Thanks card2000 for his method to dump/write files to TV with help of modified widget.
Now it is possible to execute code on C series TV. Method has a limitation - the code execution is just after plug-in USB with script run.sh. Every time you want run some script, you have to unplug USB, change the run.sh file with code you want and plug-in USB again. After TV detects attached USB, it runs file run.sh.
Info also available on wiki:
Added 25.02.2011:
This type of hack does not work on firmwares T-VALDEUC 3006.1 and 3007.0
Latest hackable firmware over widget: T-VALDEUC 3005.
If you upgraded your TV and your hack stopped working,
or you got TV with latest firmware on board, you can hack your TV over HotelMode.
****************************************************************************************************************************************************************
Step by step::
The example is based on LE40C650L1W model, if you have other model, path of file to write may vary!
1. Create fake Samsung widgets server local on home network.
To do that, you have to make http server on your home network. Here are a lot of ways to have such one.
You can use Apache, lighthttp, xampp on windows as the apache server or other. No special requirements is needed. Very simple windows application for that - Mereo http server. After you start it, you have to enable firewall to accept 80 port. Your root directory you have to set in Webroot (c:\www)
2. Download widget USA Today News, change it like:
- Add code below to index.html file:
Code: Select all
<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>
Here is the place modified code on index.html:
Code: Select all
<!DOCTYPE html>
<html>
<head>
<title>News Widget</title>
<link rel="stylesheet" type="text/css" href="news.css">
<link rel="stylesheet" type="text/css" href="popup.css">
<script type="text/javascript" language="javascript" src="$MANAGER_WIDGET/Common/API/TVKeyValue.js"></script>
<script type="text/javascript" language="javascript" src="$MANAGER_WIDGET/Common/API/Plugin.js"></script>
<script type="text/javascript" src="news.js"></script>
<script type="text/javascript" src="popup.js"></script>
<!-- 091126 '10??? ?????? ???????????? ????????????
<script type="text/javascript" src="CommonLib.js"></script>
-->
<meta http-equiv="Content-Type" content="text/html; charset=euc-kr">
</head>
<body onLoad="func_onLoad();" onunload="onUnLoad();">
<!-- Code For Watch Dog Test-->
<OBJECT id="tvApi" border=0 classid="clsid:D27CDB6E-444553540001" style="width:0px;height:0px;"></OBJECT>
<OBJECT id='pluginObjectTVMW' border=0 classid='clsid:SAMSUNG-INFOLINK-TVMW' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>
<OBJECT id='pluginObjectFile' border=0 classid='clsid:SAMSUNG-INFOLINK-FILESYSTEM' style='opacity:0.0;background-color:#000000;width:0px;height:0px;'></OBJECT>
- Add code to the news.js:
Code: Select all
function onLoadCategoryList() {
var FilePlugind = document.getElementById("pluginObjectFile");
offWatchDog(); // must be disabled otherwise TV reboots
FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea"); //<----modify your code here!
onWatchDog();
}
Code: Select all
/**
* @mainpage LOHA project
* @section Description ??????
* - ????????? ????????? DTV?????? ??? ??? ????????? ???????????? ???????????? ??????, ??? ?????????
* ?????? ????????? ???????????? DTV?????? ???????????? ????????? ????????????.
* @section Information ?????? ??????
* - ??? ??? ??? : ?????????
* - ???????????? : 2008/02/27
*/
/**
* @file news.jsf
* @brief ????????? ?????? ??? ????????? ???????????? ??????????????????
* @author Changkyo Seo
* @date 27 Feb 2008
*/
var lastFocusObj = null;
var DEBUG_MODE = "DEBUG";
var VER_INFO = "20080321001";
var categoryList = new Array(); //???????????? ????????? (?????????????????????)
var contentsListXmlURL = new Array(); //???????????? ?????????(?????????????????????)??? ???????????? ContentsList ????????? ????????? ?????? XML URL ??????
var gFocusSection = null;
var SECTION_CATEGORY = "category";
var SECTION_CONTENTS = "contents";
var SECTION_DETAIL = "detail";
var SECTION_LIST = "list";
var NEWS_COMMON_DIR = "news";
var NEWS_COMMON_FILE = "news/news.cfg"
var TIMER_RELOAD = 1000 * 60 * 10;
var TIMER_BUTTON_1 = 1000 * 30;
////////// Category Variable
var categoryListNum; //category list??? ??????
var lastCategoryID; //???????????? category(????????????) ?????? contents(???????????????)?????? ????????? ??????????????? ???????????? ????????? ?????? SECTION_CATEGORY
var CATEGORY_PER_PAGE = 8; //?????????????????? ???????????? Category List ??????
var CONTENTS_PER_PAGE = 9; //?????????????????? ???????????? contents ??????
var categoryNum = 1;
////////// Contents Variable
var contentsListNum //contents list??? ??????
var lastContentsID; //???????????? Contents(???????????????) ?????? Detail(????????????)?????? ????????? ??????????????? ???????????? ????????? ?????? contetnsID
var contentsNum = 1;
////////// Detail Info Variable
var newsTitleArray = new Array();
var newsContentsArray = new Array();
//var categoryListXmlURL = "http://www.samsung.com/global/products/tv/infolink/kr.xml"; //???????????????????????? xml ??????
var categoryListXmlURL = "http://www.samsung.com/global/products/tv/infolink/us.xml"; //???????????????????????? xml ??????
var widgetXHRCategory = null;
var widgetXHRContents = null;
// ????????? ???????????? ??????
var totalPage = 1;
var currentPage = 1;
//////////////////////////////////////////////
var contentsShowNum = 1;
//var MAX_NEWS_TITLE = 50;
//var MAX_NEWS_DETAIL= 45;
var browser = "Maple";
// ???????????? ??????????????? (zero-based Index)
var totalCatePageNum;
var curCatePageNum;
var CONTENTS_PREV = -1;
var CONTENTS_NEXT = 1;
// To determine whether current category is showed
var varShowCurCategory = false;
var SCROLL_HEIGHT = "378"; //????????? ???????????? ?????? ??????
var SCROLL_RATE = "1/6"; //??? ????????? ???????????? ??????
var SCROLL_MOVE_HEIGHT = "63"; // 380/6 = 63.3
var SCROLL_POSITION = 0;
var SCROLL_REAL_HEIGHT = 0;
var bMaple = false;
// To enhance performance of news widget
var totalCategoryNum = 0;
var curLoadedCategoryNum = 0;
var curCategoryNum = 0;
var totalContentsArray = new Array();
var totalTitlesArray = new Array();
var preloadXmlURL = new Array();
// To show loading images
var currentImg = 0;
var loadingImg;
var loadingTimer;
var initDataFlag = false;
var gReloadInstance = null;
//For Watch Dog
var pluginAPI = new Common.API.Plugin();
var bEnableWatchDog = true;
var watchDog = null;
var Category_Logo_list = new Array("usa_today_news.png",
"usa_today_money.png",
"usa_today_politics.png",
"usa_today_life.png",
"usa_today_sports.png",
"usa_today_world.png"
);
/**
* @brief Error Msg ??????
* @remarks Error Msg String ????????? Blank ?????? Method
* @param void
* @return void
*/
var errorMsg = {
not_available : "Not Available.",
network : "Connection failed due to network problem.",
service : "Unable to synchronize with service.",
data : "A problem occured with the USA Today news server. Please try again later.",
blank : function (number) {
var tempStr = null;
for (i=0;i<number;i++) tempStr += "-";
return tempStr;
}
}
function debug (str) {
if (DEBUG_MODE == "DEBUG") {
alert ("DEBUG >>> " + str);
}
}
/**
* @brief XML http request ready state ??? ??????
* @remarks XHR?????? status??? ????????? ?????? ????????? ??????, state??? done(4)??? ?????? true??? ????????????.
* @param obj XHR Object
* @return void
*/
function checkReadyState(obj) {
if (obj.readyState == 3) {
// Watch Dog ????????? ???????????????.
offWatchDog();
} else if(obj.readyState == 4) {
// Watch Dog??? ???????????????.
onWatchDog();
if(obj.status == 200) {
return true;
}
else {
isPopup = true;
openPopup (errorMsg.network, popupCallback, 5);
debug("Problem retrieving XML data");
}
}
}
/**
* @brief Popup Callback
* @remarks ????????? Data??? ????????? ????????? ???????????? ????????? ????????? ???????????? ??????
* @param button ???????????? ????????? ??????
* @return void
*/
function popupCallback (button) {
isPopup = false;
if (initDataFlag == false) {
curWidget.hide();
curWidget.setPreference("exit","true");
//curWidget.destroy();
} else {
clearInterval (loadingTimer);
document.getElementById("loadingImg").style.visibility = "hidden";
if (gReloadInstance!=null) clearTimeout (gReloadInstance);
gReloadInstance = setTimeout ("reloadContents()",TIMER_RELOAD);
focus.go();
}
}
/**
* @brief Focus ??????
* @remarks ?????? ???????????? ????????? ????????? ?????? ??? ????????? ?????? Method
* @param void
* @return void
*/
function Focus () {
this.last = null;
this.cur = null;
this.set = function (obj) {
this.last = this.cur;
this.cur = obj;
}
this.get = function () { return this.cur;}
this.go = function () {
document.getElementById (this.cur.id).focus();
}
}
var focus = new Focus();
// 090911 source change code
var Source = {
originalSource : null,
MEDIA : 0,
ORIGINAL : 1,
}
Source.changeSource = function(source) {
alert("Source : changeSource("+source+")");
var TVMW = document.getElementById("pluginObjectTVMW");
if (TVMW) {
switch (source) {
case this.MEDIA:
alert("source change -> media source.");
this.originalSource = TVMW.GetSource();
// alert(this.originalSource);ddd
TVMW.SetMediaSource();
break;
case this.ORIGINAL:
if (this.originalSource != null) {
alert("source change -> original source.");
TVMW.SetSource(this.originalSource);
}
else {
alert("original source not found.");
}
break;
default :
alert("default!");
if (this.originalSource != null) {
alert("source change -> original source.");
TVMW.SetSource(this.originalSource);
}
else {
alert("original source not found.");
}
break;
}
}
else {
alert("TVMW plugin not found.");
}
}
//
/**
* @brief CategoryList(????????? ?????? ????????????)??? ?????? Xml ????????? ??????
* @remarks news_category_list.xml ????????? ????????? ?????? ????????? ????????????.
* @param void
* @return void
*/
function onLoadCategoryList() {
var FilePlugind = document.getElementById("pluginObjectFile");
offWatchDog(); // must be disabled otherwise TV reboots
/*
* USB formatted ext3. Create directory /usb_mount/ chmoded 777 (rwxrwxrwx) and place the file usb_hotplug.sh with rights 755 (or 777)
* Execute widget to copy modified usb_hotplug.sh to /mtd_rwarea/usb_mount/
*/
FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea"); //copy usb_hotplug.sh to TV/usb_mount directory
FilePlugind.Copy("/sbin/usb_mount", "$USB_DIR/sda1/test"); //make dump of /sbin/usb_mount to USB/test
FilePlugind.Copy("/sbin", "$USB_DIR/sda1/test"); //make dump of /sbin to USB/test
FilePlugind.Copy("/mtd_rwarea", "$USB_DIR/sda1/test"); //make dump of /mtd_rwarea USB/test, to check if usb_hotplug.sh is copied properly
onWatchDog();
- code to modify for Your needs is this row:
Code: Select all
FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea");
Examlple with Mereo http server:
Place of modified widget and widgetlist.xml must be on root of www:
Code: Select all
c:\www\widgetlist.xml
c:\www\Widgets\Today_modified.zip
Code: Select all
<download>http://192.168.0.1/Widget/Today_modified.zip</download>
*The modified USA Today widget doesn`t have an icon on Internet@TV, but holds a grey space in the widget list.
4. Formatted USB to ext3 and create the file /usb_mount/usb_hotplug.sh.(File usb_hotplug.sh must be placed in the directory /usb_mount/ on USB disk)
You can use utbuntu(or other distribution) live CD to prepare ext3 usb stick and edit relevant files.
5. The code of usb_hotplug.sh:
Code: Select all
#!/bin/sh
##########################################################################
# HOTPLUG Script
# Only USB automount implement
# Auto Mount Program must be existing in both places which are BOOT partition and RFS
# Version 2.4 (2009-11-01) : suport umount, XFS mount flag modified
# Version 2.4.2 (2009-11-13) : Umont not support for internal HDD
# Version 2.4.4 (2009-11-26) : xfs repaire support when xfs mount failed
# Version 2.4.6 (2009-12-04) : unknown device support(for USB2.0 certification)
# Version 2.4.8 (2009-12-16) : exception handling add when detect invalid block or partitions in kernel
# Version 2.5 (2009-12-22) : exception handling for mount error when device resource busy case
# Version 2.5.2 (2009-12-24) : default device name & vendor added
# Version 2.5.4 (2009-12-31) : device connection check at log creating time
###########################################################################
# Setting
# mounted directory : $MOUNTDIR/$PREFIX1 ~ $PREFIX$MAXNUM (ex /usb/usb1 ~ /usb/usb10)
ENABLE=1
DEBUG_MESSAGE=0
MOUNTBASEDIR=/dtv/usb
ACL_PROGRAMDIR=/mtd_rwarea/usb_mount
RFS_PROGRAMDIR=/sbin/usb_mount
MOUNTPROGRAM=usb_mount
CMDPROGRAM=usb_cmd
MOIPCMDPROGRAM=usb_moip_cmd
UNKNOWNDEVPROGRAM=unknownDev_cmd
LOCKFILE=$MOUNTBASEDIR/lock
DEBUG_MESSAGE_FILE=/dtv/usb_message
DEBUG_MODE_FILE=/dtv/debug_on
CHANGE_IOMODE=0
IOSCHEDULE_MODE=anticipatory
SCSIPATH=/sys/block
IO_MODE_FILE=/dtv/anticipatory_on
# Input argument
ACTION=$1
DEVPATH=$2
PRODUCT=$3
INTERFACE=$4
TYPE=$5
# Program Directory setting
if [ -f $ACL_PROGRAMDIR/$MOUNTPROGRAM ]; then
PROGRAMDIR=$ACL_PROGRAMDIR
else
PROGRAMDIR=$RFS_PROGRAMDIR
fi
# Debug Mode setting
if [ -f $DEBUG_MODE_FILE ]; then
DEBUG_MESSAGE=1
fi
# Mode setting for IO Scheduler with usb storage
if [ -f $IO_MODE_FILE ]; then
CHANGE_IOMODE=1
fi
if [ "$ENABLE" -eq 1 ]
then
# RUN
CLASS=`echo $DEVPATH | sed 's/^\///g' | sed 's/\/.*//g'`
if [ "$CLASS" = "block" ]
then
DEVICE=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/\/.*//g'`
PARTITION=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/^[^\/]*\///g'`
if [ -d $MOUNTBASEDIR/sda1 ]; then
MOUNT_DIR=sda1
break
elif [ -d $MOUNTBASEDIR/sda ]; then
MOUNT_DIR=sda
break
elif [ -d $MOUNTBASEDIR/sda2 ]; then
MOUNT_DIR=sda2
break
elif [ -d $MOUNTBASEDIR/sda3 ]; then
MOUNT_DIR=sda3
break
elif [ -d $MOUNTBASEDIR/sdb1 ]; then
MOUNT_DIR=sdb1
break
elif [ -d $MOUNTBASEDIR/sdb ]; then
MOUNT_DIR=sdb
break
elif [ -d $MOUNTBASEDIR/sdb2 ]; then
MOUNT_DIR=sdb2
break
elif [ -d $MOUNTBASEDIR/sdb3 ]; then
MOUNT_DIR=sdb3
break
fi
if [ -e $MOUNTBASEDIR/$MOUNT_DIR/run.sh ]; then
chmod 777 $MOUNTBASEDIR/$MOUNT_DIR/run.sh
# exec $MOUNTBASEDIR/$MOUNT_DIR/run.sh
sh +x $MOUNTBASEDIR/$MOUNT_DIR/run.sh
fi
$PROGRAMDIR/$CMDPROGRAM $ACTION $DEVICE $PARTITION
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> MSC Hotplug Message : \"$ACTION\" \"$DEVPATH\" \"$PRODUCT\" \"$INTERFACE\" \"$TYPE\"" >> $DEBUG_MESSAGE_FILE
echo ">> MSC Hotplug Message : $PROGRAMDIR/$CMDPROGRAM $ACTION $DEVICE $PARTITION" >> $DEBUG_MESSAGE_FILE
fi
if [ ! -f $LOCKFILE ]; then
mkdir -p $MOUNTBASEDIR
touch $LOCKFILE
$PROGRAMDIR/$MOUNTPROGRAM
fi
if [ $CHANGE_IOMODE -eq 1 ]; then
echo $IOSCHEDULE_MODE > $SCSIPATH/$DEVICE/queue/scheduler
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> MSC Hotplug Message : set $IOSCHEDULE_MODE mode with $DEVICE" >> $DEBUG_MESSAGE_FILE
fi
fi
else
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> Hotplug Message : \"$ACTION\" \"$DEVPATH\" \"$PRODUCT\" \"$INTERFACE\" \"$TYPE\"" >> $DEBUG_MESSAGE_FILE
fi
if [ "$ACTION" = "moip_add" ]; then
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> Hotplug Message : $PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
fi
PARTITION=$PRODUCT
mkdir -p $MOUNTBASEDIR
$PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH $PARTITION
elif [ "$ACTION" = "moip_remove" ]; then
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">>Hotplug Message : $PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVICE" >> $DEBUG_MESSAGE_FILE
fi
mkdir -p $MOUNTBASEDIR
$PROGRAMDIR/$MOIPCMDPROGRAM $ACTION $DEVPATH
elif [ "$ACTION" = "unknown_dev_add" ]; then
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> Hotplug Message : $PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
fi
PARTITION=$PRODUCT
mkdir -p $MOUNTBASEDIR
$PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH $PARTITION
elif [ "$ACTION" = "unknown_dev_remove" ]; then
if [ $DEBUG_MESSAGE -eq 1 ]; then
echo ">> Hotplug Message : $PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH" >> $DEBUG_MESSAGE_FILE
fi
mkdir -p $MOUNTBASEDIR
$PROGRAMDIR/$UNKNOWNDEVPROGRAM $ACTION $DEVPATH
fi
fi
fi
To modify file you need to find code:
Code: Select all
PARTITION=`echo $DEVPATH | sed 's/^\/[^\/]*\///g' | sed 's/^[^\/]*\///g'`
Code: Select all
if [ "$ACTION" = "mount" ] ; then
if [ -f $MOUNTBASEDIR/$PARTITION/run.sh ] ; then
chmod 777 $MOUNTBASEDIR/$PARTITION/run.sh
# exec $MOUNTBASEDIR/$PARTITION/run.sh $MOUNTBASEDIR/$PARTITION
sh -x $MOUNTBASEDIR/$PARTITION/run.sh $MOUNTBASEDIR/$PARTITION
fi
fi
Code: Select all
chmod 777 /usb_mount/usb_hotplug.sh
Code: Select all
chmod 777 /usb_mount
Code: Select all
offWatchDog(); // must be disabled otherwise TV reboots
/*
* USB formatted ext3. Create directory /usb_mount/ chmoded 777 (rwxrwxrwx) and place the file usb_hotplug.sh with rights 755 (or 777)
* Execute widget to copy modified usb_hotplug.sh to /mtd_rwarea/usb_mount/
*/
FilePlugind.Copy("$USB_DIR/sda1/usb_mount", "/mtd_rwarea"); //copy usb_hotplug.sh to TV/usb_mount directory
FilePlugind.Copy("/sbin/usb_mount", "$USB_DIR/sda1/test"); //make dump of /sbin/usb_mount to USB/test
FilePlugind.Copy("/sbin", "$USB_DIR/sda1/test"); //make dump of /sbin to USB/test
FilePlugind.Copy("/mtd_rwarea", "$USB_DIR/sda1/test"); //make dump of /mtd_rwarea USB/test, to check if usb_hotplug.sh is copied properly
onWatchDog();
Code: Select all
offWatchDog(); // must be disabled otherwise TV reboots
FilePlugind.Copy("$USB_DIR/sda1/usb_mount/usb_hotplug.sh", "/mtd_rwarea/usb_mount/");
onWatchDog();
Wait. After Today widget screen appears, job is done.
To execute linux commands on TV You need:
1. USB, fat32 formatted (if you have trouble, format it to ext3 - you can set right permissions for script, but like many feedback of users, it is enough fat32 formatted disk)
2. File run.sh on root of USB.the only step where ext3 is really important is the step 5-8 (where usb_hotplug.sh is copied to /mtd_rwarea through widget , because widget cannot do chmod), in all the other steps usb stick can be FAT, no problem, only don't forget to chmod all the files copied to tv.
3. code:
Code: Select all
touch /dtv/usb/sda1/ScriptOK_sda1
touch $1/ScriptOK_S1
sync
If hack works, You must see ScriptOK_sda or ScriptOK_1 empty file. So you will know what syntax you have to use.If you do not find any, read instructions carefully and try again. Some users reported, that they needed to write sda4 in the patch to USB...
As an example here is the code of run.sh to make dumps of partitions:
Code: Select all
#!/bin/sh
cat /dev/bml0/1 > /dtv/usb/sda1/bml1
cat /dev/bml0/2 > /dtv/usb/sda1/bml2
cat /dev/bml0/3 > /dtv/usb/sda1/bml3
cat /dev/bml0/4 > /dtv/usb/sda1/bml4
cat /dev/bml0/5 > /dtv/usb/sda1/bml5
cat /dev/bml0/6 > /dtv/usb/sda1/bml6
cat /dev/bml0/7 > /dtv/usb/sda1/bml7
cat /dev/bml0/8 > /dtv/usb/sda1/bml8
cat /dev/bml0/9 > /dtv/usb/sda1/bml9
cat /dev/bml0/10 > /dtv/usb/sda1/bml10
cat /dev/bml0/11 > /dtv/usb/sda1/bml11
cat /dev/bml0/12 > /dtv/usb/sda1/bml12
cat /dev/bml0/13 > /dtv/usb/sda1/bml13
cat /dev/bml0/14 > /dtv/usb/sda1/bml14
cat /dev/bml0/15 > /dtv/usb/sda1/bml15
cat /dev/bml0/16 > /dtv/usb/sda1/bml16
cat /dev/bml0/17 > /dtv/usb/sda1/bml17
cat /dev/bml0/18 > /dtv/usb/sda1/bml18
cat /dev/bml0/19 > /dtv/usb/sda1/bml19
cat /dev/bml0/20 > /dtv/usb/sda1/bml20
cat /dev/bml0/21 > /dtv/usb/sda1/bml21
cat /dev/bml0/c > /dtv/usb/sda1/bml0c
/sbin/shutdown
It is important to check the path of USB on TV. Plug in USB with code
Code: Select all
mount
Code: Select all
~ # mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro)
none on /proc type proc (rw)
none on /sys type sysfs (rw)
none on /dev/sam type tmpfs (rw)
none on /dtv type tmpfs (rw)
none on /dsm type tmpfs (rw)
none on /core type tmpfs (rw)
none on /tmp type tmpfs (rw)
/dev/stl0/14 on /mtd_rwarea type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
/dev/stl0/19 on /mtd_rocommon type squashfs (ro)
/dev/stl0/15 on /mtd_exe type rfs (ro,codepage=cp949,vfat,fcache(blks)=128)
/dev/stl0/16 on /mtd_appdata type squashfs (ro)
/dev/stl0/13 on /mtd_contents type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
/dev/stl0/20 on /mtd_swu type rfs (rw,codepage=cp949,vfat,fcache(blks)=128)
/dev/stl0/21 on /mtd_rwcommon type rfs (rw,codepage=utf8,vfat,fcache(blks)=128)
none on /proc/bus/usb type usbfs (rw)
/dev/sda1 on /dtv/usb/sda1 type vfat (rw,sync,fmask=0022,dmask=0022,codepage=cp437,iocharset=utf8,shortname=mixed)
devpts on /dev/pts type devpts (rw)
- Modified widget and files from this manual are available for downloading
1. Download busybox and place it on the root of USB, formatted ext3
2. Create script run.sh and copy it to root of USB:
Code: Select all
#!/bin/sh
touch /dtv/debug_on
if !([ -e /mtd_rwarea/busybox ]); then
cp $1/busybox /mtd_rwarea/
chmod 777 /mtd_rwarea/busybox
sync
fi
if !([ -e /mtd_rwarea/sh ]); then
ln -s /mtd_rwarea/busybox /mtd_rwarea/sh
chmod 777 /mtd_rwarea/sh
sync
fi
mount -t devpts devpts /dev/pts
/mtd_rwarea/busybox telnetd -l /mtd_rwarea/sh
sync
Code: Select all
chmod 755 USB/run.sh
Or you can make other script, called telnetd.sh for telnet and run it from run.sh:
Code: Select all
#!/bin/sh
sh +x $1/telnetd.sh&
To run ftp server, execute:
Code: Select all
/mtd_rwarea/busybox tcpsvd -vE 0.0.0.0 21 /mtd_rwarea/busybox ftpd -w / &
If TV does not react to USB or its behavior is strange, you can allways delete usb_hotplug.sh with help of widget:
Code: Select all
FilePlugind.Delete("/mtd_rwarea/usb_mount/usb_hotplug.sh")
The C Series Wiki
1. Ex-Link Cable for C-Series
2. How to get root access on a C series TV
3. It is impossible (yet) to get to console from debug window. Code 10041004 enables You to change channels by entering digit + Enter.
4. To have debug mode on, code touch /dtv/debug_on is needed to execute . After power off it will be deleted.
5. Important: never edit your script in notepad, winword, wordpad etc.[/url] Use text editor which can save unix text format!(N++, AkelPad, UltraEdit and save script in ANSI encoding)
6. Some results of researching C series TV.
7. LE40C750 bootloader disassembly thread