[HowTo] DIY Unbrick Zgemma H8.2h and others

There are 5 replies in this Thread which was already clicked 4,334 times. The last Post () by alexias.

    Hello,

    Since it's good to find information when we're in trouble, I decided to share my experience of doing something wrong that corrupted my bootloader and how I solved the problem, since this information will certainly help someone else! I decided to share because in the research I did only found little information, "poorly put together" and incomplete.


    Due to a problem with the bootloader and/or information from other partitions that came from the factory on a number of these boxes (I have tested others that did not suffer from this problem), if I put the receiver in deep standby, it would never wake up again without being disconnected from power. Since I tend to flash some of these receivers remotely via ofgwrite rather than loading a full recovery image via usb, I tried flashing some of these partitions manually in search of resolving this issue.


    One of the times I flashed the mtd0 /boot partition, for some reason it became corrupted and the box died (bricked), leaving only the white LED on and not allowing me to do absolutely anything else, including reflashing via USB. So, I got to work to solve the problem.


    Code
    flash_erase /dev/mtd0 0 0 && nandwrite -pm /dev/mtd0 /tmp/fastboot.bin


    The solution that seemed most obvious to me was to try to recover via serial/rs232 ttl, and these are the steps I will explain.


    I used a direct USB to TTL serial interface so we immediately had the necessary GND, TX, RX, 5V connections.


    1.jpeg



    As I tend to deal with this type of thing a lot, I have several, but in this case I used a Profilic PL2303hxa, probably from Aliexpress or Ebay, which I've had for a few years. When trying to use it in Win11, I immediately had a problem with the driver where it gave me a message in the name of the interface something like "PL2303HXA. Phased out since 2012. Please contact your supplier", which for anyone who has the same problem may resolve here:


    PL2303HXA. Phased out since 2012. Please contact your supplier. · Issue #1 · microsoft/farmbeatsforstudents
    Using the retail kit, when I click Connect a Device in the Data Streamer tab in Excel I see this in the dropdown. Using a different usb serial cable (from the…
    github.com

    or

    Redirecting


    Then I used putty to see if I could communicate with the h8. I only used GND, RX and TX. I didn't connect the 5v as it wasn't necessary because the box is powered by its source and the Profilic interface is powered by USB, so one doesn't need to power the other.



    I used a baudrate of 115200,8,1,0 .


    I wasn't precise on the Rx/Tx connection point because I honestly don't know which is which. When there is no communication, I exchange one with the other! The colors I used in the image match those of my TTL interface wires.


    2.jpg


    Then it was time to use the Hisilicon tool to flash the bootloader. Please note that you need to select the correct CPU. In this case it is the "Hi3716MV430" which was possible to confirm through the information obtained in the communication from putty!


    I tried to get a relatively recent version to make sure it would already support this CPU.

    I used version "HiTool-5.3.1.2", which you can download from:

    HiTool-5.3.1.2-OV
    www.mediafire.com


    After choosing the CPU, you must click on "HiBurn", choose Transfer Mode = Serial, choose the COM port assigned to your interface, choose the "Burn Fastboot" tab, flash type "spi nand/nand" and in "file" enter the "fastboot.bin" file that accompanies any full recovery image for your receiver.


    3.jpg


    Follow the instructions to connect power to the receiver so that it starts sending the bootloader as soon as it turns on!

    You should have an output like this:



    After the bootloader is successfully written, the equipment will restart on its own and should be working if there are no more problems. In any case, if there is still a problem with the image, from here you can do the flash/recovery process via USB again as before brick, following the usual steps.


    I hope this information helps not only recover the H8, but all other equipment that can be recovered this way!


    Good luck!

  • oktus

    Approved the thread.

    Hi.

    I have same problem with H9.2H receiver.

    I followed procedure and load correctly fastboot.bin using serial and HiTool.

    But receiver not boot and Is not possibile load firmware using USB by reset button etc...

    Need I .xml file?

    Any suggest?

    Thanks in Advance.

    Edited once, last by agnagna ().

    Hi,

    Did you select the correct chipset for h9?


    In your case it will not be the "Hi3716MV430".

    You can check it by logging the serial when you plug the power (see my first log)

    After flashing fastboot the h9 should start to bootlogo and you should be able to load complete firmware from usb.


    You only need the xml file to flash more partitions. The xml has its addresses.


    The are h9 and h9se. Are you using the correct boot and firmware?


    Good luck!

    I tried to apply this method to H9S_SE, this model has eMMC memory, it needs to be programmed only in the tab "Burn by Partition (spi/nand/emmc)" and we need file emmc_partitions.xml . Where to find it for our boxes ?

    Hello everyone. I recently purchased a Zgemma H8.2H and suddenly the bulb didn't turn on at all and I couldn't communicate with it at all.

    I found the tutorial here and repeated the steps indicated by NOKIAS, but at the end of the process I find this message.

    The device communicates with the PC and the front bulb turns on, but when I unplug it from the outlet it simply doesn't do anything. Any suggestions where I'm wrong would be welcome.

    Sorry, I translated with Google...


    Thanks.


    Zgemma H8.jpg



    Platform Version: 5.3.12

    HiBurn Version: 5.2.19

    HiSilicon Technologies Co., Ltd. All rights reserved. (C) 2011-2019

    Mod: Hi3716MV430



    Platform Version: 5.3.12

    HiBurn Version: 5.2.19

    HiSilicon Technologies Co., Ltd. All rights reserved. (C) 2011-2019

    Mod: Hi3716MV430




    SerialPort has been connented, Please power off, then power on the device.

    If it doesn't work, please try to repower on.


    Bootrom start

    Boot Media: NAND

    ####################################################################### ---- 9%

    ####################################################################### ---- 19%

    ####################################################################### ---- 29%

    ####################################################################### ---- 39%

    ####################################################################### ---- 49%

    ####################################################################### ---- 59%

    ####################################################################### ---- 69%

    ####################################################################### ---- 79%

    ####################################################################### ---- 89%

    ####################################################################### ---- 99%

    # ---- 100%


    Decrypt auxiliary code ...OK

    Enter boot auxiliary code


    Auxiliary code - v1.00

    DDR code - V1.2.1 20160503

    Build: Sep 27 2018 - 23:35:13


    Reg Version: v1.1.0X

    Reg Time: 2018/10/24 21:31:57

    Reg Name: hi3716mv43dma_hi3716mv430_DDR3_512MB_16bitx1_2layers.reg


    SVB...done!


    DDR HW training...done!


    DDR SW training......done!


    Set cpu freq

    Reg init success


    Boot auxiliary code success


    Bootrom success



    System startup



    Relocate Boot


    Jump to C code



    Fastboot 3.3.0-dirty (h8@zgemma_dev) (Sep 14 2021 - 13:41:35)


    Fastboot: Version 3.3.0

    Build Date: Sep 14 2021, 13:42:02

    CPU: Hi3716Mv430

    Boot Media: NAND

    DDR Size: 512MB


    Found flash memory controller hifmc100.

    no found nand device.

    Using default environment





    *******************************


    serial: 537000179A2B31C7

    mac: 00:17:9A:2B:31:C7


    *******************************


    Net: upWarning: failed to set MAC address

    , downWarning: failed to set MAC address



    Boot Env on NAND

    Env Offset: 0x00100000

    Env Size: 0x00010000

    Env Range: 0x00010000

    *** Warning - Env offset is NOT aligned to NAND Flash block size, environment value is read only.


    start download process.

    Boot started successfully!


    Send command: getinfo version

    version: 3.3.0

    [EOT](OK)


    Send command: getinfo bootmode

    nand

    [EOT](OK)


    Send command: getinfo nand

    no find nand

    [EOT](OK)

    Failed to load blocksize for nand




    Code
    When the process is finished I get this error.
Failed to load blocksize for nand....

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!

Register Yourself Login