Table of Contents
Android TV-Box MXQ (Amlogic S805)
I purchased two of this, for about 35 € each. They came with different firmware, also the remote control is different and not interchangeable.
|Date of purchase||2016-04||2016-10|
|Firmware build number||MXQ.V2.0.201601260953||KOT49H.20151225 test-keys|
|CPU||ARMv7 revision 1||ARMv7 revision 1|
|Machine||Amlogic Meson8B||Amlogic Meson8B|
|Total RAM memory|| 510 Mib (345 Mb total free with LibreELEC).|
The original Linux kernel gives fake values: 824 Mb with
|NAND Storage||8GiB||8 GiB|
|WiFi driver||RTL871X: rtl8189es||RTL871X: rtl8189es|
|Remote factory_code||0x40400001 remote.conf||0xfe010001 remote.conf|
|Recovery mode||Yes, toothpick method||Only from external SD card|
|Note||Time from the internet sometimes does not work.||Overscan problem: image borders drop out of the screen.|
The device does not have a clock inside, it relies on the time it gets from the internet. With the latest firmware (2016-01-26) there is a very annoying bug: from the Android settings we enabled time from the internet and set the proper timezone, this settings works just once, after a reboot the time is almost always unset.
We don't know the actual video adapter capabilities of the MXQ, using the LibreELEC distribution we suspect that it cannot cope well with the native resolution of any HDMI monitor we connect to it. For example we attached a Samsung SyncMaster capable of 1440×900 pixel, but the Kodi interface offered only 1920×1080, 1280×720 and 720×480. So no native resultion can be used and it relays in downscaling or upscaling.
Partitions and storage space
For some insight of partitions content, see the post Boot Android from SdCard.
root@m201d:/ # cat /proc/partitions major minor #blocks name 253 0 512000 zram0 250 0 524288 cache 250 1 32768 logo 250 2 32768 recovery 250 3 32768 misc 250 4 32768 boot 250 5 1048576 system 250 6 5275648 data
|Size||Free (at factory)|
Remotes are different
From various posts on the internet it seems that very similar devices are shipped with different remotes. The two of mine are different and are not interchangeable. Remote factory code and configuration is stored into
Some devices are factory rooted
No need to root the device on model m201d, because it is already. You can install a terminal application and issue the
su command. If you don't want to register into Google to access the Play Store from the MXQ, you can get the .apk file somewhere, put it into the SD card, browse the folders and install it. Another useful app to install is an SSH server, used to open a shell session from a PC into the device or to transfer files via scp. There is also an FTP server, etc.
If the device does not have its
su binary installed, you have to boot in TWRP recovery mode and install superuser from a zip file. You need an update .zip archive, not the .apk Android package, this is why the SuperSU app is distributed also as a zip file (see below for download link). Save it into an SD card along with the TWRP recovery, boot from it and install.
su binary installed by SuperSU is not standalone: when invoked (e.g. from the command line) it will bring-up the graphical interface of SuperSU, which asks to allow superuser privileges to the requesting app. May be there are superuser binaries which does not require this (e.g. the one shipped with model m201d).
Recovery Mode and Backup
Booting into Recovery Mode
Like others Android devices, this one too can boot into Recovery Mode. This is a minimal operating system where it is possible to delete all or some user data and files, perform system updates, etc.
Unlike many Android devices, the MXQ can boot from any recovery image, it does not need a signed one and it is not required to root the device to select a non-stock recovery.
To enter the recovery mode follow the toothpick method. It should be possible to sart the built-in (stock) recovery, or pick one from the SD card. My device with firmware 2016-01-26 is unable to start from the built-in, it just keep on rebooting, so it definitely needed one on the SD card.
- Unplug the power from the device.
- Connect a screen to the HDMI socket.
- Connect an USB keyboard and/or an USB mouse (mouse required for some recovery, e.g. TWRP).
- (May be optional) insert the SD card with the
recovery.imgon its root directory (FAT32 format).
- Insert a toothpick into the A/V hole, and push it untill you feel the click of a microswitch.
- Keeping the toothpick pressed, insert the power plug.
- Wait until you see the recovery screen (about 15 seconds).
Choosing the right Recovery: Stock vs TWRP
NOTICE: the recovery image must be unzipped and renamed recovery.img before copying it into the root direcotry of the SD card.
Some Recovery images are very limited, e.g. the stock one installed at factory. This is much like the one I extracted from the OpenELEC 126.96.36.199 archive (which has a build version KOT49H.20151225 test-keys, see web resources for the download link) you can get a copy here: recovery-openelec-188.8.131.52.tgz. It does not permit backup and it has just some basic functions:
- reboot system now
- apply update from ADB
- apply update from EXT
- apply update from cache
- wipe data/factory reset
- wipe cache partition
A totally different recovery is TWRP, which needs a mouse and support a ton of functions, I reccomend it to make a full backup of the firmware before re-flashing it. See web resources below for the original link, a copy of the image is here: recovery-twrp-amlogic-mxq.tgz (TWRP v.3.0.2, md5sum a5e5cc5faa4cdddd58b8e62470c18ff9). It can perform backup and restore of partitions, it can install packages from zip files on the external SD card, can copy or delete files, …
Performing the backup
In Android world, the backup of NAND flash memory partitions is called a NANDroid backup; it contains everything, from operating system to user data. Beware that backup images created with one tool (e.g. TWRP) are generally not compatible with another tool (e.g. CWM Recovery).
Once booted into TWRP, you can click the Backup button and save the images of installed firmware. The archives will be stored into the internal storage of the MXQ, under the directory
/storage/sdcard0/TWRP/mxq/ (really a link into
/mnt/shell/emulated mounting point). In my case it required 1.5 Gb, where the free space was about 3.9 Gb. The saved images are (see below for info about their content):
- boot.emmc.win (32M)
- logo.emmc.win (32M)
- recovery.emmc.win (32M)
- data.ext4.win (560M)
- system.ext4.win (846M)
: Some of the backup files created by TWRP are not readable from the internal storage where TWRP crated them, they give permission denied even if accessed as root. Is this a bug? Is there something I miss? The unreadable files are data.ext4.win and system.ext4.win.
A workaround is to move them from the internal storage to the external SD card using the Advanced ⇒ File Manager function in TWRP.
Flashing a different firmware
Flashing a different firmware can be useful to upgrade or downgrade the stock software, or to flash a totally different image, e.g. OpenELEC or LibreELEC (we need a version specifically built for our hardware/model).
Burning the firmware from the SD card
Some posts tell to flash a new firmware using a Windows PC and the AMLogic USB Burning Tool, while the MXQ device is connected via an OTG USB cable. We don't have a Windows PC and our MXQ box does not have the OTG USB socket, so we definitely go with the alternative SD card method.
For the SD card method we need to find a firmware archive which contains three files:
- recovery.img, the recovery which will do the upgrade. A simple stock should suffice.
- factory_update_param.aml this file contains recovery instructions to flash the firmware.
- one .zip archive, e.g. m201-ota-20150915.zip, which is actually a JAR archive.
factory_update_param.aml just tells what is the archive to use for the upgrade and if erasing user data is required, this is an example:
--update_package=/sdcard/m201-ota-20150915.zip --wipe_data --wipe_cache --wipe_media
The update zip file is actualy a JAR archive, it can be extracted using
jar xvf file.zip. Into the root directory of this archive there is the
/system directory and there are also the images to flash into the relative partitions. This is an example:
| || The most important file is
| ||May contains patches to be applied to the recovery.|
| ||Contains the software that will be flashed into the system partition. It can be the full structure of directories and files, or a single image of a squashfs filesystem, …|
| || Image usually raw-flashed into
| || The u-boot image (much like a DOS/MBR boot sector). This is the first boot loader ( which is flashed where?). When Android is running there is a
| || Image usually raw-flashed into
| || Image usually raw-flashed into
Which LibreELEC image to use?
From http://kszaq.libreelec.tv/s805/ you can find several images to flash to the device, you have to experiment which one is the best fit for you. Putting the wrong image onto the SD card, results in boot freeze at MXQ logo, just remove the SD card and reboot to recover.
- HD18Q for all black MXQ box and OTT ones.
- MXQ for all black and Beelink MXQ with “red stripe” on a corner.
- m201d for boxes with 512 Mb RAM (instead of 1 Gb).
One MXQ box all black, labeled OTT, with the remote 0xfe010001 (see above) worked flawlessy with the HD18Q image. Another MXQ box all black, with the remote 0x40400001 worked with the m201d image.
Prepare the SD card and boot from it
To prepare the SD card (will be entirely erased, it must be umounted, change the name /dev/sdX to your entire device, not the partition):
gunzip LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img.gz dd if=if=LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img of=/dev/sdX bs=4M
At the end the SD card will contains two partitions; one FAT32 and one Linux. The first one contains three files (plus their MD5 checksum):
- aml_autoscript a boot loader script
- kernel.img the Linux kernel image
- SYSTEM the LibreELEC filesystem image
The Linux partition is empty, it will be resized to occupy the entire space available on the SD card and it will contain runtime data for LibreELEC.
Once you prepared the SD card, insert it into the unpowered MXQ and use the toothpick method: insert a toothpick into the A/V socket untill you feel the click of a microswitch, then power-on the MXQ while keeping the microswitch pressed. This procedure seems required only once: the following times the MXQ will boot directly from the SD card just because it is inserted.
You will need an USB keyboard to configure the Kodi program (the remote control should work, but it is not very friendly selecting IP addresses, etc.). At least you should configure the network and enable the SSH server.
Copy LibreELEC to the internal NAND memory
Once connected via the SSH server (default root password is libreelec) run this command to copy the LibreELEC software to the internal NAND memory (overwriting the Android system):
LibreELEC:~ # installtointernal ... Formatting SYSTEM partition.../dev/system contains a ext4 file system ... Writing kernel image...76+1 records in ... Copying SYSTEM files...done. Copying remote.conf...done. Formatting DATA partition...done. Do you want to copy your user data to internal data partition? [Y/n] ...
Problems (Solved and Unsolved)
The power button of the remote control does power off the device, but it is unable to wake it up. You must disconnect the power supply and connect it again.
Sometimes we get Kodi reboot, Kodi interface or video play freeze. The system is installed into the NAND memory, into the dmesg log there are plenty of that messages:
nftl _nand_discard, start sector=282632, length=72 nftl _nand_discard, start sector=274440, length=24 nftl _nand_discard, start sector=4608120, length=32
The Kodi program crashes with the following message:
Program terminated with signal SIGBUS, Bus error.
The problem seem to be fixed downgrading to LibreELEC-S805.m201d.arm-184.108.40.206d image. Some kernel problem? Was the image 8.2-8.1.5a corrupt on flashing? Quién sabe?
The volume buttons of the remote control do not work. You can instead press OK when playing a vide, then use the gear icon to access the menu.
We disabled CEC remote control, because we don't use it and we get
dmesg full of
##### cec write error! #####
Go to System –> System –> Input devices –> Peripherals –> CEC Adapter. Select the plugin and disable it. You must to reboot to have it dsabled.
TWRP Backup images
See this paragraph about Android partitions.
It is the raw dump of
/dev/block/logo partition, it contains the BMP files of boot logos packed into a special Amlogic format. There is a tool called aml-imgpack which was able to extract the image files. Browsing the partition image you can see the Amlogic magic number 0x27051956 and the magic number of several BMP images (which is BM).
- MXQ "All Black" S805 Versions / HD18q / and Clones discuss issues with MXQ devices which look similar, but they really need different software builds.
- LibreELEC vs OpenELEC some words about the fork.
- LibreELEC (fork of OpenELEC), more about the fork.
- How to Flash SuperSU using TWRP recovery and Root any Android device, download link for SuperSU zip.
- [Box Tv] Mxq s85 (AMLogic S85 - 1gb Ram-8gb flash) (forum italiano).
- Reinstalling the firmware for the MXQ Streaming Media Player, from SD card or USB stick.