最近从家里翻出来一个电信宽带ITV送的创维盒子E900，准备把它刷成Android TV系统用用

拆机图

通过拆机发现芯片是一颗海思Hi3798MV100芯片，右下角引出了串口，我这里用万用表测量最左边是GND，剩下的就得试试了，接上TTL串口模块监听串口通电，判断出最右边是TX

备份原厂固件

把串口跑出来的日志喂给AI，得出我的设备型号版本为：Hi3798MV100 非高安版本
这里顺便就是原厂的固件备份了吧，插入一个U盘，执行df命令看看是否识别并且记住U盘挂载路径，然后通过一下命令备份：

dd if=/dev/block/platform/hi_mci.1/by-name/fastboot of=/mnt/sda/sda1/fastboot.img
dd if=/dev/block/platform/hi_mci.1/by-name/bootargs of=/mnt/sda/sda1/bootargs.img
dd if=/dev/block/platform/hi_mci.1/by-name/recovery of=/mnt/sda/sda1/recovery.img
dd if=/dev/block/platform/hi_mci.1/by-name/deviceinfo of=/mnt/sda/sda1/deviceinfo.img
dd if=/dev/block/platform/hi_mci.1/by-name/baseparam of=/mnt/sda/sda1/baseparam.img
dd if=/dev/block/platform/hi_mci.1/by-name/pqparam of=/mnt/sda/sda1/pqparam.img
dd if=/dev/block/platform/hi_mci.1/by-name/logo of=/mnt/sda/sda1/logo.img
dd if=/dev/block/platform/hi_mci.1/by-name/logobak of=/mnt/sda/sda1/logobak.img
dd if=/dev/block/platform/hi_mci.1/by-name/fastplay of=/mnt/sda/sda1/fastplay.img
dd if=/dev/block/platform/hi_mci.1/by-name/fastplaybak of=/mnt/sda/sda1/fastplaybak.img
dd if=/dev/block/platform/hi_mci.1/by-name/kernel of=/mnt/sda/sda1/kernel.img
dd if=/dev/block/platform/hi_mci.1/by-name/misc of=/mnt/sda/sda1/misc.img
dd if=/dev/block/platform/hi_mci.1/by-name/userapi of=/mnt/sda/sda1/userapi.img
dd if=/dev/block/platform/hi_mci.1/by-name/hibdrv of=/mnt/sda/sda1/hibdrv.img
dd if=/dev/block/platform/hi_mci.1/by-name/qbflag of=/mnt/sda/sda1/qbflag.img
dd if=/dev/block/platform/hi_mci.1/by-name/qbdata of=/mnt/sda/sda1/qbdata.img
dd if=/dev/block/platform/hi_mci.1/by-name/system of=/mnt/sda/sda1/system.img
dd if=/dev/block/platform/hi_mci.1/by-name/userdata of=/mnt/sda/sda1/userdata.img
dd if=/dev/block/platform/hi_mci.1/by-name/cache of=/mnt/sda/sda1/cache.img
dd if=/dev/block/platform/hi_mci.1/by-name/macid of=/mnt/sda/sda1/macid.img
dd if=/dev/block/platform/hi_mci.1/by-name/skparam of=/mnt/sda/sda1/skparam.img
dd if=/dev/block/platform/hi_mci.1/by-name/skbackup of=/mnt/sda/sda1/skbackup.img
dd if=/dev/block/platform/hi_mci.1/by-name/private of=/mnt/sda/sda1/private.img
dd if=/dev/block/platform/hi_mci.1/by-name/sdcard of=/mnt/sda/sda1/sdcard.img

可用固件

剩下的就是找固件了，从恩山论坛找了几个帖子：
创维E900-E900S-E910-E950-海思Hi3798MV100芯片-非高安-当贝桌面-拆机强刷卡刷固件包
创维E900-S-非高安_HI3798MV100_免拆或拆机短接强刷-当贝桌面卡刷固件包
创维E910V10C-E900-E900S-E910-E950-海思Hi3798MV100芯片-非高安-拆机强刷固件包
其实我是想线刷的，毕竟都接好了ttl，而且想找个8G小U盘也不容易，可是找到的固件包都是卡刷包