1. I took the T-VALDEUC 3006.2, decrypted Image (kernel), changed one bit in hex editor according this:
http://forum.samygo.tv/viewtopic.php?f= ... t=30#p7076
2. this patched kernel was encrypted back, checksum is written to valindinfo.txt
Code: Select all
-=BIG FAT WARNING!=-
You can brick your TV with this tool!
Authors accept no responsibility about ANY DAMAGE on your devices!
project home: http://www.SamyGO.tv
Firmware: T-VALDEUC v3006.2
FileS ['Image']
AES Encrytped CI+ firmware detected.
Processing file: Image
Encrypting with Calculated CRC : 0x898D8838
Updating c:\tmp\T-VALDEUC\image\validinfo.txt with new CRC.
XOR Key : T-VALDEUC
Crypto package found, using fast XOR engine.
Writen file c:\tmp\T-VALDEUC\image\Image.xor
secret key : A435HX:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxx-abc2010
Encrypting with AES...
done
Writen file c:\tmp\T-VALDEUC\image\Image.sec
This plan has some doubts:
1. If we flash alternative firmware and brake it on about 50%, TV does not switch to it. Need to think how to make "toggle". Might some widget way? Is here only one kernel on TV?
2. If successfully toggled, kernel boots direct to SELP>#
But TV still resets by Authuld (kernel hash is wrong).
3. write kernel hashes to right places over console (if properly patched, this is never ever done before on C series)
4. Here are two sets of kernel (bml0/5 and bml0/7). It makes trouble to flash right kernel we want.
5. If fail - just Service, nothing more left.
Denny or mirsev could check this way on their BD players
Any coment?
