TV Hacking

**zildan** · 10-02-14, 00:03

Deschid un topic dedicat modificarii televizoarelor.
Nu ne ocupam de cele deja "rezolvate".
Aici adunam date despre celelalte si purtam discutii pe aceasta tema.
Eu am un LG cu chipset MTK si vreo 7 vestel care majoritatea au MSTAR.
Seria de la Samsung care nu e "doborata" e bazata pe MSTAR.
Atasez o documentatie de LG bazat pe MSTAR.

**zildan** · 14-03-14, 16:58

Nu am renuntat la proiect. Am avut mult de lucru (asta e bine la buzunar si .... la bugetu de stat).

**zildan** · 02-02-15, 00:25

Intre timp lucrurile nu au stat pe loc. La televizoarele VESTEL s-a decriptat fisierul de setari.
La seriile din ultimii 5 ani de LCD-led Plasma de la Vestel puteai doar sa vevi setarile, mofificari se puteau face doar prin intermediul unor fisiere furnizate de producator.
In scurt timp voi prezenta metoda prin care intrii in consola pe tv, descarci din linuxul televizorului cele 2 file, le prelucrezi pe pc si le reincarci.
Viitorul suna bine. Eu am 2 LG-uri si vreo 10 Vestel (am mai dat si la parinti)
Pentru cei care nu stiu, pe televizoare nu scrie Vestel, de ex scrie toshiba , sharp, philips etc.

**zildan** · 02-02-15, 03:58

Am reusit sa pornesc toate optiunile ascunse.
CEC merge mult mai bine decat pe LG !
Aveau toate televizoarele functia CEC disabled !
Am dezactivat si criptatea la inregistrare si multe altele.
Azi plec la Craiova ... am si acolo material de studiu !

**zildan** · 02-02-15, 12:22

scarttors2327vf.th.jpg

Nu merge cu adaptor USB normal, am reusit cu cel cu care programez procesoarele Atmega.

Using a SCART <-> RS 232 cable to a CP2102 I could get to the console.

10 and 12 (RX / TX PIN SCART try out best ) And GND easy to chassis.

Thus, I was able to:
cp /apsettings/profile/median_swprofile.bin /mnt/usb/sda1/median_swprofile.bin

La loc se pot pune automat.
La versiunea asta de mainboard se copiaza in radacina stickului apoi Meniu 7425 > USB Operations si le preia automat televizorul.

save the file to USB and change:
cp /mnt/usb/sda1/median_swprofile.bin /apsettings/profile/median_swprofile.bin
chmod 0744 /apsettings/profile/median_swprofile.bin

Now I was able to successfully unlock the software. HDMI Switch works just like PVR! Thanks also to jufoda for the Java file.

Herewith I could also advance extract the software from the firmware:
https://github.com/jrspruitt/ubi_reader
apsettings:
ubi_reader-master> extract_files.py -s751714 upgrade.pkg

nv_backup:
ubi_reader-master> extract_files.py -s2717862 upgrade.pkg

(could be the most interesting since there was vestel.bin and then analyzed by IDA) basic_partition
ubi_reader-master> extract_files.py -s4684010 upgrade.pkg

Greetings and thanks again

**zildan** · 02-02-15, 12:53

Momentan salvez pasaje aici. In final le pun cap la cap si le corectez.

---------- Post added at 12:26 ---------- Previous post was at 12:24 ----------

Here is jufodas Java program in a simplified variant: Vestl profile Readers V2

You only have to unpack everything and put the sw_profile file into the folder "Vestel profiles Reader" and open the Vestel.bat. At the end of 4 text files are created of which the contents of the software profile shows in decrypted form of hex addresses.

And I have thanks to a helpful user found out from another forum how to activate Bildaufbesser function calling itself "Vestel Pixellence" is the name of the functional and forth with the "Bravia engine" of sony to compare is. See quote:
Quote:
First original Vestel integrated circuit, with genuine Vestel patented video processing algorithms, Entirely designed by Vestel R & D. Pixellence1 video processing algorithms includes color enhancement, skin tone detection and correction, sharpness and contrast enhancement technologies improvement. Pixellence1 technology had been presented to customer first in 2007 with the aim of Improving Vestel TV's picture quality level to the higher. Pixellence1 video processing algorithms Provides all details of the picture with high contrast, vivid and natural colors at high picture quality level.
Whether this can now keep up really high with the Sony would have to be tested.
and although you may have to adjust these values as follows:
Code:

[0x74a4] PixellenceWorkingMode = 2 [0x2] - [0xa863b7c0] [0x305] [0x4] (default 0)
[0x74cc] PixellenceControlInvisible = 0 [0x1] - [0xec8082b6] [0x205] [0x4] (default value

---------- Post added at 12:53 ---------- Previous post was at 12:26 ----------

So this goes back up that way.
USB stick size matter, format it with FAT32.
On the Create stick to a file named -> DownloadProfile.mb95
This file must therefore be the only one in the root directory at the top without subfolders. Now plug in the stick and press the Menu key and go into Service mode switch 4-7-2-5 there to the point USB Operations go and confirm with OK waarten briefly and then lie on the stick 3 files (mb95_hwprofile.bin, mb95_langprofile.bin, mb95_swprofile.bin) secure it on the PC first, best in a folder name Profile. Then stick format and create the following file DownloadSpi.mb90 these are very, very important elementary files (edid.edid, mb90_credentials.bin,
mb90_ddr.bin, mb90_hdcp.bin, mb90_hdcp2.bin, mb90_mac.bin), this does not change but save on the PC in a SPI folder.
the replay of the amended mb95_swprofile.bin, goes like this. Create a folder on the stick profile name, therein lay the modified file and perform the same procedure as for the secure, the file size is copied back into the machine. This can also be done with the SPI files in case something should go wrong as MAC zerschossen or other important things, but to create a spi folder on the stick and lay all SPI files there, then save the same procedure as in.

The Internet portal Who does not like the rest, because it is the branding with Telefunken, or because it has too few apps that should have some variety for VESTEL portal, there is even an app store on TV. This can be set in the software profiles.

**horatyu** · 02-02-15, 16:51

Originally Posted by zildan

Am reusit sa pornesc toate optiunile ascunse.
CEC merge mult mai bine decat pe LG !
Aveau toate televizoarele functia CEC disabled !
Am dezactivat si criptatea la inregistrare si multe altele.
Azi plec la Craiova ... am si acolo material de studiu !

pentru clarificare CEC = " The CEC (Consumer Electronics Control) capability allows HDMI devices to control each other when necessary and allows the user to operate multiple devices with one remote control handset.^{[5] "}

**zildan** · 02-02-15, 21:18

Merge telecomanda de la televizor ca si cum ar fi a receptorului !
Bomba bombelor ar fi acum, ca am ajuns la Craiova si am un orion care nu are NET !
Dar in service se vede ca decriptand fila de setari se poate activa prin stick wireless.
Evident ca am stick, sa vedem acum ! Va tin la curent.

**zildan** · 14-02-15, 03:14

Am descoperit cateva functii noi, metode de a face autobackup.
O sa dureze sa inteleg din IDAPro.

Am gasit si procedurile de CI, le zice ICE.
Se vad intre ele televizoarele !
Poti sa te uiti pe inregistrari intre ele.
Am pornit si WIFI-Direct.
Are suport si pt USB-Network.

**zildan** · 12-02-15, 23:48

O sa iau de la service-ul autorizat firmware de reparatie oficial pe serie.
Deja am inceput tratativele.
La celelalte am asa ceva !

---------- Post added at 22:43 ---------- Previous post was at 22:35 ----------

Code:

top - 20:42:44 up 4 min,  0 users,  load average: 0.17, 0.19, 0.09
Tasks:  32 total,   2 running,  30 sleeping,   0 stopped,   0 zombie
Cpu(s):  3.3%us,  2.6%sy,  0.7%ni, 92.1%id,  0.0%wa,  0.7%hi,  0.7%si,  0.0%st
Mem:    277072k total,   123664k used,   153408k free,      176k buffers
Swap:        0k total,        0k used,        0k free,    61920k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
  241 root      20   0  799m  59m  35m S  5.6 22.0   0:29.18 aurora.elf
  240 root      20   0  2912  912  752 R  0.3  0.3   0:00.04 telnetd
  616 root      20   0  3056 1616 1296 R  0.3  0.6   0:00.10 top
    1 root      20   0  2848  960  816 S  0.0  0.3   0:00.16 init
    2 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 kthreadd
    3 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ksoftirqd/0
    4 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 events/0
    5 root      15  -5     0    0    0 S  0.0  0.0   0:00.01 khelper
    8 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 async/mgr
   45 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 kblockd/0
   65 root      20   0     0    0    0 S  0.0  0.0   0:00.00 pdflush
   66 root      20   0     0    0    0 S  0.0  0.0   0:00.01 pdflush
   67 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 kswapd0
  183 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 mtdblockd
  184 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 nftld
  221 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ubi_bgt0d
  225 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ubi_bgt1d
  227 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ubifs_bgt1_0
  228 root      20   0  2912 1168  976 S  0.0  0.4   0:00.04 rcS
  232 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ubifs_bgt0_0
  235 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 ubifs_bgt1_1
  340 root      15  -5     0    0    0 S  0.0  0.0   0:00.92 khubd
  384 root      15  -5     0    0    0 S  0.0  0.0   0:00.00 scsi_eh_0
  385 root      15  -5     0    0    0 S  0.0  0.0   0:00.01 usb-storage
  401 root      20   0     0    0    0 S  0.0  0.0   0:00.00 scsi-polling th
  467 root      24   4     0    0    0 S  0.0  0.0   0:00.18 RtmpTimerTask
  468 root      24   4     0    0    0 S  0.0  0.0   0:00.73 RtmpMlmeTask
  469 root      24   4     0    0    0 S  0.0  0.0   0:00.00 RtmpCmdQTask
  470 root      24   4     0    0    0 S  0.0  0.0   0:00.00 RtmpWscTask
  554 root      24   4 20160  15m    0 S  0.0  5.7   0:02.90 linux-mipsel-sk
  608 root      20   0  2912 1152  976 S  0.0  0.4   0:00.02 sh
  614 root      20   0  2912 1152  976 S  0.0  0.4   0:00.02 sh

---------- Post added at 23:48 ---------- Previous post was at 22:43 ----------

Am uitat sa precizez ca sunt pe wireles conectat pe net!

Code:

# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:28105 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28105 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6646500 (6.3 MiB)  TX bytes:6646500 (6.3 MiB)

ra0       Link encap:Ethernet  HWaddr 60:02:B4:5E:69:2D
          inet addr:192.168.1.145  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1300  Metric:1
          RX packets:110895 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7355 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:25660171 (24.4 MiB)  TX bytes:2020910 (1.9 MiB)

#

**zildan** · 13-02-15, 15:11

Merg aplicatiile mipsel perfect !
Am pus alt busybox, pentru ca cel original avea putine comenzi.

Code:

# ./busybox-mipsel
BusyBox v1.19.0 (2011-08-14 23:54:25 CDT) multi-call binary.
Copyright (C) 1998-2011 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: busybox --list[-full]
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        [, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash,
        awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl,
        bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod,
        chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm,
        cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd,
        deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff,
        dirname, dmesg, dnsd, dnsdomainname, dos2unix, du, dumpkmap,
        dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake,
        expand, expr, fakeidentd, false, fbset, fbsplash, fdflush, fdformat,
        fdisk, fgconsole, fgrep, find, findfs, flock, fold, free, freeramdisk,
        fsck, fsck.minix, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty,
        grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid,
        hostname, httpd, hush, hwclock, id, ifconfig, ifdown, ifenslave,
        ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip,
        ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel,
        kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64,
        linuxrc, ln, loadfont, loadkmap, logger, login, logname, logread,
        losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lspci, lsusb, lzcat, lzma,
        lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom,
        mkdir, mkdosfs, mke2fs, mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat,
        mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount,
        mountpoint, mpstat, mt, mv, nameif, nbd-client, nc, netstat, nice,
        nmeter, nohup, nslookup, ntpd, od, openvt, passwd, patch, pgrep, pidof,
        ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir,
        poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx,
        raidautorun, rdate, rdev, readahead, readlink, readprofile, realpath,
        reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir,
        rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv,
        runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
        setconsole, setfont, setkeycodes, setlogcons, setserial, setsid,
        setuidgid, sh, sha1sum, sha256sum, sha512sum, showkey, slattach, sleep,
        smemcap, softlimit, sort, split, start-stop-daemon, stat, strings,
        stty, su, sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync,
        sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test,
        tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6,
        true, tty, ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol,
        ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, umount, uname,
        unexpand, uniq, unix2dos, unlzma, unlzop, unxz, unzip, uptime, users,
        usleep, uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch,
        watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes,
        zcat, zcip

---------- Post added at 14:39 ---------- Previous post was at 13:17 ----------

Code:

# ./oscam
12:38:34        0 s >> OSCam <<  cardserver started, version 1.20-unstable_svn, build r10458 (mipsel-unknown-linux-gnu)
12:38:34        0 s     (main) System name    = Linux
12:38:34        0 s     (main) Host name      = (none)
12:38:34        0 s     (main) Release        = 2.6.28.10
12:38:34        0 s     (main) Version        = #31 PREEMPT Wed Aug 14 18:55:38 CST 2013
12:38:34        0 s     (main) Machine        = mips
12:38:34        0 s     (main) creating pidfile /tmp/.oscam/oscam.pid with pid 923
12:38:34        0 s     (main) signal handling initialized
12:38:34   54B890 h    (webif) webif: decompressed 152402 bytes back into 366512 bytes
12:38:34   54B890 h    (webif) HTTP Server running. ip=0.0.0.0 port=8888
12:38:34        0 s     (stat) loadbalancer: can't read from file /tmp/.oscam/stat
12:38:34        0 s     (main) waiting for local card init
12:38:34        0 s     (main) init for all local cards done
12:38:34        0 s (emmcache) can't read emmcache from file /tmp/.oscam/oscam.emmcache
12:38:34        0 s (emmcache) can't read emmstats from file /tmp/.oscam/oscam.emmstat
12:38:34        0 s (anticasc) anti cascading disabled
12:38:34   54EEC0 c   (client) plain dvbapi-client granted (anonymous, au=off)
12:38:34   54EEC0 c   (dvbapi) dvbapi channelcache can't read from file /var/tuxbox/config/oscam.ccache
12:38:34   54EEC0 c   (dvbapi) ERROR: Could not detect DVBAPI version.

---------- Post added at 14:42 ---------- Previous post was at 14:39 ----------

Poti sa pui server de oscam si cccam pe tv. Ramane sa se gaseasca o cale de DVB-API !

---------- Post added at 15:11 ---------- Previous post was at 14:42 ----------

Am desasamblat executabilul !
Aurora se numeste softul .

**mirel** · 13-02-15, 19:13

Ramane sa se gaseasca o cale de DVB-API

acolo-i buba...

...cum spuneam: dau o bere!!!..

**zildan** · 27-11-15, 18:17

Pentru cei care nu stiau ce inseamna VESTEL:

si in domeniul militar:

**zildan** · 14-12-16, 12:00

Am trecut la Vestel UHD, e mainboard 17MB100, prezent pe seriile 2015 final de an Panasonic.
Se poate face backup la setari, au schimbat insa codarea lor dupa ce au fost decodate.
Am activat logul prin interfata TTL-USB, nu merge insa decat in citire.
Ori am gresit ceva la fire, desi am sapat 3 ore aseara (am relevat cablu adaptor SCART-mufa TV, care e special) si am decodat corespondenta pinilor (nu mai merge combinatia 17MB95).

Code:

[AT][MBoot][Boot Nuttx][1980]
## Booting kernel from Legacy Image at 20400000 ...
   Image Name:   Linux-3.10.23
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3280280 Bytes = 3.1 MiB
   Load Address: 20208000
   Entry Point:  20208000
   Verifying Checksum ... OK

Code:

[CPU INFO] cpu openCPUIoctl - MDrv_CMD_CPU_QueryClock
## Software Version: V.0.1.33.17 SVN  192281
   MBoot Version:    MB100-068 PM ver: 1027
   NAND Size:        0
   DDR  Freq:        0M
   CPU  Freq:        756M
   DDR  Size:        1536MB

E posibil sa lipseasca o rezistenta pe cablaj ca sa nu pot edita prin consola rcS sa pornesc telnet.
Nu il desfac inca televizorul.

Are tunere C, C2, T, T2, S2, merg UHD-urile in HEVC, si Youtube4k in Vp9, e 3D activ si merge BT cu orice device, am conectat o boxa externa la el si merge fb.

Nu stie decat diseq 1.0, nu muta HH, isi masoara cu mare grija curentul si da mesaje de eroare daca apare ceva scurgeri.

Am o noua jucarie

**horatyu** · 04-02-15, 11:32

deci vrei sa spui ca il poti face sa aiba si wi-fi ? ar fi ceva sa putem face si asa ceva, adica sa facem un tv SMART doar din setari

Thread: TV Hacking

Thread Tools

Display

Hybrid View

TV Hacking

Posting Permissions