Modify squashfs images (boot.img/rootfs.img)

[arris69]

dump modify and flash boot.img for T-CHU7DEUC samsung firmware

(i assume you have usb-pen on tv and it is mounted to /dtv/usb/sda)

mksquashfs -> version 3.0!!!
unsquashfs -> version 3.3 (has parameter -s, but may not realy important. just to bee on the safer side)

dump your tvs boot partition:
via telnet:

Code: Select all

bml.dump /dev/bml0/7 /dtv/usb/sda/dev_bml0_07.img

now take yous usb-pen and put it on your linux computer
(for windows user may this link is helpfull
http://www.modmymoto.com/forums/showthread.php?t=521665)

inspect version of dumped image:

Code: Select all

unsquashfs -s dev_bml0_07.img

(just to bee on the safe side, look at version etc. but looks like
samsung guys made squashfs with default settings except block size
and with strange timestamps)

extract your image with unsqashfs:

Code: Select all

unsquashfs -dest dev_bml0_07 dev_bml0_07.img

increase version number:

Code: Select all

vi dev_bml0_07/.version

(mine was 25_2G_64_512-32 changed to 25_2G_64_512-33)

delete unneeded files:

Code: Select all

dev_bml0_07/modules/install_ko.sh

may other scriptfiles too
(i just removed install_ko.sh)

copy new modules (like patched rt73.ko and cifs.ko, you can pick it up
from SamyGO extension packs):

Code: Select all

cp SamyGO-All-Extensions/SamyGO/lib/modules/*.ko dev_bml0_07/modules/
cp SamyGO-All-Extensions/SamyGO/lib/modules/treasure/rt* dev_bml0_07/modules/

edit rc.local on boot partition (to load extra modules and/or start telnetd or whatever):

Code: Select all

vi dev_bml0_07/rc.local

(i made changes after "insmod /mtd_boot/modules/usb_fault.ko")
save your changes in rc.local and exit from vi editor

Code: Select all

:x

fix ownership of files:

Code: Select all

chown -R root:root dev_bml0_07

(or you add -all-root or -root-owned to the next command)

create boot.img:

Code: Select all

mksquashfs dev_bml0_07 boot.img -le -b 65536

check it:

Code: Select all

unsquashfs -s boot.img

(compare values from first check!)

get original firmware for your tv and extract it to usb-pen, delete unneded files:

Code: Select all

rm T-CHU7DEUC/image/exe.img.enc
rm T-CHU7DEUC/image/appdata.img.enc

copy your boot.img into T-CHU7DEUC/image/ (it is not necessary to xor it to boot.img.enc!!)

get the crc of boot.img (i used patched version of cksfv)

Code: Select all

cksfv boot.img
; Generated by cksfv v1.3.14 on 2009-10-29 at 12:24.12
; Project web site: http://www.iki.fi/shd/foss/cksfv/
;
;      1138688  11:08.17 2009-10-29 boot.img
*008_boot.img_ba61ef11

put the new information into T-CHU7DEUC/image/validinfo.txt (don't forget to delete info about exe.img and appdata.img)

plug your usb-pen into tv, on popup window select firmware update.

thats all, no channel search is needed after reboot.

here some logs:
update and reboot monitored via serial:

Code: Select all

Source : 5120  Window Type : 0  Back End Decoder Type : 4
fsrerase /dev/bml0/7
This program is operated over FSR based
The flash memory blocks have been erased successfully.
[SERIAL INPUT MANAGE] Managed tty_struct(.name:ttyS1) Setup!!!
[SERIAL INPUT MANAGE] disable_serial : ~~bye(len:5)
[SERIAL INPUT MANAGE] enable_serial : debug(len: 5)

[26_2G_64_512] Linux version 2.6.18_SELP-ARM (ksh921@sp) (gcc version 4.2.0 20070514 (GPL2) (SELP 4.2.0-3.0.5.custom 2007-10-31(14:53))) #9
================================================================================
 SAMSUNG: v2.6.18_SELP_3.X_GA_bayhill+/A1(P24)
         (Detailed Information: /sys/selp/vd/lspinfo/summary)
================================================================================
[SERIAL INPUT MANAGE] Managed tty_struct(.name:ttyS1) is freed !!!
[SERIAL INPUT MANAGE] Managed tty_struct(.name:ttyS1) Setup!!!
[SERIAL INPUT MANAGE] disable_serial : ~~bye(len:5)
[SERIAL INPUT MANAGE] enable_serial : debug(len: 5)

init started:  SELP-BusyBox(GPL2) v1.2.2-Samsung.Common.Linux (2008.12.24-18:59+0000) multi-call binary
Starting pid 24, console /dev/ttyS1: '/etc/rcS'
/etc/rc.local start!!!!
boot script rc.local start!!!
=====================================================
  ROOTFS VERSION : 25_2G_64_512-26 T-CHU7DEUC
  BOOT VERSION   : 25_2G_64_512-33
=====================================================
/mtd_rwarea/PartitionSwitch_1_0  is detected...
2nd Partition is selected...


lsmod after reboot:

Module                  Size  Used by    Tainted: P
rt73 355884 0 - Live 0xbf57b000
rt2870sta 678004 1 - Live 0xbf4d4000
usb_storage 37796 0 - Live 0xbf4c9000
ohci_hcd 18692 0 - Live 0xbf4c3000
ehci_hcd 29992 0 - Live 0xbf4ba000
usbcore 129064 6 rt73,rt2870sta,usb_storage,ohci_hcd,ehci_hcd, Live 0xbf499000
8139too 23296 0 - Live 0xbf492000
cifs 235860 0 - Live 0xbf457000
fuse 50292 0 - Live 0xbf449000
usb_fault 3928 2 - Live 0xbf447000
samdrv 3876372 26 - Live 0xbf093000
rfs 71688 7 - Live 0xbf080000
fsr_stl 251568 6 - Live 0xbf041000
fsr 258912 1 fsr_stl, Live 0xbf000000

# dmesg | grep rtus
<0>rtusb 2870 1.002(1.4.0.0) [SamyGO] init --->
<0>rtusb 0.994 [SamyGO] init ====>

happy hacking
arris

[erdem_ua]

GReat!

[arris69]

hi,
this theme is just a blackbox to me.
can you explin (in detail) what ars the benefits of this tutorial.

as the title say "Modify squashfs images (boot.img/rootfs.img)"
this are parts of the firmware what you also can change (contains device driver and applications libraries etc.), but
this parts are not included in official firmware -> you have to get this first out from your tv (dump partitions)

other parts of the firmware

• u-boot.bin -> boot loader (start the tvs operating system)
• uboot_env.bin -> boot loader configuration space (http://www.denx.de/wiki/U-Boot/WebHome)
• fnw.bin, onw.bin -> application to write memory chips?
• Image -> linux kernel for the device
• rootfs.img, boot.img, appdata.img, exe.img -> core filesystem and apps, kernel module hotplug control, libraries background images, samsung controll programms libraries
• tlib.img -> preinstalled gallery content (stupid games, stupid massage, and more stupid/unneeded things)

ive got the impression that i miss something here in the form.
i were glad to becon more background info of the above described totorial and steps.

Btw, what are the SamyGO extension packs???

Thanks alot.

SamyGO extension packs was the first step to make things a bit easier, new driver & scripts for automatical mount (access) network shares etc.

hth
arris

[arris69]

I doit this......
But now my TV is not working. (only blinks red light) ((
How i may restore default setting and root?

theory say from u-boot you can start the bbm subsystem
http://forum.samygo.tv/viewtopic.php?f= ... rt=20#p615

then from bbm in "should" be possible update partition(s)
but i think you need a working copy of the partitions and may other stuff not included in normal firmware (oneboot.bin)
notice: infos in uboot/tbml/cmd_tbml.c

what did you change on your partitions and did you saw any warning/error messages during generation or extraction of squashfs-image?

errors like:

Code: Select all

create_inode: failed to create character device squashfs-root/dev/ttySD2, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/urandom, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/usbdev1.1, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/usbdev2.1, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/usbdev3.1, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/usbdev4.1, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/vcs, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/vcsa, because Operation not permitted
create_inode: failed to create character device squashfs-root/dev/zero, because Operation not permitted

during unsquashfs rootfs image?

arris

[dynamic1969]

HI shwed,

assuming that you:
- have a working serial cable at hand ( ex-link cable )
- had set your RS232 device to "debug"
- you can interrupt the boot process as outlined in this thread
chances are good, that it should be possible to get your device up and running again ... otherwise, it may be a case for your warranty.

Regards
dynamic

[erdem_ua]

HI shwed,

assuming that you:
- have a working serial cable at hand ( ex-link cable )
- had set your RS232 device to "debug"
- you can interrupt the boot process as outlined in this thread
chances are good, that it should be possible to get your device up and running again ... otherwise, it may be a case for your warranty.

Regards
dynamic

This thread has no warnigns about working ex-link cable or marking RS232 to debug at first post
I think threads with related dangereous actions has this warnings at first post header (not title).