Note: Huawei has multiple Q-series Android STBs. This paper assumes a standard Linux/Android-based system with HiSilicon chips (Hi3798M, etc.).
Title: Forensic Analysis and Low-Level Implementation of Factory Reset Mechanisms on the Huawei STB Q11 Platform Abstract: Set-Top Boxes (STBs) are increasingly targeted for re-flashing, brick recovery, and digital forensics. The Huawei STB Q11 operates on a locked-down Android TV system. This paper dissects the factory reset process across three architectural layers: the Bootloader (Fastboot/HiBurn), the Recovery OS, and the Android Framework. We identify the physical UART interface, partition mapping (eMMC/NAND), and the critical distinction between a "soft reset" (user menu) and a "hard reset" (forced bootloader command). Practical methodologies for initiating reset without video output or remote control are provided.
1. Introduction The Huawei Q11 is a carrier-grade STB (e.g., for China Telecom or OTT services). Unlike consumer Android devices, these boxes implement Anti-Rollback and Signature Verification . A factory reset is not merely a data wipe; it is a partition-level operation that must bypass persistent cache or userdata corruption. Key Challenge: Many Q11 units become unbootable due to corrupted fastboot variables or a full /data partition. Standard UI-based reset fails. 2. System Architecture Overview | Component | Technology | Role in Reset | | :--- | :--- | :--- | | Boot ROM | Mask ROM (HiSilicon) | Loads fastboot from NAND/eMMC if signature passes. | | Bootloader | U-Boot based (Huawei HiSilicon) | Provides fastboot & recovery mode keys. | | Recovery | Custom Huawei Recovery v3e | Executes wipe_data , wipe_cache , wipe_media . | | System | Android 4.4.2 / 5.1 (modified) | Settings app triggers reboot recovery --wipe_data . | 3. Methods of Factory Reset 3.1 Soft Reset (Android Settings)
Path: Settings > Device Preferences > Factory Reset > Erase Everything Mechanism: Calls RecoverySystem.rebootAndWipe() which writes --wipe_data into /cache/recovery/command and reboots. Failure Mode: If /cache is corrupt or full, the command is never read. Result: Box hangs on boot logo. Huawei Stb Q11 Factory Reset
3.2 Hardware/Bootloader Reset (Forced) This is the primary method for bricked Q11 units. Procedure:
Disconnect power. Using a conductive tool, short J15 or J16 (test points near the NAND/eMMC) OR press and hold the Reset button (pinhole on rear, if present). Apply power while keeping short/button pressed for 10+ seconds. The bootloader detects the key press and enters forced recovery (bypassing normal boot).
Technical outcome: # UART Log during forced reset [INFO] FASTBOOT_MODE: reset button detected [INFO] boot from recovery partition (0x1F) [INFO] erase misc partition [INFO] booting recovery... Note: Huawei has multiple Q-series Android STBs
4. Partition-Level Wipe Operations The factory reset is not a simple rm -rf /data . Using HiSilicon’s eMMC driver, the Recovery executes: | Partition | Wipe Type | Command (in recovery) | | :--- | :--- | :--- | | userdata | Full format (ext4) | make_ext4fs /dev/block/mmcblk0p15 | | cache | Full format | make_ext4fs /dev/block/mmcblk0p16 | | misc | Zeroed (2KB) | dd if=/dev/zero of=/dev/block/mmcblk0p12 bs=2048 count=1 | | secure_storage | Secure erase | tee-supplicant -f & then rm -rf /data/tee/* | Critical note: The fastboot and bootargs partitions are never wiped. This prevents bricking but also retains any malicious boot parameters. 5. Bypassing a "Soft-Bricked" Q11 (No Video) If the STB shows no HDMI output but LEDs are on:
Use serial UART (J3 connector):
Baud: 115200, 8N1, 3.3V logic. Interrupt auto-boot by pressing Ctrl+C in terminal during HiSilicon bootloader countdown. The Huawei STB Q11 operates on a locked-down
In U-Boot prompt, execute: hisilicon # mmc erase 0 1000 # (optional, erase env) hisilicon # setenv bootcmd 'run recoverboot' hisilicon # saveenv hisilicon # reset
This forces the box into permanent recovery mode on next boot.
