SamyGO - User contributions [en]

Is my TV supported?

2009-12-06T06:24:15Z

Dynamic1969:

Q: My TV model is xxxxxx. Is this model supported?

A: Check the list of currently supported devices on the SamyGO home page and the WiKi main page.
If your model is not in that list, you can still try below steps:

If your model has no P letter after model number, (like LE40B650'''T2W''') Chances are higher that one of the hacks from our WIKI listed below may still work to get you access to your device. Try them out preferably in the
order listed:
# You have a LAN jack? If you have, you can use the Telnet Enabler application to enable network access.
# If Telnet Enabler Application is not working for you for whatever reason, then try to patch your firmware via SamyGO Firmware Enabler script to enable Telnet using [[http://wiki.samygo.tv/index.php?title=How_to_enable_Telnet_on_samsung_TV%27s this page]]
#After you can edit scripts on your TV - before doing so, ensure you have followed the steps on [[http://wiki.samygo.tv/index.php?title=Open_backdoor_for_fixing_bootloop_situations this WiKi page]]. This is a very important step and for your own safety!!!
#If you don't have LAN jack on your TV, than you have only one option: [[http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices Using service port via the ExLink cable]] to enter your TV's linux console.

If your model has P letter after the model number, (Like LE40B650'''T2P''' ) it means that your firmware is encrypted and your hardware has some extra security checks to prevent tinkering with your device's FW.
#Using Telnet Enable Application will enable Telnet, but you won't be able to run every program that you want. You can mount NFS shares but cannot use new kernel modules... Since firmware is encrypted, we cannot touch firmwares for enabling telnet on firmware downloaded from Samsung site ( yet! ).
#[[http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices Accessing the Linux console prompt via the Service Port using an ExLink cable]] is not yet supported for devices with encrypted Firmware but there is a hidden system menu that you may be interested in ( and could try to carefully play with it ).

You should also check out our [[http://forum.samygo.tv/index.php forum]] to see if and what other people may already have been able to do with your model type.
In any case, if you figured out some new features / possibilities on your model, you are more than welcome to share your knowledge in our [[http://forum.samygo.tv/index.php forum]] so that we can add / enhance our list of supported devices.

--[[User:erdem_ua|erdem_ua]] 06:37, 06 December 2009 (EET)

Getting access to u-boot

2009-12-04T22:30:07Z

Dynamic1969: Created page with 'Follow below steps to get access to the bootloader of your device. == Prior to boot-process == * Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote conâ¦'

Follow below steps to get access to the bootloader of your device.
== Prior to boot-process ==
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Change setting for your RS232C interface to "debug" ( Control -> Sub Option -> RS-232 Jack -> [ '''Debug''' | UART | Logic ] )
* Change setting for Watchdog to "off", so that the device doesn't reboot while you are in uBoot menu ( Control -> Sub Option -> Watchdog -> [ on | '''off''' ] )
== During the boot-process ==
* Press and hold "~"
* once you see "Hit any key to stop autoboot: ..." hit ENTER ( by default there is a booting delay of 2 seconds )
 
Now you should have a boot prompt as show below.
== Example output of the bootloader on a UExxB7000 ==
>> ONBOOT :: 0x59a50219 0x12821282
U-Boot 1.1.6 (Dec 12 2008 - 15:55:34)

DRAM: 128 MB
**************** device info *******************
nPgsPerSLCBlk = 128
nPgsPerMLCBlk = 256
nSctsPerPg = 8
nNumOfUsBlks = 994
OneNAND[booting] mode / clk = S / 50Mhz
*************************************************
TinyBML[0] open success
env_relocate_spec
Success loading partition
Environment Data loading success!!
No ethernet found.
In: serial
Out: serial
Err: serial
Net: RTL8139#0
Hit any key to stop autoboot: 0

===============================
===============================
BOOTROM DEBUG SESSION
===============================
1. ENVIRONMENT SETUP

2. SHOW PARTITION

===============================
0. JUMP TO UBOOT PROMPT
r. REBOOT
===============================
===============================
SELECT COMMAND:
Output from "2. SHOW PARTITION" shows the partitions as listed below:
<< CS0 PARTITION INFORMATION >>
======================================================================================
description load addr id attr first_blk no_blks
======================================================================================
0 : boot loader 0x60100000 (0x00000000) SLC (0x9001) 0 1
--------------------------------------------------------------------------------------
1 : u-boot 0x60200000 (0x00000001) SLC (0xd401) 1 1
--------------------------------------------------------------------------------------
2 : u-boot env 0x60300000 (0x00000002) SLC (0x9001) 2 1
--------------------------------------------------------------------------------------
3 : update util 0x60400000 (0x00000003) SLC (0x9001) 3 1
--------------------------------------------------------------------------------------
4 : kernel image 0x61000000 (0x00000004) SLC (0xd001) 4 8
--------------------------------------------------------------------------------------
5 : root file system 0x61400000 (0x00000005) SLC (0x9001) 12 8
--------------------------------------------------------------------------------------
6 : boot modules 0x61800000 (0x00000006) SLC (0x9001) 20 4
--------------------------------------------------------------------------------------
7 : driver+exeDSP 1 0x70000000 (0x00000007) MLC (0xa001) 24 60
--------------------------------------------------------------------------------------
8 : appdata+cmmLib 1 0x78000000 (0x00000008) MLC (0xa001) 84 45
--------------------------------------------------------------------------------------
9 : driver+exeDSP 2 0xffffffff (0x00000009) MLC (0xa001) 129 60
--------------------------------------------------------------------------------------
10 : appdata+cmmLib 2 0xffffffff (0x0000000a) MLC (0xa001) 189 45
--------------------------------------------------------------------------------------
11 : mtd_tlib rw 0xffffffff (0x00000014) MLC (0xa101) 234 450
--------------------------------------------------------------------------------------
12 : mtd_rwarea rw 0xffffffff (0x00000015) MLC (0x2101) 684 42
--------------------------------------------------------------------------------------
13 : mtd_infolink rw 0xffffffff (0x00000016) MLC (0x2101) 726 150
--------------------------------------------------------------------------------------
14 : OTA rw 0xffffffff (0x00000017) MLC (0x2101) 876 118
--------------------------------------------------------------------------------------
======================================================================================

<< CS1 PARTITION INFORMATION >>
======================================================================================
Device[1] not opened

Output from "1: ENVIRONMENT SETUP" with very interesting environment variables:
------------------------------
- ENVIRONMENT SETUP -
------------------------------
1. BOOTING COMMAND = bbm load fkernel;go 60008000
2. BOOTING DELAY = 2
3. TARGET IP = 10.88.23.246
4. SERVER IP = 10.88.27.160
5. GATEWAY IP = 10.88.23.1
6. ETHERNET ADDRESS = 10:11:12:13:14:15
7. BOOTING ARGS = root=139:6 rw ethaddr=10:11:12:13:14:15 ip=10.88.23.246 :10.88.27.160:10.88.24.1:255.255.255.0::eth0 console=ttyS1
8. UPDATE BOOTING ARGS
------------------------------
s. SAVE ENVIRONMENT
x. EXIT
------------------------------
The available uBoot commands are shown via "0. JUMP TO UBOOT PROMPT":
LEONID # help
? - alias for 'help'
mtest - simple RAM test
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
go - start application at address 'addr'
help - print online help
iminfo - print header information for application image
itest - return true/false on integer compare
jade -
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
rtl8139_eeprom - read & print out eeprom contents
rtl8139_eth_addr <mac addr> - write new mac address to eeprom.
rtl8139_eth_init - write 0xffff into eeprom
rtl8139_eth_setup - write default values into eeprom
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves - save S-Record file over serial line
setenv - set environment variables
sleep - delay execution for some time
smctest [r|w|t] [addr]- raw access to DATARAM0 1KB(ldm/stm by 8 words)
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
LEONID # fatls
usage: fatls <interface> <dev[:part]> [directory]
LEONID #boot[/code]
Entering "boot" from uboot menu starts over normally without issues.

--[[User:Dynamic1969|Dynamic1969]] 22:30, 4 December 2009 (UTC)

Main Page

2009-12-04T22:09:04Z

Dynamic1969: /* Firmware Modification */

== Welcome to SamyGo WiKi ==
Unfortunately, SourceForge doesn't allow users to write on wiki. We needed to assign writing permission by hand.

You can give a vote "thumb up" for this idea for make [http://sourceforge.net/apps/ideatorrent/sourceforge/ideatorrent/idea/172/ SourceForge to allow user write access to wiki].

So, edit permissions will be granted on request from forum (Drop mesage to Erdem_ua or dynamic1969).

[[File:Logo.png|left]]
<div id='TableOfCompatibility'>
{| border="1" cellpadding="2" cellspacing="0"
|+'''Table Of Compatibility for SamyGO Firmware Patch Script'''
!width="50"|Name of Device
!width="150"|Firmware
!width="100"|Version
!width="50"|Telnet
!width="90"|Video AR Fix
!width="200"|Notes
|-align="center"
|rowspan="2"|LExxB65x LExxB75x PSxxB6xx||rowspan="2"|T-CHL7DEUC||2004.1||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v2
|-align="center"
||2005.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|LNxxB65x||T-CHEAUSC||1012.3||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|LExxB55x LExxB62x PSxxB55x PSxxB56x UExxB6xxx ||T-CHL5DEUC||2008.0||bgcolor="#ff9090"|No||bgcolor="#90ff90"|v1||Also play movie from USB supported (WiseLink hack)
|-align="center"
|rowspan="4"|UExxB7xxx PSxxB85x||rowspan="4"|T-CHU7DEUC||2004.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|2008.2||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|2009.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|3000.G||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1
|-align="center"
|LExxA7xxx LExxA8xxx LExxA9xxx||T-RBYDEUC||1013.1||bgcolor="#ff9090"|No||bgcolor="#ff9090"|No
|-align="center"
|LExxA676||T-AMBDFRC||1017.0||bgcolor="#ff9090"|No||bgcolor="#ff9090"|No
|-align="center"
|Any T2P(CI+) Device||T-CHxCIPDEUC||Any Version||bgcolor="#ffff90"|By Telnet Enabler Application||bgcolor="#ffff90"|Work In Progress|| Solving Encryption Problem
|}
</div>

== Safety Measures ( which you shouldn't start without ) ==
#Have a working Ex-Link cable at hand.
#Ensure the backup exe.img ( stored on /dev/tbml10 ) is in good condition ( and ideally not altered. )
#Ensure your RS232 Setting in the Service-Menu is set to "debug".
#Know that your TV will reset RS232 jack back to UART mode after new firmware installation or reverting back to old version.
 

== Useful WIKI articles ==
===Firmware Modification===
*[[How to enable Telnet on samsung TV's]]
*[[How to enable Telnet/NFS/CIFS/SAMBA]]
*[[Enable Serial Console on non CI+ Devices]]
*[[Getting access to uBoot / bootloader]]
*[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]
*[[Open backdoor for fixing bootloop situations]]
*[[Mounting an NFS share on a USB device to bypass DLNA]]
*[[Mounting an CIFS/SAMBA share on a USB device to bypass DLNA]]

===Software Tools===
*[[Setting up a native-compilation toolchain]]
*[[Setting up a cross-compilation toolchain]]
*[[SamyGO Extensions Pack]]

===General Information===
*[[Frequently Asked Questions]]
*[[Service Manuals]]
*[[Service Menu]]
*[[Engineering Codes]]
*[[Media Play and DLNA]]
 

== Interesting Reference Material ==
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_ApplicationNotes.html Introduction to SAMSUNG's Linux Flash File System - RFS]
The file-system used in the the recent Samsung TVs is "RFS". Its proprietary nature and consequently so the absence of an according Linux RFS-Module in the standard Linux distributions makes it currently impossible to modify files by simply mounting the respective image as "RW", modifying it and saving the respective image again. This is the reason why currently all changes are done via patching of the image-binaries.
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_PortingGuide.html Linux RFS ( Robust FAT File System ) Porting Guide]
The information provided here should help, that we get a RFS module compiled for our common Linux distributions
 
--[[User:Dynamic1969|Dynamic1969]] 19:24, 6 October 2009 (UTC)

== Disclaimer ==
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx, LExxB65x and compatible devices only.

Dumping and Flashing images by hand

2009-11-30T20:34:53Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if you are just flashing modifications of the same exeDSP Version. 
'''In any case you need to ensure that you erase the respective flash before overwriting it.'''
== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Erase the flash before flashing the new file
bml.erase /dev/bml0/8
*(8) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(9) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(10) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down after re-starting exeDSP ;-) as
the exeDSP binary seems to expect a freshly initialized HW to start-up properly 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-11-21T02:00:27Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if you are just flashing modifications of the same exeDSP Version. 
'''In any case you need to ensure that you erase the respective flash before overwriting it.'''
== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Erase the flash before flashing the new file
bml.erase /dev/bml0/8
*(8) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(9) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(10) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-11-21T01:57:02Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if you are just flashing modifications of the same exeDSP Version.
'''In any case you need to ensure that you erase the respective flash before overwriting it.'''
== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-11-21T01:50:25Z

Dynamic1969: /* WARNING - WARNING - WARNING - WARNING - WARNING - WARNING */

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-11-21T01:49:37Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== WARNING - WARNING - WARNING - WARNING - WARNING - WARNING ==

== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-11-01T19:09:26Z

Dynamic1969: /* Manual flashing steps */

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== WARNING - WARNING - WARNING - WARNING - WARNING - WARNING ==

''' Don't use this method until further notice, as I have observed some wired behavior that results in the TV not booting up. '''
''' I am investigating the problem at the moment and advise everyone TO NOT USE THIS METHOD FOR THE TIME BEING!!!!! '''

== WARNING - WARNING - WARNING - WARNING - WARNING - WARNING ==

== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-10-31T16:21:53Z

Dynamic1969: /* Device files used */

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== WARNING - WARNING - WARNING - WARNING - WARNING - WARNING ==

''' Don't use this method until further notice, as I have observed some wired behavior that results in the TV not booting up. '''
''' I am investigating the problem at the moment and advise everyone TO NOT USE THIS METHOD FOR THE TIME BEING!!!!! '''

== WARNING - WARNING - WARNING - WARNING - WARNING - WARNING ==

== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''

== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.resore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Dumping and Flashing images by hand

2009-10-22T21:29:57Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== Device files used ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''
== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.resore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Mounting an NFS share on a USB device to bypass DLNA

2009-10-12T14:58:51Z

Dynamic1969: /* Problems */

By marcelr, major input from arris69 and a bunch of others from the avsforum.

== What you need ==
*A working NFS server on your network
*telnet access to your TV
*Possibly a USB pendrive (if you're lucky, you don't need this)
== What you do ==
*set up your NFS server to export at least one directory to your TV. Since your TV will probably only play music, movies etc. exporting read-only will do. A typical line in your exports file (/etc/exports on most unices) will look like this:
/full-path-to-directory-to-export aaa.bbb.ccc.ddd/32(ro) # tv will mount read-only
with aaa.bbb.ccc.ddd your TV's IP-address.
*If you haven't done so already, set up telnet access to your TV, see [[How to enable Telnet on samsung TV's]].
''Comment from dynamic1969: The below steps assume, that you modified your exe.img with "''';/mtd_rwarea/rc.local&'''" instead of "''';/etc/telnetd_start.sh&'''". We will make sure both match going forward.''
*create and edit /mtd_rwarea/rc.local to startup the telnet daemon, mine looks like this:
#!/bin/sh

# do not EVER remove the next two lines: They are your only access to your TV!
mount -t devpts devpts /dev/pts
telnetd
* make sure rc.local is executable:
chmod 755 /mtd_rwarea/rc.local
*patch your exe.img file to execute /mtd_rwarea/rc.local and install, see [[Open backdoor for fixing bootloop situations]] for details.
*reboot, telnet to your TV and open /mtd_rwarea/rc.local
Depending on your the combination of hardware/software, two major possibilities exist for mounting NFS shares:
*''first possibility, via usb pendrive,'' works always: Insert a USB pendrive with at least one empty subdirectory in the root directory, e.g., /media
*add the following lines to rc.local, or put them in a separate script which in turn is called from rc.local:
# wait for the rest of the TV boot sequence to complete, the USB stick with the
# mount point for the NFS share is mounted downstream from this script ....
sleep 30 # YMMV

# mount NFS share
mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda1/media -t nfs
with ppp.qqq.rrr.sss the nfs server's IP address, /dtv/usb/sda1 is the place where USB drives are mounted (at least on my TV)
*make sure this script is executed in the background. Otherwise you may get bootloop situations.
*''second possibility, without USB pendrive'', may work if you're lucky: Add the following lines to rc.local:
sleep 30 # YMMV

mkdir -p /dtv/usb/sda4

# mount NFS share:

mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda4 -t nfs

# append sda4 notification to log file:

echo "[sdd]
Vendor : Linux
Product : Ext disk
Serial : Q80VQLFL
Devpath : 4
Lun : 0
MountDir : /dtv/usb/sda4
FileSystem : vfat

" >> /dtv/usb/log
The mounted share will show up when you hit the media.p button on the remote.
The second method does NOT work on uexxB70xx (and probably others, please notify me in the forum).

== Benefits of NFS vs DLNA ( below others ) ==
* Via this method you can use features like FWD, RWD, PAUSE etc. ( which for some wired reasons are lacking with DLNA )
* Some Container Formats & Codecs appear as not supported via DLNA but work fine when opened via NFS

== Problems ==
* If you use 'Allegro' as a NFS server on Windows XP the subtitles won#t work on your TV. ( You can use other alternatives like Cygwin with NFS server )

Mounting an NFS share on a USB device to bypass DLNA

2009-10-12T14:56:09Z

Dynamic1969:

By marcelr, major input from arris69 and a bunch of others from the avsforum.

== What you need ==
*A working NFS server on your network
*telnet access to your TV
*Possibly a USB pendrive (if you're lucky, you don't need this)
== What you do ==
*set up your NFS server to export at least one directory to your TV. Since your TV will probably only play music, movies etc. exporting read-only will do. A typical line in your exports file (/etc/exports on most unices) will look like this:
/full-path-to-directory-to-export aaa.bbb.ccc.ddd/32(ro) # tv will mount read-only
with aaa.bbb.ccc.ddd your TV's IP-address.
*If you haven't done so already, set up telnet access to your TV, see [[How to enable Telnet on samsung TV's]].
''Comment from dynamic1969: The below steps assume, that you modified your exe.img with "''';/mtd_rwarea/rc.local&'''" instead of "''';/etc/telnetd_start.sh&'''". We will make sure both match going forward.''
*create and edit /mtd_rwarea/rc.local to startup the telnet daemon, mine looks like this:
#!/bin/sh

# do not EVER remove the next two lines: They are your only access to your TV!
mount -t devpts devpts /dev/pts
telnetd
* make sure rc.local is executable:
chmod 755 /mtd_rwarea/rc.local
*patch your exe.img file to execute /mtd_rwarea/rc.local and install, see [[Open backdoor for fixing bootloop situations]] for details.
*reboot, telnet to your TV and open /mtd_rwarea/rc.local
Depending on your the combination of hardware/software, two major possibilities exist for mounting NFS shares:
*''first possibility, via usb pendrive,'' works always: Insert a USB pendrive with at least one empty subdirectory in the root directory, e.g., /media
*add the following lines to rc.local, or put them in a separate script which in turn is called from rc.local:
# wait for the rest of the TV boot sequence to complete, the USB stick with the
# mount point for the NFS share is mounted downstream from this script ....
sleep 30 # YMMV

# mount NFS share
mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda1/media -t nfs
with ppp.qqq.rrr.sss the nfs server's IP address, /dtv/usb/sda1 is the place where USB drives are mounted (at least on my TV)
*make sure this script is executed in the background. Otherwise you may get bootloop situations.
*''second possibility, without USB pendrive'', may work if you're lucky: Add the following lines to rc.local:
sleep 30 # YMMV

mkdir -p /dtv/usb/sda4

# mount NFS share:

mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda4 -t nfs

# append sda4 notification to log file:

echo "[sdd]
Vendor : Linux
Product : Ext disk
Serial : Q80VQLFL
Devpath : 4
Lun : 0
MountDir : /dtv/usb/sda4
FileSystem : vfat

" >> /dtv/usb/log
The mounted share will show up when you hit the media.p button on the remote.
The second method does NOT work on uexxB70xx (and probably others, please notify me in the forum).

== Benefits of NFS vs DLNA ( below others ) ==
* Via this method you can use features like FWD, RWD, PAUSE etc. ( which for some wired reasons are lacking with DLNA )
* Some Container Formats & Codecs appear as not supported via DLNA but work fine when opened via NFS

== Problems ==
* If you use 'Allegro' as a NFS server on Windows XP Pro, this will make subtitles can't view on your TV. ( You can use other alternatives like Cygwin with NFS server )

Main Page

2009-10-06T19:25:16Z

Dynamic1969: /* Interesting Reference Material */

== Welcome to SamyGo WiKi ==
Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

== Safety Measures ( which you shouldn't start without ) ==
#Have a working Ex-Link cable at hand
#Ensure the backup exe.img ( stored on /dev/tbml10 ) is in good condition ( and ideally not altered )
#Ensure your RS232 Setting in the Service-Menu is set to "debug"
 
== Useful WIKI articles ==
[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open backdoor for fixing bootloop situations]]

[[How to enable Telnet on samsung TV's]]

[[Mounting an NFS share on a USB device to bypass DLNA]]

[[TODO: Mounting an CIFS/SAMBA share from TV]]
 
== Interesting Reference Material ==
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_ApplicationNotes.html Introduction to SAMSUNG's Linux Flash File System - RFS]
The file-system used in the the recent Samsung TVs is "RFS". Its proprietary nature and consequently so the absence of an according Linux RFS-Module in the standard Linux distributions makes it currently impossible to modify files by simply mounting the respective image as "RW", modifying it and saving the respective image again. This is the reason why currently all changes are done via patching of the image-binaries.
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_PortingGuide.html Linux RFS ( Robust FAT File System ) Porting Guide]
The information provided here should help, that we get a RFS module compiled for our common Linux distributions
 
--[[User:Dynamic1969|Dynamic1969]] 19:24, 6 October 2009 (UTC)

== Disclaimer ==
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Main Page

2009-10-06T19:24:16Z

Dynamic1969: /* Interesting Reference Material */

== Welcome to SamyGo WiKi ==
Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

== Safety Measures ( which you shouldn't start without ) ==
#Have a working Ex-Link cable at hand
#Ensure the backup exe.img ( stored on /dev/tbml10 ) is in good condition ( and ideally not altered )
#Ensure your RS232 Setting in the Service-Menu is set to "debug"
 
== Useful WIKI articles ==
[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open backdoor for fixing bootloop situations]]

[[How to enable Telnet on samsung TV's]]

[[Mounting an NFS share on a USB device to bypass DLNA]]

[[TODO: Mounting an CIFS/SAMBA share from TV]]
 
== Interesting Reference Material ==
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_ApplicationNotes.html Introduction to SAMSUNG's Linux Flash File System - RFS]
The file-system used in the the recent Samsung TVs is "RFS". Its proprietary nature and consequently so the absence of an according Linux RFS-Module in the standard Linux distributions makes it currently impossible to modify files by simply mounting the respective image as "RW", modifying it and saving the respective image again. This is the reason why currently all changes are done via patching of the image-binaries.
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_PortingGuide.html Linux RFS ( Robust FAT File System ) Porting Guide]
The information provided here should help, that we get a RFS module compiled for our common Linux distributions
--[[User:Dynamic1969|Dynamic1969]] 19:24, 6 October 2009 (UTC)

== Disclaimer ==
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Main Page

2009-10-06T19:22:26Z

Dynamic1969:

== Welcome to SamyGo WiKi ==
Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

== Safety Measures ( which you shouldn't start without ) ==
#Have a working Ex-Link cable at hand
#Ensure the backup exe.img ( stored on /dev/tbml10 ) is in good condition ( and ideally not altered )
#Ensure your RS232 Setting in the Service-Menu is set to "debug"
 
== Useful WIKI articles ==
[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open backdoor for fixing bootloop situations]]

[[How to enable Telnet on samsung TV's]]

[[Mounting an NFS share on a USB device to bypass DLNA]]

[[TODO: Mounting an CIFS/SAMBA share from TV]]
 
== Interesting Reference Material ==
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_ApplicationNotes.html Introduction to SAMSUNG's Linux Flash File System - RFS]
The file-system used in the the recent Samsung TVs is "RFS". Its proprietary nature and consequently so the absence of an according Linux RFS-Module in the standard Linux distributions makes it currently impossible to modify files by simply mounting the respective image as "RW", modifying it and saving the respective image again. This is the reason why currently all changes are done via patching of the image-binaries.
*[http://www.samsung.com/global/business/semiconductor/products/flash/Products_RFS_PortingGuide.html Linux RFS ( Robust FAT File System ) Porting Guide]
The information provided here should help, that we get a RFS module compiled for our common Linux distributions

== Disclaimer ==
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Mounting an NFS share on a USB device to bypass DLNA

2009-10-04T19:23:19Z

Dynamic1969:

By marcelr, major input from arris69 and a bunch of others from the avsforum.

== What you need ==
*A working NFS server on your network
*telnet access to your TV
*Possibly a USB pendrive (if you're lucky, you don't need this)
== What you do ==
*set up your NFS server to export at least one directory to your TV. Since your TV will probably only play music, movies etc. exporting read-only will do. A typical line in your exports file (/etc/exports on most unices) will look like this:
/full-path-to-directory-to-export aaa.bbb.ccc.ddd/32(ro) # tv will mount read-only
with aaa.bbb.ccc.ddd your TV's IP-address.
*If you haven't done so already, set up telnet access to your TV, see [[How to enable Telnet on samsung TV's]].
''Comment from dynamic1969: The below steps assume, that you modified your exe.img with "''';/mtd_rwarea/rc.local&'''" instead of "''';/etc/telnetd_start.sh&'''". We will make sure both match going forward.''
*create and edit /mtd_rwarea/rc.local to startup the telnet daemon, mine looks like this:
#!/bin/sh

# do not EVER remove the next two lines: They are your only access to your TV!
mount -t devpts devpts /dev/pts
telnetd
* make sure rc.local is executable:
chmod 755 /mtd_rwarea/rc.local
*patch your exe.img file to execute /mtd_rwarea/rc.local and install, see [[Open backdoor for fixing bootloop situations]] for details.
*reboot, telnet to your TV and open /mtd_rwarea/rc.local
Depending on your the combination of hardware/software, two major possibilities exist for mounting NFS shares:
*''first possibility, via usb pendrive,'' works always: Insert a USB pendrive with at least one empty subdirectory in the root directory, e.g., /media
*add the following lines to rc.local, or put them in a separate script which in turn is called from rc.local:
# wait for the rest of the TV boot sequence to complete, the USB stick with the
# mount point for the NFS share is mounted downstream from this script ....
sleep 30 # YMMV

# mount NFS share
mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda1/media -t nfs
with ppp.qqq.rrr.sss the nfs server's IP address, /dtv/usb/sda1 is the place where USB drives are mounted (at least on my TV)
*make sure this script is executed in the background. Otherwise you may get bootloop situations.
*''second possibility, without USB pendrive'', may work if you're lucky: Add the following lines to rc.local:
sleep 30 # YMMV

mkdir -p /dtv/usb/sda4

# mount NFS share:

mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda4 -t nfs

# append sda4 notification to log file:

echo "[sdd]
Vendor : Linux
Product : Ext disk
Serial : Q80VQLFL
Devpath : 4
Lun : 0
MountDir : /dtv/usb/sda4
FileSystem : vfat

" >> /dtv/usb/log
The mounted share will show up when you hit the media.p button on the remote.
The second method does NOT work on uexxB70xx (and probably others, please notify me in the forum).

== Benefits of NFS vs DLNA ( below others ) ==
* Via this method you can use features like FWD, RWD, PAUSE etc. ( which for some wired reasons are lacking with DLNA )
* Some Codes are not supported when using DLNA but work fine via NFS

Mounting an NFS share on a USB device to bypass DLNA

2009-10-04T19:14:06Z

Dynamic1969:

By marcelr, major input from arris69 and a bunch of others from the avsforum.

What you need:
*A working NFS server on your network
*telnet access to your TV
*Possibly a USB pendrive (if you're lucky, you don't need this)
What you do:
*set up your NFS server to export at least one directory to your TV. Since your TV will probably only play music, movies etc. exporting read-only will do. A typical line in your exports file (/etc/exports on most unices) will look like this:
/full-path-to-directory-to-export aaa.bbb.ccc.ddd/32(ro) # tv will mount read-only
with aaa.bbb.ccc.ddd your TV's IP-address.
*If you haven't done so already, set up telnet access to your TV, see [[How to enable Telnet on samsung TV's]].
''Comment from dynamic1969: The below steps assume, that you modified your exe.img with "''';/mtd_rwarea/rc.local&'''" instead of "''';/etc/telnetd_start.sh&'''". We will make sure both match going forward.''
*create and edit /mtd_rwarea/rc.local to startup the telnet daemon, mine looks like this:
#!/bin/sh

# do not EVER remove the next two lines: They are your only access to your TV!
mount -t devpts devpts /dev/pts
telnetd
* make sure rc.local is executable:
chmod 755 /mtd_rwarea/rc.local
*patch your exe.img file to execute /mtd_rwarea/rc.local and install, see [[Open backdoor for fixing bootloop situations]] for details.
*reboot, telnet to your TV and open /mtd_rwarea/rc.local
Depending on your the combination of hardware/software, two major possibilities exist for mounting NFS shares:
*''first possibility, via usb pendrive,'' works always: Insert a USB pendrive with at least one empty subdirectory in the root directory, e.g., /media
*add the following lines to rc.local, or put them in a separate script which in turn is called from rc.local:
# wait for the rest of the TV boot sequence to complete, the USB stick with the
# mount point for the NFS share is mounted downstream from this script ....
sleep 30 # YMMV

# mount NFS share
mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda1/media -t nfs
with ppp.qqq.rrr.sss the nfs server's IP address, /dtv/usb/sda1 is the place where USB drives are mounted (at least on my TV)
*make sure this script is executed in the background. Otherwise you may get bootloop situations.
*''second possibility, without USB pendrive'', may work if you're lucky: Add the following lines to rc.local:
sleep 30 # YMMV

mkdir -p /dtv/usb/sda4

# mount NFS share:

mount -o nolock ppp.qqq.rrr.sss:/full-path-to-directory-to-export /dtv/usb/sda4 -t nfs

# append sda4 notification to log file:

echo "[sdd]
Vendor : Linux
Product : Ext disk
Serial : Q80VQLFL
Devpath : 4
Lun : 0
MountDir : /dtv/usb/sda4
FileSystem : vfat

" >> /dtv/usb/log
The mounted share will show up when you hit the media.p button on the remote.
The second method does NOT work on uexxB70xx (and probably others, please notify me in the forum).

How to enable Telnet on samsung TV's

2009-10-04T19:06:05Z

Dynamic1969:

(by dynamic1969, edits and extensions by marcelr, erdem_ua, suggestions by olivluca, grajen)

If you know what you are doing and are simply looking for a tool that will do all of the hacking for you, then you can use [http://forum.samygo.tv/download/file.php?id=4 SamyGO script] (requires python installed on your system) to make all modifications to your firmware. This will produce an exe.img ready to [[#Flash to TV]].

If you are a novice, then I recommend you take some time to read and understand what you are doing first! THIS CAN BRICK YOUR DEIVCE !!

Read below for a detailed HowTo of the steps taken :

== Prerequisites ==
(if you do not have ALL of these: Google is your friend, at least for the software):

*a Samsung TV attached to your local network.
*a hex editor.
**Linux : okteta and many others
**Windows: flexhex, neo, and many others.
**Mac :
*a crc32 checksum calculator.
**Linux : okteta 0.3 or later, check, minicrc and many others
**Windows: flexhex, be wary of little endian (byte-reversed) checksums, possibly others
**Mac :
*xor encryption/decryption software.
**Linux : okteta 0.3 or later, crypt-xor, possibly others. I wrote my own ...
**Windows: flexhex, possibly others
**Mac :
*a normal ASCII editor.
**Linux : emacs, vi, gedit and and many more.
**Windows: notepad (Or a word processor. Be careful to save in ascii mode, .txt format)
**Mac :
*a telnet client.

== Hacking the Firmware ==
To acquire telnet access to your tv, do the following:

*Download the firmware package for your tv from the Samsung website and unpack it. As an example in this HOWTO, the T-CHU7DEUC.exe file for a ue40b70xx is taken. This will also work on any other xor-encoded firmware. Just replace the T-CHU7DEUC in this howto with your firmware name. When working on a linux box, you can unpack it with wine or unrar.
*Decrypt exe.img.enc in the T-CHU7DEUC/image directory using an xor decrypter with key "T-CHU7DEUC" (the firmware root directory name) and name it exe.img
*Check the CRC32 checksum of your decrypted file (exe.img). It should match the checksum (8-digit hexadecimal number), <xxxxxxxx> given in validinfo.txt _exactly_:
*007_exe.img_xxxxxxxx*011_appdata.img_126fb41f
If the checksums don't match, check the following: Is the downloaded file not corrupted? Is your decryption flawless?
*Using a hex-editor, make the following changes to the contents of rc.local in the decrypted exe.img file: locate the lines:

export KF_LOG=/dev/null '''#Remove engine logging.'''
cd /mtd_exe/

./exeDSP

and replace just the text element marked '''bold''', as shown below:

export KF_LOG=/dev/null''';/etc/telnetd_start.sh&'''
cd /mtd_exe/

./exeDSP
-> For safety reasons it is recommended that you don't miss the "&" at the end ( this is not yet considered in the SamyGo Script YET! )

Make sure you do not change the length of the image file. To be on the safe side, replace any unprintable characters on the changed line with spaces, but _keep_ the linefeed (0x0a)

And remember: Think before you type.
*Re-calculate the CRC32 checksum for the updated image.
*Using a normal ASCII editor, update validinfo.txt in the T-CHU7DEUC/image directory with the new CRC information: Replace xxxxxxxx in this line with the newly calculated checksum (8 hexadecimal digits, be aware of leading zeros):
*007_exe.img_xxxxxxxx*011_appdata.img_126fb41f
*Encrypt exe.img again, using xor encryption with key "T-CHU7DEUC" and copy it into the T-CHU7DEUC/image directory. Name it "exe.img.enc"

=== Flash to TV ===
*Move the T-CHU7DEUC directory and all of its contents to an otherwise empty USB drive, plugin the USB drive into your TV and manually start the upgrade via the appropriate menu entry on your TV

=== Result ===
*After upgrade, open a shell and start a telnet session on your tv:

$ telnet aaa.bbb.ccc.ddd

with aaa.bbb.ccc.ddd your tv's IP-address. when prompted, log in as <root>
This is what you'll see, when connected:

$ telnet aaa.bbb.ccc.ddd
Trying aaa.bbb.ccc.ddd...
Connected to aaa.bbb.ccc.ddd.
Escape character is '^]'.

localhost login: root
-sh: id: not found
#
You can now start typing commands. For available commands visit the normal places: /bin, /sbin, /usr/bin and /usr/sbin

Main Page

2009-10-04T18:57:18Z

Dynamic1969:

Dumping and Flashing images by hand

2009-10-04T01:24:03Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
== Manual flashing steps ==
*(1) Prevent TV from rebooting when exeDSP is stopped
/mtd_boot/MicomCtrl 23
*(2) Stop exeDSP binary
killall -9 exeDSP
*(3) Unmount the respective directory
umount /mtd_exe
*(4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
*(5) Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu'''
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
rm /mtd_swu/exe.img.orig 
*(6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
*(7) Perform the actual step of flashing the file.
bml.resore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
*(8) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe 
*(9) Starting exeDSP 
/mtd_exe/rc.local
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
== Flash Device files ==
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
=== T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC ===
*BOOTLOADER_DEVICE='''/dev/bml0/2'''
*FNW_DEVICE='''/dev/bml0/4'''
*KERNEL_DEVICE='''/dev/bml0/5'''
*RFS_DEVICE='''/dev/bml0/6'''
*BOOT_DEVICE='''/dev/bml0/7'''
=== T-CHL5DSEUC and T-CHL5DEUC Specific ===
*EXE_DEVICE='''/dev/stl0/8'''
*APPDATA_DEVICE='''/dev/stl0/9'''
=== T-CHU7DEUC Specific ===
*EXE_DEVICE='''/dev/bml0/8'''
*APPDATA_DEVICE='''/dev/bml0/9'''
 '''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Enable Serial Console on B series TV

2009-10-04T00:55:00Z

Dynamic1969:

Find below the steps you need to follow to enable console access to your TV via a serial cable.
 
== The Ex-Link (serial) cable ==
*Solder yourself ( or buy ) an Ex-Link serial cable to connect to your Samsung TV. See [http://www.wiremunky.com/file/documents/exlink.gif here] for the Serial Cable specs. You can ignore the rest of the information posted there, as it is not applicable for the more recent Samsung devices.
 
== Configure your TV for Debug-Mode ==
*Enter Service Menu ( quickly push '''[INFO] [MENU] [MUTE] [POWER]''' on your remote control )
*Change setting for your RS232C interface to "debug" ( Control -> Sub Option -> RS-232 Jack -> [ '''Debug''' | UART | Logic ] )
 
== Terminal Connection Parameters ==
*Use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''
 
== Activating the serial console ==
*Switch on your TV ... If you did everything right and everything works as expected, then you should see the boot-log on your terminal.
*Enter "'''debug'''" at the invisible prompt ... to enable your serial console. You should see something like below with each keystroke
[SERIAL INPUT MANAGE] 1-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 2-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 3-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 4-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 5-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] serial input ENABLE!!!!!
*Now you need to be fast ...
**hit '''CTRL-C''', which stops the exeDSP binary
**immediately after that enter ( you have ca. 3 seconds ... I suggest you cut&paste this command ):
/mtd_boot/MicomCtrl 23'''
This now prevents your LED/LCD to stop and you have a command prompt of the TV-Console.
 

--[[User:Dynamic1969|Dynamic1969]] 16:17, 3 October 2009 (UTC)

Open backdoor for fixing bootloop situations

2009-10-04T00:43:21Z

Dynamic1969:

Some people have reported about a bootloop preventing the TV from starting through. The issue here often is, that the script invoked from within '''/mtd_exe/rc.local''' is getting stuck and preventing the exeDSP to start.
 There are two key steps that should be considered when hacking your image, to avoid such situations or at least to open a external "backdoor" to prevent the respective script from starting.
 
== Patching your exe.img ==
*Ensure that you send your scripts into the background when starting, by padding with a '''"&"'''. Your changes in /mtd_exe/rc.local should look like:
export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib
export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager
export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal
export MAPLE_WIDGET_DATA_PATH=/mtd_down
export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc
export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB
export KF_SLEEP_READ=-2
echo 30000 > /mtd_rwarea/DelayValue.txt
#touch /mtd_rwarea/DoPrintYahoo.txt
export KF_NO_INTERACTIVE=1
export KF_LOG=/dev/null''';/mtd_rwarea/rc.local&'''
cd /mtd_exe/

./exeDSP
== /mtd_rwarea/rc.local ==
*Include a check in your '''/mtd_rwarea/rc.local''' script, so that it will source and run a different set of commands, dependent on whether a specific file is detected on the USB-Drive or not. An example could look like:
#!/bin/sh sleep 20 # Allow USB-stick to settle
USB="/dtv/usb/sda1" # Your USB mount-point
if [ -f $USB/usb.sh ];then
. $USB/usb.sh # USB-File detected. Source and run this instead
else
. /mtd_rwarea/mtd_rwarea.sh # Source and run "normal startup script"
fi
exit

How to enable Telnet on samsung TV's

2009-10-04T00:39:51Z

Dynamic1969:

(by dynamic1969, edits and extensions by marcelr, erdem_ua, suggestions by olivluca, grajen)

If you know what you are doing and are simply looking for a tool that will do all of the hacking for you, then you can use [http://forum.samygo.tv/download/file.php?id=4 SamyGO script] (requires python installed on your system) to make all modifications to your firmware. This will produce an exe.img ready to [[#Flash to TV]].

If you are a novice, then I recommend you take some time to read and understand what you are doing first! THIS CAN BRICK YOUR DEIVCE !!

Read below for a detailed HowTo of the steps taken :

== Prerequisites ==
(if you do not have ALL of these: Google is your friend, at least for the software):

*a Samsung TV attached to your local network.
*a hex editor.
**Linux : okteta and many others
**Windows: flexhex, neo, and many others.
**Mac :
*a crc32 checksum calculator.
**Linux : okteta 0.3 or later, check, minicrc and many others
**Windows: flexhex, be wary of little endian (byte-reversed) checksums, possibly others
**Mac :
*xor encryption/decryption software.
**Linux : okteta 0.3 or later, crypt-xor, possibly others. I wrote my own ...
**Windows: flexhex, possibly others
**Mac :
*a normal ASCII editor.
**Linux : emacs, vi, gedit and and many more.
**Windows: notepad (Or a word processor. Be careful to save in ascii mode, .txt format)
**Mac :
*a telnet client.

== Hacking the Firmware ==
To acquire telnet access to your tv, do the following:

*Download the firmware package for your tv from the Samsung website and unpack it. As an example in this HOWTO, the T-CHU7DEUC.exe file for a ue40b70xx is taken. This will also work on any other xor-encoded firmware. Just replace the T-CHU7DEUC in this howto with your firmware name. When working on a linux box, you can unpack it with wine or unrar.
*Decrypt exe.img.enc in the T-CHU7DEUC/image directory using an xor decrypter with key "T-CHU7DEUC" (the firmware root directory name) and name it exe.img
*Check the CRC32 checksum of your decrypted file (exe.img). It should match the checksum (8-digit hexadecimal number), <xxxxxxxx> given in validinfo.txt _exactly_:
*007_exe.img_xxxxxxxx*011_appdata.img_126fb41f
If the checksums don't match, check the following: Is the downloaded file not corrupted? Is your decryption flawless?
*Using a hex-editor, make the following changes to the contents of rc.local in the decrypted exe.img file: locate the lines:

export KF_LOG=/dev/null #Remove engine logging.
cd /mtd_exe/

./exeDSP

and replace the first one with:

export KF_LOG=/dev/null;/etc/telnetd_start.sh;

Do not touch:

cd /mtd_exe/

./exeDSP

Make sure you do not change the length of the image file. To be on the safe side, replace any unprintable characters on the changed line with spaces, but _keep_ the linefeed (0x0a)

And remember: Think before you type.
*Re-calculate the CRC32 checksum for the updated image.
*Using a normal ASCII editor, update validinfo.txt in the T-CHU7DEUC/image directory with the new CRC information: Replace xxxxxxxx in this line with the newly calculated checksum (8 hexadecimal digits, be aware of leading zeros):
*007_exe.img_xxxxxxxx*011_appdata.img_126fb41f
*Encrypt exe.img again, using xor encryption with key "T-CHU7DEUC" and copy it into the T-CHU7DEUC/image directory. Name it "exe.img.enc"

=== Flash to TV ===
*Move the T-CHU7DEUC directory and all of its contents to an otherwise empty USB drive, plugin the USB drive into your TV and manually start the upgrade via the appropriate menu entry on your TV

=== Result ===
*After upgrade, open a shell and start a telnet session on your tv:

$ telnet aaa.bbb.ccc.ddd

with aaa.bbb.ccc.ddd your tv's IP-address. when prompted, log in as <root>
This is what you'll see, when connected:

$ telnet aaa.bbb.ccc.ddd
Trying aaa.bbb.ccc.ddd...
Connected to aaa.bbb.ccc.ddd.
Escape character is '^]'.

localhost login: root
-sh: id: not found
#
You can now start typing commands. For available commands visit the normal places: /bin, /sbin, /usr/bin and /usr/sbin

Open backdoor for fixing bootloop situations

2009-10-04T00:09:53Z

Dynamic1969:

Some people have reported about a bootloop preventing the TV from starting through. The issue here often is, that the script invoked from within '''/mtd_exe/rc.local''' is getting stuck and preventing the exeDSP to start.
 There are two key steps that should be considered when hacking your image, to avoid such situations or at least to open a external "backdoor" to prevent the respective script from starting.
 
#Ensure that you send your scripts into the background when starting, by padding with a '''"&"'''. Your changes in /mtd_exe/rc.local should look like export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal export MAPLE_WIDGET_DATA_PATH=/mtd_down export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB export KF_SLEEP_READ=-2 echo 30000 > /mtd_rwarea/DelayValue.txt #touch /mtd_rwarea/DoPrintYahoo.txt export KF_NO_INTERACTIVE=1 export KF_LOG=/dev/null''';/mtd_rwarea/rc.local&''' cd /mtd_exe/ ./exeDSP
#Include a check in your '''/mtd_rwarea/rc.local''' script, so that it will source and run a different set of commands, dependent on whether a specific file is detected on the USB-Drive or not. An example could look like: #!/bin/sh sleep 20 # Allow USB-stick to settle USB="/dtv/usb/sda1" # Your USB mount-point if [ -f $USB/usb.sh ];then . $USB/usb.sh # USB-File detected. Source and run this instead else . /mtd_rwarea/mtd_rwarea.sh # Source and run "normal startup script" fi exit

Open backdoor for fixing bootloop situations

2009-10-04T00:08:11Z

Dynamic1969: Created page with 'Some people have reported about a bootloop preventing the TV from starting through. The issue here often is, that the script invoked from within '''/mtd_exe/rc.local''' is gettinâ¦'

Some people have reported about a bootloop preventing the TV from starting through. The issue here often is, that the script invoked from within '''/mtd_exe/rc.local''' is getting stuck and preventing the exeDSP to start.
 There are two key steps that should be considered when hacking your image, to avoid such situations or at least to open a "backdoor" that allows to prevent the respective script from starting.
 
#Ensure that you send your scripts into the background when starting, by padding with a '''"&"'''. Your changes in /mtd_exe/rc.local should look like export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal export MAPLE_WIDGET_DATA_PATH=/mtd_down export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB export KF_SLEEP_READ=-2 echo 30000 > /mtd_rwarea/DelayValue.txt #touch /mtd_rwarea/DoPrintYahoo.txt export KF_NO_INTERACTIVE=1 export KF_LOG=/dev/null''';/mtd_rwarea/rc.local&''' cd /mtd_exe/ ./exeDSP
#Include a check in your '''/mtd_rwarea/rc.local''' script, so that it will source and run a different set of commands, dependent on whether a specific file is detected on the USB-Drive or not. An example could look like: #!/bin/sh sleep 20 # Allow USB-stick to settle USB="/dtv/usb/sda1" # Your USB mount-point if [ -f $USB/usb.sh ];then . $USB/usb.sh # USB-File detected. Source and run this instead else . /mtd_rwarea/mtd_rwarea.sh # Source and run "normal startup script" fi exit

Main Page

2009-10-04T00:07:51Z

Dynamic1969:

<big>'''Welcome to SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open backdoor for fixing bootloop situations]]

[[TODO: How to decypher Samsung firmware images]]

[[How to enable Telnet on samsung TV's]]

'''Disclaimer:'''
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Open Backdoor for fixing bootloop situations

2009-10-04T00:04:47Z

Some people have reported about a bootloop preventing the TV from starting through. The issue here often is, that the script invoked from within '''/mtd_exe/rc.local''' is getting stuck and preventing the exeDSP to start.
 There are two key steps that should be considered when hacking your image, to avoid such situations or at least to open a "backdoor" that allows to prevent the respective script from starting.
 
#Ensure that you send your scripts into the background when starting, by padding with a '''"&"'''. Your changes in /mtd_exe/rc.local should look like export MAPLE_DEFAULT_PATH=/mtd_cmmlib/InfoLink/lib export MAPLE_MANAGER_WIDGET_PATH=/mtd_down/widgets/manager export MAPLE_NORMAL_WIDGET_PATH=/mtd_down/widgets/normal export MAPLE_WIDGET_DATA_PATH=/mtd_down export MAPLE_WIDGET_INCLUDE_PATH=/mtd_down/widgets/inc export MAPLE_PLUGIN_DATA_PATH=/mtd_cmmlib/InfoLink/lib export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib/YWidget_LIB export KF_SLEEP_READ=-2 echo 30000 > /mtd_rwarea/DelayValue.txt #touch /mtd_rwarea/DoPrintYahoo.txt export KF_NO_INTERACTIVE=1 export KF_LOG=/dev/null''';/mtd_rwarea/rc.local&''' cd /mtd_exe/ ./exeDSP
#Include a check in your '''/mtd_rwarea/rc.local''' script, so that it will source and run a different set of commands, dependent on whether a specific file is detected on the USB-Drive or not. An example could look like: #!/bin/sh sleep 20 # Allow USB-stick to settle USB="/dtv/usb/sda1" # Your USB mount-point if [ -f $USB/usb.sh ];then . $USB/usb.sh # USB-File detected. Source and run this instead else . /mtd_rwarea/mtd_rwarea.sh # Source and run "normal startup script" fi exit

Main Page

2009-10-03T23:23:07Z

Dynamic1969:

<big>'''Welcome to SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open Backdoor for fixing bootloop situations]]

[[TODO: How to decypher Samsung firmware images]]

[[TODO: How to enable Telnet on samsung TV's]]

 '''Disclaimer:'''
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Main Page

2009-10-03T23:22:15Z

Dynamic1969:

<big>'''Welcome to SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[Open Backdoor for fixing bootloop situations]]

[[TODO: How to decypher Samsung firmware images]]

[[How to enable Telnet on samsung TV's]]

 '''Disclaimer:'''
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Main Page

2009-10-03T18:14:16Z

Dynamic1969:

<big>'''Welcome to SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit permissions will be granted on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[Manually flashing images via telnet or console (without the need for XOR and CRC32)]]

[[TODO: How to decypher Samsung firmware images]]

[[TODO: How to enable Telnet on samsung TV's]]

'''Disclaimer:'''
Neither this WIKI/Forum nor the author(s) of articles and information provided accept any responsibility for damage that may be caused by use of the information provided. You do everything at your own risk. Be aware that "hacking" activities do void your warranty!
 Tested on UExxB70xx and compatible devices only.

Dumping and Flashing images by hand

2009-10-03T18:08:42Z

Dynamic1969:

The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
#Prevent TV from rebooting when exeDSP is stopped '''/mtd_boot/MicomCtrl 23'''
#Stop exeDSP binary '''killall -9 exeDSP'''
#Unmount the respective directory '''umount /mtd_exe'''
#Take a backup of the current image in the flash. '''bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig'''
#Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu''' '''mv /mtd_swu/exe.img.orig /dtv/usb/sda1''' '''rm /mtd_swu/exe.img.orig 
#Copy Image to be flashed from your USB to /mtd_swu '''cp /dtv/usb/sda1/exe.img /mtd_swu '''->this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
#Perform the actual step of flashing the file. '''bml.resore /dev/bml0/8 /mtd_swu/exe.img''' -> Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
#Mount the updated image '''mount -t auto /dev/tbml8 /mtd_exe''' -> check out content and ensure it mounts without problems and looks ok from a content perspective.
# Try starting exeDSP '''/mtd_exe/rc.local''' ->If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
*'''T-CHL5DSEUC, T-CHL5DEUC''' and '''T-CHU7DEUC'''
**BOOTLOADER_DEVICE='''/dev/bml0/2'''
**FNW_DEVICE='''/dev/bml0/4'''
**KERNEL_DEVICE='''/dev/bml0/5'''
**RFS_DEVICE='''/dev/bml0/6'''
**BOOT_DEVICE='''/dev/bml0/7'''
*'''T-CHL5DSEUC''' and '''T-CHL5DEUC'''
**EXE_DEVICE='''/dev/stl0/8'''
**APPDATA_DEVICE='''/dev/stl0/9'''
*'''T-CHU7DEUC'''
**EXE_DEVICE='''/dev/bml0/8'''
**APPDATA_DEVICE='''/dev/bml0/9'''
'''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Main Page

2009-10-03T18:07:21Z

Dynamic1969:

Dumping and Flashing images by hand

2009-10-03T17:59:18Z

Dynamic1969: Created page with 'The steps outlined below allow the flashing of a Firmware file directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown belowâ¦'

The steps outlined below allow the flashing of a Firmware file directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
#Prevent TV from rebooting when exeDSP is stopped '''/mtd_boot/MicomCtrl 23'''
#Stop exeDSP binary '''killall -9 exeDSP'''
#Unmount the respective directory '''umount /mtd_exe'''
#Take a backup of the current image in the flash. '''bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig'''
#Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu''' '''mv /mtd_swu/exe.img.orig /dtv/usb/sda1''' '''rm /mtd_swu/exe.img.orig 
#Copy Image to be flashed from your USB to /mtd_swu '''cp /dtv/usb/sda1/exe.img /mtd_swu '''->this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
#Perform the actual step of flashing the file. '''bml.resore /dev/bml0/8 /mtd_swu/exe.img''' -> Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
#Mount the updated image '''mount -t auto /dev/tbml8 /mtd_exe''' -> check out content and ensure it mounts without problems and looks ok from a content perspective.
# Try starting exeDSP '''/mtd_exe/rc.local''' ->If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
*'''T-CHL5DSEUC, T-CHL5DEUC''' and '''T-CHU7DEUC'''
**BOOTLOADER_DEVICE='''/dev/bml0/2'''
**FNW_DEVICE='''/dev/bml0/4'''
**KERNEL_DEVICE='''/dev/bml0/5'''
**RFS_DEVICE='''/dev/bml0/6'''
**BOOT_DEVICE='''/dev/bml0/7'''
*'''T-CHL5DSEUC''' and '''T-CHL5DEUC'''
**EXE_DEVICE='''/dev/stl0/8'''
**APPDATA_DEVICE='''/dev/stl0/9'''
*'''T-CHU7DEUC'''
**EXE_DEVICE='''/dev/bml0/8'''
**APPDATA_DEVICE='''/dev/bml0/9'''
'''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:59, 3 October 2009 (UTC)

Main Page

2009-10-03T17:58:45Z

Dynamic1969:

Manual FW upgrade via telnet or console (without the need for XOR and CRC32)

2009-10-03T17:50:38Z

Main Page

2009-10-03T17:46:46Z

Dynamic1969:

Manual FW upgrade via console (without the need for XOR and CRC32)

2009-10-03T17:45:50Z

Dynamic1969:

The steps outlined below allow the flashing of a Firmware file directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx.
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
#Prevent TV from rebooting when exeDSP is stopped '''/mtd_boot/MicomCtrl 23'''
#Stop exeDSP binary '''killall -9 exeDSP'''
#Unmount the respective directory '''umount /mtd_exe'''
#Take a backup of the current image in the flash. '''bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig'''
#Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu''' '''mv /mtd_swu/exe.img.orig /dtv/usb/sda1''' '''rm /mtd_swu/exe.img.orig 
#Copy Image to be flashed from your USB to /mtd_swu '''cp /dtv/usb/sda1/exe.img /mtd_swu '''->this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
#Perform the actual step of flashing the file. '''bml.resore /dev/bml0/8 /mtd_swu/exe.img''' -> Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
#Mount the updated image '''mount -t auto /dev/tbml8 /mtd_exe''' -> check out content and ensure it mounts without problems and looks ok from a content perspective.
# Try starting exeDSP '''/mtd_exe/rc.local''' ->If something went wrong and your exeDSP doesn#t start, then flash back your backup ".orig" image following steps 3-9. -> Don't worry, if you see your screen upside down. That is just due to a variable not been set ;-)
 
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
*'''T-CHL5DSEUC, T-CHL5DEUC''' and '''T-CHU7DEUC'''
**BOOTLOADER_DEVICE='''/dev/bml0/2'''
**FNW_DEVICE='''/dev/bml0/4'''
**KERNEL_DEVICE='''/dev/bml0/5'''
**RFS_DEVICE='''/dev/bml0/6'''
**BOOT_DEVICE='''/dev/bml0/7'''
*'''T-CHL5DSEUC''' and '''T-CHL5DEUC'''
**EXE_DEVICE='''/dev/stl0/8'''
**APPDATA_DEVICE='''/dev/stl0/9'''
*'''T-CHU7DEUC'''
**EXE_DEVICE='''/dev/bml0/8'''
**APPDATA_DEVICE='''/dev/bml0/9'''
'''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:45, 3 October 2009 (UTC)

Manual FW upgrade via console (without the need for XOR and CRC32)

2009-10-03T17:42:31Z

The steps outlined below allow the flashing of a Firmware file directly into the flash of your TV, without using the offical upgrade process of the TV. The example shown below is for flashing a modified exe.img on a UExxB70xx. 
There is no need to flash app_data Image, if the actual exeDSP Version is unchanged and you are flashing your personal changes.
#Prevent TV from rebooting when exeDSP is stopped '''/mtd_boot/MicomCtrl 23'''
#Stop exeDSP binary '''killall -9 exeDSP'''
#Unmount the respective directory '''umount /mtd_exe'''
#Take a backup of the current image in the flash. '''bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig'''
#Move backup image to a safe space ( e.g. USB ) and remove file from '''/mtd_swu''' '''mv /mtd_swu/exe.img.orig /dtv/usb/sda1''' '''rm /mtd_swu/exe.img.orig 
#Copy Image to be flashed from your USB to /mtd_swu '''cp /dtv/usb/sda1/exe.img /mtd_swu '''->this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
#Perform the actual step of flashing the file. '''bml.resore /dev/bml0/8 /mtd_swu/exe.img''' -> Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
#Mount the updated image '''mount -t auto /dev/tbml8 /mtd_exe''' -> check out content and ensure it mounts without problems and looks ok from a content perspective.
# Try starting exeDSP '''/mtd_exe/rc.local''' ->If something went wrong then flash back the backup of the original image taken following steps 3-9 with the ".orig" image. -> Don't worry, if you see your screen upside down. That is due to a variable not been set ;-)
 
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
*'''T-CHL5DSEUC, T-CHL5DEUC''' and '''T-CHU7DEUC'''
**BOOTLOADER_DEVICE='''/dev/bml0/2'''
**FNW_DEVICE='''/dev/bml0/4'''
**KERNEL_DEVICE='''/dev/bml0/5'''
**RFS_DEVICE='''/dev/bml0/6'''
**BOOT_DEVICE='''/dev/bml0/7'''
*'''T-CHL5DSEUC''' and '''T-CHL5DEUC'''
**EXE_DEVICE='''/dev/stl0/8'''
**APPDATA_DEVICE='''/dev/stl0/9'''
*'''T-CHU7DEUC'''
**EXE_DEVICE='''/dev/bml0/8'''
**APPDATA_DEVICE='''/dev/bml0/9'''
'''Attention:'''This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!

--[[User:Dynamic1969|Dynamic1969]] 17:42, 3 October 2009 (UTC)

Main Page

2009-10-03T16:25:33Z

Dynamic1969:

<big>'''Welcome SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit right will give on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[Manual FW upgrade via console (without the need for XOR and CRC32)]]

[[How to decypher samsung firmware images]]

[[How to enable Telnet on samsung TV's]]

Enable Serial Console on B series TV

2009-10-03T16:17:17Z

Dynamic1969:

Find below the steps you need to follow to enable console access to your TV via a serial cable.
*Solder yourself ( or buy ) an Ex-Link serial cable to connect to your Samsung TV. See [http://www.wiremunky.com/file/documents/exlink.gif here] for the Serial Cable specs. You can ignore the rest of the information posted there, as it is not applicable for the more recent Samsung devices.
*Enter Service Menu ( quickly push '''[INFO] [MENU] [MUTE] [POWER]''' on your remote control )
*Change setting for your RS232C interface to "debug" ( Control -> Sub Option -> RS-232 Jack -> [ '''Debug''' | UART | Logic ] )
*Use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
**Baudrate: '''115200'''
**Data bits: '''8'''
**Parity: '''none'''
**Stop bits: '''1'''
**Flow Control: '''none'''
*Switch on your TV ... If you did everything right and everything works as expected, then you should see the boot-log on your terminal.
*Enter "'''debug'''" at the invisible prompt ... to enable your serial console. You should see something like below with each keystroke
**[SERIAL INPUT MANAGE] 1-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 2-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 3-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 4-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 5-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] serial input ENABLE!!!!!
*Now you need to be fast ...
**hit '''CTRL-C''', which stops the exeDSP binary
**immediately after that enter ( you have ca. 3 seconds ... I suggest you cut&paste this command ): '''/mtd_boot/MicomCtrl 23''' This now prevents your LED/LCD to stop and you have a command prompt of the TV-Console.
 
 
'''Attention:''' Neither this WIKI/Forum nor the author of this article accept any responsibility for any damage that may be caused on your device. Do everything at your own risk. You will void your warranty! Tested on a UExxB70xx devices only.

--[[User:Dynamic1969|Dynamic1969]] 16:17, 3 October 2009 (UTC)

Enable Serial Console on B series TV

2009-10-03T16:15:21Z

Dynamic1969:

'''Attention:''' Neither this WIKI/Forum nor the author of this article accept any responsibility for any damage that may be caused on your device. Do everything at your own risk. You will void your warranty! Tested on a UExxB70xx devices only.

*Solder yourself ( or buy ) an Ex-Link serial cable to connect to your Samsung TV. See [http://www.wiremunky.com/file/documents/exlink.gif here] for the Serial Cable specs. You can ignore the rest of the information posted there, as it is not applicable for the more recent Samsung devices.
*Enter Service Menu ( quickly push '''[INFO] [MENU] [MUTE] [POWER]''' on your remote control )
*Change setting for your RS232C interface to "debug" ( Control -> Sub Option -> RS-232 Jack -> [ '''Debug''' | UART | Logic ] )
*Use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
**Baudrate: '''115200'''
**Data bits: '''8'''
**Parity: '''none'''
**Stop bits: '''1'''
**Flow Control: '''none'''
*Switch on your TV ... If you did everything right and everything works as expected, then you should see the boot-log on your terminal.
*Enter "'''debug'''" at the invisible prompt ... to enable your serial console. You should see something like below with each keystroke
**[SERIAL INPUT MANAGE] 1-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 2-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 3-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 4-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] 5-th ENABLE Magic serial input match!
**[SERIAL INPUT MANAGE] serial input ENABLE!!!!!
*Now you need to be fast ...
**hit '''CTRL-C''', which stops the exeDSP binary
**immediately after that enter ( you have ca. 3 seconds ... I suggest you cut&paste this command ): '''/mtd_boot/MicomCtrl 23''' This now prevents your LED/LCD to stop and you have a command prompt of the TV-Console.

--[[User:Dynamic1969|Dynamic1969]] 16:00, 3 October 2009 (UTC)

Enable Serial Console on B series TV

2009-10-03T16:00:00Z

Dynamic1969: Created page with ''''Attention:''' Do everything at your own risk. You warranty may be void! I take no responsibility for any damage that may be caused on your device. Tested on a UE46B7000 only â¦'

'''Attention:'''
Do everything at your own risk. You warranty may be void! I take no responsibility for any damage that may be caused on your device. Tested on a UE46B7000 only

1) Solder yourself ( or buy ) an Ex-Link serial cable to connect to your Samsung TV.
See [http://www.wiremunky.com/file/documents/exlink.gif here] for the Serial Cable specs.
You can ignore the rest of the information posted there, as it is not applicable for the more recent Samsung devices.

2) Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )

3) Change setting for your RS232C interface to "debug" ( Control -> Sub Option -> RS-232 Jack -> [ '''Debug''' | UART | Logic ] )

4) Use following connection parameters with your terminal-client ( e.g. Hyper Therminal or ZOC Terminal ): '''115200,8,n,1,n'''

5) Switch on your TV ... you should see the boot-log on your terminal, if you did everything right!

5) Enter "'''debug'''" at the invisible prompt ... to enable your serial console.
You should see something like below with each keystroke

[SERIAL INPUT MANAGE] 1-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 2-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 3-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 4-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] 5-th ENABLE Magic serial input match!
[SERIAL INPUT MANAGE] serial input ENABLE!!!!!

6) Now you need to be fast ...
a) hit CTRL-C, which stops the exeDSP binary
b) immediately after that enter ( you have ca. 3 seconds ... I suggest you cut&paste this command )

'''/mtd_boot/MicomCtrl 23'''

This now prevents your LED/LCD to stop and you have a command prompt of the TV-Console.

--[[User:Dynamic1969|Dynamic1969]] 16:00, 3 October 2009 (UTC)

Main Page

2009-10-03T15:26:23Z

Dynamic1969:

<big>'''Welcome SamyGo WiKi'''</big>

Here, I will add pages that you show how to edit your firmwares.

Edit right will give on request ( from forum. )

[http://samygo.sourceforge.net SamyGo Home Page]

[http://forum.samygo.tv/index.php SamyGo Forum]

[[Enable Serial Console on non CI+ Devices]]

[[How to decypher samsung firmware images]]

[[How to enable Telnet on samsung TV's]]