Z9X bricked

Discussion in 'HDD Media player(RTD 1619DR)' started by JImmy Terng, Feb 19, 2025.

  1. JImmy Terng

    JImmy Terng New Member

    Hi,
    I ve a bricked Z9X, I tried downgrade the firmware but bricked.
    It's now showing red led standby after power on.
    I have followed the uart method, but not success.
    Appreciate any ideas to recover.
     
  2. Markswift2003

    Markswift2003 Well-Known Member SUPER Administrator Beta test group Contributor

    Given you tried a UART, I guess you've already seen this:

    RTD1619 Unbrick
     
  3. JImmy Terng

    JImmy Terng New Member

    Hi,
    Yup, the putty screen doesnt show anything, I have connected the uart port. Rgds,Jimmy
     
  4. Markswift2003

    Markswift2003 Well-Known Member SUPER Administrator Beta test group Contributor

    What UART are you using? It's unusual to not get anything from a terminal.
     
  5. JImmy Terng

    JImmy Terng New Member

    It is a ftdi chip TTL board, I have no idea to verify if the condition is ok.
    Last I used, it was fine, but that was years ago. And it has been kept in box for years.
    What is the serial port speed, data bit, stop bit,s flow control parameter I should use?
    The link doesnt mentioned that, I searched through here no mention too.
     
  6. Markswift2003

    Markswift2003 Well-Known Member SUPER Administrator Beta test group Contributor

    When I had to do it years ago I used:

    115200 baud
    8 data bits
    1 stop bit
    No Parity

    I used a CP2102 USB to UART bridge.
     
  7. JImmy Terng

    JImmy Terng New Member

    I managed to get something from serial console.
    But it doesnt seem to help.
    It stop booting at
    "jump to BL31: 0x80001000"

    I used a Max3232E serial, and connect to an ATEN serial to USB
    Gosh, so much hassles yet no outcome.


    C1:80000000
    C2h
    hwsetting size: 00000a78

    ------------------- Write Leveling --------------------
    DQS0 PI = 0x0000001b, DQ0 PI = 0x00000003
    DQS1 PI = 0x0000001d, DQ1 PI = 0x00000005
    DQS2 PI = 0x0000001a, DQ2 PI = 0x00000002
    DQS3 PI = 0x0000001b, DQ3 PI = 0x00000003

    -------------------- TX VREF Scan ---------------------
    ODT60, TX VREF Range = [0x00000cd7, 0x00000cec]
    Tx VREF = 0x00000ce1, Weight = 0x0000000b

    ------------------- DQS Calibration -------------------
    DQS0 Map = [0x00000016, 0x00000000], Width = 0x0000000b
    DQS0 Best PI = 0x0000001b
    DQS1 Map = [0x00000018, 0x00000002], Width = 0x0000000b
    DQS1 Best PI = 0x0000001d
    DQS2 Map = [0x00000015, 0x0000001f], Width = 0x0000000b
    DQS2 Best PI = 0x0000001a
    DQS3 Map = [0x00000016, 0x00000000], Width = 0x0000000b
    DQS3 Best PI = 0x0000001b
    BSTC verify: OK

    DDR calibration done

    REG32(VO_SW_SEC_1) = 0x00ce070d
    warmboot_indicator = 0x00004815
    C3
    DTE_Bootcode Flash Addr = 0x00012600
    DTE_Bootcode Flash Length = 0x00044a00
    DTE_Bootcode target addr = 0x10120000
    C4
    C5
    jump to FSBL_DDR: 0x10120000
    FSBL_DDR: Mar 17 2020, 10:29:37
    p_FW_Entry_DTE_FW_Certificate: type: 10, flash_addr: 0x20c00, length: 0x400, emmc_partition: 0
    p_FW_Entry_DTE_BOOTCODE_RTK: type: 16, flash_addr: 0x1a0000, length: 0x180000, emmc_partition: 0
    p_FW_Entry_BL31: type: 17, flash_addr: 0x28800, length: 0xd114, emmc_partition: 0
    p_FW_Entry_TEEOS: type: 18, flash_addr: 0x35a00, length: 0x1409a4, emmc_partition: 0
    p_FW_Entry_PCPU_FW_Certificate: type: 2, flash_addr: 0x20800, length: 0x400, emmc_partition: 0
    p_FW_Entry_PCPU_FW: type: 14, flash_addr: 0x21800, length: 0x7000, emmc_partition: 0
    get_bl31 = 0x00000000
    copy_img_from_emmc(00000000, 00000144, 0000d114, 80001000)
    AES_ECB_decrypt(80001000, 0000d000, 80001000, 10130260, 00000000, 00000080)
    AES key (0x10130260)
    0x10130260: 12 ef cd 22 68 24 57 13 d4 c3 b2 a1 be ba 90 90

    SHA256_hash(80001000, 0000d014, 1012f280, 00000000, 00000001)
    sha256 hash (0x1012f280)
    0x1012f280: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be
    0x1012f290: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be

    return hash2 = 0x1012f180
    hash1 from CP (0x1012f280)
    0x1012f280: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be
    0x1012f290: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be

    hash2 from sig (0x1012f180)
    0x1012f180: 2e 55 29 1b 79 cf c2 df e6 fa c8 82 e6 bb f2 be
    0x1012f190: b9 21 ac 3a d2 42 d3 63 1c a4 a2 29 cf c8 74 be


    compare_memory(1012f280, 1012f180, 00000020): 00000000
    process_bl31: 0x0
    get_dte_fw_certificate = 0x00000000
    copy_img_from_emmc(00000000, 00000106, 00000400, 1012e900)
    process_dte_fw_certificate: 0x0
    get_dte_bootcode_rtk = 0x00000000
    copy_img_from_emmc(00000000, 00000d00, 00180000, 00030000)
    process_dte_bootcode_rtk: 0x0
    jump to BL31: 0x80001000
     
  8. Markswift2003

    Markswift2003 Well-Known Member SUPER Administrator Beta test group Contributor

    Unfortunately I can't help much - it's years since I did this and I barely remember what I had for dinner yesterday

    It was @jjm2473 who helped me out, but that was way back in 2020.
     

Share This Page