BL301 Tool

This tool is written by Team CoreELEC and exclusive for Amlogic devices running CoreELEC!

Some Amlogic devices do have problems with wake-up from suspend/power off by IR remote, CEC or WOL. For this reason Team CoreELEC created the BL301 injectable blob.

Amlogic devices having issues with wake-up features like IR remote wake-up, CEC or WOL wake-up can be fixed by using this tool.

This method does currently NOT work with these devices:

Magicsee N5 S905L
TX3 S905X3 from Aliexpress
X95 max S905X3

Please remember using the tool on one of these device may stop it from booting!

The device will then need to be recovered by shorting out the eMMc while a (μ)SD Card prepared by Amlogic Burncardmaker is required for flashing!

Please ensure to have the latest firmware installed on the device. Minimum required is Android 7.1 (Nougat)

GXL support is still experimental!

This procedure may brick the device!

It will be needed to short out the eMMC to recover the Amlogic device.

No warranty is given by team CoreELEC about the success of this procedure.

inject_bl301 will exchange the BL301 blob of the bootloader while leaving the rest untouched. This blob is responsible for handling the resume functions in suspend/power off mode. By exchanging the blob, the bootloaders wake-up features can be fixed/enabled. The procedure will create a backup of the current bootloader.

The advantage is that CoreELEC can still use the original bootloader, making it almost impossible to brick the device as the blob only gets activated when sending the device to suspend/power off. When encountering issues a backup of the original bootloader can be restored.

SoC ID	BOARD	SoC
0x21	GXL	S805X, S805Y, S905X, S905D, S905L, S905M2, S905W
0x28	G12A	S905X2
0x29	G12B	A311D, S922X
0x2B	SM1	S905D3, S905X3

BL301 features for supported Hardkernel Odroid devices are embedded in the installation image.

There are two ways to inject the bl301 blob:

How to enable/disable:

Settings
CoreELEC
Hardware
Inject BL301 Blob

After the BL301 blob has been injected and the devices has been rebooted, some additional, device dependent features will become available.

Any changes to the hardware settings require a reboot.

Usage: inject_bl301 [options] [BL301.bin file…]

[options]
 -b     define local bootloader blob BL301.bin
 -l     define local bootloader binary dump
 -d     upload the debug output to http://ix.io
 -s     define a system root path (needed for update.sh)
 -Y     auto confirm user interaction request
 -h     print this help

SSH into device
enter:

inject_bl301

The tool will print some debug information like this:

CoreELEC:~ # inject_bl301
Starting bootloader blob BL301 injection tool...

This tool can be used to update the bootloader
blob BL301 of the vendor bootloader on the internal
eMMC. This bootloader blob BL301 is customized by
Team CoreELEC to support all wake-up features like
CEC, Wake-On-LAN, IR, and GPIO wake-up from
suspend or power off state!

Device serial number: 280b4000012e33000009313256474d50
Using CPU type G12A (28): S905D2, S905X2
Using binary type because of CoreELEC DT-ID: Generic
Using /dev/bootloader as bootloader partition

Testing bootloader for package version v2...
Did not find Amlogic image v2 header magic!

Searching TOC_HEADER. Please wait...
Found TOC_HEADER at:            0x00010210
Name:                           AA640001
Serial Number:                  12345678
Flags:                          0

TOC ENTRY #0
UUID:                           9766FD3D89BEE849AE5D78A140608213
Offset Address:                 0x5C000 (absolute: 0x6C210)
Size:                           0xE570
Flags:                          0x0
Found BL30 blob image at:       0x0006C210
Amlogic magic:                  @AML
Old signature:                  FCC1D8D71366E27A3950A195E53BFEDF66B87966D9272D4B0312558DE4BE0FD7
Using BL301.bin:                Generic_28_29_bl301.bin
Use config.ini value:           usbpower = 0x01
Use config.ini value:           remotewakeup = 0xeb14ff00
Use config.ini value:           cec_osd_name = NEO T5
New signature:                  F227E1C7D9B03417A8AF7D3C2DD96C412B362FB974FD4C6A1E65F12EBFC601F7

Please confirm to write the bootloader blob BL301 to
the internal eMMC! Please ensure to update first the device
to the last vendor firmware! And remember if the vendor
firmware get updated you have to do this step again as the
bootloader blob will be overwritten!

Continue? [y/n] y

press y

The tool will proceed and create a backup of the original vendor bootloader before injecting the CoreELEC blob:

Make backup of vendor bootloader to: /flash/280b4000012e33000009313256474d50_bl301.bin
Finished update of BL301.bin on internal eMMC!
Please reboot device now and enjoy the new CoreELEC wake-up features!

enter:

 sync && reboot

Once the device rebooted, config.ini can be customized as described here.

The config.ini key values are read by the tool inject_bl301 on every boot into CoreELEC.
If any value were changed, the blob gets injected again with the updated values.

After the bootloader blob has been injected, the blob is automatically is updated:

with each system update following the common update method

on every boot into CoreELEC.

To test if the injection was successful, just run the tool again, and if the old signature and new signature match, then the BL301 bootloader blob was updated successfully.

Running the tool multiple times will not cause issues.

CoreELEC:~ # inject_bl301
Starting bootloader blob BL301 injection tool...

This tool can be used to update the bootloader
blob BL301 of the vendor bootloader on the internal
eMMC. This bootloader blob BL301 is customized by
Team CoreELEC to support all wake-up features like
CEC, Wake-On-LAN, IR, and GPIO wake-up from
suspend or power off state!

Device serial number: 280b4000012e33000009313256474d50
Using CPU type G12A (28): S905D2, S905X2
Using binary type because of CoreELEC DT-ID: Generic
Using /dev/bootloader as bootloader partition

Testing bootloader for package version v2...
Did not find Amlogic image v2 header magic!

Searching TOC_HEADER. Please wait...
Found TOC_HEADER at:            0x00010210
Name:                           AA640001
Serial Number:                  12345678
Flags:                          0

TOC ENTRY #0
UUID:                           9766FD3D89BEE849AE5D78A140608213
Offset Address:                 0x5C000 (absolute: 0x6C210)
Size:                           0xE570
Flags:                          0x0
Found BL30 blob image at:       0x0006C210
Amlogic magic:                  @AML
Old signature:                  F227E1C7D9B03417A8AF7D3C2DD96C412B362FB974FD4C6A1E65F12EBFC601F7
Using BL301.bin:                Generic_28_29_bl301.bin
Use config.ini value:           usbpower = 0x01
Use config.ini value:           remotewakeup = 0xeb14ff00
Use config.ini value:           cec_osd_name = NEO T5
New signature:                  F227E1C7D9B03417A8AF7D3C2DD96C412B362FB974FD4C6A1E65F12EBFC601F7
Update of BL301.bin on eMMC is not needed, exit now...

There are two ways of restoring the vendor bootloader:

restore from backup
restore (flash) vendor firmware

The injection is NOT applied automatically. Each time the device is restored to the vendor firmware image, the tool needs to be run again.

The tool made a backup of the vendor bootloader before the first injection.

The backup can be found on the CoreELEC media at:

/flash/<CPU_SERIAL>_bl301.bin

SSH into device
run the dd command:

dd if=/flash/<CPU_SERIAL>_bl301.bin of=/dev/bootloader conv=fsync bs=512

run

sync && reboot

After reboot, the original bootloader is restored.

Use the Amlogic recovery method using USB Burning Tool or Burncardmaker to restore the vendor bootloader.

By restoring (flashing) the vendor firmware back to the device, the bootloader is also restored.

Please use the User Forums Support Thread for any BL301 related questions or issues.