X86-based embedded device

I am trying to flash OpenWrt on my x86-based set-top box.

The box is sold as 'GAZAL PRO 9000' (rebranded, OEM unknown). Here is look inside:

It has an RS-232 (as 3.5 mm audio jack), USB, and HDMI port, which can be helpful.

The CPU heatsink is stuck solid to the CPU, so I can't tell what the CPU is for sure, but looking at this PCB silkscreen, it seems to be a Rise MP6, which is a 32-bit x86 CPU from 1999 :nauseated_face::

IMG_0910 Large

So I downloaded the legacy x86 generic-squashfs-combined.img.gz firmware image to try to use with it.

Onto flashing. In the user interface, there is an 'upgrade' feature (similar to regular router flashing procedure) that can allow you to flash a firmware image from a USB. So I copied the extracted image to a USB flash drive, rename the extension to bin (it didn't recognize img).

However, when I try to flash the image, it accepts it, but then it immediately reboots, with the stock firmware intact as if nothing happened. Here is a video on how it looks like: https://streamable.com/oq84hn.

I have tried doing it multiple times, but the issue keeps persisting. This is presumably a safety/security feature to reject 'corrupted' images. How would I bypass it?

hi,
this article describes how to install x86 openwrt image: https://openwrt.org/docs/guide-user/installation/openwrt_x86

using a non-openwrt appliance's upgrade function to re-flash with openwrt unlikely will ever succeed. you try to do like upgrade an active windows with linux kernel bin.

The x86 generic image is for generic hardware. This device is definitely not that.

You need a lot more info about the hardware and a way to watch how it boots, does it even have a bios? Can it boot from usb or only the flash (openwrt will not support the flash chip)

I cannot boot from a USB drive, nor can I directly write to the flash.

AND you will need to go waaay back in openwrt versions to be able to support a Pentium class cpu

I cannot boot from a USB drive, otherwise I wouldn't be trying to flash from the user interface. It has an integrated bootloader only. It is very similar to a router / other embedded device.

In the wiki page, it says the legacy version supports very old 32-bit x86 (i586) CPUs like the Pentium.

Can you interact with the boot loader then? Like we do via uart with uboot?
With hardware this exotic you have a long road ahead of you

1 Like

As I mentioned, there is an RS-232 port to use Serial Console with, but I am hoping it wouldn't be necessary.

Somehow, someone with the hardware on their desk will have to reverse engineer the OEM firmware format for that - and you definitely want a failsafe (working serial console, bootloader access and OEM bootlogs and ideally even a root shell) before even thinking about trying that - and yes, this someone will be either you or noone. Maybe this hypothetical someone can make the process easier for others in the future, maybe not. x86 does not necessarily mean generic or unlocked hardware, especially if android, chromeos, windows ce or windows embedded are involved.

Without serial console access, you're flying blind and don't know what's happening behind the scene - and any, even minor, mistake is likely to be your last one with this hardware.

3 Likes

Well, it doesn't hurt if you connect the RS-232 port to your PC, run a terminal program and see if you get any output on the screen if you power up your device.
Like @slh wrote, that's mandatory.

Here is how the port labeled as 'RS-232' at the back of the device looks like:

As you can see, it's not a typical RJ-45 or DB-9 connector, but an AUX connector. I couldn't find anything useful about such an RS-232 connector on the web. Is it even standard?

I tried using a regular old AUX cable to connect it to my Mac's audio jack, but I didn't find any new serial interface in /dev.

I know this may be outside the scope of the thread topic, but would anyone happen to know/guess how to connect to it?

No, this type of connector for a serial connection is no standard.
But i know at least two devices, who are using this kind of 3,5mm connector for data transmission. Unfortunately, the pinout is different on both these devices.

Of course not...an audio output isn't the same as a serial data connection.

So, what do you need: A serial connection to your Mac, either an old-fashioned RS-232 (if such a connector is still available on them, but i think it's not) or an USB-Serial-Converter. The easiest way is to try to get the original data cable. If you can't get it, or at least the wiring of it, you'll have to make one of your own.

If you have some basic skills on electronics, you might be able to measure which of the 3 rings on the 3,5mm plug is Gnd.
Then you have to solder an adaptor from your (most likely) DB9 to a 3,5mm plug. Maybe you even need a so-called Null modem adaptor, so the Mac will receive the data. To find out which of the remaining 2 rings is Transmit Data and Receive Data, is best done by trial-and-error.

If this is already to complicated for you, you might look for someone who will do this task for you or you just put the receiver in the recycling bin...

Because: Even with a working serial connection between the receiver and your Mac, you still don't know if the receiver will even send any useful data when powered up.

If these obstacles doesn't scare you off, than good luck with it.
On any question that will surely arise, i'll be trying to give a useful answer.

That is not an x86 processor. There are SoCs specific to these cheap TV boxes. The Rise MP6 was intended as a desktop processor and requires a large supporting chipset in order to run. Of course HDMI did not exist back in that day either.

The TV boxes run a non-Linux OS in order to fit into the very small memory space they have. The flash chip is probably only 4 MB. Because of the small memory, there has not been much development toward running a general-purpose OS on this sort of hardware.

3 Likes

That sounds much more likely, I couldn’t understand how a socket 7 cpu was being used without any of the supporting hardware!

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.