Hi, I recently purchased one of those sticks and the version that I received couldn’t be flashed with OW or OW_NEXT (the version from System Information says “SEGAM-M8 V8.0 2024-10-15”), so i tried looking at the original SD card to see what’s inside and here is a list of things I (re)discovered, hope someone else could figure out the missing pieces:
- the SD contains everything, uboot included, it’s a full dump of the physical device needed to run the stick: I suppose they didn’t put any kind of rom inside the stick and rely on the sd card only (maybe it’s cheaper?)
- the dump of the SD cannot be mounted or opened directly, but a (not so) quick look with binwalk and some guessing lead me to this layout:
0 - 0x1FFFFF (size: 2MB) => "preamble" with bootloader and AndroidTV image in it (sure about the bootloader, not so sure about AndroidTV and where it starts or how to extract it)
0x200000 - 0xBFFFFF (size: 10MB) => Linux kernel uImage, version is v3.18.24_s40
0xC00000 - 0x137FFFFF (size: 300MB) => ext3 partition 1, contains various resources (libraries, images for ui_m8, translations, sound effects etc.)
0x13800000 - 0x177FFFFF (size: 64MB) => ext3 partition 2, contains an empty 'bin' directory and a 'res' directory with game_list.db inside (yes, that's the SQLite 3 DB you are looking for, where all the games are listed and where you can add/delete games like rebuild does or I suppose it does)
0x17800000 - 0x377FFFFF (size: 512MB) => swap partition
0x37800000 - 0x777FFFFF (size: 1GB) => FAT partition 1, it contains two games (Snowman brothers.bin and tekken3.img) and it's almost full since tekken3 is ~660MB
0x77800000 - end of SD (size ~50GB in my 64GB sd card) => FAT partition 2, it contains all the roms separated by path, each path corresponding to an emulator
- I dumped all the partitions except the last one and created a new empty FAT partition for the last one, inserting only a couple of roms inside: it works, meaning that the system boots up as expected and lists the rom i want to be listed (and I can play them of course). This is a good starting point to create backups of the SD that aren’t huge in size 😛
Now I have a few open questions for those who are experts in embedded systems:
- where do I find the rootfs with the binaries (i.e retroarch, this ‘ui_m8’ executable, etc)? I tried looking for other partitions on the dump to no avail
- the preable contains a UBoot bootlader and from there I can see from a string just after the bootloader magic header that the chip is a hi3798mv100, DDR3 1GB (shouldn’t it be 256/512 as per swap partition size?)
- with these information, is it possible to use QEMU to boot and load the firmware? I’m stuck and the DTB file definition/declaration, I honestly don’t know what to put there
The executable format of the binaries for this firmware is ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 2.6.32, with debug_info, not stripped, so pretty common and easy to cross compile: I don’t know where to put a simple executable and try it but that’s a starting point.
For those interested, here is the list of dd commands to extract the different sections of the dump except the swap (replace /dev/sdX with the SD path; Linux/macOS only, don’t ask about Window because I don’t care/I don’t know):
sudo dd of=preamble.img of=/dev/sdX bs=1M seek=0 count=2 status=progress
sudo dd of=uimage.img of=/dev/sdX bs=1M seek=2 count=10 status=progress
sudo dd of=ext1.img of=/dev/sdX bs=1M seek=12 count=300 status=progress
sudo dd of=ext2.img of=/dev/sdX bs=8M seek=39 count=8 status=progress
sudo dd of=fat1.img of=/dev/sdX bs=8M seek=111 count=128 status=progress
sudo dd of=fat2.img of=/dev/sdX bs=8M seek=239 status=progress
The partitions could of course be mounted directly from the SD (this is for the second FAT partition where almost all the roms are):
sudo mount -o loop,offset=2004877312,umask=0 /dev/sdX /media/sd
You can also reassemble the original firmware image like this (there is no need to write the swap partition, it’s just random bytes initialized when the stick boots up):
sudo dd if=preamble.img of=/dev/sdX bs=1M seek=0 status=progress
sudo dd if=uimage.img of=/dev/sdX bs=1M seek=2 status=progress
sudo dd if=ext1.img of=/dev/sdX bs=1M seek=12 status=progress
sudo dd if=ext2.img of=/dev/sdX bs=8M seek=39 status=progress
sudo dd if=fat1.img of=/dev/sdX bs=8M seek=111 status=progress
sudo dd if=fat2.img of=/dev/sdX bs=8M seek=239 status=progress
If you want to use a differently sized partition for fat2.img (e.g. to replicate the image on a smaller SD), first create an empty FAT partition like so:
dd if=/dev/zero of=fat2.img bs=1M count=1024
mkfs.vfat fat2.img
sudo mount -o loop,umask=0 fat2.img /media/sd/
You can then proceed with the dd commands above and glue together all the partitions: don’t worry about the size of fat2.img, the only constraint is that it should fit the remaining free space of the SD (i.e. size of your SD - (2MB + 10MB + 300MB + 64MB + 512MB + 1GB): with almost no roms you can fit the entire system on a 2GB SD card 😛)
Inside the newly created partition you should create this tree structure:
./res
./res/settings
./res/settings/factory.txt
./res/settings/setting.txt
./save
./save/nes
./save/gba
./save/gb
./save/gbc
./save/md
./save/sfc
./save/mame
./save/ps1
./save/atari
./roms
./roms/mame
./roms/mame/preload
./roms/ps1
./roms/ps1/preload
./roms/sfc
./roms/sfc/preload
./roms/gba
./roms/gba/preload
./roms/gb
./roms/gb/preload
./roms/gbc
./roms/gbc/preload
./roms/md
./roms/md/preload
./roms/nes
./roms/nes/preload
./roms/atari
./roms/atari/preload
./roms/res
./list
./list/name_table
I think that it should works even by creating a subset of this tree, but this is the full layout of the original SD. Inside each directory in roms there are 2 files for each rom: the rom itself and the png of the screenshot shown on the UI. The name of the file is the same that the SQLite DB refers to.
Refer to the original SD to know what to put here (for example: mame subdir wants zip files, nes wants .nes etc.). I think the two factory.txt and setting.txt are required, they can be identical and they contains a few parameters for the stick (like language, background music, cpu parameters (??) etc.), just copy those in the original SD and you’re good to go.