Dumping and Flashing images by hand
The steps outlined below allow the flashing of an image directly into the flash of your TV, without using the offical upgrade process of the TV.
The example shown below is for flashing a modified exe.img on a UExxB70xx.
There is no need to flash app_data Image, if you are just flashing modifications of the same exeDSP Version.
In any case you need to ensure that you erase the respective flash before overwriting it.
Device files used
Find below the device files for different areas of the firmware for FW types listed ( this information is taken from the run.sh file and was not validated! )
T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC
T-CHL5DSEUC and T-CHL5DEUC Specific
For All Devices
- It's better to conceive the structure of your TV by df tool.
You can check your "df" output. Here is mine on LE40B650T2W which uses T-CHL7DEUC firmware
# df Filesystem 1k-blocks Used Available Use% Mounted on /dev/tbml6 3136 3136 0 100% / none 10240 0 10240 0% /dtv /dev/tbml7 1024 1024 0 100% /mtd_boot none 10240 0 10240 0% /mtd_ram /dev/stl0/14 11224 1778 9446 16% /mtd_rwarea /dev/tbml10 61400 52440 8960 85% /mtd_exe /dev/tbml11 29312 29312 0 100% /mtd_appdata /dev/stl0/13 193536 160000 33536 83% /mtd_tlib /dev/stl0/15 51160 1976 49184 4% /mtd_contents /dev/stl0/16 90012 16344 73668 18% /mtd_down /dev/stl0/12 152576 224 152352 0% /mtd_wiselink /dev/stl0/17 89072 176 88896 0% /mtd_swu
Interpretation of this list is like that:
As you can easily understand mount of /mtd_exe means EXE_DEVICE is that /dev/tbml10.
And / describes that is ROOT device at /dev/tbml6.
- EXE_DEVICE = /dev/tbml10
- ROOT_DEVICE = /dev/tbml6
- APPDATA_DEVICE = /dev/tbml11
- BOOT_DEVICE = /dev/tbml7
You have to aware that, there is some devices not shown on df commands like bootloader or like kernel devices...
Manual flashing steps
- (1) Prevent TV from rebooting when exeDSP is stopped
- (2) Stop exeDSP binary
killall -9 exeDSP
- (3) Unmount the respective directory
- (4) Take a backup of the current image in the flash.
bml.dump /dev/bml0/8 /mtd_swu/exe.img.orig
If you dont have bml.dump tool in your firmware, than you can use dd or cat tool too.
cat /dev/bml0/8 > /mtd_swu/exe.img.orig
dd if=/dev/bml0/8 of=/mtd_swu/exe.img.orig
- (5) Move backup image to a safe space ( e.g. USB )
mv /mtd_swu/exe.img.orig /dtv/usb/sda1
- (6) Copy Image to be flashed from your USB to /mtd_swu
cp /dtv/usb/sda1/exe.img /mtd_swu
-> this is the safest way, even though flashing directly from USB-Device may also be possible, which I have not tested
- (7) Erase the flash before flashing the new file
- (8) Perform the actual step of flashing the file. exe.img file is needed to be non-encrypted. So you needed to decrypt exe.img.sec or exe.img.enc images before flashing!
bml.restore /dev/bml0/8 /mtd_swu/exe.img
->Flashing progress will be shown 0% ... 100%. Don't interrupt this process!!
- (9) Mount the updated image( afterwards check out content and ensure it mounts without problems and looks ok from a content perspective. )
mount -t auto /dev/tbml8 /mtd_exe
- (10) Starting exeDSP
-> If something went wrong and your exeDSP doesn't start up properly, then you can flash back your backup ".orig" image following steps 3-9.
-> Don't worry, if you see your screen upside down after re-starting exeDSP ;-) as the exeDSP binary seems to expect a freshly initialized HW to start-up properly
Attention:This process does not validate the correctness and validity of the file being flashed. THIS IS YOUR RESPONSIBILITY!!!
Flashing via TVs Software
If you are flashing root image, how can you make it if you unmount the root?
Here is another way of flashing partitions (that not limited with root partition, instead any partition that you wanted) via Flashing menu of TV.
- Revert firmware to previous one.(Not needed every time)
- Download last firmware of TV from Samsung.
- Put modified image dump (like rootfs.img ) to the /image directory, near exe.img.enc on new FW that gonna flash.
- Update validinfo.txt file and add required changes that described at bottom.
- Than flash it as usual firmware update.
- Pray to god. ( Always needed specially while doing such a critical things. )
- If your TV is not bricked after flash, do not forget that you are praying a minute ago and say "thank you God!". This will prevent your TV to become bricked next time.
This will safely flash that partition (like "rootfs.img" or others)
You could needed to update validinfo.txt file too.
Its structure is basic, for example:
Structure is star, partition number, underline, image name, underline, crc32 at lower case. You needed to calculate CRC32 of that image. Your new valid.txt needed to be like this if you are gonna flash your root partition that located at /dev/bml0/6:
Other partitions names are: Image - KERNEL image partition
u-boot.bin - BOOTLOADER image partition
boot.img - BOOT image partition
rootfs.img - RFS image partition
exe.img - EXE image partition
appdata.img - APPDATA image partition
onw.bin - BOOTLOADER image on CHL5DEUC or T-CHL5DSEUC - Flex Onenand Writer
fnw.bin - BOOTLOADER image on CHL5DEUC or T-CHL5DSEUC - Flex Onenand Writer
This information from run.sh.enc file that available at almost firmware upgrades, but you needed to decrypt it via XOR with firmware name first.