河北聯(lián)通IPTV機(jī)頂盒破解烽火HG680-R

1、河北聯(lián)通IPTV機(jī)頂盒破解烽火HG680-R目錄雜言硬件連接篇開(kāi)機(jī)檢查三、放入U(xiǎn)盤文件并進(jìn)行安裝即破解四、個(gè)人理解的名詞解釋五、附錄辦理寬帶的時(shí)候順便帶了IPTV機(jī)頂盒，到手吃灰了倆月找了找網(wǎng)上的破解資料，發(fā)現(xiàn)只有拆解的，沒(méi)有破解的，索性自己摸索著破解試試看，沒(méi)想到還真的成功了，特此發(fā)帖供有這個(gè)盒子的玩家折騰，cpu是MSO9280 RAM 1G,ROM 4G EMMC編寫by洗洗棗這個(gè)帖子應(yīng)該算是首次破解680-r結(jié)尾的盒子，其他盒子只要是安卓的，方法都大同小異，可以試試。前言：所有的重要東西都用了黃色字體，命令使用了紅色字體， 教程結(jié)尾處會(huì)有各個(gè)紅色字體命令的解釋用途說(shuō)明，教程內(nèi)有所用到的

2、軟件鏈接，直接點(diǎn)擊或者復(fù)制鏈接到下載器即可下載，要分清你我的概念，你的是你的，我的是我的，你的不是我的，我的不是你的， 里面的命令是固定的，但是有可能U盤查到盒子以后的路徑是不一樣的，不要按照我的抄寫，要按照教程操作，并不是抄，謝謝！需要物品清單電腦一臺(tái)，配置隨意，win系統(tǒng)，linux系統(tǒng)的不會(huì)TTL 一個(gè)，我用的5塊多包郵的 CH340機(jī)頂盒一個(gè)，河北版聯(lián)通 IPTV烽火HG680-RFAT32格式的U盤一個(gè)，容量我用的 4G,僅作為參考電視機(jī)一臺(tái)（可選）需要軟件清單Putty下載地址當(dāng)貝桌面下載地址一、硬件連接篇為了方便小白，步驟寫清楚一點(diǎn)，首先把TTL不接任何東西插到電腦上面重要 需要

3、注意如下設(shè)置：TTL設(shè)置電平 重要計(jì)算機(jī)（我的電腦）- 管理- 設(shè)備管理器-CH340-波特率選擇115200點(diǎn)確定硬件連接完畢=華麗麗的分割線=二、開(kāi)機(jī)檢查首先把所有的線連接好，機(jī)頂盒處需要的線是ttl線，電源線，其他的不需要接，電腦方面只需要插上TTL就準(zhǔn)備完畢了。打開(kāi)Putty 設(shè)置com 口與波特率，然后點(diǎn)擊打開(kāi)接下來(lái)打開(kāi)盒子的電源，putty就開(kāi)始接收到數(shù)據(jù)了AC_ONMIUO_DQS-OKMIUOO_URelocation Offset is: 011d7000ATMBstart ub334U-Boot (Apr 02 2016 - 22:51:05)MIU INFO miu op

4、encreate instanee at 559e9418 with private size 80 bytes at 559e9460 create in sta nee at 559e94b8 with private size 52 bytes at 559e9500 uboot held at 557ddf6056b00000,size=013220a0CPU : ClippersBoard: BD_MST207C_D01A_S_CLIPPERSDRAM: 875 MiBNow running in RAM - U-Boot at: 55c00000 eMMC: HS200 200MH

5、z可以進(jìn)行下一步的下面的省略，還有很多，到此如果跟教程一樣的話就說(shuō)明前期操作完美, 操作了。=華麗麗的分割線=三、放入U(xiǎn)盤文件并進(jìn)行安裝即破解找一個(gè)FAT32格式的U盤，最好是空盤，以免出現(xiàn)莫名其妙的問(wèn)題把剛剛下載好的當(dāng)貝桌面放入U(xiǎn)盤的根目錄，然后插入盒子的usb里面然后輸入命令：dfshe 113 orsnse ： /ev ft ifi】t;yi；tpiLi/dev/imi /secure/imi/ascc/imt /nhb/imi/usb/iml/iso/uni Firtirt n/wax/eysteu/cackle/dal 玄/tvSTtr1.cc/tveanfif/tvdatabase

6、/tveustomer/iml /chel 1 /erwulat*kirm/LLsb/sdalH-AHWnwnnn_nnnftnRAn 2 7 7 7 7 T ? T 7 7 d 9 9 o s g sG,6.b&.A6.b6-.&.2.1 .1 .5,&-3. 4U4O狎10羽40404010苛擁抽 5MKK駐KKKK旺吒N吐亞HNKKW c c c -L* c c c c c e- c c efl41 u Ou 0 fi -u fl o o o 4 t 9 no ft- .V q 2 1 6 4 3 4 1 04 1 4- 5 2 3 去測(cè)羽羽刊刊,可理那訓(xùn)柵則川釧卅汗卅 FJD6.闞嵐幣

7、饑照附rf.Llb.SJ.yl.魄阪 L:.11 .為 44444444419$ 94型40964)964 09&409640964咖 40964陽(yáng)& 464 09&405$4096一40964 )9&4 9&:VFG:即二不4、恥這里的/mnt/usb/sdal就是我的U盤所在的目錄，你的可能不一樣，不過(guò)一般都是在mnt文件夾下面的sdal文件夾里面。然后輸入命令進(jìn)入 U盤文件夾下面：cd /mn t/usb/sda1接下來(lái)輸入命令：lsshell oran ge:/m nt/usb/sda1 # Is上面的就是我下載的當(dāng)貝桌面apk接下來(lái)輸入命令進(jìn)行安裝：pm in stall# pm i

8、n stallpkg:in tegrator_set_target_ on _dema ndINFO Data Excha nge Cou nt to User Space: 11INFO Voltage: 115on _dema nd_ha ndshake:epu 3 Bin der_4woke n up, copy cpu_voltage:115epu voltage type:0 change ent: 11 to userspace result is 0 in put: 11, wake_up wait_queue for write_dow nINFO VoltageType: 0

9、 INFO Data Exchange Count from User Space: 11Function = change_cpus_timer, Line = 792, cpu0 do: cpu0 adjust cpufreq for 701000 KHZ to 1200000 KHZcaller: integrator_set_target_on_demandINFO Data Exchange Count to User Space: 12on_demand_handshake: cpu 3 Binder_4 woken up, copy cpu_voltage:115 cpu_vol

10、tage_type:0 change_cnt: 12 to userspaceresult is 0 input: 12, wake_up wait_queue for write_downINFO Voltage: 115INFO VoltageType: 0INFO Data Exchange Count from User Space: 12Function = change_cpus_timer, Line = 792, cpu0 do: cpu0 adjust cpufreq for 1200000 KHZ to 701000 KHZSuccess直到顯示 Success 為止即為安

11、裝成功，下面我們來(lái)驗(yàn)證一下，輸入命令： pmlist packages shellorange:/mnt/usb/sda1 # pm list packagespackage: 仔細(xì)找，可以發(fā)現(xiàn)里面有我們安裝好的當(dāng)貝桌面 apk 程序然后我們來(lái)讓當(dāng)貝桌面啟 動(dòng)起來(lái)，如果盒子連接這電視機(jī)的話就可以看到顯示桌面已經(jīng)換成了當(dāng)貝桌面，命令如下： am start # am start Intent act= cat= pkg= dvfs_boost this client is not runningFunction = write_cpufreq_to_RIU, Line = 516, write

12、cpu_freq to RIU: 0x3E8 caller: integrator_set_target_on_demandINFO Data Exchange Count to User Space: 13on_demand_handshake: cpu 3 Binder_4 woken up, copy cpu_voltage:115cpu_voltage_type:0 change_cnt: 13 to userspaceresult is 0 input: 13, wake_up wait_queue for write_downINFO Voltage: 115INFO Voltag

13、eType: 0INFO Data Exchange Count from User Space: 13shellorange:/mnt/usb/sda1 # cfg80211: Calling CRDA to update world regulatory domainrtusb init rt2870 -此處省略幾百行代碼不需要糾結(jié)顯示了什么result is 0 input: 14, wake_up wait_queue for write_downINFO Voltage: 115INFO VoltageType: 0INFO Data Exchange Count from User

14、 Space: 14Function = change_cpus_timer, Line = 792, cpu0 do: cpu0 adjust cpufreq for 1000000 KHZ to 701000 KHZ顯示到這里，出現(xiàn) INFO Function 就表示已經(jīng)啟動(dòng)當(dāng)貝桌面完成了，到此，破解完成。四、個(gè)人理解的名詞解釋df列出操作系統(tǒng)下的所有分區(qū)cd /mnt/usb/sda1 ls pm install進(jìn)入我的U 盤文件夾下列出我的 U 盤文件夾下的所有文件pm list packages列出所有安裝在系統(tǒng)下的apk安裝當(dāng)貝桌面命令軟件am start運(yùn)行安裝在系統(tǒng)下的apk軟

15、件附錄:cpu info*cpui nfostart*shell oran ge:/ $ cat /proc/cpu infoprocessor:0model n ame:ARMv7 Processor rev 3 (v7l)BogoMIPSFeatures : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id ivtCPU implementer: 0x41CPU architecture: 7CPU varia nt:0x0CPU part:0xc07CPU revisi on:3processor:1model

16、n ame:ARMv7 Processor rev 3 (v7l)BogoMIPSFeatures:swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivtCPU implementer: 0x41CPU architecture: 7CPU varia nt : 0x0CPU part:0xc07CPU revisi on : 3processor:2model n ame:ARMv7 Processor rev 3 (v7l)BogoMIPSFeatures:swp half thumb fastmult vfp e

17、dsp neon vfpv3 tls vfpv4 idiva idivtCPU implementer: 0x41CPU architecture: 7CPU varia nt : 0x0CPU part : 0xc07CPU revisi on : 3processor:3model n ame:ARMv7 Processor rev 3 (v7l)BogoMIPSFeatures:swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivtCPU implementer: 0x41CPU architecture: 7C

18、PU varia nt : 0x0CPU part : 0xc07CPU revisi on : 3Hardware:clippersRevisi on:0020Serial : 0000000000000000*cpu info*memi nfo*memi nfostart*shell oran ge:/proc # cat mem infoMemTotal:MemFree:Buffers:Cached:SwapCached:832964 kB368180 kB5256 kB205304 kB0 kBActive:166216 kBIn active:189372 kBActive(a no

19、n): 145036 kBIn active(a non): 4332 kBActive(file): In active(file): Un evictable: Mlocked: HighTotal: HighFree: LowTotal: LowFree: SwapTotal: SwapFree: Dirty: Writeback: Anon Pages: Mapped:21180 kB185040 kB0 kB0 kB72704 kB1092 kB760260 kB367088 kB102396 kB102396 kB4 kB0 kB145000 kB88716 kBShmem:436

20、8 kBproc /proc proc rw,relatime 0 0Slab:12596 kBSReclaimable:4404 kBSUn reclaim:8192 kBKernelStack:4376 kBPageTables:14560 kBNFS_ Un stable:0 kBBou nee:0 kBWritebackTmp:0 kBCommitLimit:518876 kBCommitted_AS: 8711976 kBVmallocTotal: 245760 kBVmallocUsed:53248 kBVmallocCh un k: 137216 kBCMA Free: 540

21、kBCMAheap info(name,alloc,incache,fail,total free): DEFAULT_CMA_BUFFER96kb 0kb0kb 2600kb) vdec (0kb 0kb 0kb 163840kb)*memi nfoend*mount*mountstart*shell oran ge:/proc # mountrootfs / rootfs ro,relatime 0 0tmpfs /dev tmpfs rw,no suid,relatime,mode=755 0 0devpts /dev/pts devpts rw,relatime,mode=600 0

22、0 sysfs /sys sysfs rw,relatime 0 0debugfs /sys/kernel/debug debugfs rw,relatime 0 0none /acct cgroup rw,relatime,cpuacct 0 0none /sys/fs/cgroup tmpfs rw,relatime,mode=750,gid=1000 0 0tmpfs /mnt/secure tmpfs rw,relatime,mode=700 0 0tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0tmpfs /mnt/obb

23、 tmpfs rw,relatime,mode=755,gid=1000 0 0 none /dev/cpuctl cgroup rw,relatime,cpu 0 0tmpfs /mnt/usb tmpfs rw,relatime,mode=755,gid=1000 0 0tmpfs /mnt/iso tmpfs rw,relatime,mode=755,gid=1000 0 0 tmpfs /mnt/samba tmpfs rw,relatime,mode=755,gid=1000 0 0 tmpfs /var tmpfs rw,relatime,mode=775,gid=1000 0 0

24、 /dev/block/platform/by-name/system /system ext4 ro,relatime,data=ordered 0 0 /dev/block/platform/by-name/cache/cacherw,nosuid,nodev,noatime,data=ordered 0 0/dev/block/platform/by-name/userdata /data rw,nosuid,nodev,noatime,data=ordered 0 0/dev/block/platform/by-name/tvservice /tvservice ext4 ro,rel

25、atime,data=ordered 0/dev/block/platform/by-name/tvconfig /tvconfig ext4 ro,relatime,data=ordered 0 0 /dev/block/platform/by-name/tvdatabase/tvdatabaserw,nosuid,nodev,noatime,data=ordered 0 0/dev/block/platform/by-name/tvcustomer/tvcustomerrw,nosuid,nodev,noatime,data=ordered 0 0adb /dev/usb-ffs/adb

26、functionfs rw,relatime 0 0/dev/fuse /mnt/shell/emulated rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_oext4ext4ext4ext4fusether 0 0*amount end*PS*ps start*shell oran ge:/ # psUSERPIDPPIDVSIZE RSS WCHAN PCNAMEroot10604440 c0109e40 0001a09c S /in itroot2000c0046d64 0000

27、0000 S kthreaddroot3200C004e8f0 00000000 S ksoftirqd/0root4200c00408dc 00000000 S kworker/0:0root5200c00408dc 00000000 S kworker/0:0Hroot6200c00408dc 00000000 S kworker/u8:0root7200C004e8f0 00000000 S migratio n/0root8200C008b5e0 00000000 S rcu_preemptroot9200C008b378 00000000 S rcu_bhroot10200C008b

28、378 00000000 S rcu_schedroot11200C004e8f0 00000000 S migratio n/1root12200C004e8f0 00000000 S ksoftirqd/1root13200c00408dc 00000000 S kworker/1:0root14200c00408dc 00000000 S kworker/1:0Hroot15200C004e8f0 00000000 S migratio n/2root16200C004e8f0 00000000 S ksoftirqd/2root18200c00408dc 00000000 S kwor

29、ker/2:0Hroot19200C004e8f0 00000000 S migratio n/3root20200C004e8f0 00000000 S ksoftirqd/3root21200c00408dc 00000000 S kworker/3:0root22200c00408dc 00000000 S kworker/3:0Hroot23200C0040650 00000000 S khelperroot 24 2root 25 2root 30 2root 31 2root 277 2root 279 2root 281 2root 293 2root 307 2root 399

30、 2root 411 2root 456 2root 473 2root 477 2root 489 2root 622 2root 623 2root 624 2root 658 2root 700 2root 731 2root 743 2root 748 2root 753 2root 755 1root 1049 20 0 c034b640 00000000 S kdevtmpfs0 0 c00408dc 00000000 S kworker/u8:10 0 bf04e9fc 00000000 S kworker/1:10 0 c00408dc 00000000 S kworker/2

31、:10 0 c0040650 00000000 S writeback0 0 c0040650 00000000 S bioset0 0 c0040650 00000000 S kblockd0 0 c03a7e88 00000000 S khubd0 0 c045729c 00000000 S ion_system_heap0 0 c0040650 00000000 S rpciod0 0 c00c775c 00000000 S kswapd00 0 c0135d48 00000000 S fsnotify_mark0 0 c0040650 00000000 S nfsiod0 0 c004

32、0650 00000000 S cifsiod0 0 c0040650 00000000 S crypto0 0 c0442fa0 00000000 S mmcqd/00 0 c0442fa0 00000000 S mmcqd/0boot00 0 c0442fa0 00000000 S mmcqd/0boot10 0 c0040650 00000000 S binder0 0 c00338c4 00000000 D Delay Free Task0 0 c0040650 00000000 S deferwq0 0 c0040650 00000000 S f_mtp0 0 c03ca3b0 00

33、000000 S file-storage0 0 c0040650 00000000 S ms_otg_queue528 4 c0109e40 0001a09c S /sbin/ueventd0 0 c01dc440 00000000 S jbd2/mmcblk0p6-root1050 2c0040650 00000000 S ext4-dio-unwritroot 1051 2 0 0 c01dc440 00000000 S jbd2/mmcblk0p8-root1052200c0040650 00000000 S ext4-dio-unwritroot1053200c01dc440 000

34、00000 S jbd2/mmcblk0p7-root1054200c0040650 00000000 S ext4-dio-unwritroot1055200c01dc440 00000000 S jbd2/mmcblk0p9-root1056200c0040650 00000000 S ext4-dio-unwritroot1057200c01dc440 00000000 S jbd2/mmcblk0p10root1058200c0040650 00000000 S ext4-dio-unwritroot1059200c01dc440 00000000 S jbd2/mmcblk0p11r

35、oot1060200c0040650 00000000 S ext4-dio-unwritroot1061200c01dc440 00000000 S jbd2/mmcblk0p12root1062200c0040650 00000000 S ext4-dio-unwritroot1069200c00408dc 00000000 S kworker/u9:0root1077200c0412fac 00000000 S rc0root1081200c0040650 00000000 S keydispatch_wqroot109411436 4c0139ac0 00011804 S /sbin/

36、healthdsystem 1095 1 1036 172 c04647d0 b6ec85bc S /system/bin/servicemanagerroot 1096 1 6012 1296 ffffffff b6f46eb4 S /system/bin/voldsystem 1097 1 4580 744 ffffffff b6f355bc S /system/bin/resourcemanagerroot1098 19804 984ffffffff b6ef6eb4 S /system/bin/netdroot1099 11060 232c04f41dc b6f7c2b0 S /sys

37、tem/bin/debuggerdsystem1100 11280129564 ffffffff b6e8c76c S /system/bin/surfaceflingerroot1101 1494088 45112 ffffffff S zygotedrm1102 119080 6252 ffffffff b6e655bc S /system/bin/drmservermedia 1103 1 129860 18652 ffffffff b6e7c5bc S /system/bin/mediaserverinstall 1104 1 1020 212 c05a21e0 b6ed62f8 S

38、/system/bin/installd keystore 1106 1 3376 976 c04647d0 b6f205bc S /system/bin/keystoreroot1107 14540880ffffffffb6f4b5bcS/system/bin/upgrade_system_serverroot1108 13428684ffffffffb6eb55bcS/system/bin/RootShellServermedia_rw 1110 13532 184 ffffffff b6f082f8 S /system/bin/sdcardsystem 1111 14368 612 ff

39、ffffffb6ea75bc S /system/bin/browserserverbluetooth 1113 118332 5672 ffffffff b6e03708 S /system/bin/mtkbtroot 1115 1888 160 c0109e40 b6f217f4 S /system/bin/logwrapperroot 1116 1888 160 c0109e40 b6f047f4 S /system/bin/logwrapperroot11181115 2138236 8384c0038ca8 b6ec9e34 S/applications/bin/MiSysSrvro

40、ot11191116 26724 8220 ffffffff b6f2b5bc S /applications/bin/tvosshell11231 936468 c0038d10 b6e92140 S /system/bin/shroot113211070 c002936c 00000000 Z lsroot11360 c00408dc 00000000 S kworker/0:2root12060 c00408dc 00000000 S kworker/2:2root128911182357344 9820ffffffffb6ec95bc/applications/bin/MiSysSrv

41、root1291 2c00408dc 00000000 S kworker/1:3root1547 2c00408dc 00000000 S kworker/3:2root1563 2c00408dc 00000000 S kworker/0:1Hsystem15731101598180 41276 ffffffff 4014776c S system_serveru0_a316511101528084 29704 ffffffff 4014776c S1669 1101 50720822576ffffffff4014776c S1744 1101503184 21240 ffffffff40

42、14776c70920 ffffffff1759 1101 506984 21816 ffffffff4014776c S 1768 1101 625472*start*4014776c S17751101524812 26232 ffffffff4014776cS17901101504052 18524 ffffffff 4014776c S 1809 1101 503104 19976ffffffff1821 1101 50426018276 ffffffff4014776c S 1871 1101 5053004014776cS19420 ffffffff4014776c S 1935

43、1101 504176 20772 ffffffff 4014776c S1966 2 0 0 bf0df5bc 00000000 S krfcommd2010 1101 505224u0 a251975 1101 559640 49572 ffffffff 4014776c S17704 ffffffff4014776c S20361101508000 21836 ffffffff2064 1101 51114022964 ffffffff4014776c S2087 1101 5093484014776c S 2155 1101 53952435576 ffffffff4014776c S

44、 29434014776c S19876 ffffffff1123 936468c0038d10 b6ed9140 S shroot29732943936476root30332973936472root30413033936476c0038d10 b6f15140 S shc0038d10 b6f46140 S shc0038d10 b6ea7140 S shroot3052c00408dc 00000000 S kworker/2:1Hroot30913041932468c0038d10 b6ee1140 S shroot30963091936484c0038d10 b6ec1140 S

45、shroot31403096936468c0038d10 b6f07140 S shroot31853140936472c0038d10 b6ede140 S shroot32093185936476c0038d10 b6ee0140 S shroot32713209932472c0038d10 b6ea8140 S shroot32793271936484c0038d10 b6f81140 S shroot33063279932468c0038d10 b6efb140 S shroot33123306932320c0038d10 b6ee2140 S shroot33213312127223

46、200000000 b6e9c2f8 R ps*ps end*busybox shell oran ge:/ # busyboxBusyBox (2011-11-10 14:20:50 CST) multi-call bin ary.Copyright (C) 1998-2011 Erik Andersen, Rob Landley, Denys Vlasenko and others. Lice nsed un der GPLv2.See source distributi on for full no tice.Usage: busybox function argume nts.or:

47、busybox -list-fullor: fun cti on argume nts.BusyBox is a multi-call binary that comb ines many com mon Unix utilities into a sin gle executable. Most people will create a link to busybox for each function they wish to use and BusyBox will act like whatever it was in voked as.Curre ntly defi ned func

48、tions:,acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, base name, beep, blkid, blockdev, bootchartd, brctl, bun zip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chow n, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm, cp, cpio, crond, cron ta

49、b, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dir name, dmesg, dn sd, dn sdoma inn ame, dos2 unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, en vdir, en vuidgid, ether-wake, expa nd, expr, fakeide ntd, false, fbset, fbsplash,

50、 fdflush, fdformat, fdisk, fgcon sole, fgrep, find, fin dfs, flock, fold, free, freeramdisk,fsck, , fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown, ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, le