LExxB650 T2P CI+ hacking

[mprotect]

About flashing modified firmware. It isn't possible to flash TV with encrypt_update programs output, right?

Wrong. That's why I created the "RSA disable" game.

And if checksums are generated after flashing, than we can hack exeDSP via IDA as at CI devices (like for implementing Video ARFix.)

I think so, yes.

[erdem_ua]

About flashing modified firmware. It isn't possible to flash TV with encrypt_update programs output, right?

Wrong. That's why I created the "RSA disable" game.
[quote="erdem_ua"]

Okay. Instead of "RSA disable" game method, I wanted to generate this signature from XOR encrypted image since we know the "secret" key. But I think this RSA secret is different than AES secret, so we needed to scan/bruteforce entire RSA key space for implementing this.
Your method is remove kernel signature check but not every CI+ device has Game menu. We can execute derivative application from telnet too but CI+ devices could only enable their telnet via Telnet Enabler Application which is requires game menu too..

Sum off all those, CI+ is broken for only devices with a "Game" menu. Other CI+ devices cannot update their firmwares as they want...

[erdem_ua]

So, this topic close to the end here since we got almost all Hardware related things. So I open new topic for at software forum for software discussions/problems for CI+ devices.
Please follow this topic for SOFTWARE related questions and applications for CI+ devices...

[dasilverpaladin]

Sorry,

i know you wanna close this topic but i have something to add here.

After i flashed my TV 2 or 3 times (don`t know exactly) with modified firmware i noticed that my TV says there was no firmware backup.
I checked the path you mentioned in the wiki (Ensure the backup exe.img ( stored on /dev/tbml10 ) is in good condition ( and ideally not altered. ) )
but there is no folder just an 60MB file.

Maybe disabling the RSA also disables the backup progress.

As precoution i suggest every 2nd or 3rd flash should be an original unaltered firmwareimage, havent tried it, bust should work.

As adittion i installed an FTP server on my TV, if someone needs files from an 37" B650 CI+, just ask

[craftonix]

Perhaps i can help i own a LE40B651T3P.
Let me know.

I just discovered Samygo, i will be proud if i can help

[zoon01]

New firmware version is out on Samsung support site for LE40B650T2P

newest version is now T-CHLCIPDEUC-2007.1

does someone knows what is new in this?

[a-o]

As adittion i installed an FTP server on my TV, if someone needs files from an 37" B650 CI+, just ask

Could you please provide the files as an attachment in the thread (it is still open) for other users to test?
Then this could be officially distributed in the files section where the other SamyGo stuff is located.
Thank you.

New firmware version is out on Samsung support site for LE40B650T2P
newest version is now T-CHLCIPDEUC-2007.1

Attention, please read the warning "DONT UPDATE LAST SAMSUNG TV FIRMWARES".

[zibri2]

Simple question:

I found these codes inside exeDSP of T-VALDEUC 3009.2

Code: Select all

1194444
8158282
81588
81599
81501
81590
30101

but I didn't find 1198282... where should that be?

[juzis]

1198282 is for B series. You are looking T-VALDEUC, It`s for C series.