Decrypting Bravia Firmware BIN File

[sbav1]

what about this one:
U_RS232_RXD
U_RS232_TXD

Pin numbers 96 and 97 on page 88. Connector name CN5000, chip name IC5000.

Not a good place, IMO. IC5000 /MB91F313/ is Fujitsu low-power standby/secondary uC, i.e.: Sony "MIMAS" (Samsung "MICOM" equivalent), not the main SoC.
Certainly not the best place for serial console..

Main chip (Nec EMMA3TH) has 3+ built-in UARTs, see block diagrams & page 68 for details.
My bet is on EMMA3TH URT0TX/RX (M_UART0_RX/TX, "DTT Log", whatever that means). If there is a serial/debug console in that TV (we don't know that for sure; even if there is, it may be locked/disabled/restricted by default), that should be the place to look first, IMO.

You can clearly see the 6 solders left side of the chip. Two of them have trace. Those two traces are U_RS232_RXD and U_RS232_TXD, enoguh to get RS232 to work.

Yeah, it is an serial port, but probably not the right one. I think it's for MIMAS flashing/programming. It's kinda interesting, but (most likely) not really useful for any practical purposes.

I need to attack on the right port.

Keep looking , there are as many as 6 (7, 8?) serial ports/interfaces in your TV.

BTW, the TV has to be in the stand by mode right?

For anything to appear on serial console (if any), TV should be powered on, not on standby.

I don't want to fry anything

Well, there is an substantial risk you will fry/brick it, but no pain == no gain . Do not try to connect anything directly to PC RS232 (+/-12V), without proper cable/converter!

P.S. I paid 40 bucks for those manuals

They are really nice . It's the first service manual I've ever seen with the actual SIL9287 application note..

[coolrecep]

Tha helped a lot. I will give the credit to you and erdem when the project kicks off

As you and erdem say, the port I have found is not useful. Because it is not the debug port.

PDF says:

UART0_TXD/RXD
UART1_TXD/RXD

So, those ports are DTT Log and PQC Log beacuse they are named UART0 and UART1 respectively.



Now I want to establish a connection to those ports to check whether they have shell or not.

On the other hand, those ports may not be the ports we are looking for. Could you please take a look at that pics.



another one:



I have also searched DTT, it may stand for Debug Test System, debug test target.

//Updated Info

Port name: CN5502 1-774-667-51 CONNECTOR, FFC/FPC 18P

Back sde of the PCB



OK, finally, I think this is our magic port:

[erdem_ua]

Congratulations, CN5502 is the port you are searching for.

[coolrecep]

Bullseye! All right, now all we need is the proper tools and some knowledge BTW, I believe that this port is not disabled. If it was, Sony would not mention it on the PDF...I will PM you some time today erdem. Thanks.

[nashagui]

I like build a console cable with USB TTL+ FFC cable.

someone can sugest a pinout diagram ?

Is correct?