1. decrypt firmware
2. rename decrypted files and attach .dec to each decrypted file.
3. make directory in usb for example /dtv/usb/sda1/update/T-VALDEUC
4. copy all decrypted files to this dir.
5. copy all xxxxx.sec.cmac files to the dir
6. hit : ./flash_c8000 /dtv/usb/sda1/update/T-VALDEUC
it take some time until al?l is finish.
when everything is okey hit
/sbin/toggle
if u get error msgs, hit again until no error come.
when done
rename in /mtd_rwarea/
Version.x to Version.y
where x and y are 0 and 1, just swap numbers.
if u 100000% sure u done all correct , reboot tv.
finish.
attn:
take big care, when you flash bml or stl device , mount it 10 time if need and check your changment before you toggle to changed parition.
i have 2 times got some binary data in rc.local , sems if u multiple mount it on linux and change multiple time.
this project can now someone take under control and continue work on it. as i want to do some other issues whitch are need to be done.
Denny
http://www.multiupload.com/FCR1F2EEP0
console log:
Code: Select all
# flash_c8000 /dtv/usb/sda1/update/T-VALDEUC
54 2d 56 41 4c 44 45 55 43 0a
We have T-VALDEUC hardware
can not open : bml/13!!!
Parition used 0.
Parition 1 will be flashed.
read_cmac_dev : /dev/bml0/10
0 05539000 : ba cf 3c 71 d1 6a 61 16 be 63 a0 4b 07 9e 60 5d
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
rootfs.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.sec.cmac
calculated hash : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Delivered hash : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!
Image.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/Image.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/Image.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/Image.sec.cmac
calculated hash : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
Delivered hash : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!
appdata.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/appdata.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/appdata.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/appdata.img.sec.cmac
calculated hash : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
Delivered hash : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!
exe.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/exe.img.sec.cmac
calculated hash : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
Delivered hash : 97 bb 05 9c dc 05 40 bc d8 36 2a eb 0f ea 3e a4
File is changed.....!!!!
We flash this File
stl.restore /dev/stl0/17 /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
+------------------------------------------------------------------------+
| stl.restore : stl-level Partition Restore Tool for NAND Flash Memory |
+------------------------------------------------------------------------+
100%
All of the flash memory blocks have been restored successfully.
verify /dev/stl0/17, please wait.....
flash file success....
stl device hash match
/dtv/usb/sda1/update/T-VALDEUC/cmac.bin
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
bml.restore /dev/bml0/10 /dtv/usb/sda1/update/T-VALDEUC/cmac.bin
+----------------------------------------------------------------------+
| bml.restore : Low-level Partition Restore Tool for NAND Flash Memory |
+----------------------------------------------------------------------+
------------------ This is confirm message ---------------------
/******** Check your options and selected partition ***********/
Selected Flex-OneNAND device and 10 partition
100%
All of the flash memory units have been restored successfully
reading again cmac bml:
read_cmac_dev : /dev/bml0/10
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Verify CMAC DATA!!!! if match with previus hit toggle to switch paritions.
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
# mount -t rfs -r /dev/stl0/17 /mnt
# ls /mnt
$RFS_LOG.LO$ RUIC otpcheck.sh
Comp_LIB ReleaseInfo partition.txt
EDID SpecialItemNumber.txt prelink.cache
EXE_IMG_VER WIFI_LIB prelink.conf
Factory_Part1.dat YWidget_LIB rc.local
Factory_Part2.dat ddr_margin rc.local.rfs
GAME_LIB exeDSP samdrv.ko
InfoLink lib stagecraft
Java memalloc value.bin
LifeScenario moip
# cat /mnt/rc.local
#!/bin/sh
export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB:/mtd_contents:/mtd_cmmlib/InfoLink/lib/plugin/Static:/mtd_appdata/yahoo:/mtd_appdata/moip:/mtd_cmmlib/Comp_LIB:/mtd_cmmlib/GAME_LIB:/mtd_appdata/gemstar:/mtd_cmmlib/DRM_LIB:/Java/lib:/mtd_cmmlib/InfoLink/lib:/dtv
export HOME=/mtd_moip
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null #Remove engine logging.
export KF_DATA_DIR=/mtd_yahoo/yahoo
export KF_THREAD_PRIORITY=20
export KF_NO_LOG=1
export KF_NO_CRASHHANDLERS=1
export KF_HF_WRITE_PATH=/mtd_rwarea/yahoo
if [ -e /mtd_rwarea/myBoot.sh ]; then
chmod 777 /mtd_rwarea/myBoot.sh
/mtd_rwarea/myBoot.sh
else
cd /mtd_exe/
./exeDSP
fi
#