Hi, I had the same problem that you have, I had firmware 3009.2 in my Le40C650 but I managed to hack my samy via hotel mode and get back to firmware 1016. As you noticed there are many guides but most of them are useless. I'll try to explain you everything step by step how to get access to C650 via hotel model.
1. Download network_opt_18.02.2011_1.zip from here "http://www.megaupload.com/?d=MOTXPMMO"
2. Plug in your pendrive to you TV and then change your TV source to Aerial source (normal antenna) then go to Menu ->Channel ->Channel list transfer -> Export to USB, now channel list will be exported to your pendrive
2a. Now press on you remote [Mute]----[OK] and activate Hotel mode, then choose "Clone Tv to USB" and wait till everything will be copied.
3. Unplug your pendrive , connect it to your computer.
4. You will find on your pendrive file channel_list_LE40C650_1001.scm
and folder T-VALDEUC.
5. Copy all files from pendrive somewhere on you computer, and open file channel_list_LE40C650_1001.scm with winzip/7-zip.
6. The content of this file should be like this:
Now you should create new folder
inside this file (channel_list_LE40C650_1001.scm) named "usb_mount"
and in the folder new file "1.txt"
So now your *.scm file should look like this:
usb_mount <- this is the folder that you need to create and in this folder should be file "1.txt"
7. Now extract files from file that you downloaded from step 1 ( "http://www.megaupload.com/?d=MOTXPMMO
") and run Win32DiskImager.exe
8. Run win32DiskImager.exe choose you pendrive and select image file "network_opt_18.02.2011_sda2" then click write
9. Two partitions will be created on your pendrive. The first one will be Fat32 the second Ext3.
10. Copy your modified channel_list_LE40C650_1001.scm to Fat32 and all files from T-VALDEUC/Clone to HotelMode.
Now the content of your pendrive should look like this:
channel_list_LE40C650_1001.scm <- your modified scm file from step 6
HotelMode <- in this folder there should be content of T-VALDEUC/Clone (the folder you exported in HotelMode) below you can find how is he look like
[/list]Content of folder HotelMode:
11. Now unplug your pendrive and connect it to your TV.
12. Press on you remote [Mute]----[OK] and activate Hotel mode
13. Choose "Clone USB to TV"
14. Now don't do anything just wait couple of minutes, there will be black screen and Tv will restart (approx. 3-4 min)
15. Try to connect to your Tv via Telnet.
16. Run command cp $OPT_DIR/usr/restore/start.sh /mtd_rwarea/start.sh.