[App] libUnencryptedGamePatch H

[370network]

Patch for H series to allow launching unencrypted .so native widgets, tested on a decrypted game from Samsung app store and custom built SDL app. With this patch you can build your own native widgets like back in the day on B series content library. You can figure out how to make such widget by decrypting a native game from the app store and this tutorial is still relevant as a headstart.

Notes:

• Has only been tested on H MST

Usage:

• You will need samyGOso
• Copy libUnencryptedGamePatch.so into /mnt/opt/privateer/usr/libso
• Copy 99_95_UnencryptedGamePatch.init into /mnt/etc/init.d to autostart or load manually with

  Code: Select all

  samyGOso -A -l /mnt/opt/privateer/usr/libso/libUnencryptedGamePatch.so

Caution:
The code is probably not of particularly high quality, I'm not very experienced with this sort of stuff. There are definitely better ways to implement it. It contains static offsets, modifies instructions, writes to read only memory... It shouldn't break the TV, it doesn't write anything to storage, but proceed with caution mainly if testing on other tv models.

[ZGod]

Ah wow, this is great! I've actually been trying to see if I could get these unecrypted games running. Is anybody building a collection of these? I should have a couple to share if anybody is interested!

[smarttvreseacher11]

hey ZGod, I'm interested in seeing them so could you share them?

[ZGod]

I managed to get some new things to work. First of all here is a Snake example that runs:
https://codeberg.org/jschwart/SdlSnakeforSamsungOrsay

I also found this Manic Miner over here: http://download.samygo.tv/B%20Series/Co ... (DEMO).zip
This needs a slight patch. Get patchelf and run use it as follows:

Code: Select all

patchelf --add-needed libSDL.so miner.so

Add a proper config.xml so that it will show up in Smart Hub and it will start up and show some moving text. Any button press will return back to the Smart Hub. I don't know if this is intentional.

Another game Dynamic Bowling can be found here: http://download.samygo.tv/C%20Series/Fo ... _Serie.zip
Inside this archive look for this directory: Rel_C_Serie/GGame/game/DBowling/
It seems this game relies on SDL and SDL mixer, so add both:

Code: Select all

patchelf --add-needed libSDL.so game.so
patchelf --add-needed libSDL_mixer.so game.so

I also needed to put another comfig.xml in place. The included one doesn't seem to work with the newer smart hub. But once it shows up, it will start up and you can access the how to play information. Unfortunately trying to start the game will bring you back to Smart Hub. I guess the game crashes, but I don't know how to find out the problem.

It seems that older series handled the SDL libraries differently. I guess GPlayer there already loads multiple SDL libraries. On H series this needs to be done explicitly.

hey ZGod, I'm interested in seeing them so could you share them?

Did you still manage to do anything with the games I sent you?

[370network]

I guess the game crashes, but I don't know how to find out the problem.

You can see a bunch of stuff the tv logs by running this

Code: Select all

while true; do cat /proc/dtvlogd; done

Do not know if it will be of any help but you can try and look there

[ZGod]

Ah, that's indeed interesting. for Dynamic Bowling I end up with:

Code: Select all

# GPlayer_Process: unhandled page fault (11) at 0x00000018, code 0x817
[show_info] It's not show_info() case for Process Name[GPlayer_Process], Thread Name[GPlayer_Process], PC = 0xb5d354f0, LR = 0xb5d371c8 .
##### send signal from KERNEL, SIG : 11, GPlayer_Process, PID:3108, force_sig_info 
Backtrace: 
Function entered at [<c00164e8>] from [<c029ece0>]
 r6:0000000b r5:0000000b r4:c28b2580 r3:c036e940
Function entered at [<c029ecc8>] from [<c0035980>]
Function entered at [<c0035944>] from [<c001a334>]
 r8:00030001 r7:00000817 r6:0000000b r5:00000018 r4:c28b2580
Function entered at [<c001a2ac>] from [<c001a614>]
Function entered at [<c001a48c>] from [<c0008364>]
Function entered at [<c0008328>] from [<c0012df8>]
Exception stack(0xcbc29fb0 to 0xcbc29ff8)
9fa0:                                     00000000 00000000 00000004 b5d4d184
9fc0: b5d4db94 00000000 b5d4db94 b5d4db98 00000000 00000000 b5d4db94 b5d4d940
9fe0: b5d354f0 bded9e10 b5d371c8 b5d354f0 600f0150 ffffffff ffffffff
 r8:00000000 r7:b5d4db98 r6:ffffffff r5:600f0150 r4:b5d354f0
##### send signal SIG : 11, GPlayer_Process(3108)->GPlayer_Process(3108) __send_signal
##### deliver signal SIG : 11, GPlayer_Process(3108) get_signal_to_deliver
[VDLP COREDUMP] SIGNR:11

##### deliver signal SIG : 9, TZManager_MainT(3109) get_signal_to_deliver
##### deliver signal SIG : 9, PCAlarmManager(3110) get_signal_to_deliver
##### deliver signal SIG : 9, PCDebugThread(3112) get_signal_to_deliver
##### deliver signal SIG : 9, [BT]GPlayer_#2(3113) get_signal_to_deliver
##### deliver signal SIG : 9, GPlayer_Process(3117) get_signal_to_deliver
##### deliver signal SIG : 9, [BT]GPlayer_#1(3111) get_signal_to_deliver
##### deliver signal SIG : 9, SerializeEventN(3114) get_signal_to_deliver
##### deliver signal SIG : 9, Debug Setting s(3115) get_signal_to_deliver
##### deliver signal SIG : 9, GPlayer_Process(3116) get_signal_to_deliver
##### deliver signal SIG : 9, GPlayer_Process(3118) get_signal_to_deliver
minimal core: Deleting 130.xeyes.xeyes.2103.2103.mcore
***** Create small coredump file /mtd_rwcommon/error_log/140.GPlayer_Process.GPlayer_Process.3108.3108.mcore ******
including addr range 0xfffff000 to 0x00002000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xb5d4c000 to 0xb5d4f000
including addr range 0xffffe000 to 0x00001000
Merging 0xb5d4c000-0xb5d4f000 0xb5d4c000-0xb5d4f000
Merging 0xb5d4c000-0xb5d4f000 0xb5d4c000-0xb5d4f000
Merging 0xb5d4c000-0xb5d4f000 0xb5d4c000-0xb5d4f000
Merging 0xb5d4c000-0xb5d4f000 0xb5d4c000-0xb5d4f000
Merging 0xb5d4c000-0xb5d4f000 0xb5d4c000-0xb5d4f000
Including vma range 0xb5d4c000-0xb5d4f000
VMAs dumped for ARM GP register pointers = 1
small Coredump: finished dumping small core /mtd_rwcommon/error_log/140.GPlayer_Process.GPlayer_Process.3108.3108.mcore
UMP<2>: Session closed
binder: send failed reply for transaction 96071 to 141:3107

When I attach gdb to GPlayer_Process, I get:

Code: Select all

#0  0x9fcce4f0 in MenuObj::SetHandicap(int) () from /dtv/game.so
#1  0x9fcd01c8 in DrawMenuObjects() () from /dtv/game.so
#2  0x9fcd0888 in MenuProc() () from /dtv/game.so
#3  0x9fccdc08 in Game_Main () from /dtv/game.so
#4  0x00048898 in Main() ()
#5  0x00048010 in main ()

And Manic Miner crashes too:

Code: Select all

GPlayer_Process: unhandled page fault (11) at 0xffffffe8, code 0x817
[show_info] It's not show_info() case for Process Name[GPlayer_Process], Thread Name[GPlayer_Process], PC = 0xb5d12ad8, LR = 0x9ff39440 .
##### send signal from KERNEL, SIG : 11, GPlayer_Process, PID:3411, force_sig_info 
Backtrace: 
Function entered at [<c00164e8>] from [<c029ece0>]
 r6:0000000b r5:0000000b r4:c3196260 r3:c036e940
Function entered at [<c029ecc8>] from [<c0035980>]
Function entered at [<c0035944>] from [<c001a334>]
 r8:00030001 r7:00000817 r6:0000000b r5:ffffffe8 r4:c3196260
Function entered at [<c001a2ac>] from [<c001a614>]
Function entered at [<c001a48c>] from [<c0008364>]
Function entered at [<c0008328>] from [<c0012df8>]
Exception stack(0xccf5bfb0 to 0xccf5bff8)
bfa0:                                     00000004 00000000 00000001 00000004
bfc0: 00d06b60 001b95e4 be038edc be038ee4 be038ef0 b560052c 00cbb008 00000000
bfe0: 00000000 be038d70 9ff39440 b5d12ad8 600f0150 ffffffff 00000000
 r8:be038ef0 r7:be038ee4 r6:ffffffff r5:600f0150 r4:b5d12ad8
##### send signal SIG : 11, GPlayer_Process(3411)->GPlayer_Process(3411) __send_signal
##### deliver signal SIG : 11, GPlayer_Process(3411) get_signal_to_deliver
[VDLP COREDUMP] SIGNR:11

##### deliver signal SIG : 9, TZManager_MainT(3412) get_signal_to_deliver
##### deliver signal SIG : 9, [BT]GPlayer_#2(3416) get_signal_to_deliver
##### deliver signal SIG : 9, PCAlarmManager(3413) get_signal_to_deliver
##### deliver signal SIG : 9, PCDebugThread(3415) get_signal_to_deliver
##### deliver signal SIG : 9, Debug Setting s(3418) get_signal_to_deliver
##### deliver signal SIG : 9, [BT]GPlayer_#1(3414) get_signal_to_deliver
##### deliver signal SIG : 9, GPlayer_Process(3420) get_signal_to_deliver
##### deliver signal SIG : 9, SerializeEventN(3417) get_signal_to_deliver
##### deliver signal SIG : 9, GPlayer_Process(3419) get_signal_to_deliver
minimal core: Deleting 131.GPlayer_Process.GPlayer_Process.2227.2227.mcore
***** Create small coredump file /mtd_rwcommon/error_log/141.GPlayer_Process.GPlayer_Process.3411.3411.mcore ******
including addr range 0xfffff000 to 0x00002000
including addr range 0xfffff000 to 0x00002000
including addr range 0xfffff000 to 0x00002000
including addr range 0x001b8000 to 0x001bb000
including addr range 0x00cba000 to 0x00cbd000
including addr range 0xb55ff000 to 0xb5602000
including addr range 0xffffe000 to 0x00001000
Rm overlap pge 0xb55ff000 0xb4dff000-0xb5600000
Including vma range 0x001b8000-0x001bb000
Including vma range 0x00cba000-0x00cbd000
Including vma range 0x00d05000-0x00d08000
Including vma range 0xb5600000-0xb5602000
VMAs dumped for ARM GP register pointers = 4
small Coredump: finished dumping small core /mtd_rwcommon/error_log/141.GPlayer_Process.GPlayer_Process.3411.3411.mcore
binder: send failed reply for transaction 109480 to 141:3410
UMP<2>: Session closed
Mali<2>: Session has ended

bt in gdb gave me:

Code: Select all

#0  0x9fffbad8 in Game_Main () from /dtv/miner.so

I also tried the Samsung port of ScummVM, but it crashes here for me:

Code: Select all

#0  0x9fcc5c28 in Common::BaseString<char>::incRefCount() const () from /dtv/scummvm.so
#1  0x9fcc2c60 in Common::BaseString<char>::BaseString(Common::BaseString<char> const&) ()
   from /dtv/scummvm.so
#2  0x9f86048c in Common::String::String(Common::String const&) () from /dtv/scummvm.so
#3  0x9fcb3d0c in Common::Path::toString(char) const () from /dtv/scummvm.so
#4  0x9fca2254 in Common::FSNode::FSNode(Common::Path const&) () from /dtv/scummvm.so
#5  0x9fcd45f4 in OSystem::createConfigReadStream() () from /dtv/scummvm.so
#6  0x9fc943b4 in Common::ConfigManager::loadDefaultConfigFile(Common::Path const&) ()
   from /dtv/scummvm.so
#7  0x9f8713ac in scummvm_main () from /dtv/scummvm.so
#8  0x9f86e008 in Game_Main () from /dtv/scummvm.so
#9  0x00048898 in Main() ()
#10 0x00048010 in main ()

It seems there's an issue when it tries to load the configuration.