Skip to content

Unbrick the cam

Jump to bottom
roleo edited this page Jan 7, 2022 · 10 revisions

If the camera no longer starts, wait before throwing it out the window. Probably the backup partition is broken but the bootloader is ok, therefore you have a couple of chances to restore it.

This page is also useful if you want to remove the hack and restore the cam to the factory software.

There are two different ways to unbrick the cam:

  1. The soft way doesn't need to use a soldering iron and is described here:

    https://github.com/roleoroleo/yi-hack-Allwinner-v2/tree/master/unbrick

  2. The hard way is described below.

    But to do this, you need to connect the serial port and type some commands using the console.

This guide is based on model y21ga. If your model is different, please check the mtd partition table and adjust hex addresses as needed.

Prepare SD card

Probably your backup partition is broken, so you need a backup copy to restore it. If you followed the backup procedure then you should have the mtdblock4.bin file, which is the backup partition you need. Copy the file to the SD card and insert it to the cam.

Physical connection

  1. Open the cam removing screws.
  2. Find the 3 uart pads (TX, RX and GND). Where are they? It depends on the model, on the y21ga model there are the labels. Example (thanks to @lassieee for the picture):

serial

  1. Connect the pads to a ttl-rs232/usb adapter (rx, tx and GND).
  2. Open putty with logging enabled.
  3. Switch on the cam. Now, if the connection is ok, you will see the uboot and kernel logs on the screen. Otherwise, restart from point 2.
  4. Stop the boot at the U-Boot prompt (should be "=>") pressing "Enter".

Now you have a physical connection to the cam and you can use all the uboot commands.

Restore backup partition

Type the following commands and check the output response:

  1. Enable the SD card:
=> sunxi_card0_probe
[23.298]get mem for descripter OK !

card_caps:0x30000002
host_caps:0x3000003f
  1. List the content of the SD card:
=> fatls mmc 0
            record/
     2502   lower_half_init.sh
            newbackup/
            yi-hack/
  1245184   mtdblock4.bin
            Factory.done/
            log/

2 file(s), 5 dir(s)
  1. Load the file mtdblock4.bin from SD to RAM memory (address 0x45000000):
=> fatload mmc 0 45000000 mtdblock4.bin
1245184 bytes read in 1002 ms (11.5 MiB/s)
  1. Enable SPI bus and detect flash chip:
=> sf probe
sf: bus-0 cs-0 spedd-50000000Hz mode-3000
SF: Detected en25qh128 with page size 256 Bytes, erase size 64 KiB, total 16 MiB
  1. Get the parameters for erase and write commands

To run the last command you need 3 parameters:

  • address: the RAM address used above (45000000)
  • offset: is the offset in flash where mtdblock4 starts

According to the table below it's 690000 = 60000 + 1d0000 + 120000 + 340000

root@xiaoyi:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00060000 00001000 "uboot"
mtd1: 001d0000 00001000 "boot"
mtd2: 00120000 00001000 "rootfs"
mtd3: 00340000 00001000 "home"
mtd4: 00130000 00001000 "backup"
mtd5: 00020000 00001000 "env"
mtd6: 00010000 00001000 "mfg"
mtd7: 00010000 00001000 "conf"
mtd8: 00000000 00000000 "UDISK"
  • len: len of the file mtd4block.bin

copy it from the output of the fatload command and convert it to hexadecimal (1245184 => 130000)

  1. Erase the flash memory using parameters above:
=> sf erase 690000 130000
SF: 1245184 bytes @ 0x690000 Erased: OK
  1. Write the file from RAM memory to SPI flash using parameters above:
=> sf write 45000000 690000 130000
device 0 offset 0x690000, size 0x130000
SF: 1245184 bytes @ 0x690000 time:14825 ms Written: OK
  1. Reset and cross your fingers.
=> reset
Clone this wiki locally