[Report Back] about succesfuly restored bricked TV
Posted: Sat Sep 04, 2010 1:57 pm
Hello all,
i want to tell our experience of reanimation and restoring bricked le32b652T4W.
What was the problem: wrong commands were executed and by mistake tbml2 and tbml4 were erased and tbml5(kernel) partition was overwritten with dump image of u-boot. After TV restart TV went on directly to bootloader menu. There was another important option - Watchdog on service menu was ON
And TV was always restarting every 10 sec and no possibility to restore partitions from u-boot promt.
At first we have tried to boot kernel via u-boot from Fat32 formated USB using kernel made by SamyGO OpenEmbedded
(the process of making kernel was long, up to 12 hours...)
We discovered, that booting time from USB was quite long (uImage 17 sec and kernel 16 sec whole time was 33 sec), but the problem, we had just 10 sec at all to play with until TV resets. Then we tried to boot from tftp server and this way was quicker: uImage 3-4 sec and for kernel 14-15 sec. Full boot time until telnet starts and console shows request to login was 18 sec. To long too...
We needed to kill watchdog to have more time and finally it was done. Because there was no /mtd_boot/ mountig, MicomCtrl 23 command didn`t work at all. We copied MicomCtrl file from working system to rootfs on ext3 partition to /usr/sbin/ folder and modified /etc/init.d/busybox-telnetd script like:
After this we were able to stop Watchdog and get to console by pressing Ctrl+c :
Without pressing ctrl+c we didn`t stop Wachdog, not enought time.
Next task was more difficult as we thought before. The kernel from SamyGO OpenEmbedded was not fully working. There was no chance to restore or dump any partition, because on such compiled kernel were missing some modules for enabling NAND flash mode. (wiki).Copying these modules (coped from /mtd_boot/modules of working system - fsr.ko, rfs.ko and fsr_stl.ko) did not help: was unable to load them (there were a lot of errors about unknown symbols after insmod command). No NAND flash mode - no chance to recovery TV. Copying libraries from working Tvs /lib folder did not change anything. Some missing binaries were copied from /sbin and /bin. No success too.
Notice: we had full dumps of tbml1-tbml7 made earlier.
We have discovered, that after powered on, process of startup reads data from NAND flash and writes it to memory (DRAM) and from memory are partitions and all data further loading and starting TV. From partition table we got start addresses for kernel: 0x61000000 and for u-boot: 0x60200000.
Idea was to write needed partitions to right places of DRAM (not NAND) and boot TV. Because the OE kernel was not working for us, we needed another kernel. No knowledges about compilation of another kernel...
Then we used dump of tbml5 partition made with bml.dump before TV crush. Unchanged dump was not working and we got errors:
After few researches we used mkimage tool on linux computer and changed this tbml5 dump this way :
And swaped uImage from OE on tftp service directory with this tbml5 dump of original kernel.
From this moment all steps were made from u-boot promt:
1. bbm load kernel
2. cp 61000000 60200000 100000
3. go 60200000
4. setenv ipaddr 192.168.1.105;setenv gatewayip 192.168.1.1;setenv serverip 192.168.1.100
5. tftp
6. bootm
Finaly - after bootm command we got fully operating TV and we were able to connect via telnet and use tbml.restore commands to restore necessary deleted partitions.
Big hard work was made by Perforator from forum.ixbt.com with help of some forum users, and with advices from #samygo irc channel too. Thank you guys!
i want to tell our experience of reanimation and restoring bricked le32b652T4W.
What was the problem: wrong commands were executed and by mistake tbml2 and tbml4 were erased and tbml5(kernel) partition was overwritten with dump image of u-boot. After TV restart TV went on directly to bootloader menu. There was another important option - Watchdog on service menu was ON
And TV was always restarting every 10 sec and no possibility to restore partitions from u-boot promt.
At first we have tried to boot kernel via u-boot from Fat32 formated USB using kernel made by SamyGO OpenEmbedded
(the process of making kernel was long, up to 12 hours...)
We discovered, that booting time from USB was quite long (uImage 17 sec and kernel 16 sec whole time was 33 sec), but the problem, we had just 10 sec at all to play with until TV resets. Then we tried to boot from tftp server and this way was quicker: uImage 3-4 sec and for kernel 14-15 sec. Full boot time until telnet starts and console shows request to login was 18 sec. To long too...
We needed to kill watchdog to have more time and finally it was done. Because there was no /mtd_boot/ mountig, MicomCtrl 23 command didn`t work at all. We copied MicomCtrl file from working system to rootfs on ext3 partition to /usr/sbin/ folder and modified /etc/init.d/busybox-telnetd script like:
Code: Select all
#!/bin/sh
DAEMON=/usr/sbin/telnetd
NAME=telnetd
DESC="Busybox Telnet Daemon"
ARGS=""
test -f $DAEMON || exit 0
set -e
case "$1" in
start)
echo -n "Killing watchdog "
/usr/sbin/MicomCtrl 23
echo "done."
echo -n "Starting $DESC: $NAME... "
start-stop-daemon -S -b -n $NAME -a $DAEMON -- $ARGS
;;
stop)
echo -n "Stopping $DESC: $NAME... "
start-stop-daemon -K -n $NAME
echo "done."
;;
restart)
echo "Restarting $DESC: $NAME... "
$0 stop
$0 start
echo "done."
;;
reload)
echo -n "Reloading $DESC: $NAME... "
killall -HUP $(basename ${DAEMON})
echo "done."
;;
*)
echo "Usage: $0 {start|stop|restart|reload}"
exit 1
;;
esac
exit 0Code: Select all
...
Creating tmpfs at /dev
Populating /dev using mdev
Remounting root file system...
Configuring update-modules.
Configuring util-linux-ng.
update-alternatives: Linking //bin/dmesg to dmesg.util-linux-ng
update-alternatives: Linking //bin/kill to kill.util-linux-ng
Killing watchdog done.
Starting Busybox Telnet Daemon: telnetd...
SamyGO localhost ttyS1
localhost login:Next task was more difficult as we thought before. The kernel from SamyGO OpenEmbedded was not fully working. There was no chance to restore or dump any partition, because on such compiled kernel were missing some modules for enabling NAND flash mode. (wiki).Copying these modules (coped from /mtd_boot/modules of working system - fsr.ko, rfs.ko and fsr_stl.ko) did not help: was unable to load them (there were a lot of errors about unknown symbols after insmod command). No NAND flash mode - no chance to recovery TV. Copying libraries from working Tvs /lib folder did not change anything. Some missing binaries were copied from /sbin and /bin. No success too.
Notice: we had full dumps of tbml1-tbml7 made earlier.
We have discovered, that after powered on, process of startup reads data from NAND flash and writes it to memory (DRAM) and from memory are partitions and all data further loading and starting TV. From partition table we got start addresses for kernel: 0x61000000 and for u-boot: 0x60200000.
Idea was to write needed partitions to right places of DRAM (not NAND) and boot TV. Because the OE kernel was not working for us, we needed another kernel. No knowledges about compilation of another kernel...
Then we used dump of tbml5 partition made with bml.dump before TV crush. Unchanged dump was not working and we got errors:
Code: Select all
## Booting image at 61000000 ...
Bad Magic NumberCode: Select all
mkimage -A arm -O linux -T kernel -a 0x60008000 -e 0x60008000 -C none -n "Original Samsung Kernel" -d ./tbml5 uImageFrom this moment all steps were made from u-boot promt:
1. bbm load kernel
2. cp 61000000 60200000 100000
3. go 60200000
4. setenv ipaddr 192.168.1.105;setenv gatewayip 192.168.1.1;setenv serverip 192.168.1.100
5. tftp
6. bootm
Finaly - after bootm command we got fully operating TV and we were able to connect via telnet and use tbml.restore commands to restore necessary deleted partitions.
Big hard work was made by Perforator from forum.ixbt.com with help of some forum users, and with advices from #samygo irc channel too. Thank you guys!
