SamyGO - User contributions [en]

Open source software for series A7/8/9 SH4

2013-03-14T17:46:53Z

Tom van:

Increasing discontent with Samsung software resulted in looking for better alternative.
And open source community offers one.
Belive or not, Samsung TV can run without Samsung's software!
=Disclaimer=
System is very experimental and many components are work in progress.
It is not yet suitable for general public. If you are not experienced in linux, please do not use it.
There is ABSOLUTELY NO WARRANTY

=System components=
System is based on Linux, modified [http://www.stlinux.com/ STLinux] from ST Microelectronics
and [http://duckbox.info/ DuckBox] - collection of open software for satellite box.
TDT used in following text is acronym for Team Duck Box.

===Build toolchain===
Used TDT build system with patches for SAMTV

===Linux kernel===
[ftp://ftp.stlinux.com/pub/stlinux/2.4/updates/SRPMS/stlinux24-host-kernel-source-sh4-2.6.32.59_stm24_0211-211.src.rpm linux kernel] version 2.6.32.59 stm24-211
with TDT patches and SAMTV board setup.
Kernel is configured for nfs boot and root. To speed up boot time, usb disk and flash drivers are NOT compiled in, so this kernel will NOT work with usb root.

===Havana player2===
Open source multimedia player framework from ST Microelectronics.
In original Samsung software is used player version 1 with STAPI. Player 2 has linux native DVB API.
Used TDT patched version 2-191 with aditional patches for SAMTV.

===Native linux DVB-T driver===
Driver for DVB-T frontend S5H1432 was backported from linux 3.6 and substantially reworked.

===Initialization and control of TV hardware===
User mode process for initializing and setting
* FRC (frame rate converter) - I belive FRC9459M chip from Micronas is used
* FBE (FBE2 picture enhancer, commercially called DNIe)
* LDM (local dimming control)
* NTP3100 speaker amplifiers
Also used for
* SCH (scaler handling) - communication with secondary CPU MTK8226

=User software=

[[File:neutrino-samtv.jpg|400px|right]]
===Neutrino MP===
User software for satellite receiver. Multiplatform version with DVB-T.

Sources git://gitorious.org/neutrino-mp/neutrino-mp.git

* Fast start-up and operation
* Reasonable memory requirements - 50 MB free when running
* Nice GUI with partial transparency
* Advanced live graphs of signal quality.
* Simple media player and UPnP browser, not yet working on Samsung TV.

----

[[File:showtime-samtv1.jpg|400px|right]]
===Showtime media center===
Nice media center software now being ported to sh4 / Havana player2.
See http://www.lonelycoder.com/showtime/

* Appealing animated GUI
* Advanced browser with support for local files, smb, http, UPnP
* Automatic search in info databases
* Demanding lot of CPU and GPU power, original GUI uses OpenGL rendering
* Plugins and internal scripting in JavaScript

Test showed that number of simplifications in GUI must be done to adjust low CPU power of Samsung TV.

[[File:showtime-samtv2.jpg|220px]] [[File:showtime-samtv3.jpg|220px]] [[File:showtime-samtv-min.jpg|220px]] [[File:showtime-samtv-max.jpg|220px]]

----

DuckBox project includes also following user software

* Enigma 2: Satellite receiver user software. Works and supports DVB-T. Media player does not decode all formats supported by Havana player2.
* XBMC: Media center works but is very very slow and hardly fits into memory. Not for real use on this architecture.

=Instalation=
To be described

=TODO list=
* Factory and user settings of FBE2, FRC, LDM
* More filter banks for speaker amplifiers
* setting EEPROM handling
* HDMI input handling
* Micom IR remote control input and improve micom handler
* HDMI CEC
* SPIDF output

===Functions NOT planned to be suported===
* Analogue TV
* Analogue video in/out

=Misc=
Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

Open source software for series A7/8/9 SH4

2013-03-14T17:45:41Z

Tom van:

Increasing discontent with Samsung software resulted in looking for better alternative.
And open source community offers one.
Belive or not, Samsung TV can run without Samsung's software!
=Disclaimer=
System is very experimental and many components are work in progress.
It is not yet suitable for general public. If you are not experienced in linux, please do not use it.
There is ABSOLUTELY NO WARRANTY

=System components=
System is based on Linux, modified [http://www.stlinux.com/ STLinux] from ST Microelectronics
and [http://duckbox.info/ DuckBox] - collection of open software for satellite box.
TDT used in following text is acronym for Team Duck Box.

===Build toolchain===
Used TDT build system with patches for SAMTV

===Linux kernel===
[ftp://ftp.stlinux.com/pub/stlinux/2.4/updates/SRPMS/stlinux24-host-kernel-source-sh4-2.6.32.59_stm24_0211-211.src.rpm linux kernel] version 2.6.32.59 stm24-211
with TDT patches and SAMTV board setup.
Kernel is configured for nfs boot and root. To speed up boot time, usb disk and flash drivers are NOT compiled in, so this kernel will NOT work with usb root.

===Havana player2===
Open source multimedia player framework from ST Microelectronics.
In original Samsung software is used player version 1 with STAPI. Player 2 has linux native DVB API.
Used TDT patched version 2-191 with aditional patches for SAMTV.

===Native linux DVB-T driver===
Driver for DVB-T frontend S5H1432 was backported from linux 3.6 and substantially reworked.

===Initialization and control of TV hardware===
User mode process for initializing and setting
* FRC (frame rate converter) - I belive FRC9459M chip from Micronas is used
* FBE (FBE2 picture enhancer, commercially called DNIe)
* LDM (local dimming control)
* NTP3100 speaker amplifiers
Also used for
* SCH (scaler handling) - communication with secondary CPU MTK8226

=User software=

[[File:neutrino-samtv.jpg|400px|right]]
===Neutrino MP===
User software for satellite receiver. Multiplatform version with DVB-T.

Sources git://gitorious.org/neutrino-mp/neutrino-mp.git

* Fast start-up and operation
* Reasonable memory requirements - 50 MB free when running
* Nice GUI with partial transparency
* Advanced live graphs of signal quality.
* Simple media player and UPnP browser, not yet working on Samsung TV.

----

[[File:showtime-samtv1.jpg|400px|right]]
===Showtime media center===
Nice media center software now being ported to sh4 / Havana player2.
See http://www.lonelycoder.com/showtime/

* Appealing animated GUI
* Advanced browser with support for local files, smb, http, UPnP
* Automatic search in info databases
* Demanding lot of CPU and GPU power, original GUI uses OpenGL rendering
* Plugins and internal scripting in JavaScript

Test showed that number of simplifications in GUI must be done to adjust low CPU power of Samsung TV.

[[File:showtime-samtv2.jpg|220px]] [[File:showtime-samtv3.jpg|220px]] [[File:showtime-samtv-min.jpg|220px]] [[File:showtime-samtv-max.jpg|220px]]

----

DuckBox project includes also following user software

* Enigma 2: Satellite receiver user software. Works and supports DVB-T. Media player does not decode all formats supported by Havana player2.
* XBMC: Media center works but is very very slow and hardly fits into memory. Not for real use.

=Instalation=
To be described

=TODO list=
* Factory and user settings of FBE2, FRC, LDM
* More filter banks for speaker amplifiers
* setting EEPROM handling
* HDMI input handling
* Micom IR remote control input and improve micom handler
* HDMI CEC
* SPIDF output

===Functions NOT planned to be suported===
* Analogue TV
* Analogue video in/out

=Misc=
Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

Open source software for series A7/8/9 SH4

2013-03-14T17:44:33Z

Tom van: add neutrino-mp and screenshots

Increasing discontent with Samsung software resulted in looking for better alternative.
And open source community offers one.
Belive or not, Samsung TV can run without Samsung's software!
=Disclaimer=
System is very experimental and many components are work in progress.
It is not yet suitable for general public. If you are not experienced in linux, please do not use it.
There is ABSOLUTELY NO WARRANTY

=System components=
System is based on Linux, modified [http://www.stlinux.com/ STLinux] from ST Microelectronics
and [http://duckbox.info/ DuckBox] - collection of open software for satellite box.
TDT used in following text is acronym for Team Duck Box.

===Build toolchain===
Used TDT build system with patches for SAMTV

===Linux kernel===
[ftp://ftp.stlinux.com/pub/stlinux/2.4/updates/SRPMS/stlinux24-host-kernel-source-sh4-2.6.32.59_stm24_0211-211.src.rpm linux kernel] version 2.6.32.59 stm24-211
with TDT patches and SAMTV board setup.
Kernel is configured for nfs boot and root. To speed up boot time, usb disk and flash drivers are NOT compiled in, so this kernel will NOT work with usb root.

===Havana player2===
Open source multimedia player framework from ST Microelectronics.
In original Samsung software is used player version 1 with STAPI. Player 2 has linux native DVB API.
Used TDT patched version 2-191 with aditional patches for SAMTV.

===Native linux DVB-T driver===
Driver for DVB-T frontend S5H1432 was backported from linux 3.6 and substantially reworked.

===Initialization and control of TV hardware===
User mode process for initializing and setting
* FRC (frame rate converter) - I belive FRC9459M chip from Micronas is used
* FBE (FBE2 picture enhancer, commercially called DNIe)
* LDM (local dimming control)
* NTP3100 speaker amplifiers
Also used for
* SCH (scaler handling) - communication with secondary CPU MTK8226

=User software=

[[File:neutrino-samtv.jpg|400px|right]]
===Neutrino MP===
User software for satellite receiver. Multiplatform version with DVB-T.

Sources git://gitorious.org/neutrino-mp/neutrino-mp.git

* Fast start-up and operation
* Reasonable memory requirements - 50 MB free when running
* Nice GUI with partial transparency
* Advanced live graphs of signal quality.
* Simple media player and UPnP browser, not yet working on Samsung TV.

----

[[File:showtime-samtv1.jpg|400px|right]]
===Showtime media center===
Nice media center software now being ported to sh4 / Havana player2.
See http://www.lonelycoder.com/showtime/

* Appealing animated GUI
* Advanced browser with support for local files, smb, http, UPnP
* Automatic search in info databases
* Demanding lot of CPU and GPU power, original GUI uses OpenGL rendering
* Plugins and internal scripting in JavaScript

Test showed that number of simplifications in GUI must be done to adjust low CPU power of Samsung TV.

[[File:showtime-samtv2.jpg|220px]] [[File:showtime-samtv3.jpg|220px]] [[File:showtime-samtv-min.jpg|220px]] [[File:showtime-samtv-max.jpg|220px]]

----

DuckBox project includes also following user software

* Enigma 2: Satellite receiver user software. Works and supports DVB-T. Media player does not decode all formats supported by Havana player2.
* XBMC: Media center works but is very very slow and hardly fits into memory. Not for real use.

=Instalation=
To be described

=TODO list=
* Factory and user settings of FBE2, FRC, LDM
* More filter banks for speaker amplifiers
* setting EEPROM handling
* HDMI input handling
* Micom IR remote control input and improve micom handler
* HDMI CEC
* SPIDF output

===Functions NOT planned to be suported===
* Analogue TV
* Analogue video in/out

=Misc=
Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

File:Showtime-samtv-max.jpg

2013-03-14T17:40:50Z

Tom van: showtime really big font

showtime really big font

File:Showtime-samtv-min.jpg

2013-03-14T17:39:35Z

Tom van: showtime minimal font size

showtime minimal font size

File:Showtime-samtv3.jpg

2013-03-14T17:38:20Z

Tom van: showtime settings menu

showtime settings menu

File:Showtime-samtv2.jpg

2013-03-14T17:35:47Z

Tom van: showtime multimedia browser

showtime multimedia browser

File:Showtime-samtv1.jpg

2013-03-14T17:04:20Z

Tom van: showtime design on black background perfectly fits Samsung LE46A956 black frame

showtime design on black background perfectly fits Samsung LE46A956 black frame

File:Neutrino-samtv.jpg

2013-03-14T16:54:15Z

Tom van: neutrino mp just ported to Samsung LE46A956

neutrino mp just ported to Samsung LE46A956

Open source software for series A7/8/9 SH4

2013-03-11T11:20:48Z

Tom van:

Increasing discontent with Samsung software resulted in looking for better alternative.
And open source community offers one.
Belive or not, Samsung TV can run without Samsung's software!
=Disclaimer=
System is very experimental and many components are work in progress.
It is not yet suitable for general public. If you are not experienced in linux, please do not use it.
There is ABSOLUTELY NO WARRANTY

=Components=
System is based on Linux, modified [http://www.stlinux.com/ STLinux] from ST Microelectronics
and [http://duckbox.info/ DuckBox] - collection of open software for satellite box.
TDT used in following text is acronym for Team Duck Box.

===Build toolchain===
Used TDT build system with patches for SAMTV

===Linux kernel===
[ftp://ftp.stlinux.com/pub/stlinux/2.4/updates/SRPMS/stlinux24-host-kernel-source-sh4-2.6.32.59_stm24_0211-211.src.rpm linux kernel] version 2.6.32.59 stm24-211
with TDT patches and SAMTV board setup.
Kernel is configured for nfs boot and root. To speed up boot time, usb disk and flash drivers are NOT compiled in, so this kernel will NOT work with usb root.

===Havana player2===
Open source multimedia player framework from ST Microelectronics.
In original Samsung software is used player version 1 with STAPI. Player 2 has linux native DVB API.
Used TDT patched version 2-191 with aditional patches for SAMTV.

===Native linux DVB-T driver===
Driver for DVB-T frontend S5H1432 was backported from linux 3.6 and substantially reworked.

===Initialization and control of TV hardware===
User mode process for initializing and setting
* FRC (frame rate converter) - I belive FRC9459M chip from Micronas is used
* FBE (FBE2 picture enhancer, commercially called DNIe)
* LDM (local dimming control)
* NTP3100 speaker amplifiers
Also used for
* SCH (scaler handling) - communication with secondary CPU MTK8226

===Showtime media center===
Nice media center software now being ported to sh4 / Havana player2. See http://www.lonelycoder.com/showtime/

===Other software===
DuckBox project includes following user software

* Enigma 2: Satellite receiver user software. Works and supports DVB-T. Media player does not decode all formats supported by Havana player2.
* Neutrino MP: Satellite receiver user software. New version with DVB-T shold be tested. Fast start-up and operation. Good and simple media player.
* XBMC: Media center works but is very very slow and hardly fits into memory. Not for real use.

=Instalation=
To be described

=TODO list=
* Factory and user settings of FBE2, FRC, LDM
* More filter banks for speaker amplifiers
* setting EEPROM handling
* HDMI input handling
* Micom IR remote control input and improve micom handler
* HDMI CEC
* SPIDF output

===Functions NOT planned to be suported===
* Analogue TV
* Analogue video in/out

=Misc=
Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

Open source software for series A7/8/9 SH4

2013-03-11T11:15:41Z

Tom van: added TODO list

Increasing discontent with Samsung software resulted in looking for better alternative.
And open source community offers one.
Belive or not, Samsung TV can run without Samsung's software!
=Disclaimer=
System is very experimental and many components are work in progress.
It is not yet suitable for general public. If you are not experienced in linux, please do not use it.
There is ABSOLUTELY NO WARRANTY

=Components=
System is based on Linux, modified [http://www.stlinux.com/ STLinux] from ST Microelectronics
and [http://duckbox.info/ DuckBox] - collection of open software for satellite box.
TDT used in following text is acronym for Team Duck Box.

===Build toolchain===
Used TDT build system with patches for SAMTV

===Linux kernel===
[ftp://ftp.stlinux.com/pub/stlinux/2.4/updates/SRPMS/stlinux24-host-kernel-source-sh4-2.6.32.59_stm24_0211-211.src.rpm linux kernel] version 2.6.32.59 stm24-211
with TDT patches and SAMTV board setup.
Kernel is configured for nfs boot and root. To speed up boot time, usb disk and flash drivers are NOT compiled in, so this kernel will NOT work with usb root.

===Havana player2===
Open source multimedia player framework from ST Microelectronics.
In original Samsung software is used player version 1 with STAPI. Player 2 has linux native DVB API.
Used TDT patched version 2-191 with aditional patches for SAMTV.

===Native linux DVB-T driver===
Driver for DVB-T frontend S5H1432 was backported from linux 3.6 and substantially reworked.

===Initialization and control of TV hardware===
User mode process for initializing and setting
* FRC (frame rate converter) - I belive FRC9459M chip from Micronas is used
* FBE2 (picture enhancer, commercially called DNIe)
* local dimming control
* NTP3100 speaker amplifiers
Also used for
* SCH (scaler handling) - communication with secondary CPU MTK8226

===Showtime media center===
Nice media center software now being ported to sh4 / Havana player2. See http://www.lonelycoder.com/showtime/

===Other software===
DuckBox project includes following user software

* Enigma 2: Satellite receiver user software. Works and supports DVB-T. Media player does not decode all formats supported by Havana player2.
* Neutrino MP: Satellite receiver user software. New version with DVB-T shold be tested. Fast start-up and operation. Good and simple media player.
* XBMC: Media center works but is very very slow and hardly fits into memory. Not for real use.

=Instalation=
To be described

=TODO list=
* Factory and user settings of FBE2, FRCM, LD
* setting EEPROM handling
* HDMI input handling
* Micom IR remote control input and improve micom handler
* HDMI CEC
* SPIDF output

===Functions NOT planned to be suported===
* Analogue TV
* Analogue video in/out

Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

Open source software for series A7/8/9 SH4

2013-03-10T09:29:40Z

Tom van:

Open source software for series A7/8/9 SH4

2013-03-10T09:28:19Z

Tom van:

Open source software for series A7/8/9 SH4

2013-03-10T09:24:58Z

Tom van: Created page with "Increasing discontent with Samsung software resulted in looking for better alternative. And open source community offers one. Belive or not, Samsung TV can run without Samsung..."

The A Series Wiki

2013-03-10T08:18:32Z

Tom van:

Samsung produced TV sets with two different CPU architectures in 2008:
[[File:a_wiki.png|140px|right]]
=SH4 CPU based models=

*[[Samsung A Series (sh4 CPU) Hacks]] and technical info
*[[Open source software for series A7/8/9 SH4 ]]

== Unbricking ==
*[[Samsung A 6 Series (sh4 CPU) Unbricking]]

=ARM CPU based models=
*[[Samsung A Series (2008 Model) Hacks]]

The A Series Wiki

2013-03-10T08:16:53Z

Tom van:

Samsung produced TV sets with two different CPU architectures in 2008:
[[File:a_wiki.png|140px|right]]
=SH4 CPU based models=

*[[Samsung A Series (sh4 CPU) Hacks]]
*[[Open source software for series A7/8/9 SH4 ]]

== Unbricking ==
*[[Samsung A 6 Series (sh4 CPU) Unbricking]]

=ARM CPU based models=
*[[Samsung A Series (2008 Model) Hacks]]

The A Series Wiki

2013-03-10T08:16:17Z

Tom van: redesingned

Samsung produced TV sets with two different CPU architectures in 2008:
[[File:a_wiki.png|140px|right]]
=SH4 CPU based models=

*[[Samsung A Series (sh4 CPU) Hacks]]
*[[Open source software for series A7/8/9 SH4 ]] is available.

== Unbricking ==
*[[Samsung A 6 Series (sh4 CPU) Unbricking]]

=ARM CPU based models=
*[[Samsung A Series (2008 Model) Hacks]]

The A Series Wiki

2013-03-10T08:06:29Z

Tom van: not actual foreword deleted, added link to open source for A7/8/9

=Welcome to A Series Wiki Page=
[[File:a_wiki.png|140px|right]]

*[[Samsung A Series (2008 Model) Hacks]]
*[[Samsung A Series (sh4 CPU) Hacks]]
*[[Open source software for series A7/8/9 SH4 ]]

== Unbricking ==
*[[Samsung A 6 Series (sh4 CPU) Unbricking]]

==Interested forum topics==

*[http://forum.samygo.tv/viewtopic.php?f=8&t=2021&start=0 libGame.so launcher restored for A/sh4 series]

Samsung A Series (sh4 CPU) Hacks

2013-03-10T08:00:29Z

Tom van: open source for A7/8/9

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

'''Content library launcher'''

See [http://forum.samygo.tv/viewtopic.php?f=8&t=2021&p=17250#p17250 discussion]

[[Open source software for series A7/8/9 SH4 ]]

Experimental system with nfs boot and root. Samsung TV can run without Samsung's software!
Work in progress! Also see [https://forum.samygo.tv/viewtopic.php?f=8&t=5528 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

[[Watchdogs and MICOM on A series(SH4)]]

[[Ex-link in service mode on A series(SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Watchdogs and MICOM on A series(SH4)

2013-02-10T11:34:45Z

Tom van:

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of
"quality" of firmware or it is an anti-hacking measure.

== Micom microcontroller ==
Micom is a microcontroller responsible for receiving commands from an infrared remote control,
switching main power supply on and off, resetting main SH4 CPU and so on.
It also works as a watchdog.

== Micom control from linux command line ==
Use
/mtd_boot/MicomCtrl
or
/lib/modules/MicomCtrl
to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

== Micom control from U-Boot ==
'''umicom.img''' is a standalone U-Boot application for sending commands to Micom. It was tested on LE46A956 with fw T-RBYDEUC 1013.1.
It should work on all models with T-RBYDEUC software a might run also on other SH4 models. Grab latest version and source from [http://download.samygo.tv/A%20Series/ download area].

Export the image from a nfs server or set up a tftp server. Lets suppose we have '''umicom.img''' on a linux host in directory /home/samygo/
sudo exportfs ''ip_of_your_tv'':/home/samygo

At TV U-Boot prompt enter:
nfs 84300000 ''ip_of_your_linux_host'':/home/samygo/umicom.img;bootm

umicom.img is position independent code, so you can change address 84300000 to any suitable place in RAM. Then you have to start umicom by U-Boot command go with load addres + 0x40
nfs 84000000 ''ip_of_your_linux_host'':/home/samygo/umicom.img;go 84000040

Loading umicom.img over nfs:

STi710x> nfs 84300000 192.168.0.1:/home/samygo/umicom.img
Using MAC Address 00:xx:xx:xx:xx:xx
STMAC: SMSC LAN8700 found
File transfer via NFS from server 192.168.0.1; our IP address is 192.168.0.10
Filename '/home/samygo/umicom.img'.
Load address: 0x84300000
Loading: ##############
done
Bytes transferred = 70548 (11394 hex)

umicom.img without parameters switch off Micom watchdogs and reset ''silent'' flag. Power LED starts quickly flashing to indicate that communication works. A short help is printed:

STi710x> bootm
## Booting image at 84300000 ...
Image Name: micom watchdog killer 1.0
Image Type: SH-4 Linux Standalone Program (uncompressed)
Data Size: 70484 Bytes = 68.8 kB
Load Address: 84300040
Entry Point: 84300040
OK
=== www.SamyGO.tv === umicom.img 1.0 === micom watchdog killer ===
http://wiki.samygo.tv/index.php5?title=Watchdogs_and_MICOM_on_A_series(SH4)
micom via AsyncSerialController0, 0xb8030000
baud rate set to 9600 Bd
pll1 config is 0x91d02 (391500 kHz), serial console baud divisor 1234
baud divisor for micom 637
ff ff d0 00 00 00 00 00 d0 ...msg 'Set Sw Pvcc' sent
ff ff e8 01 00 00 00 00 e9 ...msg 'App Init Ok' sent
ff ff 17 00 00 00 00 00 17 ...msg 'Watchdog Disable' sent
ff ff e3 03 00 00 00 00 e6 ...power LED quickly blinking
Use:
go 84300040 e ....enable watchdog
go 84300040 d ....disable watchdog
go 84300040 18 ...switch off the TV
go 84300040 29 ...power cycle reboot
go 84300040 143 ..reset
go 84300040 ram ..presence test of RAM
go 84300040 ovc [ndiv [mdiv [pexp]]] ..overclock ClkGenA PLL1

Example of command, switching TV off

STi710x> go 84300040 18
## Starting application at 0x84300040 ...
ff ff 12 00 00 00 00 00 12 ...msg sent

## Application terminated, rc = 0x1

== Early boot timeout ==
In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208).
exeDSP sends it normally. If you don't want to or can't run exeDSP, use
/mtd_boot/MicomCtrl 208
If this command is not given in time, TV reboots 6 times and after that this watchdog
deactivates itself.

== Boot finished OK timeout ==
Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.
/mtd_boot/MicomCtrl 232 1

== Micom periodic watchdog ==
Periodic WD is disabled in boot time. exeDSP always enables WD during startup and then periodically sends alive message. Timeout is 40 seconds.
Commands:
/mtd_boot/MicomCtrl 22 # watchdog enable
/mtd_boot/MicomCtrl 23 # watchdog disable
/mtd_boot/MicomCtrl 24 # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135 # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

== Linux kernel watchdog ==
Software watchdog with 30 second timeout and /proc/watchdog interface. /proc/watchdog is periodically written from exeDSP internal watchdog thread.

== exeDSP internal watchdog ==
One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV.
Watchdog thread can be disabled writing nonzero to address 0x2091164. If the watchdog thread is disabled, /proc/watchdog is not synced anymore.

== Other Micom commands ==
/mtd_boot/MicomCtrl 18 # power off
/mtd_boot/MicomCtrl 29 # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143 # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on

Getting access to u-boot (SH4)

2013-02-10T11:05:11Z

Tom van: add umicom.img

Follow below steps to get access to the bootloader of your device.
This page is modified copy of '''[[Getting_access_to_uBoot_/_bootloader | Getting access to uBoot]]''' as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware

== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [[Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable | ExLink]]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:xx:xx:xx:xx:xx
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

If you need more time to configure U-Boot environment or to reflash bricked TV, use '''umicom.img''' to disable and enable the watchdog. See [[Watchdogs and MICOM on A series(SH4)]].

Entering U-Boot prompt needs good timing because original setting of parameter bootdelay=0 means that U-Boot does not wait for keyboard.

==U-Boot silent mode==
If Ex-link interface have not been set to "STi" in service menu, U-Boot is in ''silent'' mode.
You can type commands, see line editing. Commands work however any output of them is suppressed completely.
Also help command does not print anything.

If you desperately need access to U-Boot and you cannot make changes in service menu e.g. because the TV does not boot,
reset ''silent'' flag directly in the RAM:
mw 86149a18 3
The address is valid ONLY for the U-Boot version shown above. Running '''umicom.img''' also resets ''silent'' flag. See also [[Samsung A 6 Series (sh4 CPU) Unbricking]]

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

Command ''saveenv'' always hangs in this version of U-Boot, however environment is saved correctly. Make sure that watchdog is enabled before starting ''saveenv''.
See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==U-Boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original U-Boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Watchdogs and MICOM on A series(SH4)

2013-02-10T11:03:04Z

Tom van: add umicom.img

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of
"quality" of firmware or it is an anti-hacking measure.

== Micom microcontroller ==
Micom is a microcontroller responsible for receiving commands from an infrared remote control,
switching main power supply on and off, resetting main SH4 CPU and so on.
It also works as a watchdog.

== Micom control from linux command line ==
Use
/mtd_boot/MicomCtrl
or
/lib/modules/MicomCtrl
to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

== Micom control from U-Boot ==
'''umicom.img''' is a standalone U-Boot application for sending commands to Micom. It was tested on LE46A956 with fw T-RBYDEUC 1013.1.
It should work on all models with T-RBYDEUC software a might run also on other SH4 models. Grab latest version and source from [http://download.samygo.tv/A%20Series/ download area].

Export the image from a nfs server or set up tftp server. Lets suppose we have '''umicom.img''' on a linux host in directory /home/samygo/
sudo exportfs ''ip_of_your_tv'':/home/samygo

At TV U-Boot prompt enter
nfs 84300000 ''ip_of_your_linux_host'':/home/samygo/umicom.img;bootm

umicom.img is position independent code, so you can change address 84300000 to any suitable place in RAM. Then you have to start umicom by U-Boot command go with load addres + 0x40
nfs 84000000 ''ip_of_your_linux_host'':/home/samygo/umicom.img;go 84000040

Loading umicom.img over nfs:

STi710x> nfs 84300000 192.168.0.1:/home/samygo/umicom.img
Using MAC Address 00:xx:xx:xx:xx:xx
STMAC: SMSC LAN8700 found
File transfer via NFS from server 192.168.0.1; our IP address is 192.168.0.10
Filename '/home/samygo/umicom.img'.
Load address: 0x84300000
Loading: ##############
done
Bytes transferred = 70548 (11394 hex)

umicom.img without parameters switch off Micom watchdogs and reset ''silent'' flag. Power LED starts quickly flashing to indicate that communication works. A short help is printed

STi710x> bootm
## Booting image at 84300000 ...
Image Name: micom watchdog killer 1.0
Image Type: SH-4 Linux Standalone Program (uncompressed)
Data Size: 70484 Bytes = 68.8 kB
Load Address: 84300040
Entry Point: 84300040
OK
=== www.SamyGO.tv === umicom.img 1.0 === micom watchdog killer ===
http://wiki.samygo.tv/index.php5?title=Watchdogs_and_MICOM_on_A_series(SH4)
micom via AsyncSerialController0, 0xb8030000
baud rate set to 9600 Bd
pll1 config is 0x91d02 (391500 kHz), serial console baud divisor 1234
baud divisor for micom 637
ff ff d0 00 00 00 00 00 d0 ...msg 'Set Sw Pvcc' sent
ff ff e8 01 00 00 00 00 e9 ...msg 'App Init Ok' sent
ff ff 17 00 00 00 00 00 17 ...msg 'Watchdog Disable' sent
ff ff e3 03 00 00 00 00 e6 ...power LED quickly blinking
Use:
go 84300040 e ....enable watchdog
go 84300040 d ....disable watchdog
go 84300040 18 ...switch off the TV
go 84300040 29 ...power cycle reboot
go 84300040 143 ..reset
go 84300040 ram ..presence test of RAM
go 84300040 ovc [ndiv [mdiv [pexp]]] ..overclock ClkGenA PLL1

Example of command, switching TV off

STi710x> go 84300040 18
## Starting application at 0x84300040 ...
ff ff 12 00 00 00 00 00 12 ...msg sent

## Application terminated, rc = 0x1

== Early boot timeout ==
In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208).
exeDSP sends it normally. If you don't want to or can't run exeDSP, use
/mtd_boot/MicomCtrl 208
If this command is not given in time, TV reboots 6 times and after that this watchdog
deactivates itself.

== Boot finished OK timeout ==
Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.
/mtd_boot/MicomCtrl 232 1

== Micom periodic watchdog ==
Periodic WD is disabled in boot time. exeDSP always enables WD during startup and then periodically sends alive message. Timeout is 40 seconds.
Commands:
/mtd_boot/MicomCtrl 22 # watchdog enable
/mtd_boot/MicomCtrl 23 # watchdog disable
/mtd_boot/MicomCtrl 24 # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135 # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

== Linux kernel watchdog ==
Software watchdog with 30 second timeout and /proc/watchdog interface. /proc/watchdog is periodically written from exeDSP internal watchdog thread.

== exeDSP internal watchdog ==
One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV.
Watchdog thread can be disabled writing nonzero to address 0x2091164. If the watchdog thread is disabled, /proc/watchdog is not synced anymore.

== Other Micom commands ==
/mtd_boot/MicomCtrl 18 # power off
/mtd_boot/MicomCtrl 29 # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143 # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on

Getting access to u-boot (SH4)

2013-01-07T19:41:12Z

Tom van:

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to U-Boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware

== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.
See [[Watchdogs and MICOM on A series(SH4)]].

Entering U-Boot prompt needs good timing because original setting of parameter bootdelay=0 means that U-Boot does not wait for keyboard.

==U-Boot silent mode==
If Ex-link interface have not been set to "STi" in service menu, U-Boot is in ''silent'' mode.
You can type commands, see line editing. Commands work however any output of them is suppressed completely.
Also help command does not print anything.

If you desperately need access to U-Boot and you cannot make changes in service menu e.g. because the TV does not boot,
reset ''silent'' flag directly in the RAM:
mw 86149a18 3
The address is valid ONLY for the U-Boot version shown above. See also [[Samsung A 6 Series (sh4 CPU) Unbricking]]

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==U-Boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original U-Boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Getting access to u-boot (SH4)

2013-01-07T18:26:06Z

Tom van: silent mode, subst/u-boot/U-Boot/

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to U-Boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.
See [[Watchdogs and MICOM on A series(SH4)]].

Entering U-Boot prompt needs good timing because original setting of parameter bootdelay=0 means that U-Boot does not wait for keyboard.

==U-Boot silent mode==
If Ex-link interface have not been set to "STi" in service menu, U-Boot is in ''silent'' mode.
You can type commands, see line editing. Commands work however any output of them is suppressed completely.
Also help command does not print anything.

If you desperately need access to U-Boot and you cannot make changes in service menu e.g. because the TV does not boot,
reset ''silent'' flag directly in the RAM:
mw 86149a18 3
The address is valid ONLY for the U-Boot version shown above.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==U-Boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original U-Boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Compatibility

2012-11-11T22:16:55Z

Tom van: T-RBYDEUC: arfix-sh version updated to 1.2 (couple years late...)

== Tested Matrix ==

These TV models and related versions have been explicitly tested. Here you can find only '''A''' and '''B series''' TV.

If your TV is newer check other pages with compatibility tables:
* [[Compatibility Table for C series TVs|'''C Series''' (2010)]]
* [[Compatibility Table for D series TVs|'''D Series''' (2011)]]

<center>

<div id='TableOfCompatibility'>

'''WARNING: DO NOT APPLY THE LATEST FIRMWARE UPGRADES or you can't use some of our tools easily!'''

{|class="wikitable"
|+SamyGO Table Of Compatibility for Samsung B Series TV's (and older)
!width="100"|Name of Device
!width="100"|Firmware
!width="60"|Version
!width="90"|Telnet
!width="80"|Aspect Ratio Video Fix
!width="30"|Big & Color Subtitles
!width="20"|NFS
!width="20"|SAMBA
!width="20"|UPNP
!width="330"|Notes
|-align="center"
|rowspan="2"|'''LExxB55x LExxB57x PSxxB55x PSxxB56x LExxB62x UExxB6xxx'''||T-CHL5DEUC||2008.0||bgcolor="#cfff90"|<del>N/A</del> Enable*||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#cfff90"|<del>N/A</del> Enable*||align="left"|Play movie from USB supported (WiseLink hack). <del>Telnet N/A because of Kernel not support Network.</del><br\>* Telnet, Samba/NFS requires USB WiFi/Eth dongle, custom linux kernel from SamyGO OpenEmbedded and rewrite uboot partition with correct one. Also some other hand works too.
|-align="center"
|T-CHL5CIPDEUC||2007.0||bgcolor="#cfff90"|<del>N/A</del> Enable*||bgcolor="#ff9090"|<del>N/A</del>?||bgcolor="#cfff90"|<del>N/A</del> Probably (?)||colspan='3' bgcolor="#ff9090"|Not Yet||align="left"|<strike>We cannot get linux shell access on this type of Firmware.</strike>We have just enable ExLink console on this device too via Top Debug Menu memory editing.
|-align="center"
|rowspan="3"|'''LExxB65x LExxB75x PSxxB65x'''||rowspan="2"|T-CHL7DEUC||2004.1||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v2||bgcolor="#90ff90"|Yes||colspan='3' rowspan='2' bgcolor="#90ff90"|Yes
|-align="center"
||2005.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes
|-align="center"
|T-CHLCIPDEUC||2006.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|'''LExxB679'''||T-CHL6CIPDSEUC||1008.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|rowspan="5"|'''UExxB7xxx UExxB8xxx PSxxB85x'''||rowspan="4"|T-CHU7DEUC||2004.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' rowspan='4' bgcolor="#90ff90"|Yes
|-align="center"
|2008.2||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes
|-align="center"
|2009.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes
|-align="center"
|3000.G||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes
|-align="center"
|T-CHUCIPDEUC||3000.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes||
|-align="center"
|'''LNxxB64x'''||T-CHEAUSC||1013.0 1014.0||bgcolor="#cfff90"|Enable*||bgcolor="#ffff90"|Need Tester||bgcolor="#ffff90"|Need Tester||colspan='3' bgcolor="#cfff90"|Partial**||align="left"|I have successfully modified (by hand) the firmware update currently available on Samsung's site. It still allows exlink console. * Telnet was enabled by manually modifying the firmware image (see my walkthrough: [[LN40B640_Walkthrough]][in progress]) ** NFS support is built-in to the firmware, the cifs kernel module causes a panic (I will try compiling my own later) and I don't like UPnP so I didn't even try it out :)
|-align="center"
|LNxxB65x P'''NxxB65x LNxxB75x'''||T-CHEAUSC||1012.3||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|rowspan="2"|'''LNxxB63x UNxxB6xxx'''||T-CHE6AUSC||1012.0||bgcolor="#ffff90"|Need Tester||bgcolor="#90ff90"|Yes||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#ffff90"|Need Tester||align="left"|Play movie from USB supported (WiseLink hack). No telnet access (yet).
|-align="center"
|T-CHE5IBRC||1009.1||bgcolor="#ffff90"|Need Tester||bgcolor="#90ff90"|Yes||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#ffff90"|Need Tester||align="left"|No Wiselink hack by Firmware Patcher.
|-align="center"
|'''UNxxB7xxx UNxxB8xxx'''||T-CHE7AUSC||1013.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|rowspan="2"|'''LAxxB65x PSxxB65x LAxxB75x'''||T-CHL7DAUC||2001.1||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|T-CHEAEAC||2005.0||bgcolor="#ffff90"|Work in Progress||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|'''UAxxB6xxx'''||T-CHL5DAUC||2001.1||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|'''UAxxB7xxx UAxxB8xxx'''||T-CHU7DAUC||1008.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|'''PSxxB85x'''||T-CHU7DAUC||1007.0||bgcolor="#90ff90"|Enable||bgcolor="#90ff90"|v1||bgcolor="#90ff90"|Yes||colspan='3' bgcolor="#90ff90"|Yes
|-align="center"
|'''LExxA75x LExxA85x LExxA95x'''||T-RBYDEUC||1013.1||bgcolor="#cfff90"|Enable*||bgcolor="#90ff90"|arfix-sh 1.2||bgcolor="#ff9090"|N/A||colspan='3' bgcolor="#90ff90"|Yes||align="left"|Telnet needs telnetd/BusyBox injection.
|-align="center"
|'''LNxxA75x LNxxA76x'''||T-RBYAUSC||1012.2||bgcolor="#cfff90"|Enable*||bgcolor="#ff9090"|N/A||bgcolor="#ff9090"|N/A||colspan='3' bgcolor="#ffff90"|No Samba/UPNP||align="left"|Telnet needs manual firmware patching or Telnetd Application.
|-align="center"
|'''LNxxA85x LNxxA86x'''||T-SPHAUSC||1004.0||bgcolor="#cfff90"|Enable*||bgcolor="#ff9090"|N/A||bgcolor="#ff9090"|N/A||colspan='3' bgcolor="#ffff90"|Need Tester||align="left"|Telnet needs manual firmware patching or Telnetd Application.
|-align="center"
|'''LExxA676'''||T-AMBDFRC||1017.0||bgcolor="#ffff90"|Need Tester||bgcolor="#ff9090"|N/A||bgcolor="#ff9090"|N/A||colspan='3' bgcolor="#ffff90"|Need Tester
|}
</div>

</center>

== Compatibility Overview ==

The Samsung TV model can be broken down like so:

<TYPE><REGION><SIZE><YEAR><SERIES><VARIANT>[misc details]

{|class="wikitable"
|-
|align="right"|Type:
|'''L''' = LCD '''P''' = Plasma '''U''' = LED
|-
|align="right"|Region:
|'''A''' = Australia '''E''' = Europe '''N''' = North America
|-
|align="right"|Year:
|'''A''' = 2008 '''B''' = 2009 etc...
|}

An example, the ''UN55B8500'' is an 8 series (500 variant) 55" LED TV in North America from 2009.

So typically, the firmware modifications here should work on TVs of the same type, year, and series.

== References ==

[[File:Samsung_Models.jpg]]

Samsung A Series (sh4 CPU) Hacks

2011-07-11T10:12:09Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

'''Content library launcher'''

Work in progress, see [http://forum.samygo.tv/viewtopic.php?f=8&t=2021&p=17250#p17250 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

[[Watchdogs and MICOM on A series(SH4)]]

[[Ex-link in service mode on A series(SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Ex-link in service mode on A series(SH4)

2011-06-26T09:14:02Z

Tom van:

See [[Getting access to u-boot (SH4)]] how to connect a '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]. Provided that you have working Ex-link connection you can enter following commands (based on T-RBYDEUC firmware)

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]
Very complex menu tree follows. You can do lot of things there, especially screw up your TV completely.

BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

==Other Debug commands==
I doubt about usefulness of following commands:

^ [ Enter ]
CPU reset (TV screen is shifted because GPU is not properly initialized) - same as micom 143.

keydebug [ Enter ]
keyrec [ Enter ]
keyexit [ Enter ]
Repeats periodically sequence of simulated key presses.

==Simulated remote control==
Enter one character code followed by [ Enter ] to simulate a remote control key press.
{| border="1"
! Character entered to Ex-link
! RC command code (hex)
! Command
|-
| 1 2 3 4 5 6 7 8 9 0 || 4 5 6 8 9 0xa 0xc 0xd 0xe 0x11 || numeric keys
|-
| space
|rowspan="3"| 0x3b ||rowspan="3"| Factory (not available on standard RC)
|-
| `
|-
| s
|-
| ! || 0x65 || left
|-
| # || 0x61 || down
|-
| $ || 0x62 || right
|-
| . || 0x19 ||
|-
| < || 0x20 ||
|-
| @ || 0x60 || up
|-
| D || 0x43 || ?? shows channel number
|-
| N || 0x32 || ?? not avail
|-
| Z || 0x0f || mute
|-
| d || 0x10 || prog-
|-
| e || 0x68 || enter
|-
| f || 0x44 || favorite channel?
|-
| g || 0x4f || guide
|-
| i || 0x1f || info
|-
| l || 0x0b || vol-
|-
| m || 0x1a || menu
|-
| n || 0x33 || ?? not available
|-
| p || 0x13 || prev-ch
|-
| r || 0x07 || vol+
|-
| u || 0x12 || prog+
|-
| v || 0x01 || source
|-
| x || 0x2d || exit
|-
| z || 0x25 || subt
|}

Getting access to u-boot (SH4)

2011-06-26T09:09:20Z

Tom van:

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.
See [[Watchdogs and MICOM on A series(SH4)]].

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Ex-link in service mode on A series(SH4)

2011-06-26T09:08:19Z

Tom van: Created page with 'See Getting access to u-boot (SH4) how to connect a '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devâ¦'

See [[Getting access to u-boot (SH4)]] how to connect a '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]. Provided that you have working Ex-link connection you can enter following commands (based on T-RBYDEUC firmware)

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]
Very complex menu tree follows. You can do lot of things there, especially screw up your TV completely.

BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

==Other Debug commands==
I doubt about usefulness of following commands:

^ [ Enter ]
CPU reset (TV screen is shifted because GPU is not properly initialized) - same as micom 143.

keydebug [ Enter ]
keyrec [ Enter ]
keyexit [ Enter ]
Repeats periodically sequence of simulated key presses.

==Simulated remote control==
Enter one character code followed by [ Enter ] to simulate a remote control key press.
{| border="1"
! Character entered to Ex-link
! RC command code (hex)
! Command
|-
| space
|rowspan="3"| 0x3b ||rowspan="3"| Factory (not available on standard RC)
|-
| `
|-
| s
|-
| ! || 0x65 || left
|-
| # || 0x61 || down
|-
| $ || 0x62 || right
|-
| . || 0x19 ||
|-
| < || 0x20 ||
|-
| @ || 0x60 || up
|-
| D || 0x43 || ?? shows channel number
|-
| N || 0x32 || ?? not avail
|-
| Z || 0x0f || mute
|-
| d || 0x10 || prog-
|-
| e || 0x68 || enter
|-
| f || 0x44 || favorite channel?
|-
| g || 0x4f || guide
|-
| i || 0x1f || info
|-
| l || 0x0b || vol-
|-
| m || 0x1a || menu
|-
| n || 0x33 || ?? not available
|-
| p || 0x13 || prev-ch
|-
| r || 0x07 || vol+
|-
| u || 0x12 || prog+
|-
| v || 0x01 || source
|-
| x || 0x2d || exit
|-
| z || 0x25 || subt
|}

Samsung A Series (sh4 CPU) Hacks

2011-06-26T08:24:32Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

[[Watchdogs and MICOM on A series(SH4)]]

[[Ex-link in service mode on A series(SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Samsung A Series (sh4 CPU) Hacks

2011-06-26T08:13:22Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

[[Watchdogs and MICOM on A series(SH4)]]

[[Debug menu and simulated RC from Ex-link on A series(SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Watchdogs and MICOM on A series(SH4)

2011-05-11T12:40:25Z

Tom van:

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of
"quality" of firmware or it is an anti-hacking measure.

Micom is a microcontroller responsible for receiving commands from RC,
switching main power supply on and off, resetting main SH4 CPU and so on.
It also works as a watchdog.
Use
/mtd_boot/MicomCtrl
or
/lib/modules/MicomCtrl
to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

== Early boot timeout ==
In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208).
exeDSP sends it normally. If you don't want to or can't run exeDSP, use
/mtd_boot/MicomCtrl 208
If this command is not given in time, TV reboots 6 times and after that this watchdog
deactivates itself.

== Boot finished OK timeout ==
Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.
/mtd_boot/MicomCtrl 232 1

== Micom periodic watchdog ==
Periodic WD is disabled in boot time. exeDSP always enables WD during startup and then periodically sends alive message. Timeout is 40 seconds.
Commands:
/mtd_boot/MicomCtrl 22 # watchdog enable
/mtd_boot/MicomCtrl 23 # watchdog disable
/mtd_boot/MicomCtrl 24 # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135 # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

== Linux kernel watchdog ==
Software watchdog with 30 second timeout and /proc/watchdog interface. /proc/watchdog is periodically written from exeDSP internal watchdog thread.

== exeDSP internal watchdog ==
One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV.
Watchdog thread can be disabled writing nonzero to address 0x2091164. If the watchdog thread is disabled, /proc/watchdog is not synced anymore.

== Other Micom commands ==
/mtd_boot/MicomCtrl 18 # power off
/mtd_boot/MicomCtrl 29 # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143 # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on

Getting access to u-boot (SH4)

2011-05-01T11:33:11Z

Tom van:

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.
See [[Watchdogs and MICOM on A series(SH4)]].

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Watchdogs and MICOM on A series(SH4)

2011-05-01T11:32:01Z

Tom van: /* Micom periodic watchdog */

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of
"quality" of firmware or it is an anti-hacking measure.

Micom is a microcontroller responsible for receiving commands from RC,
switching main power supply on and off, resetting main SH4 CPU and so on.
It also works as a watchdog.
Use
/mtd_boot/MicomCtrl
or
/lib/modules/MicomCtrl
to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

== Early boot timeout ==
In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208).
exeDSP sends it normally. If you don't want to or can't run exeDSP, use
/mtd_boot/MicomCtrl 208
If this command is not given in time, TV reboots 6 times and after that this watchdog
deactivates itself.

== Boot finished OK timeout ==
Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.
/mtd_boot/MicomCtrl 232 1

== Micom periodic watchdog ==
Periodic WD is disabled in boot time. exeDSP always enables WD during startup and then periodically sends alive message. Timeout is 40 seconds.
Commands:
/mtd_boot/MicomCtrl 22 # watchdog enable
/mtd_boot/MicomCtrl 23 # watchdog disable
/mtd_boot/MicomCtrl 24 # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135 # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

== Linux kernel watchdog ==
Software watchdog with 30 second timeout and /proc/watchdog interface.
Probably only this one can be switched off in service menu.

== exeDSP internal watchdog ==
One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV.
Watchdog thread can be disabled writing nonzero to address 0x2091164.

== Other Micom commands ==
/mtd_boot/MicomCtrl 18 # power off
/mtd_boot/MicomCtrl 29 # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143 # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on

Watchdogs and MICOM on A series(SH4)

2011-05-01T11:30:50Z

Tom van: Created page with 'There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of "quality" of firmware or it is an anti-hacking measure. Micom is a microcontroller respâ¦'

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of
"quality" of firmware or it is an anti-hacking measure.

Micom is a microcontroller responsible for receiving commands from RC,
switching main power supply on and off, resetting main SH4 CPU and so on.
It also works as a watchdog.
Use
/mtd_boot/MicomCtrl
or
/lib/modules/MicomCtrl
to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

== Early boot timeout ==
In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208).
exeDSP sends it normally. If you don't want to or can't run exeDSP, use
/mtd_boot/MicomCtrl 208
If this command is not given in time, TV reboots 6 times and after that this watchdog
deactivates itself.

== Boot finished OK timeout ==
Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.
/mtd_boot/MicomCtrl 232 1

== Micom periodic watchdog ==
Periodic WD if disabled in boot time. exeDSP always enables it during startup and then periodically sends alive message. Timeout is 40 seconds.
Commands:
/mtd_boot/MicomCtrl 22 # watchdog enable
/mtd_boot/MicomCtrl 23 # watchdog disable
/mtd_boot/MicomCtrl 24 # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135 # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

== Linux kernel watchdog ==
Software watchdog with 30 second timeout and /proc/watchdog interface.
Probably only this one can be switched off in service menu.

== exeDSP internal watchdog ==
One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV.
Watchdog thread can be disabled writing nonzero to address 0x2091164.

== Other Micom commands ==
/mtd_boot/MicomCtrl 18 # power off
/mtd_boot/MicomCtrl 29 # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143 # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on

Samsung A Series (sh4 CPU) Hacks

2011-05-01T09:07:53Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

[[Watchdogs and MICOM on A series(SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Getting access to u-boot (SH4)

2011-03-31T10:52:15Z

Tom van: /* Changes to environment */

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Getting access to u-boot (SH4)

2011-03-31T10:50:39Z

Tom van:

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch it. Paste from clipboard command:
setenv bootdelay 1
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Getting access to u-boot (SH4)

2011-03-31T10:49:27Z

Tom van:

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch it. Paste from clipboard command:
setenv bootdelay 60
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [[http://forum.samygo.tv/viewtopic.php?f=8&t=49 discussion]]

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Getting access to u-boot (SH4)

2011-03-31T10:45:33Z

Tom van: Created page with 'Follow below steps to get access to the bootloader of your device. This page is modified copy of Getting access to u-boot as there are some important differences for A seriesâ¦'

Follow below steps to get access to the bootloader of your device.
This page is modified copy of [[Getting access to u-boot]] as there are some important differences for A series models with SH4.
Tested on T-RBYDEUC firmware
== Prior to boot-process ==
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
* Switch off the TV
* Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
* Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
* Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | '''STi''' | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.

2. Make or buy '''Service Cable''' - [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices#The_Ex-Link_.28serial.29_cable ExLink]

== Terminal Connection Parameters ==
*Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: '''115200'''
Data bits: '''8'''
Parity: '''none'''
Stop bits: '''1'''
Flow Control: '''none'''

== During the boot-process ==
* TV is just switched on or rebooting
* Press and hold space
* If you're lucky, you'll see prompt
Enter MBL..[0001]
_ShadowOS.

Board: STb7109

*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM: 128 MB
In: serial
Out: serial
Err: serial
Net: Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot: 0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off on this model, you have only 14 seconds
until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

==Changes to environment==
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch it. Paste from clipboard command:
setenv bootdelay 60
saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter.
You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

==Debug Menu==
Let serial line calm down from huge boot messages and type
debug [ Enter ]

==u-boot commands==
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
fnw - FlexoneNand Writer
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
==Original u-boot environment==
bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Samsung A Series (sh4 CPU) Hacks

2011-03-31T09:09:04Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

[[Getting access to u-boot (SH4)]]

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Samsung A Series (sh4 CPU) Hacks

2011-03-30T11:41:17Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Samsung A Series (sh4 CPU) Hacks

2011-03-30T11:39:42Z

Tom van: /* T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959) */

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Video AR Fix

2011-03-30T11:22:37Z

Tom van: link to Video player aspect ratio fix (SH4)

'''Problem:''' Original samsung medi@2.0 player cannot fit movies or adjust aspect resolution of movie. It has only "Orginal and Fit" options.
*Original mode: Movies are shown at their original resolution that leads SD movies are too small at screen.
*Fit mode: Movies are shown as fitted to screen without changing aspect resolution that leads black bars appears at both side of screen if you playing 4:3 video.

'''Answer: Video Aspect Resolution Fix'''

When movies playing from medi@2.0 player from USB or LAN via DLNA,NFS,SAMBA,UPNP normally Samsung program ,exeDSP, that plays the content but don't allow us to stretch the Video to TV size.
SamyGO hacker, newagehun, implements the video aspect resolution fix.

*'''Version 1 :''' This fix will stretch the movie to TV size and discard the aspect resolution of source. You cannot use "original and fit" options from menu. Movie will stretch to TV size every time.
Version 1 requires change of 5 byte from exeDSP, from different locations. At SamyGO Firmware Patcher, there is a code to extract exeDSP from image and investigate the symbol table of exeDSP than those changes applied automatically to various different exeDSPs within same code.

*'''Version 2 :''' This fix implements various view modes. Addition to Original and Fit mode;
**Full Screen
**4:3
**Non Anamorph
**16:9
**Anamorph
**1.85:1
**2.35:1
**2.37:1
**2.39:1
**2.76:1
Unfortunately, Version 2 of this fix requires injecting code to exeDSP. Because of needing new area for this injected code, we overwrite some foreign languages area. Due this it's little harder than v1 fix and thus not implemented by SamyGO Firmware Patcher yet.

'''For CI+ devices'''

You can use VideoAR Fix at CI+ devices if only your TV have content library / Game menu. We have v1 for CI+ device firmwares but if you wanted to have v2, you can use mprotect's "AVRFix" for some firmware versions.

'''For 'A' series devices with SH4 CPU'''

You need arfix-sh. See [[Video player aspect ratio fix (SH4)]]

Samsung A Series (sh4 CPU) Hacks

2011-03-30T11:15:32Z

Tom van: /* Available hacks / software */

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for linux command line access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Video player aspect ratio fix (SH4)

2011-03-30T11:10:39Z

Tom van:

WiseLink player is a component of television firmware. It can be used for browsing and playback of digital media from USB disk or network server. It is related neither to DVB-T television show nor HDMI playback.

On 'A' series models with [http://wiki.samygo.tv/index.php?title=Samsung_A_Series_(sh4_CPU)_Hacks#T-RBYDEUC_.28Models_LExxA756.2C_LExxA856.2C_LExxA956.2F959.29 T-RBYDEUC] firmware (LE40A756, LE46A756, LE46A856, LE52A856, LE46A956 and LE55A956)
WiseLink player has no interface to set desired aspect ratio for playback (although aspect ratio can be set in other modes).
DAR (display aspect ratio) information from headers in video file is not honored at all.
Moreover an evident bug prevents scaling of some type of video files in some circumstances.
Samsung unfortunately refused complaints and left the problems without fixing.

'''arfix-sh''' is a patch fixing some problems with aspect ratio in WiseLink playback.
It is a binary patch, available only for firmware T-RBYDEU1013 (T-RBYDEUC-1013.1)

== What arfix-sh does? ==

WiseLink video player has 3 new items for fixed aspect ratios in Tools menu:
4:3, 16:9 (also use as fullscreen), 2.21:1

New in version 1.1: For MPEG2 source aspect ratio flag in sequence header (01b3)
is taken into account in auto fit mode.
Otherwise if PAL resolution (720x576) is detected in Auto fit mode, aspect ratio 4:3
is used.

New in version 1.2: Fixed an error in original WiseLink code, which prevented scaling of some video
formats (e.g. H264 in MPEG TS container).

== Applying permanently to television firmware ==

Use [[SamyGO Firmware Patcher]]
Version 0.26 integrates arfix-sh 1.2

Run patcher to modify original T-RBYDEUC-1013.1 firmware and flash standard way.

Older version of SamyGO Firmware Patcher from version 0.21 integrated arfix-sh 1.1

== Dynamic in-memory patching ==

If you have access to linux console in your tv, download [http://download.samygo.tv/A%20Series/SamyGO-T-RBYDEUC-1013.1-arfix_1.2.zip arfix-sh 1.2], unpack zip content to an USB flash or to a network share and insert/mount
it to TV. Change to patch directory and run arfix.sh

# cd /dtv/usb/sdb1/T-RBYDEUC-1013.1-arfix_1.2/
# ls -l
-rw-r--r-- 1 root 0 2673 Mar 27 2011 README
-rw-r--r-- 1 root 0 2960 Mar 27 2011 T-RBYDEUC-1013.1-arfix_1.2.elfpatch
-rwxr-xr-x 1 root 0 80 Mar 27 2011 arfix.sh
-rwxr-xr-x 1 root 0 55864 Mar 27 2011 elfpatcher
# ./arfix.sh
Reading patches from file T-RBYDEUC-1013.1-arfix_1.2.elfpatch
Checking .checkVersion 16 bytes at 0x1508978
Writing .patch1 932 bytes at 0x056f43c
Writing .patch4 12 bytes at 0x073d334
Writing .patch7 4 bytes at 0x0740320
Writing .patch6 4 bytes at 0x0740470
Writing .patch5 4 bytes at 0x0b04e8c
Writing .patch2 108 bytes at 0x0d16520
Writing .patch3 180 bytes at 0x0d167a0
#

Changes will be lost after exeDSP restart (TV off/on).

A more comfortable alternative is [[SamyGO Extensions Pack]].

Download and install [http://download.samygo.tv/A%20Series/SamyGO-All-Extensions-v0.03.6-r12-for-T-RBYDEUC-201103282318.zip SamyGO-All-Extensions-v0.03.6-r12-for-T-RBYDEUC-201103282318]

This version contains arfix-sh 1.2 and run it at the boot time.

See also [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion].
Source code of arfix-sh is available in [http://samygo.svn.sourceforge.net/viewvc/samygo/oe/branches/branch-0-0-1/oe/packages/arfix-sh/ svn]

Video player aspect ratio fix (SH4)

2011-03-30T11:09:02Z

Tom van: /* Applying permanently to television firmware */

Video player aspect ratio fix (SH4)

2011-03-30T11:08:01Z

Tom van: Created page with 'WiseLink player is a component of television firmware. It can be used for browsing and playback of digital media from USB disk or network server. It is related neither to DVB-T tâ¦'

WiseLink player is a component of television firmware. It can be used for browsing and playback of digital media from USB disk or network server. It is related neither to DVB-T television show nor HDMI playback.

On 'A' series models with [http://wiki.samygo.tv/index.php?title=Samsung_A_Series_(sh4_CPU)_Hacks#T-RBYDEUC_.28Models_LExxA756.2C_LExxA856.2C_LExxA956.2F959.29 T-RBYDEUC] firmware (LE40A756, LE46A756, LE46A856, LE52A856, LE46A956 and LE55A956)
WiseLink player has no interface to set desired aspect ratio for playback (although aspect ratio can be set in other modes).
DAR (display aspect ratio) information from headers in video file is not honored at all.
Moreover an evident bug prevents scaling of some type of video files in some circumstances.
Samsung unfortunately refused complaints and left the problems without fixing.

'''arfix-sh''' is a patch fixing some problems with aspect ratio in WiseLink playback.
It is a binary patch, available only for firmware T-RBYDEU1013 (T-RBYDEUC-1013.1)

== What arfix-sh does? ==

WiseLink video player has 3 new items for fixed aspect ratios in Tools menu:
4:3, 16:9 (also use as fullscreen), 2.21:1

New in version 1.1: For MPEG2 source aspect ratio flag in sequence header (01b3)
is taken into account in auto fit mode.
Otherwise if PAL resolution (720x576) is detected in Auto fit mode, aspect ratio 4:3
is used.

New in version 1.2: Fixed an error in original WiseLink code, which prevented scaling of some video
formats (e.g. H264 in MPEG TS container).

== Applying permanently to television firmware ==

Use [[SamyGO Firmware Patcher]]
Version 0.26 integrates arfix-sh 1.2

Run patcher to modify original T-RBYDEUC-1013.1 firmware and flash standard way.

Older version of SamyGO Firmware Patcher from version 0.21 on integrated arfix-sh 1.1

== Dynamic in-memory patching ==

If you have access to linux console in your tv, download [http://download.samygo.tv/A%20Series/SamyGO-T-RBYDEUC-1013.1-arfix_1.2.zip arfix-sh 1.2], unpack zip content to an USB flash or to a network share and insert/mount
it to TV. Change to patch directory and run arfix.sh

# cd /dtv/usb/sdb1/T-RBYDEUC-1013.1-arfix_1.2/
# ls -l
-rw-r--r-- 1 root 0 2673 Mar 27 2011 README
-rw-r--r-- 1 root 0 2960 Mar 27 2011 T-RBYDEUC-1013.1-arfix_1.2.elfpatch
-rwxr-xr-x 1 root 0 80 Mar 27 2011 arfix.sh
-rwxr-xr-x 1 root 0 55864 Mar 27 2011 elfpatcher
# ./arfix.sh
Reading patches from file T-RBYDEUC-1013.1-arfix_1.2.elfpatch
Checking .checkVersion 16 bytes at 0x1508978
Writing .patch1 932 bytes at 0x056f43c
Writing .patch4 12 bytes at 0x073d334
Writing .patch7 4 bytes at 0x0740320
Writing .patch6 4 bytes at 0x0740470
Writing .patch5 4 bytes at 0x0b04e8c
Writing .patch2 108 bytes at 0x0d16520
Writing .patch3 180 bytes at 0x0d167a0
#

Changes will be lost after exeDSP restart (TV off/on).

A more comfortable alternative is [[SamyGO Extensions Pack]].

Download and install [http://download.samygo.tv/A%20Series/SamyGO-All-Extensions-v0.03.6-r12-for-T-RBYDEUC-201103282318.zip SamyGO-All-Extensions-v0.03.6-r12-for-T-RBYDEUC-201103282318]

This version contains arfix-sh 1.2 and run it at the boot time.

See also [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion].
Source code of arfix-sh is available in [http://samygo.svn.sourceforge.net/viewvc/samygo/oe/branches/branch-0-0-1/oe/packages/arfix-sh/ svn]

Samsung A Series (sh4 CPU) Hacks

2011-03-30T10:55:52Z

Tom van:

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for console access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]

Samsung A Series (sh4 CPU) Hacks

2011-03-30T10:00:19Z

Tom van: /* T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959) */

==T-AMBDFRC (Models LExxA676)==

A SH4 CPU model - please add details.

==T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)==

==='''Available hacks / software'''===

Look for latest versions in [http://download.samygo.tv/A%20Series/ download area]

[[SamyGO Firmware Patcher]]
* WiseLink video player aspect ratio fix (arfix-sh) is applied
* optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase '''U''') - e.g. for Extension Pack

[[SamyGO Extensions Pack]]

A collection of command line linux applications. Unpack files to USB disk and insert to tv set.
A firmware patch or [http://wiki.samygo.tv/index.php?title=Enable_Serial_Console_on_non_CI%2B_Devices serial console] is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
* SSH daemon for console access ( user: root, password: SamyGO )
* kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
* lot lot more... see [http://forum.samygo.tv/viewtopic.php?f=8&t=1313 discussion]

[[Video player aspect ratio fix (SH4)]]

arfix-sh fixes part of internal firmware, WiseLink video player.
Also see [http://forum.samygo.tv/viewtopic.php?f=5&t=384 discussion]

==='''T-RBYDEUC technical info'''===

The main CPU of these models is NOT an ARM processor but the '''SH4 processor''' [http://www.st.com/stonline/products/literature/bd/11660/sti7109.pdf STi7109]. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:
* exeDSP has all symbols stripped
* libGame.so loading and running is completely blocked in exeDSP
* First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
* busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

==Manual firmware patching T-RBYDEUC==

'''Obsoleted by SamyGO Firmware Patcher and Extension Pack.'''

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon.
You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856
[http://forum.samygo.tv/viewtopic.php?f=2&t=49]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor.
There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

#! /bin/sh

echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"

#sleep 25 (m)sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh

echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko

sleep 4

echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp

mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here:
[http://forum.samygo.tv/download/file.php?id=62]