Hacking TV over Hotel mode (most C series models)

[tuspam]

Has anyone tried this HACK a LED C4000 TV with T-TDTDEUC-1024.1 (new firmware for C450/C550/C4000/C5100 etc.)? Allshare works fine after enable in service menu whith edimax ew-7718Un (changed vid and pid). Any chance of success?

[karlux]

Hi juuso, greetings from Latvia

I have a PS50C530 TV on Trident platform T-TDT5DEUC firmware 1023.0, I managed to connect Edimax wireless dongle by changing the model to C550. When I try to export channel list I get .scm file - so does it mean my TV isn't hackable? Thanks a lot!

[juusso]

Hi, this means all is ok. scm is like zip archive containing all required channels. You can root this TV either manually or using universal hack usb image.

[cotarelo]

Ok... I was really scared I thought I bricked my TV... somehow I managed to restore it.

1? I changed my model to C550.
2? I did everything what it was posted on the guide with the modified Clone.dat (sda1 instead of sda).
3? After selecting from the service menu Clone USB to TV. The system said that tv is restored and it needs to be restarted. I pressed OK and TV said that no channel is found and signal is weak.

I did a factory reset and I did a auto search of channels and I can see the channels again and USB is working.

The contents of my USB are like this:

Code: Select all

ls -lR
.:
total 64
-rw-r--r-- 1 root root 28175 2012-03-11 18:58 channel_list_LE40C550_1001.scm
drwxr-xr-x 2 root root  4096 2012-03-11 12:45 link0_Clone
lrwxrwxrwx 1 root root    29 2012-03-11 19:00 link0_Temp -> /mtd_rwarea/usb_mount/usb_cmd
drwxr-xr-x 2 root root  4096 2012-03-11 12:45 link1_Clone
lrwxrwxrwx 1 root root    31 2012-03-11 19:00 link1_Temp -> /mtd_rwarea/usb_mount/usb_mount
drwxr-xr-x 2 root root  4096 2012-03-11 12:45 link2_Clone
lrwxrwxrwx 1 root root    33 2012-03-11 19:00 link2_Temp -> /mtd_rwarea/usb_mount/killself.sh
drwx------ 2 root root 16384 2012-03-11 18:51 lost+found
-rwxrwxrwx 1 root root    43 2012-03-11 12:32 run.sh
drwxr-xr-x 3 root root  4096 2012-03-11 14:26 T-MSX5DEUC

./link0_Clone:
total 0

./link1_Clone:
total 0

./link2_Clone:
total 0

./lost+found:
total 0

./T-MSX5DEUC:
total 4
drwxr-xr-x 2 root root 4096 2012-03-11 19:15 Clone

./T-MSX5DEUC/Clone:
total 16
-rw-r--r-- 1 root root 384 2010-12-03 12:29 Clone.dat
-rwxrwxrwx 1 root root 274 2012-03-11 12:32 link0
-rwxrwxrwx 1 root root  57 2012-03-11 12:32 link1
-rwxrwxrwx 1 root root 199 2012-03-11 12:32 link2

Please help

[mmhorda]

Hello guys. I haven't been here for a while.
I found some interesting info regarding those hacked C5xx TVs with unversal flesh drive and died after command reboot. Don't know if it was already discussed here.

translation:
IT IS VERY IMPORTANT! very important to turn off watchdog and turn on Debug in service menu before the hack!!! It will prevent your TV from dying after the command reboot!

add it PLS someone to wiki!!!

second undocumented thing on wiki.
Those pople with T-VALDEUC who has already hacked their TVs with universal flesh drive and have webadmin incorrectly working must replace httpd.tar.gz in TV /mtd_rwarea/network_opt/usr/plugins/ to the attached httpd.tar.gz, here. Then turn TV OFF and ON again.
the problem is that samsung busybox doesn't have gzip for tar.

[cotarelo]

Hello mmhorda,

I have a C530, but it is still unhacked as I was unable to do the hack following the procedure. I want to do this and probably I will try again this days. Do I need to disable the watchdog and turn on the debug before performing the usb manual hack explained in the forum? I do not understand so much what you wrote in the last post regarding httpd.

Thank you in advance,
Regards

[cotarelo]

I'd like to know also if it is possible to make that the hack is inside the tv, and not having the usb pendrive connected all the time. I need this usb for the Wifi dongle and I do not want an ugly usb hub.

[juusso]

Use USB hub. Better powered.

[cotarelo]

So there is not a way to keep the hack inside the flash of the TV? Symlink to /dev/sdX?

[juusso]

start.sh can do the trick. But the piece of rc.local must be there too, also right encoding must be used to edit the script, else you`ll be locked in bootloop/incomplete boot. Big danger to brick. w/o chance to be unbricked.