷回原版系统备份，命令以上面类推，比如刷recovery分区，命令为usb_update recovery recovery.img

另外备份出的系统分区镜像也可以用rom助手修改再刷回去

dcx381153580

四川有两种，DDR不同，固件也不一样

华974593

四川电信版的没有短接点怎么用USB_Burning_tool连接，我的插了USB线根本就没提示连接成功都没反应，用TTL也是通电不跑码直接就启动了

15878152263

ADB能开启的话很多事情都能解决。