安博盒子第四代UBOX4を分解検討
安博盒子第四代UBOX4を分解検討

安博盒子第四代UBOX4を分解検討

今まで日本のテレビとかムフフな動画鑑賞に我が家には無くてはならない 安博盒子 、PROS2に買い換えて引退した UBOX4 をバラしてみました。その技術的記録です。第四代UBOX4は、オクタコア搭載のいわゆるAndroid TV Boxで、2017年に発売されました。

www.unblocktech.com 3 Pockets安博盒子四代UBOX Gen.4 pro bt - 安博電視直播盒子，功能超乎您的想像，1000多個...安博盒子第四代全新軟件升級，小小盒子，帶給您無限精彩，功能超乎您的想像。安博盒子可以看到多個國家或地區的直播節目，直播頻道數量超過 1000 個。

図1.外観

本体裏面の各辺にこのようなツメでとまっているだけなので、これを各辺少しずつこじって開きます（ネジはありません）。

図2.裏面フタのツメ

内部構造はとてもシンプル。基板は上部ケースに逆さに配され、下部のフタには放熱用と思われる金属板が貼ってあります（アルミホイル程度ではなく、立派な板です）。

図3.内部全景

基板の赤外線受信部コネクタ付近には、シリアルコンソール用のピンヘッダがハンダ付けされています。

図4.基板高解像度

ネジを3本外すと基板は外れます。下図左端の青いWiFi+BTのRTL8723BUには、アンテナ線がコネクタではなく直付けされていました。

図5.基板裏高解像度

せっかくなのでシリアルを覗いてみましょう。基板にマイナスとプラスは印字されているので、残るTX、RXを類推するだけなので簡単。次のようなピンアサインになっていることを突き止めました。尚、通信速度は115,200bpsです。

図6.シリアルピン配置

図7.母艦PCとシリアル接続

次のような起動の様子を拝むことが出来ました。

HELLO! BOOT0 is starting! boot0 commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 boot0 version : 4.0 set pll start set pll end rtc[0] value = 0x00000000 rtc[1] value = 0x00000000 rtc[2] value = 0x00000000 rtc[3] value = 0x00000000 rtc[4] value = 0x00000000 rtc[5] value = 0x00000000 DRAM BOOT DRIVE INFO: V0.6 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 the chip id is 0x00000001 axp not exist DRAM CLK =624 MHZ DRAM Type =3 (2:DDR2,3:DDR3,6:LPDDR2,7:LPDDR3) DRAM zq value: 0x003b3bf9 DRAM SIZE =1024 M DRAM simple test OK. dram size =1024 card no is 2 sdcard 2 line count 8 [mmc]: mmc driver ver 2016-03-15 20:40 [mmc]: ***Try MMC card 2*** [mmc]: MMC 5.0 [mmc]: HSDDR52/DDR50 8 bit [mmc]: 50000000 Hz [mmc]: 14800 MB [mmc]: ***SD/MMC 2 init OK!!!*** sum=35ec23c3 src_sum=35ec23c3 read boot-pkg from emmc 32800 sector Succeed in loading uboot from sdmmc flash. Entry_name = u-boot Entry_name = monitor Entry_name = scp set arisc reset to de-assert state Ready to disable icache. 0xffffffff 0xffffffff 0xff20ffff 0xffffffff 0xff1620ff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff ****{cc**5R* NOTICE: BL3-1: v1.0(debug):4b69fc3 NOTICE: BL3-1: Built : 13:27:16, Jun 8 2016 NOTICE: BL3-1 commit: 4b69fc3a2b852e80afb835a84dc5dd7d9bc13aae INFO: BL3-1: Initializing runtime services ERROR: Error initializing runtime service tspd_fast INFO: BL3-1: Preparing for EL3 exit to normal world INFO: BL3-1: Next image address = 0x4a000000 INFO: BL3-1: Next image spsr = 0x1d3 U-Boot 2014.07 (Jul 19 2017 - 09:51:20) Allwinner Technology uboot commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 secure enable bit: 0 i2c: secure monitor exist [ 0.694]pmbus: ready u0:d7e14ffc [ 0.698][ARISC] :arisc initialize [ 0.830][ARISC] :arisc_dvfs_cfg_vf_table: support only one vf_table [ 0.921][ARISC] :arisc para ok [SCP] :sunxi-arisc driver begin startup 2 [SCP] :arisc_para size:240 [SCP] :arisc version: [sun8iw5_v0.03.00-242-g8fe3aa7] [SCP] :sunxi-arisc driver v1.20 is starting [ 0.939][ARISC] :sunxi-arisc driver startup succeeded axp: get node[charger0] error [SCP ERROR] :message process error [SCP ERROR] :message addr : 48105080 [SCP ERROR] :message state : 5 [SCP ERROR] :message attr : 2 [SCP ERROR] :message type : 80 [SCP ERROR] :message result : f3 [SCP WARING] :callback not install [SCP ERROR] :arisc twi read pmu reg 0x3 err probe axp806 failed axp_probe error [ 0.973]PMU: cpux 1008 Mhz,AXI=336 Mhz PLL6=600 Mhz,AHB1=200 Mhz, APB1=100Mhz MBus=400Mhz run key detect no key found no uart input DRAM: 1 GiB fdt addr: 0x76e9b1a0 Relocation Offset is: 35eee000 axp: get node[charger0] error In: serial Out: serial Err: serial gic: sec monitor mode [box standby] read rtc = 0x0 [box standby] start_type = 0x1 [box standby] to kernel boot_init_gpio used ir boot recovery not used workmode = 0,storage type = 2 [ 1.180]MMC: 2 [mmc]: mmc driver ver 2016-05-20 17:18:00-test0 [mmc]: get sdc_ex_dly_used 2, use auto tuning sdly SUNXI SD/MMC: 2 [mmc]: 50 MHz... [mmc]: sample: 63 - 158(ps) [mmc]: ds: 63 - 158(ps) [mmc]: 100 MHz... [mmc]: sample: 32 - 156(ps) [mmc]: ds: 32 - 156(ps) [mmc]: 200 MHz... [mmc]: sample: 16 - 156(ps) [mmc]: ds: 16 - 156(ps) [mmc]: media type 0x8000000 [mmc]: ************Try MMC card 2************ [mmc]: mmc don't support HS400 [mmc]: host caps: 0x6f [mmc]: MID 000088 PSN ae00a522 [mmc]: PNM NCard -- 0x4e-43-61-72-64 [mmc]: PRV 2.1 [mmc]: MDT m-3 y-2017 [mmc]: MMC v5.0 [mmc]: speed mode : HSSDR52/SDR25 [mmc]: clock : 50000000 Hz [mmc]: bus_width : 8 bit [mmc]: user capacity : 14800 MB [mmc]: boot capacity : 4096 KB [mmc]: rpmb capacity : 4096 KB [mmc]: ************SD/MMC 2 init OK!!!************ [mmc]: ========best spd md: 2-HSDDR52/DDR50, freq: 2-50000000 [mmc]: already at HSSDR52_SDR25 mode [mmc]: hsddr 2-50000000 [mmc]: get max-frequency ok 50000000 Hz [mmc]: 1 1 0: 1 1 0 [mmc]: no mmc-hs400-1_8v! [mmc]: no mmc-hs200-1_8v! [mmc]: erase_grp_size : 0x400WrBlk*0x200=0x80000 Byte [mmc]: secure_feature : 0x55 [mmc]: secure_removal_type : 0x9 [mmc]: EOL Info(Rev blks): Normal [mmc]: Wear out(type A): 0%-10% life time used [mmc]: Wear out(type B): 0%-10% life time used [ 1.420]sunxi flash init ok read item0 copy0 the secure storage item0 copy0 is good no item name key_burned_flag in the map sunxi storage read fail sunxi secure storage has no flag [ 1.442]usb burn from boot delay time 0 [ 1.534]usb prepare ok [ 2.333]timer occur [ 2.334]overtime [ 2.367]do_burn_from_boot usb : no usb exist [ 2.367]start drv_disp_init tv_init: tv_probe:000 no report hpd work,you need support the switch class! screen 0 don't support TV! tv_init: fetch tv1 err. drv_disp_init finish hdcp is closed by sys config. reading disp_rsl.fex FAT: Misaligned buffer address (76e8cfa0) 10 bytes read in 2 ms (4.9 KiB/s) get format[40a] for type[4] get format[20e] for type[2] hpd_dev_num=2, id of def_output_dev is 0 hdmi hpd out, force open? fdt_setprop_u32 disp.init_disp(0x20e040a) code:<no error> fb_id=0, size=3686400, gd->ram_size=1073741824, SUNXI_DISPLAY_FRAME_BUFFER_SIZE=16777216 [ 2.952]end PowerBus = 0( 2:vBus 3:acBus other: not exist) no battery, limit to dc no battery exist sunxi_bmp_logo_display reading advert.crc ** Unable to read file advert.crc ** sunxi bmp info error : unable to open logo file sunxi_flash bmp_name=bootlogo.bmp reading bootlogo.bmp [mmc]: blkcnt should not be 0 58 bytes read in 5 ms (10.7 KiB/s) no support big size bmp[1x-1] on fb[1280x720] show bmp on fb failed ! --------fastboot partitions-------- -total partitions:15- -name- -start- -size- bootloader : 1000000 1000000 env : 2000000 1000000 boot : 3000000 1000000 system : 4000000 60000000 verity_block: 64000000 1000000 misc : 65000000 1000000 recovery : 66000000 2000000 sysrecovery : 68000000 60000000 private : c8000000 1000000 alog : c9000000 4000000 Reserve0 : cd000000 1000000 Reserve1 : ce000000 2000000 Reserve2 : d0000000 1000000 cache : d1000000 30000000 UDISK : 1000000 0 ----------------------------------- base bootcmd=run setargs_nand boot_normal bootcmd set setargs_mmc misc partition found to be run cmd=run setargs_mmc boot_normal no item name selinux in the map sunxi storage read fail name in map mac the secure storage item1 copy0 is good update mac = 00:27:41:6C:67:B7 no item name wifi_mac in the map sunxi storage read fail no item name bt_mac in the map sunxi storage read fail no item name specialstr in the map sunxi storage read fail check user data form private update dtb dram start update dtb dram end serial is: 14005190411820310a0d [ 3.192]inter uboot shell Hit any key to stop autoboot: 0 read partition: boot or recovery [ 4.454]sunxi flash read :offset 3000000, 15636900 bytes OK Kernel load addr 0x40080000 size 11915 KiB RAM disk load addr 0x41000000 size 2332 KiB [ 4.519]ready to boot prepare for kernel [mmc]: mmc exit start [mmc]: 50 MHz... [mmc]: sample: 31 - 322(ps) [mmc]: ds: 32 - 312(ps) [mmc]: 100 MHz... [mmc]: sample: 16 - 312(ps) [mmc]: ds: 16 - 312(ps) [mmc]: 200 MHz... [mmc]: sample: 11 - 227(ps) [mmc]: ds: 11 - 227(ps) [mmc]: mmc 2 exit ok Starting kernel ... INFO: BL3-1: Next image address = 0x40080000 INFO: BL3-1: Next image spsr = 0x3c5 [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.65 (hush1305@ubuntu12-64) (gcc version 4.9.3 20150113 (prerelease) (Linaro GCC 4.9-2015.7 [ 0.000000] CPU: AArch64 Processor [410fd034] revision 4 [ 0.000000] Machine: sun50iw2 [ 0.000000] bootconsole [earlycon0] enabled root@cheetah-p1:/ # 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264 HELLO! BOOT0 is starting!boot0 commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 boot0 version : 4.0set pll startset pll endrtc[0] value = 0x00000000rtc[1] value = 0x00000000rtc[2] value = 0x00000000rtc[3] value = 0x00000000rtc[4] value = 0x00000000rtc[5] value = 0x00000000DRAM BOOT DRIVE INFO: V0.6the chip id is 0x00000001the chip id is 0x00000001the chip id is 0x00000001the chip id is 0x00000001the chip id is 0x00000001axp not existDRAM CLK =624 MHZDRAM Type =3 (2:DDR2,3:DDR3,6:LPDDR2,7:LPDDR3)DRAM zq value: 0x003b3bf9DRAM SIZE =1024 MDRAM simple test OK.dram size =1024card no is 2sdcard 2 line count 8[mmc]: mmc driver ver 2016-03-15 20:40[mmc]: ***Try MMC card 2***[mmc]: MMC 5.0[mmc]: HSDDR52/DDR50 8 bit[mmc]: 50000000 Hz[mmc]: 14800 MB[mmc]: ***SD/MMC 2 init OK!!!***sum=35ec23c3src_sum=35ec23c3read boot-pkg from emmc 32800 sectorSucceed in loading uboot from sdmmc flash.Entry_name        = u-bootEntry_name        = monitorEntry_name        = scpset arisc reset to de-assert stateReady to disable icache.0xffffffff 0xffffffff0xff20ffff 0xffffffff0xff1620ff 0xffffffff0xffffffff 0xffffffff0xffffffff 0xffffffff0xffffffff 0xffffffff****{cc**5R*NOTICE:  BL3-1: v1.0(debug):4b69fc3NOTICE:  BL3-1: Built : 13:27:16, Jun  8 2016NOTICE:  BL3-1 commit: 4b69fc3a2b852e80afb835a84dc5dd7d9bc13aae INFO:    BL3-1: Initializing runtime servicesERROR:   Error initializing runtime service tspd_fastINFO:    BL3-1: Preparing for EL3 exit to normal worldINFO:    BL3-1: Next image address = 0x4a000000INFO:    BL3-1: Next image spsr = 0x1d3  U-Boot 2014.07 (Jul 19 2017 - 09:51:20) Allwinner Technology  uboot commit : 667ca2ed789d207d965ec765d846eea1ab0a31b1 secure enable bit: 0i2c: secure monitor exist[      0.694]pmbus:   readyu0:d7e14ffc[      0.698][ARISC] :arisc initialize[      0.830][ARISC] :arisc_dvfs_cfg_vf_table: support only one vf_table[      0.921][ARISC] :arisc para ok[SCP] :sunxi-arisc driver begin startup 2[SCP] :arisc_para size:240[SCP] :arisc version: [sun8iw5_v0.03.00-242-g8fe3aa7][SCP] :sunxi-arisc driver v1.20 is starting[      0.939][ARISC] :sunxi-arisc driver startup succeededaxp: get node[charger0] error[SCP ERROR] :message process error[SCP ERROR] :message addr   : 48105080[SCP ERROR] :message state  : 5[SCP ERROR] :message attr   : 2[SCP ERROR] :message type   : 80[SCP ERROR] :message result : f3[SCP WARING] :callback not install[SCP ERROR] :arisc twi read pmu reg 0x3 errprobe axp806 failedaxp_probe error[      0.973]PMU: cpux 1008 Mhz,AXI=336 MhzPLL6=600 Mhz,AHB1=200 Mhz, APB1=100Mhz MBus=400Mhzrun key detectno key foundno uart inputDRAM:  1 GiBfdt addr: 0x76e9b1a0Relocation Offset is: 35eee000axp: get node[charger0] errorIn:    serialOut:   serialErr:   serialgic: sec monitor mode[box standby] read rtc = 0x0[box standby] start_type = 0x1[box standby] to kernelboot_init_gpio usedir boot recovery not usedworkmode = 0,storage type = 2[      1.180]MMC:        2[mmc]: mmc driver ver 2016-05-20 17:18:00-test0[mmc]: get sdc_ex_dly_used 2, use auto tuning sdlySUNXI SD/MMC: 2[mmc]: 50 MHz...[mmc]: sample: 63 - 158(ps)[mmc]: ds: 63 - 158(ps)[mmc]: 100 MHz...[mmc]: sample: 32 - 156(ps)[mmc]: ds: 32 - 156(ps)[mmc]: 200 MHz...[mmc]: sample: 16 - 156(ps)[mmc]: ds: 16 - 156(ps)[mmc]: media type 0x8000000[mmc]: ************Try MMC card 2************[mmc]: mmc don't support HS400[mmc]: host caps: 0x6f[mmc]: MID 000088 PSN ae00a522[mmc]: PNM NCard  -- 0x4e-43-61-72-64[mmc]: PRV 2.1[mmc]: MDT m-3 y-2017[mmc]: MMC v5.0[mmc]: speed mode     : HSSDR52/SDR25 [mmc]: clock          : 50000000 Hz[mmc]: bus_width      : 8 bit[mmc]: user capacity  : 14800 MB[mmc]: boot capacity  : 4096 KB[mmc]: rpmb capacity  : 4096 KB[mmc]: ************SD/MMC 2 init OK!!!************[mmc]: ========best spd md: 2-HSDDR52/DDR50, freq: 2-50000000[mmc]: already at HSSDR52_SDR25 mode[mmc]: hsddr 2-50000000[mmc]: get max-frequency ok 50000000 Hz[mmc]: 1 1 0: 1 1 0[mmc]: no mmc-hs400-1_8v![mmc]: no mmc-hs200-1_8v![mmc]: erase_grp_size      : 0x400WrBlk*0x200=0x80000 Byte[mmc]: secure_feature      : 0x55[mmc]: secure_removal_type : 0x9[mmc]: EOL Info(Rev blks): Normal[mmc]: Wear out(type A): 0%-10% life time used[mmc]: Wear out(type B): 0%-10% life time used[      1.420]sunxi flash init okread item0 copy0the secure storage item0 copy0 is goodno item name key_burned_flag in the mapsunxi storage read failsunxi secure storage has no flag[      1.442]usb burn from bootdelay time 0[      1.534]usb prepare ok[      2.333]timer occur[      2.334]overtime[      2.367]do_burn_from_boot usb : no usb exist[      2.367]startdrv_disp_inittv_init:tv_probe:000no report hpd work,you need support the switch class!screen 0 don't support TV!tv_init:fetch tv1 err.drv_disp_init finishhdcp is closed by sys config.reading disp_rsl.fexFAT: Misaligned buffer address (76e8cfa0)10 bytes read in 2 ms (4.9 KiB/s)get format[40a] for type[4]get format[20e] for type[2]hpd_dev_num=2, id of def_output_dev is 0hdmi hpd out, force open?fdt_setprop_u32 disp.init_disp(0x20e040a) code:<no error>fb_id=0, size=3686400, gd->ram_size=1073741824, SUNXI_DISPLAY_FRAME_BUFFER_SIZE=16777216[      2.952]endPowerBus = 0( 2:vBus 3:acBus other: not exist)no battery, limit to dcno battery existsunxi_bmp_logo_displayreading advert.crc** Unable to read file advert.crc **sunxi bmp info error : unable to open logo file sunxi_flashbmp_name=bootlogo.bmpreading bootlogo.bmp[mmc]: blkcnt should not be 058 bytes read in 5 ms (10.7 KiB/s)no support big size bmp[1x-1] on fb[1280x720]show bmp on fb failed !--------fastboot partitions---------total partitions:15--name-        -start-       -size-      bootloader  : 1000000       1000000     env         : 2000000       1000000     boot        : 3000000       1000000     system      : 4000000       60000000    verity_block: 64000000      1000000     misc        : 65000000      1000000     recovery    : 66000000      2000000     sysrecovery : 68000000      60000000    private     : c8000000      1000000     alog        : c9000000      4000000     Reserve0    : cd000000      1000000     Reserve1    : ce000000      2000000     Reserve2    : d0000000      1000000     cache       : d1000000      30000000    UDISK       : 1000000       0           -----------------------------------base bootcmd=run setargs_nand boot_normalbootcmd set setargs_mmcmisc partition foundto be run cmd=run setargs_mmc boot_normalno item name selinux in the mapsunxi storage read failname in map macthe secure storage item1 copy0 is goodupdate mac = 00:27:41:6C:67:B7no item name wifi_mac in the mapsunxi storage read failno item name bt_mac in the mapsunxi storage read failno item name specialstr in the mapsunxi storage read failcheck user data form privateupdate dtb dram startupdate dtb dram  endserial is: 14005190411820310a0d[      3.192]inter uboot shellHit any key to stop autoboot:  0 read partition: boot or recovery[      4.454]sunxi flash read :offset 3000000, 15636900 bytes OKKernel load addr 0x40080000 size 11915 KiBRAM disk load addr 0x41000000 size 2332 KiB[      4.519]ready to bootprepare for kernel[mmc]: mmc exit start[mmc]: 50 MHz...[mmc]: sample: 31 - 322(ps)[mmc]: ds: 32 - 312(ps)[mmc]: 100 MHz...[mmc]: sample: 16 - 312(ps)[mmc]: ds: 16 - 312(ps)[mmc]: 200 MHz...[mmc]: sample: 11 - 227(ps)[mmc]: ds: 11 - 227(ps)[mmc]: mmc 2 exit ok Starting kernel ... INFO:    BL3-1: Next image address = 0x40080000INFO:    BL3-1: Next image spsr = 0x3c5[    0.000000] Initializing cgroup subsys cpuset[    0.000000] Initializing cgroup subsys cpu[    0.000000] Initializing cgroup subsys cpuacct[    0.000000] Linux version 3.10.65 (hush1305@ubuntu12-64) (gcc version 4.9.3 20150113 (prerelease) (Linaro GCC 4.9-2015.7[    0.000000] CPU: AArch64 Processor [410fd034] revision 4[    0.000000] Machine: sun50iw2[    0.000000] bootconsole [earlycon0] enabledroot@cheetah-p1:/ #

最後にプロンプトは出るものの、何を打っても応答がありませんでした。

 

今回バラしてみようと思ったのには、コピー機対策にハードウェア識別する何かチップ類が搭載されているのか、確認してみたかった為でした。しかし基板上にはいかにも！という怪しい部品は見当たらず。私の見る限りはそんな印象でした。

 

共有:
関連
📎📎📎📎📎📎📎📎📎📎
BOT