[Android Stick & Console AMLogic based Computers] PrinceOfAbyss:
I have a very rare Technicolor UZW4030WNH TV box used by a broadband service provider and mobile network operator in my country to offer a streaming TV service to their clients. I already have an active contract with them, which allows me to watch video content through the above-mentioned TV box and, at the same time, in four additional mobile devices through their dedicated Google Play app... The problem is I don’t want to use the mobile devices option, but rather use another TV box in a second TV in my house. For that purpose, I purchased one more TV box from them, but it turns out, as ridiculous as it may sound, that, due to a limitation in their system, only one active S/N can be bound to a client... So, the S/N of the second machine once registered in their system would unregister the S/N of the first machine, effectively rendering it unusable...

Now, it may sound a bit sneaky, but I plan to overcome this by writing the same S/N in both machines... Rooting the second device to alter its S/N is obviously out of question due to the bootloader being apparently locked... So, I thought about serial (UART) reading the eMMC, replacing the S/N string in the dump, and finally writing back the dump in the machine...

For that purpose, I identified the UART interface pads (see attached image) on the PCB; it was a fairly easy task, as they were arranged neatly in a single row; I connected the interface, fired up PuTTY, and voila I successfully read the boot up sequence log... A short video of the reading process can be found here.

Following is the dump of the bootloader when the machine is in normal boot:

GXL:BL1:9ac50e:bb16dc;FEAT:BF8D39BE:0;POC:3;EMMC:0;READ:0;0.0;0.0;CHK:0;
TE: 183395

BL2 Built : 13:29:27, Oct 20 2017. \ngxl g6cead14 - marco@beast

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 9
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR4 chl: Rank0 @ 1008MHz
Rank0: 2048MB-2T-18
DataBus test pass!
AddrBus test pass!
-s
emmc switch 3 ok
BL2: rpmb counter: 0x0000001d
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x0000c200, des: 0x01700000, size: 0x00004000
Load BL3x from eMMC, src: 0x00010200, des: 0x01704000, size: 0x000f4000
NOTICE: BL3-1: v1.0(release):8ede9fe
NOTICE: BL3-1: Built : 20:00:30, Dec 25 2017
[BL31]: GXL CPU setup!
aml log : bl31 detect secure boot !
[SECURE APB] Write to enable Jtag finished
Wait for your jtag pass word...
mpu_config_enable:ok
[Image: gxl_v1.1.3212-44bf1a7 2017-07-24 17:22:09 marco@beast]
OPS=0x04
58 84 36 41 a0 8c 82 ca 5c 8a c0 7a [1.656177 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-2: ATOS-V2.0.2-g39c4135 #2 Fri Jun 15 18:29:54 CST 2018 arm
INFO: BL3-2: chip version = RevD (21:D - 0:0)
INFO: BL3-2: crypto engine DMA
INFO: BL3-2: secure time TEE

U-Boot 2015.01-g7942d0d (Nov 09 2018 - 16:20:49)

DRAM: 2 GiB
Relocation Offset is: 76edb000
register usb cfg[0][1] = 0000000077f61fb8
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
gpio: pin GPIOZ_13 (gpio 72) value is 0
gpio: pin GPIOAO_9 (gpio 109) value is 1
gpio: pin GPIOAO_6 (gpio 106) value is 1
MMC: aml_priv->desc_buf = 0x0000000073edbdc0
aml_priv->desc_buf = 0x0000000073ede0f0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 4c4d4140
start dts,buffer=0000000073ee0930,dt_addr=0000000073ee0930
parts: 16
00: logo 0000000000800000 1
01: recovery 0000000001200000 1
02: dto 0000000000800000 1
03: cri_data 0000000000800000 1
04: tee 0000000002000000 1
05: param 0000000001000000 1
06: prsv 0000000001000000 1
07: misc 0000000000400000 1
08: oem 0000000006000000 1
09: odm 0000000010000000 1
10: vendor 0000000010000000 1
11: rsv 0000000000800000 1
12: boot 0000000001000000 1
13: system 0000000050000000 1
14: cache 0000000032000000 2
15: data ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x35a00000
Using default environment

In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=1
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
Net: dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=0
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
[1080p50hz] is invalid for cvbs.
set hdmitx VIC = 31
config HPLL = 2970000
HPLL: 0xc000027b
config HPLL done
j = 4 vid_clk_div = 1
hdmitx phy setting done
hdmitx: set enc for VIC: 31
rx version is 1.4 or below div=10
hdmtix: set audio
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
gpio: pin GPIOAO_2 (gpio 102) value is 1
gpio: pin GPIOX_0 (gpio 0) value is 1
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
[imgread]secureKernelImgSz=0x918800
ee_gate_off ...
## Booting Android Image at 0x01080200 ...
reloc_addr =73f60bd0
copy done
Kernel command line: buildvariant=user
load dtb from 0x1000000 ......
Uncompressing Kernel Image ... OK
kernel loaded at 0x01080000, end = 0x0220d6c0
Loading Ramdisk to 73d4b000, end 73ec8a52 ... OK
Loading Device Tree to 000000001fff2000, end 000000001fffff72 ... OK
fdt_instaboot: no instaboot image

Starting kernel ...

uboot time: 3603836 us
[ 0.000000@0] Reserved memory: incorrect alignment of CMA region
[ 0.188788@0] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xbc)
[ 0.191290@0] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xbc)
[ 0.199504@0] genirq: Setting trigger mode 8 for irq 241 failed (gic_set_type+0x0/0xbc)
[ 0.207382@0] genirq: Setting trigger mode 8 for irq 242 failed (gic_set_type+0x0/0xbc)
domain-0 init dvfs: 4
[ 0.229334@0] tv_vout: chrdev devno 266338304 for disp
[ 0.783695@0] mtdoops: mtd device (mtddev=name/number) must be supplied
[ 0.794092@0] amlogic-new-usb3 d0078080.usb3phy: This phy has no usb port
[ 0.806707@0] ATVR driver - init called!
[ 0.817059@0] get_storage_dev return 1
[ 0.914982@0] DI-di_probe: get flag_cma error.
[ 0.917860@0] PPMGRDRV: err: ppmgr_driver_probe called
[ 0.948832@2] DVB:async fifo 0 buf size 524288, flush size 262144
[ 0.950696@2] FE: cannot find resource "tuner0"
[ 0.953769@2] FE: cannot find resource "atv_demod0"
[ 0.959292@2] FE: cannot find resource "tuner1"
[ 0.963130@2] FE: cannot find resource "atv_demod1"
[ 0.967968@2] FE: cannot find resource "dtv_demod1"
efuse_pw_en: 0x17
[ 1.220471@2] cectx aocec: no hdmirx reg resource
[ 1.220502@2] cectx aocec: no hhi reg resource
[ 1.224043@2] cectx aocec: can't find hdmirx
[ 1.445836@2] aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTL
[ 1.447841@2] aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTL -> direct -> Ext Spk
[ 1.456658@2] aml_snd_m8_card aml_m8_snd.46: ASoC: no source widget found for LOUTR
[ 1.464231@2] aml_snd_m8_card aml_m8_snd.46: ASoC: Failed to add route LOUTR -> direct -> Ext Spk
[ [ 2.171265@0] init: waitpid failed: No child processes
[ 2.175952@0] init: /init.amlogic.rc: 206: chmod requires 2 arguments
[ 2.180363@0] init: could not import file 'init.mtk.rc' from '/init.amlogic.rc': No such file or directory
[ 3.203347[ 3.219466@1] init: enter do_confirm_formated /dev/block/tee, /tee
[ 3.220017@1] init: blocksize 1024, bytes_per_inode 1024
[ 3.225334@1] init: do_confirm_formated ext4 try mount
[ 3.265769@1] DVB:async fifo 0 buf size 524288, flush size 16384
[ 3.267080@2] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[ 3.272698@2] fs_mgr: Warning: unknown flag nosuid
[ 3.277477@2] fs_mgr: Warning: unknown flag nodev
[ 3.705577@2] device-mapper: android-verity: come to android_verity_ctr in dm-android-verity.c
[ 3.708528@2] device-mapper: android-verity: argv[0]: 1
[ 3.713698@2] device-mapper: android-verity: argv[1]: /dev/block/system
[ 3.720289@2] device-mapper: android-verity: argv[2]: /dev/block/system
[ 3.726852@2] device-mapper: android-verity: argv[3]: 4096
[ 3.732242@2] device-mapper: android-verity: argv[4]: 4096
[ 3.737690@2] device-mapper: android-verity: argv[5]: 322558
[ 3.743282@2] device-mapper: android-verity: argv[6]: 322558
[ 3.748896@2] device-mapper: android-verity: argv[7]: sha256
[ 3.754519@2] device-mapper: android-verity: argv[8]: 0b1f3bddf3c1cf8b70ba15a20682e9579b85a76b0237ec49e567a8316c189612
[ 3.765110@2] device-mapper: android-verity: argv[9]: aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7
[ 3.775741@2] device-mapper: android-verity: argv[10]: 9
[ 3.780975@2] device-mapper: android-verity: argv[11]: use_fec_from_device
[ 3.787816@2] device-mapper: android-verity: argv[12]: /dev/block/system
[ 3.794436@2] device-mapper: android-verity: argv[13]: fec_start
[ 3.800379@2] device-mapper: android-verity: argv[14]: 325107
[ 3.806077@2] device-mapper: android-verity: argv[15]: fec_blocks
[ 3.812110@2] device-mapper: android-verity: argv[16]: 325107
[ 3.817814@2] device-mapper: android-verity: argv[17]: fec_roots
[ 3.823753@2] device-mapper: android-verity: argv[18]: 2
[ 3.829020@2] device-mapper: android-verity: argv[19]: ignore_zero_blocks
[ 3.837292@2] device-mapper: android-verity: verity_table_args[0]: 1
[ 3.842045@2] device-mapper: android-verity: verity_table_args[1]: /dev/block/system
[ 3.849763@2] device-mapper: android-verity: verity_table_args[2]: /dev/block/system
[ 3.857399@2] device-mapper: android-verity: verity_table_args[3]: 4096
[ 3.863946@2] device-mapper: android-verity: verity_table_args[4]: 4096
[ 3.870506@2] device-mapper: android-verity: verity_table_args[5]: 322558
[ 3.877240@2] device-mapper: android-verity: verity_table_args[6]: 322558
[ 3.883956@2] device-mapper: android-verity: verity_table_args[7]: sha256
[ 3.890688@2] device-mapper: android-verity: verity_table_args[8]: 0b1f3bddf3c1cf8b70ba15a20682e9579b85a76b0237ec49e567a8316c189612
[ 3.902418@2] device-mapper: android-verity: verity_table_args[9]: aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7
[ 3.914200@2] device-mapper: android-verity: verity_table_args[10]: 9
[ 3.920531@2] device-mapper: android-verity: verity_table_args[11]: use_fec_from_device
[ 3.928475@2] device-mapper: android-verity: verity_table_args[12]: /dev/block/system
[ 3.936231@2] device-mapper: android-verity: verity_table_args[13]: fec_start
[ 3.943296@2] device-mapper: android-verity: verity_table_args[14]: 325107
[ 3.950141@2] device-mapper: android-verity: verity_table_args[15]: fec_blocks
[ 3.957275@2] device-mapper: android-verity: verity_table_args[16]: 325107
[ 3.964106@2] device-mapper: android-verity: verity_table_args[17]: fec_roots
[ 3.971155@2] device-mapper: android-verity: verity_table_args[18]: 2
[ 3.977552@2] device-mapper: android-verity: verity_table_args[19]: ignore_zero_blocks
[ 4.727735@1] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[ 4.728719@1] fs_mgr: Warning: unknown flag nosuid
[ 4.733457@1] fs_mgr: Warning: unknown flag nodev
[ 5.352920@1] init: property_set("ro.adb.secure", "1") failed
[ 5.353461@1] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[ 5.359854@1] fs_mgr: Warning: unknown flag nosuid
[ 5.364428@1] fs_mgr: Warning: unknown flag nodev
[ 5.369082@1] init: /recovery not specified in fstab
[ 5.375242@1] init: do_start: Service debuggerd64 not found
[ 5.550729@2] dig: dig start!
[ 5.554515@2] fs_mgr: Warning: unknown flag context=u:object_r:oemfs:s0
[ 5.555499@2] fs_mgr: Warning: unknown flag nosuid
[ 5.560234@2] fs_mgr: Warning: unknown flag nodev
[ 5.867026@1] init: decode_uid: Unable to find UID for 'pppoe'. Returning UINT_MAX
[ 5.870301@1] init: decode_uid: Unable to find UID for 'pppoe'. Returning UINT_MAX
[ 5.990789@0] init: insmod: open("/system/lib/aml_thermal.ko") failed: No such file or directory
[ 6.003779@1] vfm_map_store:rm default
[ 6.003837@1] vfm_map_store:add default decoder ppmgr deinterlace amvideo
[ 6.764790@3] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[ 6.921455@3] init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[ 6.924377@3] init: setprop: cannot expand '${sys.usb.state}'
[ 6.930219@3] init: property 'ro.usb.vendor.string' doesn't exist while expanding '${ro.usb.vendor.string}'
[ 6.939709@3] init: write: cannot expand '${ro.usb.vendor.string}'
[ 6.945845@3] init: property 'ro.usb.product.string' doesn't exist while expanding '${ro.usb.product.string}'
[ 6.955678@3] init: write: cannot expand '${ro.usb.product.string}'
[ 6.961909@3] init: property_set("ro.radio.noril", "true") failed
[ 6.968719@3] init: insmod: open("/system/lib/compat.ko") failed: No such file or directory
[ 7.046084@3] init: cannot find '/system/bin/cwmpd' (No such file or directory), disabling 'cwmpd'
[ 7.050233@3] init: finit_module for "/system/lib/dwc3.ko" failed: File existsinit: finit_module for "/system/lib/dwc_otg.ko" failed: File exists
[ 7.063572@3] init: property 'sys.usb.state' doesn't exist while expanding '${sys.usb.state}'
[ 7.070815@3] init: setprop: cannot expand '${sys.usb.state}'
[ 7.076718@3] init: property 'ro.usb.vendor.string' doesn't exist while expanding '${ro.usb.vendor.string}'
[ 7.086178@3] init: write: cannot expand '${ro.usb.vendor.string}'
[ 7.092279@3] init: property 'ro.usb.product.string' doesn't exist while expanding '${ro.usb.product.string}'
[ 7.102110@3] init: write: cannot expand '${ro.usb.product.string}'
[ 7.108769@3] android_usb: already disabled
[ 7.113708@3] init: cannot find '/system/bin/update_verifier' (No such file or directory), disabling 'exec 2 (/system/bin/update_verifier)'
[ 7.125329@3] init: cannot find '/system/bin/install-recovery.sh' (No such file or directory), disabling 'flash_recovery'
[ 7.136454@3] init: cannot find '/system/bin/pppoe_wrapper' (No such file or directory), disabling 'pppoe_wrapper'
[ 7.146714@3] init: cannot find '/system/bin/factoryreset.sh' (No such file or directory), disabling 'factoryreset'
[ 7.147598@1] meson-remote c8100580.rc: remote_ioctl invalid user space pointer
[ 7.148121@1] meson-remote c8100580.rc: remote_ioctl invalid user space pointer
[ 7.184278@3] init: couldn't write 4118 to /dev/cpuset/camera-daemon/tasks: No such file or directory
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ 8.481141@2] name: mbsn, size 32
[BL31]: tee size: 0
[ 9.539984@2] name: cust_sn, size 32
[BL31]: tee size: 0
[ 10.608153@3] name: tocom, size 16
[BL31]: tee size: 0
[ 11.670126@2] name: tch_sn, size 32
[BL31]: tee size: 0
[ 12.833836@2] name: mac, size 6
[BL31]: tee size: 0
[ 13.893487@1] name: mac_bt, size 6
[BL31]: tee size: 0
[ 14.949747@2] name: mac_wlan, size 6
[BL31]: tee size: 0
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
read keybox success from TEE storage
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
Playready TA Start
provision_storage_read res 0 readlen 1348
Playready TA Exit!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
Playready TA Start
provision_storage_read res 0 readlen 32
Playready TA Exit!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ 19.005694@3] rtk_btusb: download_patch: Cold reset bt chip only download
[ 19.759712@3] rtk_btusb: download_patch: Download fw patch done, fw len 22972
[ 26.564555@3] dig: isBootCompleted:1!
[ 26.564934@3] dig: setDataRoCount count:0!
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ATOS] TDK-v2.0
[ATOS] TA verified (2048-2048)
[ 43.569084@3] name: cust_rootCA, size 2121

This is the dump of the bootloader after running a “adb reboot bootloader” through ADB to boot the machine in bootloader mode (in which case the machine hangs in a screen, and disappears from the device manager in my computer):

[ 54.835967@0] SysRq : Emergency Remount R/O
[ 55.042441@0] rtk_btusb: bt_reboot_notify: HCI_RUNNING flag cleared
[ 56.060219@0] reboot: Restarting system(init) with command 'bootloader'
bl31 reboot reason: 0xd
bl31 reboot reason: 0x7
system cmd 1.
GXL:BL1:9ac50e:bb16dc;FEAT:BF8D39BE:0;POC:3;EMMC:0;READ:0;0.0;0.0;CHK:0;
TE: 198133

BL2 Built : 13:29:27, Oct 20 2017. \ngxl g6cead14 - marco@beast

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 5
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR4 chl: Rank0 @ 1008MHz
Rank0: 2048MB-2T-18
DataBus test pass!
AddrBus test pass!
-s
emmc switch 3 ok
BL2: rpmb counter: 0x0000001d
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x0000c200, des: 0x01700000, size: 0x00004000
Load BL3x from eMMC, src: 0x00010200, des: 0x01704000, size: 0x000f4000
NOTICE: BL3-1: v1.0(release):8ede9fe
NOTICE: BL3-1: Built : 20:00:30, Dec 25 2017
[BL31]: GXL CPU setup!
aml log : bl31 detect secure boot !
[SECURE APB] Write to enable Jtag finished
Wait for your jtag pass word...
mpu_config_enable:ok
[Image: gxl_v1.1.3212-44bf1a7 2017-07-24 17:22:09 marco@beast]
OPS=0x04
58 84 36 41 a0 8c 82 ca 5c 8a c0 7a [1.670935 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-2: ATOS-V2.0.2-g39c4135 #2 Fri Jun 15 18:29:54 CST 2018 arm
INFO: BL3-2: chip version = RevD (21:D - 0:0)
INFO: BL3-2: crypto engine DMA
INFO: BL3-2: secure time TEE

U-Boot 2015.01-g7942d0d (Nov 09 2018 - 16:20:49)

DRAM: 2 GiB
Relocation Offset is: 76edb000
register usb cfg[0][1] = 0000000077f61fb8
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpu: vpu_clk_gate_init_off
vpp: vpp_init
gpio: pin GPIOZ_13 (gpio 72) value is 0
gpio: pin GPIOAO_9 (gpio 109) value is 1
gpio: pin GPIOAO_6 (gpio 106) value is 1
MMC: aml_priv->desc_buf = 0x0000000073edbdc0
aml_priv->desc_buf = 0x0000000073ede0f0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
init_part() 293: PART_TYPE_AML
[mmc_init] mmc init success
dtb magic 4c4d4140
start dts,buffer=0000000073ee0930,dt_addr=0000000073ee0930
parts: 16
00: logo 0000000000800000 1
01: recovery 0000000001200000 1
02: dto 0000000000800000 1
03: cri_data 0000000000800000 1
04: tee 0000000002000000 1
05: param 0000000001000000 1
06: prsv 0000000001000000 1
07: misc 0000000000400000 1
08: oem 0000000006000000 1
09: odm 0000000010000000 1
10: vendor 0000000010000000 1
11: rsv 0000000000800000 1
12: boot 0000000001000000 1
13: system 0000000050000000 1
14: cache 0000000032000000 2
15: data ffffffffffffffff 4
init_part() 293: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
check pattern success
mmc env offset: 0x35a00000
Using default environment

In: serial
Out: serial
Err: serial
reboot_mode=bootloader
hpd_state=1
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
_verify_dtb_checksum()-917: calc 610379a7, store 610379a7
dtb_read()-1039: total valid 2
dtb_read()-1106: do nothing
Net: dwmac.c9410000amlkey_init() enter!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0

Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x7f851000
[CANVAS]addr=0x7f851000 width=3840, height=2160
[1080p50hz] is invalid for cvbs.
set hdmitx VIC = 31
config HPLL = 2970000
HPLL: 0xc000027b
config HPLL done
j = 4 vid_clk_div = 1
hdmitx phy setting done
hdmitx: set enc for VIC: 31
rx version is 1.4 or below div=10
hdmtix: set audio
amlkey_init() enter!
amlkey_init() 71: already init!
[EFUSE_MSG]keynum is 8
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
[BL31]: tee size: 0
gpio: pin GPIOAO_2 (gpio 102) value is 1
gpio: pin GPIOX_0 (gpio 0) value is 1
pearl#

Ah, I should probably mention at this point that my TV box doesn't have any RCA audio jack, where a push button might be hidden into, so I don't know how an emergency boot mode that would accept UART commands can be initiated.

So, could someone guide me through the correct tools/process to use for writing through the UART interface to the eMMC of the machine? Thanks a lot for your help guys!