Hacking TV over Hotel mode (most C series models)

[cotarelo]

Which start.sh? where can I find the rc.local? What is the right encoding, maybe I can create manually the file with the tv via serial to not mess with the encoding type?

Did somebody ever did the trick?

[Nero]

Hello guys,

I'm new in this thread. I'm interested in hacking my LE40C750. I'v read the samygo wiki and this thread many times and I've nothing found about that someone hacked the LE40C750 successfully without brick. Maybe here is sth. who can help? I have Firmware T-VALDEUC 3011. Is this possible or have I to "downgrade"? Thanks.

[juusso]

es, its possible using hospitality hack.
But if you are scared to brick, you can use "less dangerous" way - widget hac. But then you have to downgrade up to T-VALDEUC 3005.0

[Nero]

Thanks for information. I'm interested in using nfs share, ssh an so on. so when you say it's possible, I think to hack with hotel mode. With widget method, cold plug will not work, isn't it? Or is this information outdated? Thanks

[Nero]

I've tried Hotel Hack described on page 1. Symlinks and directories are 100% correct, I checked many times. I also had to change to "sda1". After "clone from USB" nothing happend, I had no telnet access. There is also no "run.ok" on USB stick.

I waited some minutes and then restarted TV. Nothing changed, I had also no telnet access. What could be wrong? Please help. Thanks.

By the way: TV not bricked. tried same procedure 3 times.

[cotarelo]

Happens the same to me Nero, and nobody seem to help

[Nero]

hm... Maybe here is a point missing?

http://wiki.samygo.tv/index.php5/Hackin ... es_models)

12. Copy files exported in Hotel mode (from the step "Clone TV to USB" above, only files, without directories) to /HotelMode directory on USB

Exported in HotelMode files to copy:
./T-MSX5DEUC/Clone:

drwxr-xr-x 2 root root 4096 2010-12-27 18:39 .
drwxr-xr-x 3 root root 4096 2010-12-27 18:39 ..
-rw-r--r-- 1 root root 2304 1980-01-01 00:00 Clone.dat
-rw-r--r-- 1 root root 378 1980-01-01 00:00 FADAT
-rw-r--r-- 1 root root 144 1980-01-01 00:00 FineTune_Digital
-rw-r--r-- 1 root root 188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r-- 1 root root 40000 1980-01-01 00:00 map-AirA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-AirD
-rw-r--r-- 1 root root 40000 1980-01-01 00:00 map-CableA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-CableD
-rw-r--r-- 1 root root 4 1980-01-01 00:00 map-ChKey
-rw-r--r-- 1 root root 144000 1980-01-01 00:00 map-SateD
-rw-r--r-- 1 root root 95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r-- 1 root root 5382 1980-01-01 00:00 PLDAT
-rw-r--r-- 1 root root 720 1980-01-01 00:00 RadioMap
-rw-r--r-- 1 root root 7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r-- 1 root root 324 1980-01-01 00:00 ServiceProviders
-rw-r--r-- 1 root root 9478 1980-01-01 00:00 SSDAT
-rw-r--r-- 1 root root 98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r-- 1 root root 28 1980-01-01 00:00 TSIDList
-rw-r--r-- 1 root root 4 1980-01-01 00:00 UserTransponderDataBase.dat

Do I have to export files in Hotel Mode before copy modified Clone.dat to USB Stick und reimport Files to TV?

Thanks for help!

[kaiser]

Got stuck with symlinks on step #5.

Code: Select all

root@lubuntu:/media/888ee929-9b8c-4bf2-986a-2acb8c8fa7f4# ln -s /link0_Temp /mtd_rwarea/usb_mount/usb_cmd
ln: failed to create symbolic link `/mtd_rwarea/usb_mount/usb_cmd': No such file or directory

What am I doing wrong?

EDIT:

Looks like I found my mistake:

Code: Select all

root@lubuntu:/media/888ee929-9b8c-4bf2-986a-2acb8c8fa7f4# ln -s /mtd_rwarea/usb_mount/usb_cmd link0_Temp
root@lubuntu:/media/888ee929-9b8c-4bf2-986a-2acb8c8fa7f4# ln -s /mtd_rwarea/usb_mount/usb_mount link1_Temp
root@lubuntu:/media/888ee929-9b8c-4bf2-986a-2acb8c8fa7f4# ln -s /mtd_rwarea/usb_mount/killself.sh link2_Temp

[beatfreak]

if it helps here are my steps to get UE40C6500 hacked (T-VALDEUC 3015)
i am working under openSUSE 12.1
i used programs kwrite for editing
for the sda / sda1 thing it has already been said that when your pendrive was formattet with a partitiontable it will have a number in description, to make it easier to copy the posted examples i'll remove the partitiontable to get drive mounted as sda...

@the newbies and win-users:before we begin lets remember the two MOST important rules in IT-Universe:
1. DO NOT CHANGE A RUNNING SYSTEM
(and as this rule will be violated by our hack-attempt the second one becomes even more important)
2. IF YOU DON'T KNOW WHAT YOU ARE DOING, DON'T DO IT!
(means if you don't understand most of the stuff here better get someone who does in front of your TV than get a bricked TV)
so if you didn't know that you have to be absolute sensitive with upper ans lowercase when writing you better stop reading here and get a cold drink...

we start with making a backup of your channel list, how to export channel list to usb is described in your manual

create a working directory on your pc, lets say /tmp/samygo
(i'll post the commands i entered with path info the commands begin after the ">")

Code: Select all

/>cd /tmp
/tmp>mkdir samygo
/tmp>cd samygo
/tmp/samygo>

lets say your pendrive with channellist is mounted by your OS at /media/flashdrive
copy chllist to workdir

Code: Select all

/tmp/samygo>cp /media/flashdrive/channel_list_UE40C6500_1001.scm /tmp/samygo/

start typing "ch" of channel list and then press TAB to get it autocompleted

now create usb_mount folder and dummyfile in it, and set full permissions

Code: Select all

/tmp/samygo>mkdir usb_mount
/tmp/samygo>touch usb_mount/1.txt
/tmp/samygo>chmod 777 usb_mount -R

now you are ready to inject folder and dummyfile to chllist archive

Code: Select all

/tmp/samygo>zip -g channel_list_UE40C6500_1001.scm usb_mount/1.txt
  adding: usb_mount/1.txt (stored 0%)

now lets prepare the "hack"-files

Code: Select all

/tmp/samygo>kwrite run.sh

this will open kwrite with the file you wish to create
paste the code for run.sh, save and close

Code: Select all

#!/bin/sh
echo 'OK' >> /dtv/usb/sda/run.ok
# sh -x /dtv/usb/sda/SamyGO/rcSGO >/dev/null 2>&1 &

the last line is not necessary but later we only have to remove the # to get samygo extensions started

next file: link0

Code: Select all

/tmp/samygo>kwrite link0

this will open kwrite with the file you wish to create
paste the code for link0, save and close

Code: Select all

#!/bin/sh
sh -x /mtd_rwarea/usb_mount/killself.sh &
/sbin/usb_mount/usb_cmd $1 $2 $3 $4 $5 $6 $7
if [ "$1" = "mount" ] ; then
    if [ -f /dtv/usb/$3/run.sh ] ; then
                chmod 777 /dtv/usb/$3/run.sh
                sh -x /dtv/usb/$3/run.sh /dtv/usb/$3
    fi
fi

next file: link1
(with cursor key up you can repeat last command, then you only have to change last character in this case)

Code: Select all

/tmp/samygo>kwrite link1

Code: Select all

#!/bin/sh
/sbin/usb_mount/usb_mount $1 $2 $3 $4 $5 $6 $7

next file: link2

Code: Select all

/tmp/samygo>kwrite link2

Code: Select all

#!/bin/sh
sleep 900
echo killself >>/mtd_rwarea/cmd1
sh -x /dtv/usb/sda/run4.sh &
rm -rf /mtd_rwarea/usb_mount/usb_cmd
rm -rf /mtd_rwarea/usb_mount/usb_mount
rm -rf /mtd_rwarea/usb_mount/killself.sh

i chose to have 15 min before hack will be automatically removed, change this file later to make hack permanent

next file: clone.dat.txt

Code: Select all

/tmp/samygo>kwrite clone.dat.txt

Code: Select all

    0000000: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000010: 7476 2f75 7362 2f73 6461 2f6c 696e 6b30  tv/usb/sda/link0
    0000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000080: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000090: 7476 2f75 7362 2f73 6461 2f6c 696e 6b31  tv/usb/sda/link1
    00000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000100: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000110: 7476 2f75 7362 2f73 6461 2f6c 696e 6b32  tv/usb/sda/link2
    0000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................

and create binary file from txt

Code: Select all

/tmp/samygo>xxd -r clone.dat.txt Clone.dat

don't forget to set the script files to be executable (we are setting full permissions)

Code: Select all

/tmp/samygo>chmod 777 link*
/tmp/samygo>chmod 777 run.sh

so far for the preparation, lets care about the usb-drive
to eliminate possible partitions and filesystems we fill the drive with zeros
(be very careful with this, pointing to wrong device and your hdd data will be killed without confirmation)
first check which device it is

Code: Select all

/tmp/samygo>cat /proc/mounts

and somewhere we find the line

Code: Select all

/dev/sdb1 /media/flashdisk vfat rw,nosuid,nodev,relatime,errors=continue,barrier=1,data=ordered 0 0

now we now that usb-drive is sdb with first partition mounted
to clear the drive first unmount it via menu eject or

Code: Select all

/tmp/samygo>sudo umount /dev/sdb1

sudo means that we are going to do it as superuser, so you will be prompted for superuser password
if no erros occured we are ready to clear it with

Code: Select all

sudo dd if=/dev/zero of=/dev/sdb

will write zeros on it until its full, be patient on large drives

then we create new ext3 filesystem on it

Code: Select all

/tmp/samygo>sudo /sbin/mkfs.ext3 /dev/sdb -L hackdrive

when finished unplug and replug drive to get it remounted (assuming under /media/hackdrive)

now we will create the directory structure on the usb-drive

Code: Select all

/tmp/samygo> sudo mkdir /media/hackdrive/link0_Clone
/tmp/samygo> sudo mkdir /media/hackdrive/link1_Clone
/tmp/samygo> sudo mkdir /media/hackdrive/link2_Clone
/tmp/samygo> sudo mkdir /media/hackdrive/T-VALDEUC
/tmp/samygo> sudo mkdir /media/hackdrive/T-VALDEUC/Clone

and copy over the files

Code: Select all

/tmp/samygo> sudo cp channel_list_UE40C6500_1001.scm /media/hackdrive/
/tmp/samygo> sudo cp run.sh /media/hackdrive/
/tmp/samygo> sudo cp Clone.dat /media/hackdrive/T-VALDEUC/Clone/
/tmp/samygo> sudo cp link0 /media/hackdrive/T-VALDEUC/Clone/
/tmp/samygo> sudo cp link1 /media/hackdrive/T-VALDEUC/Clone/
/tmp/samygo> sudo cp link2 /media/hackdrive/T-VALDEUC/Clone/

create the symlinks

Code: Select all

/tmp/samygo> cd /media/hackdrive/
/media/hackdrive> sudo ln -s /mtd_rwarea/usb_mount/usb_cmd link0_Temp
/media/hackdrive> sudo ln -s /mtd_rwarea/usb_mount/usb_mount link1_Temp
/media/hackdrive> sudo ln -s /mtd_rwarea/usb_mount/killself.sh link2_Temp

and check if everything went right

Code: Select all

    /media/hackdrive> ls -lR
    .:
    -rw-r--r-- 1 root root  3972 2010-11-30 23:26 channel_list_LE32C550_1001.scm
    drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link0_Clone
    lrwxrwxrwx 1 root root    29 2010-11-30 23:32 link0_Temp -> /mtd_rwarea/usb_mount/usb_cmd
    drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link1_Clone
    lrwxrwxrwx 1 root root    31 2010-11-30 23:32 link1_Temp -> /mtd_rwarea/usb_mount/usb_mount
    drwxr-xr-x 2 root root  4096 2010-11-30 23:32 link2_Clone
    lrwxrwxrwx 1 root root    33 2010-11-30 23:32 link2_Temp -> /mtd_rwarea/usb_mount/killself.sh
    drwx------ 2 root root 16384 2010-11-24 19:55 lost+found
    -rwxrwxrwx 1 root root   375 2010-12-01 00:56 run.sh
    drwxr-xr-x 3 root root  4096 2010-11-30 23:32 T-VALDEUC

    ./link0_Clone:

    ./link1_Clone:

    ./link2_Clone:

    ./T-VALDEUC:
    drwxr-xr-x 2 root root 4096 2010-11-30 23:32 Clone

    ./T-VALDEUC/Clone:
    -rw-r--r-- 1 root root 384 2010-11-30 23:32 Clone.dat
    -rwxrwxrwx 1 root root 246 2010-11-30 23:32 link0
    -rwxrwxrwx 1 root root  57 2010-11-30 23:32 link1
    -rwxrwxrwx 1 root root 199 2010-11-30 23:32 link2

time to take a deep breath...
eject hackdrive and move to TV

re import your channellist as described in manual

call HotelMode menu
[MUTE] -> [1] -> [1] -> [9] -> [Enter]

activate HotelMode
if "HotelMode OFF" is highlighted press [RIGHT] to select option
and press [RIGHT] again to set HotelMode to ON
press [RETURN] to get back to HM-menu, you should now see all options changable
press [UP] to move cursor to "Clone USB to TV"
and press [RIGHT] to activate function
TV asks for confirmation, select OK
TV will process the Files and reboot twice
unplug and replug usb-drive to tv, wait a bit, and plug usb-drive to your PC to see if "run.ok" file exists
if we were successful the hardest thing is done! *YAY*

you may want to disable HotelMode by recalling HM-menu as described above
and setting HotelMode back to "OFF"
then restart TV (power off, power on)
then you may want to get your channels back
first i had to set antenna mode in menu from terestrial back to cable (as i use cable TV )
and imported my channel list again, (we can use the modified file on hackdrive for this)

now we attempt to get samygo extensions running
we can still use our ext3 formatted drive but then we'll have to do all changes on the drive as superuser and pay attention to execute-permissions
formatting it as vfat makes the whole thing way easier...

have the usb-drive plugged to your pc and eject (unmount) it but leave plugged
then format

Code: Select all

/tmp/samygo> sudo /sbin/mkfs.vfat -n SamyGO /dev/sdb

unplug and replug to get it mounted

we need run.sh on this drive too, but now we use it to call samygo extensions
edit it and remove the "#" in last line, if you like place one in front of the run.ok-command as we don't need it anymore
then copy to usb-drive

Code: Select all

/tmp/samygo>cp run.sh /media/SAMYGO/

get the extension files
from http://sourceforge.net/projects/samygo/files/
, in my case for C series, valencia (t-VALdeuc) with ARM processor
located:
Home / C Series / For ARM CPUs / Content Library Applications
download all 3 files (extensions, bugfix, libs) (for example to our workdir)
and unpack in usb-drive in the right order (bugfix after extensions)

Code: Select all

/tmp/samygo>cd /media/SAMYGO
/media/SAMYGO>unzip /tmp/samygo/SamyGO-All-Extensions-v0.03.6-r12-for-T-VALDEUC-20110103184650.zip
/media/SAMYGO>unzip /tmp/samygo/SamyGO-All-Extensions-Bugfix-v0.03.6-r15-for-valencia-20111001120232.zip
/media/SAMYGO>unzip /tmp/samygo/SamyGO-libs-T-VALDEUC-20110123101934.zip

(autocomplete is very useful here)

if you like enable or disable some extensions by removing / adding .dis at the end of the filename for the startup scripts in

/media/SAMYGO/SamyGO/etc/init.d/

for example disable something

Code: Select all

/media/SAMYGO>cd SamyGO/etc/init.d
/media/SAMYGO/SamyGO/etc/init.d>mv 03_03_djmount.init 03_03_djmount.init.dis

or enable

Code: Select all

/media/SAMYGO/SamyGO/etc/init.d>mv 06_05_vsftp.init.dis 06_05_vsftp.init

when done we are ready to go...
eject usb-drive properly and plug it to tv
wait a bit to let extensions start and try to ssh to TV

Code: Select all

ssh root@<IP of your TV>

if you don't know your TVs IP adress have a look in your routers dhcp-client list (if you didn't decide to configure a fixed IP for your TV, i prefer fixed dhcp mappings)
you shoult be prompted for ssh password which is "SamyGO" (probably you first have to confirm the key on first ssh connection to your TV)

if this step was successful its up to you what happens next

to make the hack permanent i modified the link2 aka killself.sh file as following

Code: Select all

#!/bin/sh
sleep 9
echo killself >>/mtd_rwarea/cmd1
#sh -x /dtv/usb/sda1/run4.sh &
#rm -rf /mtd_rwarea/usb_mount/usb_cmd
#rm -rf /mtd_rwarea/usb_mount/usb_mount
#rm -rf /mtd_rwarea/usb_mount/killself.sh

and re-applied the hack


P.S. feel free to use this post for wiki improvement
P.P.S.
if you decide to edit Clone.dat to fit it to your usb-drive devicename in TV
get a hex-editor like okteta or ghex
and change it like this

Code: Select all

    0000000: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000010: 7476 2f75 7362 2f73 6461 2f6c 696e 6b30  tv/usb/sda1/link
    0000020: 3000 0000 0000 0000 0000 0000 0000 0000  0...............
    0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000060: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000080: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000090: 7476 2f75 7362 2f73 6461 2f6c 696e 6b31  tv/usb/sda1/link
    00000a0: 3100 0000 0000 0000 0000 0000 0000 0000  2...............
    00000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000100: 2f6d 7464 5f72 7761 7265 612f 2e2e 2f64  /mtd_rwarea/../d
    0000110: 7476 2f75 7362 2f73 6461 2f6c 696e 6b32  tv/usb/sda1/link
    0000120: 3200 0000 0000 0000 0000 0000 0000 0000  2...............
    0000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000140: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000150: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    0000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................

for every character insertet, remove a space before next statement to keep startpoints at the same place and file length

[juusso]

wow

could you please update wiki? Thanks!