iptv机顶盒

河北联通IPTV机顶盒破解烽火HG680-R

目录

零、…………………………………………………………………………………杂言

一、…………………………………………………………………………硬件连接篇

二、……………………………………………………………………………开机检查

三、…………………………………………………放入U盘文件并进行安装即破解

四、………………………………………………………………个人理解的名词解释

五、…………………………………………………………………………………附录

办理宽带的时候顺便带了IPTV机顶盒，到手吃灰了俩月找了找网上的破解资料，发现

只有拆解的，没有破解的，索性自己摸索着破解试试看，没想到还真的成功了，特此发帖供

有这个盒子的玩家折腾，cpu是MSO9280，RAM1G,ROM4GEMMC，编写by洗洗枣

这个帖子应该算是首次破解680-r结尾的盒子，其他盒子只要是安卓的，方法都大同小

异，可以试试。

前言：所有的重要东西都用了黄色字体，命令使用了红色字体，教程结尾处会有各个红

色字体命令的解释用途说明，教程内有所用到的软件链接，直接点击或者复制链接到下载器

即可下载，要分清你我的概念，你的是你的，我的是我的，你的不是我的，我的不是你的，

里面的命令是固定的，但是有可能U盘查到盒子以后的路径是不一样的，不要按照我的抄写，

要按照教程操作，并不是抄，谢谢！

需要物品清单

电脑一台，配置随意，win系统，linux系统的不会

TTL一个，我用的5块多包邮的CH340

机顶盒一个，河北版联通IPTV烽火HG680-R

FAT32格式的U盘一个，容量我用的4G，仅作为参考

电视机一台（可选）

需要软件清单

Putty下载地址

当贝桌面下载地址

一、硬件连接篇

为了方便小白，步骤写清楚一点，首先把TTL不接任何东西插到电脑上面

重要需要注意如下设置：TTL设置电平重要

计算机（我的电脑）->管理->设备管理器->CH340->波特率选择115200点确定

硬件连接完毕

=================华丽丽的分割线=================

二、开机检查

首先把所有的线连接好，机顶盒处需要的线是ttl线，电源线，其他的不需要接，电脑方面

只需要插上TTL就准备完毕了。

打开Putty

设置com口与波特率，然后点击打开

接下来打开盒子的电源，putty就开始接收到数据了

AC_ON

MIU0_DQS-OK

MIU00_U

RelocationOfftis:011d7000

[AT][MB][startub][334]

U-Boot(Apr022016-22:51:05)

[MIUINFO]miuopencreateinstanceat559e9418withprivatesize80bytesat559e9460

createinstanceat559e94b8withprivatesize52bytesat559e9500

ubootheldat[557ddf60~56b00000],size=013220a0

CPU:Clippers

Board:BD_MST207C_D01A_S_CLIPPERS

DRAM:875MiB

NowrunninginRAM-U-Bootat:55c00000

eMMC:HS200200MHz

下面的省略，还有很多，到此如果跟教程一样的话就说明前期操作完美，可以进行下一步的

操作了。

=================华丽丽的分割线=================

三、放入U盘文件并进行安装即破解

找一个FAT32格式的U盘，最好是空盘，以免出现莫名其妙的问题

把刚刚下载好的当贝桌面放入U盘的根目录，然后插入盒子的usb里面

然后输入命令：df

这里的/mnt/usb/sda1就是我的U盘所在的目录，你的可能不一样，不过一般都是在mnt

文件夹下面的sda1文件夹里面。

然后输入命令进入U盘文件夹下面：cd/mnt/usb/sda1

接下来输入命令：ls

shell@orange:/mnt/usb/sda1#ls

上面的就是我下载的当贝桌面apk

接下来输入命令进行安装：pminstall#pminstallpkg:

integrator_t_target_on_demand

[INFO]DataExchangeCounttoUrSpace:11

[INFO]Voltage:115

on_demand_handshake:[cpu3][Binder_4]wokenup,copycpu_voltage:115

cpu_voltage_type:0change_cnt:11tourspace

[resultis0]input:11,wake_upwait_queueforwrite_down

[INFO]VoltageType:0

[INFO]DataExchangeCountfromUrSpace:11

Function=change_cpus_timer,Line=792,cpu0do:[cpu0]adjustcpufreqfor701000

KHZto1200000KHZ

caller:integrator_t_target_on_demand

[INFO]DataExchangeCounttoUrSpace:12

on_demand_handshake:[cpu3][Binder_4]wokenup,copycpu_voltage:115

cpu_voltage_type:0change_cnt:12tourspace

[resultis0]input:12,wake_upwait_queueforwrite_down

[INFO]Voltage:115

[INFO]VoltageType:0

[INFO]DataExchangeCountfromUrSpace:12

Function=change_cpus_timer,Line=792,cpu0do:[cpu0]adjustcpufreqfor1200000

KHZto701000KHZ

Success

直到显示Success为止即为安装成功，下面我们来验证一下，输入命令：pmlistpackages

shell@orange:/mnt/usb/sda1#pmlistpackages

package:仔细找，可以发现里面有我们安装好的当贝桌面apk程序然后我们来让当贝桌面启

动起来，如果盒子连接这电视机的话就可以看到显示桌面已经换成了当贝桌面，命令如下：

amstart#amstartIntent{act=cat=[pkg=}

[dvfs_boost]thisclientisnotrunning

Function=write_cpufreq_to_RIU,Line=516,writecpu_freqtoRIU:0x3E8

caller:integrator_t_target_on_demand

[INFO]DataExchangeCounttoUrSpace:13

on_demand_handshake:[cpu3][Binder_4]wokenup,copycpu_voltage:115

cpu_voltage_type:0change_cnt:13tourspace

[resultis0]input:13,wake_upwait_queueforwrite_down

[INFO]Voltage:115

[INFO]VoltageType:0

[INFO]DataExchangeCountfromUrSpace:13

shell@orange:/mnt/usb/sda1#cfg80211:CallingCRDAtoupdateworldregulatory

domain

rtusbinitrt2870--->

此处省略几百行代码不需要纠结显示了什么

[resultis0]input:14,wake_upwait_queueforwrite_down

[INFO]Voltage:115

[INFO]VoltageType:0

[INFO]DataExchangeCountfromUrSpace:14

Function=change_cpus_timer,Line=792,cpu0do:[cpu0]adjustcpufreqfor1000000

KHZto701000KHZ

显示到这里，出现[INFO]Function就表示已经启动当贝桌面完成了，到此，破解完成。

四、个人理解的名词解释

df——————————————————————————列出操作系统下的所有分区

cd/mnt/usb/sda1—————————————————————进入我的U盘文件夹下

ls———————————————————————列出我的U盘文件夹下的所有文件

pminstall————————————安装当贝桌面命令

pmlistpackages——————————————————列出所有安装在系统下的apk

软件

amstart————————————运行安装在系统下的apk软件

附录：

cpuinfo

***************cpuinfostart********************

shell@orange:/$cat/proc/cpuinfo

processor:0

modelname:ARMv7Processorrev3(v7l)

BogoMIPS:

Features:swphalfthumbfastmultvfpedspneonvfpv3tlsvfpv4idivaid

ivt

CPUimplementer:0x41

CPUarchitecture:7

CPUvariant:0x0

CPUpart:0xc07

CPUrevision:3

processor:1

modelname:ARMv7Processorrev3(v7l)

BogoMIPS:

Features:swphalfthumbfastmultvfpedspneonvfpv3tlsvfpv4idivaid

ivt

CPUimplementer:0x41

CPUarchitecture:7

CPUvariant:0x0

CPUpart:0xc07

CPUrevision:3

processor:2

modelname:ARMv7Processorrev3(v7l)

BogoMIPS:

Features:swphalfthumbfastmultvfpedspneonvfpv3tlsvfpv4idivaid

ivt

CPUimplementer:0x41

CPUarchitecture:7

CPUvariant:0x0

CPUpart:0xc07

CPUrevision:3

processor:3

modelname:ARMv7Processorrev3(v7l)

BogoMIPS:

Features:swphalfthumbfastmultvfpedspneonvfpv3tlsvfpv4idivaid

ivt

CPUimplementer:0x41

CPUarchitecture:7

CPUvariant:0x0

CPUpart:0xc07

CPUrevision:3

Hardware:clippers

Revision:0020

Serial:0000

***************cpuinfoend********************

meminfo

***************meminfostart********************

shell@orange:/proc#catmeminfo

MemTotal:832964kB

MemFree:368180kB

Buffers:5256kB

Cached:205304kB

SwapCached:0kB

Active:166216kB

Inactive:189372kB

Active(anon):145036kB

Inactive(anon):4332kB

Active(file):21180kB

Inactive(file):185040kB

Unevictable:0kB

Mlocked:0kB

HighTotal:72704kB

HighFree:1092kB

LowTotal:760260kB

LowFree:367088kB

SwapTotal:102396kB

SwapFree:102396kB

Dirty:4kB

Writeback:0kB

AnonPages:145000kB

Mapped:88716kB

Shmem:4368kB

Slab:12596kB

SReclaimable:4404kB

SUnreclaim:8192kB

KernelStack:4376kB

PageTables:14560kB

NFS_Unstable:0kB

Bounce:0kB

WritebackTmp:0kB

CommitLimit:518876kB

Committed_AS:8711976kB

VmallocTotal:245760kB

VmallocUd:53248kB

VmallocChunk:137216kB

CMAFree:540kB

CMAheapinfo(name,alloc,incache,fail,totalfree):DEFAULT_CMA_BUFFER(1496kb0kb

0kb2600kb)vdec(0kb0kb0kb163840kb)

***************meminfoend********************

mount

***************mountstart********************

shell@orange:/proc#mount

rootfs/rootfsro,relatime00

tmpfs/devtmpfsrw,nosuid,relatime,mode=75500

devpts/dev/ptsdevptsrw,relatime,mode=60000

proc/procprocrw,relatime00

sysfs/syssysfsrw,relatime00

debugfs/sys/kernel/debugdebugfsrw,relatime00

none/acctcgrouprw,relatime,cpuacct00

none/sys/fs/cgrouptmpfsrw,relatime,mode=750,gid=100000

tmpfs/mnt/curetmpfsrw,relatime,mode=70000

tmpfs/mnt/actmpfsrw,relatime,mode=755,gid=100000

tmpfs/mnt/obbtmpfsrw,relatime,mode=755,gid=100000

none/dev/cpuctlcgrouprw,relatime,cpu00

tmpfs/mnt/usbtmpfsrw,relatime,mode=755,gid=100000

tmpfs/mnt/isotmpfsrw,relatime,mode=755,gid=100000

tmpfs/mnt/sambatmpfsrw,relatime,mode=755,gid=100000

tmpfs/vartmpfsrw,relatime,mode=775,gid=100000

/dev/block/platform/by-name/system/systemext4ro,relatime,data=ordered00

/dev/block/platform/by-name/cache/cacheext4

rw,nosuid,nodev,noatime,data=ordered00

/dev/block/platform/by-name/urdata/dataext4

rw,nosuid,nodev,noatime,data=ordered00

/dev/block/platform/by-name/tvrvice/tvrviceext4ro,relatime,data=ordered0

0

/dev/block/platform/by-name/tvconfig/tvconfigext4ro,relatime,data=ordered00

/dev/block/platform/by-name/tvdataba/tvdatabaext4

rw,nosuid,nodev,noatime,data=ordered00

/dev/block/platform/by-name/tvcustomer/tvcustomerext4

rw,nosuid,nodev,noatime,data=ordered00

adb/dev/usb-ffs/adbfunctionfsrw,relatime00

/dev/fu/mnt/shell/emulatedfu

rw,nosuid,nodev,relatime,ur_id=1023,group_id=1023,default_permissions,allow_o

ther00

***************mountend********************

ps

***************psstart********************

shell@orange:/#ps

USERPIDPPIDVSIZERSSWCHANPCNAME

root10604440c0109e400001a09cS/init

root2000c0046d6400000000Skthreadd

root3200c004e8f000000000Sksoftirqd/0

root4200c00408dc00000000Skworker/0:0

root5200c00408dc00000000Skworker/0:0H

root6200c00408dc00000000Skworker/u8:0

root7200c004e8f000000000Smigration/0

root8200c008b5e000000000Srcu_preempt

root9200c008b37800000000Srcu_bh

root10200c008b37800000000Srcu_sched

root11200c004e8f000000000Smigration/1

root12200c004e8f000000000Sksoftirqd/1

root13200c00408dc00000000Skworker/1:0

root14200c00408dc00000000Skworker/1:0H

root15200c004e8f000000000Smigration/2

root16200c004e8f000000000Sksoftirqd/2

root18200c00408dc00000000Skworker/2:0H

root19200c004e8f000000000Smigration/3

root20200c004e8f000000000Sksoftirqd/3

root21200c00408dc00000000Skworker/3:0

root22200c00408dc00000000Skworker/3:0H

root23200c000Skhelper

root24200c034b64000000000Skdevtmpfs

root25200c00408dc00000000Skworker/u8:1

root30200bf04e9fc00000000Skworker/1:1

root31200c00408dc00000000Skworker/2:1

root277200c000Swriteback

root279200c000Sbiot

root281200c000Skblockd

root293200c03a7e8800000000Skhubd

root307200c045729c00000000Sion_system_heap

root399200c000Srpciod

root411200c00c775c00000000Skswapd0

root456200c0135d4800000000Sfsnotify_mark

root473200c000Snfsiod

root477200c000Scifsiod

root489200c000Scrypto

root622200c0442fa000000000Smmcqd/0

root623200c0442fa000000000Smmcqd/0boot0

root624200c0442fa000000000Smmcqd/0boot1

root658200c000Sbinder

root700200c00338c400000000DDelayFreeTask

root731200c000Sdeferwq

root743200c000Sf_mtp

root748200c03ca3b000000000Sfile-storage

root753200c000Sms_otg_queue

root75515284c0109e400001a09cS/sbin/ueventd

root1049200c01dc44000000000Sjbd2/mmcblk0p6-

root1050200c000Sext4-dio-unwrit

root1051200c01dc44000000000Sjbd2/mmcblk0p8-

root1052200c000Sext4-dio-unwrit

root1053200c01dc44000000000Sjbd2/mmcblk0p7-

root1054200c000Sext4-dio-unwrit

root1055200c01dc44000000000Sjbd2/mmcblk0p9-

root1056200c000Sext4-dio-unwrit

root1057200c01dc44000000000Sjbd2/mmcblk0p10

root1058200c000Sext4-dio-unwrit

root1059200c01dc44000000000Sjbd2/mmcblk0p11

root1060200c000Sext4-dio-unwrit

root1061200c01dc44000000000Sjbd2/mmcblk0p12

root1062200c000Sext4-dio-unwrit

root1069200c00408dc00000000Skworker/u9:0

root1077200c0412fac00000000Src0

root1081200c000Skeydispatch_wq

root1094114364c0139ac000011804S/sbin/healthd

system1c04647d0b6ec85bcS

/system/bin/rvicemanager

root1ffffffffb6f46eb4S/system/bin/vold

system1ffffffffb6f355bcS

/system/bin/resourcemanager

root1ffffffffb6ef6eb4S/system/bin/netd

root1c04f41dcb6f7c2b0S/system/bin/debuggerd

system114ffffffffb6e8c76cS/system/bin/surfaceflinger

root1112ffffffffSzygote

drm11ffffffffb6e655bcS/system/bin/drmrver

media1152ffffffffb6e7c5bcS/system/bin/mediarver

install11c05a21e0b6ed62f8S/system/bin/installd

keystore11c04647d0b6f205bcS/system/bin/keystore

root11ffffffffb6f4b5bcS

/system/bin/upgrade_system_rver

root11ffffffffb6eb55bcS

/system/bin/RootShellServer

media_rw4ffffffffb6f082f8S/system/bin/sdcard

system2ffffffffb6ea75bcS/system/bin/browrrver

bluetooth672ffffffffb6e03708S/system/bin/mtkbt

rootc0109e40b6f217f4S/system/bin/logwrapper

rootc0109e40b6f047f4S/system/bin/logwrapper

root82368384c0038ca8b6ec9e34S

/applications/bin/MiSysSrv

root248220ffffffffb6f2b5bcS/applications/bin/tvos

shellc0038d10b6e92140S/system/bin/sh

root1132110700c002936c00000000Zls

root1136200c00408dc00000000Skworker/0:2

root1206200c00408dc00000000Skworker/2:2

root73449820ffffffffb6ec95bcS

/applications/bin/MiSysSrv

root1291200c00408dc00000000Skworker/1:3

root1547200c00408dc00000000Skworker/3:2

root1563200c00408dc00000000Skworker/0:1H

system1573116ffffffff4014776cSsystem_rver

u0_a31651114ffffffff4014776cS208

22576ffffffff4014776cS1744110ffffffff4014776cS

1759116ffffffff4014776cS1768110ffffffff

4014776cS1775112ffffffff4014776cS17901101

5ffffffff4014776cS1819976ffffffff4014776cS

1821116ffffffff4014776cS1871110ffffffff

4014776cS1935112ffffffff4014776cS196620

0bf0df5bc00000000Skrfcommd

u0_a251975112ffffffff4014776cS24

17704ffffffff4014776cS2021836ffffffff4014776cS

2022964ffffffff4014776cS2819876ffffffff

4014776cS2155116ffffffff4014776cS29431123936

468c0038d10b6ed9140Ssh

root29732943936476c0038d10b6f15140Ssh

root32c0038d10b6f46140Ssh

root36c0038d10b6ea7140Ssh

root3052200c00408dc00000000Skworker/2:1H

root38c0038d10b6ee1140Ssh

root34c0038d10b6ec1140Ssh

root314c0038d10b6f07140Ssh

root372c0038d10b6ede140Ssh

root32c0038d10b6ee0140Ssh

root327c0038d10b6ea8140Ssh

root32793271936484c0038d10b6f81140Ssh

root33c0038d10b6efb140Ssh

root330c0038d10b6ee2140Ssh

root332200000000b6e9c2f8Rps

***************pnd********************

busybox

***************busyboxstart********************

shell@orange:/#busybox

BusyBox(2011-11-1014:20:50CST)multi-callbinary.

Copyright(C)1998-2011ErikAndern,RobLandley,DenysVlanko

edunderGPLv2.

Seesourcedistributionforfullnotice.

Usage:busybox[function][arguments]...

or:busybox--list[-full]

or:function[arguments]...

BusyBoxisamulti-callbinarythatcombinesmanycommonUnix

oplewillcreatea

linktobusyboxforeachfunctiontheywishtouandBusyBox

willactlikewhateveritwasinvokedas.

Currentlydefinedfunctions:

[,[[,acpid,add-shell,addgroup,addur,adjtimex,arp,arping,ash,

awk,ba64,baname,beep,blkid,blockdev,bootchartd,brctl,

bunzip2,bzcat,bzip2,cal,cat,catv,chat,chattr,chgrp,chmod,

chown,chpasswd,chpst,chroot,chrt,chvt,cksum,clear,cmp,comm,

cp,cpio,crond,crontab,cryptpw,cttyhack,cut,date,dc,dd,

deallocvt,delgroup,delur,depmod,devmem,df,dhcprelay,diff,

dirname,dmesg,dnsd,dnsdomainname,dos2unix,du,dumpkmap,

dumpleas,echo,ed,egrep,eject,env,envdir,envuidgid,ether-wake,

expand,expr,fakeidentd,fal,fbt,fbsplash,fdflush,fdformat,

fdisk,fgconsole,fgrep,find,findfs,flock,fold,free,freeramdisk,

fsck,,fsync,ftpd,ftpget,ftpput,fur,getopt,getty,

grep,groups,gunzip,gzip,halt,hd,hdparm,head,hexdump,hostid,

hostname,httpd,hush,hwclock,id,ifconfig,ifdown,ifenslave,

ifplugd,ifup,inetd,init,insmod,install,ionice,iostat,ip,

ipaddr,ipcalc,ipcrm,ipcs,iplink,iproute,iprule,iptunnel,

kbd_mode,kill,killall,killall5,klogd,last,less,linux32,linux64,

linuxrc,ln,loadfont,loadkmap,logger,login,logname,logread,

lotup,lpd,lpq,lpr,ls,lsattr,lsmod,lspci,lsusb,lzcat,lzma,

lzop,lzopcat,makedevs,makemime,man,md5sum,mdev,mesg,microcom,

mkdir,mkdosfs,mke2fs,mkfifo,,,,

mknod,mkpasswd,mkswap,mktemp,modinfo,modprobe,more,mount,

mountpoint,mpstat,mt,mv,nameif,nbd-client,nc,netstat,nice,

nmeter,nohup,nslookup,ntpd,od,openvt,passwd,patch,pgrep,pidof,

ping,ping6,pipe_progress,pivot_root,pkill,pmap,popmaildir,

poweroff,powertop,printenv,printf,ps,pscan,pstree,pwd,pwdx,

raidautorun,rdate,rdev,readahead,readlink,readprofile,realpath,

reboot,reformime,remove-shell,renice,ret,resize,rev,rm,rmdir,

rmmod,route,rpm,rpm2cpio,rtcwake,run-parts,runlevel,runsv,

runsvdir,rx,script,scriptreplay,d,ndmail,q,tarch,

tconsole,tfont,tkeycodes,tlogcons,trial,tsid,

tuidgid,sh,sha1sum,sha256sum,sha512sum,showkey,slattach,sleep,

smemcap,softlimit,sort,split,start-stop-daemon,stat,strings,

stty,su,sulogin,sum,sv,svlogd,swapoff,swapon,switch_root,sync,

sysctl,syslogd,tac,tail,tar,tcpsvd,tee,telnet,telnetd,test,

tftp,tftpd,time,timeout,top,touch,tr,traceroute,traceroute6,

true,tty,ttysize,tunctl,ubiattach,ubidetach,ubimkvol,ubirmvol,

ubirsvol,ubiupdatevol,udhcpc,udhcpd,udpsvd,umount,uname,

unexpand,uniq,unix2dos,unlzma,unlzop,unxz,unzip,uptime,urs,

usleep,uudecode,uuencode,vconfig,vi,vlock,volname,wall,watch,

watchdog,wc,wget,which,who,whoami,whois,xargs,xz,xzcat,yes,

zcat,zcip

***************busyboxend********************

此教程所有人归洗洗枣所有，转载请注明源作者，谢谢。BY洗洗枣