拆解新买的小爱音箱Pro, 更新固化开机启动 SSH 教学

un123

snowwolf725 发表于 2020-12-3 12:18
是的新的固件最後多了一行,
这个是我修改後的固件(已经自带启动 SSH),

解压后压缩里边是m5呀？不是m4

snowwolf725

un123 发表于 2021-1-26 12:35
解压后压缩里边是m5呀？不是m4

那就手动更名成 m4
m4 m5 是两个同一样的分区, 一个是目前系统, 一个是备用的系统
每次系统升级都会互换

foxdiy

学习学习

un123

大神，你制作的系统，登录root 密码是多少？

snowwolf725

un123 发表于 2021-2-13 10:12
大神，你制作的系统，登录root 密码是多少？

密码是根据你音箱的SN产生的，
每台密码都不一样，
这边有算号器
https://bbs.hassbian.com/forum.php?mod=viewthread&tid=11139

un123

谢谢，我还以为你的系统，固定了密码

hhxxttxsok

1，如果是 /dev/mtdblock5 表示目前启动的是 system1 你要要把档案写到 system0
并且使用 boot0 启动系统。2，相反如果是 /dev/mtdblock4 表示目前启动的是 system0 你要要把档案写到 system1
并且使用 boot1 启动系统。     本来我应该按照1的步骤，被我输入错误，输入2的步骤了，现在只出来mico login,回不到LX06 login，请教楼主，这种情况怎么解决？麻烦大佬指点迷津，万分感谢

hhxxttxsok

Xshell 6 (Build 0189)
Copyright (c) 2002 NetSarang Computer, Inc. All rights reserved.

Type `help' to learn how to use Xshell prompt.
[F:\~]$

Connecting to COM3...
Connected.

AXG:BL1:d1dbf2:a4926f;FEAT:E0DC318C:2000OC:F;EMMC:800;NAND:0;READ:0;0.0;CHK:0;
sdio debug board detected
TE: 24144

BL2 Built : 15:46:00, Sep 29 2019. axg g8667414 - sentao.gao@droid08-bj

set vcck to 1140 mv
set vddee to 1070 mv
Board ID = 3
CPU clk: 1200MHz
DDR low power enabled
DDR DQS-calibration enabled
DDR scramble enabled
DDR3 chl: Rank0 16bit @ 792MHz - PASS
Rank0: 128MB(auto)-2T-11
DataBus test pass!
AddrBus test pass!
NAND init
chk page: 00000500
chk page: 00000540
chk page: 00000580
chk page: 000005c0
bbt blk:00000014
bbt page:00000000
0000000000000000000000000000000000000000000000000000000000000000
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000
Load BL3x from NAND, src: 0x00010000, des: 0x01704000, size: 0x00080000
NOTICE:  BL31: v1.3(release):87b5e26
NOTICE:  BL31: Built : 11:33:44, Apr 10 2020
NOTICE:  BL31: AXG normal boot!
NOTICE:  BL31: BL33 decompress pass
[Image: axg_v1.1.3268-b93dd79 2017-12-01 14:22:18 huan.biao@droid12]
OPS=0x43
5e 8f 9f 37 d3 34 72 fa 48 ee ff 1c bl30:axg ver: 9 mode: 0
bl30:axg thermal0
[0.014576 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Jun 24 2020 - 02:36:24), Build: jenkins-Mico_lx06_ota_publish-191

DRAM:  128 MiB
Relocation Offset is: 06f17000
register usb cfg[0][1] = 0000000007f89638
NAND:  nand id: 0x98 0xf1
128MiB, SLC, page size: 2048, OOB size: 64
NAND device id: 98 f1 80 15 f2 16
NAND device: Manufacturer ID: 0x98, Chip ID: 0x98 (Toshiba A revision NAND 1Gib TC58BVG0S3HTA00 )
oob avail size 6
Creating 1 MTD partitions on "A revision NAND 1Gib TC58BVG0S3HTA00 ":
0x000000000000-0x000000200000 : "bootloader"
A revision NAND 1Gib TC58BVG0S3HTA00  initialized ok
nand id: 0x98 0xf1
128MiB, SLC, page size: 2048, OOB size: 64
NAND device id: 98 f1 80 15 f2 16
NAND device: Manufacturer ID: 0x98, Chip ID: 0x98 (Toshiba A revision NAND 1Gib TC58BVG0S3HTA00 )
PLANE change!
aml_nand_init obmul=1,oobfree.length=8,oob_size=64
oob avail size 8
bbt_start=20 env_start=24 key_start=32 dtb_start=40
nbbt: info size=0x400 max_scan_blk=24, start_blk=20
nbbt : phy_blk_addr=20, ec=0, phy_page_addr=0, timestamp=1
nbbt free list:
blockN=21, ec=-1, dirty_flag=0
blockN=22, ec=-1, dirty_flag=0
blockN=23, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1251: page_num=1
aml_nand_scan_rsv_info 1254
nbbt valid addr: 280000
aml_nand_bbt_check 1389 bbt is valid, reading.
aml_nand_read_rsv_info:397,read nbbt info to 280000
nenv: info size=0x10000 max_scan_blk=32, start_blk=24
nenv : phy_blk_addr=25, ec=69, phy_page_addr=0, timestamp=140
nenv free list:
blockN=24, ec=69, dirty_flag=1
blockN=26, ec=-1, dirty_flag=0
blockN=27, ec=-1, dirty_flag=0
blockN=28, ec=-1, dirty_flag=0
blockN=29, ec=-1, dirty_flag=0
blockN=30, ec=-1, dirty_flag=0
blockN=31, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1251: page_num=32
aml_nand_scan_rsv_info 1254
nenv valid addr: 330000
nkey: info size=0x8000 max_scan_blk=40, start_blk=32
nkey : phy_blk_addr=32, ec=0, phy_page_addr=0, timestamp=1
nkey free list:
blockN=33, ec=-1, dirty_flag=0
blockN=34, ec=-1, dirty_flag=0
blockN=35, ec=-1, dirty_flag=0
blockN=36, ec=-1, dirty_flag=0
blockN=37, ec=-1, dirty_flag=0
blockN=38, ec=-1, dirty_flag=0
blockN=39, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1251: page_num=16
aml_nand_scan_rsv_info 1254
nkey valid addr: 418000
ndtb: info size=0x20000 max_scan_blk=44, start_blk=40
ndtb : phy_blk_addr=40, ec=0, phy_page_addr=0, timestamp=1
ndtb free list:
blockN=41, ec=-1, dirty_flag=0
blockN=42, ec=-1, dirty_flag=0
blockN=43, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1251: page_num=64
aml_nand_scan_rsv_info 1254
ndtb valid addr: 500000
tpl: off 8388608, size 8388608
NAND bbt detect factory Bad block at 5240000
aml_nand_add_partition:1794 factory bad addr=292
NAND bbt detect factory Bad block at 6000000
aml_nand_add_partition:1794 factory bad addr=300
Creating 6 MTD partitions on "A revision NAND 1Gib TC58BVG0S3HTA00 ":
0x000000800000-0x000001000000 : "tpl"
0x000001000000-0x000001600000 : "boot0"
0x000001600000-0x000001c00000 : "boot1"
0x000001c00000-0x000004400000 : "system0"
0x000004400000-0x000006c40000 : "system1"
NAND bbt detect factory Bad block at 5240000
NAND bbt detect factory Bad block at 6000000
0x000006c40000-0x000008000000 : "data"
A revision NAND 1Gib TC58BVG0S3HTA00  initialized ok
aml_key_init 170
MMC:   
uboot env amlnf_env_read : ####
aml_nand_read_rsv_info:397,read nenv info to 330000
In:    serial
Out:   serial
Err:   serial
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
Saving Environment to aml-storage...
uboot env amlnf_env_save : ####
aml_nand_save_rsv_info:656, nenv: valid=1, pages=32
release_free_node 61: bitmap=1fffff
release_free_node 74: bitmap=1ffff7
aml_nand_save_rsv_info:716,save info to 300000
aml_nand_write_rsv:520,write info to 300000
[burnup]Rd:Up sz 0x3fb800 to align 0x1000
save_power_post ...
## Booting Android Image at 0x01080000 ...
reloc_addr =70343f0
copy done
load dtb from 0x1000000 ......
      Amlogic multi-dtb tool
      Cannot find legal dtb!
ERROR: image is not a fdt - must RESET the board to recover.
load dtb from 0x751e3f0 ......
      Amlogic multi-dtb tool
      Multi dtb detected
      Multi dtb tool version: v2 .
      Support 2 dtbs.
        aml_dt soc: xiaomi platform: lx06 variant: v02
        dtb 0 soc: xiaomi   plat: lx06   vari: v01
        dtb 1 soc: xiaomi   plat: lx06   vari: v02
      Find match dtb: 1
amlkey_init() enter!
amlnf_key_read key data len too much
aml_nand_read_rsv_info:397,read nkey info to 418000
[EFUSE_MSG]keynum is 4
   Uncompressing Kernel Image ... OK
   kernel loaded at 0x01080000, end = 0x0185c808
   Loading Ramdisk to 06ea7000, end 070044e8 ... OK
   Loading Device Tree to 0000000006e9b000, end 0000000006ea6036 ... OK

Starting kernel ...

uboot time: 1744073 us
domain-0 init dvfs: 4
[    0.295610@1] ff803000.serial: clock gate not found
[    0.303003@3] amlogic-new-usb3 ffe09080.usb3phy: This phy has no usb port
[    1.200959@0] hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
LED AW20054
LX06
curr_boot is boot0
Booting from boot0
/dev/mtdblock4 is ready now.
[    2.654191@2] meson-pinctrl pinctrl@ff634480: function 'gpioa_20' not supported
[    2.655861@2] meson-pinctrl pinctrl@ff634480: invalid function gpioa_20 in map table
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Please press Enter to activate this console.
[    9.038132@0] name: mac_wifi, size 17
[    9.045326@0] name: mac_bt, size 17
[    9.052532@0] name: mac_bt, size 17
ledserver[1253]: current model lx06.

ledserver[1253]: LEDSBAK EXISITS

ledserver[1253]: handle_show start

ledserver[1253]: start_show effect_id is 4 is_working is 0

ledserver[1253]: start_show end

ledserver[1253]: thread_push_led start

ledserver[1253]: handle_show stop

ledserver[1253]: thread_push_led end

crond[1292]: crond (busybox 1.27.2) started, log level 5

ledserver[1253]: light_show_control 4

ledserver[1253]: open_light start

ledserver[1253]: light_show_effect 4

ledserver[1253]: light_shut start

ledserver[1253]: light_shut end

ledserver[1253]: call light_04_lx06

[   19.647913@3] Bluetooth: command 0xfc19 tx failed (-56)
[   19.647913@3]
f
mico login:
Login timed out after 60 seconds
Please press Enter to activate this console.

mico login: root
Password:
Login incorrect
mico login: root
Password:
Login incorrect
mico login:
Login timed out after 60 seconds
Please press Enter to activate this console.

mico login:
mico login:
mico login: root
Password:

Login incorrect
mico login: root
Password:
Login timed out after 60 seconds
Please press Enter to activate this console.
root
mico login: root
Password:
Login incorrect
mico login:
Login timed out after 60 seconds
Please press Enter to activate this console.

使用小爱音箱 root 密码算号器算出来的密码输入无效，又自动跳转到mico login: 请教楼主，如果回不去，mico login:应该填什么？那么登录密码应该是什么？謝謝

soon700221

請問樓主 我做到這個階段就卡住了 可以幫幫我嗎圖一是小愛內的m4.img無法將檔案傳到192.168.1.34的LINUX
圖二是使用winscp連不到小愛內部 小愛是192.168.1.33
在我把winscp的帳號改為LX06之後 有出現連進去畫面了 但是密碼我輸入MD5產生的14位密碼卻無效????
後來我在Winscp裡面 帳號輸入root 密碼先不輸入 等連線畫面出現要輸入密碼時 再輸入14位密碼就登入了

hhxxttxsok

楼主你好，已经刷写好了1.66.8固件，请问怎么拦截小爱接入ha?麻烦大佬能给发个拦截程序吗？十分感谢