小米電視root需要做哪些準備工作？2024小米電視刷機詳細教程

萌萌的小確幸 · 發(fā)表于 2024-7-8 13:11

最近有不少人問我家里的小米電視root需要做哪些準備工作？哪些是作為一個新手最需要準備的，今天就給大家做一個2024小米電視刷機詳細教程。

一、小米電視root需要做哪些準備工作？2024小米電視刷機詳細教程

注意：這不是 root 電視的完整教程,，但是包含了進入電視系統(tǒng)底層的各種準備工作. 能夠進入電視系統(tǒng)底層之后, 任何有 magisk 使用經(jīng)驗的人都可以輕松實現(xiàn) root.

測試設(shè)備: 小米電視 A43 pro (L43MA-AP) (2023 年上市)

警告 (免責(zé)聲明)： 操作有風(fēng)險, 包括但不限于數(shù)據(jù)丟失, 設(shè)備損壞, 失去保修等，所以大家需要謹慎刷機。

1.來源

本文使用的各種方法并非原創(chuàng), 而是主要來自于以下幾篇文章：

(ZNDS 智能電視網(wǎng)) 教程&攻略 2022新款小米電視（安卓6以上）硬核root教程（需要USB轉(zhuǎn)TTL）

http://m.81jnr2m.cn/tv-1228229-1-1.html

(ZNDS 智能電視網(wǎng)) 教程&攻略小米電視硬核root教程（需要USB轉(zhuǎn)TTL硬件工具）

http://m.81jnr2m.cn/tv-1203308-1-1.html

2.啟用adb并安裝apk

本章所需硬件設(shè)備: 小米電視, 小米電視的遙控器, PC (臺式機或筆記本), 本地局域網(wǎng)絡(luò) (有線以太網(wǎng)或無線 WIFI)。

2.1 正常開機, 先看一下系統(tǒng)信息

進入電視設(shè)置

關(guān)于: MIUI TV 版本: MiTV OS 2.8.2129 (穩(wěn)定版)

設(shè)備信息: 屏幕參數(shù) 3840x2160 43英寸, 存儲內(nèi)存 2GB 閃存 32GB, 無線連接 2.4GHz/5GHz 藍牙, 操作系統(tǒng) Android.

存儲空間: 共 30536MB, 系統(tǒng) 4446MB.

2.2 在設(shè)置中的【關(guān)于】頁面找到產(chǎn)品型號 (MiTV):

選中產(chǎn)品型號然后連續(xù)多次點擊遙控器上的確認按鍵, 即可進入開發(fā)者模式.

2.3 在設(shè)置中的帳號與安全頁面, 將 ADB調(diào)試選項打開：

ADB 調(diào)試這個開關(guān)只有在上一步開啟開發(fā)者模式后才會出現(xiàn). 并且每次重啟之后, 這個選項都會自動關(guān)閉

2.4 通過有線以太網(wǎng)或無線 wifi 將設(shè)備聯(lián)網(wǎng), 然后看一下設(shè)備的 IP 地址 (下圖已打馬)：

比如此處設(shè)備的 IP 地址是 192.168.33.121

注意, 只需要將設(shè)備連接至本地局域網(wǎng), 能夠通過 DHCP 獲取 IP 地址即可, 無需連接互聯(lián)網(wǎng) (Internet).

2.5 在 PC (臺式機或筆記本) 上安裝 adb工具, 然后執(zhí)行命令：

> adb connect 192.168.33.121
connected to 192.168.33.121:5555
> adb devices
List of devices attached
192.168.33.121:5555 device

復(fù)制代碼

需要在電視上使用遙控器同意 adb 調(diào)試.

此時就成功通過 adb 連接到了電視！

2.6 在 PC 上使用 adb 安裝 apk, 比如

adb install aida64-v198.apk

復(fù)制代碼

重復(fù)使用這個命令, 就可以安裝多個應(yīng)用

如果安裝命令執(zhí)行成功后, 沒有顯示出應(yīng)用圖標, 可以重啟電視

3.開機進入recovery

本章所需硬件設(shè)備: 小米電視, 小米電視的遙控器

3.1 關(guān)機, 拔掉電源.

注意, 一定要拔掉電源, 僅僅關(guān)機是不夠的.

3.2 (適用于藍牙遙控器)

同時按住遙控器上的確認和返回按鍵, 如圖 (黃圈標記):

按住遙控器按鍵不松手, 插電開機。進入recovery界面如圖：

4.制作HDMI轉(zhuǎn) UART (TTL 5V) 調(diào)試線

本章所需硬件設(shè)備: HDMI 插頭 (或 HDMI 線), USB 轉(zhuǎn) UART 模塊 (推薦 CP2102), 杜邦線, 萬用表 (可選), 剪刀、螺絲刀等小工具.

在淘寶等購買 HDMI 插頭 (推薦 HDMI 免焊接插頭, 方便接線), 以及 USB 轉(zhuǎn) UART 模塊 (推薦 CP2102 型號), 照片如圖:

按照下表接線：

HDMI 引腳	CP2102 模塊	備注
14	+5V	電源
15	TXD	UART 發(fā)送
16	RXD	UART 接收
20	GND	接地

注意: 5V電源線必須連接, 如果不接則 UART 不會有輸出.

接線后照片：

小米電視root需要做哪些準備工作？2024小米電視刷機詳細教程

如果有萬用表, 可以在接線之后測量一下是否連通。

5.開機進入uboot

本章所需硬件設(shè)備: 小米電視, 章節(jié) (3) 制作的調(diào)試線, PC (臺式機或筆記本)

注意: 這臺設(shè)備的 UART 波特率為 921600 ! (之前使用 115200 一直是亂碼)

5.1 將調(diào)試線的 USB 轉(zhuǎn) UART 模塊插到 PC, 并打開 UART.

使用哪種操作系統(tǒng), 以及串口軟件都可以. 以下栗子只是多種可能之一

操作命令舉例 (操作系統(tǒng) ArchLinux)

插上 CP2102 模塊:

> lsusb
Bus 001 Device 006: ID 10c4:ea60 Silicon Labs CP210x UART Bridge
> ls -l /dev/tty*
crw-rw---- 1 root uucp 188, 0 12月26日 15:40 /dev/ttyUSB0

復(fù)制代碼

此處 CP2102 USB 轉(zhuǎn) UART 模塊出現(xiàn)為設(shè)備文件 /dev/ttyUSB0

設(shè)置波特率為921600:

> stty -F /dev/ttyUSB0 ispeed 921600 ospeed 921600
> stty -F /dev/ttyUSB0 speed
921600

復(fù)制代碼

打開 UART：

> cu -l /dev/ttyUSB0
Connected.

復(fù)制代碼

如果沒有 cu 命令, 可以安裝 uucp:

> sudo pacman -S uucp

復(fù)制代碼

5.2 將調(diào)試線的 HDMI 插頭插到電視的 HDMI 1 插座, 如圖:

正常開機狀態(tài)下, 重啟電視. 然后應(yīng)該能看到 UART 輸出的啟動日志

AOCPU unknown cmd=20
[VRTC] xMboxSetRTC val=0x64373481
T5:BL:b49668;ID:4D32583237340F0000250D01;FEAT:B0F875B4:280000;POC:F;RCY:0;EMMC:0;READ:0;0.0;0.0;CHK:0;
aml log : uart_clk_enhance() need fine tune
efuse adjust vddee vol,get efuse index value:0002
use efuse adjust vddee voltage, set vol 0.84v
bl2_stage_init 0x01
L0:00001803
L1:00000702
L2:00008060
L3:00000000
SIP:0006c6a
TE: 117954
BL2 Aarch32 Built : 15:50:08, Mar 17 2023. t5 g2df8b51 - zhiguang.zhang@droid08-bj
aml log : T5 efuse_get_sar_adc_ref() need fine tune
Board ID = 1
Set cpu clk to 24M
Set clk81 to 24M
CPU clk: 1800 MHz
Set clk81 to 166.6M
aml log : bl2_platform_setup() need fine tune
eMMC boot [url=home.php?mod=space&uid=103582]@[/url] 0
sw-hs 00000000
s
sw8 s
storage init finish
DDR debug 1 p_acs_set=fffc30f0,come here plat/t5/ddr/ddr.c ,207
aml log : not USB BOOT...
DDR_DRIVER_VERSION: AML_A_PHY_V_1_2; Built : 15:50:08, Mar 17 2023. t5 g2df8b51 - zhiguang.zhang@droid08-bj
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffc4fbc, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 0
enable_fast_boot
dram_type==DDR4
config==Rank01_32bit_ch0
DDR : DDR4 Rank01_32bit_ch0
Set ddr clk to 1176 MHz
DDR debug 1 dram_vref_reg_value=00000016 plat/t5/ddr/ddr_lib.c ,4844
CS0 size: 1024MB
CS1 size: 1024MB
Total size: 2048MB @ 1176MHz
DDR : 2048MB @1176MHz
cs0 DataBus test pass
cs1 DataBus test pass
cs0 AddrBus test pass
cs1 AddrBus test pass
bdlr_step_size ps=397
rpmb not init until <register.h> have been fixed
Load FIP HDR from eMMC, src: 0x00014200, des: 0x00200000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00018200, des: 0x00204000, size: 0x00138000, part: 0
boot BL31
NOTICE: BL31: v1.3(release):e2d6c4e91
NOTICE: BL31: Built : 15:39:27, May 20 2021
BL31:tsensor calibration rev, buf1[1], buf1[0]: 0x2, 0x80, 0xc
BL31:tsensor calibration: 0x8600000c
tsensor reg: 0x20d4
mhu init done-v2
NOTICE: BL31: T5 secure boot!
NOTICE: BL31: BL33 decompress pass
Starting IANFO: BL3-2: ATOS-V2.4.4-145-gf6c6ed9e2 #1 Wed Dec 16 12:45:54 2020 +0800 arm
INFO: BL3-2: Chip: T5 Rev: B (34:B - 10:11)
INFO: BL3-2: crypto engine DMA
INFO: BL3-2: secure time TEE
INFO: BL3-2: CONFIG_DEVICE_SECURE 0xb200000e
OCPU FreeRTOS
AOCPU image version='(no 6774b479c2e09162650601c4c33d8a1f194dd5f1 15:55:52 2023-04-04'
[AOCPU]: mailbox init start
reg idx=0 cmd=6 handler=100051da
reg idx=1 cmd=7 handler=100051c4
[AOCPU]: mailbox -v1 init end
reg idx=2 cmd=9 handler=100057ca
Starting timer ...
reg idx=3 cmd=b4 handler=10002a4e
reg idx=4 cmd=b6 handler=10002992
reg idx=5 cmd=11 handler=100017b0
reg idx=6 cmd=12 handler=100017e8
reg idx=7 cmd=4 handler=100019b6
reg idx=8 cmd=30 handler=100019a2
reg idx=9 cmd=31 handler=100019b2
Starting task scheduler ...
protect cbus registers
U-Boot 2015.01-g9fb9269-mulan_a-22 (Apr 04 2023 - 15:55:49), Build: jenkins-uboot_Mulan_A-22
DRAM: 2 GiB
Relocation Offset is: 76e45000
mmu cfg end: 0x80000000
mmu cfg end: 0x80000000
spi_post_bind(spicc): req_seq = 0
register usb cfg[0][1] = 0000000077f4dae8
gpio: pin GPIOD_2 (gpio 2) value is 0
gpio: pin GPIOD_3 (gpio 3) value is 1
gpio: pin GPIOB_12 (gpio 48) value is 0
gpio: pin GPIOB_13 (gpio 49) value is 0
MMC: aml_priv->desc_buf = 0x0000000073e35cd0
aml_priv->desc_buf = 0x0000000073e38010
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800
emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 40000000
init_part() 297: PART_TYPE_AML
[mmc_init] mmc init success
aml log : R2048 check pass!
Amlogic Multi-DTB tool
Multi DTB detected.
Multi DTB tool version: v2.
Support 2 DTBS.
ddr size = 80000000
Found DTB for "t5_mulan_01_2g"
start dts,buffer=0000000073e3a860,dt_addr=0000000073e3b060
get_partition_from_dts() 80: ret 0
parts: 19
00: logo 0000000000800000 1
01: recovery 0000000001800000 1
02: misc 0000000000800000 1
03: dtbo 0000000000800000 1
04: cri_data 0000000000800000 11
05: param 0000000001000000 2
06: boot 0000000001000000 1
set has_boot_slot = 0
07: rsv 0000000001000000 1
08: metadata 0000000001000000 1
09: vbmeta 0000000000200000 1
10: tee 0000000002000000 1
11:secure_recovery 0000000002000000 1
12:factorydata 0000000000a00000 11
13: vendor 0000000020000000 1
14: odm 0000000008000000 1
15: system 0000000060000000 1
16: product 0000000002000000 1
17: cache 0000000020000000 2
18: data ffffffffffffffff 4
init_part() 297: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x27400000
aml log : internal sys error!
reboot_mode=normal
gpio: pin GPIOD_7 (gpio 7) value is 1
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3476: calc 21656022, store 21656022
_verify_dtb_checksum()-3476: calc 21656022, store 21656022
dtb_read()-3691: total valid 2
update_old_dtb()-3672: do nothing
aml log : R2048 check pass!
Amlogic Multi-DTB tool
Multi DTB detected.
Multi DTB tool version: v2.
Support 2 DTBS.
ddr size = 80000000
Found DTB for "t5_mulan_01_2g"
amlkey_init() enter!
calc 62758a9f50c, store 62758a9f50c
calc 62758a9f50c, store 62758a9f50c
do nothing
[EFUSE_MSG]keynum is 4
co-phase 0x3, tx-dly 0, clock 40000000
co-phase 0x3, tx-dly 0, clock 40000000
co-phase 0x3, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, cmd->cmdarg=0x1aa, status=0x1ff2800
emmc/sd response timeout, cmd55, cmd->cmdarg=0x0, status=0x1ff2800
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 40000000
init_part() 297: PART_TYPE_AML
[mmc_init] mmc init success
switch to partitions #0, OK
mmc1(part 0) is current device
current model_name: dzvc_01_20
mmc env offset: 0x27400000
Writing to MMC(1)... done
D/ model: handle_lcd_phy, phy_lane_ctrl[0] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[1] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[2] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[3] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[4] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[5] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[6] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[7] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[8] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[9] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[10] is (0x37)
D/ model: handle_lcd_phy, phy_lane_ctrl[11] is (0x37)
[KM]Error:f[keymanage_dts_get_key_device]L99:lcd_optical key name is not exist
[KM]Error:f[_get_km_ops_by_name]L247:key lcd_optical not know device 5
[KM]Error:f[key_unify_query_exist]L367:key[lcd_optical] not cfg in dts
E/ UnifyKey: checkUnifyKey, lcd_optical query exist error.
E/ ini_io: check_hex_data_have_header_valid, rd data len error (0x0, 0xffffffff)
D/ model: handle_panel_ini, check lcd_optical param data diff (0xffffffff), save new param.
[KM]Error:f[keymanage_dts_get_key_device]L99:lcd_optical key name is not exist
[KM]Error:f[_get_km_ops_by_name]L247:key lcd_optical not know device 5
[KM]Error:f[key_unify_write]L278:key[lcd_optical] no cfg in dts
vpu: clk_level in dts: 7
vpu: vpu_power_on_new
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: vpp osd1 matrix rgb2yuv..............
vpp: vpp osd2 matrix rgb2yuv..............
hdr_func 4, hdr_process_select 0x1
hdr_func 1, hdr_process_select 0x1
lcd: lcd_debug_print flag: 0
lcd: detect mode: tv, key_valid: 1
lcd: load lcd_config from unifykey
lcd_phy_probe
lcd: unifykey version: 0x0002
lcd: unifykey version: 0x0002
lcd: tcon: rsv_mem addr:0x2bc00000, size:0xc00000
lcd: lcd_tcon_bin_path_update: init_load: 0
lcd: tcon: load init data len: 6356, ver: 20221009
lcd: lcd_tcon_bin_load
E/ model: handle_tcon_data_load, tcon_data[4] file name "/param/tcon_demura.bin" not exist.
lcd extern: load config from unifykey
lcd extern: add driver ext_default(0)
lcd: lcd_extern_config_update_dynamic_size size:0x2b
lcd: lcd_extern_config_update_dynamic_size size:0x0
lcd: lcd_extern_config_update_dynamic_size size:0x0
lcd extern: aml_lcd_extern_probe: index(0->0) ok
lcd: load backlight_config from unifykey
lcd: bl: unifykey version: 0x0001
lcd: bl: pinctrl_version: 2
lcd: bl: name: bl_pwm, method: 2
lcd: bl: bl_level: 127
lcd: bl: aml_bl_power_ctrl: 0
aml log : internal sys error!
s_version: U-Boot 2015.01-g9fb9269-mulan_a-22
do_factorydata_read:258 Can't find out dcdc from factorydata.
factorydata - Access the factorydata from Xiaomi Partition
Usage:
factorydata argv:
dump
read keyname
write keyname value
erase keyname
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
soc_family_id==0x00000034
table_max=0000000c,p_ddr_base_add=77f4b9c0,chip_id=00000034
table_index=00000000,p_ddr_base_add=77f4b9c0,(p_ddr_base->chip_id==00000028
no find match chip id=0x00000034, ,G12A will use default value
table_index=00000001,p_ddr_base_add=77f4ba10,(p_ddr_base->chip_id==00000029
no find match chip id=0x00000034, ,G12B will use default value
table_index=00000002,p_ddr_base_add=77f4ba60,(p_ddr_base->chip_id==0000002e
no find match chip id=0x00000034, ,TL1 will use default value
table_index=00000003,p_ddr_base_add=77f4bab0,(p_ddr_base->chip_id==0000002b
no find match chip id=0x00000034, ,SM1 will use default value
table_index=00000004,p_ddr_base_add=77f4bb00,(p_ddr_base->chip_id==0000002f
no find match chip id=0x00000034, ,TM2 will use default value
table_index=00000005,p_ddr_base_add=77f4bb50,(p_ddr_base->chip_id==0000002c
no find match chip id=0x00000034, ,A1 will use default value
table_index=00000006,p_ddr_base_add=77f4bba0,(p_ddr_base->chip_id==00000030
no find match chip id=0x00000034, ,C1 will use default value
table_index=00000007,p_ddr_base_add=77f4bbf0,(p_ddr_base->chip_id==00000033
no find match chip id=0x00000034, ,C2 will use default value
table_index=00000008,p_ddr_base_add=77f4bc40,(p_ddr_base->chip_id==00000032
no find match chip id=0x00000034, ,SC2 will use default value
table_index=00000009,p_ddr_base_add=77f4bc90,(p_ddr_base->chip_id==00000034
find match chip id=0x00000034 ,T5
uboot auto fast boot check flash data is ok return
Command: bcb uboot-command
Start read misc partition datas!
BCB hasn't any datas,exit!
pll tsensor avg: 0x20da, u_efuse: 0xc
temp1: 45
device cool done
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]set initrd_high: 0x2b400000
[OSD]fb_addr for logo: 0x2b400000
[OSD]load fb addr from dts:/meson-fb
[OSD]load fb addr from dts:/fb
[OSD]fb_addr for logo: 0x2b400000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x2b400000 width=3840, height=2160
[OSD]osd_hw.free_dst_data: 0,3839,0,2159
[OSD]osd1_update_disp_freescale_enable
vpp: vpp_matrix_update: 0
vpp: g12a/b post2(bit12) matrix: YUV limit -> RGB ..............
lcd: enable: ST4251D02_1, p2p, 3840x2160@60. 0Hz
lcd: tv driver init(ver 20221101): p2p
lcd: reset tcon
lcd: lcd_pll_wait_lock: pll_lock=1, wait_loop=1
lcd: set pll spread spectrum: 15, 30000ppm
lcd: set pll spread spectrum: freq=0, mode=0
vpp: vpp_init_lcd_gamma_table
[info]spicc_probe: amlogic,meson-g12a-spicc @00000000ffd13000
[info]spicc_cs_gpio_init: cs_gpio[0]=22
[info]spicc_cs_gpio_init: total (1) slaves
SF: Detected XM25QH80B with page size 256 Bytes, erase size 4 KiB, total 1 MiB
spi read test ok spi_read_test
lcd: error: spi read test ok
lcd: lcd_tcon_core_reg_set
lcd: error: lcd_tcon_data_set: data index -1 is invalid
lcd extern: lcd_extern_power_ctrl: ext_default(0): 1
lcd: bl: set level: 127, last level: 0
lcd: bl: aml_bl_power_ctrl: 1
lcd: clear mute
Start read misc partition datas!
info->attemp_times = 0
info->active_slot = 0
info->slot_info[0].bootable = 1
info->slot_info[0].online = 1
info->slot_info[1].bootable = 0
info->slot_info[1].online = 0
info->attemp_times = 0
attemp_times = 0
active slot = 0
[imgread]szTimeStamp[2023041122493711]
[imgread]secureKernelImgSz=0x866000
aml log : R~2048 check pass!
aml log : R2048 check pass!
aml log : R2048 check pass!
avb2: 0
ee_gate_off ...
avb2: 0
## Booting Android Image at 0x01080000 ...
Kernel command line: androidboot.dtbo_idx=0 buildvariant=user
[store]Is good fdt check header, no need decrypt!
active_slot is normal
load dtb from 0x1000000 ......
Amlogic Multi-DTB tool
Single DTB detected
find 1 dtbos
dtbos to be applied: 0
Apply dtbo 0
Loading Kernel Image(COMP_NONE) ... OK
kernel loaded at 0x01080000, end = 0x018b9000
libfdt fdt_getprop(): FDT_ERR_NOTFOUND
Loading Device Tree to 0000000009fe7000, end 0000000009fff559 ... OK
fdt_fixup_memory_banks, reg:0000000000000000
Starting kernel ...
uboot time: 3036492 us
vmin:72 b2 6 0!
[VRTC]: xMboxGetRTC val=0x64373481
[cec_get_portinfo]: info=0x0
AOCPU unknown cmd=b5

復(fù)制代碼

如果看到類似上面的輸出, 說明調(diào)試線及各種設(shè)置一切正常！

5.3 再次重啟, 同時快速連續(xù)多次按回車鍵, 直到進入 uboot 命令行

s_version: U-Boot 2015.01-g9fb9269-mulan_a-22
do_factorydata_read:258 Can't find out dcdc from factorydata.
factorydata - Access the factorydata from Xiaomi Partition
Usage:
factorydata argv:
dump
read keyname
write keyname value
erase keyname
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
mulan#
mulan#
mulan#
mulan#

復(fù)制代碼

好了, 這就進入 uboot 命令行了 ! 我們先來查看一些信息

執(zhí)行 printenv 命令:

mulan#printenv
DisableSelinux=permissive
EnableSelinux=enforcing
Irq_check_en=0
Ramoops_io_dump=0
Ramoops_io_en=0
Ramoops_io_skip=1
assm_mn=DZVCARF3B18TXNXX02321
assm_sn=48276106100061401
baudrate=115200
bl_level=127
boot_part=boot
bootargs=init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 logo=osd0,loaded,0x3d800000 powermode=on fb_width=1920 fb_height=1080 display_bpp=16 outputmode=2160p60hz vout=2160p60hz,enable panel_type= lcd_ctrl=0x00001185 osd_reverse=n video_reverse=0 androidboot.firstboot=0 jtag=disable irq_check_en=0 ramoops_io_en=0 ramoops_io_dump=0 ramoops_io_skip=1 androidboot.mi.panel_size=43 bl_level=127 androidboot.mi.panel_vendor=csot androidboot.mi.panel_resolution=3840x2160 androidboot.panel_type=20 androidboot.reboot_mode=normal androidboot.platform_id=1180 androidboot.model_name=dzvc_01_20 androidboot.redmi=false androidboot.hwid=01 androidboot.serialno=48276106100061401 androidboot.mac=78:53:33:10:dd:a5 androidboot.assm_mn=DZVCARF3B18TXNXX02321 androidboot.did_key=00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O loglevel=0 androidboot.console_enable=0 androidboot.hardware=amlogic androidboot.bootloader=U-Boot 2015.01-g9fb9269-mulan_a-22 androidboot.build.expect.baseband=N/A androidboot.provider=amlogic androidboot.watchdog=enabled androidboot.mi.panel_buildin=true androidboot.mi.panel_3d_attribut=0 androidboot.mi.cpu=Cortex-A35 androidboot.mi.gpu=Mali-G31
bootcmd=ddr_auto_fast_boot_check 6; run switch_bootmode
bootdelay=1
bootloader_version=U-Boot 2015.01-g9fb9269-mulan_a-22
cec_ac_wakeup=1
cec_fun=0x2F
cmdline_keys=if factorydata read assm_sn; then setenv bootargs ${bootargs} androidboot.serialno=${assm_sn};else setenv bootargs ${bootargs} androidboot.serialno=1234567890;fi;if factorydata read mac; then setenv bootargs ${bootargs} androidboot.mac=${mac};fi;if factorydata read assm_mn; then setenv bootargs ${bootargs} androidboot.assm_mn=${assm_mn};fi;if factorydata read did_key; then setenv bootargs ${bootargs} androidboot.did_key=${did_key};fi;if factorydata read dcdc; then setenv bootargs ${bootargs} androidboot.dcdc=${dcdc};fi;if factorydata read log_level; then setenv bootargs ${bootargs} loglevel=${log_level};else setenv bootargs ${bootargs} quiet;fi;if factorydata read console_enable; then setenv bootargs ${bootargs} androidboot.console_enable=${console_enable};if itest ${console_enable} != 0; then setenv bootargs ${bootargs} ${console_userdebug};fi;else setenv bootargs ${bootargs} ${console_userdebug};fi;if factorydata read mitv_screen_on; then if test ${mitv_screen_on} = false; then factorydata write mitv_screen_on 'true';else factorydata write mitv_screen_on 'true';setenv mitv_screen_on true;fi;else factorydata write mitv_screen_on 'true';setenv mitv_screen_on true;fi;
console_enable=0
console_userdebug=console=ttyS0,921600 no_console_suspend earlycon=aml-uart,0xffd23000 printk.devkmsg=on
did_key=00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O
display_bpp=16
display_color_bg=0
display_color_fg=0xffff
display_color_index=16
display_height=1080
display_layer=osd0
display_width=1920
dtb_mem_addr=0x1000000
edid_14_dir=/odm/etc/tvconfig/hdmi/port_14.bin
edid_20_dir=/odm/etc/tvconfig/hdmi/port_20.bin
edid_select=0
factory_reset_poweroff_protect=if test ${wipe_data} = failed; then echo wipe_data=${wipe_data};run update;fi;if test ${wipe_cache} = failed; then echo wipe_cache=${wipe_cache};run update;fi;
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
ffv_freeze=off
ffv_wake=off
firstboot=0
frac_rate_policy=1
fs_type=root=/dev/mmcblk0p20 ro rootwait skip_initramfs
hdmimode=2160p60hz
hdr_policy=1
hwid=01
init_display=osd open;osd clear;if test ${redmi} = true; then imgread pic logo redmi ${loadaddr};bmp display ${redmi_offset};else imgread pic logo bootup ${loadaddr};bmp display ${bootup_offset};fi;bmp scale;vout output ${outputmode}
initargs=init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000
irremote_update=if irkey 2500000 0xe31cfb04 0xb748fb04; then echo read irkey ok!; if itest ${irkey_value} == 0xe31cfb04; then run update;fi;fi;
jtag=disable
lcd_ctrl=0x00001185
lcd_init_level=0
led_brightness=0xff
loadaddr=1080000
lock=10101000
log_level=0
logic_addr=0x0
mac=78:53:33:10:dd:a5
mitv_screen_on=true
model_edid=/odm/etc/tvconfig/hdmi/port_14.bin
model_name=dzvc_01_20
model_panel=/odm/panel/CSOT_ST4251D02-1/p2p_cspi_cvte.ini
model_tcon=/odm/panel/CSOT_ST4251D02-1/p2p_cspi.bin
model_tcon_bin_header=1
model_tcon_ext_b0=null
model_tcon_ext_b0_spi=/param/tcon_p_gamma.bin
model_tcon_ext_b1=null
model_tcon_ext_b1_spi=null
model_tcon_ext_b2=null
model_tcon_ext_b2_spi=null
model_tcon_ext_b3=null
model_tcon_ext_b3_spi=null
osd_reverse=n
otg_device=0
outputmode=2160p60hz
panel_name=ST4251D02_1
panel_resolution=3840x2160
panel_reverse=0
panel_size=43
panel_vendor=csot
platform_id=1180
port_map=4312
powermode=on
preboot=run storeargs;
ramdump_enable=1
reboot_mode=normal
recovery_from_flash=if itest ${upgrade_step} == 3; then if ext4load mmc 1:2 ${dtb_mem_addr} /recovery/dtb.img; then echo cache dtb.img loaded; fi;if ext4load mmc 1:2 ${loadaddr} /recovery/recovery.img; then echo cache recovery.img loaded; bootm ${loadaddr}; fi;fi;if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then bootm ${loadaddr}; fi;
recovery_from_udisk=if fatload usb 0 ${loadaddr} mulan.autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} mulan.recovery; then if fatload usb 0 ${dtb_mem_addr} mulan.dtb; then echo udisk dtb loaded; fi;bootm ${loadaddr};fi;
recovery_fs_type=root=ramfs
recovery_offset=0
recovery_part=recovery
redmi=false
sdr2hdr=0
secureboot=setenv bootargs ${bootargs} ${recovery_fs_type} otg_device=0;run init_display;get_valid_slot;if imgread kernel secure_recovery ${loadaddr} 0; then bootm ${loadaddr}; fi;reboot;
stderr=serial
stdin=serial
stdout=serial
storeargs=get_rebootmode;get_bootloaderversion;setenv bootargs ${initargs} logo=${display_layer},loaded,${fb_addr} powermode=${powermode} fb_width=${fb_width} fb_height=${fb_height} display_bpp=${display_bpp} outputmode=${outputmode} vout=${outputmode},enable panel_type=${panel_type} lcd_ctrl=${lcd_ctrl} osd_reverse=${osd_reverse} video_reverse=${video_reverse} androidboot.firstboot=${firstboot} jtag=${jtag} irq_check_en=${Irq_check_en} ramoops_io_en=${Ramoops_io_en} ramoops_io_dump=${Ramoops_io_dump} ramoops_io_skip=${Ramoops_io_skip};setenv bootargs ${bootargs} androidboot.mi.panel_size=${panel_size} bl_level=${bl_level} androidboot.mi.panel_vendor=${panel_vendor} androidboot.mi.panel_resolution=${panel_resolution} androidboot.panel_type=${tag};setenv bootargs ${bootargs} androidboot.reboot_mode=${reboot_mode} androidboot.platform_id=${platform_id} androidboot.model_name=${model_name} androidboot.redmi=${redmi} androidboot.hwid=${hwid};run cmdline_keys;setenv bootargs ${bootargs} androidboot.hardware=amlogic androidboot.bootloader=${bootloader_version} androidboot.build.expect.baseband=N/A;setenv bootargs ${bootargs} androidboot.provider=amlogic androidboot.watchdog=enabled androidboot.mi.panel_buildin=true androidboot.mi.panel_3d_attribut=0 androidboot.mi.cpu=Cortex-A35 androidboot.mi.gpu=Mali-G31;
suspend=shutdown
switch_bootmode=bcb uboot-command;run factory_reset_poweroff_protect;run upgrade_check;if test ${reboot_mode} = cold_boot; then if adcdetect; then echo GOT secure_recovery key from ADC;run secureboot;fi;if irdetect; then echo GOT recovery key from IR;run update;fi;if monitor_bt_cmdline; then echo GOT recovery key from BT;run update;fi;if factorydata read factory_power_mode; then echo Factory power mode: ${factory_power_mode};if test ${factory_power_mode} = secondary;then systemoff;fi;fi;else boot_cooling;if test ${reboot_mode} = fastboot; then fastboot;else if test ${reboot_mode} = update; then setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;run recovery_from_flash;else if test ${reboot_mode} = watchdog_reboot; then if test ${mitv_screen_on} = false; then monitor_bt_cmdline;echo watchdog enter system off;systemoff;fi;else if test ${reboot_mode} = kernel_panic; then if test ${mitv_screen_on} = false; then monitor_bt_cmdline;echo kernel_panic enter system off;systemoff;fi;else if test ${reboot_mode} = factory_reset; then setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;run recovery_from_flash;fi; fi; fi; fi; fi; fi;run init_display;setenv bootargs ${bootargs} ${fs_type} androidboot.selinux=${EnableSelinux} otg_device=${otg_device} androidboot.led_brightness=${led_brightness};get_valid_slot;if imgread kernel boot ${loadaddr}; then bootm ${loadaddr}; fi;run storeargs;setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run recovery_from_flash;
tag=20
update=setenv bootargs ${bootargs} ${recovery_fs_type} aml_dt=${aml_dt} recovery_part=${recovery_part} recovery_offset=${recovery_offset} androidboot.selinux=${DisableSelinux} otg_device=0;run init_display;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=if itest ${upgrade_step} == 3; then echo upgrade_step=${upgrade_step}; run update;fi;
upgrade_step=0
video_reverse=0
wipe_cache=successful
wipe_data=successful
Environment size: 9759/65532 bytes
mulan#

復(fù)制代碼

uboot 命令行幫助信息

mulan#help
? - alias for 'help'
adcdetect- Detect ADC Key to start secure recovery system
adnl - use Amlogic DNL protocol
aml_bcb - aml_bcb
aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
amlmmc - AMLMMC sub system
autoscr - run script from memory
avb - avb
base - print or set address offset
bcb - bcb
bmp - manipulate BMP image data
boot_cooling- cpu temp-system
booti - boot arm64 Linux Image image from memory
bootm - boot application image from memory
cec - Amlogic cec
clkmsr - Amlogic measure clock
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
ddr_auto_fast_boot_check- ddr_fastboot_config cmd arg1 arg2 arg3...
ddr_auto_scan_drv- ddr_test_cmd cmd arg1 arg2 arg3...
ddr_auto_test_window- ddr_test_cmd cmd arg1 arg2 arg3...
ddr_cpu_test- ddr_test_cmd cmd arg1 arg2 arg3...
ddr_fast_boot- ddr_fastboot_config cmd arg1 arg2 arg3...
ddr_g12_offset_data- ddr_g12_offset_data 1 0 0 0 1 3
ddr_g12_override_data- ddr_g12_override_data 1 0 0 0 1 3
ddr_spec_test- DDR test function
ddr_test_cmd- ddr_test_cmd cmd arg1 arg2 arg3...
ddr_test_copy- ddr_test_copy function
ddrtest - DDR test function
defenv_reserv- reserve some specified envs after defaulting env
dspjtagreset- excute dsp jtag rest
dtimg - manipulate dtb/dtbo Android image
echo - echo args to console
efuse - efuse commands
efuse_user- efuse user space read write ops
emmc - EMMC sub system
env - environment handling commands
exit - exit script
ext4load- load binary file from a Ext4 filesystem
ext4ls - list files in a directory (default /)
ext4size- determine a file's size
factorydata- Access the factorydata from Xiaomi Partition
false - do nothing, unsuccessfully
fastboot- use USB Fastboot protocol
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
fatsize - determine a file's size
fdt - flattened device tree utility commands
forceupdate- forceupdate
g12_d2pll- g12_d2pll 1300 1 0x10 0
get_avb_mode- get_avb_mode
get_bootloaderversion- print bootloader version
get_nearly_model- find the nearly model name
get_rebootmode- get reboot mode
get_system_as_root_mode- get_system_as_root_mode
get_valid_slot- get_valid_slot
go - start application at address 'addr'
gpio - query and control gpio pins
gpt - GUID Partition Table
guid - GUID - generate Globally Unique Identifier based on random UUID
hdmirx - hdmirx init function
help - print command description/usage
i2c - I2C sub-system
icache - enable or disable instruction cache
img_osd - image osd sub-system
imgread - Read the image from internal flash with actual size
ini - parse an ini file in memory and merge the specified section into the env
ini_model- parse ini file by env model_name
init_vpp- Initial VPP Module
irdetect- Detect IR Key to start recovery system
itest - return true/false on integer compare
jtagoff - disable jtag
jtagon - enable jtag
keyman - Unify key ops interfaces based dts cfg
keyunify- key unify sub-system
lcd - lcd sub-system
loadb - load binary file over serial line (kermit mode)
loadx - load binary file over serial line (xmodem mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
model_list- list ini model name
monitor_bt_cmdline- monitor_bt_cmdline
mw - memory write (fill)
mwm - mw mask function
nm - memory modify (constant address)
open_scp_log- print SCP messgage
osd - osd sub-system
panel_detect- Detect panel type from GPIO pin configuration
printenv- print environment variables
query - SoC query commands
rdext4pic- read logo bmp from ext4 part
readMetadata- readMetadata
read_temp- cpu temp-system
reboot - set reboot mode and reboot system
reset - Perform RESET of the CPU
ringmsr - Amlogic measure ring
rpmb_state- RPMB sub-system
rsvmem - reserve memory
run - run commands in an environment variable
saradc - saradc sub-system
saradc_12bit- saradc sub-system
saveenv - save environment variables to persistent storage
sdc_burn- Burning with amlogic format package in sdmmc
sdc_update- Burning a partition with image file in sdmmc card
set_active_slot- set_active_slot
set_trim_base- cpu temp-system
set_usb_boot- set usb boot mode
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
spi_read_test- read spi
sspi - SPI utility command
startdsp- load dspboot.bin from address
store - STORE sub-system
systemoff- system off
tee_log_level- update tee log level
temp_triming- cpu temp-system
test - minimal test like /bin/sh
testcache- cache test
testsmp - test each CPU power on/off
true - do nothing, successfully
unpackimg- un pack logo image into pictures
usb - USB sub-system
usb_burn- Burning with amlogic format package in usb
usb_update- Burning a partition with image file in usb host
usbboot - boot from USB device
uuid - UUID - generate random Universally Unique Identifier
version - print monitor, compiler and linker version
viu_probe- enable viu probe in no secure chip
vout - VOUT sub-system
vout2 - VOUT2 sub-system
vpp - vpp sub-system
vpu - vpu sub-system
write_trim- cpu temp-system
write_version- cpu temp-system
mulan#

復(fù)制代碼

分區(qū)信息

mulan#mmcinfo
Device: SDIO Port C
Manufacturer ID: 9b
OEM: 100
Name: Y2P03
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.1
High Capacity: Yes
Capacity: (0x747c00000 Bytes) 29.1 GiB
mmc clock: 40000000
Bus Width: 8-bit
mulan#mmc part
Partition Map for MMC device 1 -- Partition Type: AML
Part Start Sect x Size Type name
00 0 8192 512 U-Boot bootloader
01 73728 131072 512 U-Boot reserved
02 221184 1048576 512 U-Boot cache
03 1286144 16384 512 U-Boot env
04 1318912 16384 512 U-Boot logo
05 1351680 49152 512 U-Boot recovery
06 1417216 16384 512 U-Boot misc
07 1449984 16384 512 U-Boot dtbo
08 1482752 16384 512 U-Boot cri_data
09 1515520 32768 512 U-Boot param
10 1564672 32768 512 U-Boot boot
11 1613824 32768 512 U-Boot rsv
12 1662976 32768 512 U-Boot metadata
13 1712128 4096 512 U-Boot vbmeta
14 1732608 65536 512 U-Boot tee
15 1814528 65536 512 U-Boot secure_recovery
16 1896448 20480 512 U-Boot factorydata
17 1933312 1048576 512 U-Boot vendor
18 2998272 262144 512 U-Boot odm
19 3276800 3145728 512 U-Boot system
20 6438912 65536 512 U-Boot product
21 6520832 54550528 512 U-Boot data
** Partition 22 not found on device 1 **
mulan#

復(fù)制代碼

重啟設(shè)備：

mulan#reset
resetting ...

復(fù)制代碼

6. 進入 recovery 命令行
本章所需硬件設(shè)備: 小米電視, 小米電視的遙控器, 章節(jié) (3) 制作的調(diào)試線, PC (臺式機或筆記本)

6.1 按照章節(jié) (5) 的方法進入 uboot 命令行

工廠數(shù)據(jù)

mulan#factorydata
factorydata - Access the factorydata from Xiaomi Partition
Usage:
factorydata argv:
dump
read keyname
write keyname value
erase keyname
mulan#factorydata dump
do_factorydata_dump : Got factory_power_mode[18] is [9]secondary
do_factorydata_dump : Got console_enable[14] is [1]0
do_factorydata_dump : Got pcba_mn[7] is [21]DZVCBCP3A12XXNXF00793
do_factorydata_dump : Got pcba_sn[7] is [21]DZVCBCP3A12XXNXF00793
do_factorydata_dump : Got assm_sn[7] is [17]48276106100061401
do_factorydata_dump : Got mac[3] is [17]78:53:33:10:dd:a5
do_factorydata_dump : Got did_key[7] is [39]00CB00073C3B|754663978|k5sBrXtwBJ6BLv5O
do_factorydata_dump : Got assm_mn[7] is [21]DZVCARF3B18TXNXX02321
do_factorydata_dump : Got bt_rc_mac[9] is [18]F4:22:7A:63:AE:6D;
do_factorydata_dump : Got log_level[9] is [1]0
do_factorydata_dump : Got mitv_screen_on[14] is [4]true
do_factorydata_dump : Got miot_beacon_pdu[15] is [38]0201060FFF8F030A10070F00ACE90FE18040E0
mulan#

復(fù)制代碼

6.2 啟用 console:

mulan#factorydata write console_enable 1

復(fù)制代碼

6.3 按照章節(jié) (3) 的方法進入 recovery

Starting kernel ...
uboot time: 10638025 us
vmin:72 b2 6 0!
[VRTC]: xMboxGetRTC val=0x0
[cec_get_portinfo]: info=0x0
AOCPU unknown cmd=b5
#

復(fù)制代碼

好了, 我們進入 recovery 命令行了 ! 看一下基本信息

# type busybox
busybox is /sbin/busybox
# busybox id
uid=0(root) gid=0(root) context=u:r:shell:s0
# busybox getenforce
Permissive
# busybox uname -a
Linux localhost 4.9.113 #1 SMP PREEMPT Tue Apr 11 22:37:53 CST 2023 armv7l GNU/Linux
#

復(fù)制代碼

好, 我們是 root, 并且 SELinux 處于關(guān)閉狀態(tài), 可以為所欲為了！

根目錄：

# busybox ls -al /
total 2080
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
drwxr-xr-x 27 root root 0 Jan 1 00:00 .
drwxr-xr-x 27 root root 0 Jan 1 00:00 ..
dr-xr-xr-x 4 root root 0 Jan 1 00:00 acct
lrwxrwxrwx 1 root root 11 Jan 1 1970 bin -> /system/bin
drwxr-xr-x 2 root root 0 Jan 1 1970 boot
lrwxrwxrwx 1 root root 50 Jan 1 1970 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx--- 6 system cache 4096 Jan 1 00:03 cache
lrwxrwxrwx 1 root root 13 Jan 1 1970 charger -> /sbin/charger
drwxr-xr-x 4 root root 0 Jan 1 1970 config
lrwxrwxrwx 1 root root 17 Jan 1 1970 d -> /sys/kernel/debug
drwxr-xr-x 2 root root 0 Jan 1 1970 data
lrwxrwxrwx 1 root root 12 Jan 1 1970 default.prop -> prop.default
drwxr-xr-x 12 root root 5320 Jan 1 00:00 dev
drwxr-xr-x 2 root root 0 Jan 1 1970 etc
-rwxr-x--- 1 root root 1500384 Jan 1 1970 init
-rwxr-x--- 1 root root 2842 Jan 1 1970 init.rc
-rwxr-x--- 1 root root 14915 Jan 1 1970 init.recovery.amlogic.rc
drwxr-xr-x 2 root root 0 Jan 1 1970 metadata
drwxr-xr-x 3 root system 60 Jan 1 00:00 mnt
drwxr-xr-x 2 root root 0 Jan 1 1970 odm
drwxr-xr-x 2 root root 0 Jan 1 1970 oem
drwxr-xr-x 3 root root 0 Jan 1 1970 persist
-rw-r--r-- 1 root root 24584 Jan 1 1970 plat_file_contexts
-rw-r--r-- 1 root root 28976 Jan 1 1970 plat_property_contexts
dr-xr-xr-x 137 root root 0 Jan 1 1970 proc
drwxr-xr-x 2 root root 0 Jan 1 1970 product
-rw-r--r-- 1 root root 6676 Jan 1 1970 prop.default
drwxr-xr-x 3 root root 0 Jan 1 1970 res
drwx------ 2 root root 0 Apr 11 2023 root
drwxr-x--- 2 root root 0 Jan 1 1970 sbin
drwxr-xr-x 2 root root 0 Jan 1 1970 sdcard
-rw-r--r-- 1 root root 472377 Jan 1 1970 sepolicy
drwxr-xr-x 2 root root 0 Jan 1 00:00 sideload
drwxr-x--x 2 root root 0 Jan 1 1970 storage
dr-xr-xr-x 12 root root 0 Jan 1 00:00 sys
lrwxr-xr-x 1 root root 19 Jan 1 1970 system -> /system_root/system
drwxr-xr-x 2 root root 0 Jan 1 1970 system_root
drwxrwxr-x 2 root shell 80 Jan 1 00:00 tmp
drwx------ 3 root root 8192 Jan 1 1970 udisk
-rw-r--r-- 1 root root 5272 Jan 1 1970 ueventd.rc
drwxr-xr-x 5 root root 0 Jan 1 1970 vendor
-rw-r--r-- 1 root root 28202 Jan 1 1970 vendor_file_contexts
-rw-r--r-- 1 root root 4146 Jan 1 1970 vendor_property_contexts
#

復(fù)制代碼

7.在 uboot 下備份各個系統(tǒng)分區(qū)

本章所需硬件設(shè)備: 小米電視, 章節(jié) (3) 制作的調(diào)試線, PC (臺式機或筆記本), U 盤 (1 個, 格式化為 FAT32 文件系統(tǒng), 容量 8GB 以上)

8.在 recovery下備份各個系統(tǒng)分區(qū)

本章所需硬件設(shè)備: 小米電視, 小米電視的遙控器, 章節(jié) (3) 制作的調(diào)試線, PC (臺式機或筆記本), U 盤 (1 個, 格式化為 FAT32 文件系統(tǒng), 容量 8GB 以上).

8.1 插入 U 盤 (FAT32 格式), 然后進入 recovery

看一下分區(qū)

# busybox ls -al /dev/block
total 0
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
drwxr-xr-x 3 root root 820 Jan 1 00:00 .
drwxr-xr-x 12 root root 5320 Jan 1 00:00 ..
brw------- 1 root root 179, 11 Jan 1 00:00 boot
brw------- 1 root root 179, 1 Jan 1 00:00 bootloader
brw------- 1 root root 179, 3 Jan 1 00:00 cache
brw------- 1 root root 179, 9 Jan 1 00:00 cri_data
brw------- 1 root root 179, 22 Jan 1 00:00 data
brw------- 1 root root 179, 8 Jan 1 00:00 dtbo
brw------- 1 root root 179, 4 Jan 1 00:00 env
brw------- 1 root root 179, 17 Jan 1 00:00 factorydata
brw------- 1 root root 179, 5 Jan 1 00:00 logo
brw------- 1 root root 7, 0 Jan 1 00:00 loop0
brw------- 1 root root 7, 8 Jan 1 00:00 loop1
brw------- 1 root root 7, 16 Jan 1 00:00 loop2
brw------- 1 root root 7, 24 Jan 1 00:00 loop3
brw------- 1 root root 7, 32 Jan 1 00:00 loop4
brw------- 1 root root 7, 40 Jan 1 00:00 loop5
brw------- 1 root root 7, 48 Jan 1 00:00 loop6
brw------- 1 root root 7, 56 Jan 1 00:00 loop7
brw------- 1 root root 179, 13 Jan 1 00:00 metadata
brw------- 1 root root 179, 7 Jan 1 00:00 misc
brw------- 1 root root 179, 0 Jan 1 00:00 mmcblk0
brw------- 1 root root 179, 32 Jan 1 00:00 mmcblk0boot0
brw------- 1 root root 179, 64 Jan 1 00:00 mmcblk0boot1
brw------- 1 root root 179, 96 Jan 1 00:00 mmcblk0rpmb
brw------- 1 root root 31, 0 Jan 1 00:00 mtdblock0
brw------- 1 root root 179, 19 Jan 1 00:00 odm
brw------- 1 root root 179, 10 Jan 1 00:00 param
drwxr-xr-x 5 root root 100 Jan 1 00:00 platform
brw------- 1 root root 179, 21 Jan 1 00:00 product
brw------- 1 root root 179, 6 Jan 1 00:00 recovery
brw------- 1 root root 179, 2 Jan 1 00:00 reserved
brw------- 1 root root 179, 12 Jan 1 00:00 rsv
brw------- 1 root root 8, 0 Jan 1 00:00 sda
brw------- 1 root root 8, 1 Jan 1 00:00 sda1
brw------- 1 root root 179, 16 Jan 1 00:00 secure_recovery
brw------- 1 root root 179, 20 Jan 1 00:00 system
brw------- 1 root root 179, 15 Jan 1 00:00 tee
brw------- 1 root root 179, 14 Jan 1 00:00 vbmeta
brw------- 1 root root 179, 18 Jan 1 00:00 vendor
brw------- 1 root root 254, 0 Jan 1 00:00 zram0

復(fù)制代碼

掛載狀態(tài)

# busybox mount
rootfs on / type rootfs (rw,seclabel)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000)
none on /acct type cgroup (rw,relatime,cpuacct)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
none on /config type configfs (rw,relatime)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
/dev/block/sda1 on /udisk type vfat (rw,nodev,noatime,nodiratime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/block/cache on /cache type ext4 (rw,seclabel,nodev,noatime,nodiratime,discard,data=ordered)
# busybox ls -al /udisk
total 16
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
drwx------ 3 root root 8192 Jan 1 1970 .
drwxr-xr-x 27 root root 0 Jan 1 00:00 ..
drwx------ 2 root root 8192 Dec 26 2023 202312
#

復(fù)制代碼

recovery 已經(jīng)自動將 U盤掛載到了 /udisk 目錄

8.2 備份除了 data (用戶數(shù)據(jù)) 外的所有分區(qū)

# busybox dd if=/dev/block/boot of=/udisk/boot.img
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 0.417935 seconds, 38.3MB/s
#

復(fù)制代碼

重復(fù)使用 dd 命令, 具體需要備份的分區(qū)可以參考以下列表:

# busybox ls -al /udisk
total 3072016
__bionic_open_tzdata: couldn't find any tzdata when looking for localtime!
__bionic_open_tzdata: couldn't find any tzdata when looking for GMT!
__bionic_open_tzdata: couldn't find any tzdata when looking for posixrules!
drwx------ 3 root root 8192 Jan 1 00:21 .
drwxr-xr-x 27 root root 0 Jan 1 00:00 ..
drwx------ 2 root root 8192 Dec 26 2023 202312
-rwx------ 1 root root 16777216 Jan 1 00:05 boot.img
-rwx------ 1 root root 4194304 Jan 1 00:06 bootloader.img
-rwx------ 1 root root 536870912 Jan 1 00:13 cache.img
-rwx------ 1 root root 8388608 Jan 1 00:16 cri_data.img
-rwx------ 1 root root 8388608 Jan 1 00:17 dtbo.img
-rwx------ 1 root root 8388608 Jan 1 00:17 env.img
-rwx------ 1 root root 10485760 Jan 1 00:18 factorydata.img
-rwx------ 1 root root 8388608 Jan 1 00:20 logo.img
-rwx------ 1 root root 16777216 Jan 1 00:18 metadata.img
-rwx------ 1 root root 8388608 Jan 1 00:20 misc.img
-rwx------ 1 root root 4194304 Jan 1 00:12 mmcblk0boot0.img
-rwx------ 1 root root 4194304 Jan 1 00:12 mmcblk0boot1.img
-rwx------ 1 root root 134217728 Jan 1 00:16 odm.img
-rwx------ 1 root root 16777216 Jan 1 00:17 param.img
-rwx------ 1 root root 33554432 Jan 1 00:19 product.img
-rwx------ 1 root root 25165824 Jan 1 00:21 recovery.img
-rwx------ 1 root root 67108864 Jan 1 00:21 reserved.img
-rwx------ 1 root root 16777216 Jan 1 00:12 rsv.img
-rwx------ 1 root root 33554432 Jan 1 00:16 secure_recovery.img
-rwx------ 1 root root 1610612736 Jan 1 00:24 system.img
-rwx------ 1 root root 33554432 Jan 1 00:17 tee.img
-rwx------ 1 root root 2097152 Jan 1 00:18 vbmeta.img
-rwx------ 1 root root 536870912 Jan 1 00:20 vendor.img
#

復(fù)制代碼

8.3 重啟設(shè)備, 拔出 U 盤

然后把上述獲得的分區(qū)鏡像文件, 打包壓縮一下, 找個安全的地方備份起來 (建議上傳網(wǎng)盤), 以后對于救磚有重要用途

上述整個操作過程中獲得的各種信息 (UART 輸出), 也建議保存?zhèn)溆?br />
以上就是我對”小米電視root需要做哪些準備工作？2024小米電視刷機詳細教程”的內(nèi)容分享，如果還有其他問題可以在評論區(qū)留言。

相關(guān)閱讀：
海信電視如何精簡系統(tǒng)？海信電視刷機簡化系統(tǒng)操作教程

1235qwerfgk · 發(fā)表于 2024-7-8 13:13

來看看這個

NRD90M · 發(fā)表于 2024-8-5 09:22

小米電視大師77寸oled，按住確認和返回命令行提示no recovery mod，adb重啟到recovery無法輸入，沒有#

yhyzhj · 發(fā)表于 2024-8-6 18:13

要膽大心細

隨便就看見了 · 發(fā)表于 2024-8-12 10:57

好貼，雖然我看不懂

yuan185 · 發(fā)表于 2024-9-20 12:06

那請問怎么 root 呢用busybox DD命令提取的BOOT.IMG去修補，修補完了之后刷進去之后不進系統(tǒng)，只能進REC。
在鏈接教程2中我失敗在安裝magisk.zip這一步，提示error127,提示安裝失敗不知道怎么搞了

siphot · 發(fā)表于 2024-9-26 23:18

yuan185 發(fā)表于 2024-9-20 12:06
那請問怎么 root 呢用busybox DD命令提取的BOOT.IMG去修補，修補完了之后刷進去之后不進系統(tǒng)，只能進RE ...

估計要TTL輸入命令關(guān)閉下AVB才行

chtwflm · 發(fā)表于 2024-10-19 21:20

樓主能分享一份2.8.2129 (穩(wěn)定版)..固件嗎？

人間仙境 · 發(fā)表于 2024-11-27 18:43

樓主，adb命令下有設(shè)置外部存儲器權(quán)限的命令嗎，我想修改一下外部存儲器存儲權(quán)限，現(xiàn)在app打不開u盤，想k歌軟件里面把移動硬盤當存儲空間來用

› 智能電視 / 安卓TV區(qū) › 小米電視