So, I have access to TOP and shell on my T-MST4 LN32D550

[juusso]

Guys on ixbt tried to dump memory over memory read function. The goal was to find out address of kernel to patch it over function memory write, to get console unlocked. No success. I mean, no kernel found, need further research. For this aim some scripts were written to enable dump only clean code and filter extra debug output and so on.
So theoretically it is possible... But practically - not yet. AFAIK here is no active work on this. If interested, i can find more info for you.

[LLStarks]

Is there any way to dump RAM/ROM without root or hooking the chip up to a flasher?

Only other idea I have is to flood port 52235 with TCP requests and crash DLNA in hopes that I drop to bash or something.

[LLStarks]

How do I fix the garbage output? I get it with cu and Putty.

Code: Select all

 [ TD Debug Menu ]
------------------------------
 0x01`?qc D???
 0x02 ?\
          "???? 
 p??*T1?1???
 0x04 ?: SPCScreen Debug 
 0x05 ?: Sequence Test  
 0x06 ?:`?[?mute on/off  
 0x07  :`?VY??}????
 0x08 ?M?5???Debug
 0x09 ?>?*?E??}???5
                    ------------------------------
 0x20`???????Shell
 0x21 `: Get SDAL version
 0x22  : Get Kernel driver version
------------------------------
 0x99  : Exit Debug 
------------------------------

There's also this...

Code: Select all

  SDAL`Ver: 2.26.0.0
------------------------------------
(29) Read `Register 
(30) Write Register 

[LLStarks]

Here's a coredump I forced.

Not sure if it is worth anything.

http://pastebin.com/Ph9LiizA