SamyGO - User contributions [en]

UnBricking TV by EEPROM Reset

2014-03-09T13:22:40Z

Hedak: Added EEPROM specification 'SoC'

Here we will show you how to reset your TV by resetting the SoC EEPROM. This can be very useful in case you have bricked your TV by messing with some of its internal settings, which can easily happen if you mess around in the Service Menu. It is highly recommended to take photos of each screen in the service menu, showing your original firmware settings, before changing anything!

=Blind Factory Reset=
Before trying to EEPROM reset, please try a factory reset, that might revive your TV also.

Press "EXIT" button for 12 seconds (15 is better since you cannot see TV), than press "Left" and "Enter"

[http://www.samsung.com/us/support/supportOwnersHowToGuidePopup.do?howto_guide_seq=5306&prd_ia_cd=N0000058&map_seq=31175 Samsung Documentation]

'''This wiki entry will not help resolve a TV bricked by firmware flashing.'''

One example (from the original post of this wiki):
''This is Erdem. As I bricked my D series device by miss service menu setting, I search for solutions to recover it.
After with help of Juzis we unbricked device with the same way of C series TVs... Here I wanted to try to let
you know how the process is working. Firstly, this hack doesn't work if you bricked you device by
firmware flashing... This hacks just removes service menu settings and let you give another chance
to fix settings... Also you needed to find correct values for your TV after resetting NVRAM like
Model / Type / Tuner / Font Color and others. It's better to have screen shots of your service menu.
You can also ask help from our forums.''

=EEPROM=
EEPROM is a short of ''electrically erasable programmable read only memory'', which is actually a chip. There are several EEPROM chips used in Samsung TVs. All service menu settings are kept in the so called SoC EEPROM. You can delete and reprogram this chips millions time. So they are fast and reliable...

=Reseting NVRAM (EEPROM)=

For resetting TV, settings, you needed to remove SoC EEPROM device from TV. But it's not required. In electronic world, if you disable communication of the chip, it counts as removed. So we just needed to kill communication of SoC EEPROM. EEPROMs on Samsung TV's communicating via common i2c protocol. That protocol carries data via SDA line and send clocks via SCL line. In our situation, both blocking SCL or SDA will works. But I decide SDA.

To do this, all you have to do that feeding (connecting) GND (ground) or VCC (3.3v) to SDA line with little wire... That's all. Since this lines are HIGH (v3.3) in IDLE, its better to hold it via VCC. You can also hold this lines via GND too. But don't try to connect both GND and VCC. It will be short circuit and probably will damage your board.

Join VCC and SDA, power on TV and hold about for 20 seconds with the TV powered. It just try to read (wrong) settings from EEPROM, since it cannot read anything (refer to the warning message bellow), just start with defaults. That is what we want. Than releasing SDA line and shutting TV off will update the settings on EEPROM with null values, that TV could boot with it. After all, you can enter service menu and change the required changes.

[[File:UE40D5000 RESET MESSAGE.JPG|center|300px| UE40D5000 Reset message]]

=Where do I find the SoC EEPROM chip?=
:Its located near CPU (SoC) at C and D series. On top, it writes some numbers and letters starting with 24256 or 24512... Here I place some screen shots from D series bellow. In my TV, 24512 EEPROM chip used. You can get the [http://pdf1.alldatasheet.com/datasheet-pdf/view/22813/STMICROELECTRONICS/M24512-RBN6.html 24512 Chip Datasheet here]. In picture, white triangle shows the first pin.
==B Series SoC EEPROM Location==
===LExxB550===
You have to search for eeprom on '''back side''' of mainboard. IC3001 
[[Image:LExxB55x_mainboard_front.JPG|270px|B550 mainboarboard front side]]
[[Image:LE46B550A5W full.jpg|270px|B550 mainboarboard back side]]
[[Image:LExxB550_eeprom.png|270px|B550 eeprom reset. Red line!]]
===LExxB6000===
[[Image:Samsung_UExxB6000_mainboard.jpg|250px|B6000 mainboarboard]]
[[Image:Samsung_UE32_B6000_eeprom_reset.jpg|270px|eeprom location, reset procedure]]

==C Series SoC EEPROM Location==
===LExxC550/530===
[[Image:C550_full.jpg|270px|C550/530 Board]]
[[Image:C550_reset.jpg|200px|C550/530 reset. Red line!]]
 

===LAxxC650===
[[Image:LA40C650full.jpg|150px|LA40C650 Board]]
[[Image:LA40C650_eeprom_is_C.jpg|225px|LA40C650 eeprom`s place]]
[[Image:LA40C650_eeprom_reset.jpg|202px|LA40C650 reset]]
 
===UAxxC6200===
[[Image:UA40C6200_full.jpg|150px|UA40C6200 Board]]
[[Image:UA40C6200_1.jpg|285px|UA40C6200 reset]]
===UExxC7700===
<gallery>
Image:DSC 0272 resized marked.jpg|UE46C7700 Board (back side of mainboard)
Image:DSC 0273 resized.jpg|UE46C7700 eeprom
</gallery>

===OTHER===
please fill up missing models. Thanks!
 

==D Series SoC EEPROM Location==
===D5000===
<gallery>
Image:UE40D5000 Board.JPG|UE40D5000 Board
Image:UE40D5000 EEPROM.JPG|UE40D5000 EEPROM Chip and UnBrick way
</gallery>

===D4003/5003===
<gallery>
Image:UE40D5003_Board.jpg|UE40D5003 Board
Image:UE40D5003_EEprom_reset.jpg|UE40D5003 EEPROM Chip and UnBrick way
</gallery>

===D550===
<gallery>
Image:le32d550_mainboard.jpg|LExxD550 Board
Image:le32d550_eeprom.jpg|LExxD550 EEPROM Chip and UnBrick way
</gallery>

===D60xx/61xx/62xx/63xx/64xx/65xx/66xx/67xx/68xx===
<gallery>
Image:UA40D6000_Board_EEPROM.jpg|UA40D6000 Board
Image:EEPROM_Reset.jpg|UA40D6000 EEPROM Chip and UnBrick way
</gallery>

==BD (BlueRay DVD Player) SoC EEPROM Location==
===BD-D8X00===
<gallery>
Image:Bd-d8900_Board.png|BD-D8900 Board
Image:Bd-d8900_Eprom.png|BD-D8900 EEPROM Chip and UnBrick way
</gallery>

===BD-E8X00===
<gallery>
Image:Bd-e8300_Board.png|BD-D8900 Board
Image:Bd-e8300_Eprom.png|BD-D8900 EEPROM Chip and UnBrick way
</gallery>

==ES-series SoC EEPROM Location==
This may also be compatible with the "E"-series...
Do check forums for latest info.

===UNxxES7500===
<gallery>
Image:UNxxES7500_Eeprom_location.jpg|UNxxES7500 Board
Image:UNxxES7500_Eeprom.jpg|UNxxES7500 Reset EEPROM
</gallery>

==F series SoC EEPROM location==

===UExxF8000===
<gallery>
Image:UExxF8000.jpg|UExxF8000
</gallery>

Ethernet multi-function Interface

2014-03-07T20:08:03Z

Hedak: /* Teensy(++ 2.0) sketch for accessing I2C interface */

Using an Arduino Ethernet board, you can send IR codes to your TV or BD

With the same board, you can also interface to the Serial Console, and read your device config eeprom.

== What you can do ==
* Send IR codes to your TV, PVR or BD, with an URL in your browser
* Use telnet to have the Serial Console on your PC or smartphone
* Read your SoC config eeprom
* Read/write micom config eeprom
* See Arduino as a Samsung device in the Samsung Remote App (can be used to power on the device !)

[[File:Arduino interface.jpg|335px]] [[File:EthernetInterface-SamsungRemote.png|335px]]

== Bill of materials ==
* Arduino Ethernet board (see [http://arduino.cc/en/Main/ArduinoBoardEthernet Arduino])
Alternatively, an Arduino Uno with an Ethernet shield could also be used
* IR led (SFH4510 for example) or RED Led (Clear Type RED LED's are emitting more than enough light at IR spectrum)
* 220 ohms resistor to limit current in the IR led
* If you plan to use the telnet interface to the Serial Console, make sure you have a 100 ohms resistor on both RX and TX signals (Arduino TX/RX are 5v !)

== How to use it ==
* Upload the following '''[[#Arduino_sketch | sketch]]''' into your Arduino
* Connect the IR or RED led with its resistor on pin 8 on the Arduino
* Connect power and network
* Find the IP address of the board on your DHCP (or use the static IP embedded in the sketch if you don't have DHCP)
* Use your browser to send an URL to the board (see format below)
* If you want to use telnet to connect to the Serial Console :
* Connect your Serial Console signals TX&RX to the Arduino board pins 0&1 ({{red|with 100 ohms resistors}})
* Use Putty with options 'Local Echo' and 'Local line editing' forced to OFF
* If you want to read your config eeprom :
* Connect the eeprom SDA&SCK signals to the Arduino board pins A4/A5 ({{red|with 100 ohms resistors}})
* Connect the eeprom GND to 0v
* If you want to use the Samsung Remote feature :
* Compile with SAMSUNGREMOTE defined
* The program only handles BD_KEY_POWER; if you want aditional keys, it's easy to add them

== URL format to send IR codes ==
The format is http://IP/ir.htm?data=XX&type=Y&device=ZZZZ
where
* IP is the Arduino board IP address
* XX is the IR code to send
* Y is 0 for TV/PVR frame format and 1 for BD frame format
* ZZZZ is the device code (0707 for TV, 0505 for PVR, 301A for BD)

The IR codes are listed at [[Key codes]]
* For TV/PVR, use the 'code' column
* For BD, use the 'BD-IR code' column

For example:

To get the Service Menu on your TV, use the 2 following URLs :
* http://IP/ir.htm?data=1F&type=0&device=0707
* http://IP/ir.htm?data=3B&type=0&device=0707
Please note that you cannot send KEY_FACTORY to a BD, as the corresponding code is not know yet

To have a kind of Wake Up on LAN on your BD player, use
* http://IP/ir.htm?data=91&type=1&device=301A

To switch to channel 1 :
* On a TV : http://IP/ir.htm?data=65&type=0&device=0707
* On a BD : http://IP/ir.htm?data=81&type=0&device=301A

== URL format to read config Eeprom ==
The format is http://IP/read?format=F&device=D&addr=A&size=S&width=W

* IP is the Arduino board IP address
* F is 0 to get the result in html, 1 to download a binary file
* D is the Eeprom device identification (80 by default)
* A is the starting address for reading (0 by default)
* S is the number of bytes to read (default=256)
* W is the address bus width (8 bits for Micom eeprom, 16 bits for SoC eeprom); default is 16

For example:

BD-E8300 is equiped with a 24512 eeprom (64 kbytes)

To download its whole config :
* http://IP/read?format=1&size=65536
or :
* http://IP/read?format=1&device=80&size=65536&addr=0

Eeprom connection :

[[File:Arduino_I2C_Eeprom.jpg|335px]]

== URL format to write config Eeprom ==
The format is http://IP/write?device=D&addr=A&data=X&width=W

* IP is the Arduino board IP address
* D is the Eeprom device identification (80 by default)
* A is the starting address for writing (0 by default)
* X is the data byte to write
* W is the address bus width (8 bits for Micom eeprom, 16 bits for SoC eeprom); default is 16

On this version, it is only possible to write one byte at once...

For example:
http://IP/write?addr=e0&data=55&width=16 will write 0x55 at address 0xe0

== IR frames format ==
BD players use a modified IR frame format that TV and PVR.
The reason is that samsung increased the data field length from 8 to 12 bits
The general format is now :
* Start bit
* Device ID (16 bits - 0707 for TV, 301A for BD)
* For BD only : Stop bit and data MSB on 4 bits
* Data LSB
* Data LSB 1's complement

A frame for BD :

[[File:BD_IR_Frame_Format.png‎]]

== Arduino sketch ==

This sketch has been compiled with Arduino 1.0.3 ([http://arduino.cc/en/Main/Software Download here])

// ---------------------------------------------------------------------
// Samsung multi-functions ethernet interface
// - Send IR frame with http get requests
// - Debug console on telnet
// - Read & Write I2C config eeprom
//
// 29-06-2012 / v1.1 / oga83
// 11-09-2012 / v1.1 / oga83
// Added optionnal 'crc' url parameter for testing IR (allow to force CRC)
// Added I2C interface to read/write config eeprom
// 09-01-2013 / v1.1.1 / oga83
// Fixed compilation issue with Arduino 1.0.3 and typo in wiki
// 11-01-2013 / v1.1.2 / oga83
// Modified ReadEeprom and WriteEeprom for 1-byte address eeproms
// 11-01-2013 / v1.2 / oga83
// Added Samsung Remote protocol (Arduino seen as a samsung device)
//----------------------------------------------------------------------

#include <SPI.h>
#include <Ethernet.h>
#include <EthernetUdp.h>
#include <Wire.h>

#define IRPIN 8 // IR led is connected on pin 8
#define LEDPIN 9 // Onboard led - blink at 2 Hz
// Debug console TX signal connected on 0
// Debug console RX signal connected on 1
// I2C Eeprom : SDA connected on A4
// I2C Eeprom : SCK connected on A5

byte mac[] = { 0x90, 0xA2, 0xda, 0x00, 0xe6, 0x5e }; // Arduino Ethernet board MAC address

IPAddress ip(192,168,1,178); // Default static IP if no DHCP
EthernetServer HttpServer(80); // HTTP is used to send IR commands
EthernetServer TelnetServer(23); // Telnet is used for Serial Console

#define SAMSUNGREMOTE // if defined, Arduino will be seen as a Samsung device
#ifdef SAMSUNGREMOTE
EthernetServer SamsungRemote(55000); // Emulates a Samsung device
EthernetUDP SamsungSSDP; // Handles Samsung device discovery
#endif

// ---------------------------------------------------------------------
// Utilities
// ---------------------------------------------------------------------

// Convert a hex string to unsigned int
unsigned int HexToULong(char *s)
{
unsigned long u=0;
while (*s)
{
char c=*s++;
// Convert to uppercase
if (c>='a') c&=0xdf;
// Exit if not hex digit
if ((c<'0' || c>'9') && (c<'A' || c>'F')) break;
// Convert digit
u<<=4;
u|=c-((c>'9') ? 'A'-0xa:'0');
}
return u;
}

#ifdef SAMSUNGREMOTE
// Base64 conversion
const char *sBase64TranslateTable = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+%";
void AsciiToBase64(char *Ascii, char *Buffer, int BufferSize)
{
int Length=0;
while (*Ascii)
{
unsigned long s32bits=0;
int i, j;
// Read 3 ASCII bytes
for (i = 2; i >= 0; i--)
{
if (*Ascii==0) break;
s32bits |= ((unsigned long)*Ascii++)<<(8*i);
}
// Convert them to four 6-bit items
for (j=3; j>=i+1; j--)
{
// Check for buffer overflow
if (++Length>=BufferSize) { *Buffer=0; return; }
// Convert 6-bit item
int c = ((s32bits >> (6 * j)) & 0x3f);
*Buffer++ = sBase64TranslateTable[c];
}
// Complete last bytes
for (/*void*/; j>=0 && ++Length<BufferSize; j--) *Buffer++='=';
}
*Buffer=0; // Trailing 0 is not needed for this project, but simplify testing
}
void Base64ToAscii(char *Base64, char *Buffer, int BufferSize)
{
int Length=0;
while (*Base64 && *Base64!='=')
{
unsigned long s24bits = 0;
// Read four 6-bit items
for (int i=3; i>=0; i--)
{
if (*Base64==0 || *Base64=='=') break;
char *p=strchr(sBase64TranslateTable, *Base64++);
if (p) s24bits |= ((unsigned long)(p-sBase64TranslateTable))<<(6*i);
}
// Convert them to three 8-bit items
for (int i=2; i>=0; i--)
{
// Check for buffer overflow
if (++Length>=BufferSize) break;
// Save byte
*Buffer++ = (char)((s24bits>>(8*i))&0xff);
}
}
*Buffer=0;
}
unsigned DecodeSamsungProtocolString(char *s, char *Buffer, int BufferSize, boolean bBase64)
{
// Get length of string in message
unsigned Length=s[0] | (((unsigned)s[1])<<8);
// Get the string
if (bBase64)
{
// Force trailing 0 into Base64 string
// (dirty but will work in this project, as the Base64 string is in a frame buffer...)
char c=s[Length+2]; s[Length+2]=0;
Base64ToAscii(s+2, Buffer, BufferSize);
// Restore corrupted char
s[Length+2]=c;
}
else
{
// Check for buffer overflow
unsigned MaxLength=(Length>BufferSize-1) ? BufferSize-1:Length;
// Just copy string
strncpy(Buffer, s+2, MaxLength);
Buffer[MaxLength]=0;
}
// Returns length of initial buffer
return Length+2;
}
unsigned EncodeSamsungProtocolString(char *s, char *Buffer, int BufferSize, boolean bBase64)
{
unsigned Length;
if (bBase64)
{
// Encode string in Base64
AsciiToBase64(s, Buffer+2, BufferSize-2);
Length=strlen(Buffer+2);
}
else
{
// Leave string in Ascii - No trailing 0
Length=strlen(s);
if (Length>BufferSize-2) Length=BufferSize-2;
strncpy(Buffer+2, s, Length);
}

// Add size of string in message
Buffer[0]=Length; Buffer[1]=Length>>8;
return Length+2;
}
#endif

// ---------------------------------------------------------------------
// Samsung IR class
// ---------------------------------------------------------------------

class Samsung
{
private:
// Send a 36kHz-modulated pulse
static void Pulse(void)
{
byte i;
for (i=0; i<21; i++)
{
digitalWrite(IRPIN, HIGH);
delayMicroseconds(10); // Value adjusted with oscilloscope
digitalWrite(IRPIN, LOW);
delayMicroseconds(10); // Value adjusted with oscilloscope
}
}
// Send a bit
static void SendIRBit(byte b)
{
Pulse();
if (b)
delayMicroseconds(1390);
else
delayMicroseconds(430);
}
// Send 4 bits
static void SendIRNibble(byte b)
{
byte i;
for (i=0; i<4; i++)
SendIRBit((b>>i)&1);
}
// Send a byte
static void SendIRByte(byte b)
{
byte i;
for (i=0; i<8; i++)
SendIRBit((b>>i)&1);
}

public:
// Send an IR command
// Type is 0 for TV, 1 for BD
// Device is 0x0707 for TV, 0x301A for BD
// Crc should be ~Command, except for tests
static void SendCommand(char Type, unsigned int Device, unsigned int Command, unsigned char Crc)
{
byte i;

// Disable interrupts
cli();

// Start bit
for (i=0; i<8; i++) Pulse();
delayMicroseconds(4500);

// Send Device Id
SendIRByte(Device>>8);
SendIRByte(Device&0xff);

// BD Player
if (Type==1)
{
// Stop bit
Pulse();
delayMicroseconds(4500);
// Send Data
SendIRNibble(Command>>8);
}

SendIRByte(Command);
SendIRByte(Crc);

// Stop bit
Pulse();
delayMicroseconds(4500);

// Re-enable interrupts
sei();
}
// Read Eeprom
static void ReadEeprom(byte device, long addr, byte *data, int count)
{
if (addr!=0xffffffff)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
Wire.endTransmission();
}
Wire.requestFrom((int)device, count);
for (int i=0; i<count; i++)
{
if (!Wire.available()) break;
data[i]=Wire.read();
}
}
// Write Eeprom
static void WriteEeprom(byte device, long addr, byte *data, int count)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
for (int i=0; i<count; i++) Wire.write(data[i]);
Wire.endTransmission();
}
static boolean bEeprom2ByteAddress;
};
boolean Samsung::bEeprom2ByteAddress=true;

// ---------------------------------------------------------------------
// Initialization
// ---------------------------------------------------------------------

void setup()
{
// Led
pinMode(LEDPIN, OUTPUT);
digitalWrite(LEDPIN, HIGH);

// IR Led
pinMode(IRPIN, OUTPUT);
digitalWrite(IRPIN, HIGH);

// I2C
Wire.begin();

// Serial Console
Serial.begin(115200);

// Initialize Ethernet. Try DHCP, otherwise static IP
if (Ethernet.begin(mac)==0)
Ethernet.begin(mac, ip);
// Initialize HTTP server
HttpServer.begin();
// Initialize Telnet server
TelnetServer.begin();
#ifdef SAMSUNGREMOTE
// Initialize Samsung Remote server
SamsungRemote.begin();
// Initialize SSDP
SamsungSSDP.begin(1900);
#endif
}

// ---------------------------------------------------------------------
// Main Program
// ---------------------------------------------------------------------

char HttpFrame[256]; // General buffer for Http and Samsung protocol frames
char TelnetFrame[256]; // General buffer for Telnet frames
char Buffer[32]; // General buffer
boolean iStateLed=false; // Used for led blinking
unsigned long timeLastLedMs=0; // Used for blinking delay

void loop()
{
// -------------------------------------------------
// LED blinks at 2Hz
// -------------------------------------------------
if (millis()>timeLastLedMs+250)
{
timeLastLedMs=millis();
digitalWrite(LEDPIN, (iStateLed) ? HIGH:LOW);
iStateLed=!iStateLed;
}

// -------------------------------------------------
// Handle HTTP requests
// Example :
// To send KEY_1 on BD :
// http://IP/ir.htm?data=81&type=1&device=301a
// -------------------------------------------------
EthernetClient client = HttpServer.available();
if (client)
{
char *ptr=HttpFrame;
int n=0;
while (client.connected() && client.available())
{
if (n++<sizeof(HttpFrame))
*ptr++=client.read();
else
client.flush();
}
*ptr=0;
if (n>0)
{
const __FlashStringHelper *HtmlHeader=F("HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n");

// -------------------------------------------------
// Send Samsung IR command
// -------------------------------------------------
ptr=strstr(HttpFrame, "/ir.htm?");
if (ptr)
{
byte Type=0, Crc;
unsigned int Device=0x0707, Data=0;

ptr=strstr(HttpFrame, "data=");
if (ptr) Data=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "type=");
if (ptr) Type=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=HexToULong(ptr+7);

// Next parameter is optional and can be used for tests
Crc=~Data;
ptr=strstr(HttpFrame, "crc=");
if (ptr) Crc=HexToULong(ptr+4);

Samsung::SendCommand(Type, Device, Data, Crc);
client.println(HtmlHeader);
client.println("OK !");
client.stop();
return;
}

// -------------------------------------------------
// Read Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/read");
if (ptr)
{
byte Device=80, Format=0x50; // hedak: changed eeprom device id to 80 to comply with description above
unsigned long Size=0x100, Addr=0;

ptr=strstr(HttpFrame, "addr=");
if (ptr) Addr=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "size=");
if (ptr) Size=atol(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "format=");
if (ptr) Format=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

if (Format==0)
{
client.println("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
}
else
client.println("HTTP/1.1 200 OK\r\nContent-Type: binary/octet-stream\r\n");

byte bSequential=0;
for (long i=Addr; i<Addr+Size; i+=32)
{
unsigned char Data[32];
for (int i=0; i<32; i++) Data[i]=0xff;
Samsung::ReadEeprom(Device, (bSequential) ? -1:i, Data, 32);
bSequential=1;

if (Format==0)
{
sprintf(Buffer, "%04lx: ", i); client.print(Buffer);
for (int j=0; j<32; j++)
{ sprintf(Buffer, "%02X ", Data[j]); client.print(Buffer); }
for (int j=0; j<32; j++)
{ client.write((Data[j]<=0x20 || Data[j]>0x7f) ? '.':Data[j]); }
client.println("");
client.flush();
}
else
{
for (int j=0; j<32; j++)
client.write(Data[j]);
}
}

client.stop();
return;
}

// -------------------------------------------------
// Write Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/write");
char *ptrAddr=strstr(HttpFrame, "addr=");
char *ptrData=strstr(HttpFrame, "data=");
if (ptr && ptrAddr && ptrData)
{
byte Device=80, Data; // hedak: changed eeprom device id to 80 to comply with description above
unsigned long Addr;

Addr=HexToULong(ptrAddr+5);
Data=HexToULong(ptrData+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

Samsung::WriteEeprom(Device, Addr, &Data, 1);
client.println("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
Data=~Data;
Samsung::ReadEeprom(Device, Addr, &Data, 1);
sprintf(Buffer, "%02X ", Data);
client.print(Buffer);

client.stop();
return;
}

#ifdef SAMSUNGREMOTE
// -------------------------------------------------
// Device info - used for Samsung Remote Protocol
// -------------------------------------------------
ptr=strstr(HttpFrame, "/smp_2_");
if (ptr)
{
client.println(F("HTTP/1.1 200 OK\r\nContent-Type: text/xml\r\n"));
client.println(F("<?xml version=\"1.0\"?>"));
client.println(F("<root xmlns='urn:schemas-upnp-org:device-1-0' xmlns:sec='http://www.sec.co.kr/dlna' xmlns:dlna='urn:schemas-dlna-org:device-1-0'>"));
client.println(F(" <specVersion>"));
client.println(F(" <major>1</major>"));
client.println(F(" <minor>0</minor>"));
client.println(F(" </specVersion>"));
client.println(F(" <device>"));
client.println(F(" <deviceType>urn:samsung.com:device:RemoteControlReceiver:1</deviceType>"));
client.println(F(" <friendlyName>SamyGO</friendlyName>"));
client.println(F(" <manufacturer>Samsung Electronics</manufacturer>"));
client.println(F(" <manufacturerURL>http://www.samsung.com/sec</manufacturerURL>"));
client.println(F(" <modelDescription>Samsung BD RCR</modelDescription>"));
client.println(F(" <modelName>BD-E8500</modelName>"));
client.println(F(" <modelNumber>1.0</modelNumber>"));
client.println(F(" <modelURL>http://www.samsung.com/sec</modelURL>"));
client.println(F(" <serialNumber>12345678RCR</serialNumber>"));
client.println(F(" <UDN>uuid:11111111-2222-3333-4444-555555555555</UDN>"));
client.println(F(" <sec:deviceID>ABCDEFGHIJKLM</sec:deviceID>"));
client.println(F(" <sec:ProductCap>Resolution:1280X720,ImageZoom,ImageRotate,Y2012</sec:ProductCap>"));
client.println(F(" <serviceList>"));
client.println(F(" <service>"));
client.println(F(" <serviceType>urn:samsung.com:service:TestRCRService:1</serviceType>"));
client.println(F(" <serviceId>urn:samsung.com:serviceId:TestRCRService</serviceId>"));
client.println(F(" <controlURL>/smp_4_</controlURL>"));
client.println(F(" <eventSubURL>/smp_5_</eventSubURL>"));
client.println(F(" <SCPDURL>/smp_3_</SCPDURL>"));
client.println(F(" </service>"));
client.println(F(" </serviceList>"));
client.println(F(" </device>"));
client.println(F("</root>"));
client.stop();
return;
}
#endif

// send an error !
client.println(HtmlHeader);
client.println(F("Error !"));
delay(1);
}
client.stop();
}

#ifdef SAMSUNGREMOTE
// -------------------------------------------------
// Samsung Remote Protocol
// -------------------------------------------------
client = SamsungRemote.available();
if (client)
{
//Serial.println("Incoming frame...");

// Read incoming frame
char *ptr=HttpFrame;
int n=0;
while (client.connected() && client.available())
if (n++<sizeof(HttpFrame)) *ptr++=client.read();

ptr=HttpFrame+1;
// Decode App Name
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), false);
//Serial.print("Name="); Serial.println(Buffer);

// Ignore message length
ptr+=2;

// Decode command
unsigned Cmd=*ptr++; Cmd|=(*ptr++)<<8;
//Serial.print("Cmd="); Serial.println(Cmd);

// Connection frame ?
if (Cmd==0x64)
{
// Decode remote IP
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("IP="); Serial.println(Buffer);

// Decode remote MAC address
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("MAC="); Serial.println(Buffer);

// Decode machine name
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("Machine="); Serial.println(Buffer);
delay(5);
}

// Key frame ?
else if (Cmd==0x00)
{
ptr++; // Skip first byte
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("KeyName="); Serial.print(Buffer); Serial.println("----");
if (!strcmp(Buffer, "BD_KEY_POWER"))
{
// Power key for BD
Samsung::SendCommand(1, 0x301a, 0x91, ~0x91);
}
}

// Answer
HttpFrame[0]=0;
int len=1;
len+=EncodeSamsungProtocolString("iapp.samsung", HttpFrame+1, sizeof(HttpFrame), false);
if (Cmd==0x64)
{
byte answer[]={0x04,0x00,0x64,0x00,0x01,0x00};
memcpy(HttpFrame+len, answer, sizeof(answer));
len+=sizeof(answer);
}
else
{
byte answer[]={0x04,0x00,0x00,0x00,0x00,0x00};
memcpy(HttpFrame+len, answer, sizeof(answer));
len+=sizeof(answer);
}
client.write((byte *)HttpFrame, len);
delay(5);
}

// SSDP discovery protocol
int PacketSize=SamsungSSDP.parsePacket();
if (PacketSize)
{
// Read incoming frame
char *ptr=HttpFrame;
int n=0;
while (SamsungSSDP.available())
if (n++<sizeof(HttpFrame)) *ptr++=SamsungSSDP.read();

// Discovery request ?
if (strstr(HttpFrame, "M-SEARCH *") && strstr(HttpFrame, "urn:samsung.com:device:RemoteControlReceiver:1"))
{
//Serial.print("SSDP Discovery from : IP="); Serial.print(SamsungSSDP.remoteIP()); Serial.print(":"); Serial.println(SamsungSSDP.remotePort());
SamsungSSDP.beginPacket(SamsungSSDP.remoteIP(), SamsungSSDP.remotePort());
SamsungSSDP.println(F("HTTP/1.1 200 OK"));
SamsungSSDP.println(F("CACHE-CONTROL: max-age= 1800"));
SamsungSSDP.println(F("Date: Sat, 01 Jan 2012 00:00:00 GMT"));
SamsungSSDP.println(F("EXT: "));
SamsungSSDP.print(F("LOCATION: http://")); SamsungSSDP.print(Ethernet.localIP()); SamsungSSDP.println(F(":80/smp_2_"));
SamsungSSDP.println(F("SERVER: SHP, UPnP/1.0, Samsung UPnP SDK/1.0"));
SamsungSSDP.println(F("ST: urn:samsung.com:device:RemoteControlReceiver:1"));
SamsungSSDP.println(F("USN: uuid:11111111-2222-3333-4444-555555555555::urn:samsung.com:device:RemoteControlReceiver:1"));
SamsungSSDP.println(F("Content-Length: 0"));
SamsungSSDP.endPacket();
}
}
#endif

// -------------------------------------------------
// Telnet Serial Console Interface
// Configure Putty with :
// - "Local Echo : Force off"
// - "Local line editing : Force off"
// -------------------------------------------------
client = TelnetServer.available();
if (client)
{
char *ptr=TelnetFrame;
int n=0;
while (client.connected() && client.available())
if (n++<sizeof(TelnetFrame)) *ptr++=client.read();
*ptr=0;

// Sends telnet buffer to Serial Console
if (n>0) Serial.write(TelnetFrame);
}
// Anything received from Serial Console ?
char *ptr=TelnetFrame;
int n=0;
while (Serial.available())
if (n++<sizeof(TelnetFrame)) *ptr++=Serial.read();
*ptr=0;
// Send it to telnet
if (n>0) TelnetServer.write(TelnetFrame);
}

// ---------------------------------------------------------------------

== Teensy(++ 2.0) sketch for accessing I2C interface ==

This sketch has been compiled with Arduino 1.0.5.
It's a limited version compared to the arduino sketch above. Only the I2C interface to read/write tv's eeprom is implemented and instead of the ethernet interface there's a usb interface (Hint: sketch becomes active only if DTR on pc side is set). Usage of the I2C feature is the same anyway.

// ---------------------------------------------------------------------
// Samsung I2C interface based on oga83's 'Samsung multi-functions ethernet interface' v1.2
// - Read & Write I2C config eeprom
//
// 07-03-2014 / v1.1 / hedak
//----------------------------------------------------------------------

#include <SPI.h>
#include <Wire.h>
#include "utility\twi.h" //hedak: for outputting I2C frequency

#define CPU_PRESCALE(n) (CLKPR = 0x80, CLKPR = (n))

#define LEDPIN CORE_LED0_PIN // Onboard led - blink at 2 Hz
// I2C Eeprom : SDA connected on D1
// I2C Eeprom : SCL connected on D0

// ---------------------------------------------------------------------
// Utilities
// ---------------------------------------------------------------------

// Convert a hex string to unsigned int
unsigned long HexToULong(char *s)
{
unsigned long u=0;
while (*s)
{
char c=*s++;
// Convert to uppercase
if (c>='a') c&=0xdf;
// Exit if not hex digit
if ((c<'0' || c>'9') && (c<'A' || c>'F')) break;
// Convert digit
u<<=4;
u|=c-((c>'9') ? 'A'-0xa:'0');
}
return u;
}

// ---------------------------------------------------------------------
// Samsung class
// ---------------------------------------------------------------------

class Samsung
{
public:
// Read Eeprom
static void ReadEeprom(byte device, long addr, byte *data, int count)
{
if (addr!=0xffffffff)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
Wire.endTransmission();
}
Wire.requestFrom((int)device, count);
for (int i=0; i<count; i++)
{
if (!Wire.available()) break;
data[i]=Wire.read();
}
}
// Write Eeprom
static void WriteEeprom(byte device, long addr, byte *data, int count)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
for (int i=0; i<count; i++) Wire.write(data[i]);
Wire.endTransmission();
}
static boolean bEeprom2ByteAddress;
};
boolean Samsung::bEeprom2ByteAddress=true;

// ---------------------------------------------------------------------
// Main Program
// ---------------------------------------------------------------------

char HttpFrame[256]; // General buffer for Http and Samsung protocol frames
char Buffer[32]; // General buffer
boolean iStateLed=false; // Used for led blinking
unsigned long timeLastLedMs=0; // Used for blinking delay

void loop()
{
// -------------------------------------------------
// LED blinks at 2Hz
// -------------------------------------------------
if (millis()>timeLastLedMs+250)
{
timeLastLedMs=millis();
digitalWrite(LEDPIN, (iStateLed) ? HIGH:LOW);
iStateLed=!iStateLed;
}

// -------------------------------------------------
// Handle HTTP requests
// Example :
// To read a whole EEPROM dump :
// http://IP/read?format=1&device=80&size=256
// -------------------------------------------------
char *ptr=HttpFrame;
int n=0;
while (Serial.available())
{
if (n++<sizeof(HttpFrame))
*ptr++=Serial.read();
else
Serial.flush();
}
*ptr=0;
Serial.write(HttpFrame);
if (n>0)
{
// -------------------------------------------------
// Read Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/read");
if (ptr)
{
byte Device=80, Format=0x50; // hedak: fixed wrong default value for 'Device'
unsigned long Size=0x100, Addr=0;

ptr=strstr(HttpFrame, "addr=");
if (ptr) Addr=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "size=");
if (ptr) Size=atol(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "format=");
if (ptr) Format=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

sprintf(Buffer, "Start reading @ address: %lX\r\n", Addr);
Serial.write(Buffer);

if (Format==0)
{
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
}
else
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: binary/octet-stream\r\n");

byte bSequential=0;
for (long i=Addr; i<Addr+Size; i+=32)
{
unsigned char Data[32];
for (int i=0; i<32; i++) Data[i]=0xff;
Samsung::ReadEeprom(Device, (bSequential) ? -1:i, Data, 32);
bSequential=1;

if (Format==0)
{
sprintf(Buffer, "%04lx: ", i); Serial.write(Buffer);
for (int j=0; j<32; j++)
{ sprintf(Buffer, "%02X ", Data[j]); Serial.write(Buffer); }
for (int j=0; j<32; j++)
{ Serial.write((Data[j]<=0x20 || Data[j]>0x7f) ? '.':Data[j]); }
Serial.write("\r\n");
Serial.flush();
}
else
{
for (int j=0; j<32; j++)
Serial.write(Data[j]);
}
}
return;
}

// -------------------------------------------------
// Write Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/write");
Serial.write("Remove the following 'return;' line to activate write feature!\r\n");
return;
char *ptrAddr=strstr(HttpFrame, "addr=");
char *ptrData=strstr(HttpFrame, "data=");
if (ptr && ptrAddr && ptrData)
{
byte Device=0, Data;
unsigned long Addr;

Addr=HexToULong(ptrAddr+5);
Data=HexToULong(ptrData+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

Samsung::WriteEeprom(Device, Addr, &Data, 1);
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
Data=~Data;
Samsung::ReadEeprom(Device, Addr, &Data, 1);
sprintf(Buffer, "%02X ", Data);
Serial.write(Buffer);
return;
}
// send an error !
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n");
Serial.write("Error !\r\n");
delay(1);
}
}

// ---------------------------------------------------------------------
// Initialization
// ---------------------------------------------------------------------

void setup()
{
#if (F_CPU == 8000000)
// set for 8 MHz clock because of operating at 3.3 volts
CPU_PRESCALE(0x01);
#else
// set for external 16 MHz clock
CPU_PRESCALE(0x00);
#endif
// Led
pinMode(LEDPIN, OUTPUT);
digitalWrite(LEDPIN, HIGH);

// I2C
Wire.begin();

// Serial Console
Serial.begin(115200);

// wait for the user to run their terminal emulator program
// which sets DTR to indicate it is ready to receive.
while (!Serial.dtr()) /* wait */ ;
sprintf(Buffer, "TWI_FREQ: %ld", TWI_FREQ);
Serial.write(Buffer);
}

// ---------------------------------------------------------------------

== References ==
Any discussion on related [http://forum.samygo.tv/viewtopic.php?f=51&t=5307#p38502 forum topic].
Thread using teensy sketch is [http://forum.samygo.tv/viewtopic.php?f=15&t=7117#p53751 here].

Ethernet multi-function Interface

2014-03-07T20:03:20Z

Hedak: Added teensy sketch and made arduino sketch eeprom device id compliant to description

Using an Arduino Ethernet board, you can send IR codes to your TV or BD

With the same board, you can also interface to the Serial Console, and read your device config eeprom.

== What you can do ==
* Send IR codes to your TV, PVR or BD, with an URL in your browser
* Use telnet to have the Serial Console on your PC or smartphone
* Read your SoC config eeprom
* Read/write micom config eeprom
* See Arduino as a Samsung device in the Samsung Remote App (can be used to power on the device !)

[[File:Arduino interface.jpg|335px]] [[File:EthernetInterface-SamsungRemote.png|335px]]

== Bill of materials ==
* Arduino Ethernet board (see [http://arduino.cc/en/Main/ArduinoBoardEthernet Arduino])
Alternatively, an Arduino Uno with an Ethernet shield could also be used
* IR led (SFH4510 for example) or RED Led (Clear Type RED LED's are emitting more than enough light at IR spectrum)
* 220 ohms resistor to limit current in the IR led
* If you plan to use the telnet interface to the Serial Console, make sure you have a 100 ohms resistor on both RX and TX signals (Arduino TX/RX are 5v !)

== How to use it ==
* Upload the following '''[[#Arduino_sketch | sketch]]''' into your Arduino
* Connect the IR or RED led with its resistor on pin 8 on the Arduino
* Connect power and network
* Find the IP address of the board on your DHCP (or use the static IP embedded in the sketch if you don't have DHCP)
* Use your browser to send an URL to the board (see format below)
* If you want to use telnet to connect to the Serial Console :
* Connect your Serial Console signals TX&RX to the Arduino board pins 0&1 ({{red|with 100 ohms resistors}})
* Use Putty with options 'Local Echo' and 'Local line editing' forced to OFF
* If you want to read your config eeprom :
* Connect the eeprom SDA&SCK signals to the Arduino board pins A4/A5 ({{red|with 100 ohms resistors}})
* Connect the eeprom GND to 0v
* If you want to use the Samsung Remote feature :
* Compile with SAMSUNGREMOTE defined
* The program only handles BD_KEY_POWER; if you want aditional keys, it's easy to add them

== URL format to send IR codes ==
The format is http://IP/ir.htm?data=XX&type=Y&device=ZZZZ
where
* IP is the Arduino board IP address
* XX is the IR code to send
* Y is 0 for TV/PVR frame format and 1 for BD frame format
* ZZZZ is the device code (0707 for TV, 0505 for PVR, 301A for BD)

The IR codes are listed at [[Key codes]]
* For TV/PVR, use the 'code' column
* For BD, use the 'BD-IR code' column

For example:

To get the Service Menu on your TV, use the 2 following URLs :
* http://IP/ir.htm?data=1F&type=0&device=0707
* http://IP/ir.htm?data=3B&type=0&device=0707
Please note that you cannot send KEY_FACTORY to a BD, as the corresponding code is not know yet

To have a kind of Wake Up on LAN on your BD player, use
* http://IP/ir.htm?data=91&type=1&device=301A

To switch to channel 1 :
* On a TV : http://IP/ir.htm?data=65&type=0&device=0707
* On a BD : http://IP/ir.htm?data=81&type=0&device=301A

== URL format to read config Eeprom ==
The format is http://IP/read?format=F&device=D&addr=A&size=S&width=W

* IP is the Arduino board IP address
* F is 0 to get the result in html, 1 to download a binary file
* D is the Eeprom device identification (80 by default)
* A is the starting address for reading (0 by default)
* S is the number of bytes to read (default=256)
* W is the address bus width (8 bits for Micom eeprom, 16 bits for SoC eeprom); default is 16

For example:

BD-E8300 is equiped with a 24512 eeprom (64 kbytes)

To download its whole config :
* http://IP/read?format=1&size=65536
or :
* http://IP/read?format=1&device=80&size=65536&addr=0

Eeprom connection :

[[File:Arduino_I2C_Eeprom.jpg|335px]]

== URL format to write config Eeprom ==
The format is http://IP/write?device=D&addr=A&data=X&width=W

* IP is the Arduino board IP address
* D is the Eeprom device identification (80 by default)
* A is the starting address for writing (0 by default)
* X is the data byte to write
* W is the address bus width (8 bits for Micom eeprom, 16 bits for SoC eeprom); default is 16

On this version, it is only possible to write one byte at once...

For example:
http://IP/write?addr=e0&data=55&width=16 will write 0x55 at address 0xe0

== IR frames format ==
BD players use a modified IR frame format that TV and PVR.
The reason is that samsung increased the data field length from 8 to 12 bits
The general format is now :
* Start bit
* Device ID (16 bits - 0707 for TV, 301A for BD)
* For BD only : Stop bit and data MSB on 4 bits
* Data LSB
* Data LSB 1's complement

A frame for BD :

[[File:BD_IR_Frame_Format.png‎]]

== Arduino sketch ==

This sketch has been compiled with Arduino 1.0.3 ([http://arduino.cc/en/Main/Software Download here])

// ---------------------------------------------------------------------
// Samsung multi-functions ethernet interface
// - Send IR frame with http get requests
// - Debug console on telnet
// - Read & Write I2C config eeprom
//
// 29-06-2012 / v1.1 / oga83
// 11-09-2012 / v1.1 / oga83
// Added optionnal 'crc' url parameter for testing IR (allow to force CRC)
// Added I2C interface to read/write config eeprom
// 09-01-2013 / v1.1.1 / oga83
// Fixed compilation issue with Arduino 1.0.3 and typo in wiki
// 11-01-2013 / v1.1.2 / oga83
// Modified ReadEeprom and WriteEeprom for 1-byte address eeproms
// 11-01-2013 / v1.2 / oga83
// Added Samsung Remote protocol (Arduino seen as a samsung device)
//----------------------------------------------------------------------

#include <SPI.h>
#include <Ethernet.h>
#include <EthernetUdp.h>
#include <Wire.h>

#define IRPIN 8 // IR led is connected on pin 8
#define LEDPIN 9 // Onboard led - blink at 2 Hz
// Debug console TX signal connected on 0
// Debug console RX signal connected on 1
// I2C Eeprom : SDA connected on A4
// I2C Eeprom : SCK connected on A5

byte mac[] = { 0x90, 0xA2, 0xda, 0x00, 0xe6, 0x5e }; // Arduino Ethernet board MAC address

IPAddress ip(192,168,1,178); // Default static IP if no DHCP
EthernetServer HttpServer(80); // HTTP is used to send IR commands
EthernetServer TelnetServer(23); // Telnet is used for Serial Console

#define SAMSUNGREMOTE // if defined, Arduino will be seen as a Samsung device
#ifdef SAMSUNGREMOTE
EthernetServer SamsungRemote(55000); // Emulates a Samsung device
EthernetUDP SamsungSSDP; // Handles Samsung device discovery
#endif

// ---------------------------------------------------------------------
// Utilities
// ---------------------------------------------------------------------

// Convert a hex string to unsigned int
unsigned int HexToULong(char *s)
{
unsigned long u=0;
while (*s)
{
char c=*s++;
// Convert to uppercase
if (c>='a') c&=0xdf;
// Exit if not hex digit
if ((c<'0' || c>'9') && (c<'A' || c>'F')) break;
// Convert digit
u<<=4;
u|=c-((c>'9') ? 'A'-0xa:'0');
}
return u;
}

#ifdef SAMSUNGREMOTE
// Base64 conversion
const char *sBase64TranslateTable = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+%";
void AsciiToBase64(char *Ascii, char *Buffer, int BufferSize)
{
int Length=0;
while (*Ascii)
{
unsigned long s32bits=0;
int i, j;
// Read 3 ASCII bytes
for (i = 2; i >= 0; i--)
{
if (*Ascii==0) break;
s32bits |= ((unsigned long)*Ascii++)<<(8*i);
}
// Convert them to four 6-bit items
for (j=3; j>=i+1; j--)
{
// Check for buffer overflow
if (++Length>=BufferSize) { *Buffer=0; return; }
// Convert 6-bit item
int c = ((s32bits >> (6 * j)) & 0x3f);
*Buffer++ = sBase64TranslateTable[c];
}
// Complete last bytes
for (/*void*/; j>=0 && ++Length<BufferSize; j--) *Buffer++='=';
}
*Buffer=0; // Trailing 0 is not needed for this project, but simplify testing
}
void Base64ToAscii(char *Base64, char *Buffer, int BufferSize)
{
int Length=0;
while (*Base64 && *Base64!='=')
{
unsigned long s24bits = 0;
// Read four 6-bit items
for (int i=3; i>=0; i--)
{
if (*Base64==0 || *Base64=='=') break;
char *p=strchr(sBase64TranslateTable, *Base64++);
if (p) s24bits |= ((unsigned long)(p-sBase64TranslateTable))<<(6*i);
}
// Convert them to three 8-bit items
for (int i=2; i>=0; i--)
{
// Check for buffer overflow
if (++Length>=BufferSize) break;
// Save byte
*Buffer++ = (char)((s24bits>>(8*i))&0xff);
}
}
*Buffer=0;
}
unsigned DecodeSamsungProtocolString(char *s, char *Buffer, int BufferSize, boolean bBase64)
{
// Get length of string in message
unsigned Length=s[0] | (((unsigned)s[1])<<8);
// Get the string
if (bBase64)
{
// Force trailing 0 into Base64 string
// (dirty but will work in this project, as the Base64 string is in a frame buffer...)
char c=s[Length+2]; s[Length+2]=0;
Base64ToAscii(s+2, Buffer, BufferSize);
// Restore corrupted char
s[Length+2]=c;
}
else
{
// Check for buffer overflow
unsigned MaxLength=(Length>BufferSize-1) ? BufferSize-1:Length;
// Just copy string
strncpy(Buffer, s+2, MaxLength);
Buffer[MaxLength]=0;
}
// Returns length of initial buffer
return Length+2;
}
unsigned EncodeSamsungProtocolString(char *s, char *Buffer, int BufferSize, boolean bBase64)
{
unsigned Length;
if (bBase64)
{
// Encode string in Base64
AsciiToBase64(s, Buffer+2, BufferSize-2);
Length=strlen(Buffer+2);
}
else
{
// Leave string in Ascii - No trailing 0
Length=strlen(s);
if (Length>BufferSize-2) Length=BufferSize-2;
strncpy(Buffer+2, s, Length);
}

// Add size of string in message
Buffer[0]=Length; Buffer[1]=Length>>8;
return Length+2;
}
#endif

// ---------------------------------------------------------------------
// Samsung IR class
// ---------------------------------------------------------------------

class Samsung
{
private:
// Send a 36kHz-modulated pulse
static void Pulse(void)
{
byte i;
for (i=0; i<21; i++)
{
digitalWrite(IRPIN, HIGH);
delayMicroseconds(10); // Value adjusted with oscilloscope
digitalWrite(IRPIN, LOW);
delayMicroseconds(10); // Value adjusted with oscilloscope
}
}
// Send a bit
static void SendIRBit(byte b)
{
Pulse();
if (b)
delayMicroseconds(1390);
else
delayMicroseconds(430);
}
// Send 4 bits
static void SendIRNibble(byte b)
{
byte i;
for (i=0; i<4; i++)
SendIRBit((b>>i)&1);
}
// Send a byte
static void SendIRByte(byte b)
{
byte i;
for (i=0; i<8; i++)
SendIRBit((b>>i)&1);
}

public:
// Send an IR command
// Type is 0 for TV, 1 for BD
// Device is 0x0707 for TV, 0x301A for BD
// Crc should be ~Command, except for tests
static void SendCommand(char Type, unsigned int Device, unsigned int Command, unsigned char Crc)
{
byte i;

// Disable interrupts
cli();

// Start bit
for (i=0; i<8; i++) Pulse();
delayMicroseconds(4500);

// Send Device Id
SendIRByte(Device>>8);
SendIRByte(Device&0xff);

// BD Player
if (Type==1)
{
// Stop bit
Pulse();
delayMicroseconds(4500);
// Send Data
SendIRNibble(Command>>8);
}

SendIRByte(Command);
SendIRByte(Crc);

// Stop bit
Pulse();
delayMicroseconds(4500);

// Re-enable interrupts
sei();
}
// Read Eeprom
static void ReadEeprom(byte device, long addr, byte *data, int count)
{
if (addr!=0xffffffff)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
Wire.endTransmission();
}
Wire.requestFrom((int)device, count);
for (int i=0; i<count; i++)
{
if (!Wire.available()) break;
data[i]=Wire.read();
}
}
// Write Eeprom
static void WriteEeprom(byte device, long addr, byte *data, int count)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
for (int i=0; i<count; i++) Wire.write(data[i]);
Wire.endTransmission();
}
static boolean bEeprom2ByteAddress;
};
boolean Samsung::bEeprom2ByteAddress=true;

// ---------------------------------------------------------------------
// Initialization
// ---------------------------------------------------------------------

void setup()
{
// Led
pinMode(LEDPIN, OUTPUT);
digitalWrite(LEDPIN, HIGH);

// IR Led
pinMode(IRPIN, OUTPUT);
digitalWrite(IRPIN, HIGH);

// I2C
Wire.begin();

// Serial Console
Serial.begin(115200);

// Initialize Ethernet. Try DHCP, otherwise static IP
if (Ethernet.begin(mac)==0)
Ethernet.begin(mac, ip);
// Initialize HTTP server
HttpServer.begin();
// Initialize Telnet server
TelnetServer.begin();
#ifdef SAMSUNGREMOTE
// Initialize Samsung Remote server
SamsungRemote.begin();
// Initialize SSDP
SamsungSSDP.begin(1900);
#endif
}

// ---------------------------------------------------------------------
// Main Program
// ---------------------------------------------------------------------

char HttpFrame[256]; // General buffer for Http and Samsung protocol frames
char TelnetFrame[256]; // General buffer for Telnet frames
char Buffer[32]; // General buffer
boolean iStateLed=false; // Used for led blinking
unsigned long timeLastLedMs=0; // Used for blinking delay

void loop()
{
// -------------------------------------------------
// LED blinks at 2Hz
// -------------------------------------------------
if (millis()>timeLastLedMs+250)
{
timeLastLedMs=millis();
digitalWrite(LEDPIN, (iStateLed) ? HIGH:LOW);
iStateLed=!iStateLed;
}

// -------------------------------------------------
// Handle HTTP requests
// Example :
// To send KEY_1 on BD :
// http://IP/ir.htm?data=81&type=1&device=301a
// -------------------------------------------------
EthernetClient client = HttpServer.available();
if (client)
{
char *ptr=HttpFrame;
int n=0;
while (client.connected() && client.available())
{
if (n++<sizeof(HttpFrame))
*ptr++=client.read();
else
client.flush();
}
*ptr=0;
if (n>0)
{
const __FlashStringHelper *HtmlHeader=F("HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n");

// -------------------------------------------------
// Send Samsung IR command
// -------------------------------------------------
ptr=strstr(HttpFrame, "/ir.htm?");
if (ptr)
{
byte Type=0, Crc;
unsigned int Device=0x0707, Data=0;

ptr=strstr(HttpFrame, "data=");
if (ptr) Data=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "type=");
if (ptr) Type=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=HexToULong(ptr+7);

// Next parameter is optional and can be used for tests
Crc=~Data;
ptr=strstr(HttpFrame, "crc=");
if (ptr) Crc=HexToULong(ptr+4);

Samsung::SendCommand(Type, Device, Data, Crc);
client.println(HtmlHeader);
client.println("OK !");
client.stop();
return;
}

// -------------------------------------------------
// Read Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/read");
if (ptr)
{
byte Device=80, Format=0x50; // hedak: changed eeprom device id to 80 to comply with description above
unsigned long Size=0x100, Addr=0;

ptr=strstr(HttpFrame, "addr=");
if (ptr) Addr=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "size=");
if (ptr) Size=atol(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "format=");
if (ptr) Format=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

if (Format==0)
{
client.println("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
}
else
client.println("HTTP/1.1 200 OK\r\nContent-Type: binary/octet-stream\r\n");

byte bSequential=0;
for (long i=Addr; i<Addr+Size; i+=32)
{
unsigned char Data[32];
for (int i=0; i<32; i++) Data[i]=0xff;
Samsung::ReadEeprom(Device, (bSequential) ? -1:i, Data, 32);
bSequential=1;

if (Format==0)
{
sprintf(Buffer, "%04lx: ", i); client.print(Buffer);
for (int j=0; j<32; j++)
{ sprintf(Buffer, "%02X ", Data[j]); client.print(Buffer); }
for (int j=0; j<32; j++)
{ client.write((Data[j]<=0x20 || Data[j]>0x7f) ? '.':Data[j]); }
client.println("");
client.flush();
}
else
{
for (int j=0; j<32; j++)
client.write(Data[j]);
}
}

client.stop();
return;
}

// -------------------------------------------------
// Write Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/write");
char *ptrAddr=strstr(HttpFrame, "addr=");
char *ptrData=strstr(HttpFrame, "data=");
if (ptr && ptrAddr && ptrData)
{
byte Device=80, Data; // hedak: changed eeprom device id to 80 to comply with description above
unsigned long Addr;

Addr=HexToULong(ptrAddr+5);
Data=HexToULong(ptrData+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

Samsung::WriteEeprom(Device, Addr, &Data, 1);
client.println("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
Data=~Data;
Samsung::ReadEeprom(Device, Addr, &Data, 1);
sprintf(Buffer, "%02X ", Data);
client.print(Buffer);

client.stop();
return;
}

#ifdef SAMSUNGREMOTE
// -------------------------------------------------
// Device info - used for Samsung Remote Protocol
// -------------------------------------------------
ptr=strstr(HttpFrame, "/smp_2_");
if (ptr)
{
client.println(F("HTTP/1.1 200 OK\r\nContent-Type: text/xml\r\n"));
client.println(F("<?xml version=\"1.0\"?>"));
client.println(F("<root xmlns='urn:schemas-upnp-org:device-1-0' xmlns:sec='http://www.sec.co.kr/dlna' xmlns:dlna='urn:schemas-dlna-org:device-1-0'>"));
client.println(F(" <specVersion>"));
client.println(F(" <major>1</major>"));
client.println(F(" <minor>0</minor>"));
client.println(F(" </specVersion>"));
client.println(F(" <device>"));
client.println(F(" <deviceType>urn:samsung.com:device:RemoteControlReceiver:1</deviceType>"));
client.println(F(" <friendlyName>SamyGO</friendlyName>"));
client.println(F(" <manufacturer>Samsung Electronics</manufacturer>"));
client.println(F(" <manufacturerURL>http://www.samsung.com/sec</manufacturerURL>"));
client.println(F(" <modelDescription>Samsung BD RCR</modelDescription>"));
client.println(F(" <modelName>BD-E8500</modelName>"));
client.println(F(" <modelNumber>1.0</modelNumber>"));
client.println(F(" <modelURL>http://www.samsung.com/sec</modelURL>"));
client.println(F(" <serialNumber>12345678RCR</serialNumber>"));
client.println(F(" <UDN>uuid:11111111-2222-3333-4444-555555555555</UDN>"));
client.println(F(" <sec:deviceID>ABCDEFGHIJKLM</sec:deviceID>"));
client.println(F(" <sec:ProductCap>Resolution:1280X720,ImageZoom,ImageRotate,Y2012</sec:ProductCap>"));
client.println(F(" <serviceList>"));
client.println(F(" <service>"));
client.println(F(" <serviceType>urn:samsung.com:service:TestRCRService:1</serviceType>"));
client.println(F(" <serviceId>urn:samsung.com:serviceId:TestRCRService</serviceId>"));
client.println(F(" <controlURL>/smp_4_</controlURL>"));
client.println(F(" <eventSubURL>/smp_5_</eventSubURL>"));
client.println(F(" <SCPDURL>/smp_3_</SCPDURL>"));
client.println(F(" </service>"));
client.println(F(" </serviceList>"));
client.println(F(" </device>"));
client.println(F("</root>"));
client.stop();
return;
}
#endif

// send an error !
client.println(HtmlHeader);
client.println(F("Error !"));
delay(1);
}
client.stop();
}

#ifdef SAMSUNGREMOTE
// -------------------------------------------------
// Samsung Remote Protocol
// -------------------------------------------------
client = SamsungRemote.available();
if (client)
{
//Serial.println("Incoming frame...");

// Read incoming frame
char *ptr=HttpFrame;
int n=0;
while (client.connected() && client.available())
if (n++<sizeof(HttpFrame)) *ptr++=client.read();

ptr=HttpFrame+1;
// Decode App Name
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), false);
//Serial.print("Name="); Serial.println(Buffer);

// Ignore message length
ptr+=2;

// Decode command
unsigned Cmd=*ptr++; Cmd|=(*ptr++)<<8;
//Serial.print("Cmd="); Serial.println(Cmd);

// Connection frame ?
if (Cmd==0x64)
{
// Decode remote IP
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("IP="); Serial.println(Buffer);

// Decode remote MAC address
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("MAC="); Serial.println(Buffer);

// Decode machine name
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("Machine="); Serial.println(Buffer);
delay(5);
}

// Key frame ?
else if (Cmd==0x00)
{
ptr++; // Skip first byte
ptr+=DecodeSamsungProtocolString(ptr, Buffer, sizeof(Buffer), true);
//Serial.print("KeyName="); Serial.print(Buffer); Serial.println("----");
if (!strcmp(Buffer, "BD_KEY_POWER"))
{
// Power key for BD
Samsung::SendCommand(1, 0x301a, 0x91, ~0x91);
}
}

// Answer
HttpFrame[0]=0;
int len=1;
len+=EncodeSamsungProtocolString("iapp.samsung", HttpFrame+1, sizeof(HttpFrame), false);
if (Cmd==0x64)
{
byte answer[]={0x04,0x00,0x64,0x00,0x01,0x00};
memcpy(HttpFrame+len, answer, sizeof(answer));
len+=sizeof(answer);
}
else
{
byte answer[]={0x04,0x00,0x00,0x00,0x00,0x00};
memcpy(HttpFrame+len, answer, sizeof(answer));
len+=sizeof(answer);
}
client.write((byte *)HttpFrame, len);
delay(5);
}

// SSDP discovery protocol
int PacketSize=SamsungSSDP.parsePacket();
if (PacketSize)
{
// Read incoming frame
char *ptr=HttpFrame;
int n=0;
while (SamsungSSDP.available())
if (n++<sizeof(HttpFrame)) *ptr++=SamsungSSDP.read();

// Discovery request ?
if (strstr(HttpFrame, "M-SEARCH *") && strstr(HttpFrame, "urn:samsung.com:device:RemoteControlReceiver:1"))
{
//Serial.print("SSDP Discovery from : IP="); Serial.print(SamsungSSDP.remoteIP()); Serial.print(":"); Serial.println(SamsungSSDP.remotePort());
SamsungSSDP.beginPacket(SamsungSSDP.remoteIP(), SamsungSSDP.remotePort());
SamsungSSDP.println(F("HTTP/1.1 200 OK"));
SamsungSSDP.println(F("CACHE-CONTROL: max-age= 1800"));
SamsungSSDP.println(F("Date: Sat, 01 Jan 2012 00:00:00 GMT"));
SamsungSSDP.println(F("EXT: "));
SamsungSSDP.print(F("LOCATION: http://")); SamsungSSDP.print(Ethernet.localIP()); SamsungSSDP.println(F(":80/smp_2_"));
SamsungSSDP.println(F("SERVER: SHP, UPnP/1.0, Samsung UPnP SDK/1.0"));
SamsungSSDP.println(F("ST: urn:samsung.com:device:RemoteControlReceiver:1"));
SamsungSSDP.println(F("USN: uuid:11111111-2222-3333-4444-555555555555::urn:samsung.com:device:RemoteControlReceiver:1"));
SamsungSSDP.println(F("Content-Length: 0"));
SamsungSSDP.endPacket();
}
}
#endif

// -------------------------------------------------
// Telnet Serial Console Interface
// Configure Putty with :
// - "Local Echo : Force off"
// - "Local line editing : Force off"
// -------------------------------------------------
client = TelnetServer.available();
if (client)
{
char *ptr=TelnetFrame;
int n=0;
while (client.connected() && client.available())
if (n++<sizeof(TelnetFrame)) *ptr++=client.read();
*ptr=0;

// Sends telnet buffer to Serial Console
if (n>0) Serial.write(TelnetFrame);
}
// Anything received from Serial Console ?
char *ptr=TelnetFrame;
int n=0;
while (Serial.available())
if (n++<sizeof(TelnetFrame)) *ptr++=Serial.read();
*ptr=0;
// Send it to telnet
if (n>0) TelnetServer.write(TelnetFrame);
}

// ---------------------------------------------------------------------

== Teensy(++ 2.0) sketch for accessing I2C interface ==

This sketch has been compiled with Arduino 1.0.5.
It's a limited version compared to the arduino sketch above. Only the I2C interface to read/write tv's eeprom is implemented and instead of the ethernet interface there's a usb interface (Hint: sketch becomes active only if DTR on pc side is set). Usage of the I2C feature is the same anyway.

// ---------------------------------------------------------------------
// Samsung I2C interface based on oga83's 'Samsung multi-functions ethernet interface' v1.2
// - Read & Write I2C config eeprom
//
// 07-03-2014 / v1.1 / hedak
//----------------------------------------------------------------------

#include <SPI.h>
#include <Wire.h>
#include "utility\twi.h" //hedak: for outputting I2C frequency

#define CPU_PRESCALE(n) (CLKPR = 0x80, CLKPR = (n))

#define LEDPIN CORE_LED0_PIN // Onboard led - blink at 2 Hz
// I2C Eeprom : SDA connected on D1
// I2C Eeprom : SCL connected on D0

// ---------------------------------------------------------------------
// Utilities
// ---------------------------------------------------------------------

// Convert a hex string to unsigned int
unsigned long HexToULong(char *s)
{
unsigned long u=0;
while (*s)
{
char c=*s++;
// Convert to uppercase
if (c>='a') c&=0xdf;
// Exit if not hex digit
if ((c<'0' || c>'9') && (c<'A' || c>'F')) break;
// Convert digit
u<<=4;
u|=c-((c>'9') ? 'A'-0xa:'0');
}
return u;
}

// ---------------------------------------------------------------------
// Samsung class
// ---------------------------------------------------------------------

class Samsung
{
public:
// Read Eeprom
static void ReadEeprom(byte device, long addr, byte *data, int count)
{
if (addr!=0xffffffff)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
Wire.endTransmission();
}
Wire.requestFrom((int)device, count);
for (int i=0; i<count; i++)
{
if (!Wire.available()) break;
data[i]=Wire.read();
}
}
// Write Eeprom
static void WriteEeprom(byte device, long addr, byte *data, int count)
{
Wire.beginTransmission(device);
if (bEeprom2ByteAddress) Wire.write(addr>>8);
Wire.write(addr);
for (int i=0; i<count; i++) Wire.write(data[i]);
Wire.endTransmission();
}
static boolean bEeprom2ByteAddress;
};
boolean Samsung::bEeprom2ByteAddress=true;

// ---------------------------------------------------------------------
// Main Program
// ---------------------------------------------------------------------

char HttpFrame[256]; // General buffer for Http and Samsung protocol frames
char Buffer[32]; // General buffer
boolean iStateLed=false; // Used for led blinking
unsigned long timeLastLedMs=0; // Used for blinking delay

void loop()
{
// -------------------------------------------------
// LED blinks at 2Hz
// -------------------------------------------------
if (millis()>timeLastLedMs+250)
{
timeLastLedMs=millis();
digitalWrite(LEDPIN, (iStateLed) ? HIGH:LOW);
iStateLed=!iStateLed;
}

// -------------------------------------------------
// Handle HTTP requests
// Example :
// To read a whole EEPROM dump :
// http://IP/read?format=1&device=80&size=65536
// -------------------------------------------------
char *ptr=HttpFrame;
int n=0;
while (Serial.available())
{
if (n++<sizeof(HttpFrame))
*ptr++=Serial.read();
else
Serial.flush();
}
*ptr=0;
Serial.write(HttpFrame);
if (n>0)
{
// -------------------------------------------------
// Read Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/read");
if (ptr)
{
byte Device=80, Format=0x50; // hedak: fixed wrong default value for 'Device'
unsigned long Size=0x100, Addr=0;

ptr=strstr(HttpFrame, "addr=");
if (ptr) Addr=HexToULong(ptr+5);
ptr=strstr(HttpFrame, "size=");
if (ptr) Size=atol(ptr+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "format=");
if (ptr) Format=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

sprintf(Buffer, "Start reading @ address: %lX\r\n", Addr);
Serial.write(Buffer);

if (Format==0)
{
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
}
else
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: binary/octet-stream\r\n");

byte bSequential=0;
for (long i=Addr; i<Addr+Size; i+=32)
{
unsigned char Data[32];
for (int i=0; i<32; i++) Data[i]=0xff;
Samsung::ReadEeprom(Device, (bSequential) ? -1:i, Data, 32);
bSequential=1;

if (Format==0)
{
sprintf(Buffer, "%04lx: ", i); Serial.write(Buffer);
for (int j=0; j<32; j++)
{ sprintf(Buffer, "%02X ", Data[j]); Serial.write(Buffer); }
for (int j=0; j<32; j++)
{ Serial.write((Data[j]<=0x20 || Data[j]>0x7f) ? '.':Data[j]); }
Serial.write("\r\n");
Serial.flush();
}
else
{
for (int j=0; j<32; j++)
Serial.write(Data[j]);
}
}
return;
}

// -------------------------------------------------
// Write Eeprom
// -------------------------------------------------
ptr=strstr(HttpFrame, "/write");
Serial.write("Remove the following 'return;' line to activate write feature!\r\n");
return;
char *ptrAddr=strstr(HttpFrame, "addr=");
char *ptrData=strstr(HttpFrame, "data=");
if (ptr && ptrAddr && ptrData)
{
byte Device=0, Data;
unsigned long Addr;

Addr=HexToULong(ptrAddr+5);
Data=HexToULong(ptrData+5);
ptr=strstr(HttpFrame, "device=");
if (ptr) Device=atoi(ptr+7);
ptr=strstr(HttpFrame, "width=8");
Samsung::bEeprom2ByteAddress=(ptr==0);

Samsung::WriteEeprom(Device, Addr, &Data, 1);
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n");
Data=~Data;
Samsung::ReadEeprom(Device, Addr, &Data, 1);
sprintf(Buffer, "%02X ", Data);
Serial.write(Buffer);
return;
}
// send an error !
Serial.write("HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n");
Serial.write("Error !\r\n");
delay(1);
}
}

// ---------------------------------------------------------------------
// Initialization
// ---------------------------------------------------------------------

void setup()
{
#if (F_CPU == 8000000)
// set for 8 MHz clock because of operating at 3.3 volts
CPU_PRESCALE(0x01);
#else
// set for external 16 MHz clock
CPU_PRESCALE(0x00);
#endif
// Led
pinMode(LEDPIN, OUTPUT);
digitalWrite(LEDPIN, HIGH);

// I2C
Wire.begin();

// Serial Console
Serial.begin(115200);

// wait for the user to run their terminal emulator program
// which sets DTR to indicate it is ready to receive.
while (!Serial.dtr()) /* wait */ ;
sprintf(Buffer, "TWI_FREQ: %ld", TWI_FREQ);
Serial.write(Buffer);
}

// ---------------------------------------------------------------------

== References ==
Any discussion on related [http://forum.samygo.tv/viewtopic.php?f=51&t=5307#p38502 forum topic].
Thread using teensy sketch is [http://forum.samygo.tv/viewtopic.php?f=15&t=7117#p53751 here].

BEFORE YOU START: Safety measures for C series TVs

2014-03-05T21:59:34Z

Hedak: Added hint to disable watchdog

* In service menu, '''enable Debug mode''' for the RS232 port AND '''disable watchdog'''.
:: With TV switched off, press the following sequence on the remote: '''[INFO] [MENU] [MUTE] [POWER]'''
:: Enter the '''Control''' menu (then enter '''Sub Option''') and set the value of the '''RS232 mode''' to '''Debug'''. Also set '''Watchdog''' to '''OFF'''.
:: Once you're back to the main Service menu, you will have to power off the TV for normal operation.
:: Notice that your TV will reset RS232 mode back to UART when you install another firmware (no matter if it's older or newer).
* Have a working '''[[Ex-Link Cable for C-Series]]''' at hand.
:: If you don't feel capable of soldering such a cable, you can find and buy a cheap (under '''$5''') '''[http://shop.ebay.com/i.html?_trkparms=65%253A12%257C66%253A2%257C39%253A1%257C72%253A4030&rt=nc&_nkw=usb+ttl&_sticky=1&_trksid=p3286.c0.m14&_sop=15&_sc=1 USB to TTL adapter]''' at eBay.

How to downgrade T-VALDEUC firmware

2014-03-05T20:47:19Z

Hedak: Added warning for not working zero fw from version 3018

=Using "the zero" firmware (not rooted TV)=
'''without SSH/Telnet or script execution''' 

'''WARNING: This doesn't seem to work for firmware version >=3018 anymore (at least for c series, see here: [http://forum.samygo.tv/viewtopic.php?f=10&t=6318#p44767])'''

If you do not have SSH/Telnet access to your TV, it is still possible to downgrade your firmware. For example, if you have 3011 firmware and would like to use SamyGo, you'd need 3005 or 3009 firmware.
To do this, follow these steps:

* Download the following file:
:[http://linksave.in/7663217674f4fbe74196ff rapidshare.com] or [http://uploaded.to/file/muz58fle uploaded.to]
* Extract the file to an USB pendrive (formatted in a file system your TV can read (e.g. FAT32, ext3, NTFS)
* Plug the pendrive into your TV
* There should pop up a message asking you if you want to use the pendrive for "Media Player" or "Software Update". Choose "Software Update".
:Should this message not pop up, go to the TV's menu and select "Software Update" from there
* Follow the procedures for a normal software update from USB. Once the TV is finished, it should restart. Usually, there should come a message up saying "Not for Sale".
* Once your TV is started, you can download any T-VALDEUC firmware on your TV (preferebly from USB), there won't be any version checks.
:Do not use firmware 0000 for "regular" use of your TV since most functions propably won't work (correctly).

=Using shell(rooted TV only)=
How to downgrade if you already have SSH/Telnet access and your run.sh is being executed: 
'''1.''' fill up run.sh with this code:
#!/bin/sh
if [ -f /mtd_rwarea/Version.0 ] ; then
echo SWU_T-VALDEUC_001000_I04_ES000DS000KS000RS000_100205 > /mtd_rwarea/Version.0
else
echo SWU_T-VALDEUC_001000_I04_ES000DS000KS000RS000_100205 > /mtd_rwarea/Version.1
fi
sync

'''2.''' Do not reboot TV, attach USB with firmware version you want to install (T-VALDEUC....) 
'''3.''' Go to "Help -> Software Upgrade -> USB" and TV should accept firmware to downgrade

* '''Attention - code above only for T-VALDEUC'''

* When editing scripts, '''always make sure line breaks are done with unix style "LF", NOT Windows' "CRLF"'''!

=Firmwares=
[[Old_&_Good_Firmwares]]
 
<hr>
=References=
[http://forum.samygo.tv/viewtopic.php?p=12695#p12695 topic]:

Hash partition structure

2014-03-04T21:49:31Z

Hedak: Added c series hash data infos, moved b series references to b series section and added empty f series section

Article describes structure and partition numbers for most known Samsung TV models.
=B series CI+ TV`s=
Almost all read only partitions on B series are observed by secure boot and modifying them may convert TV in to the brick. 
What ''for the hell'' are hashes and how do we calculate them? Read here: '''[[Hashes]]. 
*Hashes for the u-boot (/dev/bml0/2), fnw (dev/bml0/4) and kernel (dev/bml0/5) are stored in /dev/bml0/3 and begin at offset 0x1000.
*Hashes of firmware files (exe.img and appdata.img) are stored at other place on TV. begin at offset 0x0. 

== Hashes on /dev/bml0/3 ==
We have the following structure within this file (at offset 0x1000)
* '''Image''' [16 bytes hash] [4 bytes length]
* '''u-boot''' [16 bytes hash] [4 bytes length]
* '''fnw''' [16 bytes hash] [4 bytes length]
* '''authuld''' [16 bytes hash] [4 bytes length]
* '''rootfs''' [16 bytes hash] [4 bytes length]
* '''boot''' [16 bytes hash] [4 bytes length]

For example, bml0/3 of T-CHLCIPDEUC 2006.0. The hash for kernel (Image) starts at offset 0x1000 and it's length starts at offset 0x1010:
# hexdump -C ./bml0_3_dump
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001000 '''26 7a 0e f7 6f f0 e4 9f 79 1b c5 74 54 10 2e d9''' |&z..o...y..tT...|
00001010 '''{{green|e0 3c 2f 00}} {{gray|72 ab f2 09 a8 ea d4 bc e5 4b 24 a8'''}} |.</.r........K$.|
00001020 '''{{gray|7b 1d f6 bb}} {{green|dc 21 04 00}} {{blue|62 41 92 96 d0 4c 2f b1}}''' |{....!..bA...L/.|
00001030 '''{{blue|17 00 81 0f b5 78 47 ca}} {{green|b4 ba 02 00}} 3d 8a 03 f3''' |.....xG.....=...|
00001040 '''1c f0 b8 15 30 a1 4b f7 42 d8 4d fa {{green|b8 95 00 00}}''' |....0.K.B.M.....|
00001050 '''{{gray|c0 d5 c5 4b bf 04 e5 28 ef 3b c8 4a 5b 75 aa 07}}''' |...K...(.;.J[u..|
00001060 '''{{green|00 10 33 00}} {{blue|b0 5a b0 71 00 32 84 11 e2 f7 fe 45}}''' |..3..Z.q.2.....E|
00001070 '''{{blue|a4 83 fe 5e}} {{green|00 e0 0d 00}}''' 79 f0 81 7f 56 65 61 93 |...^....y...Vea.|
00001080 00 10 31 00 81 6a a0 6c 0a 06 a3 94 23 f4 06 2e |..1..j.l....#...|
00001090 b8 f0 68 3e 00 b0 0d 00 92 4c 61 38 a1 1a f0 0b |..h>.....La8....|
<...>
00020000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00080000

Where: hash of kernel comes first and it is:
26 7a 0e f7 6f f0 e4 9f 79 1b c5 74 54 10 2e d9
Image lengh (hexadecimal)is: {{green|e0 3c 2f 00}}, which has to be read {{red|backwards}}. So the real length is:
00 2f 3c e0 (hex) = 3095776 (decimal)
 
Calculation made with dumps of LE40B650T2P-2006.0 let you understand better structure of bml0/3:
./chkhash -k 7CED26D8CA2FA0F80BC637E2FF07EC46 -L 0x1000 8 bml0_3_dump *
hash[ 0] = 267a0ef76ff0e49f791bc57454102ed9 length = 3095776 : bml05.dmp
hash[ 1] = 72abf209a8ead4bce54b24a87b1df6bb length = 270812 : bml02.dmp
hash[ 2] = 62419296d04c2fb11700810fb57847ca length = 178868 : bml04.dmp
hash[ 3] = 3d8a03f31cf0b81530a14bf742d84dfa length = 38328 : authuld
hash[ 4] = c0d5c54bbf04e528ef3bc84a5b75aa07 length = 3346432 : bml06.dmp
hash[ 5] = b05ab07100328411e2f7fe45a483fe5e length = 909312 : bml07.dmp
Now you will know, that after you modify any of those partitions, you have also modify hex signature (hash) as well. MANDATORY at same TV session. Don`t reboot you you haven`t restored hash partition with updated hashes.
 

== exe.img and appdata.img ==
The hashes for mtd_exe and mtd_appdata are in /dev/bml0/18 and /dev/bml0/19 for a 1Gb flash type TV models (it differs for other flash sizes).

Structureis similar to bml0/3, just hashes are at the beginning of file: 
*'''mtd_exe''' [16 bytes hash ] [4 bytes lengh], the next [16 bytes ] [4 bytes] are for '''mtd_appdata''' 
For example T-CHLCIPDEUC-2006.0:
00000000 '''43 72 15 c3 a6 ff 21 14 ac ac 65 9f cd 5a 25 eb''' |Cr....!...e..Z%.|
00000010 {{green|00 f0 40 03}} 07 7c b3 32 41 ec cd b1 dd f0 40 fd |..@..|.2A.....@.|
00000020 f4 21 82 9d 00 d0 ca 01 00 00 00 00 00 00 00 00 |.!..............|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

Hash of exe.img:
43 72 15 c3 a6 ff 21 14 ac ac 65 9f cd 5a 25 eb
Lengh of it: {{green|00 f0 40 03}}, but {{red|backwards}} it is:
03 40 f0 00 = 54587392 bytes (decimal)
This is exact size in bytes of decrypted exe.img! :)
./chkhash -k 7CED26D8CA2FA0F80BC637E2FF07EC46 -L 0x0 3 bml19.dmp *
hash[ 0] = d960b582b2ad80eb3203c6bc23735bca length = 54587392 : exe.img
hash[ 1] = 077cb33241eccdb1ddf040fdf421829d length = 30068736 : appdata.img

== Authuld ==
After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes '''of active''' partitions and authuld itself. It is important to understand that this check takes some time (this is the delay experienced until authuld reboots the system if it detects modifications, should be approx 1 minute). If it matches, nothing happens (besides an authuld completed successfully message), if it doesn't match, the kernel tells Micom to reboot the system (Micom cmd 143).

On B series (differs from C/D/E series) here are one set of partitions which is always checked (hashes stored on /dev/bml0/'''{{red|3}}''' AND two sets of firmware files (checked only active). Example LExxB650T2P:
1nd. /dev/bml0/8 and /dev/bml0/10
2nd. /dev/bml0/9 and /dev/bml0/11
After authuld finishes checking of partitions whose hashes are stored on /dev/bml0/3, it starts to check firmware active partitions, depends from what boot flag is present on /mtd_rwarea:
PartitionSwitch_0_0 - 1st set of partitions is booting and hashes are checked on '''1st strmackeypartition'''
PartitionSwitch_1_0 - 2nd set of partitions is booting and hashes are checked on '''2nd strmackeypartition'''

At boot time neither hashes of alternative (inactive) partitions, nor its strmackeypartition are checked.

== Known numbers of strmackeypartitions ==
1Gb flash size B series models (like B650...)
/dev/bml0/18 is the '''1st strmackeypartition'''
/dev/bml0/19 is the '''2nd strmackeypartition'''
2Gb flash size B series models (like B7000/8000...)
/dev/bml0/16 is the '''1st strmackeypartition'''
/dev/bml0/17 is the '''2nd strmackeypartition'''
128Mb flash size models (like B550...)
/dev/bml0/13 is the '''1st strmackeypartition'''
/dev/bml0/14 is the '''2nd strmackeypartition'''
==Key partition ==
We until today don`t know what is stored on that partition and what is used this info for. 
For above mentioned models it`s number is:
1Gb flash - /dev/bml0/20
2Gb flash - /dev/bml0/18
128Mb flash /dev/bml0/15
Example of hex data on that partition (1Gb flash, T-CHLCIPDEUC 2006.0)
hexdump -C ./bml20.dmp
00000000 27 07 79 19 2d 65 f1 22 86 29 40 6c 90 0d af 55 |'.y.-e.".)@l...U|
00000010 17 c7 99 2a 27 07 79 19 ff ff ff ff ff ff ff ff |...*'.y.........|
00000020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00100000
If anyone has some ideas, what is needed for, please share with us [http://forum.samygo.tv/viewtopic.php?f=2&t=655 on forum]. Thanks!

==References==
#[http://forum.samygo.tv/viewtopic.php?f=2&t=655&start=30#p9491 research of cyberdemon79]

=C series TV`s=
Almost all read only partitions on C series are observed by secure boot and modifying them may convert TV in to the brick. 
What ''for the hell'' are hashes and how do we calculate them? Read here: '''[[Hashes]]. 

For knowing what it's talked about here is the whole partition list of a UE46C7700 T-VALDEUC 3011.0:
# cat /mtd_exe/partition.txt
partitionID flash_device_name flash_device_size flash_image_name flash_device_type flash_upgrade_type flash_partition_map flash_mount_path default_block_size flash_format_option flash_mount_option
0 /dev/bml0/1 262144 onboot.bin DEVICE OTHER BOOTLOADER0 NONE 262144 NONE NONE
1 /dev/bml0/2 262144 u-boot.bin BML OTHER BOOTLOADER1 NONE 262144 NONE NONE
2 /dev/bml0/3 262144 uboot_env.bin BML OTHER BOOTLOADER2 NONE 262144 NONE NONE
3 /dev/bml0/4 262144 fnw.bin BML OTHER BOOTLOADER3 NONE 262144 NONE NONE
4 /dev/bml0/5 4194304 Image BML USER KERNEL0 NONE 262144 NONE NONE
5 /dev/bml0/6 3670016 rootfs.img BML USER RFS0 NONE 262144 NONE NONE
6 /dev/bml0/7 4194304 Image BML USER KERNEL1 NONE 262144 NONE NONE
7 /dev/bml0/8 3670016 rootfs.img BML USER RFS1 NONE 262144 NONE NONE
8 /dev/bml0/9 262144 NONE BML OTHER SECUREMAC0 NONE 262144 NONE NONE
9 /dev/bml0/10 262144 NONE BML OTHER SECUREMAC1 NONE 262144 NONE NONE
10 /dev/bml0/11 262144 key.bin BML OTHER SECUREMAC2 NONE 262144 NONE NONE
11 /dev/bml0/12 262144 NONE BML OTHER NONE NONE 262144 NONE NONE
12 /dev/stl0/13 11272192 NONE STL OTHER NONE /mtd_contents 4096 ERASE:,STL:-r_7,FAT:-S_1024_-s_1 -t_rfs_-o_codepage=utf8
13 /dev/stl0/14 26214400 NONE STL OTHER NONE /mtd_rwarea 4096 ERASE:,STL:-r_7,FAT:-S_1024_-s_1 -t_rfs_-o_codepage=utf8
14 /dev/stl0/15 93323264 exe.img STL USER EXE0 /mtd_exe 4096 ERASE:,STL:-r_2 NONE
15 /dev/stl0/16 58195968 appdata.img STL USER APP_DATA0 /mtd_appdata 4096 ERASE:,STL:-r_2 NONE
16 /dev/stl0/17 93323264 exe.img STL USER EXE1 /mtd_exe 4096 ERASE:,STL:-r_2 NONE
17 /dev/stl0/18 58195968 appdata.img STL USER APP_DATA1 /mtd_appdata 4096 ERASE:,STL:-r_2 NONE
18 /dev/stl0/19 52953088 rocommon.img STL OTHER CONTENT0 /mtd_rocommon 4096 ERASE:,STL:-r_2 NONE
19 /dev/stl0/20 104857600 NONE STL OTHER NONE /mtd_swu 4096 ERASE:,STL:-r_16,FAT:-S_4096_-s_4 -t_rfs
20 /dev/stl0/21 411566080 NONE STL OTHER NONE /mtd_rwcommon 4096 FAT:-S_4096_-s_1 -t_rfs_-o_codepage=utf8

Just for completeness: SECUREMAC2 (/dev/bml0/11) is the strmackeypartition here.

==Typical hash data structure==
For all hashes the structure is as follows: 
[16 bytes hash][4 bytes length] 
16 bytes hash is calculated using chkhash. 
4 bytes length is the byte count the hash is/was calculated over. It is stored backwards (see B series for details).

==Partition hash data==
The hashes of the images exe.img, appdata.img, Image (kernel) and rootfs.img are stored in that order sequentially within a separate partition, sometimes called cmac (hash) partition. These four images are stored in separate partitions. As all four partitions exist twice (one for active set, one for inactive set) there also exist two cmac partitions: SECUREMAC0 and SECUREMAC1 
 
During boot process the hashes of inactive partition are not checked. 
 
The relation is as follows:
 
SECUREMAC0 (/dev/bml0/9): EXE0 (/dev/stl0/15), APP_DATA0 (/dev/stl0/16), KERNEL0 (/dev/bml0/5) and RFS0 (/dev/bml0/6)
 
SECUREMAC1 (/dev/bml0/10): EXE1 (/dev/stl0/17), APP_DATA1 (/dev/stl0/18), KERNEL1 (/dev/bml0/7) and RFS1 (/dev/bml0/8)
 
 
For example cmac partition for 2nd partition set (/dev/bml0/10) of T-VALDEUC 3011.0 looks like this:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 48 F5 8B FA 80 50 D8 8E A1 75 79 57 DC F7 EB C5 Hõ‹ú€PØŽ¡uyWÜ÷ëÅ
00000010 00 70 55 05 58 03 6F E3 6C 3F E1 58 56 13 A9 45 .pU.X.oãl?áXV.©E
00000020 51 AE 92 00 00 40 7D 02 7E E4 E5 37 96 1A A0 DE Q®’..@}.~äå7–. Þ
00000030 C4 95 3B AE D4 AD CE 99 90 A4 38 00 9B 86 63 05 Ä•;®Ô.Î™.¤8.›†c.
00000040 0A 8F FA 3B 66 07 BA 93 1D BF BE 2B 14 F0 37 00 ..ú;f.º“.¿¾+.ð7.
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Where
48 F5 8B FA 80 50 D8 8E A1 75 79 57 DC F7 EB C5
is the hash of exe.img (stored in /dev/stl0/17), the image byte size is 0x05557000 (00 70 55 05 read backwards)

58 03 6F E3 6C 3F E1 58 56 13 A9 4 51 AE 92 00
is the hash of appdata.img (stored in /dev/stl0/18), the image byte size is 0x027D4000 (00 40 7D 02 read backwards)

7E E4 E5 37 96 1A A0 DE C4 95 3B AE D4 AD CE 99
is the hash of Image (kernel) (stored in /dev/bml0/7), the image byte size is 0x0038A490 (90 A4 38 00 read backwards)

9B 86 63 05 0A 8F FA 3B 66 07 BA 93 1D BF BE 2B
is the hash of rootfs.img (stored in /dev/bml0/8), the image byte size is 0x0037F014 (14 F0 37 00 read backwards)

==authuld hash data==
The binary authuld is stored within read-only rootfs partition (is NOT image!). Although rootfs's hash is already checked authuld's hash is checked separately! authuld's hash is stored 0x1000 (4096 dez) byte in front of the end of partition (is NOT image!) rootfs.

For example rootfs partition for 2nd partition set (/dev/bml0/8) of T-VALDEUC 3011.0 looks like this:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0037EFF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0037F000 05 C7 9B 14 D3 DF 2B A0 88 C3 EB CB 4C A9 3E B5 .Ç›.Óß+ ˆÃëËL©>µ
0037F010 68 98 00 00 FF FF FF FF FF FF FF FF FF FF FF FF h˜..ÿÿÿÿÿÿÿÿÿÿÿÿ
0037F020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Notice: Referring to the partition list written above the partition size of rootfs is 3670016 byte (0x380000). So the hash data for authuld is located at offset 0x37F000 (0x380000 - 0x1000).

Where
05 C7 9B 14 D3 DF 2B A0 88 C3 EB CB 4C A9 3E B5
is the hash of binary authuld, the binary byte size is 0x00009868 (68 98 00 00 read backwards)

After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes of active partitions and authuld itself.
It is important to understand that this check takes some time (this is the delay experienced until authuld reboots the system if it detects modifications, should be approx 1 minute). If it matches, nothing happens (besides an authuld completed successfully message), if it doesn't match, the system reboots.

==Bootlader hashes==
Not available as far as i could figure out. (maybe because its not used (anymore))

==References==
#[http://forum.samygo.tv/viewtopic.php?f=10&t=7396&p=56294 Modifying /mtd_exe of active partition]
#[http://wiki.samygo.tv/index.php5/Remove_shell_input_filtration#Patch_kernel_image Patch kernel image]
#[http://forum.samygo.tv/viewtopic.php?f=10&t=7247&p=54937 Modifying rootfs image]

=D series TV`s=
ToDo

=E series TV`s=
ToDo

=F series TV`s=
ToDo

=BluRay players=
ToDo

Work in progress, to be updated.

Hashes

2014-02-26T21:35:08Z

Hedak: Added some 0.02 feature descriptions and download links

WORK IN PROGRESS, NOT FINISHED YET! {{red|Ned to remake and update}}

=getmkey utility=

To calculate hashes you will need a 128-bit key which can be obtained from the TV or blu-ray player using getmkey utility. Check file getmkey/Makefile to get the idea how to build getmkey program, upload it to the TV or player and run it. If you do not wish to install a toolchain for cross-compilation, you may try prebuilt binaries: getmkey or getmkey_static.

If you have root access to the TV or player, run getmkey. You should get the output which looks like this:

opening /dev/mem ok!
No key was supplied from a command line.
Using mackey from /dev/tfsr11
Input key = 86d446c947765600a4a83098e6ee7ae2
After waiting 1 loops
mkey='2b7e151628aed2a6abf7158809cf4f3c' # for BD-C6900 player
#mkey='7ced26d8ca2fa0f80bc637e2ff07ec46' # B series
#mkey='6f6bc7e1fc7f86bf9c150a82f343e2e0' # for T-VALDEUC-1014.3 TV

./chkhash -k 7ced26d8ca2fa0f80bc637e2ff07ec46 -h 3665940 rootfs.img
Last line of the output contains an mkey which will be used in chkhash program:

=Printing hashes=

./chkhash -p offset n file : prints <n> hashes at <offset> in <file>
offset less than zero means offset from the end of the file.

Example: print hashes in dumps from /dev/tbml9 and /dev/tbml10. Here and below we assume that dumps from firmware partitions /dev/tbmlX are stored in files tbmlX.bin, and dumps from /dev/stl0/X are stored in files stl0-X.bin.

./chkhash -p 0 6 tbml9.bin
hash[ 0] = cb82e0476eecfe10b7415c099c34a53f length = 39735296
hash[ 1] = efb116822ffe713571b988f4bd71fb14 length = 36028416
hash[ 2] = 66d50c94a62cb51cf51482e77c74e267 length = 3104328
hash[ 3] = 1b8f9aa5846d4d8624482c183cb9c147 length = 4190228
hash[ 4] = 7bca4cf5f259475adac2c57965d7d6f1 length = 123510
Only 5 hashes were detected

./chkhash -p 0 6 tbml10.bin
hash[ 0] = 25a3d13599932da3d255a749f1fe7581 length = 41050112
hash[ 1] = 2c23831d821407d180607890c07d4d22 length = 37797888
hash[ 2] = 60a8d999f3b6da20c58a3eb2056d43d6 length = 3104328
hash[ 3] = b0dac74b78a6814149187cf4d660f1f5 length = 4190228
hash[ 4] = 7bca4cf5f259475adac2c57965d7d6f1 length = 123510
Only 5 hashes were detected

Or print hash for /bin/authuld file (this hash is stored at the offset 4096 bytes from the end of RootFS image in /dev/tbml6 or /dev/tbml8):

./chkhash -p -4096 1 tbml6.bin
hash[ 0] = 7fe99ddcf4c6c67f68374dbc60879f64 length = 36308

./chkhash -p -4096 1 tbml8.bin
hash[ 0] = 941137492edd0c83b489c665d6335295 length = 36308

=Calculating hashes=

./chkhash -k mkey -h length file : calculates and prints hash from the first <length> bytes of the file.
if length is 0, the hash is calculated for full file length.

Example: if you have a copy of an authuld in current directory, run

./chkhash -k 2b7e151628aed2a6abf7158809cf4f3c -h 0 authuld
Hash: 941137492edd0c83b489c665d6335295, length = 36308

Or you can calculate, for example a hash for bootloader (in /dev/tbml1):

./chkhash -k 2b7e151628aed2a6abf7158809cf4f3c -h 123510 tbml1.bin
Hash: 7bca4cf5f259475adac2c57965d7d6f1, length = 123510

=Calculating and comparing hashes=

./chkhash -k mkey -m length file hash : calculates hash from the first <length> bytes of the file and compares with <hash>
prints no result, useful in scripts only: return 0 if hashes are equal
if length is 0, the hash is calculated for full file length.

=Looking for dumps whose hashes are stored in a hash block file (CMAC):=

./chkhash -k mkey -L offset n hashfile file1 file2 ... fileN
: checks if <n> hashes stored at <offset> in a <hashfile> match
: with hashes for <file1> <file2> ... <fileN>

Example: tbml10.bin (dump from /dev/tbml10), as shown above, contains a set of hashes for some files. Let's find these files (search will take some time because of calculation of hashes for many files):

./chkhash -k 2b7e151628aed2a6abf7158809cf4f3c -L 0 5 tbml10.bin tbml*.bin stl0-*.bin
hash[ 0] = 25a3d13599932da3d255a749f1fe7581 length = 41050112 : stl0-16.bin
hash[ 1] = 2c23831d821407d180607890c07d4d22 length = 37797888 : stl0-17.bin
hash[ 2] = 60a8d999f3b6da20c58a3eb2056d43d6 length = 3104328 : tbml7.bin
hash[ 3] = b0dac74b78a6814149187cf4d660f1f5 length = 4190228 : tbml8.bin
hash[ 4] = 7bca4cf5f259475adac2c57965d7d6f1 length = 123510 : tbml1.bin

Here these files contain:

stl0-16.bin : mtd_exe
stl0-17.bin : mtd_appdata
tbml7.bin : kernel
tbml8.bin : rootfs
tbml1.bin : bootloader

=Calculation of hash block (CMAC) for firmware modification=

./chkhash -k mkey -H outfile file1 file2 ... fileN
: creates hash block (cmac) for given input files

Hashes are written in the same order as supplied files. This can be used for building a hash block (CMAC) if you modify some firmware partitions.

=Save given key to binary file=

./chkhash -S key file : saves given hex <key> (16 byte) to binary <file>
<file> is created if not existent and overwritten if already existent

Example:
./chkhash -S 6f6bc7e1fc7f86bf9c150a82f343e2e0 /mtd_rwcommon/test.bin
will create the file /mtd_rwcommon/test.bin with content (hex view):
00000000 6F 6B C7 E1 FC 7F 86 BF 9C 15 0A 82 F3 43 E2 E0 okÇáü.†¿œ..‚óCâà

=Write calculated hash to file=

./chkhash -k mkey -w offset k hashfile file : writes calculated hash for <file> (full length) at hash position <k> in a hash
block located at <offset> in <hashfile>
offset less than zero means offset from the end of the hashfile

Example:
./chkhash -k 6f6bc7e1fc7f86bf9c150a82f343e2e0 -w 0 0 /mtd_rwcommon/bml10.dmp /mtd_rwcommon/mtd_exe_part.dmp
will write the calculated hash of /mtd_rwcommon/mtd_exe_part.dmp ('_part' indicates that the dump is cut to the length read in /dev/bml0/10, for example using 'dd' to dump the first xx blocks only) in /mtd_rwcommon/bml10.dmp with no offset (0) and update the hash at index 0 (i.e. the hash of /mtd_exe)

= mknewfs.sh =

This an example script to create a modified version of rootfs, mtd_exe or mtd_appdata. Please check it carefully before using. I did not test it for flashing my own firmware, so be careful. Read comments explaining the whole process and, anyway, you must accept any risk of possible bricking your TV or player.

= Other remarks =

Note that you will also need to know how to switch partitions for booting. Flashing of active (mounted) partition is dangerous, so you can only flash inactive (currently unused and unmounted) partition. So, first you will need to find which partition is active now. Run the following command in your device:

# df
Filesystem 1k-blocks Used Available Use% Mounted on
/dev/tbml8 2880 2880 0 100% /
none 10240 20 10220 0% /dtv
none 60204 0 60204 0% /core
/dev/stl0/17 36928 36928 0 100% /mtd_appdata
/dev/stl0/16 40128 40128 0 100% /mtd_exe

This is for BD-C6900 player. Other devices may have other filesystem structure, so procedure described here may be different. Here we can see that active devices are /dev/tbml8 /dev/stl0/17 /dev/stl0/16 which belong to second partiton and their CMAC data (hashes) are stored in /dev/tbml10. Therefore we can flash first partition: /dev/tbml6 /dev/stl0/15 /dev/stl0/14 and write their hashes to /dev/tbml9.

If we assume that dumps from firmware /dev/tbmlX are stored in files tbmlX.bin, and dumps from /dev/stl0/X are stored in files stl0-X.bin, first of all we need to copy currently active files to prepare them for first (now inactive) partition:

cp tbml8.bin tbml6.bin # rootfs
cp stl0-17.bin stl0-15.bin # mtd_appdata
cp stl0-16.bin stl0-14.bin # mtd_exe
cp tbml7.bin tbml5.bin # kernel

Also, we need to copy hashes:

cp tbml10.bin tbml9.bin

Now we can start to modify the firmware: run

mknewfs.sh tbml6.bin tbml9.bin

for the first time to unsquash the rootfs. Then go to the tbml6.bin.rootdir and do necessary changes. Create new rootfs by running the same script again. You will get two files: tbml6.bin.new and tbml9.bin.new which contain new rootfs and new CMAC ready for flashing to /dev/tbml6 and /dev/tbml9. You may also modify mtd_exe by running

mknewfs.sh stl0-14.bin tbml9.bin

two times: first, to unsquash filesystem, and second time after your modifications to build new mtd_exe.

After flashing modified filesystems, kernel and hash block (CMAC), you will need to switch partitions to boot into your modified filesystems. That's it!

How to flash firmware partitions and switch them: this probably can be found elsewhere...

Note that I did not try that. So, consider this just as some theoretical analysis. Study it, check for possible errors, and use it on your own risk.
----
'''Download chkhash sources and precompiled getmkey [http://download.samygo.tv/Others/chkhash-0.02.zip chkhash-0.2.zip]'''

'''Download precompiled chkhash for arm [https://forum.samygo.tv/download/file.php?id=3748]'''

'''Download precompiled chkhash for win32 [https://forum.samygo.tv/download/file.php?id=3766]'''

=References =
Discussion on the SamyGO forum (can`t decide which subforum it belongs to...)