Hotel hack for Smarthub-less TVs?

[LLStarks]

Samsung has really gone out of their way to make their LCD D-series models a pain in the ass to hack.

I've been playing around with Hotel Mode and I'm finding that maybe things aren't so helpless. The largest barrier is that Clone From USB and Clone To USB are restricted to FAT sticks. No symlinks whatsoever.

Understanding this limitation, if I modify Clone.dat, and add files to the stick, the TV will readily Clone From USB.

My problem is that I have no idea of the files already present in /mtd_rwarea (beyond those mentioned in Clone.dat and PartitionSwitch) or whether the files I designate in Clone.dat get placed on the TV. Furthermore, even if the files are successfully placed on the TV, I have no means to execute them as scripts. Ex-Link output hasn't been all that helpful.

Any ideas?

[juusso]

we know how to remove symbol filtration on arm devices (for C series). Also full console unlock patch is available for arm D series models. CHeck your kernel on IDA and search for 19 symbol checking routine.
I we could find the place of kernel in ram, then we could try to patch it. Here are some ideas to check (also compilled kernel and ~place where to patch), but as i said already - kernels address is unknown.

[LLStarks]

The ixbt guys seem to be on the right track with finding the place to patch by using some rather nice python scripts for exlink. Results are inconclusive.

Maybe jtag is the only option.

[LLStarks]

http://forum.ixbt.com/topic.cgi?id=62:19120-134

Discussion is getting pretty interesting.

If I understand correctly (probably don't since I don't know Russian), rc.local will load /mtd_rwarea/start.sh (if it exists) instead of exeDSP directly. If we clone a modified rc.local as start.sh along with a yet to be determined samygo.sh, maybe the TV won't brick.

Here's the T-MST4DEUC rc.local for reference:

Code: Select all

#!/mtd_exe/rc.local

echo "/mtd_exe/rc.local start !!!!!"

# insmod chip driver
insmod /mtd_exe/samsung_mstar.ko

# FastLogo
/mtd_exe/Fastlogo.sh

export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_DUMMY_WIDGET_PATH=/mtd_appdata/SmartTV
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib:/mtd_cmmlib/OIPF
export LD_LIBRARY_PATH=/mtd_cmmlib/InfoLink/lib/plugin/Static:/mtd_cmmlib/InfoLink/lib:/mtd_cmmlib/OIPF:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_exe:/mtd_exe/Comp_LIB:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_appdata/Java/lib:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_cmmlib/YWidget_LIB:/mtd_contents:$LD_LIBRARY_PATH
export LD_LIBRARY_PATH=/mtd_cmmlib/GAME_LIB:/dtv:$LD_LIBRARY_PATH
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null #Remove engine logging.
export KF_NO_LOG=1

#====================================
# For CairoOnShadow

export LD_LIBRARY_PATH=/mtd_rocommon/Runtime/lib/CairoShadow:/mtd_rocommon/Runtime/lib:$LD_LIBRARY_PATH
export FONTCONFIG_PATH=/mtd_rocommon/Runtime/fonts
export FONTCONFIG_FILE=/mtd_rocommon/Runtime/fonts/fonts.conf
export PATH=$PATH:/mtd_rocommon/Runtime/bin
#====================================

ulimit -c unlimited

if [ -f /mtd_rwarea/start.sh ];
then
	/mtd_rwarea/start.sh
else
	cd /mtd_exe/
	./exeDSP
fi

[juusso]

Actually i don`t like to double post in different forums...
Briefly (additional to my post on ixbt):

Problems:
1. You cant copy start.sh to /mtd_rwarea and get it same name. You get start.sh_clone or start.sh_temp.
For this we used ext3 filesystem and symlinks.
2. We need give execution rights for this file if we find a way to place it in right name. On c series we used already right chmoded file on ext3 formatted usb pen.

If you get success on 1., but get start.sh in wrong rights, then brick.

[LLStarks]

Then I assume 1. is a dead end since the TV doesn't mount ext3 partitions.

[juusso]

insufficient. TV recognizes NTFS symlinks as files. But not target files.

[LLStarks]

Any suggestions for how I should I approach the language barrier? I'm very interested in following and contributing to the discussion but online translators are pretty weak. Don't want to piss people off.

[juusso]

Got it
http://forum.ixbt.com/topic.cgi?id=62:19120-135#4421

modified HotelMode hack can be applied to D5 and D6 series!
So - HospitalityMode hack for D5xx(x) is coming

all what is neeeded - use xfs file system instead of ext3 to import start.sh with required rights.

Anyone - be verry carefull, else you get bootloop without hope to repair.