[How-To] Hacking C series TV. Models with Internet@TV only

[bastler0815]

Hi there,

finally after almost 1 day of trial and error ... I got my UE40C6700 roooted

Code: Select all

~ # ls -al --color
drwxr-xr-x   22 1000     100           446 Mar 11  2010 .
drwxr-xr-x   22 1000     100           446 Mar 11  2010 ..
lrwxrwxrwx    1 1000     100             9 Jan 23  2010 .info -> /dtv/info
-rwxrwxrwx    1 1000     100             9 Mar 11  2010 .version
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 Java -> mtd_exe/Java
drwxr-xr-x    2 1000     100           360 Jan 28  2010 bin
drwxrwxrwt    2 root     0              40 Jan  1 00:00 core
drwxr-xr-x   10 1000     100          3448 Oct 23  2009 dev
drwxrwxrwt    2 root     0              40 Jan  1 00:00 dsm
drwxrwxrwt    3 root     0             140 Jan  1 00:07 dtv
drwxr-xr-x    4 1000     100           203 Jan 30  2010 etc
drwxr-xr-x    3 1000     100           290 Nov 28  2009 lib
drwxr-xr-x    2 1000     100             3 Sep 15  2009 mnt
drwxr-xr-x   27 root     0             402 Jun 22  2010 mtd_appdata
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 mtd_boot -> etc/Scripts/
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_chmap -> mtd_rwarea
lrwxrwxrwx    1 1000     100             7 Jan 23  2010 mtd_cmmlib -> mtd_exe
drwxrwxrwx    1 root     0            1024 Jan  1 00:00 mtd_contents
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 mtd_down -> mtd_rwcommon
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_epg -> mtd_rwarea
drwxrwxrwx    4 root     0            8192 Jan  1 00:00 mtd_exe
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_factory -> mtd_rwarea
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_gemstar -> mtd_rwarea
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_mhp -> mtd_rwarea
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 mtd_moip -> mtd_rwcommon
lrwxrwxrwx    1 1000     100            10 Jan 23  2010 mtd_pers -> mtd_rwarea
lrwxrwxrwx    1 1000     100             3 Jan 23  2010 mtd_ram -> tmp
drwxrwxr-x    7 root     0             110 Mar 23  2010 mtd_rocommon
drwxrwxrwx    6 root     0            1024 Jan  1 00:57 mtd_rwarea
drwxrwxrwx    7 root     0            8192 Jan  1 00:00 mtd_rwcommon
drwxrwxrwx    1 root     0           16384 Jan  1 00:00 mtd_swu
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 mtd_wiselink -> mtd_rwcommon
lrwxrwxrwx    1 1000     100            12 Jan 23  2010 mtd_yahoo -> mtd_rwcommon
dr-xr-xr-x   47 root     0               0 Jan  1 00:00 proc
drwxr-xr-x    3 1000     100           531 Mar 11  2010 sbin
drwxr-xr-x   13 root     0               0 Jan  1 00:00 sys
drwxrwxrwt    2 root     0              40 Jan  1 00:00 tmp
drwxr-xr-x    5 1000     100            39 Sep 15  2009 usr

I don?t know why it didn?t just go like the description at post #1 but at least I succeeded! so now time to play

Regards, bastler

EDIT: I?ve another question ... probably someone has an Idea how to find out. As probably most of you know the UEXXC6700 has no USB PVR support ... but when you change the model to C6800 at the Service Menu this feature is enabled! So my Idea is/was if there is a way to find out what value/file is changed when the TV is switched to 6800 and then PVR is enabled so that this probably could be done by hand over telnet and that the TV type does not need to be changed ... Yes I know it may be the easier way to just change the Type of TV at the SM ... but I think it also would be interesting to be able to change this by hand over telnet ... probably anyone arround here has an idea how it could be possible to compare where the differences are when USB PVR is ON or OFF !?

[juusso]

Did you finaly as in post #1? or here are mistakes that must be corrected in this how-to?

[timoo]

imho changes in service menu is writen to mtd_exe / Factory_Part1.dat Factory_Part2.dat ty changing model comparing files ....

[timoo]

if you have telnet connection to your Tv you could downgrade firmware >> http://forum.samygo.tv/viewtopic.php?f= ... 8143#p8133

[bastler0815]

Hi there,

imho changes in service menu is writen to mtd_exe / Factory_Part1.dat Factory_Part2.dat ty changing model comparing files ....

Ok thank you for the tip I?ll probably take a closer look at this files

Another "problem" I have is about executing scripts from USB Stick ...

As I read I?ve telnet access to the TV ... but the way to enable it is a little bit boring ....

Code: Select all

#!/bin/sh

if !([ -e /mtd_rwarea/busybox ]); then
        cp $1/busybox /mtd_rwarea/
        chmod 777 /mtd_rwarea/busybox
        sync
fi
if !([ -e /mtd_rwarea/sh ]); then
        ln -s /mtd_rwarea/busybox /mtd_rwarea/sh
        chmod 777 /mtd_rwarea/sh
        sync
fi

mount -t devpts devpts /dev/pts
/mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh
sync

I have everything from this script installed by hand .... so the easier thing would be if the the script would be automatically executed when pluging in the USB Stick but so far it doesen?t work *hmpf*

The code at the run.sh looks like:

Code: Select all

#!/bin/sh
/mtd_rwarea/telnetd.sh &

The telnetd.sh is executeable (chmod 777) but it doesn?t get executed when pluging the Stick .... anyone has an Idea what I?m doing wrong ?

Another thing is ... only one command could get executed from the run.sh ... so I have to run all the commands to enable telnet step by step from the run.sh like:

1. mount -t devpts devpts /dev/pts

unplug Stick and change to 2nd command

2. /mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh

unplug again for entering 3rd command

3. sync

Anybody has an idea why this is like this ?!
It sureley would be easier to run the 3 commands by pluging the Stick once ... like

Code: Select all

#!/bin/sh
 mount -t devpts devpts /dev/pts
/mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh
 sync

But when the run.sh is like this telnet doesn?t get enabled when pluging the Stick .... at the moment I?m a little bit clueless why it doesn?t work ?!

Regards

Bastler

PS: So far I also have no idea how to enable internet@TV connection without having complete acces to the Serial Debug menue ... downgrading to other firmwares is not possible without telnet or USB access to execute commands or to copy files to the TV ...

EDIT: Where is the kernel located at the TV ?!
EDIT2: I tryed with 10041004 at the Serial console ... but at my TV set nothing seems to be happening even with touch /dtv/debug_on ...

[juusso]

You can use run.sh with this code directly:

Code: Select all

#!/bin/sh

if !([ -e /mtd_rwarea/busybox ]); then
        cp $1/busybox /mtd_rwarea/
        chmod 777 /mtd_rwarea/busybox
        sync
fi
if !([ -e /mtd_rwarea/sh ]); then
        ln -s /mtd_rwarea/busybox /mtd_rwarea/sh
        chmod 777 /mtd_rwarea/sh
        sync
fi

mount -t devpts devpts /dev/pts
/mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh
sync

It should run automatically. The trick with telnetd.sh seems do not work. Maybe this info solves your problem.

To run telnet at the first time you have to place busybox to USB with correct run.sh and attach USB. Next times you don`t need busybox on USB.

To get back debug mode, add this row below #!/bin/sh in run.sh:

Code: Select all

touch /dtv/debug_on

[bastler0815]

Hi,

Ok I solved the problem with the script not getting executed by USB ... As it is here if you have FAT32 only one comand gets executed (don?t know if this is normal) I tryed with an ext3 formated Stick with run.sh whith rights 777 and everything seems to work now. After plugging the Stick telnet is enabled

The other thing with the debug_on .... should it give any output ?
I created the file at /dtv but nothing seems to be happening ... tryed 10041004 end enter but no response so far!

Regards

EDIT: just an Idea ... what would happen if 3D options /settings get?s enabled at a TV which normally isn?t for 3D use ?!

EDIT2: Can anyone arround here probably post a dump of the file /mtd_exe/Factory_Part1.dat from a UEXXCXXXX. If yes would be nice to know which options are supported at this TV ... like PVR 3D and so on. Seems like there all the available options are switched on or off.

[bastler0815]

Hi,

thx for the hint!

I was not using Notepad or windows like Editor ... I always use Ultraedit ... but as you said ... I forgot to save the files in Unix style, was just to much to test yesterday and so I forgot to take care of it! ^^

And Yes would be a good Idea to take a notice to this at the first post!

Btw. I sae that here a "/" is missing at the first post from juuso:

Code: Select all

#!bin/sh
sh +x $1/telnetd.sh&

Dumping all the files at the moment ... but this take plenty of time

Regards, Bastler

[juusso]

Thank you, i corrected errors in the #1 post.

[bastler0815]

No prob

I did some tests about the Factory_Part1.dat and Factory_Part2.dat located in mtd_exe as it was looking that some settings which can be accessed from the Service Menue were Stored there.
I copied the 2 files with Ser. debugOFF to my PC and after that with Ser. Debug ON, after that I compared both files (with debug On and OFF) but they were exactly the same ... no differences were found!

So I think the data what options are used or blocked from the Service Menue or Model has to be stored somewhere else ... anybody some other Ideas ?!?!

Regards