Hacking TV over Hotel mode (most C series models)

Universal USB disk to hack C series TV

After hack your TV you can connect to TV via Telnet, you get CIFS (Samba) and NFS support, FTP Server, WebUI, crond, ...
Moreover, if you attach USB with script file "SamyGO.sh", it will be executed.
This hack has unificated structure for comfortable script execution for developers (read below).

Safety measures for C series TVs

Make some important settings before start hacking TV:

• In service menu, enable Debug mode for the RS232 port.

With TV switched off, press the following sequence on the remote: [INFO] [MENU] [MUTE] [POWER]

Enter the Control menu and set the value of the RS232 mode to Debug.

Once you're back to the main Service menu, you will have to power off the TV for normal operation.

Notice that your TV will reset RS232 mode back to UART when you install another firmware (no matter if it's older or newer).

• Have a working Ex-Link Cable for C-Series at hand. (desirable)

If you don't feel capable of soldering such a cable, you can find and buy a cheap (under $5) USB to TTL adapter at eBay.

Supported TV models

TV model is not important, you should check your firmware.

• This hack works on all firmware versions (even latest firmwares):

T-TDT5DEUC
T-MSX5DEUC
T-MSX6DEUC
T-VALDEUC

• Hack does not work on TV with T-VAL6DEUC firmware.

Preparation

1. USB > 1GB space. (Windows users can use FAT32 formatted USB)
2. TV in normal mode. Export channels from TV to clean FAT32 USB.
3. Activate Hotel Mode.

Mute-1-1-9-Enter
set to on by pressing "left"

4. Export settings from TV to the same FAT32 USB ("Clone TV to USB").
5. Unplug USB stick from TV and save files you get anywhere on PC.
6. Download network_opt_18.02.2011_1.zip, extract archive. You get 1GB file network_opt_18.02.2011_sda2.img

• IMPORTANT: This is the 3rd version of the USB image, updated on 18.2.2011.
  

If you have hacked TV with the earlier version or over widget and you want have benefits of this hack,

you should re-hack TV.

7. Make USB from this image with help of included win32diskimager.

• After win32diskimager finishes, you get two partitions on USB: one FAT32, accessible under Windows and a second, ext3 - not accessible under Windows.
  
• You do not need to do any changes on ext3 partition.
  
• All operations have to be done on the FAT32 partition, no linux needed.

Installation. What to do if...

TV is not hacked

8. Attach Universal hack USB you made to PC. Copy channel settings file (you made in normal mode) to root of USB.
9. Rename file (channel_list_LE32C550_1001.scm for C550) to zip

channel_list_LE32C550_1001.scm.zip

10. Add directory usb_mount with empty file in it (e.g. 1.txt; - very important) to archive
11. Rename back to channel_list_LE32C550_1001.scm

• You get files inside of archive:

 Archive:  channel_list_LE32C550_1001.scm
  Length     Date    Time    Name
--------- ---------- -----   ----
      68  2038-01-19 06:14   CloneInfo
      96  2038-01-19 06:14   FineTune_Digital
   40000  2038-01-19 06:14   map-AirA
  292000  2038-01-19 06:14   map-AirD
   40000  2038-01-19 06:14   map-CableA
  292000  2038-01-19 06:14   map-CableD
       4  2038-01-19 06:14   map-ChKey
     720  2038-01-19 06:14   RadioMap
       0  2010-11-30 21:55   usb_mount/
       8  2010-11-30 21:55   usb_mount/1.txt
---------                     -------
  664896                     10 files

12. Copy files exported in Hotel mode (only files, without directories) to /HotelMode directory on USB

• Exported in HotelMode files to copy:

./T-MSX5DEUC/Clone:

drwxr-xr-x 2 root root   4096 2010-12-27 18:39 .
drwxr-xr-x 3 root root   4096 2010-12-27 18:39 ..
-rw-r--r-- 1 root root   2304 1980-01-01 00:00 Clone.dat
-rw-r--r-- 1 root root    378 1980-01-01 00:00 FADAT
-rw-r--r-- 1 root root    144 1980-01-01 00:00 FineTune_Digital
-rw-r--r-- 1 root root    188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-AirA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-AirD
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-CableA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-CableD
-rw-r--r-- 1 root root      4 1980-01-01 00:00 map-ChKey
-rw-r--r-- 1 root root 144000 1980-01-01 00:00 map-SateD
-rw-r--r-- 1 root root     95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r-- 1 root root   5382 1980-01-01 00:00 PLDAT
-rw-r--r-- 1 root root    720 1980-01-01 00:00 RadioMap
-rw-r--r-- 1 root root   7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r-- 1 root root    324 1980-01-01 00:00 ServiceProviders
-rw-r--r-- 1 root root   9478 1980-01-01 00:00 SSDAT
-rw-r--r-- 1 root root  98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r-- 1 root root     28 1980-01-01 00:00 TSIDList
-rw-r--r-- 1 root root      4 1980-01-01 00:00 UserTransponderDataBase.dat 

13. Exit from Hotel mode:

• Go to ServiceMenu

Info - Menu - Mute - Power

• Hotel Mode → Off

14. Attach USB to TV and import channel settings to TV. Everything must work without errors.
15. Activate Hotel mode again.

Mute-1-1-9-Enter
set to on by pressing "left"

16. Import HotelMode settings you exported before (as is, with directories) ("Clone USB to TV")
17. Press OK.
18. TV restarts few times and starts in black screen. DO NOT POWER OFF, DO NOT DISCONNECT USB!

• Wait 3 minutes. After three minutes you can reboot TV (if you get to console you can simply type "reboot" and TV will restart).
• Try connect to TV over Telnet (Port 23).
• If you get to console, congratulations.
• TV starts in Hotel mode. If you have your channel settings, you can deactivate hotel mode from service menu.

19. If you haven't got your channels back and if you can't Telnet to TV, it means something went wrong.

• Look for file first_run.ok and content of directory /result on USB

20. If you have Telnet after hack, execute:

cp $OPT_DIR/usr/restore/start.sh /mtd_rwarea/start.sh

21. Done.

TV is already hacked

(Over Hotel Mode or Widget - doesn`t matter)

• Make USB (steps 6. and 7.)
• Do not change anything
• Attach to TV and connect via SSH/Telnet
• Find your usb:

df -h | grep "/dtv/usb/sd" 

• execute script first_run.sh with parameter of path to USB.

e.g. if path to USB is /dtv/usb/sda1, then command to enter is:

sh +x /dtv/usb/sda1/first_run.sh /dtv/usb/sda1 

Path might be different on your TV, for example:

/dtv/usb/sdb1/first_run.sh /dtv/usb/sdb1

/dtv/usb/sdc1/first_run.sh /dtv/usb/sdc1

Check exact path over Telnet before you start.

• Wait until you get the message "Installation Completed!", but do not reboot TV 3 minutes (TV is making some dumps in this time, do not interrupt it.)
• Reboot TV (switch off or enter "reboot" into console)
• Done

Normal operating of hacked TV

To be updated...

Bricked TV

ExLink cable available

Screen is blank

If your start.sh have been written with errors, TV does not boot properly...

• Unplug TV and wait 30 sec. Plug to wall, power on TV.

This should remove /mtd_rwarea/start.sh. If not helped, then:

• Connect Ex-Link Cable for C-Series, switch to debug mode:

10041004

enter:

31337 (removes /mtd_rwarea/start.sh)

or:

666 (removes /mtd_rwarea/start.sh, /mtd_rwarea/usb_mount, /mtd_rwarea/network_opt)

or:

44337794 (check file to know better what it does /mtd_rwarea/network_opt/sbin/44337794)

No reaction to USB, no telnet, but screen is on

• create empty file named kill_start.sh on root of USB
• power off TV
• attach USB and power on TV

/mtd_rwarea/start.sh should be deleted

If no success, then:

format /mtd_rwarea/

If you do not have success or script finishes with error, or you have hacked over Widget and it stopped working (on latest firmwares), Format /mtd_rwarea over ExLink and get "virgin" TV back:

• Make Ex-Link Cable for C-Series attach to TV.
• Power off TV.
• Unplug network and antenna cable. Leave only ExLink and power cable plugged.
• Power on TV.
• Open terminal and connect to TV over ExLink.
• Apply these commands (followed by Enter):

10041004
81588
20089999
2
0
0
2 (advanced)
2 (DeviceManager Debug)
90 (DeviceManager MW Debug)
12 (DLNA, FLASH, ODD, HDD, MoIP Test)
11 (FLASH, HDD Format Test)
10 (or another, /mtd_rwarea/ partition number (14)

On the last line you have to enter number of your /mtd_rwarea/. On C550 it is 10, but on other TV it can be other (e.g. 14)

Try to hack TV again starting from step 7.

no ExLink cable available

• Create script on USB emergency_start.sh (kill_start.sh is to delete)
• Attach USB to TV on stand-by mode and power it on
• TV executes this script on boot.

Factory reset on ServiceMenu. This operation should delete /mtd_rwarea/network_opt

• Hack TV with universal USB disk again

FAQ

To be updated...

Tested and works on TV

• LE 32-C550J1W [T-MSX5DEUC-2005.4]
• LE 40-C550 [T-MSX5DEUC-2003.1]
• LE 32-C530 [T-MSX5DEUC-2007.4]
• LE 32-C550J1WUA [T-MSX5DEUC-2007.4]
• LE 32-C550J1WXRU [T-MSX5DEUC-2005.4]
• UE 32-C5100QW [T-MSX5DEUC-2007.4]
• PS 50-C550 [T-TDT5DEUC]
• LE 40-C650L1WXXH [T-VALDEUC-2002]
• LE40C750 [T-VALDEUC 3007.1]
• UE40C8700 [T-VALDEUC-3006.2]
• UE40C8700 [T-VALDEUC 3007.1]
• LE37C630 [T-MSX6DEUC 1002.1]
  
• UE40C6700 [T-VALDEUC 3007.1]
• UE55C7700 [T-VALDEUC 3006.1]

To be updated...

Author and developer of universal USB hack disk - Perforator from forum.ixbt.com (He made the first hack for C series TV also).


--Juzis28 09:09, 21 February 2011 (UTC)