yi-hack-Allwinner-v2
yi-hack-Allwinner-v2 copied to clipboard
roleoroleo
New unbrick procedure
Thanks to @1-Al I found a new unbrick procedure useful if your cam doesn't boot anymore. Unlike the procedure described here, it doesn't require serial connection. Let me know if you need it.
I need it, i have some bricked cameras. Would also love a copy of the y21ga firmware to try and reflash them.
Take a look here: https://github.com/roleoroleo/yi-hack-Allwinner-v2/issues/304 There is a method to overwrite a partition from the bootloader without starting the os. If you prepare a file with the right name and the right content you can unbrick the cam. Normally the brick happens because the backup partition is full and a file is truncated during a write (i.e. init.sh). If you restore the backup partition the problem is solved. To do this:
- take mtdblock4.bin from your backup
- apply a new header with this command (you need a linux os)
mkimage -A arm -O linux -T filesystem -C none -a 0x0 -e 0x0 -n "xiaoyi-backup" -d your_mtdblock4.bin backup_y21ga - copy the file backup_y21ga to the root folder of your sd card
- switch on the cam
Depending on your cam, change y21ga with your model.
@RandomItalianGuy Which partition do you need?
Thanks for the reply, however I have failed to find my backup :)
Keith
What's your model?
Committed: https://github.com/roleoroleo/yi-hack-Allwinner-v2/commit/d36146b42689f1f5226da85e7ea989b0c3e8baa5 https://github.com/roleoroleo/yi-hack-Allwinner-v2/tree/master/unbrick
@roleoroleo I wrote a Windows app to generate recovery files if you want to try Alpha version. No compiling or installing, just copy to and run from backup folder containing mtd bin files. Kernel on it's own doesn't work, idk what name to use in the header but the 'one' should cover it. If it isn't of interest please delete this message and attachment, perhaps the discussion I started too on sensor resolution. I'm surprised there's no interest in that but the lack of response does answer a question for me so not totally useless but maybe taking up unnecessary space now :)
Hello roleoroleo,
I bricked my cam a long time ago when I tried to undo the hack. 8-) I tried to solder a serial and could see boot messages but was not able to use a shell...
Now I found this new unbrick solution and tried it with my mtdblock4.bin backup. - It doesn't work.
Is it possible to flash all mtd partitios with this method? (I have a backup of all partitions)
Uwe
Yes. There is a procedure that writes the whole flash but I didn't test it (onebin). I suggest you to write one partition at a time. The supported partitions are:
| Filename | Header label |
|---|---|
| uboot_y21ga | xiaoyi-uboot |
| kernel_y21ga | unknown |
| rootfs_y21ga | xiaoyi-rootfs |
| home_y21ga | xiaoyi-home |
| backup_y21ga | xiaoyi-backup |
| env_y21ga | xiaoyi-env |
| one_y21ga.bin | xiaoyi-onebin |
I tested only backup and home. You need to change this line according to your needs: https://github.com/roleoroleo/yi-hack-Allwinner-v2/blob/4bbb5b485ae93f09a9d61de8c8854d92e192ae53/unbrick/build.sh#L30
As explained in a previous post, u-boot saves on a variable the hash of the file when writes it. It you try to write it again, u-boot ignores the file. If you have a serial connection, the log is clear.
I have changed the last bytes of mtdblock1..4 and created the corresponding xxx_y21ga files. At boot the yellow LED blinks 3 times (only at the first boot with the created files). But the camera still does not work.
Do you have a whole flash image to try? Is there any solution to catch the logs/errors without serial connection (serial connection will never work again because of damaged board).
Uwe
Do you have a whole flash image to try?
No, and I don't know how to build it. I didn't try it yet. Maybe @1-Al ?
Is there any solution to catch the logs/errors without serial connection (serial connection will never work again because of damaged board).
AFAIK no.
@roleoroleo I wrote a Windows app to generate recovery files if you want to try Alpha version. No compiling or installing, just copy to and run from backup folder containing mtd bin files. Kernel on it's own doesn't work, idk what name to use in the header but the 'one' should cover it. If it isn't of interest please delete this message and attachment, perhaps the discussion I started too on sensor resolution. I'm surprised there's no interest in that but the lack of response does answer a question for me so not totally useless but maybe taking up unnecessary space now :)
I will try your binary tomorrow. Thanks.
The onebin isn't the whole image but for allwinner-v2 the first 6 partitions. For instance y21ga v9.0.19.02_202007141512 it's uboot, kernel(boot), rootfs, home, backup and env. It excludes the mfg and conf blocks. For allwinner-v1 mkimg produces a onebin image of 5 partitions. For instance y25ga v8.3.0.0A_201912271707 it's uboot, kernel(boot), rootfs, home and env. I don't have an Allwinner v1 so don't know if it would work. Running the allwinner v2 onebin rcovery appears to work but I haven't really changed enough to be thorough and mkimg could do with some further checks on the first mtd partition such as SPL checksum, optee checksum, u-boot checksum, flattened device tree and there's even a UEFI MBR and partition table embeded at the end, all in this first mtd partition called uboot.
Secondly I have no documentation for this, mkimg makes assumptions and could easily break if the Company makes changes.
I bricked my cam a long time ago when I tried to undo the hack. 8-) I tried to solder a serial and could see boot messages but was not able to use a shell...
I tried images created with mkimg.exe but my camera seems to be dead...
- Once recovery images are flashed the data crc of them is stored and they are not flashed again unless that number is different or non-existent.
- If you have shorted your debug port then the serial data will likely be looped back and result in a 'any key press' being detected and halting the boot. Do you have any pics of the damage? Perhaps it can be cleaned up or the serial port redirected as is done on the h60ga? I don't have a y21ga camera.
I wouldn't recommend using onebin or uboot recovery except in rare circumstances as flashing uboot may break it and it has to already be working to run this recovery method. Also the env partition isn't a straight recovery but only recovers existing settings and leaves the others intact. For instance if the recovery has loglevel=8 and env has loglevel=4 then that will become loglevel=8 while if env has backup_ver=12345678 and the recovery doesn't have an entry for that then it will remain as backup_ver=12345678. Well, that's how it works for my Yi-Iot camera.
@roleoroleo I wrote a Windows app to generate recovery files if you want to try Alpha version. No compiling or installing, just copy to and run from backup folder containing mtd bin files. Kernel on it's own doesn't work, idk what name to use in the header but the 'one' should cover it. If it isn't of interest please delete this message and attachment, perhaps the discussion I started too on sensor resolution. I'm surprised there's no interest in that but the lack of response does answer a question for me so not totally useless but maybe taking up unnecessary space now :)
Tested only with mtd4. It works properly. Could I link the binary in the wiki?
Sorry for the late reply.
Couple of things, just because I can put some code together doesn't make me a programmer by a long shot, there's still some unresolved points such as extra data integrity checks and the kernel boot partition name/type.
I could give you my source code. It's in assembler x86 fasm style and then you would be free to use and make changes as you see fit, maybe even a C/C++ version?
I could give you my source code. It's in assembler x86 fasm style and then you would be free to use and make changes as you see fit, maybe even a C/C++ version?
Assembler?!? It's not for me, thanks. :) :) :)
Okay, the offer stands incase you change you mind later. There's even a Linux asm version :grinning:
The kernel recovery file is a little special. For this I modified the existing header and changed the name from "ARM OpenWrt blah blah" to "Linux", adjusted the timestamp to current time and updated the header crc. This way other options remain as is such as entry address and so on. Probably the timestamp isn't that important but I like to update it.
mkimage -l on my Linux OS chokes on this "kernel" format for some reason, size, padding? idk why.
Yes. There is a procedure that writes the whole flash but I didn't test it (onebin). I suggest you to write one partition at a time. The supported partitions are:
Filename Header label uboot_y21ga xiaoyi-uboot kernel_y21ga unknown rootfs_y21ga xiaoyi-rootfs home_y21ga xiaoyi-home backup_y21ga xiaoyi-backup env_y21ga xiaoyi-env one_y21ga.bin xiaoyi-onebin I tested only backup and home. You need to change this line according to your needs:
https://github.com/roleoroleo/yi-hack-Allwinner-v2/blob/4bbb5b485ae93f09a9d61de8c8854d92e192ae53/unbrick/build.sh#L30
As explained in a previous post, u-boot saves on a variable the hash of the file when writes it. It you try to write it again, u-boot ignores the file. If you have a serial connection, the log is clear.
Hello @roleoroleo
Iam a beginner for this all hack things etc, but i have a little different problem. I have Yi Homce Camera 3 (y25ga v8.3.0.0A_201912271707) with YI firmware and some days camera just stop working. I can not do hard reset, yellow light blinking and lens adaptations voice coming. I bought the same camera to make a successfully backup. (for the while blue light blinking).
Could you please explain more step about new header? Or maybe do you have original firmware to flash it?
y25ga is Allwinner, not Allwinner-v2. Check this wiki: https://github.com/roleoroleo/yi-hack-Allwinner/wiki/Unbrick-the-cam
Hallo ich habe die IFUSY mit YA211ga mein Backup zuvor war jedoch schon die Version 11 hat jemand ein Backup mit der Version 9 damit ich auch die Bewegungserkennung wieder in Funktion bekomme?
Hello I have the IFUSY with YA211ga my backup previously was but Version 11 has someone backup with version 9 so I can also get the movement detection back into function?
@HolgerOnGithub, there seems to be one here: https://github.com/roleoroleo/yi-hack-Allwinner-v2/issues/388#issuecomment-1062645815. However, I have not tried it myself.
@HolgerOnGithub, there seems to be one here: #388 (comment). However, I have not tried it myself.
Thanks, a not wor QFUSY Backup. i have a IFUSY Cam
I think I'm lost. How does sticking a file named "backup_y21ga" on the SD card make it restore? I tried this, and it did nothing.
