Page 5 of 7
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 8:22 pm
by juusso
honestly i don`t understand why do you modify both partition sets, it should be enough to edit only one of them...
Okey, let`s check your old bml10 (hashes for 2nd boot set)
Code: Select all
./chkhash -p 0 4 bml/bml10.dmp
hash[ 0] = 48f58bfa8050d88ea1757957dcf7ebc5 length = 89485312
hash[ 1] = 58036fe36c3fe1585613a94551ae9200 length = 41762816
hash[ 2] = 7ee4e537961aa0dec4953baed4adce99 length = 3712144
hash[ 3] = 9b8663050a8ffa3b6607ba931dbfbe2b length = 3665940
Your calculated hash for mtd_exe (or /dev/stl0/17) is
and new bml0/10
Code: Select all
./chkhash -p 0 4 bml/bml10.dmp
hash[ 0] = 658cc6dc8a924825b9d7c18d53c3ff87 length = 89485312
hash[ 1] = 58036fe36c3fe1585613a94551ae9200 length = 41762816
hash[ 2] = 7ee4e537961aa0dec4953baed4adce99 length = 3712144
hash[ 3] = 9b8663050a8ffa3b6607ba931dbfbe2b length = 3665940
So you have to perform
Code: Select all
bml.restore /dev/bml0/10 /dtv/usb/sda1/bml10.dmp
sync; sync
/sbin/toggle
if lucky and our theory is ok, TV should reboot (... by authuld) to normal mode
p.s. and just in case, bml9 updated.
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 8:27 pm
by hedak
The /dev/stl0/17/rc.local is 0 bytes. So i had to modify it anyway. And that's the only partition i want to change ATM
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 9:03 pm
by juusso
i hope that size of stl0/17 haven`t changed because of modifications... (size left not changed in hash partition - authuld checks hashes according that value)
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 9:57 pm
by hedak
Sadly after changing partitions it still reboots after 45 secs.
After first sw toggle try something went wrong when running the start.sh script as it was designed for 1st partition... So i toggled back via micom EEPROM write and then renamed start.sh to start.sh.bak.
After second sw toggle try tv still reboots after 45 secs
Log of first boot sequence after second sw toggle try, next boot and next boot with SamyGO stick plugged (at least i can be root for 10 secs) is attached. What unsettles me are all the i2c errors. I did definitively damage anything. Maybe i should remove all the wires still soldered (but isolated at the end, except micom eeprom)?
I thought about the stl0/17's size also, but how should that change? Isn't that fixed? Anyway, getting the size should be easy: make a dump and ls -lsa that dump, correct?
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 10:00 pm
by juusso
i think you have to:
-replace original rc.local (is not, or?)
-calculate hash and correct it via bml10.dmp
if failed, we have to find how to calculate corect size of stl0/17 and/or make stl.restore on that partition...
you cn`t get full dump of stl017 because you have not enough time for that.
I don`t think wires make any damage, but sure, you have to isolate them
btw:
Code: Select all
[DEV_ERROR ] [GetPartitionSize] invalid path : NONE
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Mon Jan 13, 2014 10:11 pm
by hedak
Ok, i will try to place the original rc.local you send me there and repeat the hash procedure tomorrow.
I think i already made a 60MB dump to /mtd_swu/. Using the start.sh on the first partition should make the whole dump possible without any problems - i will try
First i will try to dupm the /mtd_appdata/ partition and compare the partition sizes as its smaller and i definitively didn't touch it
In worst case i will try to repair first partition... As you know it's enough to have one partition working to have time for repairing the other section
BTW i checked logs from a time before i soldered - the i2c errors have always been there...
THX
Edit: Can i use sync and /sbin/toggle to toggle to first partition (instead of forced hw toggle)?
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Wed Jan 15, 2014 8:16 am
by juusso
yes, you can use toggle w/o arguments to switch partitions.
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Wed Jan 15, 2014 9:03 pm
by hedak
Just for information: work is still in progress!
(i toggled back to 1st partition to repair the 2nd partition)
Yesterday i found out that samsung_hash seems to calculate incorrect hashes - extracted 3011 FW (AESdec, XOR) and moved exe.img to TV, hash of both this image and untouched /mtd_appdata/ are incorrect. I think its caused by a wrong mkey samsung_hash uses: 66 d7 7c 3a 49 7f 53 e2 51 5e f1 4c 21 d6 a4 d8 (same as mackey!)
getmkey shows this mkey: 6f6bc7e1fc7f86bf9c150a82f343e2e0 (input key is: 66d77c3a497f53e2515ef14c21d6a4d8)
So maybe that's the reason why my TV still shuts down after 45 seconds.
Today i could transfer the dump of /dev/stl017 to my pc via ftp! I could see the end of exe.img within this dump (last 3.6MByte of dump are FF's) and that's exactly the size the original and the bml0/10 partition show. Tomorrow i will try to build chkhash on windows and check the hashes of original exe.img and if it matches the hash of my image
I will let you know!
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Wed Jan 15, 2014 9:07 pm
by juusso
don`t worry about FF! you`re absolutely right about hash calculations - empty space (FF) is being ignored. I prefer to cut out binary in hex, to don`t confuse myself.
Also you could transfer original decrypted exe.img and flash it.
ps. you can attach copy of stl, i`ll calculate hash for you
Re: Cycle reboot UE46C7700 - T-VALDEUC
Posted: Wed Jan 15, 2014 9:09 pm
by hedak
don`t worry about FF!
Excuse me, what do you mean?
Is there any tool ready to calculate the hash on pc (firmware patcher can not as i have seen)?
Original decrypted exe.img is already on tv and md5sum is correct. But there is not enough time to flash i suspect
I will upload it tomorrow as i have mobile internet right now only :/