Hacking T-SPHAUSC Firmware - LN52A850 and LN52A860

[tskitishvili]

It seemed that people on different forums came to a conclusion that extending A (year 2008) series TV features is possible only using flash. My disocoveries prove them wrong.

Browsing through AVS forum thread "Official Samsung LNxxA850 Owner's Thread" I have discovered that the firmware I'm currently playing with (T-SPHAUSC version 1004) is incomplete, because it is too small (just 20Mb) compared to the version 1003.3 (300Mb) which was listed there: http://www.avsforum.com/avs-vb/showthre ... st15175787 . Inside this firmware I found one extra image file: tlib.img . After extracting its content I found the collection of games. All games are coming as shared libraries with the same entry point: Game_Main. I have also discovered references to that name in exeDSP.

I also learned that SamyGO-All-Extensions pack is also coming as shared library with Game_Main entry point. That allowed me to try using SamyGO-All-Extensions-v0.03 pack on my TVs (LN52A850).

• I have copied SamyGO folder to SEC_GAME\SamyGO folder on USB drive.
• Renamed SamyGOE.so to libSamyGO.so in order for TV to find proper library.
• I have copied .dat file from one of the games from tlib.img package and named SamyGO.dat (Placed it in above folder).
• I have copied .bmp file from one of the games from tlib.img package and named SamyGO.bmp (Placed it in above folder).
• Inserted the USB stick into my TV and followed installation instructions of SamyGO-All-Extensions-v0.03.

My TV was able to recognize "new game" and run it. I saw nice colors waves for half a minute which signals that things got executed.
But I was not able to mount anything yet.

Next I have modified rcSGO in SEC_GAME\SamyGO folder to do just two things:

Code: Select all

  mount -t devpts devpts /dev/pts
  telnetd 

and now I can connect to my TV using telnet !

For people who wants to try telnet and dig further I have created a package which enables telnetd daemon in A850 series of TVs. It might work in another A series as well. Please download the attached zip file and unpack its content to the root of USB stick. Then plug it into TV, go to content library on your TV, switch to USB drive using red button and run Telnetd game. After 27 seconds your TV will be running telnetd daemon and you will be able to connect !

SamyGO Telnetd for A850.zip

SamyGO Telnetd for LNxxAxxx.zip

Another good news is that binaries included with SamyGO are compatible with linux of my TV. That means after digging a bit I will find the way to mount NFS of Samba drives !!!

[erdem_ua]

Thanks. You can identify your FW version too?

[tskitishvili]

Currently installed version is 1004.

BTW. Until I managed to start telnet daemon through the game injection method I was thinking that I have been "successful" with flashing my custom made firmwares. But it turned out that all my attempts failed. TV software upgrade menu worked with my custom firmware, rebooted properly, but at the end I was not able to get access to telnet.
The firmware T-SPHAUSC is not encrypted. It consists of several squashfs images files. The important rootfs.img file is missing. But all remaining images can be unpacked with unsquashfs utility. I used squashfs tools pack 3.1 build for windows 32 bit. I was also able to modify rc.local file and generate new exe.img which matched by all parameters the original file. The only difference was in squshtools version number. Mine was 3.1, the original was 3.0. Maybe the reason why my custom firmware was not really flashed is these discrepancy in version numbers.

Probably I will not try anymore using custom firmware, since injection method works great and it is IMHO absolutely safe for the device

[tskitishvili]

I have permanently enabled telnet daemon. For that I have used squashtools 3.0 . Don't use 3.1

1. Unpack image with the following command:

Code: Select all

unsquashfs exe.img

2. modify squashfs-root/rc.local as this:

Code: Select all

export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_WIDGET_DATA_PATH=/mtd_down/widgets
/etc/telnetd_start.sh &
/mtd_exe/exeDSP

/etc/telnetd_start.sh & is new line there.

3. Remove or move old exe.img to different location and then run:

Code: Select all

mksquashfs.exe ./squashfs-root exe.img -all-root -nolzma -b 65536 -no-exports

4. Calculate checksum of newly generated image. (see details on SamyGO wiki age)
5. Flash it via "Update Software" TV Menu

[tskitishvili]

For last several days I was struggling with mounting windows shares. Unfortunately all my attempts failed. Although I was able to install cifs.ko (which was built with proper local version info string) , mount -t cifs produced "Segmentation fault".

However I have good news. I was able to mount NFS share. Here is how.

0. I assume you have telnet access to your TV.
1. As a test NFS server for "Windows7 64 bit" I have chosen trial version (30 days) of "Allegro NFS". The official web page is http://www.nfsforwindows.com/. It does not have download link, but you can find it on CNET if you google.
2. Installation and configuration of Allegro NFS is very simple. For test purposes I have created one export and allowed all to access it.
3. After installing Allegro NFS , you need to allow nfs.exe in Windows Firewall. If you don't do it you will get errors while mounting:

Code: Select all

mount: RPC: Timed out
mount: nfsmount failed: Bad file descriptor

4. Using telnet execute teh following command on your TV:

Code: Select all

 mount -o nolock aaa.bbb.ccc.ddd:/export_name /path_to_empty_folder -t nfs

or just follow instructions from SamyGO wiki: http://wiki.samygo.tv/index.php?title=M ... ypass_DLNA

P.S. I was able to browse/play files only if I mount nfs under an empty folder on real usb device. If I create virtual usb and mount, TV shows virtual device , but fails displaying content.

[erdem_ua]

MKV format requires special parser. I think it's not possible to inject MKV support to compiled binary (exeDSP.)
There is nothing impossible at logic domain (like softwares) but it will be really hard to do that AFAIK.