yashsingh1/xdaforums huggingface dataset:
[Touch Diamond, MDA Compact IV Themes and Apps] LucidObscurity:
I've never heard anyone complain about too much resolution before :D

I've had pretty good results with TCPMP using GDI (there's an option in there somewhere for this, much better than default). Of course you've got to get the version compiled on the .NET Framework here: http://xdaforums.com/showthread.php?t=380387.

Personally I would think you'll get the best results from a file encoded for the Diamond's native resolution (640x480) so that no scaling needs to be done to the image.

Regarding the question of which codec or compression type will yield the best results, I'm not really sure. I've found Xvid or Divx to be of very high quality provided it was encoded to the same resolution as the source and the source quality was good. I guess it's really a toss up between quality/performance and file size.
[Touch Diamond, MDA Compact IV Themes and Apps] jaapschaap:
Uhm you can have quality performance and a decent file size. DiVX looks perfect perfomance is perfect too and the size could be better (in my opinion the only thing what could be better).

Even a H.2xx encoded file always playes really nice (no shocking), you only have too worry about the 4gb limit :S

I don't know wich program i use to encode my vids, i'm @work right now.

PS 240*320 would be good to, scaling (everything x2 in this case) is much lighter then loading a 640*320 movie to the screen... But who cares if it seamlessy playing the full res :) (sorry for my englisch :))
[Touch Diamond, MDA Compact IV Themes and Apps] xmunxjai648:
not to thread jack, but i'm looking for a codec pack that will allow me to play any video on the daimond touch
[Touch Diamond, MDA Compact IV Themes and Apps] averma:
i don't know about codec packs, but TCMP and Core player come preloaded with most codecs and play video's much better than media player

TCMP is free so you might want to start there
[Touch Diamond, MDA Compact IV Themes and Apps] mancsoulja:
I use Cucusoft Ultimate DVD + Video Converter Suite its absolutely awsome, it has a preset setting for pocket pc's and the conversion quality is excellent, the movies are easly as good as dvd standard and they can be played in wmp and HTC Album :)
[Touch Diamond, MDA Compact IV Themes and Apps] Mandragore:
Have a look at this xda-developers video encoding GUI.
[OnePlus 8T Questions & Answers] husmanafper3:
Hello,

kindly any Help to solve my Problem?

i tried to flash my phone OP8T with Friemwae found but its stuck on CrashDump massage

in fastboot mode its showing Product_name_kona

any help plz?

BR
[OnePlus 8T Questions & Answers] BillGoss:
Kona is the name of the Qualcomm Snapdragon 865 5G used in our phone

Power+Vol up+Vol dn should get you out of crash dump and back to fastboot.
[OnePlus 8T Questions & Answers] husmanafper3:
Yes its getting me out but after start phone still in crash mode

what should do do fix it plz?

BR
[OnePlus 8T Questions & Answers] BillGoss:
MSM Tool will restore things back to stock.
[OnePlus 8T Questions & Answers] husmanafper3:
I tried it, its same error in the end after download and finsh MSM tool still have same error

BR
[OnePlus 8T Questions & Answers] BillGoss:
Read the OP of the MSM Tool thread carefully. It tells you what to do about getting Crash Dump when using MSM.
[Huawei Developers] KOUTLITA:
Hello, i have problem with my huawei mediap M6 8.4 tablet .. i don't have a key securiy, neither the L1, nor the L2, nor the 3. I did a check with the Drm info application and it gives me that I don't have a key. my goal is to delay the learnig video from the artstation site if you know it, but it requires an L1. is there a solution to this problem? my tablet is updated
[Huawei Developers] chowc888:
Hello, I just buy Huawei M6 8.4 this month and have the same problem. Do you have solution to fix the problem?
[Android Stick & Console AMLogic based Computers] LifelessLife:
Mecool KM2 - Root

Hi

Is there any change for TWRP or ROOT method for this Widevine certified Mecool device? Any TWRP,ROOT and MagiskHide are possible?

Looking for someone who help me root this device.

CPU: Amlogic S905X2 Quad Core ARM Cortex A53
GPU: ARM Mail-G31 MP2
OS: Android 10.0 ATV
Memory: DDR4 2GB, eMMC 8GB

Review: https://www.wirelesshack.org/review-mecool-km2-android-10-tv-box-2gb-ram-s905x2-cpu.html
[Android Stick & Console AMLogic based Computers] LifelessLife:
reserved for future updates
[Android Stick & Console AMLogic based Computers] Noter2017:
I don't think this will happen. This box is certified by Netflix.

Once you can root it, Mecool will lose the Netflix certification and most probably Mecool won't get certification in the future.
[Android Stick & Console AMLogic based Computers] rajricardo:
That's not true. Nvidia Shield is rooted, doesn't mean they cannot get future certifications.
[Android Stick & Console AMLogic based Computers] Noter2017:
Can you name another box?

The Shield is a complete exception. Not even the certificated Xiaomi boxes can be rooted, even though they have a huge community.

Mecool also has to be super careful. Not that long ago they have been selling boxes with fake/illegal certificates that could play Netflix in HD. Netflix blocked all of these boxes at some point.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Hi All,

I'm fairly new to this android tv scene, but have been following these discussions for a couple months now... I'm a hardware guy, so I picked up a couple of these units, and dissected one, ie took off the CPU and emmc.

I'm still not quite understanding of what exactly is happening with 'unlocking' bootloaders, and how this AMLogic 'tee' environment fully works, maybe you all can try to help me out a bit..

but I did want to share that I see we can still USB boot this thing, and use the AMLogic burning tool to at least re-write an image to the flash... the 'boot_5' pin I've shown in the attached pics..

you can catch it from that via (or trace) in the pic, and just touch it to gnd while powering on the unit, and it goes into USB boot via the amlogic rom... world cup device comes up and you can indeed use the burning tool..

I also dumped the emmc flash if anyone wants it? I'm not sure if that helps for being able to root it though, that's where I need some help understanding... I realize there are BL1, BL2, and BL3 boot stages, BL2 & BL3 I believe are the 'boot.img' and 'bootloader.img' that are present in the flash? that right?

I can put the emmc dump up on a mega.nz link if anyone wants it, but wasn't sure if it matters...
[Android Stick & Console AMLogic based Computers] :
By, "USB boot" do you mean actually boot operating system files from USB, or do you mean just the ability to obtain a burn mode (worldcup) connection over USB?

Skyworth has modified u-boot (bl33) for this device such that u-boot won't recognize an unlocked status for the bootloader.

For the above reason (no recognition of an unlocked status), flashing images that are not unmodified stock will fail verification and not boot.

What version does it contain?
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Hi,

So hopefully this will clarify a bit... the AmLogic S905X2/X3 uses the 'boot4/boot5/boot6' pins for the power-on boot order (power-on config) pins... these are shared pins, that are also DAT4,DAT5,DA6 (data bits 4,5,6) for the emmc interface.

So internally the amlogic has boot4/5/6 pull up, ie '111' for the boot order. When you pull boot5 low, it goes 101, ie USB first.... this is essentially what this is doing, so the amlogic bootRom is now in USB boot first, versus emmc.

(I'm assuming you can prob. also do this by just shorting any of the emmc data bits to gnd (versus just bit 5), cause corruption, and it should also fail over to usb..

I haven't tried to actually flash any image yet, but at least I see the worldcup device, and connect with the burning tool...

so I'll attach the bootup log, as well as the 'build.prop' from the /vendor folder in the image... I think this should tell you what version it's running...

*** BTW: forgot to mention, most of these devices that have a 'recovery' button or hidden switch, seem to be using 'GPIOA0_3' pin, a GPIO pin... and it's coded into the AmLogic u-boot code is 'AMLOGIC_KEY' or something like that... so when you hold it... u-boot eventually see's it and halts, and starts up the usb device ***

This is much later then when doing the above, putting the CPU into usb-boot.. just FYI....
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Another thing I wanted to mention, regarding the BL33 (which I now understand is u-boot), in the image dump, it starts at offset 0x200, and appears to probably be AES encrypted, there's not even a header on it?

I also took apart an X96 Max+ for comparison, since that box is pretty much open, and the flash image has u-boot unencrypted at the same location, and it starts with the @aml header...

I've been going through the AMLogic tools trying to understand where/how the encryption is done, but I don't understand yet how this BL33 is encrypted, and how BL32 knows what the keys are? and what's the difference from the X96 having u-boot unencrypted..

and in this one, the BL33 is encrypted? How did 'Skyworth' decrypt the bootloader to patch it?

(I'll follow-up with a mega.nz link with the mecool image once it finishes uploading)

Here's the full emmc dump:

734.74 MB file on MEGA

mega.nz
[Android Stick & Console AMLogic based Computers] :
Note that there are two types of worldcup connections. One is invoked entirely from bootrom, it is sometimes called usb download mode. It is sort of a DFU mode that has limited functionality.

In the uart console, a connection to this type of worldcup connection will look something like this;

G12A:BL:0253b8:61aa2d;FEAT:F2F939B2:32060;POC:F;RCY:0;EMMC:800;NAND:81;SD?:20000;USB:8

Note that nothing can be done using the burning tool, or the command-line update tool, with the above type of worldcup connection on the km2, due to download mode access being password protected on this device. Notwithstanding the fact that the usb burning tool will report the connection.

The second type of worldcup connection is invoked from an application in u-boot named "update". This type of worldcup connection can work with the usb burning tool or the command-line update tool. There is no password protection. In the uart console, a connection to this type of worldcup connection will look something like this;

InUsbBurn
wait for phy ready count is 0
[MSG]sof
Set Addr 1
Get DT cfg
Get DT cfg
Get DT cfg
set CFG
Get DT cfg
Get DT cfg
[Android Stick & Console AMLogic based Computers] :
Read all of the stuff at the following link, starting from oldest to newest;

https://fredericb.info/tag/amlogic.html

Maybe it is not most correct to call it a "patch" I use that terminology because that is what skyworth uses. You'll see something like this in the uart console;

[sk_patch,24]amlogic's uboot for Android10().date:Apr 8 2021

Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 1 USB Device(s) found
scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
[sk_usb_cfg_init,422]load file "/skyworth/factory_mode/uboot/check_udisk.cfg" from u disk failed!
[sk_boot,182]general boot.

Whatever skyworth does to u-boot, it is done at the source level before the bootloader is compiled.

You can define the upgrade_key to be any gpio pin you like that is not otherwise used.

You can use GPIOA0_3, but I think skyworth also uses that for some usb power mode. I think I used GPIOA0_5, which is one of the pins on the uninstalled infrared led near the micro sd slot.

The factory location for the reset button is a side mounted smd switch below the microsd slot (opposite side of the board). In the fcc photo's this switch is actually installed along with some smd resistors near it. I never figured out what gpio pin it uses. But it could never work without being defined in the environment, which it is not!

What's your end goal here? Modifying the bootloader will be rough unless you can get the bootrom keys. If you don't modify the bootloader so that an unlocked status is recognized, you can't flash non-stock partitions.

If you just want root, that can be done with a workaround. If you want to use the device to boot an alternate operating system, this probably can be done, with a workaround.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Heya,

Just wanted to clarify on this... that is the USB connection right from bootROM that I get... and the burning tool would work if I had the bootrom pwd, as this unit reports PWD is needed...

I just did this last night on a 'banana pi M5', which does not have a pwd locked bootrom, and I did the usb burn from this boot method, as it did not have any code on it whatsoever prior to me loading it....

Thanks for all of the info BTW, I'll read over it all, what I really wanted to know about was how that BL33 was encrypted... I'll get back if I have more questions, but I really appreciate all the info :)

My end goal was really just to understand what all of you already knew, I just couldn't get my head around all of it... I wanted to either just load another OS on this entirely, or figure out a way to hack the bootloader....
[Android Stick & Console AMLogic based Computers] :
Right, in order to use usb download mode, you need the password (if one is employed).

But this is the very odd case use of a worldcup connection. Unheard of for end-user use.

End users use the reset button, which runs the u-boot "update" application to establish a more robust worldcup connection that can flash and read, and even run u-boot shell commands, without any password.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
yeah, so I've been looking at compiling source, as its all up there for the banana pi, so I can play with all the pieces..

Is this skyworth info up in another thread here on this site?

Also, how did he actually write this re-compiled BL33 to the device? he re-program the flash and re-mount it? or just tap the lines and program in place?

Or, I'm taking a guess he may have used the unsigned loader exploit? I'm guessing that may not be patched in current bootROMs? or at least not all of them?
[Android Stick & Console AMLogic based Computers] :
Since you have an extra km2 with the x2 SoC removed, can you trace back the factory reset button traces to the gpio location on the SoC?

I tried finding it by shorting the traces, and using u-boot's gpio command to see which pins had a status change, but I still couldn't find which gpio pin is being used by the factory reset switch location.

Thanks for this. This contains version;

MECOOL/HP4035-Mecool/LAS:10/QTT5.200819.003/C2.0.6_20210723:user/release-keys

Although over a year old, it is 4 months newer than what I had.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Sure thing... I'll do this tonight when I get back home from work, no problem at all...

I think the first step I'd like to try with this thing is just get root? if possible... or at least do something fun to it...

(best way to try and really get a better understanding of this arm tee is to work on a fully locked implementation like this one)
[Android Stick & Console AMLogic based Computers] :
Since doing this is a rather technical process and requires verbose instructions, I'll send the details via direct message.

It might help to turn on full log level console output for the stock build. Then at least you'll see all of the tee interactions during bootup.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Heya, Ok... that would be great if you could PM me whatever you can help with...

I double-checked myself, as I thought maybe I missed a u-boot console, but I don't see one on this thing, I don't see any way for it to break into u-boot or any stage while it's booting up? nothing I hammer on the keyboard stops the process from what I can tell?

So, I was trying to identify which pads you are saying are for the smd switch.. but I waasn't totally sure, figured it would be faster to just post the top/bottom pics from that side, and you just circle the spot you want me to trace out?

(FYI, I took down my mega.nz link for the dump, since it sounds like you pulled it down, I hate leaving that stuff up for long unless someone else needs it, they can always PM me)
[Android Stick & Console AMLogic based Computers] :
See attached image. The purple arrow identifies the pad that I want to trace.

But I just remembered that it is difficult to trace because it goes to a via to the opposite side of the board underneath the card slot.

I don't want to make work for you, I was just curious.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Hi,

No worries, I have a nice lab to do these fun things :)

I heat gunned the sd socket off, to chec that via, see the attached pics, I traced that pin to that via, but from there got no hits on the cpu, and from the photo that via looks like a dead via.... not 100% sure on this, but I think this is just a 2-layer board, so prob. no internal routes? ie that via really is dead...

want me to check other pins on that header, or you sure that was the only one that could have been the 'working' pin for the switch?

BTW, how exactly did you enable more verbose console output?
[Android Stick & Console AMLogic based Computers] :
Yikes, thanks for doing all of that. It does look like a dead end. Weird.

I was trying to find the fcc photo that has the switch and the supporting smd components (resistor, cap) installed. That might shed light on what other pad connection from that area does the work. The photo wasn't part of the leap-s1 package, but another variant of the same board used for an operator tier model. I can't find it now though.

I have a PM message in draft now that will answer some of your other recent questions. I'll send it shortly.
[Android Stick & Console AMLogic based Computers] mazjed:
As long as you working on pcb schematic cheq this connection . it worked with the switch

windows pc is detected the port action then the usb wier gotten hot so i disconected it fast

i think external current limiting components should be used .

or maybe its direct connection to the emmc like jtag

GitHub - superna9999/pyamlboot: Amlogic USB Boot Protocol Library

Amlogic USB Boot Protocol Library. Contribute to superna9999/pyamlboot development by creating an account on GitHub.

github.com

i remember you told me its for ir but when boot pushing this resit swich . windows detected usb device connection but as i mention the cable becomes hot
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
This is interesting....I'll take a look..

but if you are using a pre-made 'male to male' usb cable, it also has the red wire (PWR) connected... that normally carries 5V from the host (ie your pc)...

but in some modes on these devices, the usb ports also supply 5v on that wire...

in most cases these devices will actually power-up just from your male-to-male cable because of the incoming 5v supply from the host, but really you should be powering the device from the power supply and not from this method...

So my advice is make another cable, with just the 3-wires, D+, D-, and GND...

or just make yourself a little female to male adapter (ie you can buy usb breakouts on amazon), and only connect the above 3 wires, and use your male-to-male cable with this above adapter hooked up....
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
Ok,

so trying to make sense of what I have my head wrapped around so far, correct me if any of this is wrong or not quite correct?

1) BL33 (bootloader) is at 'least' encrypted via AES keys that are programmed by the vendor into the efuses (bootrom)
(amazon seems to have added even more aes keys into other stages)

bootrom: FFFE:0000
aeskey-> offset 0x20
aesiv -> offset 0x40
(may be other params here as well)

2) amlogic 'usb dl', ie 'upgrade' mode has two flavors:

1) DFU mode in bootrom:
---> can be entered via the hdmi dongle or bootstrap pins) -- this is in BL1
2) other mode in u-boot:
---> sometimes vendors have an 'update_key', ie GPIO pin that when held, (and enabled in uboot), enters into an alternate 'upgrade' mode that is running out of u-boot (BL33), un-secure mode. (can also be entered via fault 'fallthrough', ie glitching

3) bootrom can now be password locked, via e-fuses for the password (and an e-fuse bit to enable pwd lock)

4) bootrom e-fuse bit determines 'secure-boot' or 'normal/un-secure' boot?

Amazon at some point burned an e-fuse to disable USB mode ('IS_FEAT_USB_BOOT_ENABLE'), you can see these defines at:

uboot.git - Unnamed repository; edit this file 'description' to name the repository.

aml-code.amlogic.com

So, at this point, for devices like this, we would need to get bootrump dumped, in order have any chance of decrypting BL33

...so what I don't yet fully understand yet, is how this 'worldcup' gadget is implemented in u-boot? does it still utilize any underlying bootrom function calls, or is this entirely done in unprotected world?

also looking at the public usbdl exploits...

GitHub - frederic/amlogic-usbdl: Unsigned code loader for Amlogic BootROM

Unsigned code loader for Amlogic BootROM. Contribute to frederic/amlogic-usbdl development by creating an account on GitHub.

github.com

GitHub - Raxone/amlogic-usbdl_s905x3: Dump s905x3

Dump s905x3 . Contribute to Raxone/amlogic-usbdl_s905x3 development by creating an account on GitHub.

github.com

GitHub - Raxone/amlogic-usbdl_s905x2: s905x2 Dump Bootrom BL1

s905x2 Dump Bootrom BL1. Contribute to Raxone/amlogic-usbdl_s905x2 development by creating an account on GitHub.

github.com

All of these require bootrom USB boot mode (I believe?), and to NOT be bootrom password locked..

if we can execute code from within u-boot (in usbdl mode), can we utilize the ARM Secure Monitor Calls to get into some secure rom code to do things? (ie if we write our own custom code to execute)
[Android Stick & Console AMLogic based Computers] :
That all seems more or less correct from what I can tell.
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
So, just wanted to clarify my understanding of mode #1 versus #2 (ie 'burning' mode from bootrom versus update mode in u-boot)..

it seems the 'udpate' tool really only works in mode#2 when connecting via the u-boot gadget? is this how it always was, the update tool never worked when talking to the worldcup connection via the bootrom gadget?

I kept thinking that the update tool worked for both, but I'm guessing now only the usb burning tool ever worked in #1? (and the exploit scripts, with no password lock of course)
[Android Stick & Console AMLogic based Computers] Principal-McVicker:
BTW, any of you know the correct BOOTROM start addresses for the s905X2 & s905X3...

exploits seem to say: 0xFFFE:0000 ?? (this seems incorrect)

from the datasheet for the X3, memorymap says the rom starts at 0xFFFF:0000, but the exploit scripts to dump the efuse and bootrom for both the x2 and x3 seem to indicate it's at 0xFFFE:0000, but also seems to start there for the efuse?

the bootroms are all posted, and I wanted to disassem them, but would be nice to put them at the correct address they are supposed to be:

SoC-BootROMs/amlogic at main · Zenofex/SoC-BootROMs

BootROM dumps from misc SoCs. Contribute to Zenofex/SoC-BootROMs development by creating an account on GitHub.

github.com
[Android Stick & Console AMLogic based Computers] Raxone:
SRAM Memory Map for s905,s905l,x,w,s912,s922

0xD9000000 - 0xD9013FFF AHB Sram/Load Addr.

0xD900C000 Efuse (AesKey,Usb Password,etc.)

0xD9040000 - 0xD907FFFF BootRom

SRAM Memory Map for s905x2,3,s905d3

0xFFFF0000 BootRom,BL1

0xFFFA0000 Load Addr. Bl2

s905x2 Efuse

0xFFFE0000 - 0xFFFE8000 32kb (After 0xFFFE8000 is not possible to read )

s905x3 Efuse

0xFFFE0000 - 0xFFFE0800 Part 1 2kb 0x800 (AesKey)

0xFFFE1800 - 0xFFFE6000 Part 2 18kb 0x4800

0xFFFE7000 - 0xFFFE7FFF Part3 4Kb 0xfff (AesKey)