Hacking TV over Hotel mode (most C series models)

[juusso]

congratulations! be carefull, do not brick TV

[dksoul]

dksoul: How did you change to sda1 in Clone.dat.txt that is hex encoded ?

Thank you

I used the GNOME Hex Editor, but here are my files in case anyone needs them: http://bit.ly/hID9IO

With telnet access to the TV (files here: http://bit.ly/gnkMrq) I changed the hack to this:

Code: Select all

SELP#> cd /mtd_rwarea/usb_mount
SELP#> ls -l
lrwxrwxrwx    1 root     0              30 Jan  1  1980 unknownDev_cmd -> /sbin/usb_mount/unknownDev_cmd
-rwxrwxrwx    1 root     0             196 Jan  1  1980 usb_cmd
lrwxrwxrwx    1 root     0              31 Jan  1  1980 usb_coldplug.sh -> /sbin/usb_mount/usb_coldplug.sh
lrwxrwxrwx    1 root     0              30 Jan  1  1980 usb_hotplug.sh -> /sbin/usb_mount/usb_hotplug.sh
lrwxrwxrwx    1 root     0              28 Jan  1  1980 usb_moip_cmd -> /sbin/usb_mount/usb_moip_cmd
lrwxrwxrwx    1 root     0              25 Jan  1  1980 usb_mount -> /sbin/usb_mount/usb_mount

After disabling the Hotel Mode and restoring the original channels, the hack is still functional.

[dksoul]

There is a race condition between the mount of the USB drive and the execution of run.sh, which causes that sometimes run.sh is not executed (because the USB drive is not yet mounted).
To solve this I have added a sleep to the usb_cmd (among other small changes):

Code: Select all

#!/bin/sh
/sbin/usb_mount/usb_cmd $1 $2 $3
if [ "$1" = "mount" ]; then
        sleep 2
        if [ -x /dtv/usb/$3/run.sh ]; then
                sh /dtv/usb/$3/run.sh /dtv/usb/$3 &
        fi
fi

EDIT: Updated the zip files posted above with the new usb_cmd

[juusso]

Bege, you can be the first. I think it should work, because method is very universal.

[dksoul]

dksoul: I used your files still not working. Fails with same error message (USB is still working).
Details: 1Gb ext3 stick, I used your files (exept .scm), did an usb->tv tv<-usb first to check if it is working (worked, replaced Clone.dat with the hacked one after test).

What is the normal message I get when its working ?

I got that error before changing the /dtv/usb/sda to /dtv/usb/sda1. When the hack is successful you should not get any errors.
Can you post the contents of your pen drive?

[dksoul]

This is how my usb looks:
http://dl.transfer.ro/usb.tar-transfer_ ... -3efcca.gz

under ubunto i see it like sdb1

Try to delete all files under the folder T-MSX5DEUC/Clone except for Clone.dat, link0, link1 and link2