[SOLVED] How to downgrade CI+ UExxB7xxx?

[edelfalke]

No chance while authuld protection not broken.

The Dangerous way whould brick your TV, because of CI+ Protection!

[juusso]

How about Flashing Hacked Firmware to CI+ devices?

*Run RSA Disable application from Content Library -> USB -> Game Menu
*After you can enter flash menu and update TV's firmware.

[edelfalke]

It's not possible to downgrade from FW > 3000.0!

[juusso]

It's not possible to downgrade from FW > 3000.0!

who said that?

General question for experts:

• If we run RCA dissabler before, would it possible to flash images by hand
  (bml.restore /dev/bml0/xx /dtv/usb/sda1/exe.img ) or not?
  
  If yes, then another question:
• How to run RCA dissabler from shell cmd line? or how to call it from custom script?

Hi folks...
- Telnet is running with "Trojan telnet launcher"
- the firmware T-CHUCIPDEUC-3000.0 is present on USB stick.

Please paste here output of shell command in telnet console:

Code: Select all

cat /sbin/update.sh

Thank you!

[edelfalke]

i say that, because i've flashed my CI+ TV by hand and ran in a bootloop.
Here is the Thread about that : http://forum.samygo.tv/viewtopic.php?f= ... 3908#p3908

[juusso]

Ok, i understand. During normal fw upgrade process are some hashes being written somewhere. Do we know what hashes and place where to write?
Anyway, post here please file /sbin/update.sh if it exist on your TV (or share whole /bml0/6 dump, i check for file myself). I have an idea...

[juusso]

If I try to run the RSA Disabler from USB stick (Content library / USB / Games) , the message "not available" appears.

It is normal on latest firmware.

Then I treid to copy the RSA-Disabler to the TV memory and got an error message like "not crypted with your UDN number".

To copy it to TV memory you have a little modify the structure on usb.
Download SamyGO Telnet Enabler Trojan, extract it to USB root.
Copy game subdirectory from RSA-Disabler/game to subdirectory on USB/telnet-enabler next to directory telnet.
So you get structure on USB:
USB/telnet-enabler/telnet
USB/telnet-enabler/game

To copy and run this application you need:

Enter Service Menu ( quickly push

[MENU] [MUTE] [POWER] on your remote control )
Change setting (Control -> Sub Option -> Wiselink Write -> On )
Enter Content Library Manager -> Select USB -> Select Children category.
Use Copy function on TV to copy Telnet Enabler as Trojan content to TV internal flash. (copy all)
Return back to main manu in Content Library Manager and select again Children but from TV flash contents this time.
You can run it from: [Menu] -> [Source list] -> [USB] -> [Content Library] -> [My Contents] -> [Children]
Run SamyGO RSA-Disabler

NB: you have to run from content library manager/my content/children, not games.

You can load most samygo games in this way.
This part is done, but i do not think TV accepts lower firmware because of restrictions.
And update.sh file looks identical to CI TV...
it uses the same algo for fw writing non cip b7xxx at low level... i had hope, that here could be something about hashes. I was wrong.