HiSense 65H6510G no boot

[howardc64]

Re: HiSense 65H6510G no boot

all these except MAC are licenses for Brand & specific Soc. all TV same Brand share the same LIC. there are no separated LIC. KEY will Generated according TV Model ESN

its the same to Android TV Box. Amlogic for example give each manufacture of brand LIC can be burned on all boxes.

ah ok, if license keys are public, then just need to get from another working HiSense I guess.

did you tried to have the MB solo and feed it 3.3V from yours TTL and see how the log will be

What do you mean by MB solo and feed 3.3v from TTL? What to disconnect and connect?

[lotas]

Re: HiSense 65H6510G no boot

So 3.3v from usb - uart will not pull the 3.3v bus of the motherboard, the amperage is small.

[howardc64]

Re: HiSense 65H6510G no boot

So 3.3v from usb - uart will not pull the 3.3v bus of the motherboard, the amperage is small.

Yes, furthermore, UART goes through SOC and SOC need 2x 1V rails to run CPU etc. and 1.5V for DRRAM, eMMC need 1.8v + 3.3v.

Probably can drive by external power supply 12V but then no difference from PSU power unless PSU 12V has problem. I think no reason to suspect PSU 12V. All rails have clean DC and 0V AC.

[Diah]

Re: HiSense 65H6510G no boot

folks you are not going to power on ..the MB...

how MB after manufacturing. put it on programmer base... its is 3.3V level... if you didn't saw this in real then okay.

[lotas]

Re: HiSense 65H6510G no boot

This is when you solder to the eMMC via isp and power it with a programmer, and then the programmer does not always pull out its 3.3v, you have to connect additional power.
To remove the log, you only need Tx, Rx and GND and 3.3v does not need to be supplied from the uart adapter at all.

[howardc64]

Re: HiSense 65H6510G no boot

This is when you solder to the eMMC via isp and power it with a programmer, and then the programmer does not always pull out its 3.3v, you have to connect additional power.
To remove the log, you only need Tx, Rx and GND and 3.3v does not need to be supplied from the uart adapter at all.

Ok I understand more now. Never experienced eMMC ISP Before.

I think @Diah is suggesting to use my USB TTL UART dongle to pull some kind of log from eMMC. I google for 1 hour and can not find any info. Any links or hints? I guess eMMC CMD/D0/GND must be connected to RX/TX/GND? And then run some tool (ISP app?) to ask for log?

[lotas]

Re: HiSense 65H6510G no boot

And what about the "CLK" signal?

[lotas]

Re: HiSense 65H6510G no boot

log boot mstar

[howardc64]

Re: HiSense 65H6510G no boot

log boot mstar

Thanks! Mine didn't get very far haha... Looks like a bunch of key checks in the log.

[viewerau]

Re: HiSense 65H6510G no boot

I'm out of my depth here...could this info help in any way?

https://cdn.badcaps-static.com/pdfs/...cfd645b8af.pdf

[howardc64]

Re: HiSense 65H6510G no boot

I'm out of my depth here...could this info help in any way?

https://cdn.badcaps-static.com/pdfs/...cfd645b8af.pdf

Thanks for the link. Mine doesn't get that far due to likely failed eMMC.

However, this is a newer MT9602 service manual from 2021. Mine on post #1 is MSD6886 (my SOC) from 2018. So its useful to compare the two (looks very similar if not identical)

[howardc64]

Re: HiSense 65H6510G no boot

Resurrecting this tread on a dead eMMC...

TV fixed with replacement board

Bought a main board from TVPartsToday for $52+$17 ship and TV booted up working. These boards are rare (Seems most Android TV boards are rare and expensive). Probably something about these Android (version 9) TVs thats killing the eMMC.

The purchased TV board may have eMMC replaced? (SN = 000000000000000) see pic

Comparing KEYs

Just repaired a HiSense 75H6570G with failed backlight. Both TVs are the same MSD6886 SOC/Chassis and generally similar main board design. Compared the KEYs between the 75 and the repaired 65 with replaced main board.

- Widevine, HDCP1.4, HDCP2.2, Attestation keys are all *.bin (Is this the key or actual key in a bin file in firmware?)
- What is MGK?
- Widevine, HDCP1.4, HDCP2.2, Attestation, MGK, and Netflix are all different between the 2 TVs
- Only key that is same is playstore key ( playready30 )
- Are there other keys I should retrieve/compare?
- Firmware version (listed in USA his eng) are identical to hisense support website firmware downloads file names (after entering SN) for both TVs

Like to Repair the eMMC of the failed board

Since I have working replacement main board. Like to repair the failed eMMC board if possible. Are these the basic steps?

- Freeze failed eMMC (or ISP) to recovery keys if possible
- Extract mboot from good board and program failed board with new eMMC (ISP with sufficient 3.3v current after soldering okay?)?
- Service manual does have a section on TV board without mboot (p38) but doesn't tell what to do other than remove UART connection. I doubt can install USB firmware without mboot.
- USB update firmware after mboot installed
- Reinstall keys

Is this understanding correct? Since my replacement board has no SN, it might be repaired so it seems repair process is possible if know the recipe.

Pics

Blocked out a few digits on the keys for security. But everything except Playstore key is different. I don't know if just because different TVs. Maybe the same models are the same keys? Can anyone confirm?

65H6510G Replacement Main Board



75H6570G Original Main Board

[Diah]

Re: HiSense 65H6510G no boot

i mixed by my answer on other plat forum... both are Android.. the keys are not as i wrote before... they are .bin file burned and placed at the keys section at first of bootloader...

you just check if the replacement MB since no SN. if it had fixed LAN MAC address. or it change the MAC at each boot

[howardc64]

Re: HiSense 65H6510G no boot

i mixed by my answer on other plat forum... both are Android.. the keys are not as i wrote before... they are .bin file burned and placed at the keys section at first of bootloader...

you just check if the replacement MB since no SN. if it had fixed LAN MAC address. or it change the MAC at each boot

Thanks for the .bin info. I'll research how to use my UART to USB dongle to dump eMMC data+files and see what I can retrieve/parse.

The LAN MAC address remained same on every reboot AND a reset. You provided interesting hint. Maybe also need to also find original eMMC LAN MAC and program into new eMMC? But I guess maybe not so important if most people use wifi?

[Diah]

Re: HiSense 65H6510G no boot

Android LAN MAC are dummy fixed by writing it key... LAN mac will take action only if there are LAN connected and an IP assigned to it..... other wise the Android will listed only WIFI MAC as it fixed in CHIP of the module.

[howardc64]

Re: HiSense 65H6510G no boot

Android LAN MAC are dummy fixed by writing it key... LAN mac will take action only if there are LAN connected and an IP assigned to it..... other wise the Android will listed only WIFI MAC as it fixed in CHIP of the module.

Ok thx, I connected LAN and got new MAC instead of dummy as you said

[howardc64]

Re: HiSense 65H6510G no boot

Some interesting info on eMMC health of 2 HiSense Android TVs with same MSD6886 SOC

75H6570G appears to be original main board

- Runtime is ~480 days or 11,500 hours
- 1/84 LED failed (followed by backlight replacement)
- UART log shows following eMMC health

eMMC: HS400 5.1 200MHz
eMMC 7.28 GB
ecsd 267:0x01 msg:eMMC pre_eol_info normal
ecsd 268:0x01 msg:eMMC SLC mmc type 0%%-10%% device life time used
ecsd 269:0x01 msg:eMMC MLC mmc type 0%%-10%% device life time used

65H6510G with replacement main (likely repaired with new eMMC)

- Original failed eMMC main board mainly used with firetv for smart/streaming feature (owner provided info)
- Runtime is ~4 days on replacement board
- UART log shows following eMMC health

eMMC: HS400 5.1 200MHz
eMMC eMMC 7.28 GB
ecsd 267:0x01 msg:eMMC pre_eol_info normal
ecsd 268:0x01 msg:eMMC SLC mmc type 0%%-10%% device life time used
ecsd 269:0x01 msg:eMMC MLC mmc type 0%%-10%% device life time used

Summary

11k+ hour eMMC has same health as 4 days eMMC (<10% wear). Both shows kernel and security patch in 2021. Maybe flash memory write cycle isn't what is killing these eMMCs... Maybe the firmware has a poor code section accessing eMMC during power interruption? Maybe the preventive solution is an UPS (Uninterruptible Power Supply)? It seems many failure cases involves power outage shortly before failure.

[howardc64]

Re: HiSense 65H6510G no boot

Probably giving up trying to repair failed eMMC on main board. Require some tool investment and unknown outcome on this failed eMMC (doesn't read at all) But want to ask a couple of questions before surrendering

I think there are 3 ways to read eMMC data

MSTAR ISP Tool

I run version 5.0.8 provided by @lotus in post #76 on Win10. exe file doesn't launch. Downloaded other versions of MSTAR ISP Tool and same result (doesn't launch). I guess the tool probably require MSTAR burner programmer? ( aliexpress link ) and will not work with generic USB to UART dongles?

ISP Programmer

solder CMD/D0/GND/CLK with sufficient current 3.3v current. Alternative to use programming boxes like RT809H (although removing failed eMMC with heat probably will kill the data access)

telnet/ftp

This is a favorite method of modder community ( link ) to modding files on eMMC. But these surely are limited to files rather than mboot partition dump?

====

If any path works on a good HiSense MSD6886 main board (practice), then can try to freeze failed main board eMMC and see if can dump data with unknown success. Failed eMMC doesn't read at all and not sure how long it takes to dump mboot and if need to froze during the entire data dump process ( practice on good eMMC first to avoid delays is probably good idea )

Dumping and using eMMC data from other main boards seems like it will encounter security key problem and lose many main board feature.

Anyway, given the tool investment, no much well published steps ( need to practice on good main/eMMC ) and unknown success results. Probably have to give up

[howardc64]

Re: HiSense 65H6510G no boot

MSTAR console provide an easy command to dump boot1/boot2/emmc (I presume emmc is eMMC's user partition) bin files to USB stick. I retrieved all 3 bin files from a good main board.

boot1.bin 12.6MB
boot2.bin 12.6MB
emmc.bin 3.52GB (took like 20min+ to dump to USB stick)

- I think uboot is in boot1 but mboot is probably in user area? (needs kernel + device tree to perform the many MSTAR console features)
- Are the various security keys in boot1/boot2?
- What about RPMB ( Replay Protected Memory Block ) partition on eMMC? Surely some streaming security stuff are in here? How to read this?
- What about ECSD (Extended Card Specific Data) register? Looks like ECSD provide info on how to parse eMMC
- If boot1/boot2/user partition of failed eMMC board can be read (will take awhile to dump user, will the failed eMMC need to be frozen this whole time?) Is it possible to just copy to new eMMC, boot mboot then follow USB firmware update procedure?

Here is a quick review of eMMC partitions ( link ) p6-7 gives good overview of what is stored where

Attached is the complete MSTAR console command list

====

Placing per device data in eMMC seems like a problem from cost cutting. Its best to put per device data like keys in more durable storage. Probably the sellers of preprogrammed eMMC can only provide for boards that avoided this cost cutting problem.

[Diah]

Re: HiSense 65H6510G no boot

there are tool to read the Mstar firmware extractor key... hope i could find it on my pc..... 2 time i had format it lol