[UNOFFICIAL] LineageOS 19.1 for Amlogic G12*/SM1 Family Devices

Search This thread

npjohnson

Recognized Developer
So that means that for the supported devices that use encrypted bootloaders, the bootrom keys for each device were extracted so as to be able encrypt each supported device's "own newest boot loader" for each of these builds?
None of these devices have encrypted. Bootloaders or boot rom passwords except for Sabrina, which has a whole write up on how we did it
 

RDS5

Senior Member
For what device? dopinder is broken at the moment. yes.

That's... bad. I'll fix it.

Yes, each device has it's own newest boot loader packed in which matching TEE applets.
im using wade, trying the same exact procedure on both 18.1 and 19.1 is different.
when i flash and then boot into 18.1 recovery, it all works as expected.
when i flash and then TRY to boot into 19.1 recovery, nothing happens.
if i try flashing 19.1 from 18.1 recovery, it starts acting up in the os, and if i try rebooting into recovery after that, it gets stuck on the boot logo (probably because it freezes up when trying to boot into 19.1 recovery).
 

goapy

Senior Member
Dec 30, 2021
137
34
None of these devices have encrypted. Bootloaders or boot rom passwords except for Sabrina, which has a whole write up on how we did it

When looking at a factory original bootloader.img for the deadpool (adt-3) in a hex viewer, at offset 10h there is:

Code:
@AML (hex: 40 41 4D 4C)

While for the dopinder (onn) bootloader.img at offset 0h there is:

hex: 9B DF 1A 47, with no sign of the AML magic anywhere to be found.

For wade (dynalink) it's the same, no AML magic, but different hex values at the start of bootloader.img.

What distinguishes the deadpool bootloader.img (with AML magic) from the dopinder and wade bootloader.img contents?

Are the dopinder and wade bootloader.img contents just compressed rather than encrypted, or else why is the raw hex structure so different as compared to deadpool?
 
Last edited:

npjohnson

Recognized Developer
When looking at a factory original bootloader.img for the deadpool (adt-3) in a hex viewer, at offset 10h there is:

Code:
@AML (hex: 40 41 4D 4C)

While for dopinder (onn) bootloader.img at offset 0h. there is:

hex: 9B DF 1A 47, with no sign of the AML magic anywhere to be found.

For wade (dynalink) it's the same, no AML magic, but different hex values at the start of bootloader.img.

What distinguishes the deadpool bootloader.img (with AML magic) from the dopinder and wade bootloader.img contents?

Are the the dopinder and wade bootloader.img contents just compressed rather than encrypted, or else why is the raw hex structure so different as compared to deadpool?
They're entirely different.

BL2 on wade/dopinder is older, newer on Deadpool, u-boot is built on completely different revisions for BL33.

They are stored in a proprietary format. See Sabrina writeup on how to tear them apart (minus the encryption).
 

goapy

Senior Member
Dec 30, 2021
137
34
They're entirely different.

BL2 on wade/dopinder is older, newer on Deadpool, u-boot is built on completely different revisions for BL33.

They are stored in a proprietary format. See Sabrina writeup on how to tear them apart (minus the encryption).

I've read the sabrina writeup, both yours and fred's, dozens (if not hundreds) of times.

My prior understanding and experience has been that if the AML magic was present at the start of bootloader.img, then that bootloader would at least boot on just about any generic amlogic device that wasn't configured to use an encrypted bootloader.

But if the AML magic wasn't present, then only a bootloader.img that started with the same string of bytes as the original would ever boot. I assumed this was because the bootloaders were differently encrypted. This was the case even of differently branded variants of the same device that were otherwise physically identical and most likely used the same revision of BL33.

It appears that I was wrong and I need to reassess my understanding.
 
Last edited:

npjohnson

Recognized Developer
I've read the sabrina writeup, both yours and fred's, dozens (if not hundreds) of times.

My prior understanding and experience has been that if that AML magic was present at the start of bootloader.img, then that bootloader would at least boot on just about any generic amlogic device that wasn't configured to use an encrypted bootloader.

But if the AML magic wasn't present, then only a bootloader.img that started with the same string of bytes as the original would ever boot. I assumed that was because the bootloaders were differently encrypted. This was the case even of differently branded variants of the same device that were otherwise physically identical and most likely used the same revision of BL33.

It appears that I was wrong and I need to reassess my understanding.
That isn't true in the android box world sadly - u-boots need different configurations, and different board files per device often.
 

goapy

Senior Member
Dec 30, 2021
137
34
That isn't true in the android box world sadly - u-boots need different configurations, and different board files per device often.
Aren't wade and dopinder close enough hardware-wise that they should be able to at least boot each other's bootloader minimally?

Or to put it another way, why does the wade bootloader.img (for all versions) start with hex "A7 5B 38 30" while the dopinder bootloader.img starts with "9B DF 1A 47"? Is this because of the proprietary formatting that you referenced? Could working bootloaders for these devices (respectively) ever start with anything else, in terms of raw hex values?

For other devices, even after an update across PI -> Q -> R, the first couple hundred bytes of the bootloader will always be the same. I imagine that the u-boot components probably changed a lot across android 9, 10, and 11.
 

npjohnson

Recognized Developer
Aren't wade and dopinder close enough hardware-wise that they should be able to at least boot each other's bootloader minimally?

Or to put it another way, why does the wade bootloader.img (for all versions) start with hex "A7 5B 38 30" while the dopinder bootloader.img starts with "9B DF 1A 47"? Is this because of the proprietary formatting that you referenced? Could working bootloaders for these devices (respectively) ever start with anything else, in terms of raw hex values?

For other devices, even after an update across PI -> Q -> R, the first couple hundred bytes of the bootloader will always be the same. I imagine that the u-boot components probably changed a lot across android 9, 10, and 11.
I wouldn't do that - no reason to.

They're signed by different OEM sets - so I'd anticipate it's that - or just a versioned header.

And eh - it's really just security stuff from pie to R in terms of u-boot - S changes things more tho.
 

goapy

Senior Member
Dec 30, 2021
137
34
They're signed by different OEM sets - so I'd anticipate it's that - or just a versioned header.
Ah, this may be what I'm trying to understand.

What is an OEM set? How is a bootloader signed by one? This is different than encryption?

When you make a bootloader for use with your LOS build that supports wade/dopinder, do you have to sign each bootloader differently based on its OEM set? Where in the build process does this happen, and how is it done?
 

npjohnson

Recognized Developer
Ah, this may be what I'm trying to understand.

What is an OEM set? How is a bootloader signed by one? This is different than encryption?

When you make a bootloader for use with your LOS build that supports wade/dopinder, do you have to sign each bootloader differently based on its OEM set? Where in the build process does this happen, and how is it done?
I meant a "different OEMs set of keys". It is signed with proprietary amlogic tools. Yes it's much different. Digital signage verifies source of distro/who approved it in the header, not encrypts it.

We don't make boot loaders for these devices for lineage. Only for development boards, not production devices.

We just package the stock one to make sure it matches the TEE applets we include.
 

goapy

Senior Member
Dec 30, 2021
137
34
We don't make boot loaders for these devices for lineage. Only for development boards, not production devices.

We just package the stock one to make sure it matches the TEE applets we include.

I took your earlier response to mean the opposite.

Now I'm back to being convinced that the bootloaders for wade/dopinder are encrypted while the bootloader for deadpool is not encrypted. The deadpool bootloader has text strings and large stretches of unused space (00 hex). Neither wade or dopinder do.
 
Last edited:

RDS5

Senior Member
Anyway, sorry for the distraction. My original reason for asking was noble though. I was trying to understand why some users were having trouble with 19.1 on wade (I had no trouble), and I thought the pre-install bootloader on the device might be relevant.
wait a minute, wade works on 19.1 for you?
how. why doesnt it work for me! no matter how many different things i try, its always the recovery that manages to have some issue. it never wants to boot into 19.1 recovery, so how come it works fine for you?
yes i have tried flashing 19.1 from 18.1 recovery, that completely breaks 19.1 and renders it practically unusable (every menu popup that wants to fade the display background literally causes the entire screen to go black) and rebooting into recovery mode from 19.1 (which is supposed to overwrite the 18.1 recovery with the 19.1 recovery) causes it to get stuck on the androidtv screen (most likely because it cant even boot into the recovery!!), effectively softbricking it and forcing me to use amlogic's tools to fix it.

what was your install process? was it the exact same as 18.1? because i tried flashing 19.1 the same way i did for 18.1 and it worked fine with 18.1
i thought all wades werent booting, but now im really really confused. mine's from amazon not from walmart, so that might be the difference, although flashing the factory walmart images worked fine and i dont think wade ever had any major changes that locked it down, especially since, as ive already mentioned, 18.1 works completely fine.
i just want 19.1 because of the omx support, since this box is basically a glorified youtube machine without it, and at that point i might aswell be using a desktop if it werent for the fact that hdcp doesnt even work right on desktops either... neither does it stop piracy :mad:
 

goapy

Senior Member
Dec 30, 2021
137
34
wait a minute, wade works on 19.1 for you?
how. why doesnt it work for me! no matter how many different things i try, its always the recovery that manages to have some issue. it never wants to boot into 19.1 recovery, so how come it works fine for you?
Yes. I was about to reply to your post just before I got started down that bootloader rabbit hole.

I was pondering what might be different about my device as compared to yours, if anything.

I have several wades (dynalinks). I'll do another, and document my steps, including the version of the firmware that I started with prior to the install. I'll let you know whether it works or not, and if it does, the exact steps I followed.
 
Last edited:

npjohnson

Recognized Developer
wait a minute, wade works on 19.1 for you?
how. why doesnt it work for me! no matter how many different things i try, its always the recovery that manages to have some issue. it never wants to boot into 19.1 recovery, so how come it works fine for you?
yes i have tried flashing 19.1 from 18.1 recovery, that completely breaks 19.1 and renders it practically unusable (every menu popup that wants to fade the display background literally causes the entire screen to go black) and rebooting into recovery mode from 19.1 (which is supposed to overwrite the 18.1 recovery with the 19.1 recovery) causes it to get stuck on the androidtv screen (most likely because it cant even boot into the recovery!!), effectively softbricking it and forcing me to use amlogic's tools to fix it.

what was your install process? was it the exact same as 18.1? because i tried flashing 19.1 the same way i did for 18.1 and it worked fine with 18.1
i thought all wades werent booting, but now im really really confused. mine's from amazon not from walmart, so that might be the difference, although flashing the factory walmart images worked fine and i dont think wade ever had any major changes that locked it down, especially since, as ive already mentioned, 18.1 works completely fine.
i just want 19.1 because of the omx support, since this box is basically a glorified youtube machine without it, and at that point i might aswell be using a desktop if it werent for the fact that hdcp doesnt even work right on desktops either... neither does it stop piracy :mad:
the black screen flash it expected at the moment - we fixed it along with hardware OMX.

Focused on shipping it officially at the moment, so haven't had time to update XDA builds.
 

RDS5

Senior Member
Yes. I was about to reply to your post just before I got started down that bootloader rabbit hole.

I was pondering what might be different about my device as compared to yours, if anything.

I have several wades (dynalinks). I'll do another, and document my steps, including the version of the firmware that I started with prior to the install. I'll let you know whether it works or not, and if it does, the exact steps I followed.
thanks! just in case our models are different, mine's a "DT-ATV36" although i highly doubt they are different. i forgot the firmware i started with before i installed, but i later flashed the walmart firmware (from the factory images provided in this post), so thats what it is for me right now.
 

RDS5

Senior Member
the black screen flash it expected at the moment - we fixed it along with hardware OMX.

Focused on shipping it officially at the moment, so haven't had time to update XDA builds.
wait, so the screen is supposed to stay black whenever popups happen? because that sorta renders the entire thing unusable, or do you mean you fixed it?
tho if your shipping it officially, its fine. theres no real need to update the XDA builds if the update we were gonna get is just going to end up as lineageos official. i get it takes a while to get things shipped officially (if im not wrong, the only thing stopping you guys is the sepolicy being incomplete), so its fine.
only thing im confused with is how others are fine, but im having so much trouble. i THINK i have the right model and everything, but in case im doing something wrong, i wanna figure that out.
anyways, i wanted to thank you and everyone else for all the great work you guys have been doing, and all the help you've provided me, and everyone else.
 

npjohnson

Recognized Developer
wait, so the screen is supposed to stay black whenever popups happen? because that sorta renders the entire thing unusable, or do you mean you fixed it?
tho if your shipping it officially, its fine. theres no real need to update the XDA builds if the update we were gonna get is just going to end up as lineageos official. i get it takes a while to get things shipped officially (if im not wrong, the only thing stopping you guys is the sepolicy being incomplete), so its fine.
only thing im confused with is how others are fine, but im having so much trouble. i THINK i have the right model and everything, but in case im doing something wrong, i wanna figure that out.
anyways, i wanted to thank you and everyone else for all the great work you guys have been doing, and all the help you've provided me, and everyone else.
yea, we fixed the black screen - just haven't pushed new builds.

And yes official ETA soon.
 

RDS5

Senior Member
yea, we fixed the black screen - just haven't pushed new builds.

And yes official ETA soon.
ohhhh ok, would it be possible for me to compile these builds myself? although im quite a noob at compiling, and if the official builds are right around the corner it sorta wouldnt be worth the trouble, i would just like to know if it is possible to build these, or if the changes havent been published yet.
 

kennkanniff

Senior Member
May 6, 2013
181
279
ohhhh ok, would it be possible for me to compile these builds myself? although im quite a noob at compiling, and if the official builds are right around the corner it sorta wouldnt be worth the trouble, i would just like to know if it is possible to build these, or if the changes havent been published yet.
Yes it is possible. Changes are there. But I decided to wait for official before building anything myself. ETA soon is great news!
 

RDS5

Senior Member
Yes it is possible. Changes are there. But I decided to wait for official before building anything myself. ETA soon is great news!
it makes sense that its coming soon tho, as he already did all the work previously, and making it official is just a matter of making the sepolicy and likely just some small code cleanup and testing here and there.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Fun fact - GXL/GXM support is incoming. VIM1/VIM2/ADT-2 to start, but people should be able to use these to bring up dev boards and china boxes with nominal effort.
    3
    Just got a dopinder from Walmart and read through all 48+ pages of this thread -- thanks everyone for all your contributions.

    Before flashing the latest 19.1 LineageOS build, is there anything I should (or shouldn't) do with the device? Should I plug it in and let it update to the latest update (if one is available, depending what build it shipped with)? Or does it really not matter one way or another if I'm going to flash LineageOS?

    Just want to make sure they didn't do something screwy like lock the bootloader and/or disable unlocking, etc.

    Thanks in advance.
    Update to newest build on stock.

    Enable ADB.

    adb reboot bootloader
    fastboot oem 'setenv lock 10101000;save'
    fastboot reboot bootloader
    fastboot flashing unlock
    fastboot flash dtb lineage-dtb.img
    fastboot flash dtbo lineage-dtbo.img
    fastboot flash recovery lineage-recovery.img
    fastboot reboot-bootloader
    fastboot boot lineage-recovery.img

    Use button to select "Factory Reset", "Wipe Data", once complete, "Apply Update", "From ADB"

    Then adb side load /path/to/lineage.zip, click reboot, profit.
    2
    Still stuck at fastboot.
    i will run a build shortly and check whats going on
    2
    Thanks. Can you share u-boot.bin for M5? I used a random one I found on the internet but the image does not flash.

    to get a working u-boot.bin for the m5 do the following:

    Code:
    git clone https://github.com/Stricted/deadpool_u-boot_build ~/deadpool_u-boot_build
    cd ~/deadpool_u-boot_build
    ./build_m5.sh
    cp uboot-bins/u-boot.bin <path to android source>/device/bananapi/m5/factory
    2
    Builds still in progress by chance? Just checked and the folder still looks empty here: https://download.ods.ninja/Android/lineage/dopinder/

    I cannot thank you enough for supporting all of these devices! Greatly appreciated!
    Yup, give it 2 days. TVs last
  • 21
    lineage-os-logo.png

    Amlogic G12*/SM1 Family Devices
    Code:
    - Your warranty is now void.
    - You have been warned.
    - Use at your own risk.

    Introduction:
    This is the Unofficial Lineage OS 19.1 thread for the Amlogic G12*/SM1 SoC family of devices.

    Downloads:
    Please follow the install instructions in your device's Wiki page linked below exactly, and make sure your device's firmware matches the required firmware listed:
    • deadpool - Google ADT-3
    • dopinder - Walmart Onn UHD Box
    • sabrina - Chromecast with Google TV - Broken at the moment - working on fixing it.
    • wade - Walmart Dynalink 4K Box
    We also support a few development boards, but at least (for now, until we have time to write up instructions), you're on your own to figure out the install process and set things up:
    If you don't follow these instructions, or use 3rd party add-ons (like Magisk) please don't expect support here.

    Known Bugs:
    • SELinux is permissive, this is only due to a lack of time to put together a decent looking sepolicy for these devices.
    • (sabrina only) The remote firmware sometimes gets hung up, you can reboot to solve this issue.
    Notes:
    • GApps are baked in - No, I will not be building without GApps included for this device. These builds are built, packaged, and signed by me, and not affiliated with LineageOS whatsoever.
    • OTA is provided the same way officials would have them.
    • Firmware is shipped in the ROM package for this device, so you'll end up on the newest version of compatible firmware after install. Please don't touch firmware partitions after install.
    FAQ:
    • Does L1 Widevine DRM break when I unlock my bootloader?

      Nope, it works fine. L1 certificates, and the mechanism that reports is all still exist and work as expected.

    • Can I haz Netflix?

      Yup, but only if your devices stock build supports it.

    • Is this Android TV or Google TV?

      Android TV, with some of the better components of Google TV.

    • Can I go back to stock and relock the bootloader?

      Yeah, grab the factory image for your device and flash it just like you would for a Pixel device, you can find the factory images here. Don't know it I'd relock though, consider that process largely untested on these device. Especially on sabrina, where you can't necessarily re-unlock should you ever want to.

    • Are these the stock codenames for these devices?

      Astute observation, no, they are not. The ADT-3 is actaully `adt3`, but earlier in production is was `deadpool`, which is much cooler. The Dynalink box internally is extremely similar to the ADT-3, so we coined it `wade` after Wade Wilson, AKA deadpool. The Onn box is in the same family, but different enough to coin it `dopinder`, after, well, go watch Deadpool the movie I guess. sabrina is actually the codename given by Google - no clue as to the reason.

    • Does it pass SafetyNet?

      Nope, SELinux is permissive, among other things. You can probably use Magisk if you really need that, but the good news is, 99% of Android TV apps don't care about SafetyNet, unlike on mobile, where a lot of them do. It will likely pass after we finish enforcing SELinux, though.

    • Does the stock remote work?

      Yup, just like it would on stock, in-remote-microphone and all! If it's an IR remote like wade's, it will even work in recovery!

    • Can we we support higher resolution than 4K, higher FPS, or HDR on non-certified screens?

      Nope.

    • I have a very similar device! Can I install these builds and use them?

      No. Please don't do that. You will brick your device, as we include firmware and bootloader images.

      If you're a developer looking to help port to a new device, contact me.

    Kernel Source: https://github.com/LineageOS/android_kernel_amlogic_linux-4.9

    Contributors:
    • npjohnson
    • stricted
    • webgeek1234
    • deadman96385
    • trautamaki
    • luca020400
    • aleasto
    • bgcngm
    13
    Yeah, you used the stock recovery. You need to fastboot flash, then fastboot boot recovery, I'll update the docs.

    For dopinder, it's needed right now.

    Found a procedure for dopinder without the need for keyboard/OTG.

    The docs under "Installing a custom recovery using fastboot" state to use "adb reboot fastboot" which doesn't work for booting recovery, needed to do "adb reboot bootloader" instead.

    Full command log (after unlocking bootloader and re-enabling USB debugging) of the install process with just a regular Micro USB to USB A cable:
    Code:
    adb reboot bootloader
    fastboot flash recovery lineage-18.1-20210805-recovery-dopinder.img
    fastboot boot lineage-18.1-20210805-recovery-dopinder.img
    adb reboot sideload
    adb sideload lineage-18.1-20210805-UNOFFICIAL-dopinder.zip
    # if successful then load bootloader and factory reset
    adb reboot bootloader
    fastboot -w
    fastboot reboot

    Successfully booted to LineageOS after this!
    6
    Note:

    Since the Lineage Android TV Builds for this little box (aka Boxes), are stable for the most part, but seems
    people are bouncing back in forth from Stock to Lineage and back to stock.

    I created a batch file that will auto flash the stock images and wipe data and so on.. pretty much it will
    make your box as it was when you first booted it after taking it home to try it.

    2nd, I also created a batch file that will backup current images.. No need for a fancy recovery or anything like the
    such. it will use the worldcup or what I like to say, USB Burn mode, and backup each and every partition.
    as well as some not so much needed ones like, misc and metadata. (Just for giggles)..

    backups will be copied to backup dir, I also created a separate batch file to restore your backup.


    I am one that hates doing things the long way over and over, so I always create ways to make things simple
    in the future for people.

    This way, you all can test your hearts out all the new lineages and still have your full Stock backup (including data).
    and restore back in forth as you wish.

    I will upload the backup_restore zip package as soon as I can and with @npjohnson permission I will link
    in thread. Otherwise you will have to just DM/PM me and ill link you the location.

    I am just trying to help the many that I seen complain and dont understand how to go back in forth.
    so with this script, it should take care of most on that. No Fancy Recovery needed...

    you will need worldcup driver for Amlogic........ you can find that on your own.

    Also, to get into USB Burn mode, press side button while plugging in USB cable.
    Keep pressing till you see the LOGO or hear the sound from your computer.

    then just run the batch file and wait..

    if its easier for you:

    Run the batch file, it will keep saying waiting for device..
    Just press the side button while plugging in USB, when you see it start, then release button...........
    and wait till finished..

    Only TESTED On Dopinder Boxes, but im sure they are all the same as for the partition layouts.
    5
    I ultimately settled on 1126400000, gives ~1.1GB to the system and accommodates the app adjustments I've been making for my builds without tripping OpenGApps' space check for TV stock
    this ended up being _wayyyyy_ to much, as this is the full value of the partition vs just the space to reserve, both will work, but we want to split it amongst partitions. One of our guys recalculated it and got it working.

    Should be good to build now from breakfast/extract-files (or syncing the muppets).

    Only thing left is hardware OMX. Hopefully we can figure it out!
    4
    It's been a month and a half since we discussed the possibility of the tablet-flavored (non-TV) release. It seems that the number of complaints has decreased and the basic quality of builds has improved enough to bother you again in this regard: are there any positive changes in this direction, or it is not worth expecting to get a full-featured Android on dopinder? (I'm still following this thread carefully to make a buying decision.)
    Eh, soon, sure.

    I'll look into making a buildable target