C series shell input filtration removal

[tempinbox]

Oops, forgot to mention i need other files too (to don`t make mistake...)

Code: Select all

dd if=/dev/bml0/1 of=/dtv/usb/sda1/bml1.dmp
dd if=/dev/bml0/2 of=/dtv/usb/sda1/bml2.dmp
dd if=/dev/bml0/3 of=/dtv/usb/sda1/bml3.dmp
dd if=/dev/bml0/4 of=/dtv/usb/sda1/bml4.dmp
dd if=/dev/bml0/5 of=/dtv/usb/sda1/bml5.dmp
dd if=/dev/bml0/6 of=/dtv/usb/sda1/bml6.dmp
dd if=/dev/bml0/7 of=/dtv/usb/sda1/bml7.dmp
dd if=/dev/bml0/8 of=/dtv/usb/sda1/bml8.dmp
dd if=/dev/bml0/9 of=/dtv/usb/sda1/bml9.dmp
dd if=/dev/bml0/10 of=/dtv/usb/sda1/bml10.dmp
cat /proc/cmdline > /dtv/usb/sda1/cmdline

And what firmware is currently active (T-VALDEUC-30xx?)

EDIT: ok, i see, hashes on bml10 are from T-VALDEUC-1015.1

here it is the full dump of t-valdeuc 3015.0 -->http://www.datafilehost.com/download-147c3ed7.html

[juusso]

Thanks. Kernel patched, now checking hashes. Done. Checked agains your dumps + patched kernel and hashes partition bml10.dmp:

Code: Select all

Debian:/TV/_C/T-VALDEUC# ./chkhash -k 6f6bc7e1fc7f86bf9c150a82f343e2e0 -L 0x0000 5 bml10_patched.dmp 3015/dump/*
hash[ 0] = 13ed976a89ee98cf067c1afaad44df84   length = 89739264  :  3015/dump/exe.img
hash[ 1] = 57361c1fec9390b5ebedd6576248fb06   length = 43184128  :  3015/dump/appdata.img
hash[ 2] = b2c3353dd594dd95ce4c674fa767c0f6   length =  3712144  :  3015/dump/bml7_VAL_3015_patched.dmp
hash[ 3] = 9b8663050a8ffa3b6607ba931dbfbe2b   length =  3665940  :  3015/dump/bml8.dmp

Important!: Attached files(filenames) are for T-VALDEUC-3015.1 with active 2nd partition set.
OTHER firmware versions or 1st active partition set = 100% brick.

How To
Restore both files necessarily at one TV session. If you flash one file and reboot, you get brick!

Code: Select all

bml.restore /dev/bml0/7 /dtv/usb/sda1/bml7_VAL_3015_patched.dmp
sync
sync
sync
bml.restore /dev/bml0/10 /dtv/usb/sda1/bml10_VAL_3015_patched.dmp
sync
sync
sync

If no errors come, reboot TV and pray...If you get write error, DO NOT REBOOT or POWER OFF, ask for help and wait.

How to decide which set is active you can check by rootfs partition. tfsr6 is for 1st set, tfsr8 is for 2nd set :

Code: Select all

cat /proc/cmdline

The output for 1st set should look:

Code: Select all

root=/dev/tfsr6 console=ttyS1 quiet

Output for second set:

Code: Select all

root=/dev/tfsr8 console=ttyS1 quiet

After reboot Input filtration trough exlink is removed (but it is needed to unlock input with 10041004)

Code: Select all

10041004 {Enter}
20089999
2 (Platform Print Setting)
0
0
2 (Advanced Platform)
2 (DeviceManager Debug)
91 (DeviceManager SS Debug)
20 (Enter system command)
SELP#>input your commands here

[greenhorn]

Do you need 3005.1 T-VALDEUC dump too?

[juusso]

Do you need 3005.1 T-VALDEUC dump too?

yes, if you want.

[greenhorn]

AFAIK T-VALDEUC 3005.1, 3011 and 3015 are the most popular, so will be nice if we have it patched. Thanks for your help!
@juuso
See attached dump T-VALDEUC 3005.1
http://sdoburgas.dyndns.org:81/GFO/c651 ... 0_3005.zip

Code: Select all

# cat /proc/cmdline
root=/dev/tfsr6 console=ttyS1 quiet

[tempinbox]

thanks but i can't find download link for patched file.
did you patch only full shell over exlink o the rclocal too such as the patched fw for t-val6deuc?

[juusso]

Just only exlink shell (yet). For files check PM and report back about result.

[tempinbox]

Done and it works!!!!thanks juuso
so it's possible to get custom fw on t-valdeuc board too

[juusso]

Well , tested on valdeuc-3005 and 3015... by manual writing and few other firmwares installed over network too.

I`m pretty sure it works on ANY of valdeuc family (val6 including - tested and exists on patched firmwares). Upcoming wiki article describes how to make modifications at home and how to calculate hashes - might for any, who can patch exeDSP of C series but scared to brick.

placeholder for wiki article. Anyone?