Nikita S.

More CMSXJ16A output. There is seems uboot console available if you press enter before it boots kernel. ``` IPL gd156225 D-01. HW Reset 64MB BIST0_0001-OK offset:00010000 size:7fc8 chks:5551a134 ok IPL_CUST...

Get ssh running, replace http://192.168.1.224:8000/hacks/ssh-server/bin/dropbear with your url to armv7l dropbear ``` killall hostapd echo -ne "network={\n ssid=\"gx-iot\"\n psk=\"YOUR_PASSWORD\"\n}\n" > /tmp/wpa.conf wpa_supplicant -B -i wlan0 -c /tmp/wpa.conf -D wext udhcpc...

@OUARZA Check this thread with photos: https://github.com/roleoroleo/yi-hack-MStar/issues/376

@irusanov So, your method was to use ZenStates to set lower DID and higher FID?

> Switching to an X11 session with the Nvidia GPU makes these issues go away too Not true for me. As far as I remember some versions of Nvidia Windows...

I have another one from Aliexpress(https://www.aliexpress.com/item/1005009708341434.html). Managed to get adb shell and then uploaded telnet binary ``` Linux CarPlayBox 4.9.191 #1203 PREEMPT Thu Jul 31 03:53:52 UTC 2025 armv7l GNU/Linux...

 ``` sudo sunxi-fel list USB device 001:003 Allwinner V853 62c05e00:8c404820:01055b28:209a205a ```

Reading flash using xfel in FEL mode: ``` xfel.exe spinor read 0x00000000 16777216 spinor_dump.bin ``` Partition map: ``` 0x000000000000-0x000000060000 : "uboot" 0x000000060000-0x0000002a0000 : "boot" 0x0000002a0000-0x000000730000 : "rootfs" 0x000000730000-0x0000007b0000 : "rootfs_data"...

> [@gxcreator](https://github.com/gxcreator) did buy the same device as yours, can you share fw dump here? So I dont have to open mine ? Extracted FS: [extracted_flash.tar.gz](https://github.com/user-attachments/files/23148057/extracted_flash.tar.gz) Raw dump: https://disk.yandex.ru/d/r_pLJkF2_ohssw

By the way, you dont need to open device to gain root access: 1. Install adb drivers 2. Connect device to USB port 3. There will be few seconds when...