Samsung A Series (sh4 CPU) Hacks

T-AMBDFRC (Models LExxA676)

A SH4 CPU model - please add details.

T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)

Available hacks / software

Look for latest versions in download area

SamyGO Firmware Patcher

• WiseLink video player aspect ratio fix (arfix-sh) is applied
• optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase U) - e.g. for Extension Pack

SamyGO Extensions Pack

A collection of command line linux applications. Unpack files to USB disk and insert to tv set. A firmware patch or serial console is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)

• SSH daemon for console access ( user: root, password: SamyGO )
• kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
• lot lot more... see discussion

Video player aspect ratio fix (SH4)

arfix-sh fixes part of internal firmware, WiseLink video player. Also see discussion

T-RBYDEUC technical info

The main CPU of these models is NOT an ARM processor but the SH4 processor STi7109. Therefore ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:

  Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:

• exeDSP has all symbols stripped
• libGame.so loading and running is completely blocked in exeDSP
• First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
• busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

Manual firmware patching T-RBYDEUC

Obsoleted by SamyGO Firmware Patcher and Extension Pack.

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon. You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856 [1]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor. There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

  export LOGNAME="root" [already there]
  ...
  cd /dtv/usb
  PATH_USB=`cat log | grep Mount`
  PATH_USB=`echo ${PATH_USB##MountDir : }`
  echo $PATH_USB
  $PATH_USB/usb.sh &
  ## mount -n -t usbfs none /proc/bus/usb
  ...

Modification may not work as some USB disks get mounted later than the modified code is executed

and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

  #! /bin/sh
  
  echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
  /bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
  #line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
  echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"
  
  #sleep 25 (m)sec is need for wait ethernet start
  sleep 25
  
  cd /dtv/usb
  PU=`cat log | grep Mount`
  PU=`echo ${PU##MountDir : }`
  
  echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
  $PU/busybox telnetd -l /bin/sh
  
  echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
  cd $PU
  insmod cifs.ko
  
  sleep 4
  
  echo "!!!!!!!!!!!!!! clear old contents USB on TV  !!!!!!!!!!!!!!"
  rm /mtd_contents/V* -R
  rm /mtd_contents/database -R
  
  echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
  mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
  mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
  mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp
  
  mount
  echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here: [2]