TV turns itself off due to CIP_AUTHULD

[rhsg]

Hey, I received a UE40D6500 from a friend who had had it working for a long time until one day it started to turn off after roughly 25 seconds of being on. After measuring the power supply etc. I decided to look for a serial output of some sorts and found it... anyway long story short I hooked it up and found out the device starts shutting itself down due to CIP_AUTHULD with the following log output:

Code: Select all

[CIP_AUTHULD] Errnum 1008
[CIP_AUTHULD] Errnum 1007
[CIP_AUTHULD] error part. number = 4
[CIP_AUTHULD] System will be down.(0x4)
[CIP_KERNEL] authentication fail!!
[CIP_KERNEL] timeout
[CIP_KERNEL] [init/main.c::Exception_from_authuld::864]auth failed in kernel. System Down.
[CIP_KERNEL] [init/main.c::Exception_from_authuld::864]auth failed in kernel. System Down.
[CIP_KERNEL] [init/main.c::Exception_from_authuld::864]auth failed in kernel. System Down.

So concidering I have never done much with a Samsung TV and its firmware would be so kind as to try answering any of these questions:
* Could someone tell me what this module is for? Does CIP stand for CI+ eg. the plug in modules for paid TV?
* Is there anyway to somehow gain access to the system to disable this module which is shutting it down?
* I hear somewhere that SamyGO has CIP checking disabled or something, would it be possible to flash SamyGO without the TV being on for longer than a couple of seconds? Specifically: If it starts flashing is CIP checking turned off, as otherwise this device will brick itself
* Is this honestly related to copyright protection (or atleast something similar)?!

I would be really grateful for any help!

[sectroyer]

It check signatures of partitions IMHO. I think the ONLY way to get your device back is to switch boot partition to the "other one"

[rhsg]

Well I tried accessing U-Boot however I couldn't manage to do so...

Looking in the forum it sounds like U-Boot is not accessible (due to the newer firmware?)

Here is the version information from the service menu:

WP_20150902_19_58_08_Pro.jpg

Is there another way to do this? Also thanks for your quick response

P.S.: Also is it possible to do a hardware flash or where is the firmware located?

[sectroyer]

Check posts on forum. I think other users used Arduino for accessing eprom and overwriting some bytes

[juusso]

problem is probably wrong checksums (why? - blackout/incomplete firmware upgrade/playing with telnet/other reasons...). As suggested, try to switch working partitions. As you do not have console, try identify micom eeprom and switch working partitions by editing bytes via arduino OR with programmer. No guarantee it will work, at least, you lose nothing (just your time).

[rhsg]

Well I'll try to hack up some software to play with the EEPROM and will report back as progress goes... are you suggesting to swap the CIP partition with any other so that the checksum checks out or what is your exact suggestion? Is any of the data somehow secured or could one try to just prevent the kernel module which checks the signature from starting?

[rhsg]

I have managed to read out the chip shown in:

WP_20150905_19_33_23_Pro - Copy.jpg

It is a M24512RP from ST Micro with 64KB of memory (or is this the wrong one?)

Reading out the memory however does not really help me much. Could someone give me some insight into how it would be possible to switch out the partitions? Is it safe to post the data here, may help a little. Otherwise I can PM it...

P.S.: all other SOP8 chips seem to be Z1033A which is for power regulation, so im guessing that is the correct EEPROM.
P.P.S.: only 512kbit so 64KB

[juusso]

I suggest you to read this topic first, then you will know what are we talking about: viewtopic.php?f=23&t=5042
You`ve chosen wrong eeprom. Picture is bad quality, but from what i see, you`re trying to read SoC eeprom. It may be also useful to switch some service menu settings on/off...
But now you need Micom eeprom, which is located in opposite side of mainboard (8-leg chip at the right upper 1/4 on the picture, right below to the big square chip, labeled Weltrend...). I can be wrong with the chip location, but your mainboard is very similar to mine...

What interface are you using to read chip`s data?

[rhsg]

I used an old PCB of mine with a PIC32 processor to change the bytes, read them out using UART.

I changed the old values:
FF FF FF AD CD 00 FF 00 FF 00 00 32 01 FF 67 65
72 FF 00 FF FF 01 C1 1A 03 FF FF 4D FF FF FF FF

To:
FF FF FF B0 77 00 FF 00 FF 00 00 32 01 FF 67 65
72 FF 00 FF FF 01 C1 1A 02 FF FF 4D FF FF FF FF

but not sure that this has helped, atleast TV still turns off A message appeared about having to set some settings though, so I am guessing it worked?
(not sure about that other changed byte but shouldn't have been me, either way the TV still turns off)

I take it there is no way of accessing the actual flash memory?

[juusso]

To get values valid, after you change it, you have to unplug TV from electricity. Also check if they still leave changed after reboot.
If your changed values stay, but tv keeps rebooting then this method is not suitable for repair.


p.s. seem the 4th partition is kernel and this method won`t help you. Actually any of known methods will help (checksums stay from "damaged" partitions. Toggling may help if you have same firmware on both partition sets).
4 /dev/bml0/5 4718592 Image BML USER KERNEL0 NONE 131072 NONE NONE 36