exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120308

Here is information about customize your E series firmware..:!:This forum is NOT FOR USER questions or problems but DEVELOPER.
Post Reply

User avatar
maxprasak
Posts: 24
Joined: Thu May 24, 2012 4:01 pm
Location: Czech Republic
Contact:
Contact maxprasak

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by maxprasak »

juuso wrote: Power on IDA and feed the decrypted exeDSP for it. Reverse engineering is the only way to make something usefull (except geting root and use comon linux features like nfs and samba mou nts et cetera.)
Thanks juuso !

No problem to try it, but where I can get exeDSP from T-ECPDEUC ?? Or can I use this from T-ECPAKUC ... what is the difference (I know EU/US, but internally)?
UE46ES7000 - Panel: 46A2UF0E Firmware: T-ECPDEUC-1003.0 Kernel: 0080.0700 Onboot: 0053 Camera: 3.69 Bluetooth: 1.2.14.482
Galaxy S II - Android 2.3.5 - AllShare: 2.0.0 Samsung Remote: 2.2.5 Samsung Smart View: 3.1.6
Top
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by juusso »

Basically no significant differences on other series (b/c/d) between regional firmwares.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]
DO NOT EVER INSTALL FIRMWARE UPGRADE
Top
User avatar
maxprasak
Posts: 24
Joined: Thu May 24, 2012 4:01 pm
Location: Czech Republic
Contact:
Contact maxprasak

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by maxprasak »

I can confirm, that ES firmware ECP..UC need another key to decrypt then previous firmwares.

Does anybody know if exeDSP contain decrypt key or not?
UE46ES7000 - Panel: 46A2UF0E Firmware: T-ECPDEUC-1003.0 Kernel: 0080.0700 Onboot: 0053 Camera: 3.69 Bluetooth: 1.2.14.482
Galaxy S II - Android 2.3.5 - AllShare: 2.0.0 Samsung Remote: 2.2.5 Samsung Smart View: 3.1.6
Top
arris69
Official SamyGO Developer
Posts: 1700
Joined: Fri Oct 02, 2009 8:52 am
Location: Austria/Vienna (no Kangaroos here)
Contact:
Contact arris69

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by arris69 »

maxprasak wrote:I can confirm, that ES firmware ECP..UC need another key to decrypt then previous firmwares.

Does anybody know if exeDSP contain decrypt key or not?
logically
  1. yes
    or
  2. exeDSP knows how to generate the key
Top
User avatar
maxprasak
Posts: 24
Joined: Thu May 24, 2012 4:01 pm
Location: Czech Republic
Contact:
Contact maxprasak

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by maxprasak »

arris69 wrote:
maxprasak wrote:Does anybody know if exeDSP contain decrypt key or not?
logically
  1. yes
    or
  2. exeDSP knows how to generate the key
Ok, so I will look to the code ...

BTW: Ufuf ... autoanalyzing of exeDSP in IDA takes more then 2 days :o
UE46ES7000 - Panel: 46A2UF0E Firmware: T-ECPDEUC-1003.0 Kernel: 0080.0700 Onboot: 0053 Camera: 3.69 Bluetooth: 1.2.14.482
Galaxy S II - Android 2.3.5 - AllShare: 2.0.0 Samsung Remote: 2.2.5 Samsung Smart View: 3.1.6
Top
bdpuk
Posts: 1
Joined: Tue Jun 26, 2012 12:46 pm

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by bdpuk »

Here's the binwalk output if it's of use to anyone....

Code: Select all

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
0         	0x0       	ELF 32-bit LSB executable, ARM, version 1 (SYSV)
242497    	0x3B341   	LZMA compressed data, properties: 0x5D, dictionary size: 1746862080 bytes, uncompressed size: 696713216 bytes
248693    	0x3CB75   	LZMA compressed data, properties: 0x5D, dictionary size: 1247936512 bytes, uncompressed size: 208470016 bytes
261781    	0x3FE95   	LZMA compressed data, properties: 0x5D, dictionary size: 769261568 bytes, uncompressed size: 760807424 bytes
276061    	0x4365D   	LZMA compressed data, properties: 0x5D, dictionary size: 6553600 bytes, uncompressed size: 319029248 bytes
278041    	0x43E19   	LZMA compressed data, properties: 0x5D, dictionary size: 747765760 bytes, uncompressed size: 304676864 bytes
293309    	0x479BD   	LZMA compressed data, properties: 0x5D, dictionary size: 958136320 bytes, uncompressed size: 472645632 bytes
546725    	0x857A5   	LZMA compressed data, properties: 0x5D, dictionary size: 1360855040 bytes, uncompressed size: 675414016 bytes
69490344  	0x42456A8 	Linux Journalled Flash filesystem, little endian
74410628  	0x46F6A84 	ZynOS header, header size: 48 bytes, load address 0x1E723147, rom image type: ROMIMG, uncompressed size: 692523802, compressed size: 86061376, uncompressed checksum: 0x147, compressed checksum: 0x1310, flags: 0x1, memory map table address: 0xC004610
78531528  	0x4AE4BC8 	PNG image, 825641293 x 1701670770, 121-bit
78533992  	0x4AE5568 	PNG image, 1667591796 x 1932480626, 111-bit
80365185  	0x4CA4681 	Linux kernel
80460824  	0x4CBBC18 	MPFS (Microchip) filesystem, version 116.97, 29810 file entries
81529074  	0x4DC08F2 	Linux Journalled Flash filesystem, little endian
83540340  	0x4FAB974 	LZMA compressed data, properties: 0x5D, dictionary size: 184549376 bytes, uncompressed size: 167772160 bytes
83972524  	0x50151AC 	Windows CE RTOS
83972563  	0x50151D3 	Windows CE RTOS
83982241  	0x50177A1 	Windows CE RTOS
83986671  	0x50188EF 	Windows CE RTOS
83994701  	0x501A84D 	Windows CE RTOS
83999615  	0x501BB7F 	Windows CE RTOS
84004008  	0x501CCA8 	Windows CE RTOS
84004017  	0x501CCB1 	Windows CE RTOS
84004432  	0x501CE50 	Windows CE RTOS
84776926  	0x50D97DE 	Linux Journalled Flash filesystem, little endian
85562136  	0x5199318 	LZMA compressed data, properties: 0x50, dictionary size: 8388608 bytes, uncompressed size: 562496512 bytes
85774592  	0x51CD100 	TIFF image data, little-endian
91856139  	0x5799D0B 	Linux Journalled Flash filesystem, big endian
94200260  	0x59D61C4 	Zip archive data,  v0.0
95926580  	0x5B7B934 	LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 201326592 bytes
97249724  	0x5CBE9BC 	Zip archive data,  v0.0
97544695  	0x5D069F7 	Windows CE RTOS
99294379  	0x5EB1CAB 	LZMA compressed data, properties: 0x5D, dictionary size: 2130706432 bytes, uncompressed size: 125 bytes
102646104 	0x61E4158 	YAFFS filesystem
102727268 	0x61F7E64 	YAFFS filesystem
105272833 	0x6465601 	Linux Journalled Flash filesystem, little endian
105294445 	0x646AA6D 	Linux Journalled Flash filesystem, little endian
105313443 	0x646F4A3 	Linux Journalled Flash filesystem, little endian
105512797 	0x649FF5D 	Linux Journalled Flash filesystem, little endian
105651771 	0x64C1E3B 	Linux Journalled Flash filesystem, little endian
105689482 	0x64CB18A 	Linux Journalled Flash filesystem, big endian
105692339 	0x64CBCB3 	Linux Journalled Flash filesystem, little endian
105813830 	0x64E9746 	Linux Journalled Flash filesystem, little endian
105881398 	0x64F9F36 	Linux Journalled Flash filesystem, big endian
105920819 	0x6503933 	Linux Journalled Flash filesystem, big endian
106019283 	0x651B9D3 	Linux Journalled Flash filesystem, little endian
106025910 	0x651D3B6 	Linux Journalled Flash filesystem, little endian
106172825 	0x6541199 	Linux Journalled Flash filesystem, big endian
106522715 	0x659685B 	Linux Journalled Flash filesystem, little endian
106573673 	0x65A2F69 	Linux Journalled Flash filesystem, big endian
106575630 	0x65A370E 	Linux Journalled Flash filesystem, big endian
106637792 	0x65B29E0 	Linux Journalled Flash filesystem, big endian
106691062 	0x65BF9F6 	Linux Journalled Flash filesystem, big endian
106744267 	0x65CC9CB 	Linux Journalled Flash filesystem, little endian
106787395 	0x65D7243 	Linux Journalled Flash filesystem, little endian
106891238 	0x65F07E6 	Linux Journalled Flash filesystem, big endian
106915990 	0x65F6896 	Linux Journalled Flash filesystem, big endian
106983423 	0x6606FFF 	Linux Journalled Flash filesystem, little endian
106997305 	0x660A639 	Linux Journalled Flash filesystem, big endian
107005109 	0x660C4B5 	Linux Journalled Flash filesystem, little endian
107014497 	0x660E961 	Linux Journalled Flash filesystem, little endian
107040420 	0x6614EA4 	Linux Journalled Flash filesystem, little endian
107189496 	0x66394F8 	Linux Journalled Flash filesystem, big endian
107274262 	0x664E016 	Linux Journalled Flash filesystem, little endian
107310870 	0x6656F16 	Linux Journalled Flash filesystem, big endian
107361428 	0x6663494 	Linux Journalled Flash filesystem, big endian
107396870 	0x666BF06 	Linux Journalled Flash filesystem, big endian
107410102 	0x666F2B6 	Linux Journalled Flash filesystem, little endian
107591395 	0x669B6E3 	Linux Journalled Flash filesystem, little endian
107660816 	0x66AC610 	Linux Journalled Flash filesystem, little endian
107766971 	0x66C64BB 	Linux Journalled Flash filesystem, little endian
107862536 	0x66DDA08 	Linux Journalled Flash filesystem, little endian
107967692 	0x66F74CC 	Linux Journalled Flash filesystem, big endian
107994009 	0x66FDB99 	Linux Journalled Flash filesystem, little endian
108016873 	0x67034E9 	Linux Journalled Flash filesystem, little endian
108036932 	0x6708344 	Linux Journalled Flash filesystem, little endian
108096478 	0x6716BDE 	Linux Journalled Flash filesystem, little endian
108107225 	0x67195D9 	Linux Journalled Flash filesystem, little endian
108126922 	0x671E2CA 	Linux Journalled Flash filesystem, big endian
108281019 	0x6743CBB 	Linux Journalled Flash filesystem, little endian
108536941 	0x678246D 	Linux Journalled Flash filesystem, big endian
108565218 	0x67892E2 	Linux Journalled Flash filesystem, big endian
108664912 	0x67A1850 	Linux Journalled Flash filesystem, big endian
108726700 	0x67B09AC 	Linux Journalled Flash filesystem, big endian
109849599 	0x68C2BFF 	Windows CE RTOS
109849612 	0x68C2C0C 	Windows CE RTOS
109901695 	0x68CF77F 	Windows CE RTOS
111615429 	0x6A71DC5 	Windows CE RTOS
111704220 	0x6A8789C 	Windows CE RTOS
111833324 	0x6AA70EC 	Windows CE RTOS
111836357 	0x6AA7CC5 	Windows CE RTOS
111867754 	0x6AAF76A 	Windows CE RTOS
112097495 	0x6AE78D7 	Windows CE RTOS
112277184 	0x6B136C0 	Windows CE RTOS
112834319 	0x6B9B70F 	Windows CE RTOS
113073599 	0x6BD5DBF 	Windows CE RTOS
113175919 	0x6BEED6F 	Windows CE RTOS
113185693 	0x6BF139D 	Windows CE RTOS
113185706 	0x6BF13AA 	Windows CE RTOS
113420226 	0x6C2A7C2 	Windows CE RTOS
113513021 	0x6C4123D 	Windows CE RTOS
113766651 	0x6C7F0FB 	Windows CE RTOS
113952935 	0x6CAC8A7 	Windows CE RTOS
113952946 	0x6CAC8B2 	Windows CE RTOS
114249020 	0x6CF4D3C 	Windows CE RTOS
114566578 	0x6D425B2 	Windows CE RTOS
114680620 	0x6D5E32C 	Windows CE RTOS
114730643 	0x6D6A693 	Windows CE RTOS
114737533 	0x6D6C17D 	Windows CE RTOS
115079597 	0x6DBF9AD 	Windows CE RTOS
115189169 	0x6DDA5B1 	Windows CE RTOS
116143141 	0x6EC3425 	Windows CE RTOS
116256463 	0x6EDEECF 	Windows CE RTOS
116433355 	0x6F0A1CB 	Windows CE RTOS
116438648 	0x6F0B678 	Windows CE RTOS
116643847 	0x6F3D807 	Windows CE RTOS
117382534 	0x6FF1D86 	Windows CE RTOS
117484899 	0x700AD63 	Windows CE RTOS
117635524 	0x702F9C4 	Windows CE RTOS
117806086 	0x7059406 	Windows CE RTOS
117884454 	0x706C626 	Windows CE RTOS
117893176 	0x706E838 	Windows CE RTOS
118030344 	0x7090008 	Windows CE RTOS
118424814 	0x70F04EE 	Windows CE RTOS
118498779 	0x71025DB 	Windows CE RTOS
118656640 	0x7128E80 	Windows CE RTOS
118819488 	0x7150AA0 	Windows CE RTOS
119630344 	0x7216A08 	ELF 32-bit LSB executable, ARM, version 1 (SYSV)
Top
arris69
Official SamyGO Developer
Posts: 1700
Joined: Fri Oct 02, 2009 8:52 am
Location: Austria/Vienna (no Kangaroos here)
Contact:
Contact arris69

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by arris69 »

thnx, but binwalk is maybe usabel for unknown binary data/disk images, in case of exeDSP it's clear that's: ELF 32-bit LSB executable, ARM, version 1
bdpuk wrote:Here's the binwalk output if it's of use to anyone....


DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 ELF 32-bit LSB executable, ARM, version 1 (SYSV)
...
119630344 0x7216A08 ELF 32-bit LSB executable, ARM, version 1 (SYSV)
Top
pcsne
Posts: 1
Joined: Sun Jul 29, 2012 9:58 pm

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by pcsne »

broken link T_T
one more upload plz
Top
E3V3A
Posts: 247
Joined: Wed Oct 31, 2012 2:31 am
Location: /dev/zero

Re: exeDSP from SWU_T-ECPAKUC_001012_I03_ES000KS000RS000_120

Post by E3V3A »

I need some help on how I can do the same thing for my T-MST10PDEUC-1027.1 FW?
I'd like to extract exeDSP and fire it up in IDA... Thanks.
HW: UE40ES5700SXXH
FW: T-MST10PDEUC-1029.0 Onboot: 1003
Top
User avatar
juusso
SamyGO Moderator
Posts: 10129
Joined: Sun Mar 07, 2010 6:20 pm

Re: exeDSP from SWU_T-MST10PDEUC_001027_I04_KS000RS000ES000D

Post by juusso »

no problem.
1. install python - use 2.7.3 version, don`t use 3..>
2. install pycrypto for python2.7 - use 32bit version, because x64 may give problems.
3. Download latest SamyGO patcher script from svn
4. extract your firmware
5. decrypt it using command...

Code: Select all

d:\firmware>c:\python27\python.exe SamyGO.py decrypt_all ./T-MST10PDEUC
keeping in mind python is installed to c:/python27 and you call cmd from your working dir (ex. d:/firmware). The extracted firmware dir is next to SamyGO.py.

Code: Select all

d:\firmware>c:\python27\python.exe SamyGO.py decrypt_all ./T-MST10PDEUC
SamyGO Firmware Patcher v0.34 (c) 2010-2011 Erdem U. Altinyurt

                   -=BIG FAT WARNING!=-
            You can brick your TV with this tool!
Authors accept no responsibility about ANY DAMAGE on your devices!
         project home: http://www.SamyGO.tv

Firmware:  T-MST10PDEUC v1027.1

AES Encrytped CI+ firmware detected.
Processing file rootfs.img.sec
...
6. open exe.img with 7zip and extract exeDSP or any other file you want. Or mount to loop image file under linux...

And here is extracted exeDSP... (download)

Code: Select all

# md5sum ./exeDSP
c879de16b6f872bfcae96717f62dea6c  ./exeDSP
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]
DO NOT EVER INSTALL FIRMWARE UPGRADE
Top

Post Reply

Return to “[E] Firmware”