Samsung A Series (sh4 CPU) Hacks
Contents
T-AMBDFRC (Models LExxA676)
A SH4 CPU model - please add details.
T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)
Available hacks / software
Look for latest versions in download area
- WiseLink video player aspect ratio fix (arfix-sh) is applied
- optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk (answer upercase U) - e.g. for Extension Pack
A collection of command line linux applications. Unpack files to USB disk and insert to tv set. A firmware patch or serial console is necessary to start extensions (call a script /SamyGO/rcSGO on USB disk)
- SSH daemon for linux command line access ( user: root, password: SamyGO )
- kernel modules/scripts for mounting CIFS (Windows) shares and NFS shares
- lot lot more... see discussion
Video player aspect ratio fix (SH4)
arfix-sh fixes part of internal firmware, WiseLink video player. Also see discussion
Content library launcher
Work in progress, see discussion
T-RBYDEUC technical info
The main CPU of these models is NOT an ARM processor but the SH4 processor STi7109. Therefore ARM-based hacks and tools won't run!
Getting access to u-boot (SH4)
Watchdogs and MICOM on A series(SH4)
Ex-link in service mode on A series(SH4)
Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1
Linux version:
Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008
Other differences from ARM model line:
- exeDSP has all symbols stripped
- libGame.so loading and running is completely blocked in exeDSP
- First USB is connected to MTK8226 (secondary CPU) so the first USB disk appears as /dev/sdb (mountpoint /dtv/usb/sdb1)
- busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)
Manual firmware patching T-RBYDEUC
Obsoleted by SamyGO Firmware Patcher and Extension Pack.
So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon. You can find most of the things in the following thread:
Hacking T-RBYDEUC Firmware - LE40A756 and A856 [1]
So, what you need to do, to get access to your TV:
1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor. There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:
export LOGNAME="root" [already there]
...
cd /dtv/usb
PATH_USB=`cat log | grep Mount`
PATH_USB=`echo ${PATH_USB##MountDir : }`
echo $PATH_USB
$PATH_USB/usb.sh &
## mount -n -t usbfs none /proc/bus/usb
...
Modification may not work as some USB disks get mounted later than the modified code is executed
and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:
#! /bin/sh
echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"
#sleep 25 (m)sec is need for wait ethernet start
sleep 25
cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`
echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
$PU/busybox telnetd -l /bin/sh
echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
cd $PU
insmod cifs.ko
sleep 4
echo "!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!"
rm /mtd_contents/V* -R
rm /mtd_contents/database -R
echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp
mount
echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"
On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)
You can download the whole package here: [2]
