I have some ideas...
Almost unreal, but...
IDEA No1
1. Full console enabled kernel (need to find out the address to patch - almost done, but requires time)
2. Encrypt kernel and add it to firmware upgrade USB. Edit checksums.
3. Make your firmware upgrade procedure (until 87% of success. Big chance that kernel is rewritten in this case, because TV flashes it before firmware. Don`t worry about authuld, it reboots your TV already and nothing else to be done.
4. If success, might input filtration is removed (patched kernel) and you can access full shell over exlink. It is enough to toggle to good firmware. (or correct checksumms?)
Time should be enough to make job because we can
kill authuld:
and get extra ~3 mins.
It sounds a bit mystical, because i dont know if TV does not decline any upgrade (our needed kernel) if firmware upgrade interrupts (in your case on 87%).
IDEA No2
what if you remove some files from firmware upgrade USB, that is not needed to upgrade, eg. just leave only firmware files? I mean you could try to leave:
Code: Select all
appdata.sec
appdata.sec.cmac
appdata.sec.cs
appdata.sec.vs
exe.sec
exe.sec.cmac
exe.sec.cs
exe.sec.vs
info.txt
major_version
minor_version
validinfo.txt
version_info.txt
File validinfo.txt should be edited by removing all stuff except exe.img and appdata.img like here (look at your firmware!, don`t copy/paste from here)
Code: Select all
*007_exe.img_f1c3eb29*011_appdata.img_cd58a244*005
I don`t know if TV accepts this stripped firmware. And even i don`t know if TV does not brick fully by flashing only firmware files w/o kernel and rootfs. We spare 7Mb of flashing. Is that enough? I doubt, but it is worth to try.
You asked ideas - you got it. I can`t confirm i`m right. Might i`m totally wrong. But idean No2 is more realistic. If you have had an alternative firmware, then there is kernel and rootfs already. The question is - what is TV behavior when/if it understoods about missing parts of upgrade. B series would be ok with this situation, how about C series?