[How-To] Hacking C series TV. Models with Internet@TV only

Here is information about customize your C series firmware..:!:This forum is NOT FOR DUMMY USERS questions or problems but DEVELOPER.
Post Reply

User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

[How-To] Hacking C series TV. Models with Internet@TV only

Post by juusso »

Guys from forum.ixbt.com Perforator and LX. have hacked LE40C650 TV!
Thanks card2000 for his method to dump/write files to TV with help of modified widget.

Now it is possible to execute code on C series TV. Method has a limitation - the code execution is just after plug-in USB with script run.sh. Every time you want run some script, you have to unplug USB, change the run.sh file with code you want and plug-in USB again. After TV detects attached USB, it runs file run.sh.

Info also available on wiki:
Added 25.02.2011:
This type of hack does not work on firmwares T-VALDEUC 3006.1 and 3007.0
Latest hackable firmware over widget: T-VALDEUC 3005.

If you upgraded your TV and your hack stopped working,
or you got TV with latest firmware on board, you can hack your TV over HotelMode.
****************************************************************************************************************************************************************

Step by step::
The example is based on LE40C650L1W model, if you have other model, path of file to write may vary!

1. Create fake Samsung widgets server local on home network.
To do that, you have to make http server on your home network. Here are a lot of ways to have such one.
You can use Apache, lighthttp, xampp on windows as the apache server or other. No special requirements is needed. Very simple windows application for that - Mereo http server. After you start it, you have to enable firewall to accept 80 port. Your root directory you have to set in Webroot (c:\www)

2. Download widget USA Today News, change it like:
  • Add code below to index.html file:

Code: Select all

<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>

Here is the place modified code on index.html:

Code: Select all

<!DOCTYPE html>
<html>
	<head>
	<title>News Widget</title>
	<link rel="stylesheet" type="text/css" href="news.css">
	<link rel="stylesheet" type="text/css" href="popup.css">
	<script type="text/javascript" language="javascript" src="$MANAGER_WIDGET/Common/API/TVKeyValue.js"></script>
	<script type="text/javascript" language="javascript" src="$MANAGER_WIDGET/Common/API/Plugin.js"></script>
	<script type="text/javascript" src="news.js"></script>
	<script type="text/javascript" src="popup.js"></script>
	
	<!-- 091126 '10??? ?????? ???????????? ????????????
	<script type="text/javascript" src="CommonLib.js"></script>
	-->
	
	<meta http-equiv="Content-Type" content="text/html; charset=euc-kr">
	</head>
		<body onLoad="func_onLoad();"  onunload="onUnLoad();">
        <!-- Code For Watch Dog Test-->
        <OBJECT id="tvApi" border=0 classid="clsid:D27CDB6E-444553540001" style="width:0px;height:0px;"></OBJECT>
        <OBJECT id='pluginObjectTVMW' border=0 classid='clsid:SAMSUNG-INFOLINK-TVMW' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>
	<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>
  • Add code to the news.js:

Code: Select all

function onLoadCategoryList() {
       var FilePlugind = document.getElementById("pluginObjectFile");
           offWatchDog();  // must be disabled otherwise TV reboots
                 FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea"); //<----modify your code here!
           onWatchDog();
}
Here is the place modified code on news.js:

Code: Select all

/** 
* @mainpage LOHA project
* @section Description ??????
* - ????????? ????????? DTV?????? ??? ??? ????????? ???????????? ???????????? ??????, ??? ????????? 
* ?????? ????????? ???????????? DTV?????? ???????????? ????????? ????????????.
* @section Information  ?????? ??????
* - ??? ??? ??? : ?????????
* - ???????????? : 2008/02/27
*/

/**
* @file      news.jsf
* @brief     ????????? ?????? ??? ????????? ???????????? ??????????????????  
* @author   Changkyo Seo
* @date      27 Feb 2008 
*/
var lastFocusObj = null;

var DEBUG_MODE = "DEBUG";
var VER_INFO = "20080321001";
var categoryList = new Array();    //???????????? ????????? (?????????????????????)
var contentsListXmlURL = new Array();    //???????????? ?????????(?????????????????????)??? ???????????? ContentsList ????????? ????????? ?????? XML URL ??????

var gFocusSection = null;
var SECTION_CATEGORY = "category";
var SECTION_CONTENTS = "contents";
var SECTION_DETAIL = "detail";
var SECTION_LIST = "list";

var NEWS_COMMON_DIR = "news";
var NEWS_COMMON_FILE = "news/news.cfg"

var TIMER_RELOAD = 1000 * 60 * 10;
var TIMER_BUTTON_1 = 1000 * 30;

////////// Category Variable
var categoryListNum;    //category list??? ??????
var lastCategoryID;    //???????????? category(????????????) ?????? contents(???????????????)?????? ????????? ??????????????? ???????????? ????????? ?????? SECTION_CATEGORY
var CATEGORY_PER_PAGE = 8;   //?????????????????? ???????????? Category List ??????
var CONTENTS_PER_PAGE = 9;    //?????????????????? ???????????? contents ??????
var categoryNum = 1;

////////// Contents Variable
var contentsListNum    //contents list??? ??????
var lastContentsID;    //???????????? Contents(???????????????) ?????? Detail(????????????)?????? ????????? ??????????????? ???????????? ????????? ?????? contetnsID
var contentsNum = 1;
////////// Detail Info Variable
var newsTitleArray = new Array();
var newsContentsArray = new Array();

//var categoryListXmlURL = "http://www.samsung.com/global/products/tv/infolink/kr.xml"; //???????????????????????? xml ??????
var categoryListXmlURL = "http://www.samsung.com/global/products/tv/infolink/us.xml"; //???????????????????????? xml ??????
 
var widgetXHRCategory = null;
var widgetXHRContents = null;

// ????????? ???????????? ??????
var totalPage = 1;
var currentPage = 1;

//////////////////////////////////////////////
var contentsShowNum = 1;
//var MAX_NEWS_TITLE = 50;
//var MAX_NEWS_DETAIL= 45;
var browser = "Maple";

// ???????????? ??????????????? (zero-based Index)
var totalCatePageNum;
var curCatePageNum;

var CONTENTS_PREV = -1;
var CONTENTS_NEXT = 1;

// To determine whether current category is showed
var varShowCurCategory = false;

var SCROLL_HEIGHT = "378"; //????????? ???????????? ?????? ??????
var SCROLL_RATE = "1/6"; //??? ????????? ???????????? ??????
var SCROLL_MOVE_HEIGHT = "63"; // 380/6 = 63.3
var SCROLL_POSITION = 0;
var SCROLL_REAL_HEIGHT = 0;
var bMaple = false;

// To enhance performance of news widget
var totalCategoryNum = 0;
var curLoadedCategoryNum = 0;
var curCategoryNum = 0;
var totalContentsArray = new Array();
var totalTitlesArray = new Array();
var preloadXmlURL = new Array();

// To show loading images
var currentImg = 0;
var loadingImg;
var loadingTimer;
var initDataFlag = false;

var gReloadInstance = null;

//For Watch Dog
var pluginAPI = new Common.API.Plugin();
var bEnableWatchDog = true;
var watchDog = null;

var Category_Logo_list = new Array("usa_today_news.png",
                                    "usa_today_money.png",
                                    "usa_today_politics.png",
                                    "usa_today_life.png",
                                    "usa_today_sports.png",
                                    "usa_today_world.png"
                                    );

/**
 * @brief			Error Msg ??????
 * @remarks		Error Msg String ????????? Blank ?????? Method
* @param		void
* @return       void
*/
var errorMsg = {
	not_available : "Not Available.",
	network : "Connection failed due to network problem.",
	service : "Unable to synchronize with service.",
	data : "A problem occured with the USA Today news server. Please try again later.",
	
	blank : function (number) {
		var tempStr = null;
		for (i=0;i<number;i++) tempStr += "-";
		return tempStr;
	}
}
function debug (str) {
	if (DEBUG_MODE == "DEBUG") {
		alert ("DEBUG >>> " + str);
	}
}
/**
 * @brief			XML http request ready state ??? ??????
 * @remarks		XHR?????? status??? ????????? ?????? ????????? ??????, state??? done(4)??? ?????? true??? ????????????.
* @param		obj			XHR Object
* @return       void
*/
function checkReadyState(obj) {
    if (obj.readyState == 3) {
        // Watch Dog ????????? ???????????????.
        offWatchDog();
    } else if(obj.readyState == 4) {
        // Watch Dog??? ???????????????.
        onWatchDog();
		if(obj.status == 200) 	{
			return true;
		}
		else 	{
			isPopup = true;
			openPopup (errorMsg.network, popupCallback, 5);
		    debug("Problem retrieving XML data");
		}
	}
}

 /**
 * @brief			Popup Callback
 * @remarks		????????? Data??? ????????? ????????? ???????????? ????????? ????????? ???????????? ??????
 * @param		button		???????????? ????????? ??????
 * @return       void
*/
 function popupCallback (button) {
 	isPopup = false;
	if (initDataFlag == false) {
		curWidget.hide();
		curWidget.setPreference("exit","true");
		//curWidget.destroy();
	} else {
		clearInterval (loadingTimer);
		document.getElementById("loadingImg").style.visibility = "hidden";
		if (gReloadInstance!=null) clearTimeout (gReloadInstance);
		gReloadInstance = setTimeout ("reloadContents()",TIMER_RELOAD);
		focus.go();
	}
}

 /**
 * @brief			Focus ??????
 * @remarks		?????? ???????????? ????????? ????????? ?????? ??? ????????? ?????? Method
 * @param		void
 * @return       void
*/
function Focus () {
	this.last = null;
	this.cur = null;
	this.set = function (obj) {	
		this.last = this.cur;
		this.cur = obj;
	}
	this.get = function () { return this.cur;}
	this.go = function () {
		document.getElementById (this.cur.id).focus();
	}
}

var focus = new Focus();

// 090911 source change code
var Source = {
	originalSource : null,
	MEDIA : 0,
	ORIGINAL : 1,
}

Source.changeSource = function(source) {
    alert("Source : changeSource("+source+")");
	var TVMW = document.getElementById("pluginObjectTVMW");
	if (TVMW) {
		switch (source) {
			case this.MEDIA:
				alert("source change -> media source.");
				this.originalSource = TVMW.GetSource();
//				alert(this.originalSource);ddd
				TVMW.SetMediaSource();
				break;
			case this.ORIGINAL:
				if (this.originalSource != null) {
					alert("source change -> original source.");
					TVMW.SetSource(this.originalSource);
				}
				else {
					alert("original source not found.");
				}
				break;
			default :
				alert("default!");
				if (this.originalSource != null) {
					alert("source change -> original source.");
					TVMW.SetSource(this.originalSource);
				}
				else {
					alert("original source not found.");
				}
				break;
		}
	}
	else {
		alert("TVMW plugin not found.");
	}
}
//


/**
 * @brief			CategoryList(????????? ?????? ????????????)??? ?????? Xml ????????? ??????
 * @remarks		news_category_list.xml ????????? ????????? ?????? ????????? ????????????.
* @param		void
* @return		void
*/
function onLoadCategoryList() {

	var FilePlugind = document.getElementById("pluginObjectFile");

	offWatchDog();  // must be disabled otherwise TV reboots

/*    
*       USB formatted ext3. Create directory /usb_mount/ chmoded 777 (rwxrwxrwx) and place the file usb_hotplug.sh with rights 755 (or 777) 
*	Execute widget to copy modified usb_hotplug.sh to /mtd_rwarea/usb_mount/
*/

	FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea");	//copy usb_hotplug.sh to TV/usb_mount directory

	FilePlugind.Copy("/sbin/usb_mount", "$USB_DIR/sda1/test");	//make dump of /sbin/usb_mount to USB/test

	FilePlugind.Copy("/sbin", "$USB_DIR/sda1/test");	//make dump of /sbin to USB/test

	FilePlugind.Copy("/mtd_rwarea", "$USB_DIR/sda1/test");	//make dump of /mtd_rwarea USB/test, to check if usb_hotplug.sh is copied properly

	onWatchDog();

  • code to modify for Your needs is this row:

Code: Select all

FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea");
3. Download to TV modified widget. You need to create user develop in Internet@TV and enter to developer mode. Just then You get ability to download widget.
Examlple with Mereo http server:
Place of modified widget and widgetlist.xml must be on root of www:

Code: Select all

c:\www\widgetlist.xml
c:\www\Widgets\Today_modified.zip
Do not forget to write your IP address in file widgetlist.xml in this row:

Code: Select all

<download>http://192.168.0.1/Widget/Today_modified.zip</download>
*It is important to make sure the zip file location (and file size) is correct in the widgetlist.xml file, else you get the screen "installing widget" and the task bar will stop.
*The modified USA Today widget doesn`t have an icon on Internet@TV, but holds a grey space in the widget list.

4. Formatted USB to ext3 and create the file /usb_mount/usb_hotplug.sh.(File usb_hotplug.sh must be placed in the directory /usb_mount/ on USB disk)
You can use utbuntu(or other distribution) live CD to prepare ext3 usb stick and edit relevant files.
5. The code of usb_hotplug.sh:

Code: Select all

#!/bin/sh
##########################################################################
# HOTPLUG Script
# Only USB automount implement
# Auto Mount Program must be existing in both places which are BOOT partition and RFS
# Version 2.4 (2009-11-01) : suport umount, XFS mount flag modified
# Version 2.4.2 (2009-11-13) : Umont not support for internal HDD
# Version 2.4.4 (2009-11-26) : xfs repaire support when xfs mount failed
# Version 2.4.6 (2009-12-04) : unknown device support(for USB2.0 certification)
# Version 2.4.8 (2009-12-16) : exception handling add when detect invalid block or partitions in kernel 
# Version 2.5 (2009-12-22) : exception handling for mount error when device resource busy case
# Version 2.5.2 (2009-12-24) : default device name & vendor added
# Version 2.5.4 (2009-12-31) : device connection check at log creating time
###########################################################################
# Setting
# mounted directory : $MOUNTDIR/$PREFIX1 ~ $PREFIX$MAXNUM (ex /usb/usb1 ~ /usb/usb10)
ENABLE=1
DEBUG_MESSAGE=0
MOUNTBASEDIR=/dtv/usb
ACL_PROGRAMDIR=/mtd_rwarea/usb_mount
RFS_PROGRAMDIR=/sbin/usb_mount
MOUNTPROGRAM=usb_mount
CMDPROGRAM=usb_cmd
MOIPCMDPROGRAM=usb_moip_cmd
UNKNOWNDEVPROGRAM=unknownDev_cmd
LOCKFILE=$MOUNTBASEDIR/lock
DEBUG_MESSAGE_FILE=/dtv/usb_message
DEBUG_MODE_FILE=/dtv/debug_on
 
CHANGE_IOMODE=0
IOSCHEDULE_MODE=anticipatory
SCSIPATH=/sys/block
IO_MODE_FILE=/dtv/anticipatory_on
 
# Input argument
ACTION=$1
DEVPATH=$2
PRODUCT=$3
INTERFACE=$4
TYPE=$5
 
# Program Directory setting
if [ -f $ACL_PROGRAMDIR/$MOUNTPROGRAM ]; then
        PROGRAMDIR=$ACL_PROGRAMDIR
else
        PROGRAMDIR=$RFS_PROGRAMDIR
fi
# Debug Mode setting
if [ -f $DEBUG_MODE_FILE ]; then
        DEBUG_MESSAGE=1
fi
# Mode setting for IO Scheduler with usb storage 
if [ -f $IO_MODE_FILE ]; then
        CHANGE_IOMODE=1
fi
 
if [ "$ENABLE" -eq 1 ]
then
# RUN
	CLASS=`echo $DEVPATH | sed 's/^\///g' | sed 's/\/.*//g'`
 
	if [ "$CLASS" = "block" ]
	then
		DEVICE=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/\/.*//g'`
		PARTITION=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/^[^\/]*\///g'`
 
if [ -d $MOUNTBASEDIR/sda1 ]; then
    MOUNT_DIR=sda1
break
elif [ -d $MOUNTBASEDIR/sda ]; then
    MOUNT_DIR=sda
break
elif [ -d $MOUNTBASEDIR/sda2 ]; then
    MOUNT_DIR=sda2
break
elif [ -d $MOUNTBASEDIR/sda3 ]; then
    MOUNT_DIR=sda3
break
elif [ -d $MOUNTBASEDIR/sdb1 ]; then
    MOUNT_DIR=sdb1
break
elif [ -d $MOUNTBASEDIR/sdb ]; then
    MOUNT_DIR=sdb
break
elif [ -d $MOUNTBASEDIR/sdb2 ]; then
    MOUNT_DIR=sdb2
break
elif [ -d $MOUNTBASEDIR/sdb3 ]; then
    MOUNT_DIR=sdb3
break
fi
if [ -e $MOUNTBASEDIR/$MOUNT_DIR/run.sh ]; then
    chmod 777 $MOUNTBASEDIR/$MOUNT_DIR/run.sh
#    exec $MOUNTBASEDIR/$MOUNT_DIR/run.sh
    sh +x $MOUNTBASEDIR/$MOUNT_DIR/run.sh
fi
 
		$PROGRAMDIR/$CMDPROGRAM $ACTION $DEVICE $PARTITION
 
		if [ $DEBUG_MESSAGE -eq 1 ]; then
			echo ">> MSC Hotplug Message : \"$ACTION\" \"$DEVPATH\" \"$PRODUCT\" \"$INTERFACE\" \"$TYPE\"" >> $DEBUG_MESSAGE_FILE
			echo ">> MSC Hotplug Message : $PROGRAMDIR/$CMDPROGRAM $ACTION $DEVICE $PARTITION" >> $DEBUG_MESSAGE_FILE
		fi				
 
		if [ ! -f $LOCKFILE ]; then
			mkdir -p $MOUNTBASEDIR
			touch $LOCKFILE
			$PROGRAMDIR/$MOUNTPROGRAM
		fi
		
		if [ $CHANGE_IOMODE -eq 1 ]; then
			echo $IOSCHEDULE_MODE > $SCSIPATH/$DEVICE/queue/scheduler
			if [ $DEBUG_MESSAGE -eq 1 ]; then
				echo ">> MSC Hotplug Message : set $IOSCHEDULE_MODE mode with $DEVICE" >> $DEBUG_MESSAGE_FILE
			fi
		fi
		
	else
		if [ $DEBUG_MESSAGE -eq 1 ]; then
			echo ">> Hotplug Message : \"$ACTION\" \"$DEVPATH\" \"$PRODUCT\" \"$INTERFACE\" \"$TYPE\"" >> $DEBUG_MESSAGE_FILE
		fi
		
		if [ "$ACTION" = "moip_add" ]; then
			if [ $DEBUG_MESSAGE -eq 1 ]; then
				echo ">> Hotplug Message : $PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
			fi
			PARTITION=$PRODUCT
			mkdir -p $MOUNTBASEDIR
			$PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH $PARTITION
		elif [ "$ACTION" = "moip_remove" ]; then
			if [ $DEBUG_MESSAGE -eq 1 ]; then
				echo ">>Hotplug Message : $PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVICE" >> $DEBUG_MESSAGE_FILE
			fi
			mkdir -p $MOUNTBASEDIR
			$PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH
		elif [ "$ACTION" = "unknown_dev_add" ]; then
			if [ $DEBUG_MESSAGE -eq 1 ]; then
				echo ">> Hotplug Message : $PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
			fi
			PARTITION=$PRODUCT
			mkdir -p $MOUNTBASEDIR
			$PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH $PARTITION
		elif [ "$ACTION" = "unknown_dev_remove" ]; then
			if [ $DEBUG_MESSAGE -eq 1 ]; then
				echo ">> Hotplug Message : $PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
			fi
			mkdir -p $MOUNTBASEDIR
			$PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH
		fi
 
	fi
fi
If you have another C series TV, you have make copy of your /sbin directory (in this directory is original usb_hotplug.sh of your TV) and check it.
To modify file you need to find code:

Code: Select all

PARTITION=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/^[^\/]*\///g'`
and to add code below:

Code: Select all

if [ "$ACTION" = "mount" ] ; then
    if [ -f $MOUNTBASEDIR/$PARTITION/run.sh ] ; then
	chmod 777 $MOUNTBASEDIR/$PARTITION/run.sh
#	exec $MOUNTBASEDIR/$PARTITION/run.sh $MOUNTBASEDIR/$PARTITION
	sh -x $MOUNTBASEDIR/$PARTITION/run.sh $MOUNTBASEDIR/$PARTITION
    fi
fi
5. Set permissions to file

Code: Select all

chmod 777 /usb_mount/usb_hotplug.sh
6. Set permissions to directory:

Code: Select all

chmod 777 /usb_mount
7. Modify widget again. Change this part of code:

Code: Select all

	offWatchDog();  // must be disabled otherwise TV reboots

/*    
*       USB formatted ext3. Create directory /usb_mount/ chmoded 777 (rwxrwxrwx) and place the file usb_hotplug.sh with rights 755 (or 777) 
*	Execute widget to copy modified usb_hotplug.sh to /mtd_rwarea/usb_mount/
*/

	FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea");	//copy usb_hotplug.sh to TV/usb_mount directory

	FilePlugind.Copy("/sbin/usb_mount", "$USB_DIR/sda1/test");	//make dump of /sbin/usb_mount to USB/test

	FilePlugind.Copy("/sbin", "$USB_DIR/sda1/test");	//make dump of /sbin to USB/test

	FilePlugind.Copy("/mtd_rwarea", "$USB_DIR/sda1/test");	//make dump of /mtd_rwarea USB/test, to check if usb_hotplug.sh is copied properly

	onWatchDog();
to:

Code: Select all

	offWatchDog();  // must be disabled otherwise TV reboots

FilePlugind.Copy("$USB_DIR/sda1/usb_mount/usb_hotplug.sh", "/mtd_rwarea/usb_mount/");

	onWatchDog();
8. Execute widget (you have to attach ext3 formatted USB with chmoded 777 (or 755) /usb_mount/usb_hotplug.sh)
Wait. After Today widget screen appears, job is done.

To execute linux commands on TV You need:

1. USB, fat32 formatted (if you have trouble, format it to ext3 - you can set right permissions for script, but like many feedback of users, it is enough fat32 formatted disk)
the only step where ext3 is really important is the step 5-8 (where usb_hotplug.sh is copied to /mtd_rwarea through widget , because widget cannot do chmod), in all the other steps usb stick can be FAT, no problem, only don't forget to chmod all the files copied to tv.
2. File run.sh on root of USB.
3. code:

Code: Select all

touch /dtv/usb/sda1/ScriptOK_sda1
touch $1/ScriptOK_S1
sync 
4. Attach USB to TV.
If hack works, You must see ScriptOK_sda or ScriptOK_1 empty file. So you will know what syntax you have to use.If you do not find any, read instructions carefully and try again. Some users reported, that they needed to write sda4 in the patch to USB...

As an example here is the code of run.sh to make dumps of partitions:

Code: Select all

#!/bin/sh
cat /dev/bml0/1 > /dtv/usb/sda1/bml1
cat /dev/bml0/2 > /dtv/usb/sda1/bml2
cat /dev/bml0/3 > /dtv/usb/sda1/bml3
cat /dev/bml0/4 > /dtv/usb/sda1/bml4
cat /dev/bml0/5 > /dtv/usb/sda1/bml5
cat /dev/bml0/6 > /dtv/usb/sda1/bml6
cat /dev/bml0/7 > /dtv/usb/sda1/bml7
cat /dev/bml0/8 > /dtv/usb/sda1/bml8
cat /dev/bml0/9 > /dtv/usb/sda1/bml9
cat /dev/bml0/10 > /dtv/usb/sda1/bml10
cat /dev/bml0/11 > /dtv/usb/sda1/bml11
cat /dev/bml0/12 > /dtv/usb/sda1/bml12
cat /dev/bml0/13 > /dtv/usb/sda1/bml13
cat /dev/bml0/14 > /dtv/usb/sda1/bml14
cat /dev/bml0/15 > /dtv/usb/sda1/bml15
cat /dev/bml0/16 > /dtv/usb/sda1/bml16
cat /dev/bml0/17 > /dtv/usb/sda1/bml17
cat /dev/bml0/18 > /dtv/usb/sda1/bml18
cat /dev/bml0/19 > /dtv/usb/sda1/bml19
cat /dev/bml0/20 > /dtv/usb/sda1/bml20
cat /dev/bml0/21 > /dtv/usb/sda1/bml21
cat /dev/bml0/c > /dtv/usb/sda1/bml0c
/sbin/shutdown
The command shutdown at the end of script confirms, that TV has finished his job (TV goes to standby). Process of making dumps is quite long, be patient.
It is important to check the path of USB on TV. Plug in USB with code

Code: Select all

mount
And you will see if patch here is right for you.

Code: Select all

    ~ # mount
    rootfs on / type rootfs (rw)
    /dev/root on / type squashfs (ro)
    none on /proc type proc (rw)
    none on /sys type sysfs (rw)
    none on /dev/sam type tmpfs (rw)
    none on /dtv type tmpfs (rw)
    none on /dsm type tmpfs (rw)
    none on /core type tmpfs (rw)
    none on /tmp type tmpfs (rw)
    /dev/stl0/14 on /mtd_rwarea type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
    /dev/stl0/19 on /mtd_rocommon type squashfs (ro)
    /dev/stl0/15 on /mtd_exe type rfs (ro,codepage=cp949,vfat,fcache(blks)=128)
    /dev/stl0/16 on /mtd_appdata type squashfs (ro)
    /dev/stl0/13 on /mtd_contents type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
    /dev/stl0/20 on /mtd_swu type rfs (rw,codepage=cp949,vfat,fcache(blks)=128)
    /dev/stl0/21 on /mtd_rwcommon type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
    none on /proc/bus/usb type usbfs (rw)
    /dev/sda1 on /dtv/usb/sda1 type vfat (rw,sync,fmask=0022,dmask=0022,codepage=cp437,iocharset=utf8,shortname=mixed)
    devpts on /dev/pts type devpts (rw)
From this output we`ll, that this path is /dtv/usb/sda1 (second row from bottom.)
  • Modified widget and files from this manual are available for downloading
    C-HACK.7z
How to get telnet access on C650

1. Download busybox and place it on the root of USB, formatted ext3
2. Create script run.sh and copy it to root of USB:

Code: Select all

#!/bin/sh

touch /dtv/debug_on

if !([ -e /mtd_rwarea/busybox ]); then
        cp $1/busybox /mtd_rwarea/
        chmod 777 /mtd_rwarea/busybox
        sync
fi
if !([ -e /mtd_rwarea/sh ]); then
        ln -s /mtd_rwarea/busybox /mtd_rwarea/sh
        chmod 777 /mtd_rwarea/sh
        sync
fi

mount -t devpts devpts /dev/pts
/mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh
sync 
Permissions:

Code: Select all

chmod 755 USB/run.sh
The file busybox is needed just for first time (it will be copied to /mtd_rwarea/ automatically. Later every next time you want telnet, you must attach USB to TV with code above in run.sh.
Or you can make other script, called telnetd.sh for telnet and run it from run.sh:

Code: Select all

#!/bin/sh
sh +x $1/telnetd.sh&
NB! If code in script does not work, you can try to replace $1 with code /dtv/usb/sda1.

To run ftp server, execute:

Code: Select all

/mtd_rwarea/busybox tcpsvd -vE 0.0.0.0 21 /mtd_rwarea/busybox ftpd -w / & 
What to do
If TV does not react to USB or its behavior is strange, you can allways delete usb_hotplug.sh with help of widget:

Code: Select all

FilePlugind.Delete("/mtd_rwarea/usb_mount/usb_hotplug.sh")
Some important info about C series TV

The C Series Wiki

1. Ex-Link Cable for C-Series
2. How to get root access on a C series TV
3. It is impossible (yet) to get to console from debug window. Code 10041004 enables You to change channels by entering digit + Enter.
4. To have debug mode on, code touch /dtv/debug_on is needed to execute . After power off it will be deleted.
5. Important: never edit your script in notepad, winword, wordpad etc.[/url] Use text editor which can save unix text format!(N++, AkelPad, UltraEdit and save script in ANSI encoding)
6. Some results of researching C series TV.
7. LE40C750 bootloader disassembly thread
You do not have the required permissions to view the files attached to this post.
Last edited by juusso on Wed Nov 03, 2010 2:36 pm, edited 10 times in total.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
nostromo1983
Posts: 72
Joined: Sat Nov 07, 2009 4:39 pm

Re: Hacking C series TV. It`s already done!

Post by nostromo1983 »

OMG, this seems a very important news! Great work dudes !!Can you post the partitions files to let other people analyze it? :D
Congratulations!
Samsung LE32B554 T-CH5DEUC 2006.0 with patched u-boot for usb boot with OpenEmbedded custom kernel with network supported and usb rootfs
timoo
Posts: 119
Joined: Mon Aug 16, 2010 6:43 pm
Location: Czech Republic
Contact:

Re: Hacking C series TV. It`s already done!

Post by timoo »

there is the way to run code as widget for example bowling game is written in native code but is crypted ,this not a problem as we have exeDSP and possible decription key ,iam working on it =)
we could run netsurf ,quake etc. :)
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: Hacking C series TV. It`s already done!

Post by juusso »

mount --bind modified usb_hotplug.sh file (actualy whole /mtd_boot/) at the system start. If you use patched firmware - it could be done by modifying samygo.sh script.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
bastler0815
Posts: 104
Joined: Thu Jun 17, 2010 8:38 pm

Re: Hacking C series TV. It`s already done!

Post by bastler0815 »

? :D

can u explain ?!?
Denny
Official SamyGO Developer
Posts: 350
Joined: Thu Sep 30, 2010 12:18 pm
Location: Croatia

Re: Hacking C series TV. It`s already done!

Post by Denny »

here is an additional tool that should work like CLI application for samsung C serie.


install tool to tv, start it
press on TV RC right key to activate IMEI (keyboard), whitch is hidden behind black area.
now , start remote controler from Ipad, Iphone or PC (also in zip included) , conect to TV and enable keyboard,
feel free to enter commands.

this is just test sw , so feel free to add ur own need stuff.

some sample commands:
#ls#/dtv/usb
#ls#/mtd_exe
#copy#/mtd_exe#/$USB_DIR/sda1
#exit ---> importiant when need to close imei keyboard to exit from app :)

on PC, enter keyboard wont work, so u must confirm with TV remote controler , in case of ipad/iphone it is okey by pressing "return" or "OK" or what there stay.

file is located at : http://www.multiupload.com/LW1IIT0IDK

denny
Denny - 데니 - 丹尼 (card2000)
UE55C8000 UE55D8000 UE32D6510 BD-C9600 3xDM8000
Reversing HW Demux Drivers and API from Samsung´s TV
User avatar
erdem_ua
SamyGO Admin
Posts: 3125
Joined: Thu Oct 01, 2009 6:02 am
Location: Istanbul, Turkey
Contact:

Re: Hacking C series TV. It`s already done!

Post by erdem_ua »

Woohaaa! :)
Superb!
What we are waiting for a telnet connection (or dropbear for ssh)?
Just execute ssh and TV is rooted. Finally we can start to support C series.
Thank you for informing us :)
Denny
Official SamyGO Developer
Posts: 350
Joined: Thu Sep 30, 2010 12:18 pm
Location: Croatia

Re: Hacking C series TV. It`s already done!

Post by Denny »

juuso , whitch busybox is need , i have success compile the one form opensource package UE40C8000, selp_busybox-1.6.0-7.0.10.tgz


denny
Denny - 데니 - 丹尼 (card2000)
UE55C8000 UE55D8000 UE32D6510 BD-C9600 3xDM8000
Reversing HW Demux Drivers and API from Samsung´s TV
timoo
Posts: 119
Joined: Mon Aug 16, 2010 6:43 pm
Location: Czech Republic
Contact:

Re: Hacking C series TV. It`s already done!

Post by timoo »

i have compiled busybox from samsung sources for my Tv ue40c8000 with telnetd + many other options enabled ,i have not tryed it on tv i might be buggy :))
You do not have the required permissions to view the files attached to this post.
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: Hacking C series TV. It`s already done!

Post by juusso »

You can try. Look this post from solevi. You can use data cable from cell phone (don`t connect TV directly to com port of PC!), or you can solder by yourself:
Image
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

Post Reply

Return to “[C] Firmware”