河北联通IPTV机顶盒破解烽火HG680-R

河北联通 IPTV 机顶盒破解烽火 HG680 R 目录 零 杂言 一 硬件连接篇 二 开机检查 三 放入 U 盘文件并进行安装即破解 四 个人理解的名词解释 五 附录 办理宽带的时候顺便带了 IPTV 机顶盒 到手吃灰了俩月找了找网上的破解资料 发现 只有拆解的 没有破解的 索性自己摸索着破解试试看 没想到还真的成功了 特此发帖 供有这个盒子的玩家折腾 cpu 是 MSO9280 RAM 1G ROM 4G EMMC 编写 by 洗洗枣 这个帖子应该算是首次破解 680 r 结尾的盒子 其他盒子只要是安卓的 方法都大同 小异 可以试试 前言 所有的重要东西都用了黄色字体 命令使用了红色字体 教程结尾处会有各个 红色字体命令的解释用途说明 教程内有所用到的软件链接 直接点击或者复制链接到下 载器即可下载 要分清你我的概念 你的是你的 我的是我的 你的不是我的 我的不是 你的 里面的命令是固定的 但是有可能 U 盘查到盒子以后的路径是不一样的 不要按照 我的抄写 要按照教程操作 并不是抄 谢谢 需要物品清单 电脑一台 配置随意 win 系统 linux 系统的不会 TTL 一个 我用的 5 块多包邮的 CH340 机顶盒一个 河北版联通 IPTV 烽火 HG680 R FAT32 格式的 U 盘一个 容量我用的 4G 仅作为参考 电视机一台 可选 需要软件清单 Putty 下载地址 当贝桌面下载地址 一 硬件连接篇 为了方便小白 步骤写清楚一点 首先把 TTL 不接任何东西插到电脑上面 重要 需要注意如下设置 TTL 设置电平 3 3V 重要 计算机 我的电脑 管理 设备管理器 CH340 波特率选择 115200 点确定 硬件连接完毕 华丽丽的分割线 二 开机检查 首先把所有的线连接好 机顶盒处需要的线是 ttl 线 电源线 其他的不需要接 电脑方面 只需要插上 TTL 就准备完毕了 打开 Putty 设置 com 口与波特率 然后点击打开 接下来打开盒子的电源 putty 就开始接收到数据了 AC ON MIU0 DQS OK MIU00 U Relocation Offset is 011d7000 AT MB start ub 334 U Boot 2011 06 Apr 02 2016 22 51 05 MIU INFO miu opencreate instance at 559e9418 with private size 80 bytes at 559e9460 create instance at 559e94b8 with private size 52 bytes at 559e9500 uboot held at 557ddf60 56b00000 size 013220a0 CPU Clippers Board BD MST207C D01A S CLIPPERS DRAM 875 MiB Now running in RAM U Boot at 55c00000 eMMC HS200 200MHz 下面的省略 还有很多 到此如果跟教程一样的话就说明前期操作完美 可以进行下一步 的操作了 华丽丽的分割线 三 放入 U 盘文件并进行安装即破解 找一个 FAT32 格式的 U 盘 最好是空盘 以免出现莫名其妙的问题 把刚刚下载好的当贝桌面放入 U 盘的根目录 然后插入盒子的 usb 里面 然后输入命令 df 这里的 mnt usb sda1 就是我的 U 盘所在的目录 你的可能不一样 不过一般都是在 mnt 文件夹下面的 sda1 文件夹里面 然后输入命令进入 U 盘文件夹下面 cd mnt usb sda1 接下来输入命令 ls shell orange mnt usb sda1 ls DangBeiTvLauncher 2 1 2 znds apk LOST DIR 上面的 DangBeiTvLauncher 2 1 2 znds apk 就是我下载的当贝桌面 apk 接下来输入命令进行安装 pm install DangBeiTvLauncher 2 1 2 znds apk shell orange mnt usb sda1 pm install DangBeiTvLauncher 2 1 2 znds apk pkg DangBeiTvLauncher 2 1 2 znds apk caller integrator set target on demand INFO Data Exchange Count to User Space 11 INFO Voltage 115 on demand handshake cpu 3 Binder 4 woken up copy cpu voltage 115 cpu voltage type 0 change cnt 11 to userspace result is 0 input 11 wake up wait queue for write down INFO VoltageType 0 INFO Data Exchange Count from User Space 11 Function change cpus timer Line 792 cpu0 do cpu0 adjust cpufreq for 701000 KHZ to 1200000 KHZ caller integrator set target on demand INFO Data Exchange Count to User Space 12 on demand handshake cpu 3 Binder 4 woken up copy cpu voltage 115 cpu voltage type 0 change cnt 12 to userspace result is 0 input 12 wake up wait queue for write down INFO Voltage 115 INFO VoltageType 0 INFO Data Exchange Count from User Space 12 Function change cpus timer Line 792 cpu0 do cpu0 adjust cpufreq for 1200000 KHZ to 701000 KHZ Success 直到显示 Success 为止即为安装成功 下面我们来验证一下 输入命令 pm list packages shell orange mnt usb sda1 pm list packages package com boyaa scmj tv youle package com mstar android providers tv package com android printspooler package com android defcontainer package android package com android settings package com android externalstorage package com hbunicom iptv package com ipanel ime package com android proxyhandler package cn cheerz ihw package com android dummyactivity package com android systemui package com android inputdevices package com ipanel home ctc upgrade package com android smspush package com android packageinstaller package com mstar miscsetting package com cloud cyber package com mstar tvsetting package com ipanel apps loading package com dangbei tvlauncher package com svox pico package com android smart terminal nativeplayer package com hpplay happyplay aw package com huawei iptv stb videotalk activity package mstar android tv package com android mcast package com voole vooledesktop package com android documentsui package com live firsttv package com CTC ChinaNet android tm package com broadcom bluetoothmonitor package com android wallpapercropper package com android sharedstoragebackup package com android location fused package com android backupconfirm package com android providers settings package com android vpndialogs package com vogins wodou package com voole webepg package com android keyguard package com android pacprocessor package com huawei dsm package com android shell package com suning tv ebuy package com mstar tv service package rca rc tvtaobao 仔细找 可以发现里面有我们安装好的当贝桌面 apk 程序 com dangbei tvlauncher 然后我们来让当贝桌面启动起来 如果盒子连接这电视机的话就可以看到显示桌面已经换 成了当贝桌面 命令如下 am start com dangbei tvlauncher shell orange mnt usb sda1 am start com dangbei tvlauncher Starting Intent act android intent action MAIN cat android intent category LAUNCHER pkg com dangbei tvlauncher dvfs boost this client is not running Function write cpufreq to RIU Line 516 write cpu freq to RIU 0 x3E8 caller integrator set target on demand INFO Data Exchange Count to User Space 13 on demand handshake cpu 3 Binder 4 woken up copy cpu voltage 115 cpu voltage type 0 change cnt 13 to userspace result is 0 input 13 wake up wait queue for write down INFO Voltage 115 INFO VoltageType 0 INFO Data Exchange Count from User Space 13 shell orange mnt usb sda1 cfg80211 Calling CRDA to update world regulatory domain rtusb init rt2870 此处省略几百行代码不需要纠结显示了什么 result is 0 input 14 wake up wait queue for write down INFO Voltage 115 INFO VoltageType 0 INFO Data Exchange Count from User Space 14 Function change cpus timer Line 792 cpu0 do cpu0 adjust cpufreq for 1000000 KHZ to 701000 KHZ 显示到这里 出现 INFO Function 就表示已经启动当贝桌面完成了 到此 破解完成 四 个人理解的名词解释 df 列出操作系统下的所有分区 cd mnt usb sda1 进入我的 U 盘文件夹下 ls 列出我的 U 盘文件夹下的所有文件 pm install DangBeiTvLauncher 2 1 2 znds apk 安装当贝桌面命令 pm list packages 列出所有安装在系统下的 apk 软 件 am start com dangbei tvlauncher 运行安装在系统下的 apk 软件 附录 cpuinfo cpuinfo start shell orange cat proc cpuinfo processor 0 model name ARMv7 Processor rev 3 v7l BogoMIPS 1392 92 Features swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id ivt CPU implementer 0 x41 CPU architecture 7 CPU variant 0 x0 CPU part 0 xc07 CPU revision 3 processor 1 model name ARMv7 Processor rev 3 v7l BogoMIPS 1402 89 Features swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id ivt CPU implementer 0 x41 CPU architecture 7 CPU variant 0 x0 CPU part 0 xc07 CPU revision 3 processor 2 model name ARMv7 Processor rev 3 v7l BogoMIPS 1402 89 Features swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id ivt CPU implementer 0 x41 CPU architecture 7 CPU variant 0 x0 CPU part 0 xc07 CPU revision 3 processor 3 model name ARMv7 Processor rev 3 v7l BogoMIPS 1402 89 Features swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id ivt CPU implementer 0 x41 CPU architecture 7 CPU variant 0 x0 CPU part 0 xc07 CPU revision 3 Hardware clippers Revision 0020 Serial 0000000000000000 cpuinfo end meminfo meminfo start shell orange proc cat meminfo MemTotal 832964 kB MemFree 368180 kB Buffers 5256 kB Cached 205304 kB SwapCached 0 kB Active 166216 kB Inactive 189372 kB Active anon 145036 kB Inactive anon 4332 kB Active file 21180 kB Inactive file 185040 kB Unevictable 0 kB Mlocked 0 kB HighTotal 72704 kB HighFree 1092 kB LowTotal 760260 kB LowFree 367088 kB SwapTotal 102396 kB SwapFree 102396 kB Dirty 4 kB Writeback 0 kB AnonPages 145000 kB Mapped 88716 kB Shmem 4368 kB Slab 12596 kB SReclaimable 4404 kB SUnreclaim 8192 kB KernelStack 4376 kB PageTables 14560 kB NFS Unstable 0 kB Bounce 0 kB WritebackTmp 0 kB CommitLimit 518876 kB Committed AS 8711976 kB VmallocTotal 245760 kB VmallocUsed 53248 kB VmallocChunk 137216 kB CMA Free 540 kB CMA heap info name alloc in cache fail total free DEFAULT CMA BUFFER 1496kb 0kb 0kb 2600kb vdec 0kb 0kb 0kb 163840kb meminfo end mount mount start shell orange proc mount rootfs rootfs ro relatime 0 0 tmpfs dev tmpfs rw nosuid relatime mode 755 0 0 devpts dev pts devpts rw relatime mode 600 0 0 proc proc proc rw relatime 0 0 sysfs sys sysfs rw relatime 0 0 debugfs sys kernel debug debugfs rw relatime 0 0 none acct cgroup rw relatime cpuacct 0 0 none sys fs cgroup tmpfs rw relatime mode 750 gid 1000 0 0 tmpfs mnt secure tmpfs rw relatime mode 700 0 0 tmpfs mnt asec tmpfs rw relatime mode 755 gid 1000 0 0 tmpfs mnt obb tmpfs rw relatime mode 755 gid 1000 0 0 none dev cpuctl cgroup rw relatime cpu 0 0 tmpfs mnt usb tmpfs rw relatime mode 755 gid 1000 0 0 tmpfs mnt iso tmpfs rw relatime mode 755 gid 1000 0 0 tmpfs mnt samba tmpfs rw relatime mode 755 gid 1000 0 0 tmpfs var tmpfs rw relatime mode 775 gid 1000 0 0 dev block platform mstar mci 0 by name system system ext4 ro relatime data ordered 0 0 dev block platform mstar mci 0 by name cache cache ext4 rw nosuid nodev noatime data ordered 0 0 dev block platform mstar mci 0 by name userdata data ext4 rw nosuid nodev noatime data ordered 0 0 dev block platform mstar mci 0 by name tvservice tvservice ext4 ro relatime data ordered 0 0 dev block platform mstar mci 0 by name tvconfig tvconfig ext4 ro relatime data ordered 0 0 dev block platform mstar mci 0 by name tvdatabase tvdatabase ext4 rw nosuid nodev noatime data ordered 0 0 dev block platform mstar mci 0 by name tvcustomer tvcustomer ext4 rw nosuid nodev noatime data ordered 0 0 adb dev usb ffs adb functionfs rw relatime 0 0 dev fuse mnt shell emulated fuse rw nosuid nodev relatime user id 1023 group id 1023 default permissions allow other 0 0 mount end ps ps start shell orange ps USER PID PPID VSIZE RSS WCHAN PC NAME root 1 0 604 440 c0109e40 0001a09c S init root 2 0 0 0 c0046d64 00000000 S kthreadd root 3 2 0 0 c004e8f0 00000000 S ksoftirqd 0 root 4 2 0 0 c00408dc 00000000 S kworker 0 0 root 5 2 0 0 c00408dc 00000000 S kworker 0 0H root 6 2 0 0 c00408dc 00000000 S kworker u8 0 root 7 2 0 0 c004e8f0 00000000 S migration 0 root 8 2 0 0 c008b5e0 00000000 S rcu preempt root 9 2 0 0 c008b378 00000000 S rcu bh root 10 2 0 0 c008b378 00000000 S rcu sched root 11 2 0 0 c004e8f0 00000000 S migration 1 root 12 2 0 0 c004e8f0 00000000 S ksoftirqd 1 root 13 2 0 0 c00408dc 00000000 S kworker 1 0 root 14 2 0 0 c00408dc 00000000 S kworker 1 0H root 15 2 0 0 c004e8f0 00000000 S migration 2 root 16 2 0 0 c004e8f0 00000000 S ksoftirqd 2 root 18 2 0 0 c00408dc 00000000 S kworker 2 0H root 19 2 0 0 c004e8f0 00000000 S migration 3 root 20 2 0 0 c004e8f0 00000000 S ksoftirqd 3 root 21 2 0 0 c00408dc 00000000 S kworker 3 0 root 22 2 0 0 c00408dc 00000000 S kworker 3 0H root 23 2 0 0 c0040650 00000000 S khelper root 24 2 0 0 c034b640 00000000 S kdevtmpfs root 25 2 0 0 c00408dc 00000000 S kworker u8 1 root 30 2 0 0 bf04e9fc 00000000 S kworker 1 1 root 31 2 0 0 c00408dc 00000000 S kworker 2 1 root 277 2 0 0 c0040650 00000000 S writeback root 279 2 0 0 c0040650 00000000 S bioset root 281 2 0 0 c0040650 00000000 S kblockd root 293 2 0 0 c03a7e88 00000000 S khubd root 307 2 0 0 c045729c 00000000 S ion system heap root 399 2 0 0 c0040650 00000000 S rpciod root 411 2 0 0 c00c775c 00000000 S kswapd0 root 456 2 0 0 c0135d48 00000000 S fsnotify mark root 473 2 0 0 c0040650 00000000 S nfsiod root 477 2 0 0 c0040650 00000000 S cifsiod root 489 2 0 0 c0040650 00000000 S crypto root 622 2 0 0 c0442fa0 00000000 S mmcqd 0 root 623 2 0 0 c0442fa0 00000000 S mmcqd 0boot0 root 624 2 0 0 c0442fa0 00000000 S mmcqd 0boot1 root 658 2 0 0 c0040650 00000000 S binder root 700 2 0 0 c00338c4 00000000 D Delay Free Task root 731 2 0 0 c0040650 00000000 S deferwq root 743 2 0 0 c0040650 00000000 S f mtp root 748 2 0 0 c03ca3b0 00000000 S file storage root 753 2 0 0 c0040650 00000000 S ms otg queue root 755 1 528 4 c0109e40 0001a09c S sbin ueventd root 1049 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p6 root 1050 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1051 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p8 root 1052 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1053 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p7 root 1054 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1055 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p9 root 1056 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1057 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p10 root 1058 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1059 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p11 root 1060 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1061 2 0 0 c01dc440 00000000 S jbd2 mmcblk0p12 root 1062 2 0 0 c0040650 00000000 S ext4 dio unwrit root 1069 2 0 0 c00408dc 00000000 S kworker u9 0 root 1077 2 0 0 c0412fac 00000000 S rc0 root 1081 2 0 0 c0040650 00000000 S keydispatch wq root 1094 1 1436 4 c0139ac0 00011804 S sbin healthd system 1095 1 1036 172 c04647d0 b6ec85bc S system bin servicemanager root 1096 1 6012 1296 ffffffff b6f46eb4 S system bin vold system 1097 1 4580 744 ffffffff b6f355bc S system bin resourcemanager root 1098 1 9804 984 ffffffff b6ef6eb4 S system bin netd root 1099 1 1060 232 c04f41dc b6f7c2b0 S system bin debuggerd system 1100 1 128012 9564 ffffffff b6e8c76c S system bin surfaceflinger root 1101 1 494088 45112 ffffffff 40146708 S zygote drm 1102 1 19080 6252 ffffffff b6e655bc S system bin drmserver media 1103 1 129860 18652 ffffffff b6e7c5bc S system bin mediaserver install 1104 1 1020 212 c05a21e0 b6ed62f8 S system bin installd keystore 1106 1 3376 976 c04647d0 b6f205bc S system bin keystore root 1107 1 4540 880 ffffffff b6f4b5bc S system bin upgrade system server root 1108 1 3428 684 ffffffff b6eb55bc S system bin RootShellServer media rw 1110 1 3532 184 ffffffff b6f082f8 S system bin sdcard system 1111 1 4368 612 ffffffff b6ea75bc S system bin browserserver bluetooth 1113 1 18332 5672 ffffffff b6e03708 S system bin mtkbt root 1115 1 888 160 c0109e40 b6f217f4 S system bin logwrapper root 1116 1 888 160 c0109e40 b6f047f4 S system bin logwrapper root 1118 1115 2138236 8384 c0038ca8 b6ec9e34 S applications bin MiSysSrv root 1119 1116 26724 8220 ffffffff b6f2b5bc S applications bin tvos shell 1123 1 936 468 c0038d10 b6e92140 S system bin sh root 1132 1107 0 0 c002936c 00000000 Z ls root 1136 2 0 0 c00408dc 00000000 S kworker 0 2 root 1206 2 0 0 c00408dc 00000000 S kworker 2 2 root 1289 1118 2357344 9820 ffffffff b6ec95bc S applications bin MiSysSrv root 1291 2 0 0 c00408dc 00000000 S kworker 1 3 root 1547 2 0 0 c00408dc 00000000 S kworker 3 2 root 1563 2 0 0 c00408dc 00000000 S kworker 0 1H system 1573 1101 598180 41276 ffffffff 4014776c S system server u0 a3 1651 1101 528084 29704 ffffffff 4014776c S com android systemui system 1669 1101 507208 22576 ffffffff 4014776c S com mstar tv service u0 a12 1744 1101 503184 21240 ffffffff 4014776c S com ipanel ime system 1759 1101 506984 21816 ffffffff 4014776c S com android settings system 1768 1101 625472 70920 ffffffff 4014776c S com hbunicom iptv u0 a26 1775 1101 524812 26232 ffffffff 4014776c S com hpplay happyplay aw system 1790 1101 504052 18524 ffffffff 4014776c S com broadcom bluetoothmonitor u0 a14 1809 1101 503104 19976 ffffffff 4014776c S com android dummyactivity u0 a20 1821 1101 504260 18276 ffffffff 4014776c S com android printspooler system 1871 1101 505300 19420 ffffffff 4014776c S com mstar android providers tv system 1935 1101 504176 20772 ffffffff 4014776c S com ipanel apps loading root 1966 2 0 0 bf0df5bc 00000000 S krfcommd u0 a25 1975 1101 559640 49572 ffffffff 4014776c S com voole vooledesktop system 2010 1101 505224 17704 ffffffff 4014776c S com ipanel home ctc upgrade u0 a10 2036 1101 508000 21836 ffffffff 4014776c S com huawei dsm system 2064 1101 511140 22964 ffffffff 4014776c S com android mcast system 2087 1101 509348 19876 ffffffff 4014776c S com CTC ChinaNet android tm system 2155 1101 539524 35576 ffffffff 4014776c S com huawei iptv stb videotalk activity root 2943 1123 936 468 c0038d10 b6ed9140 S sh root 2973 2943 936 476 c0038d10 b6f15140 S sh root 3033 2973 936 472 c0038d10 b6f46140 S sh root 3041 3033 936 476 c0038d10 b6ea7140 S sh root 3052 2 0 0 c00408dc 00000000 S kworker 2 1H root 3091 3041 932 468 c0038d10 b6ee1140 S sh root 3096 3091 936 484 c0038d10 b6ec1140 S sh root 3140 3096 936 468 c0038d10 b6f07140 S sh root 3185 3140 936 472 c0038d10 b6ede140 S sh root 3209 3185 936 476 c0038d10 b6ee0140 S sh root 3271 3209 932 472 c0038d10 b6ea8140 S sh root 3279 3271 936 484 c0038d10 b6f81140 S sh root 3306 3279 932 468 c0038d10 b6efb140 S sh root 3312 3306 932 320 c0038d10 b6ee2140 S sh root 3321 3312 1272 232 00000000 b6e9c2f8 R ps ps end busybox busybox start shell orange busybox BusyBox v1 19 2 2011 11 10 14 20 50 CST multi call binary Copyright C 1998 2011 Erik Andersen Rob Landley Denys Vlasenko and others Licensed under GPLv2 See source distribution for full notice Usage busybox function arguments or busybox list full or function arguments BusyBox is a multi call binary that combines many common Unix utilities into a single executable Most people will create a link to busybox for each function they wish to use and BusyBox will act like whatever it was invoked as Currently defined functions acpid add shell addgroup adduser adjtimex arp arping ash awk base64 basename beep blkid blockdev bootchartd brctl bunzip2 bzcat bzip2 cal cat catv chat chattr chgrp chmod chown chpasswd chpst chroot chrt chvt cksum clear cmp comm cp cpio crond crontab cryptpw cttyhack cut date dc dd deallocvt delgroup deluser depmod devmem df dhcprelay diff dirname dmesg dnsd dnsdomainname dos2unix du dumpkmap dumpleases echo ed egrep eject env envdir envuidgid ether wake expand expr fakeidentd false fbset fbsplash fdflush fdf