Update: a working method of rooting ES series

Ideas and dreaming will go this forum

E3V3A
Posts: 247
Joined: Wed Oct 31, 2012 2:31 am
Location: /dev/zero

Re: Update: a working method of rooting ES series

Post by E3V3A »

@ thewalker3: +1 Photos are very useful, for everyone. Please try to provide some high-res closeups of major board components.

Also, do you have time to do anything in those 30s? Try factory reset a few times, but pulling the plug in between. (TV never dies unless you do that.) Sound like watchdog is going crazy, but I'm not sure its a good idea to kill watchdog (from Service menu) in this state. Someone else would have to chime in on this... Or see if you have time to start a firmware update via USB. (Use smallest possible increment.) Also, can you see from debug log (or post one) what is causing the reset?
[perhaps starting a new thread, as this is getting OT?]
HW: UE40ES5700SXXH
FW: T-MST10PDEUC-1029.0 Onboot: 1003

thwalker3
Posts: 18
Joined: Sun Nov 25, 2012 6:39 pm

Re: Update: a working method of rooting ES series

Post by thwalker3 »

Happy to upload a photo but I don't have edit rights on the wiki. Don't really want to upload it here as we are quite off-topic at this point. Maybe I'll start another thread in the HW section with the photos. Need to tend to holiday stuff now though.
As for the 30 seconds or so, nothing works in that time (exeDSP doesn't appear to have loaded yet). And since I cleared the eeprom, I don't have any serial output (even the unreadable garbled stuff I got before).

xorloser
Posts: 43
Joined: Sun Oct 28, 2012 2:49 pm

Re: Update: a working method of rooting ES series

Post by xorloser »

Following up to what thwalker3 noticed about unsanitised Copy;
The code that get called to process the "Copy" is as follows:

Code: Select all

char buff[1024];
memset(buff, 0, 0x400);
PCString::Print(buff, "nice -n 19 cp -rf %s %s", filename1, filename2);
CMyPrint::DebugPrintf("copy: %s\n", buff);
if ( sef::CEmpTaskCameraApp::SystemCall(pThis, buff) )
{
	CMyPrint::DebugPrintf("Copy Result: PLR_FALSE\n");
	result = 0;
}
else
{
	sef::CEmpTaskCameraApp::SystemCall(pThis, "sync");
	sef::CEmpTaskCameraApp::SystemCall(pThis, "sync");
	result = 1;
}
So not only can you see that no sanitising occurs, it also has potential for buffer a overflow by using a filename longer than 1024 characters :)

xorloser
Posts: 43
Joined: Sun Oct 28, 2012 2:49 pm

Re: Update: a working method of rooting ES series

Post by xorloser »

Ok so looking closer is *does* do some checks inside the SystemCall function. It checks that the string doesn't contain one of the 5 characters:

Code: Select all

;
'
&
|
"
So any strings that don't contain them will get past the checks.

JoeyBiggins
Posts: 24
Joined: Tue Jan 22, 2013 10:29 am

Re: Update: a working method of rooting ES series

Post by JoeyBiggins »

I am interested in how your root method works.

I think I understand it, but can I ask about the libm.so. Is that the libm.so from the glibc library with a modified inizialisation method or constructor to run the script on the usb? If so what is the entry point as id like to try it out for myself.

Thans Joey BB

zarigo
SamyGO Project Donor
Posts: 136
Joined: Tue Jan 22, 2013 2:45 am
Location: Spain

Re: Update: a working method of rooting ES series

Post by zarigo »

Thanks a lot. This method works 100% in Samsung 40ES5000W.

Please, is possible quit records drm? any hack yet?

Thanks a lot.

Regards from Spain
Samsung UE49K6400 Waiting for RooT or any tools for K series...
Thanks @sectroyer for your work and help!!

yepp
Posts: 43
Joined: Sat Oct 08, 2011 1:06 pm

Re: Update: a working method of rooting ES series

Post by yepp »

it is possible to execute ftp, telnet on TV startup ? without running hack widget every time.

miazza
SamyGO Project Donor
Posts: 731
Joined: Wed Apr 03, 2013 6:10 pm

Re: Update: a working method of rooting ES series

Post by miazza »

Hello guys,

Sorry if I make a silly question but I'm a beginner.
I've spent few days in reading , I have a 46ES8000 , and I feel the need to have the TV compatible also with SMB.
After having done the rooting, is it possible to configure the TV set so that SMB is visible via LAN or Wi-Fi ?

Thanks for your patience.

miazza
AVOID TO PUBLISH AND DISCLOSE SAMYGO PROJECTS ON OTHER FORUM.

User avatar
juusso
SamyGO Moderator
Posts: 10124
Joined: Sun Mar 07, 2010 6:20 pm

Re: Update: a working method of rooting ES series

Post by juusso »

sambe-server is included, you just need to enable it trough telnet (rename required file).
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

miazza
SamyGO Project Donor
Posts: 731
Joined: Wed Apr 03, 2013 6:10 pm

Re: Update: a working method of rooting ES series

Post by miazza »

Thanks very much juuso.
I will start to read the way to do that and menwhile I will manufacture a serial cable to telnet the TV (or can I telnet it via Wi-Fi ?).
I'm not very skilled with linux command line and, as usual, I'm very carefull and I ready and I need to understand everything before to try :)

A last question if you are so kind:
Does it men that the TV will look also to my SMB server in the standard connection pop up ?

Ciao

miazza

To be continued here :) viewtopic.php?f=53&t=5797
AVOID TO PUBLISH AND DISCLOSE SAMYGO PROJECTS ON OTHER FORUM.

Post Reply

Return to “[E] Brainstorm”