UE40C6700 LED LCD

[Denny]

i have partly read "exeDSP" from UE55C8000, (approx 29MB) whitch is not full filesize as the watchdog kill my file transfer and TV reboots without complete the transfer

[juusso]

Please tell how did you do that? Did you get console working?

[Denny]

wel, console i did not enable, and atm i am trying to read complete exedsp file coz sems the aes key is not in 1st part of 29MB.

and how, i keep this private, in case to do not let samsung act against this bug.
as soon i read exe fully, i will publish it.


Denny

[juusso]

It sounds very interesting and we are waiting for more explanation. Wouldn`t you think, that if you explane your investigations (you can do it private) - more people will try improve your method and success could be more quicker... Could you give some hints, we are looking for solution (you can look at http://forum.ixbt.com/topic.cgi?id=62:17649-1 - its russian btw)...

[bastler0815]

Hey there,

sounds very interesting

Would be nice to hear more about the bug to get access to read the exec.DSP ^^

Do you know if the usage of this bug also would be possible at the UE40C6700 version ?!

Regards, bastler

[timoo]

share please this partly dumped exeDSP upload it somewehere ,maybe i (we) could dump crypting key iam working on my tv ue40c8000 if you could share your knowledge how to dump exeDSP let me PM
P.S. iam not samsung staff D

[Denny]

f*ck s..

lets go....

the way is user application(widget).
i have used the USA news app and modify it :

it is need to load

pluginObjectFile

on usb stick it is need to create "test" dir or remove it from destination dir in code below.
code :

Code: Select all

in index.html
u must add :

<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>

 
function onLoadCategoryList() {
       var FilePlugind = document.getElementById("pluginObjectFile");
     
       offWatchDog();  // must be disabled otherwise TV reboots
       FilePlugind.Copy("/mtd_exe", "$USB_DIR/sda1/test");
        FilePlugind.Copy("/mtd_cmmlib", "$USB_DIR/sda1/test");
        FilePlugind.Copy("/mtd_appdata", "$USB_DIR/sda1/test");
        FilePlugind.Copy("/mtd_rwcommon", "$USB_DIR/sda1/test");
        FilePlugind.Copy("/mtd_tlib", "$USB_DIR/sda1/test");
        FilePlugind.Copy("/mtd_rwarea", "$USB_DIR/sda1/test");
    onWatchDog();
continue load news page....

now , all patch can be done by revert way, just copy data to stick and copy it to TV back by the user application.

let see who first do C series.


Denny

[timoo]

gratulations ! ,i is same way i think about in this thread >> http://forum.samygo.tv/viewtopic.php?f= ... t=10#p7770 but i dont have enough js knowledges and you do it bevore me
btw: you could kill watchdog in firmware before dumping , could you dump $ upload exedsp for my ? im not by my tv now and idont want to wait to sunday :/

[juusso]

card2000
Thank you! now you are not alone!
Did you try to watchdog-off in Service Menu?

[Denny]

jup, just the normal api for read/write wont work, as the top default path is seted to /mtd_rwcommon/common . so u can not access files whitch are in other directorys.

exeDsp , it is 57MB big , have to see where to upload it.
will leave then link when uploaded.

denny