Samsung A Series (sh4 CPU) Hacks

T-AMBDFRC (Models LExxA676)

A SH4 CPU model - please add details.

T-RBYDEUC (Models LExxA756, LExxA856, LExxA956/959)

The main CPU of these models is NOT an ARM processor but the SH4 processor STi7109 [1]. Therefore the ARM-based hacks and tools won't run!

Official firmware from Samsung: T-RBYDEU (T-RBYDEUC) in version 1013.1

Linux version:

  Linux version 2.6.17.14_stm22_0039-Samsung_7103 (gcc version 4.1.1 (STMicroelectronics/Linux Base 4.1.1-23)) #363 PREEMPT Sun Jul 27 17:14:14 KST 2008

Other differences from ARM model line:

• exeDSP has all symbols stripped
• libGame.so loading and running is completely blocked in exeDSP
• First USB is connected to MTK8226 (secondary CPU) so an USB disk appears as /dev/sdb (mounted /dtv/usb/sdb1)
• busybox has a malfunctioning telnet-deamon compiled in (busybox is compiled without /dev/pts filesystem support however kernel needs it)

You can use SamyGO Firmware Patcher version >= 0.22 for

• WiseLink video player aspect ratio fix [2]
• optionally enabling boot time call to a script /SamyGO/rcSGO from USB disk

Manual firmware patching T-RBYDEU

Partially obsoleted by SamyGO Firmware Patcher.

So, what you need is an updated BusyBox, a modified exe.img to enable script-starts from USB-Pens and a good USB-Script to start telnet-daemon. You can find most of the things in the following thread:

Hacking T-RBYDEUC Firmware - LE40A756 and A856 [3]

So, what you need to do, to get access to your TV:

1. Modifiy your start.sh in exe.img, either by unpacking and repacking it (see below how to do), or by using a hex-editor. There are many descriptions how to modify exe.img and to correct the crc-hash. What you need to add to start.sh:

  export LOGNAME="root" [already there]
  ...
  cd /dtv/usb
  PATH_USB=`cat log | grep Mount`
  PATH_USB=`echo ${PATH_USB##MountDir : }`
  echo $PATH_USB
  $PATH_USB/usb.sh &
  ## mount -n -t usbfs none /proc/bus/usb
  ...

Modification may not work as some USB disks get mounted later than the modified code is executed and now I can run scripts (usb.sh) from pendrive. Therefore you need to build (or copy from archive) the folloing script to the root of your pendrive:

  #! /bin/sh
  
  echo "!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!"
  /bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
  #line before enables console for speed 57600. Put 'debug' to console and you see menu, put '12' and ENTER
  echo "!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!"
  
  #sleep 25 (m)sec is need for wait ethernet start
  sleep 25
  
  cd /dtv/usb
  PU=`cat log | grep Mount`
  PU=`echo ${PU##MountDir : }`
  
  echo "!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!"
  $PU/busybox telnetd -l /bin/sh
  
  echo "!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!"
  cd $PU
  insmod cifs.ko
  
  sleep 4
  
  echo "!!!!!!!!!!!!!! clear old contents USB on TV  !!!!!!!!!!!!!!"
  rm /mtd_contents/V* -R
  rm /mtd_contents/database -R
  
  echo "!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!"
  mount -t cifs //XXX.XXX.XXX.XXX/photo $PU/photo -o user=user_xp -o pass=password_xp
  mount -t cifs //XXX.XXX.XXX.XXX/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
  mount -t cifs //XXX.XXX.XXX.XXX/video $PU/video -o user=user_xp -o pass=password_xp
  
  mount
  echo "!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!"

On pendrive you have to have empty folders: photo, mp3, video and files: usb.sh, cifs.ko (size for my compilation 2707316 bytes), busybox (size for my compilation 992084 bytes)

You can download the whole package here: [4]