T-VAL6DEUC progress/roadmap

[prostheta]

Hi everyone. I've done as much homework using the search function and Wiki as is reasonable!

What I haven't found however, is the progress on the process of downgrading VAL6DEUC TVs to older firmwares. I understand that the hackable vectors are far more difficult for this firmware, likely resulting in bricks, etc. Is still being actively worked on, or put onto the back burner? The forum seems full of people querying whether it can be done ("currently: no"?) and not much indicating it is still on the cards. Am I right in thinking that TVs running VAL6DEUC have smaller onboard flash memories, therefore moving sideways to other firmwares is physically impossible?

If there is some kind of thread already tracking this, I haven't found it. I'm known to miss the most obvious things sometimes!

PS. Why do I always end up making stupid "first posts" like this on boards? This is some phenomenon worthy of further investigation, methinks.

[juusso]

This is your first post ever

Sadly, the answer is no. Here is neither laboratory mouse with T-VAL6DEUC nor brave testers with good ideas to check it on devices...
The firmware key is known and we have it decrypted, but that's all what we have. No one reported about any progress, just questions like yours.
Anyone?

[prostheta]

Thanks juuso. Despite adding just another question to the pile, I thought it might be a good idea to try and figure out where T-VAL6DEUC is going (or not!). I wish I'd known this when we bought the TV from Sonera (UE46C6000) as I love interoperable toys. Shame that this one is proving to be more of a "static working brick" than a hackable fun toy.

I hope other people chime in with their progress so we can figure out whether this one truly is a dead end, or merely a work in progress.

[juusso]

From other tests, made few months ago, some summary:

what is tested, but does not work:

1. Hotel mode hack does not work because of unsupported ext3 filesystem by TV
2. All possible filesystems (with symlink support) were tested (ext4,riser,rfs and so on) without any success.
3. TV does not have Internet@TV, widget way to hack it is closed as well.


What is tested and works:

1. Shell over ExLink is limited, only limited character input is allowed (A-F, 0-9)
2. Firmware key is known and everyone can decrypt firmware with SamyGO patcher v0.30 (look at samygo svn repo)

Sure, any progress is welcome and i`m inviting people to post about any positive or negative success on T-VAL6DEUC.
The goal - root access to run other stuff like all extensions, NFS and samba shares...

[prostheta]

Apologies for my lack of experience in this specific area as I only really decided to look into hacking the TV last night (beer makes people hack).

Am I right in thinking that the hardware is more or less the same across the board for many of the Samsung TVs in various classes (except for perhaps the flash memory size) and that in order to consider installing a different firmware version you need a solid vector into the existing firmware to do so? It sounds like VAL6DEUC is locked, bolted, sewn up and welded tight compared to the other firmwares! I truly hope that if the hardware in the TV we have is capable of running Internet@TV that VAL6DEUC gets cracked open somehow. I presume that since the software end is now decrypted and "open" all it takes is a suitable flaw or vector via the hardware end?

I truly am an amateur in TV/device hacking circles. My experience lies elsewhere in CAD, electronics, manufacturing and the "physical" engineering/building skills. I haven't touched UNIX since maybe 1993 so I'm not entirely up to speed.

[flalt]

devnull43, any luck with your attempts so far?

[juusso]

even if you edit any rootfs file, encrypt it back and upgrade to TV, you get reboot by authuld.
You have to write right hashes as well to get it working. It is tested on C550.

If you really going to edit rootfs, it is better to change /sbin/usb_hotplug.sh like other widget hacks. But we don`t know where hash on this model is placed. We have calchash tool for T-VALDEUC and might it could be usefull here.

I see this scenario of hacking ANY C or D series TV:

1. Edit rootfs to get script from USB executed (might you could add telnet-enabled busybox to rootfs as well and telnetd call from any startup scripts?)
2. After upgrading of such rootfs, TV starts to reboot at every about 15-20 sec.
3. Connect to TV over telnet and try to execute calchash tool to write right hashes to it`s places. To get extra time (about 2-3 min) authuld could be killed:

Code: Select all

killall -9 authuld

4. If success, TV stops rebooting. If fail - contact Service