Servicemenu change via Firmware Update

[arris69]

hi,

somebody analyzed the file Factory.dat in /mtd_exe ?
seems to be the servicemenu settings, or not?

arris

[juusso]

I looked this a couple of months ago. I decided it is the database file for service menu. I mean here are all possible values listed. Where does active setting stored I didn't find, but guess it are in micom...

Might we could change service menu settings by changing order of listed in factory.dat, in case if only number (or address) of meaning is read from this file and stored as service menu setting.

[arris69]

I looked this a couple month ago. I decided it is the database file for service menu. I mean here are all possible values listed. Where does active setting stored I didn't find, but guess it are in micom...

Might we could change service menu settings by changing order of listed in factory.dat, in case if only number (or address) of meaning is read from this file and stored as service menu setting.

but seems also SpecialItemNumber.txt has something to do with it, and for storage i guess maybe somehow in /mtd_rwarea/nvramCount?

arris

[sbav1]

and for storage i guess maybe somehow in /mtd_rwarea/nvramCount?
arris

I think nvramCount file is just for counting writing cycles for main EEPROM data cells; no actual settings stored in this file.

Code: Select all

int nvc_table[0x8000];

It's useful for guessing which NVRAM cells are used for what, but otherwise not very important, IMO.

Main EEPROM size in B-Series is 32KB/256kB. Factory data storage area in that chip is 0x1500 bytes long, starting at 0x68f1 offset
(t.b.c, I'll try to post some more details later ).

But, is main EEPROM holding all factory settings?? I'm not sure about that; we have two small 2kB EEPROMs on the mainboard as well ( probably connected to MICOM, and not directly accessible through I2C from Chelsea).

Factory.dat (mostly) contains serialized data structures for factory menu tree nodes. Additionally, there are 3 lists in there (panel strings list, model strings list, and 3rd one - AFAIRC somehow related to region codes).
I don't think node labels which are visible in this file are used directly in graphical service menu, but they might be used for text-based factory settings options available in TDM.
Value lables (like Debug | UART | Logic, VESA | JEIDA | ...) are elsewhere, most likely in exeDSP.
Some nodes (but not all of them - ??) contain indexes (addresses? IDs?), which can be traced to SpecialItemNumber.txt entries and/or low-level EEPROM data offsets. But not directly; there are some extra levels of abstraction involved. Samsung really overdid itself with those parts of code, it's one really big mess .

SpecialItemNumber.txt file is probably not used for anything important (only for debugging).

[erdem_ua]

-= Will move to D series Firmware =-

[juusso]

*moved*

[nobody]

Interesting! It would be great to be able to backup and restore the nvram.