Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

by

Summary

  • Introduces firmware backup and flashing for set-top boxes using HiSilicon CPU. Connect the set-top box using USB-TTL serial programmer CH340, use Huawei HiSilicon flashing tool HiTool to create and modify partition table files, backup and flash firmware, and upgrade the system through upgrade packages. Install Home Assistant in the Hinas system, access files via FTP, WebDAV, Alist cloud disk, determine the real CPU model and reg name, and methods to speed up flashing.

Background Information

  • Using Home Assistant (abbreviated as HA) requires a personal server, with different home Linux server solutions depending on the situation.

    Server Solution Advantages Disadvantages
    Old Phone Small size, low power consumption, low cost Low performance, limited network
    Set-Top Box Small size, low power consumption, low cost Low performance, limited network
    Raspberry Pi Small size, low power consumption High cost, medium performance, limited network
    Mini PC Small size, medium cost Medium power consumption, medium performance, limited network
    NAS Medium size, medium cost High power consumption, high performance, limited network
    Computer/Server High performance High cost, large size, high power consumption, limited network
    Cloud Server No network restrictions, high performance High cost

  • Old phones can be used for simple functional verification, installation is more complex, and issues can easily arise. Currently common solutions include 「termux」, 「termux+proot」, 「Alpine Term+docker」, 「linux deploy (requires root permissions)」. The termux and termux+proot solutions mainly install HA by installing Python. After attempting, installing HA on termux results in dependency errors; termux+proot+debian shows version error prompts when starting HA; Alpine Term+docker can run HA normally after installation, but performance is severely low and laggy.

  • Set-top boxes can be used for simple personal use, with moderate installation difficulty and not prone to issues. Currently common options include 「Armbian」 and 「Hinas System」, primarily installing HA via Docker. 「Hinas System」 mainly supports 「HiSilicon」 chips including 「Hi3798MV100」, 「Hi3798MV200」, 「Hi3798MV300」, and does not support 「Hi3798MV300H」 and other suffix processors. 「Armbian」 mainly supports 「Amlogic」 chips in the 「S9xx」 series.

  • Initially planned to flash the set-top box model CM211-2, later found that the CPU model is Hi3798MV300H. Thus changed to flash the model HG680-j with CPU Hi3798MV100.

Operational Practice

Prerequisites

  • Software: Huawei HiSilicon flashing tool 「HiTool」, set-top box tool 「Happy TV Assistant」 (optional).

  • Hardware: Computer, USB-TTL serial programmer CH340, USB drive.

  • Firmware Package: Hinas hinas firmware TTL-hi3798mv100-202301.zip

Obtain System Information

  1. Connect the set-top box and computer to the network using an Ethernet cable, and connect the set-top box and USB-TTL serial programmer. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  2. Open 「HiTool」 and click 「HiBurn」. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  3. Set 「PC and Board Configuration」 parameters. Set 「Local PC Configuration」 under 「Serial Port」 and 「Server IP」, and set 「Board Configuration」 under 「IP Address」 and 「Gateway」. 「Serial Port」 is the port number used by the USB-TTL serial programmer (check via: 「Control Panel」 -> 「Device Manager」 -> 「Ports (COM and LPT)」), 「Server IP」 is the computer’s IP address. 「IP Address」 is the set-top box’s IP address, and 「Gateway」 is generally kept default. Choose 「Transmission Method」 as 「Network (Recommended)」. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  4. Obtain the CPU model and pin configuration table. Click 「Open Terminal Tool」, then click 「Connect」, and finally power on the set-top box. The startup information contains the pin configuration table, CPU model, memory specifications, PCB layer count, and flash type. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  5. View the partition table. For the model CM211-2 with CPU Hi3798MV300H, the startup information will display partition table information. For the model HG680-j with CPU Hi3798MV100, the startup information will not show the partition table, and the command cat /proc/cmdline needs to be executed to view the partition table information. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server FirmwareUsing Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  6. View the mount information. Execute mount command to view all mounted file systems in the system. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  7. View flash block partitions. For the model CM211-2 set-top box, execute cd /dev/block/platform/soc/by-name and ls -al commands to view the partition names pointed to by the flash block partitions. For the model HG680-j, execute cd /dev/block/platform/hi_mci.1/by-name and ls -al commands to view the partition names pointed to by the flash block partitions. For other set-top boxes, look for the by-name folder in the subdirectories under /dev/block/platform. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  8. View file system information. Execute df command to view the size and usage of partitions in the system. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  9. Based on the usage of partitions in the system, clean up unnecessary information to prepare for data backup. Software uninstallation can use 「Happy TV Assistant」, which can also conveniently obtain partition tables, mount information, file system information, etc. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Create and Modify Partition Table

  1. Set chip model. Click 「Chip」 -> 「Switch Chip」 -> 「Hi3798MV100」. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  2. Click 「Flash eMMC」, and click the green plus sign on the right side of the table to create a new partition.

  3. Click the name item, enter the partition name according to partition table, and follow the block order in flash block partition (from mmcblk0p1 to mmcblk0p17).

  4. Click the file item and select the file path by clicking the folder icon on the right (appears when selected), then click 「Open」 after entering the file name. It is recommended that the file name be consistent with the partition name.

  5. Click the length item and set the corresponding partition size according to partition table.

  6. Click the file system item and select the corresponding partition file system according to mount information. This item only affects the speed of flashing.

  7. Check the checkbox in front of the partition to be operated on.

  8. Click eMMC partition table file on the right side of 「Browse」, select the file path in the pop-up dialog and click 「Open」, then click 「Save」. It is recommended that the file name contains the CPU model and flash type of the device. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Operate Firmware

Backup Firmware

Method 1: TTL+HiTool

  1. Click 「Upload」 in the last step of creating and modifying the partition table.

  2. Close the power of the set-top box after the pop-up dialog appears.

  3. Turn on the power of the set-top box.

  4. Wait for the progress bar in the dialog box to finish. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Method 2: TTL+USB Drive

  1. Click 「Open Terminal Tool」, then click 「Connect」, and finally power on the set-top box.

  2. Execute df command to check the usage of partitions in the system.

  3. Insert the USB drive (FAT32 format), then execute df command to check the usage of partitions in the system, the newly appeared /mnt/sda/sda1 indicates that the USB drive is successfully mounted.

  4. Execute cd /dev/block/platform/soc/by-name and ls -al commands to view the partition names pointed to by the flash block partitions. 

    root@Hi3798MV300:/ # cd /dev/block/platform/soc/by-name
root@Hi3798MV300:/dev/block/platform/soc/by-name # ls -al
lrwxrwxrwx root    root    1970-01-01 08:00 baseparam -> /dev/block/mmcblk0p5
lrwxrwxrwx root    root    1970-01-01 08:00 boot -> /dev/block/mmcblk0p9
lrwxrwxrwx root    root    1970-01-01 08:00 cache -> /dev/block/mmcblk0p14
lrwxrwxrwx root    root    1970-01-01 08:00 fastboot -> /dev/block/mmcblk0p1
lrwxrwxrwx root    root    1970-01-01 08:00 fastplay -> /dev/block/mmcblk0p8
lrwxrwxrwx root    root    1970-01-01 08:00 logo -> /dev/block/mmcblk0p7
lrwxrwxrwx root    root    1970-01-01 08:00 misc -> /dev/block/mmcblk0p10
lrwxrwxrwx root    root    1970-01-01 08:00 partition -> /dev/block/mmcblk0p2
lrwxrwxrwx root    root    1970-01-01 08:00 pqparam -> /dev/block/mmcblk0p6
lrwxrwxrwx root    root    1970-01-01 08:00 recovery -> /dev/block/mmcblk0p3
lrwxrwxrwx root    root    1970-01-01 08:00 securestore -> /dev/block/mmcblk0p12
lrwxrwxrwx root    root    1970-01-01 08:00 swdb -> /dev/block/mmcblk0p13
lrwxrwxrwx root    root    1970-01-01 08:00 swdevinfo -> /dev/block/mmcblk0p4
lrwxrwxrwx root    root    1970-01-01 08:00 system -> /dev/block/mmcblk0p15
lrwxrwxrwx root    root    1970-01-01 08:00 trustedcore -> /dev/block/mmcblk0p11
lrwxrwxrwx root    root    1970-01-01 08:00 userdata -> /dev/block/mmcblk0p16

  5. Execute cd /mnt/sda/sda1 command to switch the current working directory to /mnt/sda/sda1, and execute mkdir FW_BK command to create a folder named FW_BK in the current working directory.

  6. Use the following dd command to backup partitions. For larger partitions, execute dd if=/dev/block/platform/soc/by-name/userdata | gzip > /mnt/sda/sda1/FW_BK/userdata.bin.gz command to compress and then output.

    dd if=/dev/block/platform/soc/by-name/fastboot of=/mnt/sda/sda1/FW_BK/fastboot.bin
dd if=/dev/block/platform/soc/by-name/partition of=/mnt/sda/sda1/FW_BK/partition.bin
dd if=/dev/block/platform/soc/by-name/recovery of=/mnt/sda/sda1/FW_BK/recovery.bin
dd if=/dev/block/platform/soc/by-name/swdevinfo of=/mnt/sda/sda1/FW_BK/swdevinfo.bin
dd if=/dev/block/platform/soc/by-name/baseparam of=/mnt/sda/sda1/FW_BK/baseparam.bin
dd if=/dev/block/platform/soc/by-name/pqparam of=/mnt/sda/sda1/FW_BK/pqparam.bin
dd if=/dev/block/platform/soc/by-name/logo of=/mnt/sda/sda1/FW_BK/logo.bin
dd if=/dev/block/platform/soc/by-name/fastplay of=/mnt/sda/sda1/FW_BK/fastplay.bin
dd if=/dev/block/platform/soc/by-name/boot of=/mnt/sda/sda1/FW_BK/boot.bin
dd if=/dev/block/platform/soc/by-name/misc of=/mnt/sda/sda1/FW_BK/misc.bin
dd if=/dev/block/platform/soc/by-name/trustedcore of=/mnt/sda/sda1/FW_BK/trustedcore.bin
dd if=/dev/block/platform/soc/by-name/securestore of=/mnt/sda/sda1/FW_BK/securestore.bin
dd if=/dev/block/platform/soc/by-name/swdb of=/mnt/sda/sda1/FW_BK/swdb.bin
dd if=/dev/block/platform/soc/by-name/cache of=/mnt/sda/sda1/FW_BK/cache.bin
dd if=/dev/block/platform/soc/by-name/system of=/mnt/sda/sda1/FW_BK/system.bin
dd if=/dev/block/platform/soc/by-name/userdata of=/mnt/sda/sda1/FW_BK/userdata.bin

Flash Firmware

Method 1: TTL+HiTool

  1. Unzip the Hinas system firmware package TTL-hi3798mv100-202301.zip.

  2. Click eMMC partition table file on the right side of 「Browse」, select the eMMC partition table file from the Hinas system firmware package, and click 「Open」.

  3. Check the checkboxes in front of the partitions to be flashed.

  4. Click 「Flash」.

  5. Close the power of the set-top box after the pop-up dialog appears.

  6. Turn on the power of the set-top box.

  7. Wait for the flashing progress bar in the dialog box to finish. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Method 2: TTL+USB Drive

  1. Click 「Open Terminal Tool」, then click 「Connect」, and finally power on the set-top box.

  2. Execute df command to check the usage of partitions in the system.

  3. Insert the USB drive (FAT32 format), then execute df command to check the usage of partitions in the system, the newly appeared /mnt/sda/sda1 indicates that the USB drive is successfully mounted.

  4. Execute cd /dev/block/platform/soc/by-name and ls -al commands to view the partition names pointed to by the flash block partitions. 

    root@Hi3798MV300:/ # cd /dev/block/platform/soc/by-name
root@Hi3798MV300:/dev/block/platform/soc/by-name # ls -al
lrwxrwxrwx root    root    1970-01-01 08:00 baseparam -> /dev/block/mmcblk0p5
lrwxrwxrwx root    root    1970-01-01 08:00 boot -> /dev/block/mmcblk0p9
lrwxrwxrwx root    root    1970-01-01 08:00 cache -> /dev/block/mmcblk0p14
lrwxrwxrwx root    root    1970-01-01 08:00 fastboot -> /dev/block/mmcblk0p1
lrwxrwxrwx root    root    1970-01-01 08:00 fastplay -> /dev/block/mmcblk0p8
lrwxrwxrwx root    root    1970-01-01 08:00 logo -> /dev/block/mmcblk0p7
lrwxrwxrwx root    root    1970-01-01 08:00 misc -> /dev/block/mmcblk0p10
lrwxrwxrwx root    root    1970-01-01 08:00 partition -> /dev/block/mmcblk0p2
lrwxrwxrwx root    root    1970-01-01 08:00 pqparam -> /dev/block/mmcblk0p6
lrwxrwxrwx root    root    1970-01-01 08:00 recovery -> /dev/block/mmcblk0p3
lrwxrwxrwx root    root    1970-01-01 08:00 securestore -> /dev/block/mmcblk0p12
lrwxrwxrwx root    root    1970-01-01 08:00 swdb -> /dev/block/mmcblk0p13
lrwxrwxrwx root    root    1970-01-01 08:00 swdevinfo -> /dev/block/mmcblk0p4
lrwxrwxrwx root    root    1970-01-01 08:00 system -> /dev/block/mmcblk0p15
lrwxrwxrwx root    root    1970-01-01 08:00 trustedcore -> /dev/block/mmcblk0p11
lrwxrwxrwx root    root    1970-01-01 08:00 userdata -> /dev/block/mmcblk0p16

  5. Use the following dd command to flash partitions. The location of the backed-up firmware is the FW_BK folder. For larger partitions, execute gzip -dc /mnt/sda/sda1/FW_BK/userdata.bin.gz | dd of=/dev/block/platform/soc/by-name/userdata command to decompress and then output.

    dd if=/mnt/sda/sda1/FW_BK/fastboot.bin of=/dev/block/platform/soc/by-name/fastboot
dd if=/mnt/sda/sda1/FW_BK/partition.bin of=/dev/block/platform/soc/by-name/partition
dd if=/mnt/sda/sda1/FW_BK/recovery.bin of=/dev/block/platform/soc/by-name/recovery
dd if=/mnt/sda/sda1/FW_BK/swdevinfo.bin of=/dev/block/platform/soc/by-name/swdevinfo
dd if=/mnt/sda/sda1/FW_BK/baseparam.bin of=/dev/block/platform/soc/by-name/baseparam
dd if=/mnt/sda/sda1/FW_BK/pqparam.bin of=/dev/block/platform/soc/by-name/pqparam
dd if=/mnt/sda/sda1/FW_BK/logo.bin of=/dev/block/platform/soc/by-name/logo
dd if=/mnt/sda/sda1/FW_BK/fastplay.bin of=/dev/block/platform/soc/by-name/fastplay
dd if=/mnt/sda/sda1/FW_BK/boot.bin of=/dev/block/platform/soc/by-name/boot
dd if=/mnt/sda/sda1/FW_BK/misc.bin of=/dev/block/platform/soc/by-name/misc
dd if=/mnt/sda/sda1/FW_BK/trustedcore.bin of=/dev/block/platform/soc/by-name/trustedcore
dd if=/mnt/sda/sda1/FW_BK/securestore.bin of=/dev/block/platform/soc/by-name/securestore
dd if=/mnt/sda/sda1/FW_BK/swdb.bin of=/dev/block/platform/soc/by-name/swdb
dd if=/mnt/sda/sda1/FW_BK/cache.bin of=/dev/block/platform/soc/by-name/cache
dd if=/mnt/sda/sda1/FW_BK/system.bin of=/dev/block/platform/soc/by-name/system
dd if=/mnt/sda/sda1/FW_BK/userdata.bin of=/dev/block/platform/soc/by-name/userdata

Upgrade Firmware

  • Method 1: Use TTL+HiTool+USB Drive. Flash recovery to recovery, flash emmc to misc, then restart the set-top box to enter recovery mode, and finally select apply update from external storage in recovery mode to flash the update.zip package from the USB drive.

  • Method 2: Use TTL+USB Drive or ADB+USB Drive. Use dd command to output recovery to recovery, emmc to misc, then execute reboot command to restart into recovery mode, and finally select apply update from external storage in recovery mode to flash the update.zip package from the USB drive.

  • Method 3: Use ADB or TTL or TTL+HiTool to flash recovery and then install the native version of the settings software package. Enter the native version of 「Settings」 and select 「Local Upgrade」 to upgrade the system. The upgrade package must be named update.zip and located in the root directory of the USB drive. The package is generally named SWProductCheck.apk, which can be searched in related tutorials for flashing rescue.

  • Method 4: Copy fastboot.bin, bootargs.bin, and recovery.img files to the root directory of the USB drive. Short-circuit the forced flashing short-circuit point, then turn on the power of the set-top box, wait a few seconds, and then release the short-circuit. The set-top box will load fastboot.bin from the USB drive and boot recovery.img from the USB drive into recovery mode, and finally select apply update from external storage in recovery mode to flash the update.zip package from the USB drive.

  • Method 5: Copy fastboot.bin, bootargs.bin, and recovery.img files to the root directory of the USB drive. Use ADB or TTL or TTL+HiTool to erase the fastboot.bin partition. After rebooting, the set-top box will load fastboot.bin from the USB drive and boot recovery.img from the USB drive into recovery mode, and finally select apply update from external storage in recovery mode to flash the update.zip package from the USB drive.

Usage Summary

  • Enter the IP address of the set-top box in the browser to access the Hinas system homepage.

  • Click 「External Network」 on the homepage, then click 「Terminal Management」, the initial username and password are root and ecoo1234, and the current system root account password can be modified using the passwd root command.

  • On the 「Terminal Management」 page, enter apt install minidlna to install MiniDLNA software. The system has built-in software installation scripts for basic functions, enter the following commands to automatically install and configure the software. Portainer is a visual container image management tool, Qinglong panel is a task management platform that supports Python3, JavaScript, Shell, Typescript scripts, Home Assistant is an open-source home automation platform developed based on Python 3 that integrates existing smart home ecosystems.

    install-portainer.sh        Install Docker container management panel
install-qinglong.sh         Install Docker application: Qinglong panel
install-homeassistant.sh    Install smart home control panel

  • Support document management on the server via FTP or SCP, the initial username and password are ubuntu and ecoo1234. SFTP mode’s port 22 can access the root directory, while FTP mode’s port 21 can only access the /home directory.

  • The built-in WebDAV server is on port 8081, with the initial username and password both as admin, and the default storage location is /home/ubuntu/webdav.

  • The built-in Alist cloud disk supports multiple storage types and allows web browsing and WebDAV access. The initial username and password are admin and admin123.

  • Executing recoverbackup command can restore the backup system, and all data in the root partition will be cleared and overwritten by the original backup system.

Precautions

  • About chip models: The CPU models of the Magic Box CM211-2 include MV100, MV300, MV300H. The actual CPU model is based on the reg name containing the CPU model or the chip’s own silk screen.

  • About reg name: The reg name of the firmware to be flashed in the chip’s fastboot should be consistent with the reg name in the existing fastboot of the set-top box in terms of pin configuration table and CPU model; otherwise, the fastboot cannot be flashed. The reg name displayed in the startup information is for reference only; the actual pin configuration table is based on the reg name in the existing fastboot of the set-top box. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

  • About 「HiBurn」 in 「Transmission Method」: Regardless of whether the transmission method is set to serial port or network port, when flashing fastboot, the data is actually transmitted via the serial port, which is very slow.

  • About 「HiBurn」 in 「File System」: If a file system actually exists but is set to none in the software, during the flashing operation, the partition image will be transmitted in binary form; if set to a specific file system like ext3/4, the partition image will be transmitted in compressed form, meaning the image is compressed before transmission, and then decompressed and written to the partition. Therefore, setting the file system during the flashing operation can reduce the time required for partition image transmission, ultimately speeding up the overall flashing process. For the upload operation, regardless of whether the file system is set in the software, the uploaded partition image is always transmitted in binary form, which does not change the upload speed.

  • About compression: The image size of the userdata partition will exceed 4GB, surpassing the FAT32 file system limit, so compression is needed. When using the dd command, deciding whether to compress based on the partition size and usage can effectively save space and transmission time.

  • About terminal content being overwritten and lost: Click 「Window」 -> 「Preferences」, click 「Terminal」 and modify the terminal cache line count.

  • About failure to flash and backup firmware using HiTool: Click 「Window」 -> 「Preferences」, then click 「HiBurn」, modify the TFTP settings and command settings. Adjust corresponding parameters based on the error messages in the 「Console」. Sometimes redoing the operation can also restore normalcy. Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

References

  • HiSilicon Set-Top Box NAS Hinas System User Guide
  • Building the Strongest Huawei HiSilicon Hi3798MV100/200/300 Set-Top Box NAS Server System – Huawei Box Forum – ZNDS
  • Which TV Box Chip Performance is Stronger? TV Box Transforms into Linux System Install Docker Panel Qinglong Opens Another World of the Box
  • 【Dog Egg】Build a Family Server, Hardware, Software, Configuration Recommendations【Ten Thousand Words Long Article Continuously Updated】 – Zhihu
  • Magic Box CM211-2 Network Set-Top Box Firmware Download Summary and Motherboard Distinction – Evaluation/Image Sharing – Android Flashing Firmware Network【Kirin Flashing Network】
  • Henan Mobile CMCC-2 CH TV Box Hi3798MV310 Line Flashing – Card Flashing – Rescue – Zhihu
  • Which Method to Use for Flashing HiSilicon Devices
  • HiSilicon Hi3798MV300/300H Universal Unlock Version Recovery – China Mobile Magic Box – ZNDS
  • Magic Box CM211-2 Flashing (MV300 Chip) OEM Disassembly TTL Cracking Firmware – Set-Top Box/Smart TV Digital Home
  • Beijing CM211-2 Original Rescue Package Flashing Dongbei No Disassembly Tutorial – China Mobile Magic Box – ZNDS

Copyright Statement: This article is original by 「Dream Heart Star」 and is licensed under CC BY-NC-SA 4.0. Please include the original source link and this statement when reprinting.

Blog Garden Address: https://www.cnblogs.com/Sky-seeker WeChat Public Account: Follow the WeChat Public Account for instant push Using Hi3798 Set-Top Box with Hitool and TTL to Backup and Flash Hinas Linux Server Firmware

Related posts:

  1. Guide to Building a Raspberry Pi 4B Home Server: Running rsnapshot for Cost-effective Incremental Local Backup of Server Data
  2. How to Use Syncthing for Home Server Photo Backup
  3. Comprehensive Guide to Building a Home Server for Backup and More

Leave a Comment

×