SamyGO for DUMMIES


From SamyGO
Revision as of 22:30, 26 January 2011 by Marcelru (talk | contribs)
Jump to: navigation, search

I think we have a problem here in SamyGO. Older members tend to know a lot about embedded systems and their operating systems, but some newbies don't seem to know how to execute basic programs... We thought that every one would know that, because of its relative simplicity. But we are wrong there. Also the Wiki pages are too overwhelming for some newbies.

I think we needed to create a wiki page `SamyGO for DUMMIES" and divert all newbies to that article before starting. The article might mention about how you could execute programs on a TV or copy them to internal TV memory etc. Easy things, which we don't feel the need to talk a lot about.


So I created this page. Me and others will fill this area later on to show simple processes. Also put pictures about running steps of external applications from TV etc...

What is SamyGO?

SamyGO started in the summer of 2009 as a thread at avsforum, under the title "Samsung LNXXA650 InfoLink hacking". This thread drew a lot of attention and slowly strayed away from its original topic towards rooting TV's and firmware hacking. It also got quite long, so Erdem U. Altinyurt and a few others decided to start a sourceforge project, specific for enhancement of the firmware of Samsung TV-sets, specifically aimed at models issued from 2008 onwards. Many people stayed on and came along from avsforum to sourceforge.

So that is what SamyGO is: A sourceforge project, aimed at enhancing firmware and functionality, specifically for Samsung TV models from 2008 onwards.

The activities of the SamyGO project comprise, but are not limited to:

  1. Gaining access to all available Samsung TV models from 2008 onwards (rooting).
  2. Active development of software extensions to enhance Samsung TV accessibility.
  3. Active development of applications to run on Samsung TV hardware.
  4. Giving support to project members who want to enhance their TV's functionality.

SamyGO is not a program that you can "just run" on your TV. Enhancing your hardware is not THAT simple. It requires some beginner and intermediate computer skills. The community will support you and is committed to helping you make this work for you. Remember however, that you need to do your part too. Read and try to understand. If you don't understand, ask in the appropriate forum. Proceed only once you understand what it is you are trying to achieve.

I want more functionality from my TV. What do I need to do?

  1. Find out whether your TV model is supported by SamyGO. See the supported models list at our homepage for that.
  2. Find out which firmware version your TV is equipped with. Newer firmwares are not (yet) supported by SamyGO. See also the supported models list.
  3. Checkout the access route for your TV, again, this is in the supported models list.
  4. Get access! Follow the tutorials in the Wiki pages for that.
  5. Install the software you like/need.
  6. Enjoy your improved equipment.

Each of these steps will be explained briefly.

What is my TV model code and number ?

Ue40b7020 model.png

Model code and number are almost the same thing. The model number is a short form of the model code. This is a sample model code with the model number written bold.

UE40B7020WWXXC

You can read your model code from the sticker at the side or rear of your TV. Once you found the model, you can check whether it is supported by SamyGO here for A- and B-series and here for C-series models.

What is my firmware model and version ?

You can learn your firmware number by entering the Service Menu. PROCEED WITH GREAT CAUTION.

Do not change anything in the service menu until you understand what each setting does. The service menu is like entering the BIOS in a computer. It's where changes can be made to the "brain" that controls television functions. Making the wrong choice in a setting can result in a completely unexpected result and brick your television. To navigate the Service menu ONLY use the up and down button. Use enter to select and the previous button to return to the previous screen. DO NOT USE the RIGHT and LEFT buttons of your remote while navigating the service menu unless you know what you are trying to do. Using the left and right navigation butttons may change some variables that may easily brick your TV. If you do make a change to a menu, do not panic. Simply navigate in the opposite direction until the original variable is visible. This is by default the selected option.

To identify your firmware version you only need to enter the main screen of the service menu. You do not need to navigate to other Service menu pages. Identification of your firmware version is important to determine whether your television firmware is supported by SamyGO here for A- and B-series and here for C-series models. You exit the Service menu by turning off the television.

Is my TV a CI or a CI+ device?

Samsung has implemented increasing encryption with each series of televsions it releases. Earlier models had no firmware encryption, subsequent firmware releases have XORcipher encryption and the latest firmware releases utilize both AES and XOR encryption. This encryption limits how much editing of a firmware can be done despite the fact that the software Samsung uses is opensource and publicly available from Samsung per GNU and GPL licensing terms. Knowing the type of firmware utilized is important because it determines what kind of access you can obtain in your television's operating system. There are two types of firmwares based on access, CI and CI+ devices.

A television from the C series is always a CI+ device. B series models have two possibilities: If there is a P in the last part of the model code, it is most likely a CI+ device. The firmware version installed on these TV's has the letters CIP in the firmware version code. Otherwise it is probably a CI device. A series devices do not have encryption.

Some examples:

LE40B652T4WXXU device uses T-CHL7DEUC firmware, which indicates it is a CI device.
LE40B652T2PXXU device uses T-CHLCIPDEUC firmware, which indicates it is a CI+ device.
UE40B7020WWXXC device uses T-CHU7DEUC firmware, which indicates it is a CI device.
TODO: Add some UN,UE and PS model "codes" here.

You can also find your firmware name and version number in the Service Menu. This is important to know because there are different software solutions depending on whether your TV is a CI or a CI+ device. Software developers frequently develop two versions of software to support these two types of firmwares. It's up to you to select the right one for your Television.

What are Restricted Firmwares?

Restricted Firmwares are original Samsung firmwares which have been released after 01 February 2010. These firmwares have been restricted in many ways by Samsung and have limited how much access one can gain inside their television's operating system. Here in the SamyGO community, we believe this is a deliberate effort to hinder and disable our software development efforts.

Functions that have been removed by the release of these Restricted Firmwares are:

  • ExLink Access , that allows us Serial connection to TV's bash line.
  • Removal of Top Debug Menu that let us allow to configure every property of TV.
  • Removal of u-boot code for that we use to run External firmwares and un-bricking TV.
  • Removal of program copy and execution ability from USB disks.
  • Removal of Alternative firmware firmware section to avoid reverting older firmwares.
  • Additional security enhancements to avoid to flash hacked firmwares.

(*TODO: Anything that I forgot?")

If you are interested in applying any of the SamyGO software enhancements to your television's firmware, it's better not to have received any of these firmwares. However, do not despair if you have had your television crippled by these "updates". The ingenuity and hard work of the developers of the SamyGO community have found several work-arounds that will allow you to restore your television to an older firmware that allows SamyGO applications to run. They have also simplified and automated part of this process as much as it is legally possible.

Unfortunately, if you have a restricted firmware, you can't just plug and play. There are several steps that you need to take to gain back "ownership" of your television. Several steps are involved including, copying programs to your TV memory by using an open vulnerabilities such as the "Children Menu" hack or the Nurislam Trojan. This will allow you to move applications to TV and enjoy additional features currently no possible...

How can I get access to my TV?

With getting access we mean root access to your TV's operating system. Essentially, Samsung TV's are Linux-based embedded systems with a huge display attached to them. To control a Linux-based system, you need root access to it (Administrator privileges in Windows). Depending on the type of TV and version of the firmware, this can be achieved in a number of ways. In the compatibility tables you can find the methods that have been used successfully for each type (The list is not complete yet, work in progress).

Using the Ex-Link port

Many TV models are accessible through a serial port, called Ex-link. This port is addressed in the manuals as "connector for service only". It is a serial port, with a 3.5mm stereo jack as connector. To use it, you will need a serial cable with the right layout, which is given here. On the same page you will find how to enter the service menu of your TV, at least for a number of older types.

Patching Firmware with the SamyGO Firmware Patcher

B-series models (Non CI+) with older firmwares (pre february 2010) have firmware update files which are only trivially encrypted by Samsung. The CI+ firmwares are AES-encrypted. From a few of these firmwares, the encryption keys have been recovered. By decrypting these firmwares, changing some of the startup scripts inside them and subsequently upgrading your TV's firmware with the patched firmware, it is quite easy to get root access through telnet. Telnet is a small program that enables remote access to another computer. For windows, you can use PuTTY. This remote access is required, since (at least at this stage) there is no mouse or keyboard attached to your TV. The use of the SamyGO firmware patcher is explained here.

Using Content Library applications

TODO

Using Internet@TV

TODO

Using Hotel@USB

TODO

Compatibility table (just for evaluation purposes)

Below is a first draft of a new version of a comprehensive compatibility table for SamyGO. It is here for evaluation purposes, please feel free to comment on it in the forum. Since this is a still a draft, not all links are there yet, or working. Also probably not all models have been put in yet, and the ones that are there have not yet been completed, I'm still working on it (especially finding the links into the forum pages is a tough job).

The main changes are:

removal of the display type (I think you know what you bought)

Indication of access routes with letters.

combination of a whole bunch of options into a few columns

Oh, and never mind the thin blank lines in the table, they're just empty table entries.


Note: The SamyGO project is compatible with most of the other LN, LA, UN, or UA model TV's. We just haven't tested them yet. No need to get worried about that.

Table legend
well tested, production level available, but complicated work in progress unavailable
SamyGO compatibility table
TV type CPU Firmware FW Version Rooted via

E: ExLink.
F: FW patcher.
C: Contents lib
I: Internet@TV
H: hotel@usb
O: otherwise

Root Access

T: telnet
S: ssh

Share types
U: UPnP
S: Samba
N: NFS
Options:
A: Video AR
S: subtitles
P: PVR
G: guide+
O: other
Notes
2011 models or D-series
2010 models or C-series
LE26C350D1W MIPS T-MSX5DEUC 2005.4 O Movie player enabled through model change
PSxxC550 MIPS T-TDT5DEUC 1.021
1.023
H T U?,S, N
LExxC550 MIPS T-TDT5DEUC 1.021 H T U?, S, N Internet & games enabled on Trident-based C550s. (Platform has MStar and Tridend based units)
UExxC5100 MIPS T-TDT5DEUC 1004.0 H T U?, S, N
LExxC630 ? T-VAL6DEUC ? ? ? ? ?
LExxC630
LExxC650
LExxC670
LExxC750
ARM T-VALDEUC 1005.0
3003.0
3005.1
I T, S U?, S, N P, G FW version 1005.0 can't enable PVR. Only Italian C630's have VALDEUC firmware.
UExxC6500
UExxC6530
UExxC6700
UExxC6730
UExxC6800
ARM T-VALDEUC 1011.1
2002.0
3003.0
3005.1
I T, S U, S, N P, G C6800 has PVR function by default. FW version 1011.1 can't enable PVR
UNxxC6900 ARM T-VAL6XIBRC ? I T?, S U?, S, N P, G? Brasilian
PSxxC7000
PSxxC7700
ARM T-VALDEUC 3003.0 I T?, S U, S, N P, G?
UExxC7000
UExxC7705
ARM T-VALDEUC 3005.1 I T?, S U, S, N P, G?
PSxxC8000 ARM T-VALDEUC 3003.0 I T, S U, S, N P, G
2009 models or B-series
CI models
LExxB55x
LExxB57x
PSxxB55x
LExxB62x
UExxB6xxx
ARM T-CHL5DEUC 2008.0 E, F T U, S, N A, S Playing movies from USB supported (WiseLink hack).<br\>telnet, Samba/NFS requires USB WiFi/Eth dongle, custom linux kernel from SamyGO OpenEmbedded and a rewrite of the uboot partition with a correct one. And some more manual changes.
LExxB65x
LExxB75x
PSxxB65x
ARM T-CHL7DEUC 2004.1
2005.0
E, F T U, S, N A, S FW 2004.1 has extensive aspect ratio features
UExxB70x0
UExxB8000
PSxxB85x
ARM T-CHU7DEUC 2004.0
2008.2
2009.0
3000.G
E, F, C T U, S, N A, S, P
LNxxB64x ARM T-CHEAUSC 1013.0
1014.0
E, F T U, N I have successfully modified (by hand) the firmware update currently available on Samsung's site. It still allows exlink console.

Telnet was enabled by manually modifying the firmware image. NFS support is built-in to the firmware, the cifs kernel module causes a panic (I will try compiling my own later) and I don't like UPnP so I didn't even try it out.

LNxxB65x
PNxxB65x
LNxxB75x
ARM T-CHEAUSC 1012.3 E, F T U, S, N A, S
LNxxB63x
UNxxB6xxx
ARM T-CHE6AUSC 1012.0 E, F A, S Play movie from USB supported (WiseLink hack). No telnet access (yet).
LNxxB63x
UNxxB6xxx
ARM T-CHE5IBRC 1009.1 E, F A, S No Wiselink hack by Firmware Patcher.
UNxxB7xxx
UNxxB8xxx
ARM T-CHE7AUSC 1013.0 E, F T U, S, N A, S
LAxxB65x
PSxxB65x
LAxxB75x
ARM T-CHL7DAUC 2001.1 E, F T U, S, N A, S
LAxxB65x
PSxxB65x
LAxxB75x
ARM T-CHEAEAC 2005.0 E, F U, S, N A, S
UAxxB7xxx
UAxxB8xxx
ARM T-CHU7DAUC 1008.0 E, F T U, S, N A, S
PSxxB85x ARM T-CHU7DAUC 1007.0 E, F T U, S, N A, S
CI+ models
LExxB55xyyP
LExxB57x?
PSxxB55xTxP
PSxxB56xTxP
LExxB62xTxP
UExxB6xxxVP
ARM T-CHL5CIPDEUC 2007.0 E T Serial (ExLink) access possible via Top Debug Menu memory editing.
LExxB65xTxP
LExxB75xUxP
PSxxB65xyyP
ARM T-CHLCIPDEUC 2006.0 E, F T U, S, N A, S
LExxB679T2S ARM T-CHL6CIPDSEUC 1008.0 E, F T U, S, N A, S
UExxB7xxxWP
UExxB8xxxXP
PSxxB85xYxP
ARM T-CHUCIPDEUC 3000.0 E, F T U, S, N A, S
2008 models or A-series
LExxA75x
LExxA85x
LExxA95x
SH4 T-RBYDEUC 1013.1 F T U, S, N A
LNxxA75x
LNxxA75x
SH4 T-RBYAUSC 1012.2 E T! N telnet needs manual firmware patching or telnetd application.
LNxxA85x
LNxxA86x
SH4 T-SPHAUSC 1004.0 E T! telnet needs manual firmware patching or telnetd application. tester needed for shares
LExxA676 T-AMBDFRC 1017.0 E tester needed for telnet and shares