[SOLVED] Kinda Bricked my TV

[dasilverpaladin]

as i understand the tool just enables shell?
well shell seems to work even without the tool, but wont accept letters...

tried the other one with emergency.sh which seems to work, SWU_T-CHLCIPDEUC_002006_I02_EK000DK000_091112
as i have read in the posting, the password is for every TV anotherone?

[juusso]

Tool enables FULL console. No symbol filtration anymore!. But it is for B550.

Try to patch memory. The goal is - to remove that symbol filtration (A-F, 0-9).
http://forum.samygo.tv/viewtopic.php?f= ... t=20#p5650

What about 9115 ? Have you tried that? The password probably is for every TV different. If your TV not broke, here is a tool, which calculates that password for you. But you can try the password from petergrey...

[dasilverpaladin]

yeah i am trying to patch the memory,
but its kinda hard to work with scripted inputs, i can just script and try them because my TV wont stop spamming errors etc.

the given password doesnt seem to work, at least i am getting an Authuld shutdown everytime i try it...

[juusso]

Check full path to memory read or write , or also the value to patch (on forum ) and copy to bufer. Every digit on new line. Then just paste it to putty and you're here! For example to get to memory read menu:

Code: Select all

1198282
1198282
11
04
0

You can inspect log file for the meorry address to patch.
Next reboot of TV you can patch this in same way by just copy/paste.

Code: Select all

1198282
1198282
11
04
1
0x......

For B679 the address to patch is 0x601665c0, you can try this also.

Code: Select all

1198282
1198282
11
04
1
0x601665c0
0

To get knowing about success, just try to kill exeDSP by pressing ctrl+c
If worked, you get shell. If not, search for your address.

[dasilverpaladin]

i was able to change the given bytes

Code: Select all

Select> physical address: 0xinput is 0x60133114
number:
[60133114]: e5953000 new value:input is 0x0

this didn`t enable full console.

i even tried the other offset given on a page later

Code: Select all

Select> physical address: 0xinput is 0x60166598
number:
[60166598]: ebfb620c new value:input is 0x0

didn`t give me full console

but as i read in the posting i would need to find the coresponding offset for my firmware?

hahaha, after reading this posting http://forum.samygo.tv/viewtopic.php?f= ... t=30#p7153 there seems a little bit of a problem, with memory patching the filter... as the offset is 601665c0

[juusso]

If you look at previous my post, i told already this offset to you

[dasilverpaladin]

haha, didnt see your edit
but i it wouldnt change a thing, because of the filter you cant enter the letter "c" which is needed for this offest

but i have a solution i tried, i patched all 11 places after 0x60166598 and got the filter disabled,
could even kill exeDSP via killall command and getting full console which freeze after 2-3 seconds

[juusso]

You can enter not smal c, but enter capital C
it`s same for address. But for input - not.
Equal:

Code: Select all

0x601665C0
0x601665c0

If not works, execute your script from USB. 2-3 sec is enough for that. For example:

Code: Select all

sh +x /dtv/usb/sda1/emergency.sh

Edit: if you have dump of your /mtd_rwarea, then you can restore it.

Code: Select all

#!/bin/sh
umount -f /mtd_rwarea
partition.erase /dev/bml0/14
stl.format /dev/bml0/14
dd if=/dtv/usb/sda1/stl_0_14 of=/dev/stl0/14
sync
echo "done"

where /dtv/usb/sda1/stl_0_14 is your dump file. and usb is recognized as sda1 ...
also be sure your /mtd_rwarea is mounted /dev/stl0/14...

or as you said, probably it is enough to delete autostart.sh and exeDSP.sh (probably it is not existing already) and SamyGO.sh

Code: Select all

rm -f /mtd_rwarea/SamyGO/SamyGO.sh
rm -f /mtd_rwarea/SamyGO/autorun.sh
rm -f /mtd_rwarea/SamyGO/exeDSP.sh

[dasilverpaladin]

hey juuso,

if you someday come to Munich, call me.

Thanks to you i unbricked my TV

[juusso]

if you someday come to Munich

Yes, sure, i will

Advice for future:
Run the tool on your TV and get the password for your 9115.

patcher.zip

Code: Select all

/dtv/usb/sda1/patcher /dev/mem /dtv/usb/sda1/patch.ini patch2 patch

Also for autostart use patched firmware (not with geo patcher, but 0.24) and injectso or gdb trick.
Those are less dangerous. Also adding some bootlop prevent code to SamyGO.sh could be usefull also.

Good to know you got success

EDIT: the next posts were moved to: Executing custom script on CI+. Thanks.