mounting & modifying exe.img

[arris69]

the exe.img can easily be mounted as VFAT, just as the RFS document clearly states that the file format is "FAT compatible". i'm wondering if anyone has done this to make modifications to the firmware easier.

the telnet enabler script could be written as:

Code: Select all

mount -o loop exe.img.dec loop/
sed -i '/KF_LOG/i/etc/telnetd_start.sh&' loop/rc.local
umount loop
<encrypt & re-crc the exe.img>

not realy, then if you acces and modify a file this way the os will make some changes in the filesystem what can't work, because the filesystem is full.
in worse case you destroy the image, in best case your changes are dropped.

if somebody find a way to modify the rfs images it will be nice, but i think it is also possible to migrate the rfs images to squashfs
desperade testers needed

arris

[marcelru]

Hi all,

I'm not sure about your distro's, my linux box will mount the RFS filesystem as vfat, but as soon as you start changing things, files turn out to be read-only, so there's something in the filesystem structure that prevents overwriting (at least on Fedora 11).

IMO, To use the RFS filesystem, someone will need to rewrite the rfs kernel module, or you might use an ARM emulator to use the samsung rfs.ko module.
There was a message about this on the AVForums thread on samsung infolink hacking, by cowenchicken if I remember well, but I haven't seen any follow-up on that.

marcelr

[dynamic1969]

Has anyone managed to set-up a loop-device on the TV, so that we could mount the "exe.img" as RW from USB via a loop-device ?

Actually mounting e.g. mtd_exe ( /dev/tbml8 ) like shown below:

Code: Select all

mount -t rfs /dev/tbml8 /mtd_new_exe

will give you a RW image. You'll even be able modify files, add new files etc. ... everything seems to just work fine!

The only back-side is, that the changes are lost after a reboot, as the kernel seems to keep all changes in "RAM" only.

However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.

Thought this is worthwhile to share ...

Regards
dynamic

[erdem_ua]

Has anyone managed to set-up a loop-device on the TV, so that we could mount the "exe.img" as RW from USB via a loop-device ?

Actually mounting e.g. mtd_exe ( /dev/tbml8 ) like shown below:

Code: Select all

mount -t rfs /dev/tbml8 /mtd_new_exe

will give you a RW image. You'll even be able modify files, add new files etc. ... everything seems to just work fine!

The only back-side is, that the changes are lost after a reboot, as the kernel seems to keep all changes in "RAM" only.

However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.

Thought this is worthwhile to share ...

Regards
dynamic

Really?
So then we can place live exeDSP hacks without change FW...

[arris69]

...
However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.

if i try it mount as rfs & loop

Code: Select all

loop: loaded (max 8 devices)                                                                              
rfs_build_sb[346]: invalid number of sectors : 30720                                                      

if i mount it as vfat and mount as loop,rw can edit files but on save:

Code: Select all

attempt to access beyond end of device                                                                    
loop0: rw=1, want=104956, limit=104952  

on new mount edited file is empty.

new try to mount it as rfs & loop

Code: Select all

Alignment trap: mount (950) PC=0x40029e8c Instr=0xe1d280bb Address=0x0001e2f3 FSR 0x011 

little update:

Code: Select all

fsck.vfat -v /home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "libFAT  "
Media byte 0xf8 (hard disk)
      2048 bytes per logical sector
      8192 bytes per cluster
         2 reserved sectors
First FAT starts at byte 4096 (sector 2)
         2 FATs, 16 bit entries
     16384 bytes per FAT (= 8 sectors)
Root directory starts at byte 36864 (sector 18)
       512 root directory entries
Data area starts at byte 53248 (sector 26)
      7673 data clusters (62857216 bytes) <<<<<<<<<<<<<<<<<<<<<<<<<<<!!!!!!!!!!
8 sectors/track, 1 heads
         0 hidden sectors
     30720 sectors total
FATs differ but appear to be intact. Use which FAT ?
1) Use first FAT
2) Use second FAT
? 1
Checking for unused clusters.
Leaving file system unchanged.
/home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img: 105 files, 6552/7673 clusters

but ls -l say:
-rw-r--r-- 1 root root 53727232 2009-09-15 00:45 /home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img

hth
arris

[dynamic1969]

Hi arris,

does the loop device work OK with non RFS images ? Did you test that ?
I'd also be interested to understand how created the loop-devices ? Could you share, as to which steps you have taken ?

Thanks!

Regards
dynamic

[arris69]

Hi arris,

does the loop device work OK with non RFS images ? Did you test that ?

didn't tested it, but i saw a bug in loop driver hmmmmm, 5 years ago. the error "access beyond end of device" will appear too if i mount the exe.img as fat on my computer. (and the error is logical, than the img is smaller as the information in the fat-table about storage size, may the dump are made as some backup software do it, there is not the full partition just the data upto the last used sector?)

I'd also be interested to understand how created the loop-devices ? Could you share, as to which steps you have taken ?

i installed the "selp distribution" on my computer, exported it via nfs, mounted on tv, bound /proc into right place and chrooted into the nfs exported root (may it would be better to mount /sys also or use unionfs for /dev) may it is also possible to patch the loop driver to use /dtv or /dev/sam for device directory.

"selp distribution" means an openembedded (http://www.openembedded.org) build distribution including parts from samsung sources.
but i stopped my efforts to manipule rfs images beg. of sept. if the rootfs is a squashfs why the exe not? who knows that the partition 8 of the onenand-chip is writible, may it just can be flashed.

hth
arris