TOP Debug menu for C models via ExLink

[mamaich]

I'll share a bit of information i've found.
If you'll type:
20089999
after 10041004 via exlink, you'll get:

Code: Select all

    ====================================
          [ TOP Debug Menu]
    ------------------------------------
      1  : SubSystem Print On/Off
      2  : Platform Print Setting
      3  : TD Print Setting
      4  : Performance Print Setting
      5  : Sdal Print Setting
      6  : Sdal Trace Setting
      10 : Factory Debug
      11 : TD Debug
      12 : SubSystem DBG
      13 : SubSystem Info Print
      20 : Performance File Write
      21 : Louvre Print Setting
    ------------------------------------
      70 : Jade Debug
    ====================================
      99 : Exit
    ====================================

in p 11 you'll get the shell. But input is limited to 0-9, A-F, Backspace, ENTER.
Be very careful while playing with this menu. For example turning on "SubSystem Print" for all subsystems would cause your TV to overload exlink with messages and it would take you lots of time to turn it off.

[juusso]

Yes!
Samsung has finally fallen! Next step: how to avoid input restrictions in shell console?
By the way, what you have to input to get to shell console:

Code: Select all

10041004
20089999
11
20
SELP#> <--- here is it!

[mamaich]

Next step: how to avoid input restrictions in shell console?

According to kernel sources - you cannot. The only way to enable all characters on console is to flash debug firmware image. But where can we get it?

[cyberdemon79]

Hi there,

petergrey found a way to patch the character checking routine in memory using direct memory writes and only numbers.
You can find his post here: http://forum.samygo.tv/viewtopic.php?f= ... =tty#p5650
(this is for a B550 CI+ and can't be applied to a C series tv without further modifications).
DO NOT APPLY HIS SOLUTION DIRECTLY TO C-SERIES TVs, YOU MIGHT BREAK SOMETHING

I think that the C-series tvs also have to menu option "register & physical memory read/write".
The hard part is that you have to patch the routine using only numbers/numerical addresses (that are still given in hex),
clever patching is required.

The approach would be to guess where in memory the routine is located, read some bytes in sequence starting from
this address, start up IDA PRO or something similar and find where (in the kernel) you are. Then think about how you
can trick this check using only numbers.
It should be possible but not trivial.

cu Cyberdemon

[mamaich]

petergrey found a way to patch the character checking routine in memory using direct memory writes and only numbers.

A very clever idea, but unfortunately we on C5xx don't have physical memory editor, at least I was unable to find such menu items.