Page 1 of 1
Re: mounting & modifying exe.img
Posted: Mon Dec 07, 2009 5:04 pm
by arris69
vapier wrote:the exe.img can easily be mounted as VFAT, just as the RFS document clearly states that the file format is "FAT compatible". i'm wondering if anyone has done this to make modifications to the firmware easier.
the telnet enabler script could be written as:
Code: Select all
mount -o loop exe.img.dec loop/
sed -i '/KF_LOG/i/etc/telnetd_start.sh&' loop/rc.local
umount loop
<encrypt & re-crc the exe.img>
not realy, then if you acces and modify a file this way the os will make some changes in the filesystem what can't work, because the filesystem is full.
in worse case you destroy the image, in best case your changes are dropped.
if somebody find a way to modify the rfs images it will be nice, but i think it is also possible to migrate the rfs images to squashfs
desperade testers needed
arris
Re: mounting & modifying exe.img
Posted: Mon Dec 07, 2009 6:46 pm
by marcelru
Hi all,
I'm not sure about your distro's, my linux box will mount the RFS filesystem as vfat, but as soon as you start changing things, files turn out to be read-only, so there's something in the filesystem structure that prevents overwriting (at least on Fedora 11).
IMO, To use the RFS filesystem, someone will need to rewrite the rfs kernel module, or you might use an ARM emulator to use the samsung rfs.ko module.
There was a message about this on the AVForums thread on samsung infolink hacking, by cowenchicken if I remember well, but I haven't seen any follow-up on that.
marcelr
Re: mounting & modifying exe.img
Posted: Mon Dec 07, 2009 10:07 pm
by dynamic1969
Has anyone managed to set-up a loop-device on the TV, so that we could mount the "exe.img" as RW from USB via a loop-device ?
Actually mounting e.g. mtd_exe ( /dev/tbml8 ) like shown below:
Code: Select all
mount -t rfs /dev/tbml8 /mtd_new_exe
will give you a RW image. You'll even be able modify files, add new files etc. ... everything seems to just work fine!
The only back-side is, that the changes are lost after a reboot, as the kernel seems to keep all changes in "RAM" only.
However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.
Thought this is worthwhile to share ...
Regards
dynamic
Re: mounting & modifying exe.img
Posted: Mon Dec 07, 2009 11:39 pm
by erdem_ua
dynamic1969 wrote:Has anyone managed to set-up a loop-device on the TV, so that we could mount the "exe.img" as RW from USB via a loop-device ?
Actually mounting e.g. mtd_exe ( /dev/tbml8 ) like shown below:
Code: Select all
mount -t rfs /dev/tbml8 /mtd_new_exe
will give you a RW image. You'll even be able modify files, add new files etc. ... everything seems to just work fine!
The only back-side is, that the changes are lost after a reboot, as the kernel seems to keep all changes in "RAM" only.
However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.
Thought this is worthwhile to share ...
Regards
dynamic
Really?
So then we can place live exeDSP hacks without change FW...
Re: mounting & modifying exe.img
Posted: Tue Dec 08, 2009 1:45 pm
by arris69
dynamic1969 wrote:...
However, this makes me believe, that mounting an exe.img from USB-Drive directly on the TV via a loop-device will allow to modify and save RFS images, which I think we are looking for.
if i try it mount as rfs & loop
Code: Select all
loop: loaded (max 8 devices)
rfs_build_sb[346]: invalid number of sectors : 30720
if i mount it as vfat and mount as loop,rw can edit files but on save:
Code: Select all
attempt to access beyond end of device
loop0: rw=1, want=104956, limit=104952
on new mount edited file is empty.
new try to mount it as rfs & loop
Code: Select all
Alignment trap: mount (950) PC=0x40029e8c Instr=0xe1d280bb Address=0x0001e2f3 FSR 0x011
little update:
Code: Select all
fsck.vfat -v /home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "libFAT "
Media byte 0xf8 (hard disk)
2048 bytes per logical sector
8192 bytes per cluster
2 reserved sectors
First FAT starts at byte 4096 (sector 2)
2 FATs, 16 bit entries
16384 bytes per FAT (= 8 sectors)
Root directory starts at byte 36864 (sector 18)
512 root directory entries
Data area starts at byte 53248 (sector 26)
7673 data clusters (62857216 bytes) <<<<<<<<<<<<<<<<<<<<<<<<<<<!!!!!!!!!!
8 sectors/track, 1 heads
0 hidden sectors
30720 sectors total
FATs differ but appear to be intact. Use which FAT ?
1) Use first FAT
2) Use second FAT
? 1
Checking for unused clusters.
Leaving file system unchanged.
/home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img: 105 files, 6552/7673 clusters
but ls -l say:
-rw-r--r-- 1 root root
53727232 2009-09-15 00:45 /home/Software/Tuxbox/Samsung-Firmware/Firmware/2004.1/T-CHL7DEUC/image/exe.img
hth
arris
Re: mounting & modifying exe.img
Posted: Sat Dec 12, 2009 12:07 am
by dynamic1969
Hi arris,
does the loop device work OK with non RFS images ? Did you test that ?
I'd also be interested to understand how created the loop-devices ? Could you share, as to which steps you have taken ?
Thanks!
Regards
dynamic
Re: mounting & modifying exe.img
Posted: Sat Dec 12, 2009 10:56 am
by arris69
dynamic1969 wrote:Hi arris,
does the loop device work OK with non RFS images ? Did you test that ?
didn't tested it, but i saw a bug in loop driver hmmmmm, 5 years ago. the error "access beyond end of device" will appear too if i mount the exe.img as fat on my computer. (and the error is logical, than the img is smaller as the information in the fat-table about storage size, may the dump are made as some backup software do it, there is not the full partition just the data upto the last used sector?)
dynamic1969 wrote:
I'd also be interested to understand how created the loop-devices ? Could you share, as to which steps you have taken ?
i installed the "selp distribution" on my computer, exported it via nfs, mounted on tv, bound /proc into right place and chrooted into the nfs exported root (may it would be better to mount /sys also or use unionfs for /dev) may it is also possible to patch the loop driver to use /dtv or /dev/sam for device directory.
"selp distribution" means an openembedded (
http://www.openembedded.org) build distribution including parts from samsung sources.
but i stopped my efforts to manipule rfs images beg. of sept. if the rootfs is a squashfs why the exe not? who knows that the partition 8 of the onenand-chip is writible, may it just can be flashed.
hth
arris