談?wù)労币苿影僖曂≧3300-L紅盒子如何破解

hbjmcsc · 發(fā)表于 2017-12-23 15:02

本帖最后由 hbjmcsc 于 2017-12-23 15:19 編輯

   湖北移動寬帶送的百視通R3300-L破解超級簡單，沒有任何限制條件，直接U盤插上安裝即可，開機也是當(dāng)貝桌面自動運行。但美中不足是，想修改MAC地址，但無從下手。拆機發(fā)現(xiàn)該機頂盒CPU為晶晨S905L，內(nèi)存1G+8G，TTL孔被錫堵住，電路板上也無任何標識，但我仍然把RX、TX、GND給試出來了。現(xiàn)在請教各位高手，S905L系列里面MAC地址是存儲在哪個文件里面的？之前海思3798系列，都是在deviceinfo里面。通過機頂盒關(guān)于里面輸入start adbd指令也無法開啟adb，無奈拆機通過TTL連上了，并且導(dǎo)出了部分文件，但不知道MAC地址、序列號等信息到底在哪個文件里面。
以下是/dev下面部分目錄列表：
root@p201_iptv:/dev/block/platform/d0074000.emmc # ls -l
lrwxrwxrwx root    root             2015-01-01 08:00 boot -> /dev/block/boot
lrwxrwxrwx root    root             2015-01-01 08:00 bootloader -> /dev/block/bootloader
drwxr-xr-x root    root             2015-01-01 08:00 by-num
lrwxrwxrwx root    root             2015-01-01 08:00 cache -> /dev/block/cache
lrwxrwxrwx root    root             2015-01-01 08:00 crypt -> /dev/block/crypt
lrwxrwxrwx root    root             2015-01-01 08:00 data -> /dev/block/data
lrwxrwxrwx root    root             2015-01-01 08:00 env -> /dev/block/env
lrwxrwxrwx root    root             2015-01-01 08:00 instaboot -> /dev/block/instaboot
lrwxrwxrwx root    root             2015-01-01 08:00 logo -> /dev/block/logo
lrwxrwxrwx root    root             2015-01-01 08:00 misc -> /dev/block/misc
lrwxrwxrwx root    root             2015-01-01 08:00 mmcblk0 -> /dev/block/mmcblk0
lrwxrwxrwx root    root             2015-01-01 08:00 mmcblk0boot0 -> /dev/block/mmcblk0boot0
lrwxrwxrwx root    root             2015-01-01 08:00 mmcblk0boot1 -> /dev/block/mmcblk0boot1
lrwxrwxrwx root    root             2015-01-01 08:00 mmcblk0rpmb -> /dev/block/mmcblk0rpmb
lrwxrwxrwx root    root             2015-01-01 08:00 params -> /dev/block/params
lrwxrwxrwx root    root             2015-01-01 08:00 recovery -> /dev/block/recovery
lrwxrwxrwx root    root             2015-01-01 08:00 reserved -> /dev/block/reserved
lrwxrwxrwx root    root             2015-01-01 08:00 rsv -> /dev/block/rsv
lrwxrwxrwx root    root             2015-01-01 08:00 system -> /dev/block/system
lrwxrwxrwx root    root             2015-01-01 08:00 tee -> /dev/block/tee

以下是開機顯示的全部代碼：
GXL:BL1:9ac50e:a1974b;FEAT:ADFC318C;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 159554

BL2 Built : 14:57:36, Nov  4 2016.
gxl g5990442 - xiaobo.gu@droid05

set vcck to 1070 mv
set vddee to 1070 mv
Board ID = 7, adc=541
CPU clk: 1200MHz
2layers board, use ddr_set[0]
DDR chl: Rank0+1 @ 792MHz - FAIL
DDR chl: Rank0 @ 792MHz - PASS
DQS-corr enabled
DDR scramble enabled
Rank0: 1024MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x00007400
Load bl301 from eMMC, src: 0x00018200, des: 0x01200000, size: 0x00002200
Load bl31 from eMMC, src: 0x0001c200, des: 0x10100000, size: 0x00019400
Load bl33 from eMMC, src: 0x00038200, des: 0x01000000, size: 0x00083e00
NOTICE:  BL3-1: v1.0(debug):959fdf0
NOTICE:  BL3-1: Built : 15:01:44, Dec 29 2016
aml log : bl31 normal boot !
[Image: gxl_v1.1.3088-142d621 2016-11-14 18:19:22 yun.cai@droid06]
bl30: check_permit, count is 1
bl30: check_permit: ok!
chipid: ef be ad de d f0 ad ba ef be ad de not ES chip
efuse init ops = c2
efuse init hdcp = c, cf9=7
[0.444269 Inits done]
seINFcOu:r e t aBsLk3 -s1t:a rItn!it
ializing runthiimgeh  stearvices
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9

U-Boot 2015.01-gd786353-dirty (Apr 21 2017 - 02:56:20)

DRAM:  1 GiB
Relocation Offset is: 36eef000
gpio: pin GPIODV_24 (gpio 43) value is 1
mwm 0xc8837004:[0x aa203] with [0x ea203] ok
mwm 0xc883700c:[0x 3e3b744] with [0x 3e3b764] ok
mwm 0xc8837010:[0x c0101] with [0x c8101] ok
mwm 0xc8837010:[0x c8101] with [0x  128101] ok
register usb cfg[0][1] = 0000000037f63230
[CANVAS]canvas init
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
MMC: aml_priv->desc_buf = 0x0000000033edfac0
aml_priv->desc_buf = 0x0000000033ee1de0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
mmc read lba=0x14000, blocks=0x400
   Amlogic multi-dtb tool
   Multi dtb detected
   2layers board, board id use 7
   Multi dtb tool version: v2 .
   Support 6 dtbs.
      aml_dt soc: gxl platform: p211 variant: 1g
      dtb 0 soc: gxbb plat: p201 vari: 1g
      dtb 1 soc: gxbb plat: p201 vari: 2g
      dtb 2 soc: gxl plat: p211 vari: 1g
      dtb 3 soc: gxl plat: p211 vari: 2g
      dtb 4 soc: gxl plat: p215 vari: 1g
      dtb 5 soc: gxl plat: p215 vari: 2g
   Find match dtb: 2
start dts,buffer=0000000033ee4630,dt_addr=0000000033ef5e30
parts: 12
00:    logo 0000000002000000 1
01:  recovery 0000000002000000 1
02:    rsv 0000000000800000 1
03:    tee 0000000000800000 1
04:    crypt 0000000002000000 1
05:    misc 0000000002000000 1
06: instaboot 0000000020000000 1
07:    boot 0000000002000000 1
08: system 0000000040000000 1
09:    cache 0000000020000000 2
10: params 0000000004000000 2
11:    data ffffffffffffffff 4
get_dtb_struct: Get emmc dtb OK!
overide_emmc_partition_table: overide cache
[mmc_get_partition_table] skip partition cache.
Partition table get from SPL is :
      name                      offset             size             flag
===================================================================================
0: bootloader                      0          400000                0
1: reserved                   2400000          4000000                0
2: cache                      6c00000       20000000                2
3: env                      27400000          800000                0
4: logo                      28400000          2000000                1
5: recovery                   2ac00000          2000000                1
6: rsv                      2d400000          800000                1
7: tee                      2e400000          800000                1
8: crypt                      2f400000          2000000                1
9: misc                      31c00000          2000000                1
  10: instaboot                34400000       20000000                1
  11: boot                      54c00000          2000000                1
  12: system                   57400000       40000000                1
  13: params                   97c00000          4000000                2
  14: data                      9c400000       135c00000                4
mmc read lba=0x12000, blocks=0x2
mmc read lba=0x12002, blocks=0x2
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x27400000
In: serial
Out: serial
Err: serial
board id is : 7
hpd_state=0
cvbs performance type = 7, table = 1
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
read emmc dtb
   Amlogic multi-dtb tool
   Multi dtb detected
   2layers board, board id use 7
   Multi dtb tool version: v2 .
   Support 6 dtbs.
      aml_dt soc: gxl platform: p211 variant: 1g
      dtb 0 soc: gxbb plat: p201 vari: 1g
      dtb 1 soc: gxbb plat: p201 vari: 2g
      dtb 2 soc: gxl plat: p211 vari: 1g
      dtb 3 soc: gxl plat: p211 vari: 2g
      dtb 4 soc: gxl plat: p215 vari: 1g
      dtb 5 soc: gxl plat: p215 vari: 2g
   Find match dtb: 2
Net: dwmac.c9410000
wipe_data=successfulSecd
wipe_cache=successful
bmp pixel: 16
[CANVAS]addr=0x3d800000 width=2560, height=1440
upgrade_step=2
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
rebootmode=cold_boot
Hit any key to stop autoboot:  0
ee_gate_off ...
## Booting Android Image at 0x01080000 ...
reloc_addr =33f0c190
copy done
   Amlogic multi-dtb tool
   Single dtb detected
load dtb from 0x1000000 ......
Uncompressing Kernel Image ... OK
kernel loaded at 0x01080000, end = 0x01ff2c18
Loading Ramdisk to 33c12000, end 33edc72e ... OK
Loading Device Tree to 000000001fff3000, end 000000001ffff022 ... OK
signature:
fdt_instaboot: get header err

Starting kernel ...

uboot time: 1890007 us
[ 0.000000@0] Initializing cgroup subsys cpu
[ 0.000000@0] Initializing cgroup subsys cpuacct
[ 0.000000@0] Linux version 3.14.29-g0b159cd-dirty (chaiq@ter) (gcc version 4.9.2 20140904 (prerelease) (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09) ) #1 SMP PREEMPT Mon Sep 4 23:00:19 EDT 2017
[ 0.000000@0] CPU: armv71 Processor [410fd034] revision 4
[ 0.000000@0] bootconsole [earlycon0] enabled
get_dvfs_info 0007
INFO: HDCP22 key read fail!
INFO: p1d 0
INFO: pd1 0
root@p201_iptv:/ #

請各位高手大咖們研究討論一下，我實在是沒招了，網(wǎng)上也無相關(guān)教程。文件稍微小一點的比如env、srv、tee等我都導(dǎo)出來看了，沒有發(fā)現(xiàn)MAC地址信息，params里面是一些類似日志的東西。@hao501802766

eswgdeh · 發(fā)表于 2017-12-23 15:43

http://m.81jnr2m.cn/tv-824995-1-1.html樓主看看

hbjmcsc · 發(fā)表于 2017-12-24 13:24

破解沒有問題，我現(xiàn)在主要想知道MAC地址存在什么地方，我需要修改

hao501802766 · 發(fā)表于 2017-12-26 16:57

hbjmcsc 發(fā)表于 2017-12-24 13:24
破解沒有問題，我現(xiàn)在主要想知道MAC地址存在什么地方，我需要修改

我也沒研究MAC地址之類的只能幫頂了

hbjmcsc · 發(fā)表于 2018-1-1 12:36

hao501802766 發(fā)表于 2017-12-26 16:57
我也沒研究MAC地址之類的只能幫頂了

兄弟，幫幫忙啦，有空幫忙研究一下，我主要對晶晨的CPU及對應(yīng)安卓架構(gòu)不了解

webpad · 發(fā)表于 2018-1-2 02:22

樓主你要發(fā)達

webpad · 發(fā)表于 2018-1-2 02:22

樓主你要改mac干嘛？

hbjmcsc · 發(fā)表于 2018-1-2 21:49

webpad 發(fā)表于 2018-1-2 02:22
樓主你要改mac干嘛？

一是作備用，二是學(xué)習(xí)知識唄

webpad · 發(fā)表于 2018-1-3 01:18

hbjmcsc 發(fā)表于 2018-1-2 21:49
一是作備用，二是學(xué)習(xí)知識唄

uboot終端下keyman指令；
linux終端下操作/sys/class/unifykeys/ ；
風(fēng)險自擔(dān)，磚了不管

hbjmcsc · 發(fā)表于 2018-1-4 22:28

webpad 發(fā)表于 2018-1-3 01:18
uboot終端下keyman指令；
linux終端下操作/sys/class/unifykeys/ ；
風(fēng)險自擔(dān)，磚了不管 ...

謝謝，uboot是通過TTL連接進入啦？改天試試，有問題再請教大神！

› 運營商IPTV / 有線電視 / 廣電機頂盒 › 百視通盒子

談?wù)労币苿影僖曂≧3300-L紅盒子如何破解 ...

談?wù)労币苿影僖曂≧3300-L紅盒子如何破解

相關(guān)帖子