Skyworth hp4024 (hp40a)

[mazjed]

Hi i have the hph07 the one with all the ports but its running android 8 with full access to the settings, and developer mode free to enable, it can be sellected custom launcher (but needs to press a custom programed button on the remote right after it start the android os, becuse im forced to keep the main iptv app and dont touch it in order to dont avoid the warranty from the cable provider) i have a little strugle bc i want to install android tv or something that works with chromecast bc in the site manufactuare has a lable chromecast enabled but mine dosent have it for the fact that it is android not android tv, you can enable adb on it, all that without even openig it (it has a skyworth testing software and other left over from the testing proces) in the developer mode has some processes that some of them idk for what they are it can kill the processes and still works, one of them is skyworth update software runnig 24/7, in the left over testing stuff is a flashing tool for the hdcp, and hardware testing software, it can sideload apps without a problem, i will love to share a firmware dump but i really dont want to open the stb, i will buy one second Hand and test further on that, if anyone has an intrest of me sending one second hand box to them it can dm me, when the chromecast bilt in app is instaled it shows untrusted device so idk, thats all i have for now, any questions below i will respond as soon as posible



Some pictures from what i have done to my box and what i saved from the left overs:

Hi buddy you can try

1001 TVs it support HPH07 for casting

 

[dankatapich]

The box i have dosen support it but i fix it using Air screen

 

[dankatapich]

I managed to boot to the recovery mode Is there anything can be done from recovery

Can you tell how you manage to get there bc the version i have has the recovery mode deleted some how enabling adb and settingit to reboot in the recovery dosent work

 

[dankatapich]

Is there any way to just install apps without rooting it? I don't wanna mess it up since it's my TV providers box. Anything risk free?

#1397# and then find storage plug a usb drive and open in from the settings it will launch file browser the just install what you want (that worked for me)

 

[dankatapich]

My HP40A can use uboot shell. No limitations at all, firmware can enable developer options, turn on adb, but not root. The pcb is exactly the same. Different firmware is Android 9.0.

I may have the same but mine is with the android 8

 

[mazjed]

Can you tell how you manage to get there bc the version i have has the recovery mode deleted some how enabling adb and settingit to reboot in the recovery dosent work

i have no idea why your system not booting to recovery mode my systems were android 10
but why don't you try khadas recovery method.

https://xdaforums.com/t/skyworth-hp4024-hp40a.4425361/post-87952253

 

[dankatapich]

i have no idea why your system not booting to recovery mode my systems were android 10
but why don't you try khadas recovery method.

https://xdaforums.com/t/skyworth-hp4024-hp40a.4425361/post-87952253

The thing is mine dosent have it? No mater what i do it boosts directly in to the android os

 

[mazjed]

The thing is mine dosent have it? No mater what i do it boosts directly in to the android os

what about fast boot can you go to fast boot

any how attached my recovery backup if you want to edit .

but take care these device's are easily get bricked .

 

[dankatapich]

what about fast boot can you go to fast boot

any how attached my recovery backup if you want to edit .

but take care these device's are easily get bricked .

Nope no mater what i try my box just boot right back in to the android even tried to deliberately to bricked while it was updating and nothing the box just strats with old version :/, probably becuse it has a copy of evrything and just boot right back up, and really old trick used by my isp on their old boxes

 

[Elsafah]

This device has been cracked. root firmware,USB burning mode,ddbr emmc img

How can I flash the firmware

 

[mazjed]

How can I flash the firmware

Hi buddy No one has confirmed that this rom is compatible with skyworth
so take care their is no coming back form bricked devices tell today

 

[nik5610]

Hi mazjed,

i have the same box as yours. Strong Leap-s1.
with you help and the one of zeus (other forum) i managed to boot from usb.

what's now missing seems to be a good dtb

i'm stuck on this:

[rsvmem] get fdtaddr NULL!
rsvmem - reserve memory

Usage:
rsvmem check                   - check reserved memory
rsvmem dump                    - dump reserved memory

rsvmem check failed

any idea?

no worries about the aarch linux - i get the same results with armbian

Thanks
Nik

hdmitx: set enc for VIC: 16
enc_vpu_bridge_reset[1319]
rx version is 1.4 or below  div=10
Net:   dwmac.ff3f0000M...33:01(from chipid)

Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
(Re)start USB...
USB0:   USB3.0 XHCI init start
Register 3000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
Found /extlinux/extlinux.conf
Retrieving file: /extlinux/extlinux.conf
reading /extlinux/extlinux.conf
1671 bytes read in 28 ms (57.6 KiB/s)
1:      Armbian
Retrieving file: /uInitrd
reading /uInitrd
9920638 bytes read in 310 ms (30.5 MiB/s)
Retrieving file: /zImage
reading /zImage
28078592 bytes read in 830 ms (32.3 MiB/s)
append: root=LABEL=ROOTFS rootflags=data=writeback rw console=ttyAML0,115200n8 console=tty0 no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0
Retrieving file: /dtb/amlogic/meson-gxm-beelink-gt1.dtb
reading /dtb/amlogic/meson-gxm-beelink-gt1.dtb
30751 bytes read in 51 ms (587.9 KiB/s)
[rsvmem] get fdtaddr NULL!
rsvmem - reserve memory

Usage:
rsvmem check                   - check reserved memory
rsvmem dump                    - dump reserved memory

rsvmem check failed
## Loading init Ramdisk from Legacy Image at 03080000 ...
   Image Name:   uInitrd
   Image Type:   AArch64 Linux RAMDisk Image (gzip compressed)
   Data Size:    9920574 Bytes = 9.5 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
active_slot is <NULL>
Unknown command 'store' - try 'help'
No dtbo patitions found
load dtb from 0x1000000 ......
## Flattened Device Tree blob at 01000000
   Booting using the fdt blob at 0x1000000
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND
No valid dtbo image found
libfdt fdt_path_offset() returned FDT_ERR_NOTFOUND
[rsvmem] fdt get prop fail.
   Loading Ramdisk to 3ce89000, end 3d7ff03e ... OK
   Loading Device Tree to 000000001fff5000, end 000000001ffff81e ... OK

Starting kernel ...

uboot time: 13416376 us

 

[mazjed]

hi Nik
the best Amlogic dtb's are attached
i believe that the MECOOL KM3 ones may work
if u want to dig more look

amlogic-s9xxx-armbian/build-armbian/armbian-files/common-files/etc/model_database.conf at main · ophub/amlogic-s9xxx-armbian

Support for Armbian in Amlogic, Rockchip and Allwinner boxes. Support a311d, s922x, s905x3, s905x2, s912, s905d, s905x, s905w, s905, s905l, rk3588, rk3568, rk3399, rk3328, h6, etc. - ophub/amlogic-...

github.com

amlogic-s9xxx-openwrt/make-openwrt/openwrt-files/common-files/etc/model_database.conf at main · ophub/amlogic-s9xxx-openwrt

Support for OpenWrt in Amlogic, Rockchip and Allwinner boxes. Support a311d, s922x, s905x3, s905x2, s912, s905d, s905x, s905w, s905, s905l, rk3588, rk3568, rk3399, rk3328, h6, etc. - ophub/amlogic-...

github.com

 

[mirosslav]

I booted linux OS Armbian on Hp4024 and used meson-g12a-radxa-zero.dtb. Wifi is not working. The rest works OK.

 

[mazjed]

I booted linux OS Armbian on Hp4024 and used meson-g12a-radxa-zero.dtb. Wifi is not working. The rest works OK.

Try the g12a-s905l3a-e900v22c.dtb

And would you write the armbian rom you have used
so others may try

+ remember that MTEK MT7661LSN / 2144 is a bit trek.

 

[kalehrl]

How did you boot armbian from USB?

 

[nik5610]

Hi,
@mazjed : thank you very much for the quick reply - unfortunately i had no succcess. (so far)

• do you still have the bootloop? have you unsolderedd the pin correctly and the pullup is there, still fine? I had the same problem.

@kalehrl: with the 'switches' on the board you can stop/interrupt the normal boot.

here's what i did (had also the boot loop from mazjed)
1. you need the serial port connected. (it's written on the board, or on pictures)

• The tty seems always to print out the boot, on another board i just took the oscilloscope and tested all the testpoints while booting until i find something looking like serial

2. you need a way to interrupt the boot process...

• either by pressing space or ^c (commercial ones do prohibit this mostly)
• press some kind of 'reset' switch, this looks to me more as boot-select-switch (toothpick) forcing an alternate boot order: eg sd - usb - emmc
• on the picture below you see where i placed the switch, there is also another testpin 3 down 2 left with a pullup aside, this one i used in the first go to interrupt the boot. (the same a majed used)
• i found that when booting i have to flip the switch 'several times' during the boot to interrupt the access to emmc - (failed boot count goes up) this way the boot is forced into 'recovery' and stops at this prompt:

3. Bingo - with this prompt your in g12a_u212_v1#

• at this promt you can now do some thing...
• g12a_u212_v1# printenv
  • this will print the current environment settings with things like:
  • bcb_cmd=get_avb_mode;get_valid_slot;
    boot_part=boot
    bootargs=init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 loglevel=1 hdr_priority= otg_device=0 reboot_mode_android=normal logo=osd0,loaded,0x3d800000 fb_width=1920 fb_height=1080 display_bpp=16 outputmode=1080p60hz vout=1080p60hz,enable panel_type=lcd_1 lcd_ctrl=0x00000000 hdmitx=,444,8bit hdmimode=1080p60hz hdmichecksum=0x09430000 dolby_vision_on=0 frac_rate_policy=1 hdmi_read_edid=1 cvbsmode=576cvbs osd_reverse=0 video_reverse=0 irq_check_en=0 androidboot.selinux=enforcing androidboot.firstboot=1 jtag=disable androidboot.hardware=amlogic androidboot.bootloader=U-Boot 2015.01 androidboot.build.expect.baseband=N/A rootfstype=ramfs aml_dt= recovery_part=recovery recovery_offset=0
    bootcmd=run storeboot
    bootloader_version=U-Boot 2015.01
    ...
  • g12a_u212_v1#help
    ? - alias for 'help'
    aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
    amlmmc - AMLMMC sub system
    amlnf - aml mtd nand sub-system
    autoscr - run script from memory
    avb - avb
    base - print or set address offset
    bcb - bcb
    bmp - manipulate BMP image data
    boot_cooling- cpu temp-system
    booti - boot arm64 Linux Image image from memory
    bootm - boot application image from memory
    bootp - boot image via network using BOOTP/TFTP protocol
    cbusreg - cbus register read/write
    chpart - change active partition
    
    
  • g12a_u212_v1 #fatls usb 0 /
    dtb-6.1.11-meson64/
    dtb/
    extlinux/
    ...
    
    
  • g12a_u212_v1 #fatload usb 0:1 0x1000000 u-boot.ext
  • this loads now the bootload from the usb and ends with:
    Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
• Bingo - now you should be at the odroidn2#
• with this prompt you now have also access to set/persist the 'bios' setting for upcoming boots...
• here i placed then:
• odroidn2# defenv
  odroidn2# setenv bootcmd 'usb start && if fatload usb 0:1 0x1000000 u-boot.ext ; then go 0x1000000; else run storeboot; fi'
  odroidn2# saveenv
  odroidn2#reboot
  
  
• from now on the usb drive will first be consulted

one more thing: the command at #81 has a typo in: setenv start_vmmc_vautoscript "run switch_bootmode"
there are 'spaces' at the v and this will result in a failure at boot. (bootloop?)

 

[nik5610]

what's needed to boot further?
(i have tried many different dtb found this the closest E900V22C-D but it's 905L anyway - almost matching PCB )

1. I'm at the prompt:
   odroidn2#
2. I have access to the bootprom and can persist:
   1. odroidn2#defenv
      odroidn2#setenv bootcmd 'usb start && if fatload usb 0:1 0x1000000 u-boot.ext ; then go 0x1000000; else run storeboot; fi'
      odroidn2#saveenv
3. I can load the kernel/image/device-tree
   1. fatload usb 0:1 0x11000000 /uImage
   2. fatload usb 0:1 0x13000000 /uInitrd
   3. fatload usb 0:1 0x10000000 /dtb/amlogic/meson-gxl-s905x-p212.dtb
4. I can set the args:
   1. setenv bootargs root=UUID=89c45261-1cd5-4b2d-9970-1b5a56ff98e2 rootflags=data=writeback console=ttyAML0,115200n8 console=tty0 rw no_console_suspend consoleblank=0 fsck.fix=yes fsck.repair=yes net.ifnames=0 splash plymouth.ignore-serial-consoles
5. and i start:
   1. booti 0x11000000 0x13000000 0x10000000

   2. odroidn2#booti 0x11000000 0x13000000 0x10000000
      [rsvmem] get fdtaddr NULL!
      rsvmem - reserve memory
      
      Usage:
      rsvmem check                   - check reserved memory
      rsvmem dump                    - dump reserved memory
      
      rsvmem check failed
      Bad Linux ARM64 Image magic!

Don't get further from here :-(
any help?

 

[mirosslav]

I forgot which version I was using, I think it was Armbian_5.96_Aml-g12_Debian_buster_default_5.3.0-rc8_desktop_20190910.7z.
I deleted the usb drive.
You need to install Armbian on a usb flash drive from Balena, rename dtb from radaxa-zero to u-boot.ext and put it in root. Enter U-boot mote.
Type
fatload usb 0:1 0x1000000 s905_autoscript
then autoscr 0x1000000.
I'm writing this from memory and sorry for my bad English.

 

[mazjed]

For me its just bootloop no matter whatever i do
it looks like the loader is corrupt . my emmc is getting hot
the device stuck in mask mode
i don't know how to make it life again

that's why im stuck at this point for long long time *.*

im using the Strong Leap-s1 as my main tv device so
i cant come back to the game tell i make the HP4105
back to live