jjm2473

RTD1619 Unbrick

2021/03/01
Read this page in a different language:

Only Z9X now

I don’t have a Z9X, this guide is experience when help others unbrick their Z9X

Any question, please issue on github

Term explanation

Term Explanation
Target The device that needs to be flashed, here is your box
Host The device performing the interaction, which is the PC you are using

Unbrick with TTL/UART

First of all, we should be able to connect to the UART. Here is the photo provided by forum user Markswift2003: Z9X UART Connection

Restore FWTABLE Signature

If you get stuck when flash before, it is likely that the signature of fwtable (similar to the partition table) is destroyed, and the machine can no longer be flashed. In this case, just restore the fwtable signature.

  1. Shutdown the target device

  2. Connect UART, then hold the ESC key in the terminal and turn the target device on, until the terminal displays *** ESC Pressed *** (may not be the last line) or when the terminal is no longer scrolling, then release the ESC key. At this time, press the Enter key several times it should displays Realtek>

  3. Execution help in terminal, will display all supported commands, confirm whether they are included rtkemmc, dw and mw, if not, do not continue

  4. Execution rtkemmc read 0x03000000 20744 512 in terminal, it will load the header of fwtable to memory

  5. Execution dw 0x03000000 8. If it says 43534552 5f5f4555, goto next step; If it says 4f524556 5f5f414e, it means that the signature of fwtable is ok, we don’t need to touch it, we should try Unbrick with UART + U Disk, do not continue next step; If not either of both, I don’t know what’s going on, do not continue

  6. Execution mw 0x03000000 0x4f524556

  7. Execution mw 0x03000004 0x5f5f414e

  8. Execution dw 0x03000000 8. It should displays 4f524556 5f5f414e

  9. Execution rtkemmc write 0x03000000 20744 512, it will write back the header to fwtable

  10. Shutdown

Signature of fwtable was restored, now we can follow the official guide to flash the target device. If it still fail in flashing, then try the Unbrick with UART + U Disk

Unbrick with UART + U Disk

Usually you can use this method to restore the firmware, unless uBoot is broken.

Prepare a U disk with 2GB or more space, if it is not in FAT32 format, format it as FAT32.

If you can get to this point, you must have tried the official flash tutorial (Z9X ), I believe you already have install.img。 Copy the install.img to the root directory of the U disk.

Download z9x_flash_rescue.zip, then unzip it to the root directory of the U disk.

We should have at least these files in the root directory of the U disk:

  • z9x_flash_rescue.bin
  • install.img

The U disk is ready.

Flash process：

  1. Shutdown the target device and plug in the U disk

  2. Connect UART, then hold the ESC key in the terminal and turn the target device on, until the terminal displays *** ESC Pressed *** (may not be the last line) or when the terminal is no longer scrolling, then release the ESC key. At this time, press the Enter key several times it should displays Realtek>, it means that you have entered the uBoot console

  3. Execute help in terminal, will display all supported commands, confirm whether they are included usb, fatload and boot, if not, do not continue, try other solutions

  4. Execute usb start, this step enables USB and scans the USB devices, it will take a few seconds, and it will display Realtek> on finished. Check if there is any Storage Device(s) found in the output. If not, change the USB slot and perform this step again

  5. Execute fatload usb 0:1 0x20000000 z9x_flash_rescue.bin, If there was any error, change 0:1 to 0:2 0:3 or 0:4 and try again, depending on the partition of the U disk

  6. Execute rtkemmc write 0x20000000 20744 172032000, it will take a few moment to write emmc

  7. Execute rtkemmc erase 7704968 7737736, it will erase boot logo, avoiding checksum verifing fail

  8. Execute boot r, the flashing will start soon without superise

Unbrick with UART + TFTP + U Disk

Usually you can use this method to restore the firmware, unless uBoot is broken.

Please try the “Unbrick with UART + U Disk” solution first, if it not works, then try this.

This solution requires:

  • U Disk
  • Network cable (for the target machine to access TFTP)

If uBoot does not support usb or fatload commands in the “Unbrick with UART + U Disk” solution, but supports the net command, and tftp appears when the net command is executed, then tftp can be used to load the flashing environment.

Prepare a U disk with 2GB or more space, if it is not in FAT32 format, format it as FAT32.

Copy the install.img mentioned above to the root directory of the U disk so that the U disk is ready.

Prepare a TFTP server, or deploy TFTP service on the Host, Windows users refer to this, Mac users refer to this.

Download z9x_flash_rescue.zip, then unzip it to the TFTP root directory. So we have z9x_flash_rescue.bin in TFTP root directory.

In this way, the TFTP service is also ready.

Flash process：

  1. Shutdown the target device and plug in the U disk

  2. Connect UART, then hold the ESC key in the terminal and turn the target device on, until the terminal displays *** ESC Pressed *** (may not be the last line) or when the terminal is no longer scrolling, then release the ESC key. At this time, press the Enter key several times it should displays Realtek>, it means that you have entered the uBoot console

  3. Execute help in terminal, will display all supported commands, confirm whether they are included net and boot, if not, read the PS below

  4. Configure the target network. First try DHCP automatic configuration, by execute net dhcp_client, it should output DHCP client start, wait a few seconds, if there is output netif en ip ..., then go to the next step; if there is no output, then manually configure the network, execute net ifconfig <IP address> <mask> 0.0.0.0, pay attention to replace <IP address> and <mask> with appropriate values ​​(if the TFTP server is in the internal network, it only needs to be in the same subnet as the TFTP server) (if Your TFTP service is on the external network, you need to replace 0.0.0.0 with the real gateway address, usually the router IP)

  5. Execute net ping <TFTP server IP> (replacing <TFTP server IP> with the IP of the TFTP server). If the network configuration is ok, it will output multiple ping: send ... and ping: recv .... When it is no longer outputting, press Enter to return to the console. If there is no output of ping: recv ..., there should be a problem with the network configuration, please solve it yourself.

  6. Execute env set tftpblocksize 1468; net tftp 0x20000000 <TFTP server IP> z9x_flash_rescue.bin (replace <TFTP server IP> with the IP of the TFTP server). If there is a stuck, it may be that there is a problem with the TFTP service, or the firewall has blocked the TFTP communication. After troubleshooting these problems, you need to restart from the step 1.

  7. Execute rtkemmc write 0x20000000 20744 172032000, it will take a few moment to write emmc

  8. Execute rtkemmc erase 7704968 7737736, it will erase boot logo, avoiding fail on checksum verifing

  9. Execute boot r, the flashing will start soon without superise

PS: If there is not net command in uBoot, but tftp exists, replace step 3 to 6 by execute:

   env set ipaddr <IP address>
   env set serverip <TFTP server IP>
   env set tftpblocksize 1468
   tftp 0x20000000 z9x_flash_rescue.bin

PPS: If there is not boot command in uBoot, try go instead

Attachments：

Post Directory