Hacking TV over Hotel mode (most C series models)


From SamyGO
Revision as of 10:35, 18 February 2011 by Decix (talk | contribs) (→‎If TV is not hacked)
Jump to: navigation, search

Universal USB disk to hack C series TV. It should work on any C series TV with export settings to ext3 USB support. Some models does not support ext3 file system for settings export (C6000/C630...firmwares with T-VAL6DEUC) Tested and works on models with T-MSX5DEUC, T-TDT5DEUC and T-VALDEUC (until 5.1.2011).

After this hack you can connect to TV over telnet, you get CIFS (samba) and NFS support, ftp server, webui, crond... Moreover, if you attach USB with script file "SamyGO.sh", it will be executed.

This hack has unificated structure for comfortable script execution for developers (read below)

Preparation

1. USB > 1GB space. (windows user can use Fat32 formatted USB)
2. TV in normal mode. Export channels from TV to clean fat32 USB
3. Activate Hotel Mode 

Mute-1-1-9-Enter
set to on by pressing "left"

4. Export settings from TV to the same fat32 USB
5. Save files you get anywhere in PC
6. Download network_opt_18.02.2011_1.zip, extract from archive. You get 1Gb file network_opt_18.02.2011_sda2.img

  • IMPORTANT This is the 3th version of USB image, updated on 18.2.2011.

If you have hacked TV with the first version or over widget, you should re-hack TV.

7. Make USB from this image with help of included win32diskimager.

  • After win32diskimager finishes, you get two partitions on USB: one fat32, accessible from windows and second, ext3 - not accessible under Windows.
  • You do not need to do any changes on ext3 partition.
  • All operations you have to do on fat32 partition.

Hacking TV


If TV is not hacked

8. Attach USB you made to PC. Copy channel settings file (you made in normal mode) to root of USB
9. Rename file (channel_list_LE32C550_1001.scm for C550) to zip 

channel_list_LE32C550_1001.scm.zip

10. Add directory usb_mount with empty file in it (e.g. 1.txt; - very important) to archive
11. Rename back to channel_list_LE32C550_1001.scm

  • You get files inside of archive:
 Archive:  channel_list_LE32C550_1001.scm
  Length      Date    Time    Name
---------  ---------- -----   ----
       68  2038-01-19 06:14   CloneInfo
      96  2038-01-19 06:14   FineTune_Digital
   40000  2038-01-19 06:14   map-AirA
  292000  2038-01-19 06:14   map-AirD
   40000  2038-01-19 06:14   map-CableA
  292000  2038-01-19 06:14   map-CableD
       4  2038-01-19 06:14   map-ChKey
     720  2038-01-19 06:14   RadioMap
       0  2010-11-30 21:55   usb_mount/
       8  2010-11-30 21:55   usb_mount/1.txt
---------                     -------
  664896                     10 files

12. Copy files exported in Hotel mode (only files, without directories) to /restore directory on USB

  • Exported in HotelMode files to copy:

./T-MSX5DEUC/Clone: 

drwxr-xr-x 2 root root   4096 2010-12-27 18:39 .
drwxr-xr-x 3 root root   4096 2010-12-27 18:39 ..
-rw-r--r-- 1 root root   2304 1980-01-01 00:00 Clone.dat
-rw-r--r-- 1 root root    378 1980-01-01 00:00 FADAT
-rw-r--r-- 1 root root    144 1980-01-01 00:00 FineTune_Digital
-rw-r--r-- 1 root root    188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-AirA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-AirD
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-CableA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-CableD
-rw-r--r-- 1 root root      4 1980-01-01 00:00 map-ChKey
-rw-r--r-- 1 root root 144000 1980-01-01 00:00 map-SateD
-rw-r--r-- 1 root root     95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r-- 1 root root   5382 1980-01-01 00:00 PLDAT
-rw-r--r-- 1 root root    720 1980-01-01 00:00 RadioMap
-rw-r--r-- 1 root root   7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r-- 1 root root    324 1980-01-01 00:00 ServiceProviders
-rw-r--r-- 1 root root   9478 1980-01-01 00:00 SSDAT
-rw-r--r-- 1 root root  98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r-- 1 root root     28 1980-01-01 00:00 TSIDList
-rw-r--r-- 1 root root      4 1980-01-01 00:00 UserTransponderDataBase.dat

13. Exit from Hotel mode:

  • Go to ServiceMenu
Info - Menu - Mute - Power
  • Hotel Mode ->Off

14. Attach USB to TV and import channel settings to TV. Everything must go w/o errors.
15. Activate Hotel mode again 16. Import HotelMode settings you exported before (as is, with directories)

17. Press OK.

18. TV restarts twice and starts in black screen. DO NOT POWER OFF, DO NOT DISCONNECT USB.

  • Wait 3 minutes. After three minutes or if you get to console earlier you can reboot TV.
  • Try connect to TV over telnet (port:23)
  • If you get to console, congratulations.
  • TV starts in Hotel mode. If you have your channel settings right, you can deactivate hotel mode from service menu.

19. If you haven`t got your channels back and if you can`t telnet to TV, it means - something went wrong

  • Look for file first_run.ok and content of directory /result on USB

20. If you have telnet after hack, execute: 

cp $OPT_DIR/usr/restore/start.sh /mtd_rwarea/start.sh

If TV is already hacked

(Over hotel mode or widget - it does not matter)

  • Make USB (steps 6. and 7.)
  • Do not change anything
  • Attach to TV and connect over telnet
  • Execute:
sh +x /dtv/usb/patch_to/first_run.sh
  • Wait until you get "Installation Completed!"
  • Reboot TV

Normal operating of hacked TV

To be updated...

Ways to unbrick TV

To be updated...

If you do not have success or script finishes with error, or you have hacked over Widget and it stopped working (on latest firmwares), Format /mtd_rwarea over ExLink:

  • Make Ex-Link Cable for C-Series attach to TV.
  • Power off TV.
  • Unplug Network cable, might antenna too. Leave only ExLink and Power cable plugged.
  • Power on TV.
  • Open terminal and connect TV over ExLink.
  • Enter commands following by Enter:
10041004
81588
20089999
2
0
0
2 (advanced)
2 (DeviceManager Debug)
90 (DeviceManager MW Debug)
12 (DLNA, FLASH, ODD, HDD, MoIP Test)
11 (FLASH, HDD Format Test)
10 (or another, /mtd_rwarea/ partition number (14)

On the last line you have to enter number of your /mtd_rwarea/. On C550 it is 10, but on other TV it can be other (e.g. 14)

Try hack TV again from step 7.

FAQ =

To be updated...

Tested on those models


  • LE 32-C550J1W [T-MSX5DEUC-2005.4]
  • LE 40-C550 [T-MSX5DEUC-2003.1]
  • LE 32-C530 [T-MSX5DEUC-2007.4]
  • LE 32-C550J1WUA [T-MSX5DEUC-2007.4]
  • LE 32-C550J1WXRU [T-MSX5DEUC-2005.4]
  • UE 32-C5100QW [T-MSX5DEUC-2007.4]
  • PS 50-C550 [T-TDT5DEUC]
  • LE 40-C650L1WXXH [T-VALDEUC-2002]
  • LE40C750 [T-VALDEUC 3007.1]
  • UE40C8700 [T-VALDEUC-3006.2]
  • UE40C8700 [T-VALDEUC 3007.1]
  • LE37C630 [T-MSX6DEUC 1002.1]


To be updated...
Author and developer of universal USB hack disk - Perforator from forum.ixbt.com (He made the first hack for C series TV also).

--Juzis28 10:14, 18 February 2011 (UTC)

Retrieved from "http://wiki.samygo.tv/index.php?title=Hacking_TV_over_Hotel_mode_(most_C_series_models)&oldid=1469"