access to uboot menu

[aquadran]

Greate news indeed

on what TV you got this ?

[arris69]

THAT IS IT!!!!!!!!!!!!!

Keep pressing "~" when powering up the TV and you'll get this:

...

I think that is what we've been waiting for... New kernel, new root file system... Totally safe!!! Unless you overwrite the bootloader area.


Robbiesz

nice!

but the question is what we can do with the tv without samdrv.ko and exeDSP

for shure nfsboot looks interesting!

arris

[dynamic1969]

Guys,

just tried it out myself and it works well .
Following are the changes I have made in my Service Menu and steps taken during boot-process:
- Service Menu: put your RS232 setting device to "debug"
- Service Menu: set Watchdog to "off", so that the device doesn't reboot while you are in uBoot menu
- Boot-Process: press and hold "~"
- Boot-Process: once you see "Hit any key to stop autoboot: ..." hit e.g. ENTER ( by default there is a booting delay of 2 seconds )
- there you are ...
Thanks robbiesz

Could somebody with a CI+ device try this out as well ??? I'd be interested if this shall work

This is the output on a UExxB7000

Code: Select all

>> ONBOOT :: 0x59a50219 0x12821282
U-Boot 1.1.6 (Dec 12 2008 - 15:55:34)

DRAM:  128 MB
**************** device info  *******************
nPgsPerSLCBlk = 128
nPgsPerMLCBlk = 256
nSctsPerPg = 8
nNumOfUsBlks = 994
OneNAND[booting] mode / clk = S / 50Mhz
*************************************************
TinyBML[0] open success
env_relocate_spec
Success loading partition
Environment Data loading success!!
No ethernet found.
In:    serial
Out:   serial
Err:   serial
Net:   RTL8139#0
Hit any key to stop autoboot:  0

===============================
===============================
     BOOTROM DEBUG SESSION
===============================
1. ENVIRONMENT SETUP

2. SHOW PARTITION

===============================
0. JUMP TO UBOOT PROMPT
r. REBOOT
===============================
===============================
SELECT COMMAND:

Output from "2. SHOW PARTITION" shows the partitions as listed below:

Code: Select all

<< CS0 PARTITION INFORMATION >>
======================================================================================
     description          load addr          id           attr      first_blk  no_blks
======================================================================================
 0 : boot loader          0x60100000     (0x00000000)    SLC (0x9001)   0        1
--------------------------------------------------------------------------------------
 1 : u-boot               0x60200000     (0x00000001)    SLC (0xd401)   1        1
--------------------------------------------------------------------------------------
 2 : u-boot env           0x60300000     (0x00000002)    SLC (0x9001)   2        1
--------------------------------------------------------------------------------------
 3 : update util          0x60400000     (0x00000003)    SLC (0x9001)   3        1
--------------------------------------------------------------------------------------
 4 : kernel image         0x61000000     (0x00000004)    SLC (0xd001)   4        8
--------------------------------------------------------------------------------------
 5 : root file system     0x61400000     (0x00000005)    SLC (0x9001)   12       8
--------------------------------------------------------------------------------------
 6 : boot modules         0x61800000     (0x00000006)    SLC (0x9001)   20       4
--------------------------------------------------------------------------------------
 7 : driver+exeDSP 1      0x70000000     (0x00000007)    MLC (0xa001)   24       60
--------------------------------------------------------------------------------------
 8 : appdata+cmmLib 1     0x78000000     (0x00000008)    MLC (0xa001)   84       45
--------------------------------------------------------------------------------------
 9 : driver+exeDSP 2      0xffffffff     (0x00000009)    MLC (0xa001)   129      60
--------------------------------------------------------------------------------------
10 : appdata+cmmLib 2     0xffffffff     (0x0000000a)    MLC (0xa001)   189      45
--------------------------------------------------------------------------------------
11 : mtd_tlib rw          0xffffffff     (0x00000014)    MLC (0xa101)   234      450
--------------------------------------------------------------------------------------
12 : mtd_rwarea rw        0xffffffff     (0x00000015)    MLC (0x2101)   684      42
--------------------------------------------------------------------------------------
13 : mtd_infolink rw      0xffffffff     (0x00000016)    MLC (0x2101)   726      150
--------------------------------------------------------------------------------------
14 : OTA rw               0xffffffff     (0x00000017)    MLC (0x2101)   876      118
--------------------------------------------------------------------------------------
======================================================================================

<< CS1 PARTITION INFORMATION >>
======================================================================================
Device[1] not opened

Output from "1: ENVIRONMENT SETUP" with very interesting environment variables:

Code: Select all

------------------------------
-     ENVIRONMENT SETUP      -
------------------------------
1. BOOTING COMMAND      = bbm load fkernel;go 60008000
2. BOOTING DELAY        = 2
3. TARGET IP            = 10.88.23.246
4. SERVER IP            = 10.88.27.160
5. GATEWAY IP           = 10.88.23.1
6. ETHERNET ADDRESS     = 10:11:12:13:14:15
7. BOOTING ARGS         = root=139:6 rw ethaddr=10:11:12:13:14:15 ip=10.88.23.246 :10.88.27.160:10.88.24.1:255.255.255.0::eth0 console=ttyS1
8. UPDATE BOOTING ARGS
------------------------------
s. SAVE ENVIRONMENT
x. EXIT
------------------------------

The available uBoot commands are shown via "0. JUMP TO UBOOT PROMPT":

Code: Select all

LEONID # help
?       - alias for 'help'
mtest   - simple RAM test
autoscr - run script from memory
base    - print or set address offset
bbm   - BBM sub-system
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
itest   - return true/false on integer compare
jade     -
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rtl8139_eeprom - read & print out eeprom contents
rtl8139_eth_addr <mac addr> - write new mac address to eeprom.
rtl8139_eth_init - write 0xffff into eeprom
rtl8139_eth_setup - write default values into eeprom
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves   - save S-Record file over serial line
setenv  - set environment variables
sleep   - delay execution for some time
smctest [r|w|t] [addr]- raw access to DATARAM0 1KB(ldm/stm by 8 words)
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
LEONID # fatls
usage: fatls <interface> <dev[:part]> [directory]
LEONID #boot

Entering "boot" from uboot menu starts over normally without issues.

Regards
dynamic

[aquadran]

It open new chapter of hacking this tv
I wonder about replace kernel in CI+ from CI. Then would be no authtd deamon.

[erdem_ua]

Samy will GO angry to us for cracking CI+

[aquadran]

I'm trying access to bootloader but no success.
I'm keeping pressing '~' (actually it's ' ) '~' you got with shift + '`'
I guess you don't mean char but button ?
Anyway I tried both combination, also tab, space, enter, still can't enter bootloader

[aquadran]

I'm trying access to bootloader but no success.
I'm keeping pressing '~' (actually it's ' ) '~' you got with shift + '`'
I guess you don't mean char but button ?
Anyway I tried both combination, also tab, space, enter, still can't enter bootloader

I looked into bootloader binary, and indeed I found check for '~' char.
I managed to work anyway.
So it's not button but keycode. so shift + `
And it's not example ENTER key, but ONLY ENTER key to break uboot wait delay. It's match source code.
It's very difficult get keypress '~' at specific milisecodns window time.
And hold key might not work as you describe.
That depend on keyrepeat and delay after first keypress. So I set in system for maximum speed repeat, and minimum first delay.
Now I got no problem access to bootloader by keep hold pressing keycode '~'

Pawel

[dynamic1969]

I looked into bootloader binary, and indeed I found check for '~' char.
I managed to work anyway.
So it's not button but keycode. so shift + `
And it's not example ENTER key, but ONLY ENTER key to break uboot wait delay. It's match source code.
It's very difficult get keypress '~' at specific milisecodns window time.
And hold key might not work as you describe.
That depend on keyrepeat and delay after first keypress. So I set in system for maximum speed repeat, and minimum first delay.
Now I got no problem access to bootloader by keep hold pressing keycode '~'

Hi Pawel, the keys to press may be different, based on your keyboard-layout.
As far as I can see, it is checking for the "~" ( tilde ) character to be issued - e.g. on a German Keyboard, this is achieved by pressing "AltGR" and "+" keys.

For me, holding "AltGR" and "+" pressed during the boot-process stops the boot process and you get the bootloader prompt.
During the bootdelay, I didn't try any other key than "ENTER" but you may be right, that it may have to be "ENTER" ( even though the prompt is saying ... any key ).

Regards
dynamic