Skip to content

Unbrick the cam

Jump to bottom
roleo edited this page Sep 22, 2022 · 15 revisions

If the camera no longer starts, wait before throwing it out the window. Probably the home partition is broken but the bootloader is ok, therefore you have a couple of chances to restore it.

This page is also useful if you want to remove the hack and restore the cam to the factory software.

There are two different ways to unbrick the cam:

  1. The soft way doesn't need to use a soldering iron and is described here (thanks to @74ls04):

    https://github.com/roleoroleo/yi-hack-Allwinner/tree/master/unbrick

  2. The hard way is described below.

    But to do this, you need to connect the serial port and type some commands using the console.

See this post for more details: https://github.com/roleoroleo/yi-hack-Allwinner/issues/365

Prepare SD card

Probably your home partition is broken, so you need a backup copy to restore it. If you followed the backup procedure then you should have the mtdblock3.bin file, which is the home partition you need. Copy the file to the SD card and insert it to the cam.

Physical connection

  1. Open the cam removing screws.
  2. Find the 3 uart pads (TX, RX and GND). Where are they? It depends on the model, on the y20ga model there are the labels. Example: serial
  3. Connect the pads to a ttl-rs232/usb adapter (rx, tx and GND).
  4. Open putty with logging enabled.
  5. Switch on the cam. Now, if the connection is ok, you will see the uboot and kernel logs on the screen. Otherwise, restart from point 2.
  6. Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".

Now you have a physical connection to the cam and you can use all the uboot commands.

Restore home partition

Type the following commands and check the output response:

  1. Enable the SD card:
=> sunxi_card0_probe
[23.298]get mem for descripter OK !

card_caps:0x30000002
host_caps:0x3000003f
  1. List the content of the SD card:
=> fatls mmc 0
            Factory.done/
  3246161   home_y20gam.done
            record/
 67108864   swapfile
            fw_upgrade/
            log/
            newhome/
 12058624   mtdblock3.bin

3 file(s), 5 dir(s)
  1. Load the file mtdblock3.bin from SD to RAM memory (address 0x45000000):
=> fatload mmc 0 45000000 mtdblock3.bin
12058624 bytes read in 1002 ms (11.5 MiB/s)
  1. Enable SPI bus and detect flash chip:
=> sf probe
sf: bus-0 cs-0 spedd-50000000Hz mode-3000
SF: Detected en25qh128 with page size 256 Bytes, erase size 64 KiB, total 16 MiB
  1. Get the parameters for erase and write commands

To run the last command you need 3 parameters:

  • address: the RAM address used above (45000000)
  • offset: is the offset in flash where mtdblock3 starts

According to the table below it's 440000

root@xiaoyi:/# cat /proc/mtd
dev:    start    size   erasesize  name
mtd0: 00000000 00080000 00010000 "uboot"
mtd1: 00080000 00240000 00010000 "boot"
mtd2: 002C0000 00180000 00010000 "rootfs"
mtd3: 00440000 00b80000 00010000 "home"
mtd4: 00fc0000 00020000 00010000 "env"
mtd5: 00fe0000 00010000 00010000 "mfg"
mtd6: 00ff0000 00010000 00010000 "conf"
mtd7: 00000000 00000000 00000000 "UDISK"
  • len: len of the file mtd3block.bin

copy it from the output of the fatload command and convert it to hexadecimal (12058624 => b80000)

  1. Erase the flash memory using parameters above:
=> sf erase 440000 b80000
SF: 12058624 bytes @ 0x440000 Erased: OK
  1. Write the file from RAM memory to SPI flash using parameters above:
=> sf write 45000000 440000 b80000
device 0 offset 0x440000, size 0xb80000
SF: 12058624 bytes @ 0x440000 time:14825 ms Written: OK
  1. Reset and cross your fingers.
Clone this wiki locally