FORUMS
Remove All Ads from XDA

Rooting MediaTek Based Linux Smart TV

60 posts
Thanks Meter: 20
 
By borillion_star, Member on 4th July 2015, 11:36 PM
Post Reply Email Thread
25th November 2018, 05:13 AM |#181  
Junior Member
Thanks Meter: 12
 
More
hi, i just found this thread but the search tool did not found this info so i hope it helps:

https://github.com/jamesyan84/mt5507_android_4.4
Almost complete dump of source code for TCL tvs based on mediatek MT5507.

Then there is this project: https://github.com/prototux/TCL-TV-reverse-engineering

Happy reading, compiling, hacking
 
 
25th November 2018, 09:47 PM |#182  
Junior Member
Thanks Meter: 0
 
More
Install apk files hisense 39n2170pw powered by VIDAA
Hi there, I just bought this Hisense tv as a smart Tv, thinking im going to install apk files like iptv, and all the stuff, i failed because i have discovered on the pack ;powered by VIDAA; i saw an app store written N when i got in, its crap. it got a build in browser when you get in , there are only build in search engines, no browser with an address bar. countries location is limited to ARAB countries. when i tried doing some search with my pc, i discovered tv is using Linux portal interface ui. by NETRANGE.COM. so the app store is from netrange. i even tried locating the root folder, nothing which mean i cant download to tv memory. please i need help here, to run android on this tv, or if theres any other way i can get iptv on it, then fine.
Thanks in advance!
6th February 2019, 05:10 PM |#183  
Junior Member
Thanks Meter: 0
 
More
I’ve got Sony XF9005 main board (1-983-249-21) which does not have serial/IR ports (EU model with sat tuner and CAM). CPU is marked MT5832 (not MT5891)

A few questions:

- does anyone know whether 1.8V uart should be available somewhere or uart ports are just blocked at boot?
- are there known software to connect to serial over usb at boot (over usb otg)?
7th February 2019, 02:20 PM |#184  
Member
Thanks Meter: 27
 
More
Quote:
Originally Posted by sendx

I’ve got Sony XF9005 main board (1-983-249-21) which does not have serial/IR ports (EU model with sat tuner and CAM). CPU is marked MT5832 (not MT5891)

A few questions:

- does anyone know whether 1.8V uart should be available somewhere or uart ports are just blocked at boot?
- are there known software to connect to serial over usb at boot (over usb otg)?

For example, my Panasonic does not have a debug output on connector 3.5 or any other external connector.
According to the service manual, a special debugging connector - inside the TV
10th February 2019, 02:45 PM |#185  
Inactive Recognized Developer
Thanks Meter: 74
 
More
L99
Quote:
Originally Posted by sendx

I’ve got Sony XF9005 main board (1-983-249-21) which does not have serial/IR ports (EU model with sat tuner and CAM). CPU is marked MT5832 (not MT5891)

A few questions:

- does anyone know whether 1.8V uart should be available somewhere or uart ports are just blocked at boot?
- are there known software to connect to serial over usb at boot (over usb otg)?

On my TCL U65P6046 Android TV with a MT5658 chipset, the 3.3V UART service port is wired on the USB 2.0 port (service port):
Code:
GND = pin 5  GND 		black
TX  = pin 9  MicB_SSRX- 	purple (connect to RX of USB-UART adapter)
RX  = pin 10 MicB_SSRX+ 	orange (connect to TX of USB-UART adapter)
The upgrade.pkg AES encryption key is exposed in the bootlog during firmware upgrade
28th February 2019, 12:37 PM |#186  
Junior Member
Flag near Bremen
Thanks Meter: 0
 
More
Got a Thomson 32FD5506 with "Smart TV3" based on Linux.. How to get access to root there? I only found something to "Smart TV2" ?!
14th May 2019, 02:16 PM |#187  
Junior Member
Thanks Meter: 0
 
More
Quote:
Originally Posted by neoxitric

I changed some settings in keyboard*.JS in UI directory but, i had no success remapping the wuaki button to amazon APP.

Maybe it's a setting not in UI directory?! Anyone changed the function of buttons on remote control? Any hint would be great!!!

For Hisense LTDN58K700XWTSEU3D

1. Go to /3rd_rw/UI/hisenseUI/keyboard/
2. Open file keyboard_EU.js (config for Russia & Europe)
3. Change the line 31: SYSCMD_KEYCODE_MAP[guijs.SYSCMD_INFO] = VK_INFO;
to SYSCMD_KEYCODE_MAP[guijs.SYSCMD_INFO] = VK_AMAZON; // AMAZON selected because it is not relevant for Russia
4. Go to /3rd_rw/UI/hisenseUI/modulePages/appPages/
5. Open file amazon.js
6. Change the line 36 & 40 to :
sendAM(':am,am,:start=[tv_store,-u,link to your application]')
and line 46
sendAM(":am,am,:stop=tv_store")

7. Reload TV
8. Сlick "info" button -> your application start up
28th July 2019, 08:34 PM |#188  
Junior Member
Thanks Meter: 1
 
More
Quote:
Originally Posted by jockyw2001

L99
On my TCL U65P6046 Android TV with a MT5658 chipset, the 3.3V UART service port is wired on the USB 2.0 port (service port):

Code:
GND = pin 5  GND 		black
TX  = pin 9  MicB_SSRX- 	purple (connect to RX of USB-UART adapter)
RX  = pin 10 MicB_SSRX+ 	orange (connect to TX of USB-UART adapter)
The upgrade.pkg AES encryption key is exposed in the bootlog during firmware upgrade



can you please share the AES key
edit
i managed to extract the RSA and AES from the tv but when i use the key to decrypt the header the result differs from the log decrypted header by the first 16 bytes so i think we may need an IV to properly decrypt the firmware
Code:
##########RSA public key######
6d 42 9c 74 61 88 f8 28 7f 29 17 0e 12 15 41 02    mB.ta..(.)....A.
9b f2 5d 65 ea 73 b9 b2 a3 64 61 b7 f0 c8 57 a4    ..]e.s...da...W.
ae d9 2b 93 e8 bf 01 ba d4 4e b2 07 50 02 62 42    ..+......N..P.bB
37 c1 b9 dd 88 b4 c4 c6 1f 52 4e d9 7f 4f 65 82    7........RN..Oe.
e2 13 1a d8 53 f6 1f a7 49 b8 b0 36 a4 76 42 a5    ....S...I..6.vB.
07 c9 12 81 f4 51 b1 1d 7d 5c 1c 7b e1 84 2f b2    .....Q..}\.{../.
7f 64 6e a2 c4 29 6f 5d 0b b4 50 bd cd e0 b5 69    .dn..)o]..P....i
4b 37 cc 7d b7 8d e2 c8 4d ea 5a 0a d4 b2 12 5f    K7.}....M.Z...._
e8 ec 96 6e c2 ff 03 f4 07 61 36 02 47 85 23 ad    ...n.....a6.G.#.
4b 8b ec fa 44 2a 33 3f 37 e7 54 06 81 eb c7 bf    K...D*3?7.T.....
8b 0c e1 67 dd b4 78 81 03 a3 ce ab 2d 62 60 3d    ...g..x.....-b`=
c5 04 95 9c 36 f6 fe ce ff 25 29 ef eb 80 08 83    ....6....%).....
37 cc a0 b1 e2 fd 10 e2 aa 80 26 f8 29 34 b3 c5    7.........&.)4..
44 c5 5c 31 f6 13 95 bd 88 a2 6d 0e dc 3d 5b 89    D.\1......m..=[.
5b 93 bb 52 96 a0 75 08 b2 17 b8 24 a9 e4 12 b8    [..R..u....$....
5e 58 9a c0 8a d9 d0 c1 9f c8 84 89 e0 b1 29 af    ^X............).

##########aes key######
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55    UUUUUUUUUUUUUUUU

##########AES Key######
b1 bf aa 40 7f 70 c8 0c 65 03 79 df ea fa a4 0f    [email protected]
9th August 2019, 04:10 PM |#189  
Inactive Recognized Developer
Thanks Meter: 74
 
More
I had to tweak epk2extract a little bit and it works perfect and my MTK.key includes:
Code:
55555555555555555555555555555555,B1BFAA407F70C80C650379DFEAFAA40F // TCL 2017
13th August 2019, 11:16 AM |#190  
Junior Member
Thanks Meter: 1
 
More
Quote:
Originally Posted by jockyw2001

I had to tweak epk2extract a little bit and it works perfect and my MTK.key includes:

Code:
55555555555555555555555555555555,B1BFAA407F70C80C650379DFEAFAA40F // TCL 2017

grait!
did you get the .pak files decrypted or just extracted?
can you email smx-smx (epk2extract author) with the details so he could add it to the tool's source
im trying to get the tool to decrypt the paks but still fail
The main header structure is the same i just added vender magic "TCL\0"
firmware magic is present "#[email protected]" but i cant find MTK_RESERVED_MAGIC
there is a static 16bytes (9BF7ED4FDA262A8E58FC63CF38F6E8A9) in every pak header, is that the MTK_RESERVED_MAGIC?
Post Reply Subscribe to Thread

Tags
exploit, hisense, linux, root, smart tv

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes