Hacking TV over Hotel mode (most C series models)

General forum for C series TVs.
Post Reply

User avatar
juusso
SamyGO Moderator
Posts: 9959
Joined: Sun Mar 07, 2010 6:20 pm

Hacking TV over Hotel mode (most C series models)

Post by juusso » Sun Nov 28, 2010 1:38 pm

updated on 3.08.2011
Related/updated wiki article is here.(automated way)
Use manual below if you want make hack from scratch. Do not follow wiki article because here isn't any USB hack image available. This condition is temporary until new version is released.

How To hack C series TV over HotelMode (manual way)

All operations on manual are made under linux

1. Import channels from TV to USB, ext3 formatted
you get an zip archive channel_list_LE32C550_1001.scm on USB

2. Add to this zip archive directory usb_mount and file 1.txt on it (it is good to set permissions to directory to 777 before add)
You get files within archive:

Code: Select all

alex3d@threed:/media/flash$ unzip -l channel_list_LE32C550_1001.scm
Archive:  channel_list_LE32C550_1001.scm
  Length      Date    Time    Name
---------  ---------- -----   ----
       68  2038-01-19 06:14   CloneInfo
       96  2038-01-19 06:14   FineTune_Digital
    40000  2038-01-19 06:14   map-AirA
   292000  2038-01-19 06:14   map-AirD
    40000  2038-01-19 06:14   map-CableA
   292000  2038-01-19 06:14   map-CableD
        4  2038-01-19 06:14   map-ChKey
      720  2038-01-19 06:14   RadioMap
        0  2010-11-30 21:55   usb_mount/
        8  2010-11-30 21:55   usb_mount/1.txt
---------                     -------
   664896                     10 files
3. Create few files with code: (you have to copy to USB later)

link0:

Code: Select all

#!/bin/sh
sh -x /mtd_rwarea/usb_mount/killself.sh &
/sbin/usb_mount/usb_cmd $1 $2 $3 $4 $5 $6 $7
if [ "$1" = "mount" ] ; then
    if [ -f /dtv/usb/$3/run.sh ] ; then
                chmod 777 /dtv/usb/$3/run.sh
                sh -x /dtv/usb/$3/run.sh /dtv/usb/$3
    fi
fi
link1:

Code: Select all

#!/bin/sh
/sbin/usb_mount/usb_mount $1 $2 $3 $4 $5 $6 $7
link2:

Code: Select all

#!/bin/sh
sleep 120
echo killself >>/mtd_rwarea/cmd1
sh -x /dtv/usb/sda/run4.sh &
rm -rf /mtd_rwarea/usb_mount/usb_cmd
rm -rf /mtd_rwarea/usb_mount/usb_mount
rm -rf /mtd_rwarea/usb_mount/killself.sh
run.sh

Code: Select all

#!/bin/sh
echo 'OK' >> /dtv/usb/sda/run.ok
Clone.dat.txt

Code: Select all

0000000: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
0000010: 7476 2f75 7362 2f73 6461 2f6c 696e 6b30  tv/usb/sda/link0
0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000080: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
0000090: 7476 2f75 7362 2f73 6461 2f6c 696e 6b31  tv/usb/sda/link1
00000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000100: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
0000110: 7476 2f75 7362 2f73 6461 2f6c 696e 6b32  tv/usb/sda/link2
0000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
0000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
4. Now you have to make binary Clone.dat from this txt file, execute command:

Code: Select all

xxd -r Clone.dat.txt Clone.dat
5. Create exact stucture of symlinks and directories on USB:

Code: Select all

alex3d@threed:/media/flash$ ls -lR
.:
-rw-r--r-- 1 root root  3972 2010-11-30 23:26 channel_list_LE32C550_1001.scm
drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link0_Clone
lrwxrwxrwx 1 root root    29 2010-11-30 23:32 link0_Temp -> /mtd_rwarea/usb_mount/usb_cmd
drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link1_Clone
lrwxrwxrwx 1 root root    31 2010-11-30 23:32 link1_Temp -> /mtd_rwarea/usb_mount/usb_mount
drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link2_Clone
lrwxrwxrwx 1 root root    33 2010-11-30 23:32 link2_Temp -> /mtd_rwarea/usb_mount/killself.sh
drwx------ 2 root root 16384 2010-11-24 19:55 lost+found
-rwxrwxrwx 1 root root   375 2010-12-01 00:56 run.sh
drwxr-xr-x 3 root root  4096 2010-11-30 23:32 T-MSX5DEUC
 
./link0_Clone:

./link1_Clone:

./link2_Clone:

./T-MSX5DEUC:
drwxr-xr-x 2 root root 4096 2010-11-30 23:32 Clone
 
./T-MSX5DEUC/Clone:
-rw-r--r-- 1 root root 384 2010-11-30 23:32 Clone.dat
-rwxrwxrwx 1 root root 246 2010-11-30 23:32 link0
-rwxrwxrwx 1 root root  57 2010-11-30 23:32 link1
-rwxrwxrwx 1 root root 199 2010-11-30 23:32 link2
6. Attach USB to TV, restore channels from USB: "restore from USB"

7. Activate Hotel Mode by pressing [MUTE] -> [1] -> [1] -> [9] -> [Enter]

8. Insert USB you made before, do settings restore: "restore from USB" from "Hotel Menu"

9. Re-insert USB

10. You should see file run.ok on USB.

11. run.sh is executed every time you attach usb.

Do not forget to change T-MSX5DEUC to T-TDT5DEUC if your TV is Trident. Here is an example with files, structure and symlinks and busybox for MIPS inside (works). do not use for import, just have look. TV was broken after import Hotel data from other TV (there were differen platforms, anyway, be carefull)

PS. you have to set "/dtv/usb/sda" as is on your TV, it might be "/dtv/usb/sda1"...

Impression. Thanks mamaich, Perforator for such delicate way of hack over symlinks, alexthreed for manual, StaLeWaR for nerves and at least three times broken TV, his wife for patience and that she didn`t kill him... and whole forum.ixbt.com community.Image

Added

If your USB have stopped working

Code: Select all

Make Ex-link cable and connect to TV enter commands folowing by Enter:
10041004
81588
20089999
2
0
0
2 (advanced)
2 (DeviceManager Debug)
90 (DeviceManager MW Debug)
12 (DLNA, FLASH, ODD, HDD, MoIP Test)
11 (FLASH, HDD Format Test)
10 (/mtd_rwarea/ partition number)
After procedure reboot TV, it starts with clean mtd_rwarea, tv restores full needed partition by self.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. Imagerooting K seriesImage, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

User avatar
erdem_ua
SamyGO Admin
Posts: 3097
Joined: Thu Oct 01, 2009 6:02 am
Location: Istanbul, Turkey
Contact:

Re: Hack for C550 and other C models

Post by erdem_ua » Wed Dec 01, 2010 4:41 am

Really good.
But better if you put this Wiki too.

mamaich
Official SamyGO Developer
Posts: 65
Joined: Sun Nov 21, 2010 4:15 am

Re: Hack for C550 and other C models

Post by mamaich » Wed Dec 01, 2010 5:34 am

One note.
If you'll read the above instructions - you'll see that link2 file creates the /mtd_rwarea/usb_mount/killself.sh script that would delete itself and other scripts 120 seconds after TV is powered on. So the TV would return back to non-hacked mode.

So if you'll need the fulltime hack - comment or remove the following lines in link2:
sleep 120
echo killself >>/mtd_rwarea/cmd1
sh -x /dtv/usb/sda/run4.sh &
rm -rf /mtd_rwarea/usb_mount/usb_cmd
rm -rf /mtd_rwarea/usb_mount/usb_mount
rm -rf /mtd_rwarea/usb_mount/killself.sh
Another note.
For myself I use a bit different usb_cmd file (link0 above):

Code: Select all

#!/bin/sh

if [ -f /dtv/busybox.initialized ]; then
#    sh -x /dtv/usb/sda/run-cmd.sh &
else
    export PATH=/mtd_rwarea/bin:$PATH
    touch /dtv/busybox.initialized
    /mtd_rwarea/busybox telnetd -l /bin/sh &
    /mtd_rwarea/busybox tcpsvd -vE 0.0.0.0 21 /mtd_rwarea/busybox ftpd -w / &
fi
/sbin/usb_mount/usb_cmd $1 $2 $3 $4 $5 $6 $7
if [ "$1" = "mount" ] ; then
    if [ -f /dtv/usb/$3/run.sh ] ; then
                chmod 777 /dtv/usb/$3/run.sh
                sh -x /dtv/usb/$3/run.sh /dtv/usb/$3
    fi
fi
It would run busybox telnet daemon and FTP server immediately after TV power on if you have any USB device connected to TV.
Of cause you'll need to copy MIPS busybox to /mtd_rwarea directory. MIPS busybox that works on TVs with T-TDT5DEUC firmware is here: http://busybox.net/downloads/binaries/1 ... sybox-mips

User avatar
juusso
SamyGO Moderator
Posts: 9959
Joined: Sun Mar 07, 2010 6:20 pm

Re: Hack for C550 and other C models

Post by juusso » Thu Dec 02, 2010 9:50 pm

In which step do you get error?
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. Imagerooting K seriesImage, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

mamaich
Official SamyGO Developer
Posts: 65
Joined: Sun Nov 21, 2010 4:15 am

Re: Hack for C550 and other C models

Post by mamaich » Fri Dec 03, 2010 2:34 am

Note:
Be very careful while using this hack. Now there are at least 2 persons who've got TVs with non-working USB (and I'm one of them). As our TVs can't load widgets - there are no ways to restore USB functionality for now.

User avatar
juusso
SamyGO Moderator
Posts: 9959
Joined: Sun Mar 07, 2010 6:20 pm

Re: Hack for C550 and other C models

Post by juusso » Fri Dec 03, 2010 12:29 pm

Yes, maybe your USB is recognized as /dtv/sda1, try.
Strange, Mute-1-1-9-enter should work to switch to HotelMode.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. Imagerooting K seriesImage, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

dksoul
Official SamyGO Developer
Posts: 47
Joined: Tue Nov 23, 2010 2:13 pm
Location: Lisbon, Portugal

Re: Hack for C550 and other C models

Post by dksoul » Fri Dec 03, 2010 2:40 pm

After changing from /dtv/usb/sda to /dtv/usb/sda1 the hack worked on my PS50C550 (T-TDT5DEUC running FW 1.021).

PS: To enter Hotel Mode, I also have to use the {INFO} {MENU} {MUTE} {POWER} while in standby
Last edited by dksoul on Fri Dec 03, 2010 4:19 pm, edited 2 times in total.

Post Reply

Return to “[C] General”