Hacking TV over Hotel mode (most C series models)


From SamyGO
Revision as of 19:03, 20 January 2011 by Stefanth (talk | contribs) (If you have linux and TV is not hacked)
Jump to: navigation, search

Universal USB disk to hack C series TV. It should work on any C series TV with export settings to ext3 USB support. Some models does not support ext3 file system for settings export (C6000/C630...firmwares with T-VAL6DEUC) Tested and works on models with T-MSX5DEUC, T-TDT5DEUC and T-VALDEUC (until 5.1.2011).

After this hack you can connect to TV over telnet, you get CIFS (samba) and NFS support. Moreover, if you attach USB with script file "SamyGO.sh", it will executed.

This hack has unificated structure for comfortable script execution for developers (read below)

Author and developer - Perforator from forum.ixbt.com (He made the first hack for C series TV also).

IMPORTANT: Until further notice, don't try this hack on a TV without Ethernet port (like C530). Read the C series forum for additional information and try the original juuso hack.

To Do

  • NFS automounts
  • php script for administer TV over http
  • implementations of easy installation/uninstallation of scripts

Preparation

Only for USB, recognised as sda.
How to check. Read this post. Later limitation will be removed.
1. USB > 1GB space. (windows user can use Fat32 formatted USB)
2. TV in normal mode. Export channels from TV to USB
3. Activate Hotel Mode

Mute-1-1-9-Enter
set to on by pressing "left"

4. Export settings from TV to USB
5. Save files you get anywhere in PC
6 Download file, extract from archive. You get 1Gb file network_opt_28.12.2010_3_sda.img
7 Make USB from this image.

  • Under windows you can use win32diskimager.
  • After win32diskimager finishes, USB is not accessible under Windows, because it is ext3 format.

Hack TV

If you have linux and TV is not hacked

8. Attach USB you made to linux PC. Copy channel settings file (you made in normal mode) to root of USB

9. Rename file (channel_list_LE32C550_1001.scm for C550) to zip

channel_list_LE32C550_1001.scm.zip

10. Add directory usb_mount with empty file in it (e.g. 1.txt; - very important) to archive
11. Rename back to channel_list_LE32C550_1001.scm

  • You get files inside of archive:
 Archive:  channel_list_LE32C550_1001.scm
  Length      Date    Time    Name
---------  ---------- -----   ----
       68  2038-01-19 06:14   CloneInfo
      96  2038-01-19 06:14   FineTune_Digital
   40000  2038-01-19 06:14   map-AirA
  292000  2038-01-19 06:14   map-AirD
   40000  2038-01-19 06:14   map-CableA
  292000  2038-01-19 06:14   map-CableD
       4  2038-01-19 06:14   map-ChKey
     720  2038-01-19 06:14   RadioMap
       0  2010-11-30 21:55   usb_mount/
       8  2010-11-30 21:55   usb_mount/1.txt
---------                     -------
  664896                     10 files

12. Copy files exported in Hotel mode (only files, without directories) to /restore directory on USB

  • Exported in HotelMode files to copy:

./T-MSX5DEUC/Clone:

drwxr-xr-x 2 root root   4096 2010-12-27 18:39 .
drwxr-xr-x 3 root root   4096 2010-12-27 18:39 ..
-rw-r--r-- 1 root root   2304 1980-01-01 00:00 Clone.dat
-rw-r--r-- 1 root root    378 1980-01-01 00:00 FADAT
-rw-r--r-- 1 root root    144 1980-01-01 00:00 FineTune_Digital
-rw-r--r-- 1 root root    188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-AirA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-AirD
-rw-r--r-- 1 root root  40000 1980-01-01 00:00 map-CableA
-rw-r--r-- 1 root root 292000 1980-01-01 00:00 map-CableD
-rw-r--r-- 1 root root      4 1980-01-01 00:00 map-ChKey
-rw-r--r-- 1 root root 144000 1980-01-01 00:00 map-SateD
-rw-r--r-- 1 root root     95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r-- 1 root root   5382 1980-01-01 00:00 PLDAT
-rw-r--r-- 1 root root    720 1980-01-01 00:00 RadioMap
-rw-r--r-- 1 root root   7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r-- 1 root root    324 1980-01-01 00:00 ServiceProviders
-rw-r--r-- 1 root root   9478 1980-01-01 00:00 SSDAT
-rw-r--r-- 1 root root  98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r-- 1 root root     28 1980-01-01 00:00 TSIDList
-rw-r--r-- 1 root root      4 1980-01-01 00:00 UserTransponderDataBase.dat 
  • You should get structure on USB/restore:

./restore:

drwxrwxrwx  2 root       root         4096 2010-12-27 21:47 .
drwx------ 10 root       root         4096 2010-12-27 20:14 ..
-rw-r--r--  1 root       root         2304 1980-01-01 00:00 Clone.dat
-rw-r--r--  1 root       root          378 1980-01-01 00:00 FADAT
-rw-r--r--  1 root       root          144 1980-01-01 00:00 FineTune_Digital
-rw-r--r--  1 root       root          188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r--  1 root       root        40000 1980-01-01 00:00 map-AirA
-rw-r--r--  1 root       root       292000 1980-01-01 00:00 map-AirD
-rw-r--r--  1 root       root        40000 1980-01-01 00:00 map-CableA
-rw-r--r--  1 root       root       292000 1980-01-01 00:00 map-CableD
-rw-r--r--  1 root       root            4 1980-01-01 00:00 map-ChKey
-rw-r--r--  1 root       root       144000 1980-01-01 00:00 map-SateD
-rw-r--r--  1 root       root           95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r--  1 root       root         5382 1980-01-01 00:00 PLDAT
-rw-r--r--  1 root       root          720 1980-01-01 00:00 RadioMap
-rw-r--r--  1 root       root         7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r--  1 root       root          324 1980-01-01 00:00 ServiceProviders
-rw-r--r--  1 root       root         9478 1980-01-01 00:00 SSDAT
-rw-r--r--  1 root       root        98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r--  1 root       root           28 1980-01-01 00:00 TSIDList
-rw-r--r--  1 root       root            4 1980-01-01 00:00 UserTransponderDataBase.dat 
  • Whole USB structure you have to get:

./:

drwx------ 10 perforator perforator  4096 2010-12-27 21:57 .
drwxr-xr-x  4 root       root        4096 2010-12-27 21:35 ..
-rwxrwxrwx  1 root       root       23443 2010-12-23 13:55 channel_list_LE32C550_1001.scm
-rwxrwxrwx  1 perforator root        4635 2010-12-27 16:08 first_run.sh
drwxrwsrwx  2 root       root        4096 2010-12-23 14:50 link0_Clone
lrwxrwxrwx  1 root       root          29 2010-12-27 20:14 link0_Temp -> /mtd_rwarea/usb_mount/usb_cmd
drwxrwsrwx  2 root       root        4096 2010-12-23 14:50 link1_Clone
lrwxrwxrwx  1 root       root          31 2010-12-27 20:14 link1_Temp -> /mtd_rwarea/usb_mount/usb_mount
drwxrwxrwx  5 root       root        4096 2010-12-24 03:32 modules
drwxrwxrwx  8 root       root        4096 2010-12-27 14:04 opt
drwxrwxrwx  2 root       root        4096 2010-12-27 21:47 restore
drwxrwsrwx  3 root       root        4096 2010-12-23 14:04 T-MSX5DEUC
drwxrwsrwx  3 root       root        4096 2010-12-23 14:04 T-TDT5DEUC
drwxrwxrwx  3 root       root        4096 2010-12-24 00:10 T-VALDEUC
./link0_Clone:
drwxrwsrwx  2 root       root       4096 2010-12-23 14:50 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 .. 
./link1_Clone:
drwxrwsrwx  2 root       root       4096 2010-12-23 14:50 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
./modules:
drwxrwxrwx  5 root       root       4096 2010-12-24 03:32 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
drwxrwsrwx  5 root       root       4096 2010-12-27 14:07 T-MSX5DEUC
drwxrwsrwx  5 root       root       4096 2010-12-24 04:17 T-TDT5DEUC
drwxrwxrwx  5 root       root       4096 2010-12-24 04:18 T-VALDEUC
./modules/T-MSX5DEUC:

drwxrwsrwx 5 root root 4096 2010-12-27 14:07 .
drwxrwxrwx 5 root root 4096 2010-12-24 03:32 ..
drwxrwxrwx 3 root root 4096 2010-12-27 14:06 etc
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 lib
drwxrwxrwx 4 root root 4096 2010-12-27 17:12 usr

./modules/T-MSX5DEUC/etc:

drwxrwxrwx 3 root root 4096 2010-12-27 14:06 .
drwxrwsrwx 5 root root 4096 2010-12-27 14:07 ..
drwxrwxrwx 3 root root 4096 2010-12-27 14:07 init.d

./modules/T-MSX5DEUC/etc/init.d:
drwxrwxrwx 3 root root 4096 2010-12-27 14:07 .
drwxrwxrwx 3 root root 4096 2010-12-27 14:06 ..
drwxrwxrwx 2 root root 4096 2010-12-27 14:07 startup_run_once

./modules/T-MSX5DEUC/etc/init.d/startup_run_once:

drwxrwxrwx 2 root root 4096 2010-12-27 14:07 .
drwxrwxrwx 3 root root 4096 2010-12-27 14:07 ..
-rwxrwxrwx 1 root root  240 2010-12-27 01:38 0_20_insmod.init

./modules/T-MSX5DEUC/lib:

drwxrwxrwx 3 root root 4096 1970-01-01 03:02 .
drwxrwsrwx 5 root root 4096 2010-12-27 14:07 ..
drwxrwxrwx 2 root root 4096 1970-01-01 03:02 modules

./modules/T-MSX5DEUC/lib/modules:

drwxrwxrwx 2 root root   4096 1970-01-01 03:02 .
drwxrwxrwx 3 root root   4096 1970-01-01 03:02 ..
-rwxrwxrwx 1 root root 405132 1970-01-01 03:02 cifs.ko
-rwxrwxrwx 1 root root 136636 1970-01-01 03:02 lockd.ko
-rwxrwxrwx 1 root root 290572 1970-01-01 03:02 nfs.ko
-rwxrwxrwx 1 root root 342380 1970-01-01 03:02 sunrpc.ko
./modules/T-MSX5DEUC/usr:

drwxrwxrwx 4 root root 4096 2010-12-27 17:12 .
drwxrwsrwx 5 root root 4096 2010-12-27 14:07 ..
drwxrwxrwx 2 root root 4096 2010-12-27 14:07 bin
drwxrwxrwx 2 root root 4096 2010-12-27 14:07 sbin

./modules/T-MSX5DEUC/usr/bin:

drwxrwxrwx 2 root root    4096 2010-12-27 14:07 .
drwxrwxrwx 4 root root    4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 root root 1625796 1970-01-01 03:02 busybox

./modules/T-MSX5DEUC/usr/sbin:

drwxrwxrwx 2 root root 4096 2010-12-27 14:07 .
drwxrwxrwx 4 root root 4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 root root  138 1970-01-01 03:02 platform.sh

./modules/T-TDT5DEUC:

drwxrwsrwx 5 root root 4096 2010-12-24 04:17 .
drwxrwxrwx 5 root root 4096 2010-12-24 03:32 ..
drwxrwsrwx 3 root root 4096 2010-12-24 03:46 etc
drwxrwsrwx 3 root root 4096 2010-12-25 18:36 lib
drwxrwsrwx 4 root root 4096 2010-12-27 17:12 usr

./modules/T-TDT5DEUC/etc:

drwxrwsrwx 3 root root 4096 2010-12-24 03:46 .
drwxrwsrwx 5 root root 4096 2010-12-24 04:17 ..
drwxrwsrwx 3 root root 4096 2010-12-24 03:47 init.d

./modules/T-TDT5DEUC/etc/init.d:

drwxrwsrwx 3 root root 4096 2010-12-24 03:47 .
drwxrwsrwx 3 root root 4096 2010-12-24 03:46 ..
drwxrwsrwx 2 root root 4096 2010-12-24 17:39 startup_run_once

./modules/T-TDT5DEUC/etc/init.d/startup_run_once:

drwxrwsrwx 2 root root 4096 2010-12-24 17:39 .
drwxrwsrwx 3 root root 4096 2010-12-24 03:47 ..
-rwxrwxrwx 1 root root  240 2010-12-27 01:38 0_20_insmod.init

./modules/T-TDT5DEUC/lib:

drwxrwsrwx 3 root root 4096 2010-12-25 18:36 .
drwxrwsrwx 5 root root 4096 2010-12-24 04:17 ..
drwxrwsrwx 2 root root 4096 2010-12-24 04:19 modules

./modules/T-TDT5DEUC/lib/modules:

drwxrwsrwx 2 root root   4096 2010-12-24 04:19 .
drwxrwsrwx 3 root root   4096 2010-12-25 18:36 ..
-rwxrwxrwx 1 root root  62972 2010-12-11 00:00 auth_rpcgss.ko
-rwxrwxrwx 1 root root 399356 2010-12-11 00:00 cifs.ko
-rwxrwxrwx 1 root root  41076 1980-01-01 00:00 isofs.ko
-rwxrwxrwx 1 root root 106436 2010-12-11 00:00 lockd.ko
-rwxrwxrwx 1 root root 405780 2010-12-11 00:00 nfs.ko
-rwxrwxrwx 1 root root  15080 2010-12-11 00:00 rpcsec_gss_krb5.ko
-rwxrwxrwx 1 root root 105104 2010-12-11 00:00 smbfs.ko
-rwxrwxrwx 1 root root 240652 2010-12-11 00:00 sunrpc.ko
-rwxrwxrwx 1 root root 127728 1980-01-01 00:00 udf.ko

./modules/T-TDT5DEUC/usr:

drwxrwsrwx 4 root root 4096 2010-12-27 17:12 .
drwxrwsrwx 5 root root 4096 2010-12-24 04:17 ..
drwxrwsrwx 2 root root 4096 2010-12-25 18:36 bin
drwxrwsrwx 2 root root 4096 2010-12-27 14:10 sbin

./modules/T-TDT5DEUC/usr/bin:

drwxrwsrwx 2 root root    4096 2010-12-25 18:36 .
drwxrwsrwx 4 root root    4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 root root 1694608 1980-01-01 00:00 busybox

./modules/T-TDT5DEUC/usr/sbin:
итого 12
drwxrwsrwx 2 root       root 4096 2010-12-27 14:10 .
drwxrwsrwx 4 root       root 4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 perforator root  138 2010-12-24 17:40 platform.sh

./modules/T-VALDEUC:

drwxrwxrwx 5 root root 4096 2010-12-24 04:18 .
drwxrwxrwx 5 root root 4096 2010-12-24 03:32 ..
drwxrwsrwx 3 root root 4096 2010-12-24 03:46 etc
drwxrwsrwx 3 root root 4096 2010-12-25 18:37 lib
drwxrwsrwx 4 root root 4096 2010-12-27 17:12 usr

./modules/T-VALDEUC/etc:

drwxrwsrwx 3 root root 4096 2010-12-24 03:46 .
drwxrwxrwx 5 root root 4096 2010-12-24 04:18 ..
drwxrwsrwx 3 root root 4096 2010-12-24 03:47 init.d

./modules/T-VALDEUC/etc/init.d:

drwxrwsrwx 3 root root 4096 2010-12-24 03:47 .
drwxrwsrwx 3 root root 4096 2010-12-24 03:46 ..
drwxrwsrwx 2 root root 4096 2010-12-27 14:11 startup_run_once

./modules/T-VALDEUC/etc/init.d/startup_run_once:

drwxrwsrwx 2 root root 4096 2010-12-27 14:11 .
drwxrwsrwx 3 root root 4096 2010-12-24 03:47 ..
-rwxrwxrwx 1 root root  130 2010-12-27 14:11 0_20_insmod.init

./modules/T-VALDEUC/lib:

drwxrwsrwx 3 root root 4096 2010-12-25 18:37 .
drwxrwxrwx 5 root root 4096 2010-12-24 04:18 ..
drwxrwsrwx 2 root root 4096 2010-12-24 04:20 modules

./modules/T-VALDEUC/lib/modules:

drwxrwsrwx 2 root root   4096 2010-12-24 04:20 .
drwxrwsrwx 3 root root   4096 2010-12-25 18:37 ..
-rwxrwxrwx 1 root root 274304 2010-12-03 22:39 cifs.ko

./modules/T-VALDEUC/usr:

drwxrwsrwx 4 root root 4096 2010-12-27 17:12 .
drwxrwxrwx 5 root root 4096 2010-12-24 04:18 ..
drwxrwsrwx 2 root root 4096 2010-12-25 18:37 bin
drwxrwsrwx 2 root root 4096 2010-12-24 17:41 sbin

./modules/T-VALDEUC/usr/bin:

drwxrwsrwx 2 root root   4096 2010-12-25 18:37 .
drwxrwsrwx 4 root root   4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 root root 904544 2010-10-29 01:27 busybox

./modules/T-VALDEUC/usr/sbin:

drwxrwsrwx 2 root       root 4096 2010-12-24 17:41 .
drwxrwsrwx 4 root       root 4096 2010-12-27 17:12 ..
-rwxrwxrwx 1 perforator root  138 2010-12-24 17:41 platform.sh

./opt:

drwxrwxrwx  8 root       root       4096 2010-12-27 14:04 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
drwxrwxrwx  2 root       root       4096 2010-12-27 14:04 bin
drwxrwxrwx  4 root       root       4096 1970-01-01 03:02 etc
drwxrwxrwx  3 root       root       4096 1970-01-01 03:02 lib
drwxrwxrwx  2 root       root       4096 2010-12-27 01:53 sbin
drwxrwxrwx  5 root       root       4096 1970-01-01 03:02 usr
drwxrwxrwx  3 root       root       4096 1970-01-01 03:02 var

./opt/bin:

drwxrwxrwx 2 root root 4096 2010-12-27 14:04 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..

./opt/etc:

drwxrwxrwx 4 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..
drwxrwxrwx 5 root root 4096 2010-12-27 17:03 init.d
drwxrwxrwx 2 root root 4096 2010-12-27 02:16 init.d-disabled

./opt/etc/init.d:

drwxrwxrwx 5 root root 4096 2010-12-27 17:03 .
drwxrwxrwx 4 root root 4096 1970-01-01 03:02 ..
drwxr-xr-x 2 root root 4096 1970-01-01 03:04 start.sh_before_nonblock
drwxrwxrwx 2 root root 4096 2010-12-27 17:10 startup_run_once
drwxrwxrwx 2 root root 4096 2010-12-27 01:37 usb_mount_after

./opt/etc/init.d/start.sh_before_nonblock:

drwxr-xr-x 2 root root 4096 1970-01-01 03:04 .
drwxrwxrwx 5 root root 4096 2010-12-27 17:03 ..
-rwxr-xr-x 1 root root  521 1970-01-01 03:04 0_01_restore_start.sh.init

./opt/etc/init.d/startup_run_once:

drwxrwxrwx 2 root root 4096 2010-12-27 17:10 .
drwxrwxrwx 5 root root 4096 2010-12-27 17:03 ..
-rwxrwxrwx 1 root root 1430 2010-12-27 01:38 0_00_0_emergency_start.init
-rwxrwxrwx 1 root root  422 2010-12-27 17:10 0_10_telnetd.init

./opt/etc/init.d/usb_mount_after:

drwxrwxrwx 2 root root 4096 2010-12-27 01:37 .
drwxrwxrwx 5 root root 4096 2010-12-27 17:03 ..
-rwxrwxrwx 1 root root  243 2010-12-27 01:37 0_00_usbSamyGO.sh.init

./opt/etc/init.d-disabled:

drwxrwxrwx 2 root root 4096 2010-12-27 02:16 .
drwxrwxrwx 4 root root 4096 1970-01-01 03:02 ..

./opt/lib:

drwxrwxrwx 3 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..
drwxrwxrwx 2 root root 4096 2010-12-27 14:05 modules

./opt/lib/modules:

drwxrwxrwx 2 root root 4096 2010-12-27 14:05 .
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 ..

./opt/sbin:

drwxrwxrwx 2 root root 4096 2010-12-27 01:53 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..
-rwxrwxrwx 1 root root  192 2010-12-27 01:40 31337
-rwxrwxrwx 1 root root  652 2010-12-27 01:52 44337794
-rwxrwxrwx 1 root root  178 2010-12-27 01:40 666
-rwxrwxrwx 1 root root  591 2010-12-27 01:53 event.sh

./opt/usr:

drwxrwxrwx 5 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..
drwxrwxrwx 2 root root 4096 2010-12-27 14:05 bin
drwxrwxrwx 2 root root 4096 2010-12-27 17:02 restore
drwxrwxrwx 3 root root 4096 2010-12-27 14:08 sbin

./opt/usr/bin:

drwxrwxrwx 2 root root 4096 2010-12-27 14:05 .
drwxrwxrwx 5 root root 4096 1970-01-01 03:02 ..

./opt/usr/restore:

drwxrwxrwx 2 root root 4096 2010-12-27 17:02 .
drwxrwxrwx 5 root root 4096 1970-01-01 03:02 ..
-rwxr-xr-x 1 root root  213 1970-01-01 03:04 9_9_kill_start.sh_ok.init
-rwxr-xr-x 1 root root  418 1970-01-01 03:04 start.sh
./opt/usr/sbin:

drwxrwxrwx 3 root root 4096 2010-12-27 14:08 .
drwxrwxrwx 5 root root 4096 1970-01-01 03:02 ..
drwxrwxrwx 2 root root 4096 2010-12-27 01:32 usb_mount

./opt/usr/sbin/usb_mount:

drwxrwxrwx 2 root root 4096 2010-12-27 01:32 .
drwxrwxrwx 3 root root 4096 2010-12-27 14:08 ..
-rwxrwxrwx 1 root root  841 2010-12-27 01:32 opt_path
-rwxrwxrwx 1 root root  723 2010-12-27 01:30 unknownDev_cmd
-rwxrwxrwx 1 root root  161 1970-01-01 03:02 usb_cmd
-rwxrwxrwx 1 root root  166 1970-01-01 03:02 usb_moip_cmd
-rwxrwxrwx 1 root root  181 1970-01-01 03:02 usb_mount

./opt/var:

drwxrwxrwx 3 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 8 root root 4096 2010-12-27 14:04 ..
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 spool

./opt/var/spool:

drwxrwxrwx 3 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 ..
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 cron

./opt/var/spool/cron:

drwxrwxrwx 3 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 ..
drwxrwxrwx 2 root root 4096 1970-01-01 03:02 crontabs

./opt/var/spool/cron/crontabs:

drwxrwxrwx 2 root root 4096 1970-01-01 03:02 .
drwxrwxrwx 3 root root 4096 1970-01-01 03:02 ..
./restore:

drwxrwxrwx  2 root       root         4096 2010-12-27 21:47 .
drwx------ 10 perforator perforator   4096 2010-12-27 21:57 ..
-rw-r--r--  1 root       root         2304 1980-01-01 00:00 Clone.dat
-rw-r--r--  1 root       root          378 1980-01-01 00:00 FADAT
-rw-r--r--  1 root       root          144 1980-01-01 00:00 FineTune_Digital
-rw-r--r--  1 root       root          188 1980-01-01 00:00 LNBSettingsDataBase.dat
-rw-r--r--  1 root       root        40000 1980-01-01 00:00 map-AirA
-rw-r--r--  1 root       root       292000 1980-01-01 00:00 map-AirD
-rw-r--r--  1 root       root        40000 1980-01-01 00:00 map-CableA
-rw-r--r--  1 root       root       292000 1980-01-01 00:00 map-CableD
-rw-r--r--  1 root       root            4 1980-01-01 00:00 map-ChKey
-rw-r--r--  1 root       root       144000 1980-01-01 00:00 map-SateD
-rw-r--r--  1 root       root           95 1980-01-01 00:00 PackageDataBase.dat
-rw-r--r--  1 root       root         5382 1980-01-01 00:00 PLDAT
-rw-r--r--  1 root       root          720 1980-01-01 00:00 RadioMap
-rw-r--r--  1 root       root         7979 1980-01-01 00:00 SatDataBase.dat
-rw-r--r--  1 root       root          324 1980-01-01 00:00 ServiceProviders
-rw-r--r--  1 root       root         9478 1980-01-01 00:00 SSDAT
-rw-r--r--  1 root       root        98554 1980-01-01 00:00 TransponderDataBase.dat
-rw-r--r--  1 root       root           28 1980-01-01 00:00 TSIDList
-rw-r--r--  1 root       root            4 1980-01-01 00:00 UserTransponderDataBase.dat

./T-MSX5DEUC:

drwxrwsrwx  3 root       root       4096 2010-12-23 14:04 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
drwxrwsrwx  2 root       root       4096 2010-12-27 15:50 Clone
./T-MSX5DEUC/Clone:

drwxrwsrwx 2 root       root 4096 2010-12-27 15:50 .
drwxrwsrwx 3 root       root 4096 2010-12-23 14:04 ..
-rwxrwxrwx 1 root       root  256 2010-12-27 15:58 Clone.dat
-rwxrwxrwx 1 perforator root  319 2010-12-27 15:50 link0
-rwxrwxrwx 1 perforator root   39 2010-12-27 15:50 link1

./T-TDT5DEUC:

drwxrwsrwx  3 root       root       4096 2010-12-23 14:04 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
drwxrwsrwx  2 root       root       4096 2010-12-27 14:13 Clone
./T-TDT5DEUC/Clone:

drwxrwsrwx 2 root       root 4096 2010-12-27 14:13 .
drwxrwsrwx 3 root       root 4096 2010-12-23 14:04 ..
-rwxrwxrwx 1 root       root  256 2010-12-27 15:58 Clone.dat
-rwxrwxrwx 1 perforator root  319 2010-12-27 15:50 link0
-rwxrwxrwx 1 perforator root   39 2010-12-27 15:50 link1

./T-VALDEUC:

drwxrwxrwx  3 root       root       4096 2010-12-24 00:10 .
drwx------ 10 perforator perforator 4096 2010-12-27 21:57 ..
drwxrwxrwx  2 root       root       4096 2010-12-27 14:16 Clone

./T-VALDEUC/Clone:

drwxrwxrwx 2 root       root 4096 2010-12-27 14:16 .
drwxrwxrwx 3 root       root 4096 2010-12-24 00:10 ..
-rwxrwxrwx 1 root       root  256 2010-12-27 15:58 Clone.dat
-rwxrwxrwx 1 perforator root  319 2010-12-27 15:50 link0
-rwxrwxrwx 1 perforator root   39 2010-12-27 15:50 link1 

13. Exit from Hotel mode:

  • Go to ServiceMenu
Info - Menu - Mute - Power
  • Hotel Mode ->Off

14. Attach USB to TV and import channel settings to TV. Everything must go w/o errors.
15. Activate Hotel mode again 16. Import HotelMode settings you exported before (as is, with directories) 17. Press OK. 18. TV restarts twice and starts in black screen. DO NOT POWER OFF, DO NOT DISCONNECT USB.

  • Wait 3 minutes. After trhee minutes or if you get to console earlier you can reboot TV.
  • Try connect to TV over telnet (port:23)
  • If you get to console, congratulations.
  • TV starts in Hotel mode. If you have your channel settings right, you can deactivate hotel mode from service menu.

19. If you haven`t got your channels back and if you can`t telnet to TV, it means - something went wrong

  • Look for file first_run.ok and content of directory /result on USB

20. If you have telnet after hack, execute:

cp $OPT_DIR/usr/restore/start.sh /mtd_rwarea/start.sh

Do not have linux and TV is not hacked

Normal operating of hacked TV

Ways to unbrick TV

FAQ =

Tested on those models

  • LE 32-C550J1W [T-MSX5DEUC-2005.4]
  • LE 40-C550 [T-MSX5DEUC-2003.1]
  • LE 32-C530 [T-MSX5DEUC-2007.4]
  • LE 32-C550J1WUA [T-MSX5DEUC-2007.4]
  • LE 32-C550J1WXRU [T-MSX5DEUC-2005.4]
  • UE 32-C5100QW [T-MSX5DEUC-2007.4]
  • PS 50-C550 [T-TDT5DEUC]
  • LE 40-C650L1WXXH [T-VALDEUC-2002]

TO be updated in few days

--Juzis28 20:21, 5 January 2011 (UTC)