Hacking T-RBYDEUC Firmware - LE40A756 and A856

[tom_van]

1) I'm not able to get debug output on RS232.
I used INFO-MENU-MUTE-POWER, navigated to Advanced, entered 0-0-0-0, then selected ?Control? and change ?Service Select? from Normal to Sti. This change does not seem to make any change on serial line, also after TV reboot ?Service Select? is set back to Normal.

Oh my God, I must have been blind: right item in Service menu is Advanced -> Adjust -> UART Select
and change from W.Mount to STi

I edited my previous message not to fool others.

[tom_van]

I can confirm entering to debug menu

Console work only on 57600 (you have to change speed, put debug on console and select 12 from menu).

Moreover if you grep Samsung's kernel source for "yongval", you'll see how creative are Koreans in crippling GNU software.
So you don't need slow down serial console if you add secret kernel parameter yongsik

You can save change in persistent uboot environment:
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

Code: Select all

setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 watchdog=4000 rxsize:512 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
setenv bootdelay 1
saveenv

With this setup serial console runs at 115200 Baud (8N1).
Type debug<Enter> in terminal and you into get debug menu.

[tom_van]

Good work, nobody. Well wouldn't be better to create a separate wiki page for SH4 models to avoid messing with ARM? You clearly stated the type of CPU, but the following and older part about T-SPHAUSC does not.

For the recovery, even if I get it to boot from USB, how to reinstall a good firmware ? Can you document this also in the WIKI ?

Using fsr tools from rootfs, /util directory. Or just replacing offending script if it is on writable partition. I'm afraid there is no universal recipe, your mileage may vary.
I'm not allowed to edit the wiki.

Erdem, how is the SH4 telnetd app? I don't need it personally, however it might be the most important thing to describe in wiki.

[erdem_ua]

I don't understand your question but you have wiki write access. Please change lines where is needed. THanks

[tom_van]

Erdem, I asked you for more info about telnetd application (enabler) for SH4 models, you mentioned:

AFAIK you can enable Telnet access with Telnetd Application.
I forget to put them download area. I wish I can put them tomorrow, you can find them in the forum.

Maybe I'm blind again, but in files area is just an old version Telnetd app for ARM models, which obviously
does not work on LE46A956.
I suppose that swf script can not copy a file from usb to mtd_rwarea so we need a .so "game" library compiled for SH4. Is it true?
Is the source code of libTelnetd.so available? Haven's seen it in SCM repo...

BTW I'm making slow progress toward video AR fix for SH4. I've got working gdbserver and analyzed SetDisplaySize() function at 0x56f43c(exeDSP).
I'll document it in wiki later.

[erdem_ua]

Maybe I'm blind again, but in files area is just an old version Telnetd app for ARM models, which obviously
does not work on LE46A956.
I suppose that swf script can not copy a file from usb to mtd_rwarea so we need a .so "game" library compiled for SH4. Is it true?
Is the source code of libTelnetd.so available? Haven's seen it in SCM repo...

BTW I'm making slow progress toward video AR fix for SH4. I've got working gdbserver and analyzed SetDisplaySize() function at 0x56f43c(exeDSP).
I'll document it in wiki later.

Telnet Application is for ARM, but Telnetd Application is for SH4.
I don't know anything about swf files. I think you can request telnetd's source code it from arris69. I don't touched the source.

[arris69]

Maybe I'm blind again, but in files area is just an old version Telnetd app for ARM models, which obviously
does not work on LE46A956.
I suppose that swf script can not copy a file from usb to mtd_rwarea so we need a .so "game" library compiled for SH4. Is it true?
Is the source code of libTelnetd.so available? Haven's seen it in SCM repo...

BTW I'm making slow progress toward video AR fix for SH4. I've got working gdbserver and analyzed SetDisplaySize() function at 0x56f43c(exeDSP).
I'll document it in wiki later.

Telnet Application is for ARM, but Telnetd Application is for SH4.
I don't know anything about swf files. I think you can request telnetd's source code it from arris69. I don't touched the source.

whole SamyGO-Extensions stuff is in svn, there is some info in wiki how to rebuild it for different architectures http://wiki.samygo.tv/index.php?title=S ... sions_Pack

i can't do more for sh4 arch until somebody donate me a tv

arris

[tom_van]

i can't do more for sh4 arch until somebody donate me a tv

Great idea! I send you my LE46A956 and I'll save a plenty of time.

Thx for info about OE. Actually I have checked out SamyGo OE two weeks ago,
but did not know that trunk is an old stuff and development going in the branch.
Well, little bit unusual... That's why I couldn't find SamyGOE.c and thought that there is no support for SH4.
Good work, I'll try SH4 OE (until now STLinux2.2 precompiled cross toolchain worked well for me)

Two posts here about running "Content" are quite contrary:

I'll post here what I found out about the "Content" menu on the A750.
It does not load executables, as the newer TVs do. Instead, the content

1) Must live in subdirectories named "SEC_GAME", "SEC_ART", "SEC_COOK" in the root of the memory stick.
2) Must be Flash files (.SWF extension)

and

AFAIK you can enable Telnet access with Telnetd Application.

Unfortunatelly n0ykg is right. He probably has an american model, but the same is valid for T-RBYDEUC.
To end rumors: T-RBYDEUC 1013 firmware does not execute .so games
I studied it in exeDSP binary: an easy patch can reenable browsing SEC_GAME folder.
When you select Telnetd app, instead of loading and executing .so lib a builtin game DBowling is run.
Although dl-load (.so library loader) code is included in binary, it wloudl'n be easy to patch missing code back.
There is no use of enabling .so anyway. I'm not aware of any binary game for that model and patching
dspEXE to use SamyGOE.c doesn't make any sense.

I wanted to use .so loading for injecting of new code into exeDSP for debugging.
Well, now I see it wasn't a wise idea.

And wait, Arris. Bad luck. My wife doesn't agree with such donating to open source community
Maybe next time.