Introduction

I caught A–flu one weekend and was too tired to think about anything serious. Between fever spikes and boredom, I noticed a couple of VNPT MyTV Smartbox 2 units (Amlogic S805) that had been sitting untouched for years. They originally ran Android 4.4 — far too outdated to be useful now — but still perfectly functional pieces of hardware.

I cracked one open. The inside was far better than expected for a low-cost IPTV box: clean PCB layout, solid soldering, proper shielding, stable power rails, and easy UART pads placed exactly where you want them. Once connected, the board showed a short one-second U-Boot window. If I didn’t interrupt it in time, it would simply continue into Android and drop me directly into a root shell — unexpectedly convenient.

From there, the idea was simple: turn these obsolete Android boxes into small Debian/Armbian machines. Nothing serious — just a side quest while recovering.

This article is not a step-by-step guide. It is simply a record of what I tried, what worked, and what didn’t during the process of making Debian boot on this hardware.

The Easy Part

Before things got complicated, the first board behaved perfectly. I documented both sides of the PCB and marked the pins that are useful for anyone interested in eMMC wiring — D0, CLK, CMD, and the 3.3V rail. The backside also has a neat “1701” printing, suggesting the board was manufactured in week 01 of 2017. For a cheap IPTV device, the layout is surprisingly clean and serviceable.

For the initial test, I downloaded an image from
https://github.com/hzyitc/armbian-onecloud.

For loading Armbian manually, I stopped at the U-Boot prompt and used the following command set.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

mmc part list # To rescan mmc

setenv loadaddr     0x12000000
setenv initrd_addr  0x13000000
setenv fdt_addr     0x01000000

# Load the kernel and initrd from the SD card (Armbian image uses a separate FAT boot partition, so U-Boot sees it as mmcblk0p1)
fatload mmc 0:1 ${loadaddr} uImage
fatload mmc 0:1 ${initrd_addr} uInitrd
fatload mmc 0:1 ${fdt_addr} dtb/meson8b_m201_1G.dtb

# Set the boot arguments. Amlogic assigns the SD card as mmcblk0, and the root filesystem is on partition 2:
setenv bootargs 'console=ttyS0,115200n8 earlyprintk ignore_loglevel root=/dev/mmcblk0p2 init=/init rootwait rw fsck.repair=yes no_console_suspend vdaccfg=0xa000 clk_ignore_unused hdmimode=1080p cvbsmode=576cvbs hdmitx=cecb'

bootm ${loadaddr} ${initrd_addr} ${fdt_addr}

It booted immediately on the first try, but with major limitations: no WiFi, no GPU acceleration, and even the internal eMMC wasn’t detected. It only ran properly from the SD card, so that wasn’t good enough.

I switched to an older build instead:
Armbian_5.99_Aml-s805_Debian_buster_default_3.10.108_minimal.img, which uses the original Amlogic 3.x kernel. This one worked far better. The system booted cleanly, and after adjusting a few DTB settings, WiFi came up as well. Everything felt simple and straightforward — at that point I thought the work was easy and should be done soon.

The Unexpected Wall

The strange board

After the smooth progress on the first unit, I moved on to the second Smartbox 2 — this one had a manufacturing code 1832 (week 32 of 2018). Same board revision, same SoC, same memory chips, same layout. I assumed it would behave identically.

I was wrong.

I flashed the exact same Armbian images, used the same SD card, same UART setup, and the same U-Boot commands.
No matter how many times I tried, it refused to boot anything other than its stock Android.

The system always stopped right after U-Boot printed: Starting kernel

And then: nothing.
No HDMI output, no kernel logs, not even UART noise. Changing kernel log level, adding earlyprintk, modifying console settings, or forcing init to a busybox shell made no difference.

Boot log

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

QA5:B;SVN:B72;POC:1DF;STS:0;BOOT:0;INIT:0;READ:0;

U-boot-00000-ge0c1103-dirty(m8b_m201_v1@) (Feb 02 2018 - 15:47:12)

clr h-ram
DRAM:  1 GiB
relocation Offset is: 2fec4000
aml_card_type=0x200
MMC:   [mmc_register] add mmc dev_num=0, port=1, if_type=6
[mmc_register] add mmc dev_num=1, port=2, if_type=6
SDIO Port B: 0, SDIO Port C: 1
power init
out reg=c110804c,value=dfffffff
IR init done!
register usb cfg[0][1] = 3ff67d4c
register usb cfg[2][0] = 3ff6ac98
NAND:  EMMC BOOT: not init nand
do not init nand : cause boot_device_flag without nand
get_boot_device_flag: init_ret -1
get_boot_device_flag EMMC BOOT:
Emmckey: Access range is illegal!
[mmc_init] SDIO Port C:1, if_type=7, initialized OK!
[mmc_get_partition_table] skip cache partition.
Partition table get from SPL is :
        name                        offset              size              flag
===================================================================================
   0: bootloader                         0            400000                  0
   1: reserved                     2400000           4000000                  0
   2: cache                        6c00000          20000000                  2
   3: env                         27400000            800000                  0
   4: logo                        28400000           2000000                  1
   5: recovery                    2ac00000           2000000                  1
   6: misc                        2d400000           2000000                  1
   7: boot                        2fc00000           2000000                  1
   8: system                      32400000          40000000                  1
   9: data                        72c00000         15f400000                  4
mmc read lba=0x12000, blocks=0x1
mmc read lba=0x12001, blocks=0x1
mmc_read_partition_tbl: mmc read partition OK!
eMMC/TSD partition table have been checked OK!
i=0,register --- emmc_key
mmc_storage_probe 493
mmc  storage node0  addr = 2600000 and node1 addr = 2640000
MMC BOOT, emmc_env_relocate_spec : env_relocate_spec 59
set_storage_device_flag: store 2
[imgread]Secure kernel sz 0x7c4730
      Multi dtb tool version: v2 .
      Multi dtb detected, support 2 dtbs.
        aml_dt soc: m8b platform: m201 variant: 1G
        dtb 0 soc: m8b                plat: m201               vari: 1G
        dtb 1 soc: m8b                plat: m201               vari: 2G
      Find match dtb: 0
vpu clk_level in dts: 3
set vpu clk: 182150000Hz, readback: 182150000Hz(0x701)
Net:   Meson_Ethernet
main_loop...
cvbs trimming.1.v5: 0xa0, 0x1
preboot...
hdmi tx power init
TV mode 576cvbs selected.
vdac open.1 = 0x1, 0x1
mode is: 4
viu chan = 1
config HPLL
config HPLL done
reboot_mode=charging
### main_loop entered: bootdelay=1

### main_loop: bootcmd="run mytvboot; if test ${bootfromnand} = 1; then setenv bootfromnand 0; saveenv; else run bootfromsd; run bootfromusb; run bootfromemmc; fi; run storeboot"
Hit Enter key to stop autoboot -- :  0
exit abortboot: 0
(Re)start USB(0)...
USB0:   dwc_usb driver version: 2.94 6-June-2012
USB (1) peri reg base: c1108820
USB (1) use clock source: XTAL input
USB (1) base addr: 0xc90c0000
Force id mode: Host
dwc_otg: No USB device found !
lowlevel init failed
USB error: all controllers failed lowlevel init

** Invalid boot device **

** Invalid boot device **

** Invalid boot device **

** Invalid boot device **
[mmc_init] SDIO Port B:0, if_type=7, initialized OK!
reading s805_autoscript

1991 bytes read
## Executing script at 01000000
reading uInitrd

4373257 bytes read
reading uImage

6608764 bytes read
reading dtb.img

** Unable to read "dtb.img" from mmc 0:1 **
[imgread]Secure kernel sz 0x7c4730
      Multi dtb tool version: v2 .
      Multi dtb detected, support 2 dtbs.
        aml_dt soc: m8b platform: m201 variant: 1G
        dtb 0 soc: m8b                plat: m201               vari: 1G
        dtb 1 soc: m8b                plat: m201               vari: 2G
      Find match dtb: 0
## Booting kernel from Legacy Image at 14000000 ...
   Image Name:   Linux-3.10.108
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    6608700 Bytes = 6.3 MiB
   Load Address: 00208000
   Entry Point:  00208000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 15000000 ...
   Image Name:   uInitrd
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    4373193 Bytes = 4.2 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 11800000
   Booting using the fdt blob at 0x11800000
   Uncompressing Kernel Image ... OK
uboot time: 12750841 us.
EFUSE machid is not set.
Using machid 0xf81 from environment
From device tree /memory/ node aml_reserved_end property, for relocate ramdisk and fdt, relocate_addr: 0x4435001
   Loading Ramdisk to 04009000, end 04434ac9 ... OK
   Loading Device Tree to 04000000, end 04008845 ... OK

Starting kernel ...

This behavior matched exactly what another person reported online:
https://forum.armbian.com/topic/33667-amlogic-s805-image/

The symptoms are identical:
U-Boot runs normally, then the kernel simply never starts.

At this point, I suspected something deeper than a bad SD card or wrong DTB.
Everything pointed to U-Boot itself.

Attempts to Fix It (All Failed)

Loading U-Boot via USB Burning Protocol (update tool)

For this test I used the open-source Amlogic USB burning utility from:

https://github.com/Stane1983/aml-linux-usb-burn

The tool provides a userspace binary named update, which communicates with the SoC’s USB Download Mode and can upload binaries directly into RAM and execute them.
This is the same protocol used by the official Amlogic Windows “USB Burning Tool”, but exposed in a CLI form.

Because the VNPT Smartbox 2 uses an Amlogic M8/M8B (S805) chip, I followed the procedure documented in Amlogic Update USB Tool User Guide — Section 4.1.2:

1
2
3
4
5
6
7
8
9

a > update cwr ddr_init.bin 0xd9000000 // upload ddr_init.bin into RAM
b > update run 0xd9000030 // run ddr_init.bin to init DDR/PLL

c > update write u-boot-comp.bin 0x00400000 // upload compressed SPL/TPL to RAM
d > update write decompressPara_4M.dump 0xd9010000
// parameter blob for decompression

e > update run 0xd9000030 // run ddr_init.bin again to decompress TPL
f > update run 0x001000000 // finally run U-Boot

This sequence should:

1. Initialize DRAM
2. Load a compressed U-Boot (TPL/SPL) blob
3. Decompress it into RAM
4. Execute the newly uploaded U-Boot entirely from USB

I repeated this procedure with multiple U-Boot images taken from various S805 boards:

• MXQ S805
• M201/M201D
• Tronsmart S85
• ENY M8B
• Several community-built S805 U-Boots

Every attempt behaved the same: right after update run 0x10000000, the target board instantly rebooted. There was never any UART output from the uploaded U-Boot, and the reboot happened so fast that even the ROM banner did not change.

Burning U-Boot into SD Card for External Boot

I also tried forcing the board to boot an external U-Boot from a microSD card. First, I used AML Boot Card Maker to generate a proper Amlogic boot SD with u-boot.bin written to the first sectors. Then I repeated the process manually using dd, writing both community S805 U-Boot binaries and the bootloader dump from my working 1701 board.
No matter how the SD card was prepared, the 1832 board completely ignored it — no UART output, no fallback, no SD boot attempts at all.

Full eMMC Transplant and Bootloader Replacement

Since USB and SD card boot were both blocked, the next step was the most invasive one: desoldering the eMMC from the 1832 board to rewrite the bootloader externally. I removed the eMMC chip, dumped its contents with an external reader, and compared it against the fully working 1701 board. Amlogic stores U-Boot in three locations: boot0, boot1, and the first few megabytes of the user area (the “bootloader” partition, usually the first ~4 MB). Because all three regions must match, I replaced boot0, boot1, and the user area with the known-good data from the working device.

With the cloned bootloader installed, the board failed instantly. UART printed only the BootROM diagnostic:

1

QA5:B;SVN:B72;POC:1DF;STS:0;BOOT:0;INIT:0;READ:0;CHECK:FFFFBF00;BOOT:1;INIT:10;USB:3;

This line means:

• BOOT:0 → try internal eMMC
• INIT:0 → eMMC detected
• READ:0 → read OK
• CHECK:FFFFBF00 → signature/hash verification failed
• BOOT:1 / INIT:10 → SD card not present
• USB:3 → USB Burning mode available but not connected

I then tried a safer variant: keep the original boot0/boot1, only replace the user-area bootloader. This allowed U-Boot to start, but the moment I ran the kernel with bootm, U-Boot printed:

1

aml log : check is 3