T-VALDEUC Flashing tool.

Here are software that related with Samsung C series TVs, applications, programs that will run in your TV or computer...:!:This forum is NOT FOR USER QUESTIONS or Problems.

Denny
Official SamyGO Developer
Posts: 350
Joined: Thu Sep 30, 2010 12:18 pm
Location: Croatia

T-VALDEUC Flashing tool.

Post by Denny »

in my case i have just change rc.local in exe.img

1. decrypt firmware
2. rename decrypted files and attach .dec to each decrypted file.
3. make directory in usb for example /dtv/usb/sda1/update/T-VALDEUC
4. copy all decrypted files to this dir.
5. copy all xxxxx.sec.cmac files to the dir
6. hit : ./flash_c8000 /dtv/usb/sda1/update/T-VALDEUC
it take some time until al?l is finish.

when everything is okey hit
/sbin/toggle
if u get error msgs, hit again until no error come.
when done
rename in /mtd_rwarea/
Version.x to Version.y
where x and y are 0 and 1, just swap numbers.
if u 100000% sure u done all correct , reboot tv.
finish.

attn:
take big care, when you flash bml or stl device , mount it 10 time if need and check your changment before you toggle to changed parition.
i have 2 times got some binary data in rc.local , sems if u multiple mount it on linux and change multiple time.


this project can now someone take under control and continue work on it. as i want to do some other issues whitch are need to be done.


Denny


http://www.multiupload.com/FCR1F2EEP0

console log:

Code: Select all

# flash_c8000 /dtv/usb/sda1/update/T-VALDEUC
54 2d 56 41 4c 44 45 55 43 0a
We have T-VALDEUC hardware
can not open : bml/13!!!
Parition used 0.
Parition 1 will be flashed.
read_cmac_dev : /dev/bml0/10
0 05539000 : ba cf 3c 71 d1 6a 61 16 be 63 a0 4b 07 9e 60 5d
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
rootfs.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/rootfs.img.sec.cmac

calculated hash : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Delivered hash  : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!




Image.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/Image.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/Image.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/Image.sec.cmac

calculated hash : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
Delivered hash  : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!




appdata.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/appdata.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/appdata.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/appdata.img.sec.cmac

calculated hash : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
Delivered hash  : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
Hash Same , File is unchanged!
Flash alredy have this file, we skip flashing!!!




exe.img.dec found
Opening /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
Calculate CMAC /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
Opening /dtv/usb/sda1/update/T-VALDEUC/exe.img.sec.cmac

calculated hash : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
Delivered hash  : 97 bb 05 9c dc 05 40 bc d8 36 2a eb 0f ea 3e a4
File is changed.....!!!!
We flash this File
stl.restore /dev/stl0/17 /dtv/usb/sda1/update/T-VALDEUC/exe.img.dec
+------------------------------------------------------------------------+
|  stl.restore : stl-level Partition Restore Tool for NAND Flash Memory  |
+------------------------------------------------------------------------+
  100%
All of the flash memory blocks have been restored successfully.
verify /dev/stl0/17, please wait.....
flash file success....
stl device hash match


/dtv/usb/sda1/update/T-VALDEUC/cmac.bin
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
bml.restore /dev/bml0/10 /dtv/usb/sda1/update/T-VALDEUC/cmac.bin
+----------------------------------------------------------------------+
| bml.restore : Low-level Partition Restore Tool for NAND Flash Memory |
+----------------------------------------------------------------------+
------------------  This is confirm message  ---------------------
/********  Check your options and selected partition  ***********/
Selected Flex-OneNAND device and 10 partition
  100%
All of the flash memory units have been restored successfully
reading again cmac bml:
read_cmac_dev : /dev/bml0/10
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
Verify CMAC DATA!!!! if match with previus hit toggle to switch paritions.
0 05539000 : c6 bd 56 9a 9e ab 9f ef ae 33 d0 ca dc 1b 8c 18
1 0271d000 : 21 db f8 89 05 6b 6e cd b9 79 f4 7d 9c f3 df e4
2 0038c490 : c3 c8 87 8a b7 99 22 99 dd d2 f5 78 59 53 30 20
3 0037f014 : c1 08 db 98 9f 5a 9b a4 db 8d f4 ca 30 4c 55 6d
# mount -t rfs -r /dev/stl0/17 /mnt
# ls /mnt
$RFS_LOG.LO$           RUIC                   otpcheck.sh
Comp_LIB               ReleaseInfo            partition.txt
EDID                   SpecialItemNumber.txt  prelink.cache
EXE_IMG_VER            WIFI_LIB               prelink.conf
Factory_Part1.dat      YWidget_LIB            rc.local
Factory_Part2.dat      ddr_margin             rc.local.rfs
GAME_LIB               exeDSP                 samdrv.ko
InfoLink               lib                    stagecraft
Java                   memalloc               value.bin
LifeScenario           moip
# cat /mnt/rc.local
#!/bin/sh

export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB:/mtd_contents:/mtd_cmmlib/InfoLink/lib/plugin/Static:/mtd_appdata/yahoo:/mtd_appdata/moip:/mtd_cmmlib/Comp_LIB:/mtd_cmmlib/GAME_LIB:/mtd_appdata/gemstar:/mtd_cmmlib/DRM_LIB:/Java/lib:/mtd_cmmlib/InfoLink/lib:/dtv

export HOME=/mtd_moip
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null #Remove engine logging.
export KF_DATA_DIR=/mtd_yahoo/yahoo
export KF_THREAD_PRIORITY=20
export KF_NO_LOG=1
export KF_NO_CRASHHANDLERS=1
export KF_HF_WRITE_PATH=/mtd_rwarea/yahoo
if [ -e /mtd_rwarea/myBoot.sh ]; then
    chmod 777 /mtd_rwarea/myBoot.sh
    /mtd_rwarea/myBoot.sh
else
    cd /mtd_exe/
    ./exeDSP
fi
#
Denny - 데니 - 丹尼 (card2000)
UE55C8000 UE55D8000 UE32D6510 BD-C9600 3xDM8000
Reversing HW Demux Drivers and API from Samsung´s TV
User avatar
decix
Posts: 95
Joined: Thu Dec 30, 2010 11:18 pm
Location: Germany

Re: T-VALDEUC Flashing tool.

Post by decix »

it's probably not a good idea to experiment with flashing at all until a safe solution has been tested and published here.
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: T-VALDEUC Flashing tool.

Post by juusso »

only way get it back is to formatt mtd_rwarea. but debug is needed. if you didnt set it, then call Service :(
it is bad, if you started such dangerous without exlink debug mode and watchdog off ...
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
Denny
Official SamyGO Developer
Posts: 350
Joined: Thu Sep 30, 2010 12:18 pm
Location: Croatia

Re: T-VALDEUC Flashing tool.

Post by Denny »

eeehmm, fell now also bad about rebooting tv,
i was thingking about this issue, when myBoot.sh is in /mtd_rwarea located, and it is empty
in BD, i modify it to /dtv/usb/sda1, but this can not work, coz usb is loaded when exeDSP is executed.... so, in rc.local, there is need to add some more check that will check myBoot.sh file , if myBoot.sh dont have any call for exeDSP to toggle back the previus parition.

Denny
Denny - 데니 - 丹尼 (card2000)
UE55C8000 UE55D8000 UE32D6510 BD-C9600 3xDM8000
Reversing HW Demux Drivers and API from Samsung´s TV
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: T-VALDEUC Flashing tool.

Post by juusso »

I suggest you change behavior of myBoot.sh during boot process. Look at the rc.local on B series and how does samygo.sh is being activated: - it goes to background and doesn`t troubles boot process. Now TV checks for your myBoot.sh and whole start process is being executed by myBoot.sh. It is to dangerous and it is the same as start.sh was.
Before:

Code: Select all

export KF_LOG=/dev/null #Remove engine logging.
cd /mtd_exe/

./exeDSP
After:

Code: Select all

export KF_LOG=/dev/null;/mtd_rwarea/SamyGO.sh&
cd /mtd_exe/

./exeDSP
The & means that script is loading in bacground (necessary)! I did not look at rc.local of C series firmware, but i think this example gives you some ideas how to make pached autostart more secure.

And here is another custom rc.local of B series:
#!/bin/sh

export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null

# set SamyGO root directory export
export SamyGOpath="/mtd_rwarea/SamyGO"

# run autorun script in the background (if exists)
if [ -f "$SamyGOpath/autorun.sh" ]; then
$SamyGOpath/autorun.sh&
else
# no autorun script? run telnet
mount -t devpts devpts /dev/pts
telnetd
fi

# and run original exeDSP
cd /mtd_exe
./exeDSP
Where you can see- you do not need to give TV booting for you custom script. Leave original TV start procedure untouched.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE
Denny
Official SamyGO Developer
Posts: 350
Joined: Thu Sep 30, 2010 12:18 pm
Location: Croatia

Re: T-VALDEUC Flashing tool.

Post by Denny »

juuso , in my case i just want to start own exeDSP not the one in /mtd_exe, that is why i make myBoot.sh in my case of modify,

today i think about , is there any way, in rc.local after check myBoot.sh to add is exeDSP started, if not start the one from /mtd_exe

telnet etc , all can be started before starting exeDSP , all no problem and question , just final check , is exeDSP started or not, this must be added in rc.local

another think to avoid such think is to try mount usb before starting exeDSP or in my case what i want try to mount HDD on Dreambox where all stuff for me are located.

i also know, if i write something bad in script , bye bye tv and misstyping are like good day....

Denny
Denny - 데니 - 丹尼 (card2000)
UE55C8000 UE55D8000 UE32D6510 BD-C9600 3xDM8000
Reversing HW Demux Drivers and API from Samsung´s TV

Post Reply

Return to “[C] Software”