Page 1 of 44

[App] ForceFirmware Back (FFB)

Posted: Wed Nov 24, 2010 9:04 pm
by juusso
Force Firmware Back (FFB) v.0.8

FFB is a samygo application for B series CI (not CI+ !!!) samsung TV to force firmware downgrade on "February" firmwares. With help of this samygo "game" it`s easy to restore deleted by "postFEB" firmware u-boot and TOP debug, to have access to u-boot menu and TOP debug menu over ExLink cable in emergency repair situation (for CI devices only).

For CI+ devices, use another version of this app, check here.


LExxB65x - firmware: T-CHL7DEUC
LExxB75x - firmware: T-CHL7DEUC

LNxxB65x - firmware: T-CHEAUSC
LNxxB75x - firmware: T-CHEAUSC
Korean LNxxB65x/75x, firmware T-CHEAKRC

PSxxB65x - firmware: T-CHL7DEUC
PSxxB85x - firmware: T-CHU7DEUC
PNxxB8xxx - firmware: T-CHE7AUSC
PNxxB65x/86x - firmware: T-CHEAUSC
PNxxB850 - firmware T-CHEAUSC

P.s.You need to enable GAMES on plasma TV first to use samygo apps, instruction is here.

UExxB7xxx - firmware: T-CHU7DEUC
UExxB8xxx - firmware: T-CHU7DEUC

UAxxB7xxx - firmware: T-CHU7AEAC (for downgrade use T-CHU7AEAC-2004.0)
UAxxB7xxx - firmware: T-CHU7AEAC (for downgrade use T-CHU7AEAC-2004.0)

UNxxB7xxx - firmware: T-CHE7AUSC
UNxxB8xxx - firmware: T-CHE7AUSC

No other models supported, you can brick TV if use other!Use at your own risk.

N.B If you have TV with unsupported firmware (don't listed above, e.g. T-CHL7DAUC, T-CHL7DCNC,T-CHU7DAUC or other) and you need FFB for downgrade, please contact me.


First you need enable (if not already) copy/remove feature in Content Library Manager, enable debug and disable Watchdog:
  • TV is off
  • Enter Service Menu ( quickly push
    [MENU] [MUTE] [POWER] on your remote control )
    on American models: [MUTE] [1] [8] [2] [POWER]
    [*]Change setting (Control -> Sub Option -> Wiselink Write -> On<-off)
    [*]Change setting (Control -> Sub Option -> Watchdog -> Off<-on)
    [*]Change setting (Control -> Sub Option -> rs232-jack -> debug<-UART<-Logic)
    [*]Power off TV [POWER]
    [*]Remove all USB drives/keys attached to TV
1. Download Latest FFB and extract archive to empty Fat32 formatted USB disk. /samygo-ffb directory must be on root of USB with file structure on it:

Code: Select all

Attach USB to TV.


2. Enter [Content Library Manager] -> Select [USB] -> [Children]


3. Use Copy function (yellow RC button) on TV to copy 5.SamygoHorse content to TV internal flash.
(After pressing yellow button, choose "Copy all").


Detach USB from TV.

4. Download "pre-FEB" firmware for your TV (original only!).

Some firmwares: If you don`t find firmware you need, ask on forum.
5. Extract firmware to USB (you can use the same usb with FFB app). Do not change firmware files, use them "as is"

6. After firmware upgrade USB disk is done, on the root directory you have to see T-CHL7DEUC (for LExxB65x, LExxB75x, PSxxB65x ) or T-CHU7DEUC (for UExxB7xxx, UExxB8xxx, PSxxB85x, UAxxB7xxx, UAxxB8xxx), or T-CHEAUSC (for LNxxB65x, LNxxB75x), T-CHE7AUSC (for LNxxB7xxx, LNxxB8xxx, P(U)NxxB8xx(x))

7a. For CI firmware only:

Files [T-xxxxxxx]-u-boot.bin, [T-xxxxxxx]-fnw.bin, [T-xxxxxxx]-Image (where xxxxxxxx is firmware version) needed to be placed in the same directory as exe.img.enc, appdata.img.enc and other firmware files (inside /image/ directory). (extract from archive as is e.g. [T-CHL7DEUC]-u-boot.bin , do not rename!). You can`t downgrade firmware without those images using FFB. Also copy md5sum and md5 files as well.

Structure you have to get on USB(example with T-CHL7DEUC, if your TV has other firmware, you have to get your firmware here):

Code: Select all

Download required images (not for CI+): 8. Go to [Content Library Manager] -> [My Contents] -> [Children]

  • You can run it from: [Menu] -> [Source list] -> [USB] -> [Content Library] -> [My Contents] -> [Children] as well.
9. Attach to TV firmware upgrade USB (or just add firmware directory to USB you used for copying game to TV.
You have to add firmware after you copy this game to TV!)

10. Run 1.FFB


11. TV stops to respond to RC, it is normal, screen goes dark. Process info is visible on TV screen.
Do not unplug TV until it reboots by itself!

12. After approx 1-2 minutes TV reboots to alternative firmware. If TV doesn`t reboot after 5 minutes, power it off and pray it starts normally.

13. It is recommended to use normal firmware upgrade procedure (from TV menu-help-software upgrade) to delete post-FEB firmware from TV forever.

14. You find log files on USB, do not delete it, especially if something went wrong!

15. Here are other apps like:

Code: Select all

2. TelnetEnabler # starts telnet daemon
3. ActivateAltFirmware # searches for alternative firmware and activates it on menu. Use on step1 firmwares only!
4. SamygoHorse_fake # ignore this. Used to copy games to TV memory and delete all at once if not required
5. EmergencyAAF # Copies firmware ID of active firmware to alternative. Activates alternative menu setting. After that you can switch to previous firmware and repair TV. Attention! Use only if got rebooting TV after FFB. Else- brick if no alternative firmware exists.
It haven`t to use if you successfully used FFB. Only if TV starts rebooting (on CI+ devices), apps 2-5 are to use.

- TV rebots on any error during downgrade procedure ("set -e" mode for script).
- Look at _FFBlog.log, _debug.log and sysinfo.log, ask for help on forum
- If error occurs, TV starts after reboot to currently active (post-FEB) firmware.
- Try to use another USB disk, download firmware from another source...

- TV reboots even if FFB does not find any firmware on USB, or it will not match firmware it supports. Do not scary, nothing happens.
But be careful with choosing firmware. Use only your model firmware, do not place other firmware to upgrade USB, because script writes images directly to NAND.
- Sometimes game does not work. Just unplug firmware upgrade USB, reboot TV and do steeps from 8 to 10.
- Always plug in firmware upgrade USB after TV is booted, do not let it attached during booting procedure. Here were some issues if more USB disks (or virtual disk) is pluged - TV does not find firmware.


Code: Select all

v.0.8.2 (05/06/2013)
- FTP server app included
- CUR_DIR fix (bdan629`s issue)
v.0.8.1 (02/06/2013)
- md5sum fix...
v.0.8 (11/11/2012)
- new SDL graphics (matrix...) for loader
- small script fixes
v.0.7.3 (1/11/2012)
- small fixes.
v.0.7.1 (24/10/2012)
- small loader fixes.
v.0.7 (17/10/2012)
- Removed CI+ support. Only CI devices are supported from now.
- Changed script structure and behaviour to avoid brick because of damaged USB. 
- md5 of u-boot.bin, fnw.bin and Image is checked
- crc sum of exe.img and appdata.img checked

v.0.5.9 (31/12/2011)enabled again. CI+ support removed.

v. (01/10/2011)
- Debug content of USB to log file. 
- Added the re-bricking apps to package (are being copied at once together with FFB to TV`s memory. 
  Only for emergency use:
  TelnetEnabler # starts telnet daemon
  ActivateAltFirmware # searches for alternative firmware and activates it on menu. Use on step1 firmwares only!
  EmergencyAAF # Copies firmware ID of active firmware to alternative. Activates alternative menu setting. 

v.0.6.2 (28/09/2011)
- Bugfix: md5 and right hash file for T-CHLCIPDEUC
- B650/750 CI+ support enabled. Successfully tested.
v.0.6.1 (27/09/2011)
- Support of T-CHLCIPDEUC suspended due brick.
v. (26/09/2011)
- Bugfix: "SamyGODecrypter not found" issue.
v.0.6 (20/09/2011)
- CI+ support added (T-CHUCIPDEUC, T-CHLCIPDEUC)
- Completely remade, code cleaned, optimized
- md5 chksum control of CI+ firmwares and hash files.
v.0.5.9 (25/05/2011)
- Support for korean firmware added (T-CHEAKRC)
- Support for USA Plasma PNxxB650/86* (firmware T-CHEAUSC) added
v.0.5.8 (18/04/2011)
- Loader code optimization.
v.0.5.7 (16/04/2011)
- Updated loader code.
- Small bug fixes.
v.0.5.5 (11/03/2011)
- Removed code for bml3,6,7 flashing.
- Added checking for additional images to avoid miss-flashing of bml2/4/5.
- Small bug fixes.
v.0.5.1 (06/03/2011)
- Added flag files deletion on the fly.
v.0.5   (05/03/2011)
- Text mesages on TV screen. Big thanks Rvs2 for help with SDL!
- Renamed to
- Renamed to
- Small bug fixes.
- Removed exeDSP killing
v.0.4.5 (03/03/2011)
- Code improvement. Safety routine at the beginning.
v.0.4   (08/02/2011)
- Code improvement to avoid bricked TV
v.0.3.2 (07/02/2011)
- Added US models LNxxB7xxx/8xxx support (firmware T-CHE7AUSC)
- Added US model  PNxxB8xx support (firmware T-CHE7AUSC)
v.0.3.1 (25/01/2011)
- Added US models LNxxB65x support. (firmware T-CHEAUSC)
- Added US models LNxxB75x support. (firmware T-CHEAUSC)
v.0.3   (18/01/2011)
- Plasma B650 support added. (firmware T-CHL7DEUC)
- Added safety routines to avoid bricking TV. FFB stops and TV reboots on error.
- Firmware files are being copied to (cleaned before)/mtd_swu/. Flashing from internal memory, not from USB.
- Whole procedure logging.
- Some important system info collection to log file (df -h, mount, cat PartitionSwitch* ...)
- kiling exeDSP to avoid start FFB twice - most of bricked TVs are because of start FFB once more.
v.0.2   (01/12/2010)
- Added T-CHU7DEUC support.(firmware T-CHU7DEUC)
- nice icon from moras86.
- Added direct flashing from unencrypted images - no more problem with XOR.
- Logging to USB (poor).
v.0.1   (18/11/2010)
- First version, supports only T-CHL7DEUC.

- ADD support for currently unsupported models
- ADD different trap on EXIT for script error and script successful exit (open for suggestions!)
- Remove issues found in older versions

- Erdem for SamyGODecrypter (for ci+ firmwares)
- cyberdemon79 for hashes on B+ explanation
- SamygoTrojaHorse author for loader (erdem_ua)
- moras86 for nice icons
- gao_atc for testing and advices
- Rvs2 for help with SDL
- my wife for patience
- Users who bricked TV for headache during unbricking procedure
Please, write short feedback if you use this app. Full TV model and firmware you used. Thank you.

Re: Rollback on old FW...

Posted: Sun Nov 28, 2010 8:04 pm
by juusso
Here is step by step instruction on my post above :) I do not think the manual could be more detailed... You didn`t write your FULL TV model and full firmware version. After you write i can give you link to download earlier firmware.
You can`t install any firmware via normall TV firmware upgrade because it is restricted by samsung. Using this game (if your tv is supported), you can avoid those restrictions. All what you need, is make steps 1-12.

Re: Rollback on old FW...

Posted: Sun Nov 28, 2010 8:29 pm
by juusso
I guess firmware name is T-CHL7DEUC 3001.1. OK, then this game is for you!
You can download T-CHL7DEUC-2005.0 from samsungs download site ;)

It is important for you to know, that in service menu you can walk with RC buttons up and down (in the middle, not channel and volume) and change values you can with right/left. Be very careful in service menu.

As i said - ask before doing what you do not understand.
- May I copy older fw on USB like in case standard upgrade?
Yes, that`s what i`ve ment. Absolutely!

Re: Rollback on old FW...

Posted: Sun Nov 28, 2010 9:56 pm
by juusso
Does it mean, that you are done with success? :)