Hash partition structure - Revision history

Hedak: Added c series hash data infos, moved b series references to b series section and added empty f series section

2014-03-04T21:49:31Z

Added c series hash data infos, moved b series references to b series section and added empty f series section

Juzis28 at 13:07, 6 January 2013

2013-01-06T13:07:29Z

Juzis28: /* Hashes on /dev/bml0/3 */

2013-01-06T12:33:15Z

‎Hashes on /dev/bml0/3

Juzis28 at 12:29, 6 January 2013

2013-01-06T12:29:59Z

Juzis28: /* exe.img and appdata.img */

2013-01-06T12:17:15Z

‎exe.img and appdata.img

Juzis28: /* exe.img and appdata.img */

2013-01-06T12:17:01Z

‎exe.img and appdata.img

Juzis28: /* exe.img and appdata.img */

2013-01-06T12:14:37Z

‎exe.img and appdata.img

Juzis28: /* Authuld */

2013-01-06T12:02:22Z

‎Authuld

Juzis28: /* B series CI+ TV`s */

2013-01-06T11:59:55Z

‎B series CI+ TV`s

Juzis28: /* kernel, fnw, u-boot */

2013-01-06T11:43:52Z

‎kernel, fnw, u-boot

@@ Line 107: / Line 107: @@
   00100000
 If anyone has some ideas, what is needed for, please share with us [http://forum.samygo.tv/viewtopic.php?f=2&t=655 on forum]. Thanks!
 =C series TV`s=
 =D series TV`s=
 =E series TV`s=
 =BluRay players=
-=References=
+ToDo
 Work in progress, to be updated.

@@ Line 37: / Line 37: @@
 Where: hash of kernel comes first and it is:
 7a 0e f7 6f f0 e4 9f  79 1b c5 74 54 10 2e d9
-Image lengh (hex)is: {{green|e0 3c 2f 00}}, which has to be read {{red|backwards}}. So the real length is:
+Image lengh (hexadecimal)is: {{green|e0 3c 2f 00}}, which has to be read {{red|backwards}}. So the real length is:
-2f 3c e0 = 3095776 (in dec).
+2f 3c e0 (hex) = 3095776 (decimal)
 <br>
 Calculation made with dumps of LE40B650T2P-2006.0 let you understand better structure of bml0/3:
@@ Line 72: / Line 72: @@
 == Authuld ==
-After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes '''of active''' partitions.<br>
+After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes '''of active''' partitions and authuld itself.<br> It is important to understand that this check takes some time (this is the delay experienced until authuld reboots the system if it detects modifications, should be approx 1 minute). If it matches, nothing happens (besides an authuld completed successfully message), if it doesn't match, the kernel tells Micom to reboot the system (Micom cmd 143).
-On B series (difers from C/D/E series) here are one set of partitions which is always checked (hashes stored on /dev/bml0/{{red|3}} AND two sets of firmware files (checked only active). Example LExxB650T2P:
 nd. /dev/bml0/8 and /dev/bml0/10
 nd. /dev/bml0/9 and /dev/bml0/11

@@ Line 21: / Line 21: @@
   00001000  '''26 7a 0e f7 6f f0 e4 9f  79 1b c5 74 54 10 2e d9'''  |&z..o...y..tT...|
   00001010  '''{{green|e0 3c 2f 00}}  {{gray|72 ab f2 09  a8 ea d4 bc e5 4b 24 a8'''}}  |.</.r........K$.|
-  00001020  '''{{gray|7b 1d f6 bb}}  {{green|dc 21 04 00}}  {{red|62 41 92 96 d0 4c 2f b1}}'''  |{....!..bA...L/.|
+  00001020  '''{{gray|7b 1d f6 bb}}  {{green|dc 21 04 00}}  {{blue|62 41 92 96 d0 4c 2f b1}}'''  |{....!..bA...L/.|
-  00001030  '''{{red|17 00 81 0f b5 78 47 ca}}  {{green|b4 ba 02 00}} 3d 8a 03 f3'''  |.....xG.....=...|
+  00001030  '''{{blue|17 00 81 0f b5 78 47 ca}}  {{green|b4 ba 02 00}} 3d 8a 03 f3'''  |.....xG.....=...|
   00001040  '''1c f0 b8 15 30 a1 4b f7  42 d8 4d fa {{green|b8 95 00 00}}'''  |....0.K.B.M.....|
   00001050  '''{{gray|c0 d5 c5 4b bf 04 e5 28  ef 3b c8 4a 5b 75 aa 07}}'''  |...K...(.;.J[u..|
-  00001060  '''{{green|00 10 33 00}} {{red|b0 5a b0 71  00 32 84 11 e2 f7 fe 45}}'''  |..3..Z.q.2.....E|
+  00001060  '''{{green|00 10 33 00}} {{blue|b0 5a b0 71  00 32 84 11 e2 f7 fe 45}}'''  |..3..Z.q.2.....E|
-  00001070  '''{{red|a4 83 fe 5e}} {{green|00 e0 0d 00}}'''  79 f0 81 7f 56 65 61 93  |...^....y...Vea.|
+  00001070  '''{{blue|a4 83 fe 5e}} {{green|00 e0 0d 00}}'''  79 f0 81 7f 56 65 61 93  |...^....y...Vea.|
   00001080  00 10 31 00 81 6a a0 6c  0a 06 a3 94 23 f4 06 2e  |..1..j.l....#...|
   00001090  b8 f0 68 3e 00 b0 0d 00  92 4c 61 38 a1 1a f0 0b  |..h>.....La8....|

@@ Line 20: / Line 20: @@
+  *
   00001000  '''26 7a 0e f7 6f f0 e4 9f  79 1b c5 74 54 10 2e d9'''  |&z..o...y..tT...|
-  00001010  '''{{green|e0 3c 2f 00}}''' 72 ab f2 09  a8 ea d4 bc e5 4b 24 a8  |.</.r........K$.|
+  00001010  '''{{green|e0 3c 2f 00}}  {{gray|72 ab f2 09  a8 ea d4 bc e5 4b 24 a8'''}}  |.</.r........K$.|
-  00001020  7b 1d f6 bb dc 21 04 00  62 41 92 96 d0 4c 2f b1  |{....!..bA...L/.|
+  00001020  '''{{gray|7b 1d f6 bb}}  {{green|dc 21 04 00}}  {{red|62 41 92 96 d0 4c 2f b1}}'''  |{....!..bA...L/.|
-  00001030  17 00 81 0f b5 78 47 ca  b4 ba 02 00 3d 8a 03 f3  |.....xG.....=...|
+  00001030  '''{{red|17 00 81 0f b5 78 47 ca}}  {{green|b4 ba 02 00}} 3d 8a 03 f3'''  |.....xG.....=...|
-  00001040  1c f0 b8 15 30 a1 4b f7  42 d8 4d fa b8 95 00 00  |....0.K.B.M.....|
+  00001040  '''1c f0 b8 15 30 a1 4b f7  42 d8 4d fa {{green|b8 95 00 00}}'''  |....0.K.B.M.....|
-  00001050  c0 d5 c5 4b bf 04 e5 28  ef 3b c8 4a 5b 75 aa 07  |...K...(.;.J[u..|
+  00001050  '''{{gray|c0 d5 c5 4b bf 04 e5 28  ef 3b c8 4a 5b 75 aa 07}}'''  |...K...(.;.J[u..|
-  00001060  00 10 33 00 b0 5a b0 71  00 32 84 11 e2 f7 fe 45  |..3..Z.q.2.....E|
+  00001060  '''{{green|00 10 33 00}} {{red|b0 5a b0 71  00 32 84 11 e2 f7 fe 45}}'''  |..3..Z.q.2.....E|
-  00001070  a4 83 fe 5e 00 e0 0d 00  79 f0 81 7f 56 65 61 93  |...^....y...Vea.|
+  00001070  '''{{red|a4 83 fe 5e}} {{green|00 e0 0d 00}}'''  79 f0 81 7f 56 65 61 93  |...^....y...Vea.|
   00001080  00 10 31 00 81 6a a0 6c  0a 06 a3 94 23 f4 06 2e  |..1..j.l....#...|
   00001090  b8 f0 68 3e 00 b0 0d 00  92 4c 61 38 a1 1a f0 0b  |..h>.....La8....|

@@ Line 55: / Line 55: @@
 Structureis similar to bml0/3, just hashes are at the beginning of file:<br>
-*'''mtd_exe''' [16 bytes hash ] [4 bytes lengh], the next [16 bytes ] [4 bytes] are for mtd_appdata<br>
+*'''mtd_exe''' [16 bytes hash ] [4 bytes lengh], the next [16 bytes ] [4 bytes] are for '''mtd_appdata'''<br>
 For example T-CHLCIPDEUC-2006.0:
   00000000  '''43 72 15 c3 a6 ff 21 14  ac ac 65 9f cd 5a 25 eb'''  |Cr....!...e..Z%.|

@@ Line 57: / Line 57: @@
 the first 16+4 bytes are for mtd_exe, the next 16+4 bytes are for mtd_appdata<br>
 For example T-CHLCIPDEUC-2006.0:
-  00000000  43 72 15 c3 a6 ff 21 14  ac ac 65 9f cd 5a 25 eb  |Cr....!...e..Z%.|
+  00000000  '''43 72 15 c3 a6 ff 21 14  ac ac 65 9f cd 5a 25 eb'''  |Cr....!...e..Z%.|
-  00000010  00 f0 40 03 07 7c b3 32  41 ec cd b1 dd f0 40 fd  |..@..|.2A.....@.|
+  00000010  {{green|00 f0 40 03}} 07 7c b3 32  41 ec cd b1 dd f0 40 fd  |..@..|.2A.....@.|
   00000020  f4 21 82 9d 00 d0 ca 01  00 00 00 00 00 00 00 00  |.!..............|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
@@ Line 64: / Line 64: @@
 Hash of exe.img:
 72 15 c3 a6 ff 21 14  ac ac 65 9f cd 5a 25 eb
-Lengh of it: 00 f0 40 03, but backwards it is:
+Lengh of it: {{green|00 f0 40 03}}, but {{red|backwards}} it is:
 40 f0 00 = 54587392 bytes (decimal)
 This is exact size in bytes of decrypted exe.img! :)
 == Authuld ==
 After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes '''of active''' partitions.<br>

@@ Line 68: / Line 68: @@
 This is exact size in bytes of decrypted exe.img! :)
 == Authuld ==
-After boot of kernel and mounting of rootfs, /sbin/authuld is called and it is checking hashes '''of active''' partitions.<br>
+After boot of kernel and mounting of rootfs, /bin/authuld is called and it is checking hashes '''of active''' partitions.<br>
-On B series (difers from C/D/E series) here are one set of partitions for kernel and rootfs (hashes stored on /dev/bml0/{{red|3}} AND two sets of firmware files (Example LExxB650T2P):
+On B series (difers from C/D/E series) here are one set of partitions which is always checked (hashes stored on /dev/bml0/{{red|3}} AND two sets of firmware files (checked only active). Example LExxB650T2P:
 nd. /dev/bml0/8 and /dev/bml0/10
 nd. /dev/bml0/9 and /dev/bml0/11
-After authuld finishes checking of partitions whose hashes are stored on /dev/bml0/3, it starts to check firmware active partitions, depends from boot flag is present on /mtd_rwarea:
+After authuld finishes checking of partitions whose hashes are stored on /dev/bml0/3, it starts to check firmware active partitions, depends from what boot flag is present on /mtd_rwarea:
-PartitionSwitch_0_0 - 1st set of partitions is booting and hashes are checked on '''1st strmackeypartition'''
+ PartitionSwitch_0_0 - 1st set of partitions is booting and hashes are checked on '''1st strmackeypartition'''
-PartitionSwitch_1_0 - 2nd set of partitions is booting and hashes are checked on '''2nd strmackeypartition'''
+ PartitionSwitch_1_0 - 2nd set of partitions is booting and hashes are checked on '''2nd strmackeypartition'''
 At boot time neither hashes of alternative (inactive) partitions, nor its strmackeypartition are checked.

@@ Line 1: / Line 1: @@
 Article describes structure and partition numbers for most known Samsung TV models.
 =B series CI+ TV`s=
-Almost all read only partitions on B series are observed by secure boot and changing them may convert TV in to the brick.
+Almost all read only partitions on B series are observed by secure boot and modifying them may convert TV in to the brick.<br>
-What for the hell are hashes and how do we calculate them? Read here: '''[[Hashes]].<br><br>
+What ''for the hell'' are hashes and how do we calculate them? Read here: '''[[Hashes]].<br><br>
 *Hashes for the u-boot (/dev/bml0/2), fnw (dev/bml0/4) and kernel (dev/bml0/5) are stored in /dev/bml0/3 and begin at offset 0x1000.
 *Hashes of firmware files (exe.img and appdata.img) are stored at other place on TV. begin at offset 0x0.<br>
@@ Line 8: / Line 8: @@
 == Hashes on /dev/bml0/3  ==
 We have the following structure within this file (at offset 0x1000)
- [16 bytes kernel hash] [4 bytes kernel length]
+* '''Image''' [16 bytes hash] [4 bytes length]
- [16 bytes uboot hash] [4 bytes uboot length]
+* '''u-boot''' [16 bytes hash] [4 bytes length]
- [16 bytes fnw hash] [4 bytes fnw length]
+* '''fnw''' [16 bytes hash] [4 bytes length]
- [16 bytes authuld hash] [4 bytes authuld length]
+* '''authuld''' [16 bytes hash] [4 bytes length]
- [16 bytes rootfs hash] [4 bytes rootfs length]
+* '''rootfs''' [16 bytes hash] [4 bytes length]
- [16 bytes boot.img hash] [4 bytes boot.img length]
+* '''boot''' [16 bytes hash] [4 bytes length]
 For example, bml0/3 of T-CHLCIPDEUC 2006.0. The hash for kernel (Image) starts at offset 0x1000 and it's length starts at offset 0x1010:
@@ Line 29: / Line 29: @@
   00001080  00 10 31 00 81 6a a0 6c  0a 06 a3 94 23 f4 06 2e  |..1..j.l....#...|
   00001090  b8 f0 68 3e 00 b0 0d 00  92 4c 61 38 a1 1a f0 0b  |..h>.....La8....|
   <...>
 Where: hash of kernel comes first and it is:
 7a 0e f7 6f f0 e4 9f  79 1b c5 74 54 10 2e d9
@@ Line 48: / Line 48: @@
   hash[ 4] = c0d5c54bbf04e528ef3bc84a5b75aa07   length =  3346432  :  bml06.dmp
   hash[ 5] = b05ab07100328411e2f7fe45a483fe5e   length =   909312  :  bml07.dmp
-Now you will know, that after you modify any of those partitions, you have also modify hex signature (hash) as well.
+Now you will know, that after you modify any of those partitions, you have also modify hex signature (hash) as well. MANDATORY at same TV session. Don`t reboot you you haven`t restored hash partition with updated hashes.
 <br>