[SOLVED] Forced "toggle" to repair bricked TV?

This forum is for information related with D series hardware.

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

juuso wrote:00->02->00 at address 0x18
This is more promising candidate, IMO; personally I'd try to change this byte first. Let's hope there are no checksums of any kind involved ;)

User avatar
juusso
SamyGO Moderator
Posts: 10125
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

Oga83, got trouble: whatever address i use to rw, it always changes me the 0x00 address, mean, first byte. Value changed ok, but just first address. Used 0x01, 0x02, 0x03, 03, 3, 22, 0x23, 00e0, 0x00e0
(use command like: http://192.168.1.207/write?device=80&addr=23&data=FF )
Always it change red marked one:
SpoilerShow
0000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0020: FF FF B0 77 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 07 6E FF B2 FF FF FF FF FF

For example command

Code: Select all

http://192.168.1.207/write?device=80&addr=e0&data=55
Result:
0000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0020: 55 FF B0 77 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 07 6E FF B2 FF FF FF FF FF
Does my interface can`t understand addr variable? addr gives number of row or so? for example:
SpoilerShow

Code: Select all

http://192.168.1.207/read?format=0&device=80&addr=1&size=1
0001: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

Code: Select all

http://192.168.1.207/read?format=0&device=80&addr=10&size=40
0010: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0030: 22 FF B0 77 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 07 6E FF B2 FF FF FF FF FF

Code: Select all

http://192.168.1.207/read?format=0&device=80&addr=22&size=40
0022: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0042: FF FF B0 77 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 07 6E FF B2 FF FF FF FF FF
I can`t read value of one byte and perhaps i can`t write it as well. Googled a little and found something. I hope i don`t need to connect pins A0, A1, A2 to gnd??? If this will not damage mainboard, i can make short circuit on all four pins on GND side...

p.s. Url like http://192.168.1.207/write?addr=e0&data=55 (as on wiki) won`t do anything - i mean value is written (as page returns some data), but read eeprom doesn`t get it back.

I haven`t used any resistors between eeprom pins and arduino, just direct connection:
GND - GND
WP - GND
SDA - A4
SCL - A5
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

juuso wrote:Oga83, got trouble: whatever address i use to rw, it always changes me the 0x00 address, mean, first byte. Value changed ok, but just first address
I did not try to write into micom e2prom (24CS0), only in SoC e2prom (24512) :(

At first glance, the 'write' I2C frame is different between the 2 chips.
I will look deeper to it this afternoon, and will probably add a parameter in the URL to choose the eeprom type.
eeprom.png
In the meantime, you can comment the following line in the function 'WriteEeprom' :

Code: Select all

Wire.write(addr>>8);
I think it will make it for Micom eeprom :)
You do not have the required permissions to view the files attached to this post.

User avatar
juusso
SamyGO Moderator
Posts: 10125
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

oga83 wrote: In the meantime, you can comment the following line in the function 'WriteEeprom' :

Code: Select all

Wire.write(addr>>8);
I think it will make it for Micom eeprom :)
Okey, this helped! Starting to debricking... :!:

Update:
wow, guys, you`re amazing! it worked! board toggled to 1st, healthy partition :o . Will experiment and write some summary.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

juuso wrote:Okey, this helped! Starting to debricking...
Great !

New version is wikified :
- Add width=8 in the url for Micom eeprom (8-bits address bus)
- By default, address bus is 16-bit wide (SoC eeprom)

I also modified the bus width for ReadEprom.
Let me know if it works for you. I did not have enough time to test in depth...

User avatar
juusso
SamyGO Moderator
Posts: 10125
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

Have done a lot of testing with two available mainboards and have some summary. To switch partitions, we need to change two bytes:
0x03 and 0x04 and unplug TV from the wall for few seconds. Mentioned 00 and 02 at address 0x18 do nothing, at least i couldn`t find any relation between changing them and partition switch. Tested on UE40D6750 and UE406500...

1. Read config micom: 2. Enable micom debug (if disabled, no boot log, no debug trough exlink, no chance to get shell!) set 0x05 to 00: N.B you have to enable debug and disable watchdog on SoC eeprom (use another eeprom, check here) by commands below: 3. Switch boot partition.
For example:
To force toggle to 1st partition set (cmd line rootfs=/dev/tfsr6...), values should be AD CD:
http://ip/write?device=80&addr=3&data=AD&width=8
http://ip/write?device=80&addr=4&data=CD&width=8
SpoilerShow
0000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0020: FF FF AD CD 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 02 6E FF B2 FF FF FF FF FF .............eng......+.n.......
0040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00a0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00c0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00e0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
To boot 2nd set of partitions (cmd line rootfs=/dev/tfsr8...) values are B0 77
http://ip/write?device=80&addr=3&data=B0&width=8
http://ip/write?device=80&addr=4&data=77&width=8
SpoilerShow
0000: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0020: FF FF B0 77 00 FF 00 FF 00 00 02 00 FF 65 6E 67 FF 00 FF FF 01 C2 2B 02 6E FF B2 FF FF FF FF FF ...w.........eng......+.n.......
0040: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0060: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00a0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00c0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00e0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
Checked many times and every time tv booted as expected according values above. Method doesn`t work if powered off to standby and powered on back, no reaction to modified boot flags: to get partitions toggling, unplug from wall is mandatory.

On D series boards i haven`t soldered wires direct to the chip, on backside of mobo i noticed three pads, used multimeter and identified they`re connected to proper eeprom config pads! GND i took from another place, one of legs of socket (look at black wire).
SpoilerShow
ImageImage
SpoilerShow
Image
Image
I`m lucky i have had healthy mobo i could make testing with, now both mainboards working. :)

Some notices. I think this way on D series, with original rootfs and kernel is not really acceptable, because toggling partitions will force TV to start rebooting by authuld, here is only one exe.img partition onboard and toggle won`t switch cmac partitions. This may be solutions for advanced users, who have patched kernel and hashes aren`t important anymore or devels if bricked while messing with rootfs or kernel.

For C series this could be ok, because "toggle" is used to completely switch firmware, but not only rootfs+kernel. Someone could do similar testing on C series mainboards, time to time here are some bricks, what could be treatable this way. If similar pads exist, perhaps no soldering is needed at all?

Oga83, i haven`t tested your new sketch yet, TV was already assembled when i saw your post. Will do that later.

one more edit: inspecting some another behavior: B0 77 definitelly loads 2nd partition set, but AD CD does not. Or not always. So, research to be continued :)
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

User avatar
erdem_ua
SamyGO Admin
Posts: 3114
Joined: Thu Oct 01, 2009 6:02 am
Location: Istanbul, Turkey
Contact:

Re: [SOLVED] Forced "toggle" to repair bricked TV?

Post by erdem_ua »

Congratulations. I also wondered before about what are those pads.
:D

User avatar
prairie
SamyGO Project Donor
Posts: 303
Joined: Wed May 04, 2011 10:30 pm

Re: [SOLVED] Forced

Post by prairie »

Nice work! I have a D-series bricked board I'd like to revive for spare/research.

my situation
1. ROLLBACK flag is set in /mtd_rwarea which generates an immediate reboot of device
2. It has exe.img in both swu/0 and swu/1 but they are stock exe.img and no modified rootfs (no usb hotplug option here)


Can I use this I2C interface to switch boot partitions or perhaps erase /mtd_rwarea? My board has the single row of testpoints pictured here:
SpoilerShow
ImageUploadedByTapatalk1357996814.857209.jpg
You do not have the required permissions to view the files attached to this post.
PN60F8500AFXZA
T-FXPAKUC 1206.3 + SamyGO

"BrickMaster 2015"

User avatar
juusso
SamyGO Moderator
Posts: 10125
Joined: Sun Mar 07, 2010 6:20 pm

Re: [SOLVED] Forced

Post by juusso »

Your problem has another brick character than mine, you lose nothing if you connect ethernet interface to micom switch partitions. I doubt this can solve your problem, but who knows, perhaps this is enough to repair?
prairie wrote: Can I use this I2C interface to switch boot partitions or perhaps erase /mtd_rwarea? My board has the single row of testpoints pictured here:
Yes, exact this i did - i switched boot partitions by replacing bytes in eeprom. Testpoints on your photo are wrong for our goal, this is most probably SoC eeprom pads. Please attach hi-res photo of your mainboard first... Thanks...
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

User avatar
prairie
SamyGO Project Donor
Posts: 303
Joined: Wed May 04, 2011 10:30 pm

Re: [SOLVED] Forced "toggle" to repair bricked TV?

Post by prairie »

Here are the pics:
SpoilerShow
Image
Image
PN60F8500AFXZA
T-FXPAKUC 1206.3 + SamyGO

"BrickMaster 2015"

Post Reply

Return to “[D] Hardware”