Amlogic USB Burning Tool Still Sucks in 2016

Orange Pi Development Boards

[Update November 2016: If you don’t like USB Burning Tool or don’t have the necessary USB cable, you can flash Amlogic IMG firmware to a micro SD card instead]

In the first few years when Android TV Boxes/mini PCs started to hit the markets, in the 2012-2014 period, online firmware update was inexistent for the vast majority of the boxes, and if you wanted to update your firmware you had to use some windows tools like USB Burning Tool for Amlogic, AndroidTool for Rockchip, or PhoenixUSBPro / PhonixSuite for Allwinner platforms. All those tools have poor design, for example the window is not resizable, so it’s impossible to your an old netbook (1024×600 resolution), and then you have to install drivers which is easy, for after detection of the box may be hit and miss, and you have to follow a procedure with the right power sequence with a USB cable connected to a USB OTG port (not always properly marked) and the recovery pin hole or button. It’s taken me close to 4 hours in the past to update firmware through that method switching between USB ports and computers to find out what may be wrong… Luckily in recent years, many devices are now supporting OTA firmware updates, or an easy offline update procedure using a micro SD card or USB flash drive. That means most people should not need to torture themselves using such terrible tools and procedure, unless your TV box is somehow bricked, in which case Windows tools, or their Linux equivalent, are required.

I’ve writing about this because Rikomagic must have been nostalgic and decided not to provide OTA firmware update, and only distribute MK22 TV box firmware as an IMG file for Amlogic USB Burning Tool, both of which can be downloaded on Rikomagic download page. Even though I must have had to use such tools for nearly two years, I was naively expecting it update the firmware in a few minutes, since I used such tools extensively in the past. I was wrong, and I did managed to flash the firmware after two hours, most of it due my own mistakes, as I forgot some of the caveat, and did not read the complete instructions. So I’ll report my experience in case it can help somebody.

The first challenge was to find which one of the USB ports is the OTG one, as there are three, and no specific markings. At first, none of the ports would be detected due the wrong recovery sequence as explained, but I eventually found out it was the lonely USB port on the side, on the left of the micro SD slot and recovery pinhole.

mk22-otg-port-recovery-button

I know that normally you need to insert a toothpick in the recovery button and apply power, before releasing the recovery button, and I did just that and could not get into recovery mode at anytime. My mistake was that I had also inserted the USB cable, and it took me a while to realize it would also power the power through USB, not enough to show anything on the TV, but enough to boot the processor, and prevent me from accessing recovery mode. So the correct procedure, is to enter recovery mode by pressing the recovery button, applying power, and a few second later release the recovery button, and only then you can insert the USB cable.

After that I fired up a Windows 7 virtual image through VirtualBox, and installed USB Burning Tool and drivers by clicking on setup_v2.0.5.15_build7.exe downloaded from Rikomagic website. The installation went smoothly, but after enabling “Amlogic” device in Virtual Box, it would report the device is not supported, so I removed the drivers and reinstalled them, and I could get “Worldcup Device” in the Device Manager.

Good, now I can start USB Burning Tool, change the language to English in the program, and the TV box is detected, so I loaded the firmware file (File->Import Image… RKM MK22_161031.img), hoping to get ready to flash the firmware, but I got another error message “Get key failed” with the mac = 0 on the right window when click on Start button… Very odd.

Click to Enlarge
Click to Enlarge

But I’m not the only one with the issue, and for some reasons, Amlogic decided to add a license to their factory software… Hard to understand why, but I should definitely have read the provided “MK22.MK06 Software installation intructions-161013.doc” manual, as it explicitly states to

copy the folderlicense to the path when you set by this step. For example: I set C:\Program Files (x86)\Amlogic\USB_Burning_Tool

And there’s indeed a license folder in the downloaded file from Rikomagic, so I copied the directory to C:\Program Files (x86)\Amlogic\USB_Burning_Tool, overwriting the current license directory, and started USB burning tool again. Hmm… same “get key failed” error… Should I reboot? Let’s do it, but same error again after reboot.

So I decided to uninstall everything, and start from start with the drivers and USB Burning Tool, and made sure I copied the license directory before starting USB burning tool. After which I started the program, loaded the firmware file, click on Start button, and after just under 7 minutes I had managed to flash the firmware! Woohoo!

Click to Enlarge
Click to Enlarge

That was a painful experience. So while there’s a case (firmware recovery) for such tools and images, end users should not be asked to install the firmware through that method. It’s complicated, and the default settings wipe out your data and apps.

Support CNX Software - Donate via PayPal or become a Patron on Patreon

19
Leave a Reply

avatar
19 Comment threads
0 Thread replies
2 Followers
 
Most reacted comment
Hottest comment thread
11 Comment authors
Ajaybalbes150PhilSTOMBumsBums Recent comment authors
  Subscribe  
newest oldest most voted
Notify of
JustMe ROMS
Guest

No Need for power cable just it gets powered via usb cable

Theguyuk
Guest
Theguyuk
Stane1983
Member

Amlogic IMG files can be burn using only USB flash drive or SD card as bootloader supports usb/sdcard burning (on M8 – newer sdk-s and on all S9xx). Things you need is aml_autoscript, aml_sdc_burn.ini and IMG file to be in root of sdcard/usb. I’ll write article on how to do it on my site and will provide aml_autoscript for both usb and sdcard burning because they use different command and not all people can create these files. Will post another msg here when article is up. Flashing is slower than recovery or USB burning tool but it works 🙂

Mr Maso
Guest
Mr Maso

Stane1983 :
Amlogic IMG files can be burn using only USB flash drive or SD card as bootloader supports usb/sdcard burning (on M8 – newer sdk-s and on all S9xx). Things you need is aml_autoscript, aml_sdc_burn.ini and IMG file to be in root of sdcard/usb. I’ll write article on how to do it on my site and will provide aml_autoscript for both usb and sdcard burning because they use different command and not all people can create these files. Will post another msg here when article is up. Flashing is slower than recovery or USB burning tool but it works

That would be great as i have a godforsaken MXQ Pro Plus here that doesn’t get detected by the PC (Yes the drivers are correct anther box with the same SOC gets detected fine) and I tried everything else with no luck 🙁

Chris
Guest
Chris

@Stane1983

You don’t even need the aml_autoscript, just the aml_sdc_burn.ini (which you can extract from the img file) and the aml_upgrade_package.img file itself on a sd card. I put some simple c code on freaktab to extract all the files from the img file.

Chris
Guest
Chris

Example output from serial console:

GXM:BL1:dc8b51:76f1a5;FEAT:ADFC318C:0;POC:3;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
TE: 147717

BL2 Built : 19:58:22, Aug 31 2016.
gxl g54c8aee – [email protected]

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0+1 @ 912MHz – PASS
Rank0: 1024MB(auto)-2T-13
Rank1: 1024MB(auto)-2T-13
DataBus test pass!
AddrBus test pass!
-s
Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from eMMC, src: 0x00020200, des: 0x10100000, size: 0x00015400
Load bl33 from eMMC, src: 0x00038200, des: 0x01000000, size: 0x000a9200
NOTICE: BL3-1: v1.0(debug):2e39a99
NOTICE: BL3-1: Built : 16:36:21, Sep 20 2016
aml log : bl31 normal boot !
[Image: gxl_v1.1.3153-831ee11 2016-09-23 19:09:41 [email protected]]
OPS=0x82
2b c1 3a 4d 9c 87 d8 6b 3e fe 40 85 [0.395813 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9

U-Boot 2015.01 (Oct 01 2016 – 13:36:46)

DRAM: 2 GiB
Relocation Offset is: 76ec9000
register usb cfg[0][1] = 0000000077f5ece0
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000073ec96b0
aml_priv->desc_buf = 0x0000000073ecb9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
mmc read lba=0x14000, blocks=0x400
start dts,buffer=0000000073ece270,dt_addr=0000000073ece270
parts: 11
00: logo 0000000002000000 1
01: recovery 0000000002000000 1
02: rsv 0000000000800000 1
03: tee 0000000000800000 1
04: crypt 0000000002000000 1
05: misc 0000000002000000 1
06: instaboot 0000000020000000 1
07: boot 0000000002000000 1
08: system 0000000040000000 1
09: cache 0000000020000000 2
10: data ffffffffffffffff 4
get_dtb_struct: Get emmc dtb OK!
overide_emmc_partition_table: overide cache
[mmc_get_partition_table] skip partition cache.
Partition table get from SPL is :
name offset size flag
===================================================================================
0: bootloader 0 400000 0
1: reserved 2400000 4000000 0
2: cache 6c00000 20000000 2
3: env 27400000 800000 0
4: logo 28400000 2000000 1
5: recovery 2ac00000 2000000 1
6: rsv 2d400000 800000 1
7: tee 2e400000 800000 1
8: crypt 2f400000 2000000 1
9: misc 31c00000 2000000 1
10: instaboot 34400000 20000000 1
11: boot 54c00000 2000000 1
12: system 57400000 40000000 1
13: data 97c00000 30c200000 4
mmc read lba=0x12000, blocks=0x2
mmc read lba=0x12002, blocks=0x2
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x27400000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
hpd_state=0
cvbs performance type = 6, table = 0
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
read emmc dtb
Net: dwmac.c9410000
wipe_data=successful
wipe_cache=successful
upgrade_step=2
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x3d851000
[OSD]load fb addr from dts
[OSD]fb_addr for logo: 0x3d851000
[CANVAS]canvas init
[CANVAS]addr=0x3d851000 width=3840, height=2160
amlkey_init() enter!
[EFUSE_MSG]keynum is 4
[BL31]: tee size: 0
[KM]Error:f[key_manage_query_size]L507:key[usid] not programed yet
[KM]Error:f[key_manage_query_size]L507:key[deviceid] not programed yet
gpio: pin GPIOAO_2 (gpio 102) value is 0
detect upgrade key
gpio: pin GPIOAO_2 (gpio 102) value is 1
get_cpu_id flag_12bit=1
InUsbBurn
noSof
card in
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 1b
OEM: 534d
Name: 00000
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 29.8 GiB
mmc clock: 40000000
Bus Width: 4-bit
[MSG]Reload bmps env.
Err imgread(L472):Logo header err.
[MSG]ini sz 0x25aB
[fat]Filesize is 0x25aB[0M]
[fat]0x:leftSz 25a >>
[common]
erase_bootloader = 1
erase_flash = 0
reboot = 0x0
key_overwrite = 0x0

[burn_ex]
package = aml_upgrade_package.img
media =

[burn_parts]
burn_num = 0

<<<<=====sdc_burn_paras======

[MSG]To erase OLD bootloader !
emmckey_is_protected : protect
start = 0,end = 8191
mmc switch to boot0 success
emmckey_is_protected : protect
Emmckey: Access range is illegal!
mmc switch to boot1 success
emmckey_is_protected : protect
Emmckey: Access range is illegal!
mmc switch to user success
[MSG]Reset to load NEW uboot from ext-mmc!
reboot mode:
Can not find match reboot mode, use normal by default
INFO: PSCI Affinity Map:
INFO: AffInst: Level 1, MPID 0x0, State ON
INFO: AffInst: Level 1, MPID 0x100, State OFF
INFO: AffInst: Level 0, MPID 0x0, State ON
INFO: AffInst: Level 0, MPID 0x1, State OFF
INFO: AffInst: Level 0, MPID 0x2, State OFF
INFO: AffInst: Level 0, MPID 0x3, State OFF
INFO: AffInst: Level 0, MPID 0x100, State OFF
INFO: AffInst: Level 0, MPID 0x101, State OFF
INFO: AffInst: Level 0, MPID 0x102, State OFF
INFO: AffInst: Level 0, MPID 0x103, State OFF
bl31 reboot reason: 0xd
bl31 reboot reason: 0x1
system cmd 1.
GXM:BL1:dc8b51:76f1a5;FEAT:ADFC318C:0;POC:3;RCY:0;EMMC:0;READ:0;CHK:AA;SD:0;READ:0;0.0;CHK:0;
no sdio debug board detected
TE: 142065

BL2 Built : 13:48:56, Sep 23 2016.
gxl g7459bd4 – [email protected]

set vdd cpu_a to 1120 mv
set vdd cpu_b to 1050 mv
set vddee to 1000 mv
Board ID = 2
CPU clk: 1200MHz
DQS-corr enabled
DDR scramble enabled
DDR3 chl: Rank0 @ 636MHz – PASS
Rank0: 1024MB(auto)-2T-9
DataBus test pass!
AddrBus test pass!
Load fip header from SD, src: 0x0000c200, des: 0x01400000, size: 0x00004000
New fip structure!
Load bl30 from SD, src: 0x00010200, des: 0x01100000, size: 0x0000d600
Load bl31 from SD, src: 0x00020200, des: 0x10100000, size: 0x00015400
Load bl33 from SD, src: 0x00038200, des: 0x01000000, size: 0x000aaa00
NOTICE: BL3-1: v1.0(debug):3fb6b3e
NOTICE: BL3-1: Built : 16:45:24, Sep 21 2016
aml log : bl31 normal boot !
wdt: reset registers!
[Image: gxl_v1.1.3153-831ee11 2016-09-23 19:09:41 [email protected]]
OPS=0x82
2b c1 3a 4d 9c 87 d8 6b 3e fe 40 85 [0.538491 Inits done]
secure task start!
high task start!
low task start!
INFO: BL3-1: Initializing runtime services
WARNING: No OPTEE provided by BL2 boot loader
ERROR: Error initializing runtime service opteed_fast
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x1000000
INFO: BL3-1: Next image spsr = 0x3c9

U-Boot 2015.01-gb41fa5d-dirty (Sep 27 2016 – 15:57:15)

DRAM: 1 GiB
Relocation Offset is: 36ec8000
register usb cfg[0][1] = 0000000037f5f6a0
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: set clk: 666667000Hz, readback: 666660000Hz(0x300)
vpp: vpp_init
boot_device_flag : 1
Nand PHY Ver:1.01.001.0006 (c) 2013 Amlogic Inc.
init bus_cycle=6, bus_timing=7, system=5.0ns
reset failed
get_chip_type and ret:fffffffe
get_chip_type and ret:fffffffe
chip detect failed and ret:fffffffe
nandphy_init failed and ret=0xfffffff1
MMC: aml_priv->desc_buf = 0x0000000033ec86b0
aml_priv->desc_buf = 0x0000000033eca9d0
SDIO Port B: 0, SDIO Port C: 1
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
[mmc_startup] mmc refix success
[mmc_init] mmc init success
mmc read lba=0x14000, blocks=0x400
start dts,buffer=0000000033ecd270,dt_addr=0000000033ecd270
parts: 11
00: logo 0000000002000000 1
01: recovery 0000000002000000 1
02: rsv 0000000000800000 1
03: tee 0000000000800000 1
04: crypt 0000000002000000 1
05: misc 0000000002000000 1
06: instaboot 0000000020000000 1
07: boot 0000000002000000 1
08: system 0000000040000000 1
09: cache 0000000020000000 2
10: data ffffffffffffffff 4
get_dtb_struct: Get emmc dtb OK!
overide_emmc_partition_table: overide cache
[mmc_get_partition_table] skip partition cache.
Partition table get from SPL is :
name offset size flag
===================================================================================
0: bootloader 0 400000 0
1: reserved 2400000 4000000 0
2: cache 6c00000 20000000 2
3: env 27400000 800000 0
4: logo 28400000 2000000 1
5: recovery 2ac00000 2000000 1
6: rsv 2d400000 800000 1
7: tee 2e400000 800000 1
8: crypt 2f400000 2000000 1
9: misc 31c00000 2000000 1
10: instaboot 34400000 20000000 1
11: boot 54c00000 2000000 1
12: system 57400000 40000000 1
13: data 97c00000 30c200000 4
mmc read lba=0x12000, blocks=0x2
mmc read lba=0x12002, blocks=0x2
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
mmc env offset: 0x27400000
In: serial
Out: serial
Err: serial
reboot_mode=normal
hpd_state=0
cvbs performance type = 6, table = 0
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
read emmc dtb
card in
[mmc_init] mmc init success
Device: SDIO Port B
Manufacturer ID: 1b
OEM: 534d
Name: 00000
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
High Capacity: Yes
Capacity: 29.8 GiB
mmc clock: 40000000
Bus Width: 4-bit
[MSG]ini sz 0x25aB
[fat]Filesize is 0x25aB[0M]
[fat]0x:leftSz 25a >>
[common]
erase_bootloader = 1
erase_flash = 0
reboot = 0x0
key_overwrite = 0x0

[burn_ex]
package = aml_upgrade_package.img
media =

[burn_parts]
burn_num = 0

<<<<=====sdc_burn_paras======

[fat]Filesize is 0x3279923cB[807M]
[fat]0x:leftSz 2c40 < BPS 4000, gotSz 6c40
[MSG]image version [0x00000002]
[fat]Seek 0xb87338 from 0x6c40
[MSG]itemSizeNotAligned 0xcc8
[MSG]align 4 mmc read… [fat]0x:leftSz 175d To burn part [boot]
[MSG]itemSizeNotAligned 0x1524
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(boot) sz(0x7f41d1) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 128
[MSG]itemSizeNotAligned 0x1524
[fat]0x:leftSz 2cad To burn part [logo]
[fat]Seek 0xaa2d18 from 0x9becdd
[MSG]itemSizeNotAligned 0x12e8
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(logo) sz(0xe45f0) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 15
[MSG]itemSizeNotAligned 0x12e8
[fat]0x:leftSz 3308 To burn part [recovery]
[fat]Seek 0xb9182c from 0xb87338
[MSG]itemSizeNotAligned 0x27d4
[MSG]flash LOGIC partCap 0x2000000B
[MSG]Down(store) part(recovery) sz(0xabefa6) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 172
[MSG]itemSizeNotAligned 0x27d4
[fat]0x:leftSz 7d2 To burn part [system]
[MSG]itemSizeNotAligned 0x37fc
[MSG]flash LOGIC partCap 0x40000000B
[MSG]Down(store) part(system) sz(0x31148a08) fmt(sparse)
[MSG]totalSlotNum = 0, nextWriteBackSlot 1024
[MSG]itemSizeNotAligned 0x37fc
[MSG]Burn Start…
[fat]0x:leftSz 120c To burn part [bootloader]
[MSG]itemSizeNotAligned 0x1320
[MSG]Down(store) part(bootloader) sz(0xe4000) fmt(normal)
[MSG]totalSlotNum = 0, nextWriteBackSlot 15
[MSG]itemSizeNotAligned 0x1320
[fat]0x:leftSz 2ce0 < BPS 4000, gotSz 2ce0
[MSG]Burn Start…
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
[MSG]align bootloader sz from 0xe4000 to 0x100000
[MSG]Burn complete
mmc switch to boot0 success
mmc switch to boot1 success
mmc switch to user success
[MSG]VERIFY OK
## save_setting ##
[MSG]Set upgrade_step to 2
Saving Environment to aml-storage…
mmc env offset: 0x27400000
Writing to MMC(1)… done
[MSG]to close image
[MSG]Reload bmps env.
[MSG]======sdc burn SUCCESS.
[MSG]stop here as poweroff and powerkey not supported in platform!
[MSG]You can to reboot

Chris
Guest
Chris

@Chris
Sorry I think there was some sort of error during copy and paste of the serial output above. Parts of the log are missing, maybe due to parsing by the message board.

Chris
Guest
Chris

@Chris

Chris :
@Stane1983
You don’t even need the aml_autoscript, just the aml_sdc_burn.ini (which you can extract from the img file) and the aml_upgrade_package.img file itself on a sd card. I put some simple c code on freaktab to extract all the files from the img file.

Disregard the above it appears you need either aml_autoscript or u-boot on the sdcard. I am working on porting amlogic u-boot to current version and apparently had remnants of it on my sdcard without realizing it.

BumsBums
Guest
BumsBums

Where is the link to freaktab or the tool. Flashed a qbox firmware on a eny box nowbthe device isn’t recognized on the pc anymore. Do i need to extract the files of a qbox image or a eny image later for the bootable sd?

Chris
Guest
TOM
Guest
TOM

As flashing wiht USB burning tool failed, i got TF card flash from RIkomagic.
Share here:
https://www.sendspace.com/file/nj2rll

PhilS
Guest
PhilS

The greatest problem that I find is not with regards to the tool (although the licencing thing is rather silly) but the physical procedures that you often have to go through, which can vary from box to box, even when some have the same type of SOC onboard.

The pinholes in the base or reset buttons in the AV ports are just plain stupid.

At least with something like the TX5 Pro, all you had to do was fire up the tool and then just plug the USB cable in off it went. No need for any overbearing procedures, some of which require you to be a contortionist.

There is also the need (especially with AMLogic boxes, where none of the USB ports are OTG either) to purchase a Male A to Male A USB cable.

Rockchip boxes used to come with a micro usb OTG port that was easier to use because everybody tended to have a micro usb cable handy but the newer boxes, whilst still supporting OTG functionality, tend to only have the full sized ports.

Even when some vendors provide OTA updates, they tend to be of such a kind that still wipes the data and settings, rather than just update the functionality with the modifications.

balbes150
Guest
balbes150

“But I’m not the only one with the issue, and for some reasons, Amlogic decided to add a license to their factory software… Hard to understand why, but I should definitely have read the provided “MK22.MK06 Software installation intructions-161013.doc” manual, as it explicitly states to”

IMHO
This is a license for MAC ‘ (allowed list). Each manufacturer is allocated a specific range and the license describes this range.

Ajay
Guest
Ajay

in my android tv box flash another rom after didn’t connect to pc Please help me.
ans start android Zoom the Screen An not open properely and colure are yellow,