SamyGO

Samsung TV Firmware on the GO
http://forum.samygo.tv/

rooted F6400. Some interesting info from inside...

http://forum.samygo.tv/viewtopic.php?t=5992

Page 1 of 2

rooted F6400. Some interesting info from inside...

Posted: Wed May 29, 2013 10:39 am
by juusso
F6400 - rooted

Code: Select all

/proc/version
Linux version 3.0.33 (jison@sp2) (gcc version 4.6.4 (VDLinux.GA1.2012-10-03) ) #1 SMP PREEMPT Fri Feb 22 16:35:00 KST 2013

Code: Select all

/proc/cpuinfo
Processor	: ARMv7 Processor rev 0 (v7l)
processor	: 0
BogoMIPS	: 1974.27

processor	: 1
BogoMIPS	: 1974.27

Features	: swp half fastmult vfp edsp neon vfpv3 tls 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x3
CPU part	: 0xc09
CPU revision	: 0

Hardware	: edison
Revision	: 0000
Serial		: 0000000000000000

Code: Select all

/proc/cmdline
console=ttyS2,115200 root=/dev/mmcblk0p8 rootfstype=squashfs LX_MEM=0x40200000,0xC600000 LX_MEM2=0xA5E00000,0x1A200000 EMAC_MEM=0x40000000,0x100000 Onboot  : 0059.B SELP_ENABLE=20139120 quiet 
/proc/bus/usb/devices

Code: Select all

/proc/modules
usb_storage 32412 1 - Live 0xbf3c5000
exfat_fs 15584 0 - Live 0xbf3be000 (P)
exfat_core 46096 1 exfat_fs, Live 0xbf3af000 (P)
tntfs 419736 0 - Live 0xbf345000 (P)
ath6kl_usb 314756 0 - Live 0xbf2f7000
cfg80211 154568 1 ath6kl_usb, Live 0xbf2ce000
compat 320 0 - Live 0xbf2ca000
bthid 2792 0 - Live 0xbf2c6000
hid_chicony 1052 0 - Live 0xbf2c2000
hid_apple 4016 0 - Live 0xbf2be000
hid_microsoft 1864 0 - Live 0xbf2ba000
mousedev 7708 0 - Live 0xbf2b5000
evdev 6688 0 - Live 0xbf2b0000
usbhid 13152 0 - Live 0xbf2a9000
hid 40668 5 bthid,hid_chicony,hid_apple,hid_microsoft,usbhid, Live 0xbf29c000
mdrv_emac 17380 0 - Live 0xbf286000
snd_pcm 47612 0 - Live 0xbf277000
snd_page_alloc 2600 1 snd_pcm, Live 0xbf273000
snd_hwdep 3700 0 - Live 0xbf26f000
snd_rawmidi 12836 0 - Live 0xbf268000
snd_seq_device 3612 1 snd_rawmidi, Live 0xbf264000
snd_timer 13652 1 snd_pcm, Live 0xbf25d000
snd 28168 5 snd_pcm,snd_hwdep,snd_rawmidi,snd_seq_device,snd_timer, Live 0xbf253000
soundcore 444 1 snd, Live 0xbf24f000
v4l2_common 4340 0 - Live 0xbf24c000
videodev 64676 1 v4l2_common, Live 0xbf239000
v4l2_int_device 1436 0 - Live 0xbf237000
samsung_mstar 1700660 0 - Live 0xbf06a000
btusb 33136 1 - Live 0xbf05e000
samsung_mali 91356 28 - Live 0xbf044000
tzdrv 28616 56 - Live 0xbf03c000
ehci_hcd 43484 0 - Live 0xbf02e000
usbcore 100516 7 usb_storage,ath6kl_usb,usbhid,btusb,ehci_hcd, Live 0xbf012000
PreInit 60908 0 - Live 0xbf000000

Code: Select all

df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                 3456      3456         0 100% /
tmpfs                   310072        20    310052   0% /dev/shm
tmpfs                    40960        32     40928   0% /dtv
tmpfs                    36864      1844     35020   5% /tmp
tmpfs                     2048         0      2048   0% /freesia
tmpfs                    30720         0     30720   0% /core
/dev/mmcblk0p19         291840    291840         0 100% /mtd_uncompexe
/dev/mmcblk0p17         207488    207488         0 100% /mtd_exe
/dev/mmcblk0p16         153600     16732    136868  11% /mtd_rwarea
/dev/mmcblk0p14           3072       776      2296  25% /mtd_drmregion_a
/dev/mmcblk0p15           3072       776      2296  25% /mtd_drmregion_b
/dev/mmcblk0p21         284672    284672         0 100% /mtd_rocommon
/dev/mmcblk0p24         153600      6424    147176   4% /mtd_contents
/dev/mmcblk0p26        1611776    350160   1261616  22% /mtd_rwcommon
/dev/mmcblk0p23         102400     81788     20612  80% /mtd_emanual
/dev/mmcblk0p25          10240       596      9644   6% /mtd_swu
/dev/loop0               39936     39936         0 100% /mtd_rwcommon/widgets/manager/10130000000
/dev/sda1              1970372   1601080    369292  81% /dtv/usb/sda1
/dtv/loop4                5376      5376         0 100% /mtd_rwcommon/widgets/normal/111199001564

Code: Select all

/proc/mounts
rootfs / rootfs rw 0 0
/dev/root / squashfs ro,relatime 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev/shm tmpfs rw,relatime 0 0
tmpfs /dtv tmpfs rw,relatime,size=40960k 0 0
tmpfs /tmp tmpfs rw,relatime,size=36864k 0 0
tmpfs /freesia tmpfs rw,relatime,size=2048k 0 0
tmpfs /core tmpfs rw,relatime,size=30720k 0 0
none /sys/kernel/security securityfs rw,relatime 0 0
/dev/mmcblk0p19 /mtd_uncompexe emmcfs ro,relatime 0 0
none /sys/fs/cgroup cgroup rw,relatime,cpu 0 0
/dev/mmcblk0p17 /mtd_exe squashfs ro,relatime 0 0
/dev/mmcblk0p16 /mtd_rwarea emmcfs rw,relatime 0 0
/dev/mmcblk0p14 /mtd_drmregion_a emmcfs rw,relatime 0 0
/dev/mmcblk0p15 /mtd_drmregion_b emmcfs rw,relatime 0 0
/dev/mmcblk0p21 /mtd_rocommon squashfs ro,noexec,relatime 0 0
/dev/mmcblk0p24 /mtd_contents emmcfs rw,relatime 0 0
none /proc/bus/usb usbfs rw,relatime 0 0
/dev/mmcblk0p26 /mtd_rwcommon emmcfs rw,relatime 0 0
/dev/mmcblk0p23 /mtd_emanual emmcfs rw,relatime 0 0
/dev/mmcblk0p25 /mtd_swu emmcfs rw,relatime 0 0
/dev/loop0 /mtd_rwcommon/widgets/manager/10130000000 squashfs ro,noexec,relatime 0 0
/dev/sda1 /dtv/usb/sda1 vfat rw,dirsync,noexec,noatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=utf8,shortname=mixed,usefree,flush,errors=continue 0 0
/dtv/loop4 /mtd_rwcommon/widgets/normal/111199001564 squashfs ro,noexec,relatime 0 0

Code: Select all

ps
PID   USER     TIME   COMMAND
    1 root       0:00 init
    2 root       0:00 [kthreadd]
    3 root       0:00 [ksoftirqd/0]
    6 root       0:00 [migration/0]
    7 root       0:00 [migration/1]
    8 root       0:00 [kworker/1:0]
    9 root       0:00 [ksoftirqd/1]
   10 root       0:00 [khelper]
   11 root       0:00 [sync_supers]
   12 root       0:00 [bdi-default]
   13 root       0:00 [kblockd]
   14 root       0:00 [kworker/u:1]
   15 root       0:00 [kdtvlogd]
   16 root       0:00 [kswapd0]
   17 root       0:00 [fsnotify_mark]
   18 root       0:00 [vdbinder]
   19 root       0:00 [kworker/0:1]
   20 root       0:06 [mmcqd/0]
   21 root       0:00 [mmcqd/0boot0]
   22 root       0:00 [mmcqd/0boot1]
   34 root       0:00 -/bin/sh
   60 root       0:00 [kworker/1:2]
   66 root       0:00 [khubd]
   72 root       0:00 {exe} ash /mtd_exe/rc.local
   73 root       0:00 ./servicemanager_csp -vdbinder
   85 root       0:00 [mali-pmm-wq]
   87 root       1:00 ./exeAPP -vdbinder
   88 root       0:34 ./exeTV -vdbinder
  306 root       0:01 /mtd_appdata/Runtime/bin/X -logfile /mtd_rwarea/Xlog.txt -modulepath /mtd_appdata/Runtime/XorgLibs -config /mtd_appdata/Runtime/bin/xorg.conf
  310 root       0:02 Compositor -vdbinder
  407 root       0:00 /mtd_cmmlib/BT_LIB/bsa_server -all=0 -diag=0 -hci=0 -l2c=0 -app=0 -btm=0 -sdp=0 -rfc=0 -gap=0 -a2d=0 -avdt=0 -avrc=0 -mca=0 -d /dev/btusb0 -u /dtv/
  441 root       0:00 [cfg80211]
  444 root       0:00 [ath6kl]
  453 root       0:00 [flush-179:0]
  456 root       0:00 [loop0]
  472 root       0:03 /mtd_appext/WidgetEngine/WidgetEngine
  511 root       0:00 /mtd_cmmlib/WIFI_LIB/QCA/wpa_supplicant -Dnl80211 -ip2p0 -c/mtd_rwarea/network/p2p_dual.conf -N -Dnl80211 -iwlan0 -c/mtd_rwarea/network/wpa_sta.conf -e /mtd_rwarea/network/entropy.dat -t -B -O /tmp/wpa_supplicant
  526 root       0:00 udhcpc -i eth0 -T 2 -b
  567 root       0:15 /mtd_down/widgets/normal/20131000001/bin/BrowserLauncher
  671 root       0:00 [scsi_eh_0]
  672 root       0:00 [usb-storage]
  690 root       0:00 [scsi-poller]
  756 root       0:02 /mtd_down/emps/empWebBrowser/bin/WebKitWebProcess 13
  767 root       0:09 /mtd_exe/Webkit/WebKitWebProcess 14 WidgetEngine
  803 root       0:00 [flush-8:0]
  808 root       0:00 /tmp/bin/busybox tcpsvd -vE 0.0.0.0 21 /tmp/bin/busybox ftpd -w /
  809 root       0:00 /tmp/bin/remshd
  976 root       0:00 /mtd_exe/WebServerApp/bin/lighttpd -D -f /mtd_exe/WebServerApp/webserver/lighttpd.conf -s
 1084 root       0:00 [loop4]
 1121 root       0:00 /mtd_exe/Comp_LIB/UEP.b
 1125 root       0:00 /tmp/bin/remshd
 1159 root       0:00 [kworker/u:0]
 1186 root       0:00 [kworker/0:2]
 1201 root       0:00 sh -x /mtd_rwcommon/info.sh
 1203 root       0:00 /tmp/bin/busybox ftpd -w /
 1204 root       0:00 [busybox]
 1205 root       0:00 [busybox]
 1206 root       0:00 [busybox]
 1207 root       0:00 [busybox]
 1225 root       0:00 ps eux

Code: Select all

cat /mtd_exe/partition.txt
partitionID	flash_device_name	flash_device_size	flash_image_name	flash_device_type	flash_upgrade_type	flash_partition_map	flash_mount_path	default_block_size	flash_format_option	flash_mount_option
0	/dev/mmcblk0p0	524288	onboot.bin	MLC	OTHER	BOOTLOADER0	NONE	1048576	NONE	NONE
1	/dev/mmcblk0p1	524288	u-boot.bin	MLC	NONE	BOOTLOADER1	NONE	1048576	NONE	NONE
2	/dev/mmcblk0p2	524288	secos.bin	MLC	USER	SECOS0	NONE	1048576	NONE	NONE
3	/dev/mmcblk0p3	524288	secos.bin	MLC	USER	SECOS1	NONE	1048576	NONE	NONE
4	/dev/mmcblk0p4	0	ex_partition	MLC	NONE	NONE	NONE	1048576	NONE	NONE
5	/dev/mmcblk0p5	524288	seret.bin	MLC	USER	SERET0	NONE	1048576	NONE	NONE
6	/dev/mmcblk0p6	524288	seret.bin	MLC	USER	SERET1	NONE	1048576	NONE	NONE
7	/dev/mmcblk0p7	7340032	uImage	MLC	USER	KERNEL0	NONE	1048576	NONE	NONE
8	/dev/mmcblk0p8	5767168	rootfs.img	MLC	USER	RFS0	NONE	1048576	NONE	NONE
9	/dev/mmcblk0p9	7340032	uImage	MLC	USER	KERNEL1	NONE	1048576	NONE	NONE
10	/dev/mmcblk0p10	5767168	rootfs.img	MLC	USER	RFS1	NONE	1048576	NONE	NONE
11	/dev/mmcblk0p11	8192	sign0.bin	MLC	NONE	SECUREMAC0	NONE	1048576	NONE	NONE
12	/dev/mmcblk0p12	8192	sign1.bin	MLC	NONE	SECUREMAC1	NONE	1048576	NONE	NONE
13	/dev/mmcblk0p13	8192	VD-HEADER	MLC	NONE	NONE	NONE	1048576	NONE	NONE
14	/dev/mmcblk0p14	3145728	NONE	MLC	NONE	NONE	mtd_drmregion_a	1048576	NONE	NONE
15	/dev/mmcblk0p15	3145728	NONE	MLC	NONE	NONE	mtd_drmregion_b	1048576	NONE	NONE
16	/dev/mmcblk0p16	157286400	NONE	MLC	NONE	NONE	mtd_rwarea	1048576	NONE	NONE
17	/dev/mmcblk0p17	235929600	exe.img	MLC	USER	EXE0	mtd_exe	1048576	NONE	NONE
18	/dev/mmcblk0p18	235929600	exe.img	MLC	USER	EXE1	mtd_exe	1048576	NONE	NONE
19	/dev/mmcblk0p19	298844160	uncompexe.img	MLC	USER	UNCOMPEXE0	mtd_uncompexe	1048576	NONE	NONE
20	/dev/mmcblk0p20	298844160	uncompexe.img	MLC	USER	UNCOMPEXE1	mtd_uncompexe	1048576	NONE	NONE
21	/dev/mmcblk0p21	361758720	rocommon.img	MLC	USER	CONTENT0	mtd_rocommon	1048576	NONE	NONE
22	/dev/mmcblk0p22	361758720	rocommon.img	MLC	USER	CONTENT1	mtd_rocommon	1048576	NONE	NONE
23	/dev/mmcblk0p23	104857600	emanual.img	MLC	OTHER	NONE	mtd_emanual	1048576	NONE	NONE
24	/dev/mmcblk0p24	157286400	NONE	MLC	NONE	NONE	mtd_contents	1048576	NONE	NONE
25	/dev/mmcblk0p25	10485760	NONE	MLC	NONE	NONE	mtd_swu	1048576	NONE	NONE
26	/dev/mmcblk0p26	1650761728	rwcommon.img	MLC	OTHER	NONE	mtd_rwcommon	1048576	NONE	NONE
Code for Exlink unlock console: 20139120
someone should try enter TDM with 20089999

:)

Re: rooted F6400. Some interesting info from inside...

Posted: Wed May 29, 2013 2:07 pm
by greenhorn
great!

Re: AW: rooted F6400. Some interesting info from inside...

Posted: Wed May 29, 2013 11:39 pm
by fluffi444
Good news for all F owners

Re: rooted F6400. Some interesting info from inside...

Posted: Thu May 30, 2013 11:57 am
by sfranzis
juuso wrote:F6400 - rooted

Code: Select all

/proc/version
Linux version 3.0.33 (jison@sp2) (gcc version 4.6.4 (VDLinux.GA1.2012-10-03) ) #1 SMP PREEMPT Fri Feb 22 16:35:00 KST 2013
.....
Code for Exlink unlock console: 20139120
someone should try enter TDM with 20089999

:)
How did you manage to get root access?

[edit] I got it. Search: exlink
:)
[/edit]
SF

Re: rooted F6400. Some interesting info from inside...

Posted: Thu Jun 06, 2013 8:01 pm
by juusso
If anyone interested, here are dumps of this TV. but be prepared, most of partitons are in emmcfs filesystem format, not so easy to gather files from there...

Download as torrent (magnet link):

Code: Select all

magnet:?xt=urn:btih:EBBC0BDBC3EC7FC10A6EFD80C716BBB8BD2C8D18&dn=F6400_dumps.tar.gz&tr=udp%3a%2f%2ftracker.openbittorrent.com%3a80%2fannounce&tr=udp%3a%2f%2ftracker.publicbt.com%3a80%2fannounce
exeAPP is main TV binary, aka exeDSP on previuos models.

Re: rooted F6400. Some interesting info from inside...

Posted: Thu Jun 27, 2013 4:05 pm
by ddub
HELLO thks for this great hack !!!
Can you tell us the content of :
/mtd_exe
it might have somes directories and especialy SmartTV
can you tell us the content of this directory:
normaly it containts the internal app of the smart TV : 29_fullbrowser is one of them
thks in advance.

Re: rooted F6400. Some interesting info from inside...

Posted: Thu Jun 27, 2013 9:57 pm
by bugficks
ls -laR of /mtd_exe (mmcblk0p17.dmp)
http://pastebin.com/c1GDYqNa

Re: rooted F6400. Some interesting info from inside...

Posted: Thu Jul 04, 2013 8:53 pm
by bugficks
juuso wrote:F6400 - rooted
Code for Exlink unlock console: 20139120
someone should try enter TDM with 20089999
Hi,
I've recently bought a F8000. Now that I finally got my DKU-5 USB cable I've made an Ex-Link cable. Went to service menu and set RS232 to debug.
Started PuTTY and getting tons of logs.

Code: Select all

boot-up
1 T 1.5 S 0081 (Feb 27 2013-13:09:02)
KernelAck
[VDLP] preset_lpj manual set to 5382144
[VDLP] preset_lpj manual set to 5382144
[VDLP] preset_lpj manual set to 5382144
[VDLP] preset_lpj manual set to 5382144
tps54921: i2s write error -5
[gzm_module_init]
[gzM_init]
Starting [Gunzip Manager]-v2.0.0
[gzip_init]
[gzlib_init]
[gzM_thread]
================================================================================
 SAMSUNG VDLP Kernel
 Version : 0141, release
 Applied Last Patch Number : 1121, DTV, Fox.P, release, DVB_BRANCH
============================================================================[gzM_register_client] Request for Squashfs
[gzM_register_client] Squashfs is registering @ 1
[gzM_register_cp] type GZM_CGZIP
starting pid 38, tty '': '/etc/rc.local'
/etc/rc.local start
=====================================================================
  ROOTFS VERSION : "Fox.P 0153" KERNEL MODULE VERSION : "0141.1121, DTV, Fox.P, release, DVB_BRANCH"

+ thousends more lines
So far so good:)
I've waited until log output has stopped and then I've tried your codes 20139120 and 20089999 nothing happens though:(

How did you get those codes? And how can I root my TV?:)

Thanks

Re: rooted F6400. Some interesting info from inside...

Posted: Fri Jul 05, 2013 8:24 am
by juusso
Interesting. I know, TDM main menu is empty, that`s why you don`t see anything there.
you have to wait a little until we publish rooting method for F series. Currently it is is in early alpha stage.

Code for console unlocking is in kernel`s cmdline (SELP_ENABLE=...)

Code: Select all

cat /proc/cmdline
console=ttyS2,115200 root=/dev/mmcblk0p8 rootfstype=squashfs LX_MEM=0x40200000,0xC600000 LX_MEM2=0xA5E00000,0x1A200000 EMAC_MEM=0x40000000,0x100000 Onboot  : 0059.B SELP_ENABLE=20139120 quiet
and TDM code exists inside exeAPP, xored. 20089999.

Re: rooted F6400. Some interesting info from inside...

Posted: Fri Jul 05, 2013 8:59 am
by bugficks
thanks for the infos. though w/o a shell i cant do jack:)
i was already thinking of setting a up my own dns and redirect it to a temp http server. check: 'http://oempprd.samsungcloudsolution.net/'
it's full of emp updates, web browser doesn't even seem to have sig checks.
also i was trying to add some trusted path to flash settings (http://www.macromedia.com/support/docum ... ger04.html), unfortunately input box doesnt accept any keyboard input.

guess i'll just wait:)
All times are UTC+01:00
Page 1 of 2

Powered by phpBB® Forum Software © phpBB Limited