A question on rooting ES

[mamaich]

As I'll buy an ES-based TV only on weekend, I can't check this idea myself.
Idea is simple. We have the following lines in rc.local:

Code: Select all

if [ -f /mtd_rwarea/start.sh ];
then
	/mtd_rwarea/start.sh
else
	cd /mtd_exe/
	./exeDSP
fi

So to run our own code - we should make an /mtd_rwarea/start.sh file with such content:

Code: Select all

#!/bin/sh
/bin/sh /dtv/usb/sda1/SamyGo.sh &
	cd /mtd_exe/
	./exeDSP &
rm /mtd_rwarea/start.sh
sync

(last lines are a safeguard and may be removed).
I use "/bin/sh /dtv/usb/sda1/SamyGo.sh" as USB is mounted as noexec, so we should explicitly execute our script.

To create a /mtd_rwarea/start.sh file - you can make a widget that contains the following line in its .js body:

Code: Select all

WMGlobal.FilePlugin.Copy("/dtv/usb/sda1/start.sh", "/mtd_rwarea/start.sh");

and place start.sh with the above content do USB disk. File copying code is taken from ...\infolink\manager\Main\WMMain.js, so probably should be working.

Idea is simple, so someone should have already tested it. So my question is - what prevents this from working?

[juusso]

To prevent possible brick brick, you should know:
you can`t call exeDSP in background and you have to set environment variables for exeDSP in script you`re trying to call it from. Btw, what firmware name we`re talking about? IIRC ES6720 is mstar based MST10PDEUC... or?

WMGlobal.FilePlugin.Copy was used to root C series, this stopped to work on firmwarea T-VALDEUC 3006 and later and definitely doesn`t work on D series too. I`m not talking about ES series But yes, agree, needed to check, but please, doesn`t touch start.sh file
For rooting goal we have another solution which i think we`ll share.

[mamaich]

I'm considering to get UE32ES6727, as it it the only DVB-T2 32" TV with white color that is available in my city.
It is T-MST10PDEUC, seems that it is mali-based (.version contains ""X10P 0071" KERNEL MODULE VERSION : "0064.0716, DTV, X10P, release, DEU_BRANCH", and according to rc.local if it contains "X10" line, than it loads samsung_mali.ko, but here I may be wrong).

Regarding start.sh - I was using that trick on old Trident TV to trace the exeDSP loading, and there was a way to format /mtd_rwarea via exlink (I've used it several times ). If the same trick with formatting /mtd_rwarea is possible on the newer TV sets - it is absolutely safe to continue playing with this script.
Setting environment variables is not a problem. There may be a problem if exeDSP initialises USB, and /dtv/usb/sdaX is not accessible before its launch - but this can be solved too by adding a delay.

For rooting goal we have another solution which i think we`ll share.

As far as I see - you are making a patched firmware that should be flashed by end-users. My personal opinion is that patching the original firmware should be the last effort, we should try other methods at first. I already have several ideas, lets hope that I'll have time to test them this weekend and that at least one of them would work

[juusso]

If start.sh is busy, you can`t format rwarea. And if you`re in bootloop before exeDSP start, you have no chance to get into debug menu. And if exeDSP isn`t started, no chance for TDM too.

But yes, you`re right about last effort

Edit: looked at rc.local and yes, you`re right, start.sh is called like we used to see on mstar devices, at the end of file.

Code: Select all

#!/mtd_exe/rc.local

echo "/mtd_exe/rc.local start !!!!!"

# insmod chip driver
cat /.version | grep -i X10
if [ $? -eq 0 ]; then
#insmod /mtd_exe/ump.ko
#insmod /mtd_exe/mali.ko
#samsung_mali.ko = mali.ko + ump.ko + mali_drm.ko
insmod /mtd_exe/samsung_mali.ko
fi
insmod /mtd_exe/samsung_mstar.ko

#/mtd_exe/starts.sh

# FastLogo
/mtd_exe/Fastlogo.sh


export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_DUMMY_WIDGET_PATH=/mtd_appdata/SmartTV
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib:/mtd_cmmlib/OIPF
export LD_LIBRARY_PATH=/mtd_cmmlib/InfoLink/lib/plugin/Static:/mtd_cmmlib/InfoLink/lib:/mtd_cmmlib/OIPF:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_exe:/mtd_cmmlib/Comp_LIB:/mtd_cmmlib/Comp_LIB/XT9_LIB:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_appdata/Java/lib:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_cmmlib/YWidget_LIB:/mtd_contents:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_cmmlib/GAME_LIB:/dtv:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_cmmlib/CBRE:/dtv:$LD_LIBRARY_PATH

#WebServerApp
export LD_LIBRARY_PATH=/mtd_exe/WebServerApp/bin:$LD_LIBRARY_PATH

# WebKit Widget Engine
export WE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export WE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export WE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export WE_DUMMY_WIDGET_PATH=/mtd_appdata/SmartTV
export WE_WIDGET_DATA_PATH=/mtd_down
export WE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export WE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib
export WE_PLUGIN_PATH=/mtd_appext/WidgetEngine/Plugins:/mtd_rocommon/Webkit/Plugins/Common
export WE_FONTCONFIG_FILE=/mtd_rocommon/Webkit/fonts/fonts.conf

#====================================
# For ContentsManager
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/CM_LIB
#====================================

# For HBBTV
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_appext/OIPF/lib:/mtd_exe/OIPF/lib

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB:/mtd_contents:/mtd_appdata/yahoo:/mtd_cmmlib/moip:/mtd_appext/WidgetEngine:/mtd_rocommon/Webkit

export HOME=/mtd_moip
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null #Remove engine logging.
export KF_NO_LOG=1

#====================================
# For XServer
export  XVT_DEFAULT="/dev/tty0"
export  XVT_RUNTIME="/dev/tty%d"

mknod /dev/tty0 c 4 0
mknod /dev/tty1 c 4 1
mknod /dev/tty2 c 4 2
mknod /dev/tty3 c 4 3
export DISPLAY=:0


export PANGO_RC_FILE=/mtd_cmmlib/Runtime/pango/pangorc
export GTK_PATH=/mtd_cmmlib/Runtime/lib/gtk-2.0
export PATH=/mtd_cmmlib/Runtime/bin:$PATH

export LD_LIBRARY_PATH=/mtd_cmmlib/Runtime/XorgLibs:/mtd_cmmlib/Runtime/lib/CairoShadow:/mtd_cmmlib/Runtime/lib:$LD_LIBRARY_PATH
export FONTCONFIG_PATH=/mtd_cmmlib/Runtime/fonts
export FONTCONFIG_FILE=/mtd_rocommon/WebBrowser/fonts/fonts.conf
export PATH=$PATH:/mtd_cmmlib/Runtime/bin
export COMPILED_KEYMAP_PATH="/mtd_cmmlib/Runtime"
export XSERVER_RW_PATH=/mtd_rwarea
#====================================

# GINGA-NCL 
export GDK_PIXBUF_MODULE_FILE=/mtd_exe/Runtime/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache

ulimit -c unlimited

#====================================
# Start Streamline
# End Streamline
#====================================

if [ -f /mtd_rwarea/start.sh ];
then
	/mtd_rwarea/start.sh
else
	cd /mtd_exe/
	./exeDSP
fi

[mamaich]

Finally I've bought a TV, UE32ES6727. Connected it to WiFi and found that it loads a file: http://vd.emp.prd.s3.amazonaws.com/emp/ ... _0.970.xml
EMP == External Module Process. This XML contains info on lots of binary modules - browser, skype, etc. And several of them are not signed:

Code: Select all

X10P_0.970_empAppAnalyzer_VER_1.19.zip
X10P_0.970_empBrowserCommonPlugin_VER_1.79.zip
X10P_0.970_empWebBrowser_VER_2.23.zip
X10P_0.970_empWebBrowserDRI_VER_2.23.zip
X10P_0.970_empWLibPlugin_VER_0.001.zip

So, we can theoretically replace one of these unsigned modules with our own code and force a TV to load our ZIP file, for example via the DNS trick.
I'll try to replace a trash like libFamilyStory.so. If my idea is correct - then this DLL (and our code) would be launched by pressing the "Family Story" button on remote - rather convenient way. And if that "Family Story" would be broken - my wife would not kill me, as she also does not use this trash

Have anyone played with this already? It would take some time for me to install ubuntu and set up a build environment before making a test.

[mamaich]

Had some time to play. Bad thing is that ext2/3/4 filesystem is no longer supported. And symlinks on USB are blocked - I've tried to create a link to "/" on XFS-formatted USB and was unable to read from it.
But good info is that "FilePlugin.Copy" is still working. At least the following code:

Code: Select all

in html:
		<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM'></OBJECT>	
in js:
		var FilePlugin = document.getElementById("pluginObjectFile");
		eval("FilePlugin.Copy(\"/proc/self/mounts\", \"/dtv/usb/sda1/mounts\")");

I use "eval" to hide usage of "undocumented functions", otherwise app does not load. Here are the contents of several files from "/proc" from my TV:

SpoilerShow

rootfs / rootfs rw 0 0
/dev/root / squashfs ro,relatime 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev/shm tmpfs rw,relatime 0 0
tmpfs /dtv tmpfs rw,relatime,size=40960k 0 0
tmpfs /tmp tmpfs rw,relatime,size=36864k 0 0
tmpfs /dsm tmpfs rw,relatime,size=12288k 0 0
tmpfs /core tmpfs rw,relatime,size=30720k 0 0
/dev/mmcblk0p14 /mtd_exe squashfs ro,relatime 0 0
none /sys/fs/cgroup cgroup rw,relatime,cpu 0 0
/dev/mmcblk0p12 /mtd_rwarea rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p10 /mtd_drmregion_a rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p11 /mtd_drmregion_b rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p16 /mtd_appext squashfs ro,relatime 0 0
/dev/mmcblk0p17 /mtd_rocommon squashfs ro,relatime 0 0
/dev/mmcblk0p19 /mtd_contents rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p21 /mtd_rwcommon rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p18 /mtd_emanual rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
/dev/mmcblk0p20 /mtd_swu rfs rw,relatime,vfat,llw,iocharset=utf8 0 0
none /proc/bus/usb usbfs rw,relatime 0 0
/dev/sda1 /dtv/usb/sda1 xfs rw,noexec,relatime,nouuid,attr2,noquota 0 0

SpoilerShow

console=ttyS2,115200 root=/dev/mmcblk0p6 rootfstype=squashfs LX_MEM=0x40200000,0x14900000 LX_MEM2=0xA4E00000,0xB200000 EMAC_MEM=0x40000000,0x100000 SELP_ENABLE=1198282 Onboot : 1003 quiet

SpoilerShow

Processor : ARMv7 Processor rev 0 (v7l)
processor : 0
BogoMIPS : 1794.04

processor : 1
BogoMIPS : 1794.04

Features : swp half thumb fastmult vfp edsp neon vfpv3
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : amber3
Revision : 0000
Serial : 0000000000000000

SpoilerShow

nodev sysfs
nodev rootfs
nodev bdev
nodev proc
nodev cgroup
nodev tmpfs
nodev sockfs
nodev pipefs
nodev anon_inodefs
squashfs
nodev ramfs
vfat
xfs
nodev mqueue
rfs
tntfs
nodev usbfs

SpoilerShow

bthid 2520 0 - Live 0xbf323000
hid_microsoft 2032 0 - Live 0xbf31d000
mousedev 7248 0 - Live 0xbf316000
evdev 5576 0 - Live 0xbf30f000
usbhid 12872 0 - Live 0xbf306000
hid 31240 3 bthid,hid_microsoft,usbhid, Live 0xbf2f9000
rtnet5572sta 31400 2 - Live 0xbf2ec000
rt5572sta 1295528 1 rtnet5572sta, Live 0xbf1ad000 (P)
rtutil5572sta 30436 2 rtnet5572sta,rt5572sta, Live 0xbf1a3000
btusb 31128 1 - Live 0xbf196000
usb_storage 30272 1 - Live 0xbf189000
ehci_hcd 47852 0 - Live 0xbf178000
usbcore 108904 8 usbhid,rtnet5572sta,rtutil5572sta,btusb,usb_storage,ehci_hcd, Live 0xbf158000
tntfs 363728 0 - Live 0xbf0fa000 (P)
mdrv_emac 12684 0 - Live 0xbf0f1000 (P)
samsung_mstar 494248 0 - Live 0xbf066000
samsung_mali 83468 18 samsung_mstar, Live 0xbf04c000
rfs_fat 202648 7 - Live 0xbf015000 (P)
rfs_glue 61548 1 rfs_fat, Live 0xbf000000 (P)

SpoilerShow

major minor #blocks name

254 0 102400 ramzswap0
254 1 102400 ramzswap1
254 2 102400 ramzswap2
254 3 102400 ramzswap3
179 0 1953792 mmcblk0
179 1 512 mmcblk0p1
179 2 6144 mmcblk0p2
179 3 4608 mmcblk0p3
179 4 1 mmcblk0p4
179 5 6144 mmcblk0p5
179 6 4608 mmcblk0p6
179 7 8 mmcblk0p7
179 8 8 mmcblk0p8
179 9 8 mmcblk0p9
179 10 3072 mmcblk0p10
179 11 3072 mmcblk0p11
179 12 71680 mmcblk0p12
179 13 122880 mmcblk0p13
179 14 122880 mmcblk0p14
179 15 81920 mmcblk0p15
179 16 81920 mmcblk0p16
179 17 256000 mmcblk0p17
179 18 102400 mmcblk0p18
179 19 51200 mmcblk0p19
179 20 10240 mmcblk0p20
179 21 1024344 mmcblk0p21
8 0 3888128 sda
8 1 3885416 sda1

SpoilerShow

Linux version 2.6.35.13 (sanghomin@localhost.localdomain) (gcc version 4.4.1 (VDLinux GA-release2 OpenMP 2011-06-30) ) #1 SMP PREEMPT Wed Aug 29 16:04:55 KST 2012

I have not tested copying from usb to "/mtd_rwarea/start.sh". I'm not so brave to do that now, after reading juuso posts
Later I'll try the method with EMP, but not today (have no more time).

[E3V3A]

...Connected it to WiFi and found that it loads a file: http://vd.emp.prd.s3.amazonaws.com/emp/ ... _0.970.xml
EMP == External Module Process. This XML contains info on lots of binary modules - browser, skype, etc. And several of them are not signed...

So, we can theoretically replace one of these unsigned modules with our own code and force a TV to load our ZIP file, for example via the DNS trick.
I'll try to replace a trash like libFamilyStory.so. If my idea is correct - then this DLL (and our code) would be launched by pressing the "Family Story" button on remote - rather convenient way. ...

1. I don't think we need to use the DNS trick, if the EMPs are not signed. (?)
2. I'd like to replace Family story botton to run the rooting "Test" widget. Any ideas how to do this?
3. Here's the latest list of EMP's (edited for readability):

SpoilerShow

Code: Select all

<?xml version="1.0" encoding="UTF-8"?>
<emplist>
<file id="empAppAnalyzer"           version="1.19"  name="X10P_0.970_empAppAnalyzer_VER_1.19.zip"           url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empAppAnalyzer_VER_1.19.zip"        size="969174" />
<file id="empAuthSMG"               version="0.200" name="X10P_0.970_empAuthSMG_VER_0.200.zip"              url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empAuthSMG_VER_0.200.zip"           size="730741" />
<file id="empBrowserCommonPlugin"   version="1.81"  name="X10P_0.970_empBrowserCommonPlugin_VER_1.81.zip"   url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empBrowserCommonPlugin_VER_1.81.zip" size="3648573" />
<file id="empCamera"                version="1.120513" name="X10P_0.970_empCamera_VER_1.120513.zip"         url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empCamera_VER_1.120513.zip"         size="1399075" />
<file id="empDownload"              version="2.510" name="X10P_0.970_empDownload_VER_2.510.zip"             url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empDownload_VER_2.510.zip"          size="591915" />
<file id="empNaver"                 version="1.007" name="X10P_0.970_empNaver_VER_1.007.zip"                url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empNaver_VER_1.007.zip"             size="39075" />
<file id="empNService"              version="0.53"  name="X10P_0.970_empNService_VER_0.53.zip"              url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empNService_VER_0.53.zip"           size="1607" />
<file id="empPsaApp"                version="1.006" name="X10P_0.970_empPsaApp_VER_1.006.zip"               url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empPsaApp_VER_1.006.zip"            size="16558" />
<file id="empQs"                    version="1.007" name="X10P_0.970_empQs_VER_1.007.zip"                   url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empQs_VER_1.007.zip"                size="1554293" />
<file id="empSignature"             version="1.000" name="X10P_0.970_empSignature_VER_1.000.zip"            url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empSignature_VER_1.000.zip"         size="312193" />
<file id="empSkype"                 version="1.120601" name="X10P_0.970_empSkype_VER_1.120601.zip"          url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empSkype_VER_1.120601.zip"          size="2777914" />
<file id="empSpotify"               version="0.215" name="X10P_0.970_empSpotify_VER_0.215.zip"              url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empSpotify_VER_0.215.zip"           size="4071762" />
<file id="empT9"                    version="2.302" name="X10P_0.970_empT9_VER_2.302.zip"                   url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empT9_VER_2.302.zip"                size="2879078" />
<file id="empTalk"                  version="2.420" name="X10P_0.970_empTalk_VER_2.420.zip"                 url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empTalk_VER_2.420.zip"              size="668454" />
<file id="empWebBrowser"            version="2.25"  name="X10P_0.970_empWebBrowser_VER_2.25.zip"            url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empWebBrowser_VER_2.25.zip"         size="6235297" />
<file id="empWebBrowserDRI"         version="2.25"  name="X10P_0.970_empWebBrowserDRI_VER_2.25.zip"         url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empWebBrowserDRI_VER_2.25.zip"      size="6406151" />
<file id="empWLibPlugin"            version="0.001" name="X10P_0.970_empWLibPlugin_VER_0.001.zip"           url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empWLibPlugin_VER_0.001.zip"        size="390804" />
<file id="empXT9"                   version="2.700" name="X10P_0.970_empXT9_VER_2.700.zip"                  url="http://oempprd.samsungcloudsolution.net/emp/emp/X10P_0.970_empXT9_VER_2.700.zip"               size="8137804" />
</emplist>

And for your convenience you can download them all from here: EMPs.zip (~38 MB)

Btw. What do the (non obvious) ones do?

Code: Select all

"empAppAnalyzer"        Flash/JS
"empAuthSMG"            Crypto stuff
"empBrowserCommonPlugin"   libflash.so browser plugin
"empCamera"             
"empDownload"           
"empNaver"              
"empNService"           
"empPsaApp"             
"empQs"                 
"empSignature"          
"empSkype"              
"empSpotify"            
"empT9"                 
"empTalk"               
"empWebBrowser"         
"empWebBrowserDRI"      
"empWLibPlugin"         
"empXT9"                

[E3V3A]

How can I tell if they are signed?
Can I use these to update browser?

[arris69]

How can I tell if they are signed?
Can I use these to update browser?

there is an .xml file in the archive where signed or unsigned is defined.
in theory you can update the browser, also the flashplayer plugin is installed over emp.

[dajojo]

Code: Selecteer alles"empAppAnalyzer" Flash/JS
"empAuthSMG" Crypto stuff
"empBrowserCommonPlugin" libflash.so browser plugin
"empCamera" Camera App
"empDownload" Downloader
"empNaver" directional pad
"empNService" Menu Navigation service
"empPsaApp" ?
"empQs" Quicksupport
"empSignature" Digital signing ( CA ? )
"empSkype" Skype
"empSpotify" Spotify
"empT9" T9 textinput
"empTalk" Google Talk
"empWebBrowser" Buildin browser
"empWebBrowserDRI" buildin browser Digital rights managment stuff
"empWLibPlugin" live TV
"empXT9" extended T9 text input