rigacci.org

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Android TV-Box MXQ (Amlogic S805) ======

I purchased two of this, for about 35 € each. They came with **different firmware**, also the **remote control is different** and not interchangeable.

^ Hostname               ^ m201d                  ^ m201C                       ^
^ Date of purchase       | 2016-04                | 2016-10                     |
^ Android                | 4.4.2                  | 4.4.2                       |
^ Firmware build number  | MXQ.V2.0.201601260953  | KOT49H.20151225 test-keys   |
^ Factory rooted         | Yes                    | No                          |
^ Linux kernel           | 3.10.33                | 3.10.33                     |
^ CPU                    | ARMv7 revision 1       | ARMv7 revision 1            |
^ Machine                | Amlogic Meson8B        | Amlogic Meson8B             |
^ Total RAM memory       | **510 Mib** (345 Mb total free with LibreELEC).\\ The original Linux kernel **gives fake values**: 824 Mb with ''/proc/meminfo'' or 1926 Mb with ''free''   | **1022 MiB**  |
^ NAND Storage           | 8GiB                   | 8 GiB                       |
^ WiFi driver            | RTL871X: rtl8189es     | RTL871X: rtl8189es          |RTL871X: rtl8189es
^ Remote factory_code    | 0x40400001 {{.:mxq:mxq-remote.0x40400001.conf.txt|remote.conf}}  | 0xfe010001 {{.:mxq:mxq-remote.0xfe010001.conf.txt|remote.conf}}  |
^ Recovery mode          | Yes, toothpick method  | Only from external SD card  |
^ [[http://kszaq.libreelec.tv/s805|Kszaq LibreELEC]]  | LibreELEC-S805.m201d.arm-7.0.3.3d.img  | LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img  |
^ Note                   | Time from the internet sometimes does not work.  | Overscan problem: image borders drop out of the screen.  |

The device does not have a clock inside, it relies on the time it gets from the internet. With the latest firmware (2016-01-26) there is a **very annoying bug**: from the Android settings we enabled **time from the internet** and set the proper timezone, this settings works just once, after a reboot the time is **almost always unset**.

===== Video Resolution =====

We don't know the actual **video adapter capabilities** of the MXQ, using the LibreELEC distribution we suspect that it cannot cope well with the native resolution of any HDMI monitor we connect to it. For example we attached a Samsung SyncMaster capable of 1440x900 pixel, but the Kodi interface offered only **1920x1080**, **1280x720** and **720x480**. So no native resultion can be used and it relays in **downscaling** or **upscaling**.


===== Partitions and storage space =====

For some insight of partitions content, see the post [[http://linux-sunxi.org/Boot_Android_from_SdCard|Boot Android from SdCard]].

<code>
root@m201d:/ # cat /proc/partitions                                            
major minor  #blocks  name

 253        0     512000 zram0
 250        0     524288 cache
 250        1      32768 logo
 250        2      32768 recovery
 250        3      32768 misc
 250        4      32768 boot
 250        5    1048576 system
 250        6    5275648 data
</code>

^              ^  Size            ^^  Free (at factory)  ^^
^ Partition    ^  m201d  ^  m201C  ^  m201d  ^  m201C  ^
^ ''/system''  |  991.9M |    1.5G |  144.0M |  578.5M |
^ ''/data''    |    4.9G |    4.4G |    3.9G |    3.6G |
^ ''/cache''   |  495.9M |  495.9M |  495.4M |  495.5M |
===== Remotes are different =====

From various posts on the internet it seems that very similar devices are shipped with different remotes. The two of mine are different and are not interchangeable. Remote factory code and configuration is stored into **''/system/etc/remote.conf''**.

{{.:mxq:mxq-remote-0x40400001.jpg?direct&64|MXQ Remote factory_code 0x40400001}}
{{.:mxq:mxq-remote-0xfe010001.jpg?direct&64|MXQ Remote factory_code 0xfe010001}}
===== Some devices are factory rooted =====

No need to [[wp>Rooting (Android OS)|root the device]] on model **m201d**, because it is already. You can install a **[[https://play.google.com/store/apps/details?id=jackpal.androidterm|terminal application]]** and issue the **''su''** command. If you don't want to register into Google to access the Play Store from the MXQ, you can get the **.apk** file somewhere, put it into the SD card, browse the folders and install it. Another useful app to install is an **[[https://play.google.com/store/apps/details?id=com.icecoldapps.sshserver|SSH server]]**, used to open a shell session from a PC into the device or to transfer files via **scp**. There is also an **[[https://play.google.com/store/apps/details?id=lutey.FTPServer|FTP server]]**, etc.

If the device does not have its **''su''** binary installed, you have to **boot in TWRP recovery mode** and install superuser **from a zip file**. You need an //update// .zip archive, not the .apk Android package, this is why the **[[https://play.google.com/store/apps/details?id=eu.chainfire.supersu|SuperSU]]** app is **distributed also as a zip file** (see below for [[#web_resources|download link]]). Save it into an SD card along with the TWRP recovery, boot from it and install.

The ''su'' binary installed by SuperSU is not standalone: when invoked (e.g. from the command line) it will bring-up the graphical interface of SuperSU, **which asks to allow superuser privileges to the requesting app**. May be there are superuser binaries which does not require this (e.g. the one shipped with model m201d).
====== Recovery Mode and Backup ======

==== Booting into Recovery Mode ====

Like others Android devices, this one too can boot into **Recovery Mode**. This is a minimal operating system where it is possible to delete all or some user data and files, perform system updates, etc.

Unlike many Android devices, the MXQ **can boot from any recovery image**, it does not need a signed one and it is not required [[wp>Rooting (Android OS)|to root the device]] to select a non-stock recovery.

To enter the recovery mode follow the **toothpick method**. It should be possible to sart the **built-in (stock) recovery**, or pick **one from the SD card**. My device with firmware 2016-01-26 is unable to start from the built-in, it just keep on rebooting, so it definitely needed one on the SD card.

  - **Unplug the power** from the device.
  - Connect a **screen to the HDMI** socket.
  - Connect an **USB keyboard** and/or an **USB mouse** (mouse required for some recovery, e.g. TWRP).
  - (May be optional) insert the SD card with the **''recovery.img''** on its root directory (FAT32 format).
  - Insert a **toothpick into the A/V** hole, and push it untill you feel the click of a microswitch.
  - Keeping the **toothpick pressed**, insert the **power plug**.
  - **Wait until** you see the recovery screen (about 15 seconds).

==== Choosing the right Recovery: Stock vs TWRP ====

**NOTICE**: the recovery image must be unzipped and renamed **recovery.img** before copying it into the root direcotry of the SD card.

{{  .:mxq:mxq_stock-recovery.jpg?direct&280|MXQ Stock Recovery}}
Some Recovery images are very limited, e.g. the //stock// one installed at factory. This is much like the one I extracted from the **OpenELEC 6.0.0.2 archive** (which has a build version //KOT49H.20151225 test-keys//, see [[#Web Resources|web resources]] for the download link) you can get a copy here: {{.:mxq:recovery-openelec-6.0.0.2.tgz|}}. It does not permit backup and it has just some basic functions:

  * reboot system now
  * apply update from ADB
  * apply update from EXT
  * apply update from cache
  * wipe data/factory reset
  * wipe cache partition

{{.:mxq:mxq_twrp-recovery.jpg?direct&280  |MXQ TWRP Recovery}}
**A totally different recovery is [[https://twrp.me/about/|TWRP]]**, which needs a mouse and support a ton of functions, I reccomend it to make a full backup of the firmware before re-flashing it. See [[#Web Resources|web resources]] below for the original link, a copy of the image is here: {{.:mxq:recovery-twrp-amlogic-mxq.tgz}} (TWRP v.3.0.2, md5sum a5e5cc5faa4cdddd58b8e62470c18ff9). It can perform backup and restore of partitions, it can install packages from zip files on the external SD card, can copy or delete files, ...

==== Performing the backup ====

In Android world, the backup of NAND flash memory partitions is called a **NANDroid backup**; it contains everything, from operating system to user data. Beware that backup images created with one tool (e.g. TWRP) are generally not compatible with another tool (e.g. [[wp>ClockworkMod|CWM]] Recovery).

Once booted into TWRP, you can click the //Backup// button and save the images of installed firmware. The archives will be stored into the internal storage of the MXQ, under the directory **''/storage/sdcard0/TWRP/mxq/''** (really a link into **''/mnt/shell/emulated''** mounting point). In my case it required **1.5 Gb**, where the free space was about **3.9 Gb**. The saved images are (see [[#twrp_backup_images|below]] for info about their content):

  * boot.emmc.win (32M)
  * logo.emmc.win (32M)
  * recovery.emmc.win (32M)
  * data.ext4.win (560M)
  * system.ext4.win (846M)

FIXME: Some of the backup files created by TWRP are not readable from the internal storage where TWRP crated them, they give **//permission denied//** even if accessed as root. Is this a bug? Is there something I miss? The unreadable files are data.ext4.win and system.ext4.win.

A workaround is to move them from the internal storage to the external SD card using the //Advanced// => //File Manager// function in TWRP.

====== Flashing a different firmware ======

Flashing a different firmware can be useful to upgrade or downgrade the stock software, or to flash a totally different image, e.g. [[http://openelec.tv/|OpenELEC]] or [[https://libreelec.tv/|LibreELEC]] (we need a version specifically built for our hardware/model).

==== Burning the firmware from the SD card ====

Some posts tell to flash a new firmware using a **Windows PC** and the **AMLogic USB Burning Tool**, while the MXQ device is connected via an **[[wp>USB On-The-Go|OTG USB]] cable**. We don't have a Windows PC and our MXQ box does not have the OTG USB socket, so we definitely go with **the alternative SD card method**.

For the SD card method we need to find a firmware archive which **contains three files**:

  * **recovery.img**, the recovery which will do the upgrade. A simple stock should suffice.
  * **factory_update_param.aml** this file contains recovery instructions to flash the firmware.
  * one .zip archive, e.g. **m201-ota-20150915.zip**, which is actually a JAR archive.

The file **''factory_update_param.aml''** just tells what is the archive to use for the upgrade and if erasing user data is required, this is an example:

<code>
--update_package=/sdcard/m201-ota-20150915.zip
--wipe_data
--wipe_cache
--wipe_media
</code>

The **update zip file is actualy a JAR archive**, it can be extracted using ''jar xvf file.zip''. Into the root directory of this archive there is the **''/system''** directory and there are also the images to flash into the relative partitions. This is an example:

^ ''/META-INF''       | The most important file is ''/META-INF/com/google/android/updater-script'', which is the script that actually does the upgrade.  |
^ ''/recovery''       | May contains patches to be applied to the recovery.   |
^ ''/system''         | Contains the software that will be flashed into the //system// partition. It can be the full structure of directories and files, or a single image of a squashfs filesystem, ...  |
^ ''boot.img''        | Image usually raw-flashed into ''/dev/block/boot'' partition. It should contain an [[http://forum.xda-developers.com/showthread.php?t=443994|Android bootimg]] with **kernel**, **ramdisk** and **second stage**.  |
^ ''bootloader.img''  | The **u-boot image** (much like a DOS/MBR boot sector). This is the first boot loader (FIXME which is flashed where?). When Android is running there is a ''/dev/bootloader'' device and a ''/sys/devices/virtual/bootloader/bootloader''.  |
^ ''file_contexts''   |  |
^ ''logo.img''        | Image usually raw-flashed into ''/dev/block/logo'' partition.  |
^ ''recovery.img''    | Image usually raw-flashed into ''/dev/block/recovery'' partition. Like the ''boot.img'', it should contains the **kernel**, the **ramdisk** and a **second stage**.  |

===== LibreELEC =====

==== Which LibreELEC image to use? ====

From [[http://kszaq.libreelec.tv/s805/]] you can find several images to flash to the device, you have to experiment which one is the best fit for you. Putting the wrong image onto the SD card, results in boot freeze at MXQ logo, just remove the SD card and reboot to recover.

  - **HD18Q** for all black MXQ box and OTT ones.
  - **MXQ** for all black and Beelink MXQ with "red stripe" on a corner.
  - **m201d** for boxes with 512 Mb RAM (instead of 1 Gb).

One MXQ box all black, labeled OTT, with the remote 0xfe010001 (see above) worked flawlessy with the **HD18Q** image. Another MXQ box all black, with the remote 0x40400001 worked with the **m201d** image.
==== Prepare the SD card and boot from it ====

To prepare the SD card (will be entirely erased, it must be umounted, change the name **/dev/sdX** to your entire device, not the partition):

<code>
gunzip LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img.gz
dd if=if=LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img of=/dev/sdX bs=4M
</code>

At the end the SD card will contains two partitions; one **FAT32** and one **Linux**. The first one contains three files (plus their MD5 checksum):

  - **aml_autoscript** a boot loader script
  - **kernel.img** the Linux kernel image
  - **SYSTEM** the LibreELEC filesystem image

The Linux partition is empty, **it will be resized** to occupy the entire space available on the SD card and it will contain runtime data for LibreELEC.

Once you prepared the SD card, insert it into the unpowered MXQ and use the **//toothpick method//**: insert a toothpick into the A/V socket untill you feel the click of a microswitch, then power-on the MXQ while keeping the microswitch pressed. This procedure seems required only once: the following times the MXQ will **boot directly** from the SD card just because it is inserted.

You will need an **USB keyboard** to configure the Kodi program (the remote control should work, but it is not very friendly selecting IP addresses, etc.). At least you should **configure the network** and **enable the SSH server**.

==== Copy LibreELEC to the internal NAND memory ====

Once connected via the SSH server (default root password is //libreelec//) run this command to copy the LibreELEC software to the internal NAND memory (overwriting the Android system):

<code>
LibreELEC:~ # installtointernal 
...
Formatting SYSTEM partition.../dev/system contains a ext4 file system
...
Writing kernel image...76+1 records in
...
Copying SYSTEM files...done.
Copying remote.conf...done.
Formatting DATA partition...done.
Do you want to copy your user data to internal data partition? [Y/n] 
...
</code>

==== Problems (Solved and Unsolved) ====

=== LibreELEC-S805.arm-8.2-8.1.5a-m201d ===

The **power button of the remote control** does power off the device, but it is unable to wake it up. You must disconnect the power supply and connect it again.

Sometimes we get **Kodi reboot**, Kodi interface or **video play freeze**. The system is installed into the NAND memory, into the dmesg log there are plenty of that messages:

<file>
nftl _nand_discard, start sector=282632, length=72
nftl _nand_discard, start sector=274440, length=24
nftl _nand_discard, start sector=4608120, length=32
</file>

The Kodi program crashes with the following message:

<file>
Program terminated with signal SIGBUS, Bus error.
</file>

The problem seem to be fixed **downgrading** to LibreELEC-S805.m201d.arm-7.0.3.3d image. Some kernel problem? Was the image 8.2-8.1.5a corrupt on flashing? Quién sabe?

=== LibreELEC-S805.arm-8.2-8.1.5-HD18Q ===

The **volume buttons of the remote control** do not work. You can instead press OK when playing a vide, then use the gear icon to access the menu.

=== LibreELEC-S805.m201d.arm-7.0.3.3d.img ===

We disabled **[[wp>Consumer Electronics Control|CEC]] remote control**, because we don't use it and we get ''dmesg'' full of

<file>
##### cec write error! #####
</file>

Go to //System// --> //System// --> //Input devices// --> //Peripherals// --> //CEC Adapter//. Select the plugin and disable it. You must to reboot to have it dsabled.
====== TWRP Backup images ======

See this paragraph about [[..:android:start#partizioni|Android partitions]].

=== boot.emmc.win ===

=== data.ext4.win ===

=== logo.emmc.win ===

It is the raw dump of **''/dev/block/logo''** partition,  it contains the BMP files of boot logos packed into a special Amlogic format. There is a tool called [[https://github.com/steeve/aml-imgpack|aml-imgpack]] which was able to extract the image files. Browsing the partition image you can see the Amlogic //magic number// **0x27051956** and the //magic number// of several BMP images (which is **BM**).

=== recovery.emmc.win ===

=== system.ext4.win ===

====== Web Resources ======

  * [[http://www.mxqproject.com/libreelec-mxq-sd-card-duel-boot|MXQProject.com - LibreElec MXQ SD Card Dual Boot]]
  * [[http://www.microdev.it/wp/it/2016/12/12/configurazione-telecomando-su-libreelec-per-soc-amlogic/|Configurazione telecomando su Libreelec per soc Amlogic]]
  * [[http://freaktab.com/forum/tv-player-support/amlogic-based-tv-players/s805/others-ab/540512-mxq-all-black-s805-versions-hd18q-and-clones-directory|MXQ "All Black" S805 Versions / HD18q / and Clones]] discuss issues with MXQ devices which look similar, but they really need different software builds.
  * [[http://sx05.eu/libreelec/7.0.2.5/|LibreELEC 7.0.2.5 for Amlogic S805]]
  * [[http://sx05.eu/libreelec/openelec/6.95.3.1|OpenELEC 6.95.3 for Amlogic S805]]
  * [[https://forum.libreelec.tv/thread-990.html|LibreELEC vs OpenELEC]] some words about the fork.
  * [[https://www.reddit.com/r/kodi/comments/4bm3kb/libreelec_fork_of_openelec/|LibreELEC (fork of OpenELEC)]], more about the fork.
  * [[https://justmeroms.com/2016/01/19/how-to-install-openelec-on-mxq-m8-m8s-m8s-minix-beelink-android-tv-box/|How To Install OpenELEC on MXQ, M8, M8s, M8s+, MINIX & Beelink Android TV Box]]
  * [[https://www.androidfilehost.com/?fid=24694152805484317|TWRP recovery.img v.3.0.2 for Amlogic MXQ]], was announced by [[http://freaktab.com/member/83595-luca91|Luca91]] with [[http://freaktab.com/forum/tv-player-support/amlogic-based-tv-players/s805/eny-acemax-ott-ab/firmware-roms-tools-ar/594502-amlogic-mxq-twrp|this post]].
  * [[http://androiding.how/how-to-flash-supersu-using-twrp-recovery-and-root-any-android-device/|How to Flash SuperSU using TWRP recovery and Root any Android device]], download link for [[http://downloadmirror.co/Uld/SuperSU-v2.78-201609011115.zip|SuperSU zip]].
  * [[http://www.androidiani.com/forum/box-tv-soc-amlogic/442787-box-tv-mxq-s85-amlogic-s85-1gb-ram-8gb-flash.html|[Box Tv] Mxq s85 (AMLogic S85 - 1gb Ram-8gb flash)]] (forum italiano).
  * [[https://www.digitalreins.com/reinstalling-the-firmware-for-the-mxq-streaming-media-player/|Reinstalling the firmware for the MXQ Streaming Media Player]], from SD card or USB stick.