Rooting MediaTek Based Linux Smart TV

Search This thread
By:
Advanced…
1

1337p

New member
Jun 6, 2017
3
0
I've also found this in /etc/login.sh

Code: 
#!/bin/sh
stty -echo

while true
do
    read line
    # if [ $(echo -n "x${line}" | md5sum | awk '{print $1}') = "e6007a36a7bacfb32502f787431664df" ]; then
    if [ "$line" = "05328087" ]; then
        stty echo
        exit 0
    fi
done

no idea where it's used though :D there could be a shell hidden somewhere..
 
K

Kirby54

New member
Mar 28, 2021
1
0
Hi

i'm not sure but maybe somebody can help, i need to know if it's possible to install any application on a 2020 Hisense TV (model is 43A7100F), that run the Vidaa 3 OS:

www.lcd-compare.com

HISENSE 43A7100F 108 cm sur LCD Compare !

Voir la fiche technique LCD-Compare, les marchands, prix et avis utilisateurs sur le HISENSE 43A7100F - 108 cm
www.lcd-compare.com www.lcd-compare.com

I'm not sure if i need to use a ftp browser to browse the TV config files to install app that are not available on the TV app store ?

Thanks
 
F

fellaw

New member
Jun 2, 2021
2
0
pirate32 said:
The user fellaw posted in neophob com/2010/01/root-my-tv-hack-philips-pfl9703/ about exploiting Busybox DHCP client to get higher access to the TVs, here is the full post (for backup)
Click to expand...
Click to collapse
fellaw here after a looooong time. Sorry to dig out this old thread but I have exciting news in regards to the QN141E 2014 Philip models. I have been just too busy with life to play with the firmware other than quite recently.

With that said: Further analysis showed that there is a simple, permanent entry point even in the latest QN141E_012.003.086.128 firmware.
In particular at boot time some lib looks for a certain script in two locations and executes it if found.
Both locations are in writable filesystems, and normally there is no script in either.

Search order:

1. /3rd_rw/sigma/mtksigma_start_wfd.sh
2. /mnt/usb/sda1/sigma/mtksigma_start_wfd.sh

No. 2 is only triggered if no. 1 is not found.
If no. 2 is not found then there will be an execute error on the console.
Successful execution is logged to the console for either.

/3rd_rw is a persistent filesystem, even over firmware upgrades. Also it does not depend on external devices.
Thus I preferred to drop a script there rather than use USB.

I dropped my script via my initial method.
I used firmware QN141E_012.003.030.128 to exploit CVE-2011-2716 and drop the script via BusyBox ftpd.

As far as I can tell QN141E_012.003.038.128 and beyond are not exploitable via CVE-2011-2716, although the udhcpc binary and it's calling script are identical. Not sure what is going on though, and frankly I lost patience to dig further.

The relevant lib is /basic/lib/libwfd.so. It's used by a core service, /basic/dtv_svc.
Thus I doubt that the entry point is easy to fix other than maybe with signatures.
 
T

tarator.ru

Member
Apr 27, 2019
7
4
Hisense Vidaa TV, how to :

- make a backup of TV settings & apps
- install applications from a USB flash drive
- delete pre-installed apps

Sorry, Russian only. But the video is clear without words
 
a13x501

a13x501

New member
Aug 23, 2021
3
1
p0isk said:
And something interesting. I found AES key for Hisense and some Sharp and Philips TV's.
Code: 
dd if=upgrade_loader.pkg of=header.aes bs=16 count=10
openssl enc -aes-128-cbc -vi 0 -d -K 09291094092910940929109409291094 -in header.aes -out header
hexdump -C header
00000000  68 69 73 65 23 44 48 40 46 69 52 6D 49 44 54 56  |hise#[email protected]|
00000010  04 87 57 42 57 85 B2 F1 4D E0 AA 53 71 2E E6 DE  |.‡WBW…ІсMаЄSq.жЮ|
00000020  5E 3E E1 66 F8 31 4D 4C FE BB 27 CF 34 9A F5 CC  |^>бfш1MLю»'П4љхМ|
00000030  17 2B 9F A0 45 EB 66 BF 10 BA A0 BC 55 79 BF 27  |.+џ*Eлfї.є*јUyї'|
00000040  09 A6 98 A5 B0 02 42 1A A6 7A A2 64 C2 0B 36 5D  |.¦.Ґ°.B.¦zўdВ.6]|
00000050  7D 82 E9 F8 B7 E7 41 5F 64 CD EF B8 FA 69 C5 73  |}‚йш·зA_dНпёъiЕs|
00000060  A9 51 6D 87 B4 5C 17 99 80 FD 3A C5 50 75 37 3B  |©Qm‡ґ\.™Ђэ:ЕPu7;|
00000070  2C CC 0D FD 58 74 A2 38 4D 16 F6 4C F4 B4 1E A8  |,М.эXtў8M.цLфґ.Ё|
00000080  EA BB 1E C9 9F FF EC CE 4C F2 ED 74 E6 B1 E9 D4  |к».ЙџямОLтнtж±йФ|
Hm, first string of header and digest are good, but not other.
Code: 
Header :
35 b3 67 73 08 b5 82 c3 7e d0 9c 0c 40 1c b9 ee    [email protected]
6e 0f be 55 cf 6e 7d 7c c9 e4 16 f6 00 9a f5 cc    n..U.n}|........
17 2b 9f a0 45 eb 66 bf 10 ba a0 bc 55 79 bf 27    .+..E.f.....Uy.'
09 a6 98 a5 b0 02 42 1a dd ac 39 21 c2 0b 36 5d    ......B...9!..6]
10 f6 dc c0 8e d7 1e 3a 11 92 83 d1 94 1c bd 73    .......:.......s
a9 51 6d 87 b4 5c 17 99 80 fd 3a c5 50 75 37 3b    .Qm..\....:.Pu7;
38 b9 d6 10 84 03 94 b2 c3 60 14 9b ed 0b 63 73    8........`....cs

Header :
68 69 73 65 23 44 48 40 46 69 52 6d 49 44 54 56    hise#[email protected]
31 34 30 31 5f 30 30 32 33 30 36 5f 31 32 5f 30    1401_002306_12_0
30 31 5f 33 37 5f 30 30 37 5f 31 39 34 00 00 00    01_37_007_194...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
00 00 00 00 00 00 00 00 7b d6 9b 45 00 00 00 00    ........{..E....
6d 74 35 38 39 30 5f 65 75 5f 6c 69 6e 75 78 00    mt5890_eu_linux.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................

Validate codefile HMAC
open File = /mnt/usb_0/upgrade_loader.pkg
Encrypted digest:
ea bb 1e c9 9f ff ec ce 4c f2 ed 74 e6 b1 e9 d4    ........L..t....
9c f4 dd 7b 1b cc d9 f3 7e 0e 00 2d 80 00 77 cb    ...{....~..-..w.

Download digest
2c cc 0d fd 58 74 a2 38 4d 16 f6 4c f4 b4 1e a8    ,...Xt.8M..L....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
But wait... second string of digest is look like first encrypted string! It's mean that after AES you need apply some operation with previous string. But which operation? Subtract? Maybe, but it does work for header. XOR is the answer!

Conclusion:
+we can sign selfmade firmware
-we can not sign part of firmware (mtk loader, uboot... ): it needed RSA key
-we don't have anything to sign

P.S.: Sharp Android TV based on mt5890 cpu and don't encrypt like Sony. Do you want Hisense Android TV?;)
Click to expand...
Click to collapse
DTV>u
[H-CheckUpgrade]Read flag u1fgAPForceUpdate = 2!
[H-CheckUpgrade]Set u1fgAPForceUpdate =1

Do USB upgrade
hs>>in-upgrade
[H]WakeupReason = 3
u1USBBlock = 0x01d0ab80
USB: Vbus turn up time = 11871 ms, Max =0 ms.
USB-0: insert.
Device High speed.
MGC_HostEnumerator:MGC_EnumStateGetMaxDevice
HubPort-0: Device reset.
Silent Reset: Root device = 0x01d0bb84, Reset.
MGC_HostEnumerator:MGC_EnumStateReset
HubPort-0: Device address = 1.
MGC_HostEnumerator:MGC_EnumStateSetAddress
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: idVendor = 0x0951.
HubPort-0: idProduct = 0x1613.
HubPort-0: bcdDevice = 0x0110.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Lang Id: 0x409.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Manufacturer: Kingston.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Product: DT 101 II.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: SerialNum: 5B871400022A.
MGC_HostEnumerator:MGC_EnumStateSizeConfigs
MGC_HostEnumerator:MGC_EnumStateGetConfigs
MGC_HostEnumerator:MGC_EnumStateConnectDevice
USB Enumerator: find device driver
MGC_HostFindDriver:++
MUSB_TARGET_CLASS case 2:bMatch =1, 0x0,0x0
MUSB_TARGET_CLASS case1:bMatch =1,0x8,0x8
MUSB_TARGET_ACCEPT:bMatch = 1
HubPort-0: Driver support, class = 0x8.
USB Enumerator: Driver support
HubPort-0: Device is accepted.
HubPort-0: Device is accepted.
MGC_HostEnumerator:Connect device complete, bRet=1
MGC_HostEnumerator: break connect device
USB-0: ClassCode= 0x8, u4Diff=239 ms.
MUSB_GetInsert return 1

FIND_CLASS_MASS_STORAGE.
Wait USB medium to be mounted...
LUN = 0-1.
vid = 0x0951, pid = 0x1613, bMediumStatus = 0.
LUN = 0-1.
ID = KingstonDT 101 II PMAP. [RW].
Block size = 512 bytes, Total size = 7646 Mbytes.
MUSB_HfiMediumInserted().
USB Medium on Device, Time = 1742 ms.
USB block size = 512 bytes.
/dev is created.
/mnt is already existed. That is OK.
/dev/usb is created.
/mnt/usb_0 is created.
/dev/usb_0 is mounted as /mnt/usb_0.
[H]Serial product name:Id=27,str=SA5600H,Len=32
[H-ReadTVSerialModel]Tv Serial Model name pkg: usb_SA5600H.pkg
====
[H]Find PKG -> path name: /mnt/usb_0/usb_SA5600H.pkg
Use internal integrity check API
open File = /mnt/usb_0/usb_SA5600H.pkg
Header encrypt by AES
Header :
d7 d2 f5 90 ad 28 09 38 12 37 e5 ac fc f4 fa ba .....(.8.7......
35 8a c0 17 60 ee 85 33 6a 0c 63 9b 8c 64 f7 2d 5...`..3j.c..d.-
bf 86 d7 a5 62 5f e1 b3 aa 50 62 76 a5 f7 f7 5f ....b_...Pbv..._
85 01 fa 58 8b ee 01 89 45 2c ab 27 10 1c ca 79 ...X....E,.'...y
c9 ff 02 07 9e 4b a3 d4 a1 05 c9 67 11 46 e9 69 .....K.....g.F.i
fc 5d 6a b4 fb 9f ad d7 a3 db d0 b8 72 e5 5f 47 .]j.........r._G
c9 b5 ee df e6 1c 06 fd 6e 21 f4 78 85 b0 cd 04 ........n!.x....

Header :
68 69 73 65 23 44 48 40 46 69 52 6d 53 41 35 36 hise#[email protected]
30 30 48 31 00 00 00 00 00 00 00 00 00 00 00 00 00H1............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 ed 1a 40 1f 00 00 00 00 [email protected]
6d 74 35 38 36 33 5f 73 61 5f 37 36 38 5f 6c 69 mt5863_sa_768_li
6e 75 78 00 00 00 00 00 00 00 00 00 00 00 00 00 nux.............

open File = /mnt/usb_0/usb_SA5600H.pkg
Encrypted header:
d7 d2 f5 90 ad 28 09 38 12 37 e5 ac fc f4 fa ba .....(.8.7......
35 8a c0 17 60 ee 85 33 6a 0c 63 9b 8c 64 f7 2d 5...`..3j.c..d.-
bf 86 d7 a5 62 5f e1 b3 aa 50 62 76 a5 f7 f7 5f ....b_...Pbv..._
85 01 fa 58 8b ee 01 89 45 2c ab 27 10 1c ca 79 ...X....E,.'...y
c9 ff 02 07 9e 4b a3 d4 a1 05 c9 67 11 46 e9 69 .....K.....g.F.i
fc 5d 6a b4 fb 9f ad d7 a3 db d0 b8 72 e5 5f 47 .]j.........r._G
c9 b5 ee df e6 1c 06 fd 6e 21 f4 78 85 b0 cd 04 ........n!.x....

Header:
68 69 73 65 23 44 48 40 46 69 52 6d 53 41 35 36 hise#[email protected]
30 30 48 31 00 00 00 00 00 00 00 00 00 00 00 00 00H1............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 ed 1a 40 1f 00 00 00 00 [email protected]
6d 74 35 38 36 33 5f 73 61 5f 37 36 38 5f 6c 69 mt5863_sa_768_li
6e 75 78 00 00 00 00 00 00 00 00 00 00 00 00 00 nux.............

Model_name=SA5600H1

[H]Get this PKG product name: usb_SA5600H1.pkg

[H-MorePkgDetect]The can not find available upgrade files
[H-UsbUpgrade] IsHaveUpgradeFile = 1

Error: No valid upgrade file found or found more than 2 avliable upgrade files, USB upgrade stop
hs>>upgrade-err-USB upgrade stop
[HI]Set Clean block empty status 0.

Apparently this serves only to identify that the file is adequate to be able to use it in the firmware update, it is a check who can make a decoder AND encoder with the AES key to verify that you can use another file by just changing the first lines
(hise # DH @ FiRmSA5600h1) by (hise # DH @ FiRmSA5600h)
 
a13x501

a13x501

New member
Aug 23, 2021
3
1
github.com

GitHub - opensource-hisense/SmartTV-Series9 at 82b65288a9a12b73674184d20c69b9e2adc4a1cc

Productions List: HS32A5600HWB HS43A5600FWB HS39A5600FWB HS32A5605HWB HS43A5605FWB HS49N2173FWB HS32N1800HWB HS43N1800FWB HS50N1800FWB HS32A5608HWB HE39A5600FWTS HE32A5600HWTS HE...
github.com github.com

source code​

Productions List: HS32A5600HWB HS43A5600FWB HS39A5600FWB HS32A5605HWB HS43A5605FWB HS49N2173FWB HS32N1800HWB HS43N1800FWB HS50N1800FWB HS32A5608HWB HE39A5600FWTS HE32A5600HWTS HE43A5600FWTS HE39A5607FWTS HE43A5607FWTS HE32A5800HWTS HX32A5610HWTS HX49N2183FWTS HX43A5610FWTS HE39A5600FWTS(0001) HE43A5600FWTS(0001) HE32A5600HWTS(0001) 40E5600EE 32E…
 
P

p0isk

Member
Sep 3, 2016
19
11
a13x501 said:
DTV>u
[H-CheckUpgrade]Read flag u1fgAPForceUpdate = 2!
[H-CheckUpgrade]Set u1fgAPForceUpdate =1

Do USB upgrade
hs>>in-upgrade
[H]WakeupReason = 3
u1USBBlock = 0x01d0ab80
USB: Vbus turn up time = 11871 ms, Max =0 ms.
USB-0: insert.
Device High speed.
MGC_HostEnumerator:MGC_EnumStateGetMaxDevice
HubPort-0: Device reset.
Silent Reset: Root device = 0x01d0bb84, Reset.
MGC_HostEnumerator:MGC_EnumStateReset
HubPort-0: Device address = 1.
MGC_HostEnumerator:MGC_EnumStateSetAddress
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: idVendor = 0x0951.
HubPort-0: idProduct = 0x1613.
HubPort-0: bcdDevice = 0x0110.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Lang Id: 0x409.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Manufacturer: Kingston.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: Product: DT 101 II.
MGC_HostEnumerator:MGC_EnumStateGetFullDevice
HubPort-0: SerialNum: 5B871400022A.
MGC_HostEnumerator:MGC_EnumStateSizeConfigs
MGC_HostEnumerator:MGC_EnumStateGetConfigs
MGC_HostEnumerator:MGC_EnumStateConnectDevice
USB Enumerator: find device driver
MGC_HostFindDriver:++
MUSB_TARGET_CLASS case 2:bMatch =1, 0x0,0x0
MUSB_TARGET_CLASS case1:bMatch =1,0x8,0x8
MUSB_TARGET_ACCEPT:bMatch = 1
HubPort-0: Driver support, class = 0x8.
USB Enumerator: Driver support
HubPort-0: Device is accepted.
HubPort-0: Device is accepted.
MGC_HostEnumerator:Connect device complete, bRet=1
MGC_HostEnumerator: break connect device
USB-0: ClassCode= 0x8, u4Diff=239 ms.
MUSB_GetInsert return 1

FIND_CLASS_MASS_STORAGE.
Wait USB medium to be mounted...
LUN = 0-1.
vid = 0x0951, pid = 0x1613, bMediumStatus = 0.
LUN = 0-1.
ID = KingstonDT 101 II PMAP. [RW].
Block size = 512 bytes, Total size = 7646 Mbytes.
MUSB_HfiMediumInserted().
USB Medium on Device, Time = 1742 ms.
USB block size = 512 bytes.
/dev is created.
/mnt is already existed. That is OK.
/dev/usb is created.
/mnt/usb_0 is created.
/dev/usb_0 is mounted as /mnt/usb_0.
[H]Serial product name:Id=27,str=SA5600H,Len=32
[H-ReadTVSerialModel]Tv Serial Model name pkg: usb_SA5600H.pkg
====
[H]Find PKG -> path name: /mnt/usb_0/usb_SA5600H.pkg
Use internal integrity check API
open File = /mnt/usb_0/usb_SA5600H.pkg
Header encrypt by AES
Header :
d7 d2 f5 90 ad 28 09 38 12 37 e5 ac fc f4 fa ba .....(.8.7......
35 8a c0 17 60 ee 85 33 6a 0c 63 9b 8c 64 f7 2d 5...`..3j.c..d.-
bf 86 d7 a5 62 5f e1 b3 aa 50 62 76 a5 f7 f7 5f ....b_...Pbv..._
85 01 fa 58 8b ee 01 89 45 2c ab 27 10 1c ca 79 ...X....E,.'...y
c9 ff 02 07 9e 4b a3 d4 a1 05 c9 67 11 46 e9 69 .....K.....g.F.i
fc 5d 6a b4 fb 9f ad d7 a3 db d0 b8 72 e5 5f 47 .]j.........r._G
c9 b5 ee df e6 1c 06 fd 6e 21 f4 78 85 b0 cd 04 ........n!.x....

Header :
68 69 73 65 23 44 48 40 46 69 52 6d 53 41 35 36 hise#[email protected]
30 30 48 31 00 00 00 00 00 00 00 00 00 00 00 00 00H1............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 ed 1a 40 1f 00 00 00 00 [email protected]
6d 74 35 38 36 33 5f 73 61 5f 37 36 38 5f 6c 69 mt5863_sa_768_li
6e 75 78 00 00 00 00 00 00 00 00 00 00 00 00 00 nux.............

open File = /mnt/usb_0/usb_SA5600H.pkg
Encrypted header:
d7 d2 f5 90 ad 28 09 38 12 37 e5 ac fc f4 fa ba .....(.8.7......
35 8a c0 17 60 ee 85 33 6a 0c 63 9b 8c 64 f7 2d 5...`..3j.c..d.-
bf 86 d7 a5 62 5f e1 b3 aa 50 62 76 a5 f7 f7 5f ....b_...Pbv..._
85 01 fa 58 8b ee 01 89 45 2c ab 27 10 1c ca 79 ...X....E,.'...y
c9 ff 02 07 9e 4b a3 d4 a1 05 c9 67 11 46 e9 69 .....K.....g.F.i
fc 5d 6a b4 fb 9f ad d7 a3 db d0 b8 72 e5 5f 47 .]j.........r._G
c9 b5 ee df e6 1c 06 fd 6e 21 f4 78 85 b0 cd 04 ........n!.x....

Header:
68 69 73 65 23 44 48 40 46 69 52 6d 53 41 35 36 hise#[email protected]
30 30 48 31 00 00 00 00 00 00 00 00 00 00 00 00 00H1............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 ed 1a 40 1f 00 00 00 00 [email protected]
6d 74 35 38 36 33 5f 73 61 5f 37 36 38 5f 6c 69 mt5863_sa_768_li
6e 75 78 00 00 00 00 00 00 00 00 00 00 00 00 00 nux.............

Model_name=SA5600H1

[H]Get this PKG product name: usb_SA5600H1.pkg

[H-MorePkgDetect]The can not find available upgrade files
[H-UsbUpgrade] IsHaveUpgradeFile = 1

Error: No valid upgrade file found or found more than 2 avliable upgrade files, USB upgrade stop
hs>>upgrade-err-USB upgrade stop
[HI]Set Clean block empty status 0.

Apparently this serves only to identify that the file is adequate to be able to use it in the firmware update, it is a check who can make a decoder AND encoder with the AES key to verify that you can use another file by just changing the first lines
(hise # DH @ FiRmSA5600h1) by (hise # DH @ FiRmSA5600h)
Click to expand...
Click to collapse
Does Your usb_SA5600H.pkg file contain any partition?
Next step is reading all file's header in upgrade file:
open File = /mnt/usb_0/upgrade_loader.pkg Append file length = 223 Append file length = 52473995 Append file length = 10205 Append file length = 902576 Append file length = 30784 Append file length = 8196 Append file length = 4592 Append file length = 2803992 Append file length = 13396 Append file length = 196672 Append file length = 288271360 Append file length = 257196096 Append file length = 64553024 Append file length = 3213520 Append file length = 512 Process tag "usig" length = 512, 00.00.02.00 _LdrUsigUpgrade, verify key pass, command='1'(0x31) No version defined!! No CC_DISABLE_UART_UPGRADE defined!! download usig percentage = 100 free memory size = 4194304 UID hise open File = /mnt/usb_0/upgrade_loader.pkg Header encrypt by AES Header : 35 b3 67 73 08 b5 82 c3 7e d0 9c 0c 40 1c b9 ee [email protected] 6e 0f be 55 cf 6e 7d 7c c9 e4 16 f6 00 9a f5 cc n..U.n}|........ 17 2b 9f a0 45 eb 66 bf 10 ba a0 bc 55 79 bf 27 .+..E.f.....Uy.' 09 a6 98 a5 b0 02 42 1a dd ac 39 21 c2 0b 36 5d ......B...9!..6] 10 f6 dc c0 8e d7 1e 3a 11 92 83 d1 94 1c bd 73 .......:.......s a9 51 6d 87 b4 5c 17 99 80 fd 3a c5 50 75 37 3b .Qm..\....:.Pu7; 38 b9 d6 10 84 03 94 b2 c3 60 14 9b ed 0b 63 73 8........`....cs Header : 68 69 73 65 23 44 48 40 46 69 52 6d 49 44 54 56 hise#[email protected] 31 34 30 31 5f 30 30 32 33 30 36 5f 31 32 5f 30 1401_002306_12_0 30 31 5f 33 37 5f 30 30 37 5f 31 39 34 00 00 00 01_37_007_194... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 7b d6 9b 45 00 00 00 00 ........{..E.... 6d 74 35 38 39 30 5f 65 75 5f 6c 69 6e 75 78 00 mt5890_eu_linux. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ open File = /mnt/usb_0/upgrade_loader.pkg Append file length = 223 .. Process tag "cfig" length = 223, 00.00.00.df download cfig percentage = 100 free memory size = 4194304 Dynamic Tag No: 0 TagName: load FlashType: 0 PartitionID: 0 Dynamic Tag No: 1 TagName: uenv FlashType: 0 PartitionID: 1 Dynamic Tag No: 2 TagName: kern FlashType: 0 PartitionID: 4 Dynamic Tag No: 3 TagName: kern FlashType: 0 PartitionID: 5 Dynamic Tag No: 4 TagName: rtfs FlashType: 0 PartitionID: 6 Dynamic Tag No: 5 TagName: rtfs FlashType: 0 PartitionID: 7 Dynamic Tag No: 6 TagName: perm FlashType: 0 PartitionID: 9 Dynamic Tag No: 7 TagName: 3rdp FlashType: 0 PartitionID: 10 Dynamic Tag No: 8 TagName: 3rdw FlashType: 0 PartitionID: 11 Dynamic Tag No: 9 TagName: pqda FlashType: 0 PartitionID: 15 Dynamic Tag No: 10 TagName: aqda FlashType: 0 PartitionID: 16 Dynamic Tag No: 11 TagName: logo FlashType: 0 PartitionID: 17 Dynamic Tag No: 12 TagName: adsp FlashType: 0 PartitionID: 20 Dynamic Tag No: 13 TagName: ddb FlashType: 0 PartitionID: 22 Dynamic Tag No: 14 TagName: hdcp FlashType: 0 PartitionID: 23 Dynamic Tag No: 15 TagName: facs FlashType: 0 PartitionID: 24
 
xiaodeng

xiaodeng

Member
Nov 15, 2021
27
10
bernardstef said:
太棒了，伙计们！感谢您提供有关此线程的所有
bernardstef said:
太棒了，伙计们！感谢您提供有关此线程的所有信息！


：笑：

PlyMWkLiWOq_YAwqjXtUO-tzEKlxQYTw0ylsnt1uR7tEfZVVXd0rI_pjqci_XGebPi46MGvbhmvVr6G41UkulaC2kKHHRazFawhc7aJbOJfyQSdMwi4fkg_ixLaV-3_d89Ypii-VPkP3DgNHotBGoEzRsNJFCx912nesvSwWRXdklzT8g6YgrQhRkVJKp0C1x7WsPYegemaYxceNtMB8SpaM5VkcJfG7afmZ2eIJ4U9Xv2CtiJoJXmGODugQrY8oI9m_jvRVBqMIk19OdUOK0Fu-q4RNxvpLLLJiQiXurVO0cIF9gm-FY4QSScu6GYtiqg7H7col_GcGMjcNpypbrVzZO33JOj8pIYClxJJnLotAo_8p2dqi6YQVmm5kv7vhD6fBm-d-ezkXNwwQ8medFvNMqS3mfdoyuoh00LakaWAWsHFus1gFcWGfljqygXBnlat7whJSq2UotKNoj6ywsolRLfXWbizWugMemHXDE0qVh22oFhow4-P4BmfEC8os-R2xH07z6GQxKnwFt_93MJlnpAyUPbUXA5V_kcDZwv-QGG5Zb3i3z3zey-GB3dwDBmNlThJ6QkfHJwhtRr500qEK4adD5IcuvG_GBp4v7Fz2O9d0-g7jdcma0vnbdW2RuzmXg2-2PsKsZUP90Xite4uxGP6OUfh9RQ=w888-h666-no




iUsUPKLxCPHxeLjr48oJBl3mTf3JG9eOXpI4GYqRXwBwd4Kr6Fn69pl3XNxkJBSVrT5m5I6J4X5AChe-klT1TaygRGisRew2plVZ7Lf8XAu3iNa_5DKfZZeDohePSRHOgFFFPKWeWLCUZGecKIEurcMRwTdFObH700sJcBoRjqoTx921Fue3_ZL-xhU2csLHi1tBR8kp_a-BFhcxQGPSAHde6RYfHidrUk-VSf2N8deL0NlfQrxmh9l7USI1U1U41hIDlGQdM6-GgMuFc_nPztEoXAmhNioSqC2q-gVLUgg2whopNcELycAAuR3QRI1BcdLQkXUldZyKSNev6vYZPgKt1JdxqnnZU_Gh5TcPo4MUC55QJwMaaf73dLPBgUJ11pic7SWrHMswPI9xPCgL5OvT6G7WTlFmW5OZMAlM1i0aIex5j939UQpT-gMzwyOp5NuWdo4ZzDzbFSUYEW0ZQADdH8Ce89o4uM85V_Wbaf2t9ppRg6MvAs0c-F6pFPPnH7YstFEVdsQrF9xhPZte3iqhmU_5xNeq7d-mBc8D9N8cgkYFXUZc0IZsTuVh1nOINDwFMznoEPOkZPEeD0Ceg1JqTdfYpS6kwKnAiOXTBYyx_ZwallCcee6d4pUELWHw4OHCPigpaQoVb3GzwNgF4IuNbPXC8gYvMA=w888-h666-no
Click to expand...
Click to collapse
can you tell me how to repack the pkg firmware? thanks
信息！


：笑：

PlyMWkLiWOq_YAwqjXtUO-tzEKlxQYTw0ylsnt1uR7tEfZVVXd0rI_pjqci_XGebPi46MGvbhmvVr6G41UkulaC2kKHHRazFawhc7aJbOJfyQSdMwi4fkg_ixLaV-3_d89Ypii-VPkP3DgNHotBGoEzRsNJFCx912nesvSwWRXdklzT8g6YgrQhRkVJKp0C1x7WsPYegemaYxceNtMB8SpaM5VkcJfG7afmZ2eIJ4U9Xv2CtiJoJXmGODugQrY8oI9m_jvRVBqMIk19OdUOK0Fu-q4RNxvpLLLJiQiXurVO0cIF9gm-FY4QSScu6GYtiqg7H7col_GcGMjcNpypbrVzZO33JOj8pIYClxJJnLotAo_8p2dqi6YQVmm5kv7vhD6fBm-d-ezkXNwwQ8medFvNMqS3mfdoyuoh00LakaWAWsHFus1gFcWGfljqygXBnlat7whJSq2UotKNoj6ywsolRLfXWbizWugMemHXDE0qVh22oFhow4-P4BmfEC8os-R2xH07z6GQxKnwFt_93MJlnpAyUPbUXA5V_kcDZwv-QGG5Zb3i3z3zey-GB3dwDBmNlThJ6QkfHJwhtRr500qEK4adD5IcuvG_GBp4v7Fz2O9d0-g7jdcma0vnbdW2RuzmXg2-2PsKsZUP90Xite4uxGP6OUfh9RQ=w888-h666-no




iUsUPKLxCPHxeLjr48oJBl3mTf3JG9eOXpI4GYqRXwBwd4Kr6Fn69pl3XNxkJBSVrT5m5I6J4X5AChe-klT1TaygRGisRew2plVZ7Lf8XAu3iNa_5DKfZZeDohePSRHOgFFFPKWeWLCUZGecKIEurcMRwTdFObH700sJcBoRjqoTx921Fue3_ZL-xhU2csLHi1tBR8kp_a-BFhcxQGPSAHde6RYfHidrUk-VSf2N8deL0NlfQrxmh9l7USI1U1U41hIDlGQdM6-GgMuFc_nPztEoXAmhNioSqC2q-gVLUgg2whopNcELycAAuR3QRI1BcdLQkXUldZyKSNev6vYZPgKt1JdxqnnZU_Gh5TcPo4MUC55QJwMaaf73dLPBgUJ11pic7SWrHMswPI9xPCgL5OvT6G7WTlFmW5OZMAlM1i0aIex5j939UQpT-gMzwyOp5NuWdo4ZzDzbFSUYEW0ZQADdH8Ce89o4uM85V_Wbaf2t9ppRg6MvAs0c-F6pFPPnH7YstFEVdsQrF9xhPZte3iqhmU_5xNeq7d-mBc8D9N8cgkYFXUZc0IZsTuVh1nOINDwFMznoEPOkZPEeD0Ceg1JqTdfYpS6kwKnAiOXTBYyx_ZwallCcee6d4pUELWHw4OHCPigpaQoVb3GzwNgF4IuNbPXC8gYvMA=w888-h666-no
Click to expand...
Click to collapse
 
H

hackwerk

Senior Member
Jan 7, 2010
452
121
Amsterdam
Today I did a large comprehensive post about my Sony Bravia 4K Android TV in the topic Sony Android TV Users.

Parts are based on your great topic and work.

Maybe some of you are able to help me/us too, as the chipsets are the same/similar (MediaTek MT5890 (= MT5595 = ATV1))?

It would be HUGE to us if the tv could be rooted, if we could manage to unpack/pack firmwares (Sony) or if we would be able to upgrade the tv to international firmware (US/Asia 6.827 instead of EU 5.457)!

Thanks, and keep up your great work!
 
  • Like
Reactions: chris1892006
Kalaskas

Kalaskas

Member
May 1, 2022
6
7
I have a TV Hisense U7H 2022 version ASIA with Vidaa OS U , I can not install extra applications , it has no web browser , if I write in the search Hisense://debug only searches within YouTube. It seems to be capped everywhere. Any hope to install something ?
 
F

fellaw

New member
Jun 2, 2021
2
0
birry said:
Hey people, I successfully ran telnet server on my MT5880 tv using the following:



The problem is that I cannot add it to boot secuence and didn't found any file in 3rd_rw related to boot, any ideas of how could add it to boot?
Click to expand...
Click to collapse
You may want to try
/3rd_rw/sigma/mtksigma_start_wfd.sh
or
/mnt/usb/sda1/sigma/mtksigma_start_wfd.sh

Those are attempted to be executed on my MT53xx based philips TV.

I did mention this here a while ago:
forum.xda-developers.com

Rooting MediaTek Based Linux Smart TV

Hi Guys, I am looking for methods to get root on my Linux smart tv. Anyone have any ideas? I ran metasploit against it and had no luck, it did find some open ports for upnp and something called twonkymedia but I was not able to get anywhere...
forum.xda-developers.com forum.xda-developers.com
 
chris1892006

chris1892006

Senior Member
Jun 29, 2018
186
17
Has anyone rooted the tv yet? I have my Hisense 43A6H boot.img but after patching and flashing in fastboot, still no root... On Android 11. I tried almost every version like 6 magisk versions and all same result. Whats the deal?
 
chris1892006

chris1892006

Senior Member
Jun 29, 2018
186
17
Can you help with that Hisense root file you uploaded? I had to use an updated adb to get it to work yet it still wouldn't work...

D:\HISENSE 43A6H GOOGLE TV\Root\root>root.bat
╥╗╝ⁿroot╣ñ╛▀ú¼▓╗╚╖╢¿╦∙╙╨╗·╨═─▄╙├ú¼by ╦º▓╗╖│í¡í¡
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
╟δ╩Σ╚δ╡τ╩╙(║╨╫╙)╡─IP╡╪╓╖ú║
┐¬╩╝┴¼╜╙í¡í¡
unable to connect to :5555
adbd cannot run as root in production builds
/system/bin/sh: /system/bin/remount: inaccessible or not found
failed to copy 'su' to '/system/bin/su': couldn't create file: Read-only file system
failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': couldn't create file: Read-only file system
chmod: /system/bin/su: No such file or directory
╓╪╞⌠╡τ╩╙(║╨╫╙)ú¼╡╚╞⌠╢»═Ω╛═╛═╩╟root┴╦ú¼╒Γ╕÷┼·┤ª└φ┐╔╥╘╣╪┴╦í¡í¡
 
chris1892006

chris1892006

Senior Member
Jun 29, 2018
186
17
hackwerk said:
Today I did a large comprehensive post about my Sony Bravia 4K Android TV in the topic Sony Android TV Users.

Parts are based on your great topic and work.

Maybe some of you are able to help me/us too, as the chipsets are the same/similar (MediaTek MT5890 (= MT5595 = ATV1))?

It would be HUGE to us if the tv could be rooted, if we could manage to unpack/pack firmwares (Sony) or if we would be able to upgrade the tv to international firmware (US/Asia 6.827 instead of EU 5.457)!

Thanks, and keep up your great work!
Click to expand...
Click to collapse
Any update because I used Python Binwalk to extract my Hisense 43A6H firmware and no dice once i extracted the .pkg it had two .gz files in there that couldn't be extracted using gzip in Python. I plan on upgrading to a Sony google tv and want to root it, your thoughts?
 
D@rkbytes

[email protected]

New member
May 26, 2023
1
0
México
Greetings.
Does anyone know how to extract encrypted MTK firmware for TV?
I saw that they mentioned something about MTK_RESERVED_MAGIC and I have some firmware that have that byte string:
9BF7ED4FDA262A8E58FC63CF38F6E8A9
I have been trying for a long time to find some script or program that can unpack them, but so far I have not been able to find it.
I appreciate any information about it.
Thank you.
 

Attachments

  • MTK_Crypted_Firmware.jpg
    MTK_Crypted_Firmware.jpg
    601.7 KB · Views: 2
You must log in or register to reply here.

Similar threads

DooMLoRD
[04/Jan][ROOTING/UNROOTING] DooMLoRD's Easy Rooting Toolkit [v4.0](zergRush Exploit)
Replies
927
Views
3M
B
bishoy ashraf
N
[APP][ROOT] LMT Launcher v3.2
Replies
15K
Views
5M
Whiskey103
Whiskey103
Chainfire
[2014.05.01][ROOT] Mobile ODIN v4.20
Replies
5K
Views
3M
Zagnutty
Zagnutty
devwithzachary
[APP] Linux-on-Android project (Complete Linux Installer)
Replies
2K
Views
1M
secretgogeta
secretgogeta
Chainfire
[Android 2.1+][03.10.2011][v3.2] Chainfire3D [ROOT][OpenGL ES 2.0+]
Replies
3K
Views
3M
rignfool
rignfool

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 6
    P
    p0isk
    toolchain and linux source

    Hi All!

    @birri, grep your dmesg output, its contain tuner model,e.g. Si2157.

    K321/K700/K720 have this mmcblk config (can be copied from TV):
    Code: 
    /dev/		size	FW	name	FS type		description
mmcblk0p1	2M		uboot			uboot	
mmcblk0p2	2M	+	uboot_env		uboot envirment	
mmcblk0p3	256k		part_02			
mmcblk0p4	256k		part_03			
mmcblk0p5	4M	+	kernelA			kernel	
mmcblk0p6	4M	+	kernelB			kernel backup	
mmcblk0p7	75M	+	rootfsA	squashfs	root fs	
mmcblk0p8	75M	+	rootfsB	squashfs	root fs backup	
mmcblk0p9	256k		basic			
mmcblk0p10	8M		perm	ext4		/perm	
mmcblk0p11	320M	+	3rd_ro	squashfs	/3rd
mmcblk0p12	750M	+	rw_area	ext4		/3rd_rw	
mmcblk0p13	256k		reserved			
mmcblk0p14	256k		channelA			
mmcblk0p15	256k		channelB			
mmcblk0p16	256k	+	pq			picture quality	
mmcblk0p17	256k	+	aq			
mmcblk0p18	75M	+	logo	jpg		startup logo	512k
mmcblk0p19	256k		acfg_descr			
mmcblk0p20	256k		schedule_pvr			
mmcblk0p21	3M	+	adsp			
mmcblk0p22	256k		ci			
mmcblk0p23	256k		dvbsDB			
mmcblk0p24	256k		hdcp			
mmcblk0p25	1M	+	facs			
mmcblk0p26	256k		hiscfg			
mmcblk0p27	2048M		data	ext4		/data	for update?
    firmware contain this:
    Code: 
    name		FS type		desciption
logo.bin	jpg		JPEG logo's
ddb.bin
load.bin			firmware update loader?
facs.bin	
eepr.bin			EEPROM
uenv.bin			u-boot environment
adsp.bin			ADSP
aqda.bin	
pqda.bin	
3rdw.bin	LZHS(etx4)	/3rd_rw 
3rdp.bin	squashfs	/3rd
rtfs.bin	squashfs	rootfs
kern.bin	LZO		kernel
usig.bin

    Here You can find pkg tools to extract .bin from firmware:
    github com/p0isk/pkg2extract
    (based on epk2extrack for LG TV and jakubpawlo script)
    1. Copy upgrade_loader.pkg to scripts/
    2. Check 3 constant for your firmware:
    OFFSET=427 - address of second entry 'logo'
    EXTRA_DATA_LEN=64 - length of block like this:
    Code: 
    69 4D 74 4B 38 00 00 00 10 00 00 00 55 53 42 5F iMtK8.......USB_
55 50 47 5F 56 45 52 53 49 4F 4E 00 69 50 41 64 UPG_VERSION.iPAd
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    HEADER_LEN=48 - lengh of block minus 12 byte (name of .bin, 0000, len of .bin) like this:
    Code: 
    6C 6F 67 6F 00 00 00 00 8B B0 20 03 AF D2 12 17 logo....‹° .ЇТ..
6B 6D 06 A8 B8 88 FC F5 F0 19 8E CE D9 4F 8F C7 km.Ёё€ьхр.ЋОЩOЏЗ
DB EB D8 F1 FD C8 EC BC EA 5B 64 BB 6C 6E 35 4B ЫлШсэИмјк[d»ln5K
CB B7 90 A1 2E 8B 7A ED 18 59 FC 91             Л·ђЎ.‹zн.Yь‘
    3. Execute
    Code: 
    extract.sh
    Now You can mount 3rdp.bin and rtfs.bin as squashfs.
    4. 3rdw.bin is ext4 packed by LZHS. First 1MB isn't packed.
    5. Build pkg2extract and execute
    Code: 
    ./lzhs_scanner 3rdw.bin 1
cat 3rdw.bin_file*.unlzhs > 3rdw.ext4
    Now You can mount 3rdw.ext4 as ext4.

    New toolchain 4.8.2 and linux-3.10.27 are available on github.com/p0isk
    Code: 
    sudo apt-get install ncurses-dev procmail
    Code: 
    git clone https://github.com/p0isk/gnu-toolchain_4.8.2
git clone https://github.com/p0isk/linux-3.10.27
cd linux-3.10.27
make mt5880_smp_mod_defconfig
make menuconfig
make modules
    I compile cifs.ko module and mount share from NTFS drive. It works from browser and telnet, but not from Media UI (mounted folder just disappears).
    Then I try FAT32 - it works fine!
    How to mount:
    Code: 
    mkdir /tmp/share
insmod cifs.ko
busybox mount -t cifs -o username=<username>,password=<password> //192.168.1.1/share /tmp/share
echo "/tmp/share;MyShare;0123456789" >> /tmp/usbs
    Now You can see video from Media UI like from USB.

    Media UI works through /3rd/browser/opera_dir_launcher/jsplugins/libmodeljs.so library and /3rd_rw/UI/hisenseUI/model/model.js which contains functions calls.
    So it possible to create table of libmodeljs.so functions and examples of their use, maybe.
    model.js written by Sascha Radike and has Copyright (c) 2014 LOEWE Opta GmbH, Kronach. But I didn't find anything about him.
    modeljs has one interesting function 'sendam()':
    for example sendAM(":am,am,remote:start=youtube")
    'youtube' is described in file /basic/am_config
    Code: 
    [ youtube ]
exec = /3rd/internet_browser/browser
args = -w 1920 -h 1080 -x youtube -m NO -4 YES -v YES -u http //www youtube com/tv --hw-dfb --allow-file-access-from-files --remote-debugging-port=9222 --log-level=0 --dfb-window-mode --enable-impl-side-painting --dfb-compositor-memory-limit-mb=46
id   = YOUTUBE
app  = youtube
loosely_exclusive_set = dtv
coexist_set = [dtv_app_mtk,hbbtv]
timeout_4_stop = 30
keymap = keymap.ini
    or
    Code: 
    [ netflix ]
exec = /3rd/netflix/nrd-app/netflix
args =
layer1_buffer_mode = window
change_focus_notify = true
id   = MTK_NETFLIX
app  = netflix
loosely_exclusive_set  = dtv
coexist_set = [dtv_app_mtk,hbbtv]
keymap = keymap.ini
timeout_4_stop = 30
wait_for_started = true
backgm_support = default
hotkey = true
    So we can try to run new browser (for webskype) or kodi...

    /3rd/software-update/ and /3rd_rw/software-update/ contain ota-update scripts and tools.
    Maybe it possible to replace read-only /3rd and rootfs by ext2 fs.

    Sony Bravia Android TV has this cpu (and mt5891), but firmware is encrypted by AES.
    It contains:
    Code: 
    cfig
uenv
misc
recv
boot
sysm
usrd
cach
logo
rfsA
tvap
3rdw
perm
3rdp
svla
svlb
pnel
edid
ddbb
epg
adsp
upgr
ddri
ldat
dfw1
dfw2
fdat
udat
minf
b001
b002
spst
bost
ver
demo
tzbp
aqda
bdat
bdix
mafw
mlfw
ndat
pdat
pqda
udt
    Wow, more than HiSense TV.
    And Sony TV has serial control 3.5 mini jack, like HiSense:
    graphics secondipity com/gr/images/nw/XBR49X830CSideRight02.jpg
    (its X830C 4K Ultra HD with Android TV)
    Maybe it possible to take image from eMMC.

    And something interesting:
    linux-3.10.27 source says that MT5890 is Cortex-A12 quad-core... arch/arm/boot/dts/MT5890_hmp.dts contain this:
    Code: 
    	cpus {
		cpu0: [email protected] {
			device_type = "cpu";
			compatible = "arm,cortex-a12";
            		cci-control-port = <&cci_control1>;
			reg = <0x0>;
			clock-frequency = <1000000000>;
		};

		cpu1: [email protected] {
			device_type = "cpu";
			compatible = "arm,cortex-a12";
            		cci-control-port = <&cci_control1>;
			reg = <0x1>;
			clock-frequency = <1000000000>;
		};

		cpu2: [email protected] {
			device_type = "cpu";
			compatible = "arm,cortex-a7";
			cci-control-port = <&cci_control2>;
			reg = <0x100>;
			clock-frequency = <1000000000>;
		};

		cpu3: [email protected] {
			device_type = "cpu";
			compatible = "arm,cortex-a7";
			cci-control-port = <&cci_control2>;
			reg = <0x101>;
			clock-frequency = <1000000000>;
		};
	};
    And config contain:
    Code: 
    CONFIG_NR_CPUS=2
    But dmesg says:
    Code: 
    [    0.000000] CPU: ARMv7 Processor [410fc0e0] revision 0 (ARMv7), cr=10c5387d
[    5.165670] SMP: Total of 2 processors activated.
    But 0x410fc0e0 means Cortex-A17...
    View
    4
    T
    tarator.ru
    how to install any html5 app

    hi all !

    1. open on TV stock browser
    2. in the address bar, type hisense://debug
    3*. on the page type the name of the application and its URL
    4. find the application icon in Google. copy and paste the url of the icon
    5. Click the INSTALL button
    6. can use the app

    * lots of applications here -> apptest.staging.foxxum.com
    View
    3
    B
    borillion_star
    I was able to capture input form the internal UART and its a bit different that I have seen before, its using u-boot.

    Code: 
    Boot-

DRAM Channel A Calibration.

Byte 0 : Gating(2 ~ 67), Size=66, Mid=36, Set=36.

Byte 1 : Gating(2 ~ 57), Size=56, Mid=31, Set=31.

Byte 2 : Gating(2 ~ 77), Size=76, Mid=41, Set=41.

Byte 3 : Gating(2 ~ 72), Size=71, Mid=39, Set=39.

HW Byte 0 : DQS(13 ~ 45), Size 33, Set 27, HW_Set 31.

HW Byte 1 : DQS(9 ~ 45), Size 37, Set 25, HW_Set 28.

HW Byte 2 : DQS(13 ~ 47), Size 35, Set 28, HW_Set 32.

HW Byte 3 : DQS(13 ~ 48), Size 36, Set 28, HW_Set 31.

DRAM A Size = 512 Mbytes.

Boot


Start Pmain


0x0000a000

Nand boot

NID=0x9590dcad

LZHS addr:0x00100040

LZHS size:0x0012fdd8

LZHS checksum:0x000000ef

Boot


Start Lmain



MT5880 Boot Loader v0.9
Boot reason: A/C power on!!
Load VGA internal EDID.................
 Load HDMI internal EDID.................
 CEC Physical offset 159
HDMI1 Physical adr 0x30
HDMI1 PA 0x30
HDMI1 checksum 0xa1
HDMI2 PA 0x30
HDMI2 checksum 0xa1
HDMI3 PA 0x20
HDMI3 checksum 0xb1
HDMI4 PA 0x10
HDMI4 checksum 0xc1
SIF_Master0: new design
IR DATA register : 0x       0
Boot reason: A/C power on!!T8032 init A/C on case loader stage...
Load T8032 FW (addr: 0x  e0dd30, size: 24576)success!!
T8032 FW version: 73
T8032 change to loader stage...
LDR_FlashCopy 0xf010 0x6ec00 0x80
Detect NAND flash ID: 0x9590DCAD
Detect HY27U4G8F2DTR NAND flash(SLC): 512MB
NAND_BDM_Mount: Partid=0, offset=0x0, size=0x200000
NAND_BDM_Mount: Partid: 0, Total Block Count: 16, Bad Block Count: 0
1st MAC in EEP is valid (c8:16:bd:ff:d9:c6)
1st : (c8:16:bd:ff:d9:c6)
2nd : (ff:ff:ff:ff:ff:ff)
Boot reason: A/C power on!!Boot reason: A/C power on!!Org:0x30 Flags:0x30
                             
PDWNC_Init
Boot reason: A/C power on!!USB0: Set GPIO63 = 1.
USB1: Set GPIO64 = 1.
USB2: Set GPIO61 = 1.
Boot reason: A/C power on!!Boot reason: A/C power on!!Org:0x30 Flags:0x30
                             

Do USB upgrade
USB: Vbus turn up time = 226 ms, Max =300 ms.
USB-0: insert.
USB-1: insert.
USB-0: ClassCode= 0xFF, u4Diff=0 ms.
USB-1: ClassCode= 0x9, u4Diff=0 ms.

 FIND_CLASS_HUB.

 HUB No USB Medium on Hub.
USB upgrade stop
Boot reason: A/C power on!!Boot reason: A/C power on!!Org:0x30 Flags:0x30
                             
PDWNC_EnterPowerDown(100,0) 
Disable VGA wakeup
[LdrLedBlinkikng] Start to Init/Turn off timer!
Standby             *
UART>
UART>
UART>
UART>
UART>
UART>¡HšøDRAM Channel A Calibration.

Byte 0 : Gating(2 ~ 62), Size=61, Mid=34, Set=34.

Byte 1 : Gating(2 ~ 57), Size=56, Mid=31, Set=31.

Byte 2 : Gating(2 ~ 77), Size=76, Mid=41, Set=41.

Byte 3 : Gating(2 ~ 72), Size=71, Mid=39, Set=39.

HW Byte 0 : DQS(13 ~ 45), Size 33, Set 27, HW_Set 31.

HW Byte 1 : DQS(9 ~ 46), Size 38, Set 25, HW_Set 28.

HW Byte 2 : DQS(13 ~ 47), Size 35, Set 28, HW_Set 32.

HW Byte 3 : DQS(13 ~ 48), Size 36, Set 28, HW_Set 31.

DRAM A Size = 512 Mbytes.

Boot


Start Pmain


0x0000a000

Nand boot

NID=0x9590dcad

LZHS addr:0x00100040

LZHS size:0x0012fdd8

LZHS checksum:0x000000ef

Boot


Start Lmain



MT5880 Boot Loader v0.9
SIF_Master0: new design
IR DATA register : 0x       0
T8032 change to loader stage...
LDR_FlashCopy 0xf010 0x6ec00 0x80
Detect NAND flash ID: 0x9590DCAD
Detect HY27U4G8F2DTR NAND flash(SLC): 512MB
NAND_BDM_Mount: Partid=0, offset=0x0, size=0x200000
NAND_BDM_Mount: Partid: 0, Total Block Count: 16, Bad Block Count: 0
1st MAC in EEP is valid (c8:16:bd:ff:d9:c6)
1st : (c8:16:bd:ff:d9:c6)
2nd : (ff:ff:ff:ff:ff:ff)
PDWNC_Init
USB0: Set GPIO63 = 1.
USB1: Set GPIO64 = 1.
USB2: Set GPIO61 = 1.
Display 0x00e353a0 background:0x00000000

OSD_SetPlaneSwitchOrder[0,1,2],Switch[1,2,3]
---------- [SA7] vErrorHandleInit ----------
[SA7] Error handling init 
[SA7] PANEL_GetPanelWidth=0x780, PANEL_GetPanelHeight=0x438 , wDrvGetOutputHTotal=0x898 , wDrvGetOutputVTotal=0x465
[SA7] PANEL_GetHTotalMax=0x92c, PANEL_GetHTotalMin=0x82a, PANEL_GetVTotalMax=0x578, PANEL_GetVTotalMin=0x456 
[SA7] PANEL_GetPixelClkMax=152500000, PANEL_GetPixelClkMin=130000000 
[SA7] PANEL_GetPixelClk60Hz = 0x8d9ee20 
---------- [SA7] vErrorHandleSetByTiming ----------
[SA7] u2HSyncWidth=260, u2HSyncStart=1930, u2VSyncWidth=26, u2VSyncStart=1094
---------- [SA7] vErrorHandleSetByTiming end----------
---------- [SA7] vErrorHandleSetByPanel end----------
[SA7] vDDDSInit
---------- [SA7] vErrorHandleSetByTiming ----------
[SA7] u2HSyncWidth=30, u2HSyncStart=1936, u2VSyncWidth=3, u2VSyncStart=1119
---------- [SA7] vErrorHandleSetByTiming end----------
vDrvSetOCLKClockSchemaInit.
[SA7] _fgVopllUseDDDS = True
[LVDS] VOPLL Initialize successful !
LDR_OsdDisplay(13, 0x00d43530, 768, 240)
Color:13 BmpAddr:0x00d43530 Width:768 Height:240
Panel 1920 x 1080 

*************u4BmpPitch=1536******************
u4OutWidth=768,u4OutHeight=240,u4OutX=576,u4OutY=420.

Do USB upgrade
USB: Vbus turn up time = 2739 ms, Max =300 ms.
USB-0: insert.
USB-1: insert.
USB-0: ClassCode= 0xFF, u4Diff=0 ms.
USB-1: ClassCode= 0x9, u4Diff=0 ms.

 FIND_CLASS_HUB.

 HUB No USB Medium on Hub.
USB upgrade stop

Flash load lzhs header from 0x80000 to dram(0x15203a0), size=2048
Decompression uboot to 0x00800000...

Flash load image from 0x80000 to dram(0x15203a0), size=0x3e34e
NAND_BDM_Mount: Partid=4, offset=0x480000, size=0x300000
NAND_BDM_Mount: Partid: 4, Total Block Count: 24, Bad Block Count: 0

Flash load tz from 0x1f7343(kernel) to dram(0x1f200000), size=0x2e978
secure boot ok
secure boot ok
Starting image...



U-Boot 2011.12.12 (Dec 29 2014 - 13:20:10)

DRAM:  261.3 MiB
WARNING: Caches not enabled
NAND:  Detect NAND flash ID: 0x9590DCAD
Detect HY27U4G8F2DTR NAND flash: 512MB
512 MiB

0.0.0.0
In:    serial
Out:   serial
Err:   serial
Boot from kernelA and rootfsA(partition 6)
Net:   Net Initialization Skipped
No ethernet found.
Hit any key to stop autoboot:  0 
Partition rootfsA defined at mtdparts:
ID:6, Offset:0x00000000, Size:0x00a80000
Loader succeeded in signature verification
## Booting kernel from Legacy Image at 00007fc0 ...
   XIP Kernel Image ... OK
OK

Starting kernel ...

TZ Heap: start=0x1FA63280, end=0x20000000

TZ dram: start=0x1F000000, end=0x20000000

[    0.000000] timekeeping_init done


INIT: version 2.86 booting

Loading /etc/profile...
Start readahead /etc/readahead_early
Running rc.local...
# mount 3rd_rw
net.ipv4.tcp_window_scaling = 6
net.core.rmem_max = 1048576
UBI device number 1, total 3189 LEBs (404926464 bytes, 386.2 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
# mount 3rd DMVERITY(SquashFS read-only)
real	0m 0.00s
user	0m 0.00s
sys	0m 0.00s
 can't not find /3rd/upgrade/download.xml 
Start readahead /etc/readahead
[AM ERROR][am_main.c][getPowerKeyWDSetting] open /dev/rmmgr failed(No such device or address)
commandline read: app_man

   ~~~~~~~~~~~~~~~~~~~~~~~~~~| DirectFB 1.5.3 |~~~~~~~~~~~~~~~~~~~~~~~~~~
        (c) 2001-2010  The world wide DirectFB Open Source Community
        (c) 2000-2004  Convergence (integrated media) GmbH
      ----------------------------------------------------------------

(*) DirectFB/Core: Multi Application Core. (2014幎 12月 29日 星期䞀 13:24:02 CST) 
(*) Direct/Memcpy: Using libc memcpy()
(*) Fusion/SHM: Using MADV_REMOVE (3.0.13.0 >= 2.6.19.2)
(*) Direct/Thread: Started 'Fusion Dispatch' (-1) [MESSAGING OTHER/OTHER 0/0] <8388608>...
(*) Direct/Thread: Started 'Fusion Deferred' (-1) [MESSAGING OTHER/OTHER 0/0] <8388608>...
======DFB 3DMM u4VirtAddr : 0x1bac5000, and DFB 3DMM u4Size : 0x1f80000======
(*) Direct/Thread: Started 'Virtual Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>...
(*) DirectFB/Input: Virtual Input 0.0 (Convergence GmbH)
input thread's parent pid is 451 tid is 451
(*) Direct/Thread: Started 'RC Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>...
(*) DirectFB/Input: MediaTek RC Input 0.1 (Denis Oliver Kropp)
(*) Direct/Thread: Started 'Hotplug with Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>...
[DirectFB]: Wait to Init IR...!
(*) DirectFB/Input: Hot-plug detection enabled with Linux Input Driver 
(*) MediaTek/Driver: Mapped shared command queue control structure to 0x4324e000
(*) MediaTek/Driver: Mapped DMA region to 0x4326a000
(*) MediaTek/Driver: GFX_CmdQueInit( 0x4324e000, 0x38920 )
(*) DirectFB/Graphics: MediaTek 53xx 0.3 (Denis Oliver Kropp)
(*) DirectFB/Core/WM: SaWMan 0.2 (directfb.org)
(*) SaWMan/Config: Parsing config file '/etc/sawmanrc'.
(*) SaWMan: Initializing stack 0x20298a00 for tier 0x216b3000, 0x0, layer 0, context 0x20089000 [3]...
(*) SaWMan: Initializing stack 0x20298900 for tier 0x216b3800, 0x0, layer 1, context 0x20089a00 [6]...
(*) SaWMan/Init: Layer  0:  1280x720, ARGB, options: 0
(*) SaWMan/Init: Border 0:  426x240, LUT8, options: 8
(*) SaWMan/Init: Layer  1:  1280x720, ARGB, options: 0
(*) SaWMan/Init: Border 1:  426x240, LUT8, options: 8
[dtv_app_mtk]>drv_init as 0x0 model
[dtv_app_mtk]>drv_init as US model
[dtv_app_mtk]>HDMI fast booting init...
[   11.247113] NAND_SDM_Mount: Partid=13, offset=0x1f900000, size=0x700000

readahead: can't open '/basic/lib/libnet_info.so': No such file or directory
[dtv_app_mtk]>
[dtv_app_mtk]>TVD MsgCtrl:  NRL:60/40, PER:100/90
input thread pid is 451 tid is 458
original scheduler policy 0
scheduler nice 0
original child scheduler policy 0 prio 0
new child scheduler policy 2 prio 99
Start to wait IR event...
[dtv_app_mtk]>x_drv_init end!!
[dtv_app_mtk]>[ FakeDM ] Init...
[dtv_app_mtk]>
[FakeDM] Init FM...
[dtv_app_mtk]>
/dev is created./mnt is already existed.  That is OK.
[dtv_app_mtk]>
/mnt/usb is created.[FakeDM] FM inited...
[dtv_app_mtk]>
[FakeDM] Init DLNA...
[dtv_app_mtk]>
[FakeDM] DLNA inited...
[dtv_app_mtk]>
[FakeDM] Init SMB...
[dtv_app_mtk]>
[FakeDM] SMB inited...
[dtv_app_mtk]>
Init chip_spec_init!!!!!
[dtv_app_mtk]>
[DM] _dm_open_dev_thread: entered
[dtv_app_mtk]>
EEPROM size is 0xc0.
[dtv_app_mtk]>
[DM] _dm_nfy_req_thread enter
[dtv_app_mtk]>
[DM] _dm_nfy_req_thread get_nl_sock:18
[dtv_app_mtk]>
[DM] _dm_cb_msg_thread enter
[dtv_app_mtk]>
{CDB} Loading metadata (version 7)
[dtv_app_mtk]>
{CDB} Loading metadata (version 7)
[dtv_app_mtk]>
{CDB} Loading metadata (version 7)
[dtv_app_mtk]>
{CDB} Loading metadata (version 7)
[dtv_app_mtk]>
[dtv_app_mtk]>   ~~~~~~~~~~~~~~~~~~~~~~~~~~| DirectFB 1.5.3 |~~~~~~~~~~~~~~~~~~~~~~~~~~
[dtv_app_mtk]>        (c) 2001-2010  The world wide DirectFB Open Source Community
[dtv_app_mtk]>        (c) 2000-2004  Convergence (integrated media) GmbH
[dtv_app_mtk]>      ----------------------------------------------------------------
[dtv_app_mtk]>
[dtv_app_mtk]>(*) DirectFB/Core: Multi Application Core. (2014幎 12月 29日 星期䞀 13:24:02 CST) 
[dtv_app_mtk]>(*) Direct/Memcpy: Using libc memcpy()
[dtv_app_mtk]>(*) Fusion/SHM: Using MADV_REMOVE (3.0.13.0 >= 2.6.19.2)
[dtv_app_mtk]>(*) Direct/Thread: Started 'Fusion Dispatch' (-1) [MESSAGING OTHER/OTHER 0/0] <8388608>...
[dtv_app_mtk]>(*) Direct/Thread: Started 'Fusion Deferred' (-1) [MESSAGING OTHER/OTHER 0/0] <8388608>...
[dtv_app_mtk]>(*) MediaTek/Driver: Mapped shared command queue control structure to 0x4002b000
[dtv_app_mtk]>(*) MediaTek/Driver: Mapped DMA region to 0x43817000
[dtv_app_mtk]>(*) MediaTek/Driver: GFX_CmdQueInit( 0x4002b000, 0x39a040 )
[dtv_app_mtk]>(*) DirectFB/Graphics: MediaTek 53xx 0.3 (Denis Oliver Kropp)
[dtv_app_mtk]>(*) SaWMan/Config: Parsing config file '/etc/sawmanrc'.
stacking [0x0], layer_id [0] 
stacking [0x0], layer_id [0] 
[dtv_app_mtk]>
dtv_svc_main: fbm phy addr = 1674b000, share mem addr = 452c6000, vir addr = 0, size = 143347712 
[dtv_app_mtk]>SC_FCT_0: sched_getparam 441 error -1
[dtv_app_mtk]>SC_FCT_0: sched_getparam 442 error -1
[dtv_app_mtk]>[* GL DFB *] Create plane (ON layer) :10112a7 
stacking [0x0], layer_id [0] 
stacking [0x0], layer_id [0] 
[dtv_app_mtk]>
[dtv_app_mtk]>

[dtv_app_mtk]>
x_wifi_cli_init~~~
[dtv_app_mtk]>

[dtv_app_mtk]>
=====================
[dtv_app_mtk]>
channel id:(262272), svl rec id:(1), channel id in rec:(262272), brdcst type:(1)
[dtv_app_mtk]>
=====================
[dtv_app_mtk]>

[dtv_app_mtk]>
 channel info: svl_id(262272), channel_id(262272) 
[dtv_app_mtk]>
{DT} Real Time Clock is available on this system.
[dtv_app_mtk]>
reason: 0x00000003 - 0x00000000
[dtv_app_mtk]><AM> wakeup reason = 3
[dtv_app_mtk]>

IDX_FAC_LVDS_SPREAD offset = 0x11f +0x460
[dtv_app_mtk]>
[zxf 222]  IDX_BBY_BUTTON_LOCK offset = 0x120 +0x460
[dtv_app_mtk]>
EEPROM size is 0xba0.
[dtv_app_mtk]>
EEPROM size is 0x1000.
[dtv_app_mtk]>
reason: 0x00000003 - 0x00000000
[dtv_app_mtk]>[OT][_acfg_ch_lst_load_p1][707]: e_wakeup_reason = 3.
[dtv_app_mtk]>
{CDB} Loading metadata (version 7)
[dtv_app_mtk]>
<MSCVT>Call function : a_msg_convert_register.
[dtv_app_mtk]>
<MSCVT>Call function _mc_app_init_fct.
[dtv_app_mtk]>
<MSCVT>msg_convert_custom_init 
[dtv_app_mtk]>
<MSCVT> msgconvert custom: do something before init
[dtv_app_mtk]>
----------------restore------------ui_tbl
[dtv_app_mtk]>:dtv_app_mtk,am,:started=agent_app
[dtv_app_mtk]>_id =0
[dtv_app_mtk]>
<MSCVT>language is eng
[dtv_app_mtk]>
<MSCVT>country is USA
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[dtv_app_mtk]>

[dtv_app_mtk]>
[dtv_app_mtk]> file=wifi_direct.c line = 599, func=a_wifi_direct_register reason = 0
[dtv_app_mtk]>

 file=wifi_direct.c line = 603, func=a_wifi_direct_register reason = 0
[dtv_app_mtk]>

 file=wifi_direct_view_main.c line = 730, func=wifi_direct_view_main_proc_fct reason = 268
[dtv_app_mtk]>

 file=wifi_direct_view_main.c line = 730, func=wifi_direct_view_main_proc_fct reason = 267
[dtv_app_mtk]>

 file=wifi_direct_view.c line = 616, func=_wifi_direct_view_init reason = 0
[dtv_app_mtk]>

 file=wifi_direct_view.c line = 624, func=_wifi_direct_view_init reason = 0
[dtv_app_mtk]>

[INET] 6.156, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 1, plugin
[dtv_app_mtk]>
[INET] 6.157, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 2, unplug
[dtv_app_mtk]>
 file=wifi_direct.c line = 180, func=_wifi_direct_init reason = 0
[dtv_app_mtk]>

_wifi_direct_init enable wifi direct
[dtv_app_mtk]>
[INET] 6.169, ni_mon_thread.1906 >>> wifi0 is unplug!
[dtv_app_mtk]>
<MENU> Because this is 2D panel, 3d item is hide.
[dtv_app_mtk]>mkdir: cannot create directory '/3rd_rw/tmp_upg': File exists
[dtv_app_mtk]>

[dtv_app_mtk]>
 creat  /tmp/keyboard_exist ,dev_type=1 
[dtv_app_mtk]>
 
[dtv_app_mtk]>
 creat  /tmp/mouse_exist ,dev_type=2 
[dtv_app_mtk]>
 [xuehongfeng] is acfg_video.c,acfg_video_update,7406
[dtv_app_mtk]>

[dtv_app_mtk]>[NAV]SVL_ID= 2, ui_tuner_type = 1, ui1_svl_lst_idx = 0 @Func = 
[dtv_app_mtk]>
[NAV]SVL_ID= 2, ui_tuner_type = 1, ui1_svl_lst_idx = 0 @Func = 
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[dtv_app_mtk]>
acfg_common.c, Get RRT2_idx=5
[dtv_app_mtk]>
{RRCTX}[L730] i4_ret = 0  len = 1
[dtv_app_mtk]>
{Rating_Info}[L276] set region id 5   0 
[dtv_app_mtk]>
========network.c,5816,[a_nw_init] init NMC/DMR stack ========
[dtv_app_mtk]>
========hs_nmc_dmr.c,2195,[hs_nmc_dmr_stack_init] init NMC/DMR lib add wanghaibin log ========
[dtv_app_mtk]>
========hs_nmc_dmr.c,2201,[hs_nmc_dmr_stack_init] call tm_dmscp_ioctl(TRUE) add wanghaibin log ========
[dtv_app_mtk]>
reason: 0x00000003 - 0x00000000
[dtv_app_mtk]>
[dtv_app_mtk]>
===ONE_TOUCH_PLAY wake up reason 3===
[dtv_app_mtk]>
reason: 0x00000003 - 0x00000000
[dtv_app_mtk]>reason: 0x00000003 - 0x00000000
[dtv_app_mtk]>[PosDemo] Demo mode selection is OFF
[dtv_app_mtk]>

[dtv_app_mtk]><wfd>: a_wfd_init is OK

[dtv_app_mtk]>
 file=wifi_direct.c line = 473, func=_wifi_direct_device_remove_nfy_handler reason = 2
[dtv_app_mtk]>

 file=wifi_direct.c line = 474, func=_wifi_direct_device_remove_nfy_handler reason = 1
[dtv_app_mtk]>

 file=wifi_direct.c line = 703, func=wifi_direct_app_get_p2p_sta reason = 1
[dtv_app_mtk]>

 file=wifi_direct.c line = 703, func=wifi_direct_app_get_p2p_sta reason = 1
[dtv_app_mtk]>


[dtv_app_mtk]>:dtv_app_mtk,am,:started=eas_app
[dtv_app_mtk]>
[dtv_app_mtk]>
 channel info: svl_id(262272), channel_id(262272) 
[dtv_app_mtk]>

[dtv_app_mtk]>
DIVX_DRM_51
[dtv_app_mtk]>
strMacRet -> 6C9D
[dtv_app_m[   14.062183] star: star_open(eth0)

tk]>
========GetModelMac -> 50K220GWUS6C9D==========
[dtv_app[   14.071014] star: request interrupt vector=40

_mtk]>
nmc_ldmr_init IN
[dtv_app_mtk]>
initDmcList ... 
[dtv[   14.081061] star: Internal PHY mode

_app_mtk]>
readList >> no file yet.
[dtv_app_mtk]>

[dtv_app_mtk]>
set g_bIsSeeking to FALSE
[dtv_app_mtk]>
nResult == CP_ERR_NO_ERROR
[dtv_app_mtk]>
[INET] 7.238, x_net_ip_v6_auto.4714 >>> (eth0->eth0, b_restart_if = 0
[dtv_app_mtk]>
[INET] 7.239, x_net_network_reg_nfy.4291 >>> 0x40f72bb0, 0x00000000
[dtv_app_mtk]>
[INET] 7.240, x_net_ni_enable.1444 >>> if enable eth0->eth0
[dtv_app_mtk]>


[dtv_app_mtk]>
 @@@@@@@@@@@@@@@t_g_menu_common_item_auto_upgrade added!
[dtv_app_mtk]>
menu_factory_hierarchy.c,2793,s_tmp_str=api.us.hismarttv.com
[dtv_app_mtk]>
,
[dtv_app_mtk]><factory> init is invoked
[dtv_app_mtk]>
AM_BRDCST_MSG_POWER_ON
[dtv_app_mtk]>
numb=0 t_fac_src_sw_av.numbs=0
[dtv_app_mtk]>

numb=0 t_fac_src_sw_av.numbs=0
[dtv_app_mtk]>

numb=1 t_fac_src_sw_av.numbs=1
[dtv_app_mtk]>


[dtv_app_mtk]>:dtv_app_mtk,am,:started=factory
[   14.186103] ADDRCONF(NETDEV_UP): eth0: link is not ready

[dtv_app[   14.190674] 5707 write 1 byte ok!

[   14.192911] 5711 write 1 byte fail=0x 6, 0x 0!

_mtk]>[INET] 7.367, x_net_network_reg_nfy.4295 >>> call eth0 enabled
[dtv_app_mtk]>
<ACFG> Open audio outport: 0 ms
[dtv_app_mtk]>
Enter next state by event 4
[dtv_a[   14.427972] 

[   14.427977]  <drv_cust_api>___GPIO(224),set to (1)  

[   14.427981]  pp_mtk]>acfg_common.c, Get RRT2_idx=5
[dtv_app_mtk]>
{RRCTX}[L730] i4_ret = 0  len = 1
[dtv_app_mtk]>
{Rating_Info}[L276] set region id 5   0 
[dtv_app_mtk]>

[dtv_app_mtk]>
 true NowTV=50K220GWUS-- SMART_DMR_MODEL=50K220GWUS--LEN=10--
[dtv_app_mtk]>
---Right_TV_Model---acfg_custom_update_all---7486--


[   14.541132]  111111 <api_pecustui>___GPIO(67),get status (0)  

[   14.541139]  

[   14.545754]  <api_pecustui>___GPIO(67),get status (0)  

[   14.545759]  >>setmatrixlvladj in_y_ofst=200 

[dtv_app_mtk]>

[dtv_app_mtk]>
!!!!!![SHL]FILE:acfg_custom.c,FUNC:a_cfg_get_hp_plug_in_gpio_polarity,LINE:10171,u4GpioVal:0!!!!!!
[dtv_app_mtk]>

[dtv_app_mtk]>
<SHL-power>a_cfg_get_hp_plug_in_gpio_polarity=0 
[dtv_app_mtk]>
[xuehongfeng] is acfg_video.c,acfg_video_update,7406
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[   14.826660] [NPTV]FlashPQ Gamma OK

[   14.884775] >>setmatrixlvladj in_y_ofst=200 

[   14.886427] >>setmatrixlvladj in_y_ofst=200 

[   14.890741] Output Width or Height is 0

[dtv_app_mtk]>
[acfg_video_update]8722,  3D_Mode= 0,  s_n[   14.901742] Output Width or Height is 0

ame=dtv_app_mtk
[dtv_app_mtk]>
<ACFG> The min/max/pos of h-po[   14.911211] [NPTV]FlashPQ Gamma OK

s in driver is wrong.
[dtv_app_mtk]>
<ACFG> The min/max/pos of v-pos in driver is wrong.
[dtv_app_mtk]>
[xuehongfeng] is acfg_video.c,acfg_video_update,7406
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[dtv_app_mtk]>
# mount perm
[   15.877695] UBI: attaching mtd10 to ubi2

[   15.878876] UBI: save scan info advance:     1

[   15.883440] UBI: physical eraseblock size:   131072 bytes (128 KiB)

[   15.889806] UBI: logical eraseblock size:    126976 bytes

[   15.895072] UBI: smallest flash I/O unit:    2048

[   15.899664] UBI: VID header offset:          2048 (aligned 2048)

[   15.907285] UBI: data offset:                4096

[   15.919731] UBI: scan info block is a empty block

[   15.921791] UBI: ubi get sid err[-22]

[   15.936883] UBI: max. sequence number:       512

[   15.951517] UBI: attached mtd10 to ubi2

[   15.952597] UBI: MTD device name:            "perm"

[   15.961044] UBI: MTD device size:            5 MiB

[   15.965993] UBI: number of good PEBs:        39

[   15.967743] UBI: number of bad PEBs:         0

[   15.981071] UBI: number of corrupted PEBs:   0

[   15.982735] UBI: max. allowed volumes:       128

[   15.995991] UBI: wear-leveling threshold:    4096

[   15.997915] UBI: number of internal volumes: 1

[   16.006070] UBI: number of user volumes:     1

[   16.007732] UBI: available PEBs:             0

[   16.015979] UBI: total number of reserved PEBs: 39

[dtv_app_mtk]>[DM[   16.019534] UBI: number of PEBs reserved for bad PEB handling: 5

[   16.026127] UBI: max/mean erase counter: 20/13

[   16.029882] UBI: image sequence number:  1102700798

[   16.035079] UBI: background thread "ubi_bgt2d" started, PID 616

] usbfs mounted.
[dtv_app_mtk]>
UBI device number 2, total 39 LEBs (4952064 bytes, 4.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[   16.067850] UBIFS: recovery needed

[   16.125078] UBIFS: recovery completed

[   16.126286] UBIFS: mounted UBI device 2, volume 0, name "perm"

[   16.131916] UBIFS: file system size:   2539520 bytes (2480 KiB, 2 MiB, 20 LEBs)

[   16.139294] UBIFS: journal size:       1142785 bytes (1116 KiB, 1 MiB, 8 LEBs)

[   16.146556] UBIFS: media format:       w4/r0 (latest is w4/r0)

[   16.152332] UBIFS: default compressor: lzo

[   16.156221] UBIFS: reserved for root:  0 bytes (0 KiB)

[dtv_app_mtk]>[INFO] playready  installation
[dtv_app_mtk]>/etc/scripts/ins_playready.sh: cd: line 9: can't cd to /3rd/playready/data
[dtv_app_mtk]>[ERROR] Please put bgroupcert.dat to this folder
[dtv_app_mtk]>[FM-Linux]Mount /dev/mtd10 to /perm successfully.
[dtv_app_mtk]>
[FM](/dev/mtd10) is mounted to (/perm) successfully(0)
[dtv_app_mtk]>
3rd partition is already attached!!!
[dtv_app_mtk]>3rd partition is already mounted!!!
[dtv_app_mtk]>[FM-Linux]Mount /dev/mtd9 to /3rd_rw successfully.
[dtv_app_mtk]>
[FM](/dev/mtd9) is mounted to (/3rd_rw) successfully(0)
[dtv_app_mtk]>
# mount 3rd DMVERITY(SquashFS read-only)
[dtv_app_mtk]>3rd_ro partition is already attached!!!
[dtv_app_mtk]>[FM-Linux]Mount /dev/mtd12 to /3rd successfully.
[dtv_app_mtk]>
[FM](/dev/mtd12) is mounted to (/3rd) successfully(0)
[   16.492210] rtusb init rtusbSTA --->

[   16.493309] usbcore: registered new interface driver rtusbSTA

[   16.564079] NTFS driver 2.1.30 [Flags: R/O MODULE].

[   16.597081] usbcore: registered new interface driver usbhid

[   16.599873] usbhid: USB HID core driver

[dtv_app_mtk]>mount: mounting none on /proc/bus/usb failed: Device or resource busy
[   16.633021] v4l2_common: Unknown symbol v4l2_ctrl_get_menu (err 0)

[   16.636693] v4l2_common: Unknown symbol v4l2_ctrl_fill (err 0)

[dtv_app_mtk]>insmod: can't insert '/basic/modules/v4l2-common.ko': unknown symbol in module or invalid parameter
[   16.655688] Linux video capture interface: v2.00

[   16.666183] usbcore: registered new interface driver uvcvideo

[   16.669363] USB Video Class driver (v1.1.0)

[   16.680733] [email protected]#[email protected]# @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ alsa_card_mtk_init 201202101600

[dtv_app_mtk]>
reason: 0x00000003 - 0x00000000
[dtv_app_mtk]>reason: 0x00000003[   16.734777] >>setmatrixlvladj in_y_ofst=200 

[   16.738925] >>setmatrixlvladj in_y_ofst=200 

[   16.743261] Output Width or Height is 0

 - 0x00000000
[dtv_app_mtk]>
[dtv_app_mtk]>
[dtv_app_mtk]>
 channel info: svl_id(262272), channel_id(262272) 
[dtv_app_mtk]>
[PosDemo] Demo mode selection is OFF
[   17.155913] MUC_Irq 3843: [USB]Connect interrupt  = 0x10.

[   17.175902] MUC_Irq 3843: [USB]Connect interrupt  = 0x10.

[dtv_app_mtk]>
[PosDemo] Demo mode selection is OFF
[   17.255909] usb_events_timer_func 529: [usb]USB_EVENTS_CHECK_CONNECT

[   17.275902] usb_events_timer_func 529: [usb]USB_EVENTS_CHECK_CONNECT

[   17.484747] >>setmatrixlvladj in_y_ofst=200 

[   17.541232] usb 1-1: new high speed USB device number 2 using MtkUsbHcd

[dtv_app_mtk]>
[xuehongfeng] is acfg_video.c,acfg_video_update,7406
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[   17.745795] [NPTV]FlashPQ Gamma OK

[   17.770172] 

[   17.770176] 

[   17.770179] === pAd = dfcc3000, size = 1603200 ===

[   17.770184] 

[   17.778766] <-- RTMPAllocTxRxRingMemory, Status=0

[   17.781841] <-- RTMPAllocAdapterBlock, Status=0

[   17.786215] Efuse Size=0x2d [2d0-2fc] 

[   17.789674] NVM is EFUSE

[dtv_app_mtk]>
[acfg_video_update]8722,  3D_Mode= 0,  s_name=dtv_app_mtk
[dtv_app_mtk]>
[xuehongfeng] is acfg_video.c,acfg_vi[   17.814219] [NPTV]FlashPQ Gamma OK

deo_update,7406
[dtv_app_mtk]>
Get  APP_CFG_RECID_VID_LUMA
[dtv_app_mtk]>
[INET] 11.229, ni_mon_thread.1850 >>> ra0 is plug!
[dtv_app_mtk]>
 file=wifi_direct.c line = 473, func=_wifi_direct_device_remove_nfy_handler reason = 1
[dtv_app_mtk]>

 file=wifi_direct.c line = 474, func=_wifi_direct_device_remove_nfy_handler reason = 1
[   18.075991] usb 2-1: new high speed USB device number 2 using MtkUsbHcd

[   18.287956] hub 2-1:1.0: USB hub found

[   18.289008] hub 2-1:1.0: 4 ports detected

[   18.391153] MGC_FindEnd 757: [USB] Port-1: New Dev=0xC93B3800, proto=I int, wPacketSize=8.

[   18.396643] MGC_FindEnd 760: [USB] Port-1: idVendor=0x1A40, idProduct=0x0101, bcdDevice=0x0100.

[   18.405323] MGC_FindEnd 850: [USB] Rx Ep 7 is free for use.

[   18.410878] MGC_FindEnd 900: [USB] Rx Ep 7 prepare to use fifo at 64.

[dtv_app_mtk]>

[INET] 13.689, _net_network_ready_thread.4220 >>> start
[dtv_app_mtk]>
[INET] 13.690, x_net_network_init.285 >>> start
[dtv_app_mtk]>[WIFI MW]c_net_wlan_wpa_reg_cbk
[dtv_app_mtk]>[WIFI MW]c_net_wlan_task_create
[dtv_app_mtk]>
[INET] 13.744, x_net_ni_enable.1444 >>> if enable eth0->eth0
[dtv_app_mtk]>
[INET] 13.744, x_net_network_init.357 >>> call eth0 enabled
[dtv_app_mtk]>
[INET] 13.744, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 1, plugin
[dtv_app_mtk]>
[INET] 13.744, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 2, unplug
[dtv_app_mtk]>
[INET] 13.745, x_net_network_init.371 >>> wifi plug/unplug callback reg-ed
[dtv_app_mtk]>
[INET] 13.745, x_net_network_init.374 >>> inited
[dtv_app_mtk]>
[INET] 13.745, x_net_ni_reg_ev_notify.2009 >>> dev: eth0->eth0, event: 3, ipchg
[dtv_app_mtk]>
[INET] 13.745, x_net_ni_reg_ev_notify.2009 >>> dev: eth0->eth0, event: 4, ipexp
[dtv_app_mtk]>
[INET] 13.745, x_net_ni_reg_ev_notify.2009 >>> dev: eth0->eth0, event: 1, plugin
[dtv_app_mtk]>
[INET] 13.746, x_net_ni_reg_ev_notify.2009 >>> dev: eth0->eth0, event: 2, unplug
[dtv_app_mtk]>
[INET] 13.746, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 3, ipchg
[dtv_app_mtk]>
[INET] 13.746, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 4, ipexp
[dtv_app_mtk]>
[INET] 13.747, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 1, plugin
[dtv_app_mtk]>
[INET] 13.747, x_net_ni_reg_ev_notify.2009 >>> dev: wifi0->wifi0, event: 2, unplug
[dtv_app_mtk]>
eth0 is unplug!
[dtv_app_mtk]>
[INET] 13.748, x_net_ni_enable.1444 >>> if enable eth0->eth0
[dtv_app_mtk]>
[INET] 13.748, x_net_enable.3543 >>> call eth0 enabled
[dtv_app_mtk]>
[INET] 13.748, x_net_set_if_type.416 >>> type: 71, wifi?
[dtv_app_mtk]>
[INET] 13.749, x_net_ip_config.836 >>> (eth0->eth0, 0x00000000, 0xff000000, 0x00000000)
[dtv_app_mtk]>
[INET] 13.768, ni_mon_thread.1850 >>> ra0 is plug!
[dtv_app_mtk]>
[INET] 13.768, ni_mon_thread.1906 >>> eth0 is unplug!
[dtv_app_mtk]>
[/sbin/ifconfig.script] ifconfig interface ipaddr netmask maskaddr
[dtv_app_mtk]>[/sbin/ifconfig.script] ifconfig eth0 0.0.0.0
[dtv_app_mtk]>DHCP_FLAG=0
[dtv_app_mtk]>IP=0.0.0.0
[dtv_app_mtk]>Subnet=0.0.0.0
[dtv_app_mtk]>router=0.0.0.0
[dtv_app_mtk]>DNS1=0.0.0.0
[dtv_app_mtk]>DNS2=0.0.0.0
[dtv_app_mtk]>[INET] 13.823, x_net_ni_enable.1444 >>> if enable wifi0->ra0
[   20.870109] NICLoadFirmware: We need to load firmware

[   20.940822] RTMP_TimerListAdd: add timer obj dfde6418!

[   20.943572] RTMP_TimerListAdd: add timer obj dfde6430!

[   20.950647] RTMP_TimerListAdd: add timer obj dfde6448!

[   20.953682] RTMP_TimerListAdd: add timer obj dfde6400!

[   20.958760] RTMP_TimerListAdd: add timer obj dfde63b8!

[   20.964109] RTMP_TimerListAdd: add timer obj dfde63d0!

[   20.969042] RTMP_TimerListAdd: add timer obj dfd7b64c!

[   20.973967] RTMP_TimerListAdd: add timer obj dfd67cdc!

[   20.979494] RTMP_TimerListAdd: add timer obj dfd67cf8!

[   20.984242] RTMP_TimerListAdd: add timer obj dfd7b6a8!

[   20.989556] RTMP_TimerListAdd: add timer obj dfd67d14!

[   20.994846] RTMP_TimerListAdd: add timer obj dfd6a644!

[   20.999641] RTMP_TimerListAdd: add timer obj dfd69eb4!

[   21.004932] RTMP_TimerListAdd: add timer obj dfd6a628!

[   21.010253] RTMP_TimerListAdd: add timer obj dfd6a8cc!

[   21.015043] RTMP_TimerListAdd: add timer obj dfd6a660!

[   21.020298] RTMP_TimerListAdd: add timer obj dfd6a67c!

[   21.025347] RTMP_TimerListAdd: add timer obj dfd6a698!

[   21.030640] RTMP_TimerListAdd: add timer obj dfcc77d0!

[   21.035616] RTMP_TimerListAdd: add timer obj dfcc7040!

[   21.040642] RTMP_TimerListAdd: add timer obj dfcc77b4!

[   21.046051] RTMP_TimerListAdd: add timer obj dfcc7a58!

[   21.050757] RTMP_TimerListAdd: add timer obj dfcc79d0!


....
    View
    3
    G
    giofrida
    You can extract your firmware using epk2extract. Clone it from github, build with "build.sh" inside the project and launch it from "build_linux" (if you're using Linux) with the following syntax: "epk2extract firmware.pkg". The program will split the firmware in blocks and extract them if possible. At the moment blala (aka smx-smx) is working on correctly unpacking the 3rd_rw block, which includes a lot of interesting files (such as the GUI). In addition, it's not possible for now to repack and flash the firmware, because part of it is encrypted with a key stored in a special (= not easily accessable) area of the chipset.

    If you just want to edit some files, as I did, you can connect your PC to the television using a USB to UART converter (personally I use a FTDI FT2232H board). Using a program, such as Realterm, you can send commands to the TV and you can, for example, enable telnet.

    If you're interested in this and you have a USB-UART converter, connect it to the TV on the Service Port using a 3.5" jack. The pinout of it is attached. Then, using Realterm configure your VCP with the following data:
    • Baud: 115200
    • Parity: none
    • Data bits: 8 bits
    • Stop bits: 1 bit
    When you start seeing data diplayed on the terminal, send ^C (Ctrl+C) and you will be able to send commands from the shell.
    Some useful commands:
    • Start telnet server: busybox telnetd -l /bin/sh
    • Start FTP server (log with anonymous): busybox tcpsvd 0.0.0.0 21 busybox ftpd -w /

    Using FTP I could download files, edit them and eventually upload them.

    I hope I've clearly answered your question. Let me know if you need any further help.
    View
    2
    T
    techtrails
    Hey,
    I have a working command injection at the moment on my Vizio Smart TV, I've also managed to launch the Opera browser via /3rd/opera/browser (there is no browser bundled with the Vizio TV Software that my TV is running), most of it is in Japanese but it is usable.
    How would I go about enabling telnet? I've checked -- there's no netcat or the like available, and telnet doesn't seem to be enabled from a port scan. I can access the file system via Opera with "file://"
    If you're interested in trying the exploit, go to Menu > Network > Hidden Network. All commands typed within `` seem to execute as root.
    I've also been able to copy the file system to a USB drive by running "cp -r / /tmp/mnt/usb/sda1". I'd imagine you wouldn't need an upload considering that there already seems to be a version of the firmware uploaded on GitHub in the thread.
    It's also worth noting that the TV has BusyBox installed based on the file system.
    Thanks for the help,
    techtrails
    View

New posts