Page 2 of 2
Re: So, I have access to TOP and shell on my T-MST4 LN32D550
Posted: Tue Dec 06, 2011 5:27 pm
by juusso
Guys on ixbt tried to dump memory over memory read function. The goal was to find out address of kernel to patch it over function memory write, to get console unlocked. No success. I mean, no kernel found, need further research. For this aim some scripts were written to enable dump only clean code and filter extra debug output and so on.
So theoretically it is possible... But practically - not yet. AFAIK here is no active work on this. If interested, i can find more info for you.
Re: So, I have access to TOP and shell on my T-MST4 LN32D550
Posted: Tue Dec 06, 2011 5:39 pm
by LLStarks
Is there any way to dump RAM/ROM without root or hooking the chip up to a flasher?
Only other idea I have is to flood port 52235 with TCP requests and crash DLNA in hopes that I drop to bash or something.
Re: So, I have access to TOP and shell on my T-MST4 LN32D550
Posted: Fri Dec 09, 2011 9:22 am
by LLStarks
How do I fix the garbage output? I get it with cu and Putty.
Code: Select all
[ TD Debug Menu ]
------------------------------
0x01`?qc D???
0x02 ?\
"????
p??*T1?1???
0x04 ?: SPCScreen Debug
0x05 ?: Sequence Test
0x06 ?:`?[?mute on/off
0x07 :`?VY??}????
0x08 ?M?5???Debug
0x09 ?>?*?E??}???5
------------------------------
0x20`???????Shell
0x21 `: Get SDAL version
0x22 : Get Kernel driver version
------------------------------
0x99 : Exit Debug
------------------------------
There's also this...
Code: Select all
SDAL`Ver: 2.26.0.0
------------------------------------
(29) Read `Register
(30) Write Register
Re: So, I have access to TOP and shell on my T-MST4 LN32D550
Posted: Fri Dec 09, 2011 10:55 am
by LLStarks
Here's a coredump I forced.
Not sure if it is worth anything.
http://pastebin.com/Ph9LiizA