nokias

Newbie
Hello,
Since it's good to find information when we're in trouble, I decided to share my experience of doing something wrong that corrupted my bootloader and how I solved the problem, since this information will certainly help someone else! I decided to share because in the research I did only found little information, "poorly put together" and incomplete.

Due to a problem with the bootloader and/or information from other partitions that came from the factory on a number of these boxes (I have tested others that did not suffer from this problem), if I put the receiver in deep standby, it would never wake up again without being disconnected from power. Since I tend to flash some of these receivers remotely via ofgwrite rather than loading a full recovery image via usb, I tried flashing some of these partitions manually in search of resolving this issue.

One of the times I flashed the mtd0 /boot partition, for some reason it became corrupted and the box died (bricked), leaving only the white LED on and not allowing me to do absolutely anything else, including reflashing via USB. So, I got to work to solve the problem.
flash_erase /dev/mtd0 0 0 && nandwrite -pm /dev/mtd0 /tmp/fastboot.bin

The solution that seemed most obvious to me was to try to recover via serial/rs232 ttl, and these are the steps I will explain.

I used a direct USB to TTL serial interface so we immediately had the necessary GND, TX, RX, 5V connections.

TTL.jpeg

As I tend to deal with this type of thing a lot, I have several, but in this case I used a Profilic PL2303hxa, probably from Aliexpress or Ebay, which I've had for a few years. When trying to use it in Win11, I immediately had a problem with the driver where it gave me a message in the name of the interface something like "PL2303HXA. Phased out since 2012. Please contact your supplier", which for anyone who has the same problem may resolve here:

PL2303HXA. Phased out since 2012. Please contact your supplier. · Issue #1 · microsoft/farmbeatsforstudents
or
Redirecting

Then I used putty to see if I could communicate with the h8. I only used GND, RX and TX. I didn't connect the 5v as it wasn't necessary because the box is powered by its source and the Profilic interface is powered by USB, so one doesn't need to power the other.

h8_ttl.jpg

I used a baudrate of 115200,8,1,0 .

I wasn't precise on the Rx/Tx connection point because I honestly don't know which is which. When there is no communication, I exchange one with the other! The colors I used in the image match those of my TTL interface wires.
Bootrom start
Boot Media: NAND
Decrypt auxiliary code ...OK
Enter boot auxiliary code

Auxiliary code - v1.00
DDR code - V1.2.1 20160503
Build: Sep 27 2018 - 23:35:13

Reg Version: v1.1.0X
Reg Time: 2018/10/24 21:31:57
Reg Name: hi3716mv43dma_hi3716mv430_DDR3_512MB_16bitx1_2layers.reg

SVB...done!

DDR HW training...done!

DDR SW training......done!

Set cpu freq
Reg init success

Boot auxiliary code success
Bootrom success


System startup


Relocate Boot

Jump to C code

*** irq: undefined instruction

*** irq: undefined instruction

*** irq: undefined instruction

*** irq: undefined instruction

*** irq: undefined instruction

...

Then it was time to use the Hisilicon tool to flash the bootloader. Please note that you need to select the correct CPU. In this case it is the "Hi3716MV430" which was possible to confirm through the information obtained in the communication from putty!

I tried to get a relatively recent version to make sure it would already support this CPU.
I used version "HiTool-5.3.1.2", which you can download from:
HiTool-5.3.1.2-OV

After choosing the CPU, you must click on "HiBurn", choose Transfer Mode = Serial, choose the COM port assigned to your interface, choose the "Burn Fastboot" tab, flash type "spi nand/nand" and in "file" enter the "fastboot.bin" file that accompanies any full recovery image for your receiver.

HiTool2.jpg

Follow the instructions to connect power to the receiver so that it starts sending the bootloader as soon as it turns on!
You should have an output like this:

Platform Version: 5.3.12
HiBurn Version: 5.2.19
HiSilicon Technologies Co., Ltd. All rights reserved. (C) 2011-2019
Mod: Hi3716MV430


Current Serial port selection: COM6

SerialPort has been connented, Please power off, then power on the device.
If it doesn't work, please try to repower on.

Bootrom start
Boot Media: NAND
########################################################################################################## ---- 9%
########################################################################################################## ---- 19%
########################################################################################################## ---- 29%
########################################################################################################## ---- 39%
########################################################################################################## ---- 49%
########################################################################################################## ---- 59%
########################################################################################################## ---- 69%
########################################################################################################## ---- 80%
########################################################################################################## ---- 90%
######################################################################################################### ---- 100%

Decrypt auxiliary code ...OK
Enter boot auxiliary code

Auxiliary code - v1.00
DDR code - V1.2.1 20160503
Build: Sep 27 2018 - 23:35:13

Reg Version: v1.1.0X
Reg Time: 2018/10/24 21:31:57
Reg Name: hi3716mv43dma_hi3716mv430_DDR3_512MB_16bitx1_2layers.reg

SVB...done!

DDR HW training...done!

DDR SW training......done!

Set cpu freq
Reg init success

Boot auxiliary code success

Bootrom success


System startup


Relocate Boot

Jump to C code


Fastboot 3.3.0-dirty (h8@zgemma_dev) (Sep 14 2021 - 13:41:35)

Fastboot: Version 3.3.0
Build Date: Sep 14 2021, 13:42:02
CPU: Hi3716Mv430
Boot Media: NAND
DDR Size: 512MB

Found flash memory controller hifmc100.
Nand ID: 0x98 0xDC 0x90 0x26 0x76 0x16 0x08 0x00

Nand: Toshiba TC58NVG2S0HBAI4
Nand(HW-Auto): Block:256KB Page:4KB OOB:256B ECC:24bit/1k Chip:512MB*1
Using default environment
...

After the bootloader is successfully written, the equipment will restart on its own and should be working if there are no more problems. In any case, if there is still a problem with the image, from here you can do the flash/recovery process via USB again as before brick, following the usual steps.

I hope this information helps not only recover the H8, but all other equipment that can be recovered this way!

Good luck!
 
Back
Top