Author Topic: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery  (Read 5936 times)

0 Members and 1 Guest are viewing this topic.

Offline rh100605Topic starter

  • Regular Contributor
  • *
  • Posts: 51
  • Country: gb
I noticed that my Pixstar picture frame (old 5volt supply model) started forgetting things and needing a reset to get it started. Wifi stopped and then the whole frame froze at the Pixstar logo. The 4Gbyte San Disk solid state disk SDIN7DP2-4G was failing, a common fault after 6 years of reading and writing.
This frame uses the S5PV210AH ARM processor from Samsung, a Cortex A7 model running 32 bit code , just like the Raspberry pi......

I extracted the San Disk chip and attached it to a USB to emmc bga 153 chip converter I bought on Ebay to examine the image. There was no boot sector but there were Linux superblocks (Magic number EF 53) and using the UUID signatures in the superblocks (see Wikipedia for superblock structure) I was able to identify four partitions. I worked out the Block size was 1KB or two sectors. I had to insert one block of zeros at the front , I then used the first half of the Block as Master Boot record.
I then put the Block numbers for start and length into a master boot record in the empty sector zero.
I used the binary editor "Hex editor neo" to do all this. I then installed "OSF Mount" under Windows and low and behold four Linux partitions appeared. Only the first 6Mbyte with the U-Boot loader and compressed kernel were not visible (not even a vfat partition). There was a lot of damage to the Linux system, executables  had sectors of zeros in the middle. You can Mount image files with OSF mount that are not on the USB EMMC for testing and correction.

I then installed Raspian Linux on a partition of my laptop and with the 4GByte San disk image still on the usb converter but now with a Master boot record. I ran the Linux file system checker ( fsck) on the device. This found multiple errors that I recorded into a document I then saved a copy of the entire image using the Linux command dd and then ran fsck in correction mode. I recorded this as well to be able to understand what was damaged and how it was corrected.

Afterwards I allowed the partitions to mount as 4 disks in Raspian (three 128Mbyte and one 3.6gb and one hidden of 6Mbyte). I could then correct several symbolic links on the first partition to BusyBox ( an application that supplies most of the Linux commands such as cd ls ln rm mount etc)

But how to check if it worked at all ? I noticed that the board has 4 large via's in a line at the edge with GND and 3v3 at the outside as a guess I attached a RS232 (3v3 not 5V) to USB converter and then went back to the image to search for the word "baud", next to it was 115200 …

I copied the corrected image, erased the boot sector block and rewrote the image to a new San Disk chip (8GB version purchased on Ebay) using the usb to emmc converter. Windisk Imager was used to write to the usb to emmc converter.

I then put the new chip + image back into the frame with the RS232 to usb converter connected to the laptop. I used PUTTY telnet to attach at 115200 baud and default settings of Xon/off.
Eureka I could see U-Boot working and the Kernel then the Linux initd scripts going by. finally it ended in a prompt . Entering whoami resulted in root. I then spent a long time looking at the start up recorded by the PUTTY terminal. By hitting enter at the start of booting I could bring up the u-boot prompt which allows file loading over a serial connection as well as changing the emmc boot options.

(I could not  boot from the sd card as u-boot is loaded from the emmc chip - none of the 16 settings of the 4 switches seem to force an sd card boot)

A full embedded Linux 2.6.36 system was shown by running uname -a. 99% of the code was GNU licensed Kernel and GNU packages such as Busybox, BlueZ , OpenSSL, QT, D-Bus, U-Boot and  wpa_supplicant . Some were wrecked and looking at the saved binary image and searching for the ELF signature at the start of programs established missing sectors..

I looked at Raspian and Debian packages on Google for replacement armel versions of the damaged libraries but how to load them to the frame without unsoldering the 153 BGA emmc device. I loaded them to a USB stick on a PC and then put the stick into the frame. Then using the Linux command find / -name xxxxxx (xxxx is a library name I had on the usb stick) to establish where the usb stick was mounted copied them into /lib.
 I learnt the hard way that upgrading the version of GLIBC and linker library pair results in disaster.

Finally the frame functioned without wifi and Bluetooth, so no connection to the server yet..

I also noticed on the pixstar web site that usb to ethernet converters were supported. I bought the recommended  "Cable Matters" usb2.0 to ethernet 100mbit  converter plugged it in and Ping resulted in reaching the router and beyond. The frame functioned and downloaded new pictures, that I could view and load on a PC with Samba 1.0. Pixstar Firmware version was 1.372.

I then tried to build replacement executables from source on a Raspberry pi to make the wifi work......More later.


UPDATE NOV 2020
I tried compiling executables on the pi for this frame but although they execute, they all demand the C Library level they were made with.
The frame uses a low level glibc and I found it very difficult to compile and use a low level glibc on the pi. So I bought another scrap frame and used the usb port (/opt/app/disk/photos/local/usb) to copy off executables and load them onto the fixed frame. Voila wifi worked when wpa_supplicant was copied. Now only the infrared remote fails, although it works in the scrap frame I bought

I solved this by checking all the resistors around the BitCode 1308 chip near the flex to the back buttons. It is linked to the IR receiver. R45 was open should be 4.7k. Now it all works thanks to having second frame to compare to!

If anyone wants a working software image for this frame just ask!
« Last Edit: December 04, 2020, 12:24:05 pm by rh100605 »
 

Online NiHaoMike

  • Super Contributor
  • ***
  • Posts: 8969
  • Country: us
  • "Don't turn it on - Take it apart!"
    • Facebook Page
Re: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery
« Reply #1 on: July 02, 2020, 10:43:05 pm »
Have you checked the datasheet for the LCD? Might be easier to salvage that plus the power supply circuit for it and run it from a Raspberry Pi.
Cryptocurrency has taught me to love math and at the same time be baffled by it.

Cryptocurrency lesson 0: Altcoins and Bitcoin are not the same thing.
 

Offline rh100605Topic starter

  • Regular Contributor
  • *
  • Posts: 51
  • Country: gb
Re: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery
« Reply #2 on: July 03, 2020, 04:31:12 pm »
Hi,
I had considered transferring all the function the to Pi but Pixstar frames work by having all pictures on a remote server that accepts emails containing video and pictures from anywhere . As I have pixstar account for this frame (locked to a unique Ethernet address or MAC) I was hoping to resurrect all the function.
Cheers
Rob
« Last Edit: July 03, 2020, 04:35:38 pm by rh100605 »
 

Online NiHaoMike

  • Super Contributor
  • ***
  • Posts: 8969
  • Country: us
  • "Don't turn it on - Take it apart!"
    • Facebook Page
Re: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery
« Reply #3 on: July 04, 2020, 04:23:59 am »
Note that with PiVPN and a SSH server (SFTP/SSHFS) running on the Pi, you can get that functionality without putting your data on the cloud, plus you can use it as an extra layer of security when using public Wifi with questionable security. You can also use Tor to eliminate the need for even dynamic DNS, but that's a lot more involved to set up.
Cryptocurrency has taught me to love math and at the same time be baffled by it.

Cryptocurrency lesson 0: Altcoins and Bitcoin are not the same thing.
 

Offline jandelatv

  • Newbie
  • Posts: 1
  • Country: id
Re: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery
« Reply #4 on: July 05, 2020, 08:12:15 am »
I noticed that my Pixstar picture frame started forgetting things and needing a reset to get it started. Wifi stopped and then the whole frame froze at the Pixstar logo. The 4Gbyte San Disk solid state disk SDIN7DP2-4G was failing, a common fault after 6 years of reading and writing.
This frame uses the S5PV210AH ARM processor from Samsung, a Cortex A7 model running 32 bit code , just like the Raspberry pi......

I extracted the San Disk chip and attached it to a USB to emmc bga 153 chip converter I bought on Ebay to examine the image. There was no boot sector but there were Linux superblocks (Magic number EF 53) and using the UUID signatures in the superblocks (see Wikipedia for superblock structure) I was able to identify four partitions. I worked out the Block size was 1KB or two sectors. I had to insert one block of zeros at the front , I then used the first half of the Block as Master Boot record.
I then put the Block numbers for start and length into a master boot record in the empty sector zero.
I used the binary editor "Hex editor neo" to do all this. I then installed "OSF Mount" under Windows and low and behold four Linux partitions appeared. Only the first 6Mbyte with the U-Boot loader and compressed kernel were not visible (not even a vfat partition). There was a lot of damage to the Linux system, executables  had sectors of zeros in the middle. You can Mount image files not on the USB EMMC for testing.

I then installed Raspian Linux on a partition of my laptop and with the 4GByte San disk image still on the usb converter but now with a Master boot record. I ran the Linux file system checker ( fsck) on the device. This found multiple errors that I recorded into a document I then saved a copy of the entire image using the Linux command dd and then ran fsck in correction mode. I recorded this as well to be able to understand what was damaged and how it was corrected.

Afterwards I allowed the partitions to mount as 4 disks in Raspian (three 128Mbyte and one 3.6gb and one hidden of 6Mbyte). I could then correct several symbolic links on the first partition to BusyBox ( an application that supplies most of the Linux commands such as cd ls ln rm mount etc)

But how to check if it worked at all ? I noticed that the board has 4 large via's in a line at the edge with GND and 3v3 at the outside as a guess I attached a RS232 (3v3 not 5V) to USB converter and then went back to the image to search for the word "baud", next to it was 115200 …

I copied the corrected image, erased the boot sector block and rewrote the image to a new San Disk chip (8GB version purchased on Ebay) using the usb to emmc converter. Windisk imager was used to write to the usb to emmc converter.

I then put the new chip + image back into the frame with the RS232 to usb converter connected to the laptop. I used PUTTY telnet to attach at 115200 baud and default settings of Xon/off.
Eureka I could see U-Boot working and the Kernel then the Linux initd scripts going by. finally it ended in a prompt . Entering whoami resulted in root. I then spent a long time looking at the start up recorded by the PUTTY terminal.

A full embedded Linux 2.6.36 system was shown by running uname -a. 99% of the code was GNU licensed Kernel and GNU packages such as Busybox, BlueZ , OpenSSL, QT and  wpa_supplicant . Kode remote Samsung Some were wrecked and looking at the saved binary image and searching for the ELF signature at the start of programs established missing sectors..

I looked at Raspian and Debian packages on Google for replacement armel versions of the damaged libraries but how to load them to the frame without unsoldering the 153 BGA emmc device. I loaded then to a USB stick and then using the Linux command find / -name xxxxxx (xxxx is a library name I had on the usb stick) to establish where the usb stick was mounted copied them into /lib. The frame then functioned without wifi and Bluetooth.

I then tried to build replacement executables from source on a Raspberry pi......More later


Hi,
I had considered transferring all the function the to Pi but Pixstar frames work by having all pictures on a remote server that accepts emails containing video and pictures from anywhere . As I have pixstar account for this frame (locked to a unique Ethernet address or MAC) I was hoping to resurrect all the function.
Cheers
Kevin
 

Offline humbertomcneary

  • Newbie
  • !
  • Posts: 2
  • Country: us
Re: Pixstar WiFi digital Picture frame San Disk EMMC failure recovery
« Reply #5 on: July 18, 2022, 08:10:12 am »
Hi there. Tbh, I’ve never had this issue, but I guess my friend had. I asked him, and he told me he had found a yt video tutorial that solved his problem. I guess someone who’s had the same problem may have seen that video too.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf