yashsingh1/xdaforums huggingface dataset:
[Android Software Development] birry:
In my case using “busybox telnetd -l /bin/sh didn't work, either specifying the port with -p option, perhaps my linux version could be different?

# uname -a

Linux mt5880 3.0.13 #1 PREEMPT Wed Feb 19 00:44:30 CST 2014 armv7l GNU/Linux
[Android Software Development] giofrida:
What's the issue? Do you get any error?
[Android Software Development] birry:
Nothing, I submit the command normally, it does not get an output as it should worked, but telnet never works :eek:

even I can see the process running with ps
[Android Software Development] drdoolittle:
Whats your output when you do ifconfig? I had to give eth0 an IP address first then fire it up with ifconfig eth0 up, as CTRL+C when booting stops right before all relevant startup scripts fire up, including bringing up the ethernet port.
[Android Software Development] birry:
I not use the eth port, the tv connects by wifi. Using ifconfig I can see the correct lan ip of wlan interface, but I get no telnet trough there
[Android Software Development] drdoolittle:
Hm how about FTP, does that work? I suppose the IP of the TV is pingable?
[Android Software Development] birry:
Ping is OK :good:

Commands outputs, seems that ftp is not installed:

Telnet:

# busybox telnetd -l /bin/sh

FTP:

# busybox tcpsvd 0.0.0.0 21 busybox ftpd -w /
tcpsvd: applet not found
# busybox ftpd
ftpd: applet not found
[Android Software Development] drdoolittle:
I found a way to make access permanent: I put the telnetd command into run-OtaUpgrade.sh in /3rd_rw/software-update - it seems when the TV is started this script is invoked to check for available OTA updates :)

I now would be interested in seeing live what happens when I press buttons or open some apps. What would I have to do in order to log the systems behaviour? I know dmesg, but is there any other way for live logging certain processes / services?
[Android Software Development] birry:
with UART interface you can see all info in "verbose" mode

check connect by serial and press a button of remote control
[Android Software Development] drdoolittle:
Seems to be different with my TV. After booting up the OS there is nothing more displayed via the UART interface.
[Android Software Development] birry:
Which TV do you have? Let's compare hardware and firmware info

Mine is that:

# cat /proc/cpuinfo
Processor : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 1694.10
Features : swp half thumb fastmult vfp edsp vfpv3 vfpv3d16
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MT5880
Revision : 0000
Serial : 0000000000000000

# uname -a

Linux mt5880 3.0.13 #1 PREEMPT Wed Feb 19 00:44:30 CST 2014 armv7l GNU/Linux

MT5880 Boot Loader v0.9
Boot reason: A/C power on!!

Load T8032 FW (addr: 0x e10650, size: 24576)success!!
T8032 FW version: 73

Starting image...
U-Boot 2011.12.12 (Feb 19 2014 - 00:42:10)

~~~~~~~~~~~~~~~~~~~~~~~~~~| DirectFB 1.5.3 |~~~~~~~~~~~~~~~~~~~~~~~~~~
(c) 2001-2010 The world wide DirectFB Open Source Community
(c) 2000-2004 Convergence (integrated media) GmbH
----------------------------------------------------------------
[Android Software Development] drdoolittle:
Here's what I got:

sh-3.2# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc0e
CPU revision : 0

processor : 1
model name : ARMv7 Processor rev 0 (v7l)
Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc0e
CPU revision : 0

Hardware : MT5890
Revision : 0000
Serial : 0000000000000000

sh-3.2# busybox uname -a
Linux mt5890 3.10.27 #1 SMP PREEMPT Thu Aug 25 16:36:30 CST 2016 armv7l GNU/Linux

I suppose you got the other stuff from the serial console? Can't do that right now.
[Android Software Development] birry:
You can try to connect by serial in your TV (if it is as mine) through the VGA plug of the TV, test if you have RX at pin 4, GND at pin 5 and TX at pin 11, this is how I get connected by serial and see even the bootloader
[Android Software Development] drdoolittle:
Hi, could you please elaborate how to use the OTTPlayer for example on Hisense with OperaTV? I saw that there's some zip to download for LG TVs. So all I would have to do is extract it to the TV and open the index.html with the browser?
[Android Software Development] puercoespin:
No. Simply open your web browser in the tv and go to widget.ottplayer.es

You don't need to download anything. Just register your user and set your playlists once from your phone or your pc at the website.

Remember to change the HLS player to DEFAULT in settings.
[Android Software Development] drdoolittle:
OK thanks, I tried that site but it is very confusing (also because it is partially in russian). I worked out how to make a channel, but no matter what kind of URL I add to it, the player won't open it ("error connecting to stream")? When using the stream address with VLC player for example it works without problems.
[Android Software Development] birry:
Someone have an idea of this? It could be fantastic to tune with the tv
[Android Software Development] drdoolittle:
I'd like to try out the custom GCC you provide to compile moonlight for the Hisense H65MEC5550 with MT5890 CPU. How would I do that? Just git clone the toolchain and use make? How do I tell ubuntu not to use the preinstalled GCC but the custom one instead? (because I already tried compiling, but the preinstalled GCC was used and the compiled binary doesn't work on the TV)
[Android Software Development] birry:
Is it possible to do the same to install telnet or ssh in a mt5880 CPU? It could be a nice experiment to try
[Android Software Development] drdoolittle:
Should be possible with this GCC. But I'm quite a noob when it comes to compiling, so I hope p0isk can help me out here. Will send you the telnetd binary asap, maybe it'll work on your TV too.
[Android Software Development] birry:
Cool, look all your binaries, perhaps there is something else that could be useful
[Android Software Development] birry:
Well, after some experiments and googling I have found the following:

- to run telnet service, as I read Here, it is needed to uncoment a line of /etc/inetd.conf file, so this file should be RW

- for surprise, my root filesystem is RO:

# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro,relatime)
none on /proc type proc (rw,relatime)
none on /sys type sysfs (rw,relatime)
none on /tmp type tmpfs (rw,relatime)
none on /opt type tmpfs (rw,relatime)
none on /var/run type tmpfs (rw,relatime)
ubi1:3rd_rw on /3rd_rw type ubifs (rw,relatime,bulk_read,no_chk_data_crc)
/dev/mapper/dm-1 on /3rd type squashfs (ro,relatime)
tmpfs on /3rd_rw/tmp_upg type tmpfs (rw,relatime,size=153600k)
none on /proc/bus/usb type usbfs (rw,relatime)
ubi2:perm on /perm type ubifs (rw,relatime,bulk_read,no_chk_data_crc)

and as I read Here squashfs is a readonly filesystem and the only way should be flashing the tv, any ideas of how could I do that?

[MENTION=4505116]drdoolittle[/MENTION] could you check how is your root filesystem and if you have the following line uncommented at /etc/inetd.conf?

#telnet stream tcp nowait root /usr/libexec/telnetd telnetd
[Android Software Development] drdoolittle:
Yes, I already have looked into that, I have a similar line but as I wrote before everything is read-only, so I put something like that into a .sh script on the 3rd_rw partition which gets executed on startup. But it wouldn't work this way anyway, as you have to use busybox as there is not telnetd binary (at least not in my system).
[Android Software Development] birry:
My BusyBox has telnetd as yours have, the only is that I have not a telnet binary in /bin

Otherwise starting telnet invoking BusyBox appears to work (with no messages as I attached before), but it doesn't work anyway, are you Shure that you have not more changes?
[Android Software Development] drdoolittle:
I also haven't got a telnet binary in /bin or elsewhere - only busybox works. When starting the telnet daemon I too don't get any output in the shell, but I can connect via telnet to the TV. I also can see the process running ps aux
[Android Software Development] birry:
When I run telnet I even can run putty, select telnet, use my TV IP with port 23 and the command window shows up, but it is empty(all black, no messages) and if I type enter the cursor moves but nothing shows up, do you use any key combination to activate telnet in the client?
[Android Software Development] drdoolittle:
That's the way to go. Maybe you could try to use another port with the -p option of the telnet daemon?
[Android Software Development] birry:
Tried other ports and have no luck, telnet shows running with ps and i see telnet port listening with netstat, any other idea of what could be the problem?
[Android Software Development] p0isk:
TDA is just "Ready for DVB-T2 and DVB-C2", your TV must support it too.

For example for dvb-t2:page 41

without decoder CXD2838ER-T4 TVcan't show dvb-t2.

TV has logo and boot animation.

To change logo, goto service menu (by 1969 keys combination) Factory->Options->Logo and select "1 Hisense".

Put in /tmp you logo (jpeg, 1920x1080) and exec:

cd /3rd_rw/software-update/FlashWriter
./FlashWriter /dev/mmcblk0pXX /tmp/logo.jpg

where mmcblk0pxx is your mmc partition with manufactures logo's

Boot animation situated in /basic/startupimages and /basic/startupoem. Path to them is hardwrite in /3rd/browser/lib/libbrowser_egl.so and /3rd/browser/lib/libbrowser_dfb.so. So, there is no permanent method to change boot animation yet. You may unsquash your rootfs and replace files. But you must patch your kernel every times when you turn on TV;)

---------- Post added at 08:16 PM ---------- Previous post was at 07:59 PM ----------

Linux start /rtc/rc.d/rc.local that run another sctripts, e.g. /basic/autorun.sh.

autorun.sh run /3rd/bluetooth/bt_start.sh (symlinked to /3rd_rw/blutooth/bt_start.sh). I append this script by

echo "start telnetd......"
busybox telnetd -l /bin/sh &
busybox tcpsvd -vE 0.0.0.0 21 busybox ftpd -w / &

---------- Post added at 08:25 PM ---------- Previous post was at 08:16 PM ----------

All installed apps situated in /3rd_rw/appdata/launcher/

Replace URL and StartCommand in preset.txt for app which you don't use by "http://widget.ottplayer.es/"

Replace startCmd and objectUrl in data/CategoryXX_XXXXXXXXXX.xml by "http://widget.ottplayer.es/"

Also, you may replace name and icon for app.
[Android Software Development] p0isk:
Except telnet and u-boot Hisense TV has another console: DTV. Use Esc key when trun on TV.

DTV>help

[Help]
upgrade(u): Upgrade firmware
boot(bt): Boot firmware
logo(logo): Display logo
chipid(chipid): print chip id
memtest: Memory test
eeprom: Eeprom command
msdc: Msdc command
read(r): Memory read(word)
write(w): Memory write(word)
basic_(b): basic command
mtktool(0): mtktool command
cd: Change current directory
do: Repeat command
DTV>b.sv
GUEST mode

"b.scm 0" change mode from guest to supervisor.

BE CAREFULL! Don't forget to make backup of eeprom!!

In telnet:

ls /dev/eeprom*
busybox dd if=/dev/eeprom_0 of=/tmp/eeprom_0 bs=1 count=16384
busybox dd if=/dev/eeprom_3 of=/tmp/eeprom_3 bs=1 count=16384
[Android Software Development] p0isk:
By using FlashTool0.6.8.2 you can update firmware, read/write memory. Case MT53XX for MT58XX cpu

(I found only 0.5.0 and MtkTool 2.48.07)

http://www.go-gddq.com/upload/2016-02/16021416484231.pdf
[Android Software Development] p0isk:
And something interesting. I found AES key for Hisense and some Sharp and Philips TV's.

dd if=upgrade_loader.pkg of=header.aes bs=16 count=10
openssl enc -aes-128-cbc -vi 0 -d -K 09291094092910940929109409291094 -in header.aes -out header
hexdump -C header
00000000 68 69 73 65 23 44 48 40 46 69 52 6D 49 44 54 56 |hise#DH@FiRmIDTV|
00000010 04 87 57 42 57 85 B2 F1 4D E0 AA 53 71 2E E6 DE |.‡WBW…ІсMаЄSq.жЮ|
00000020 5E 3E E1 66 F8 31 4D 4C FE BB 27 CF 34 9A F5 CC |^>бfш1MLю»'П4љхМ|
00000030 17 2B 9F A0 45 EB 66 BF 10 BA A0 BC 55 79 BF 27 |.+џ*Eлfї.є*јUyї'|
00000040 09 A6 98 A5 B0 02 42 1A A6 7A A2 64 C2 0B 36 5D |.¦.Ґ°.B.¦zўdВ.6]|
00000050 7D 82 E9 F8 B7 E7 41 5F 64 CD EF B8 FA 69 C5 73 |}‚йш·зA_dНпёъiЕs|
00000060 A9 51 6D 87 B4 5C 17 99 80 FD 3A C5 50 75 37 3B |©Qm‡ґ\.™Ђэ:ЕPu7;|
00000070 2C CC 0D FD 58 74 A2 38 4D 16 F6 4C F4 B4 1E A8 |,М.эXtў8M.цLфґ.Ё|
00000080 EA BB 1E C9 9F FF EC CE 4C F2 ED 74 E6 B1 E9 D4 |к».ЙџямОLтнtж±йФ|

Hm, first string of header and digest are good, but not other.

Header :
35 b3 67 73 08 b5 82 c3 7e d0 9c 0c 40 1c b9 ee 5.gs....~...@...
6e 0f be 55 cf 6e 7d 7c c9 e4 16 f6 00 9a f5 cc n..U.n}|........
17 2b 9f a0 45 eb 66 bf 10 ba a0 bc 55 79 bf 27 .+..E.f.....Uy.'
09 a6 98 a5 b0 02 42 1a dd ac 39 21 c2 0b 36 5d ......B...9!..6]
10 f6 dc c0 8e d7 1e 3a 11 92 83 d1 94 1c bd 73 .......:.......s
a9 51 6d 87 b4 5c 17 99 80 fd 3a c5 50 75 37 3b .Qm..\....:.Pu7;
38 b9 d6 10 84 03 94 b2 c3 60 14 9b ed 0b 63 73 8........`....cs

Header :
68 69 73 65 23 44 48 40 46 69 52 6d 49 44 54 56 hise#DH@FiRmIDTV
31 34 30 31 5f 30 30 32 33 30 36 5f 31 32 5f 30 1401_002306_12_0
30 31 5f 33 37 5f 30 30 37 5f 31 39 34 00 00 00 01_37_007_194...
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 7b d6 9b 45 00 00 00 00 ........{..E....
6d 74 35 38 39 30 5f 65 75 5f 6c 69 6e 75 78 00 mt5890_eu_linux.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Validate codefile HMAC
open File = /mnt/usb_0/upgrade_loader.pkg
Encrypted digest:
ea bb 1e c9 9f ff ec ce 4c f2 ed 74 e6 b1 e9 d4 ........L..t....
9c f4 dd 7b 1b cc d9 f3 7e 0e 00 2d 80 00 77 cb ...{....~..-..w.

Download digest
2c cc 0d fd 58 74 a2 38 4d 16 f6 4c f4 b4 1e a8 ,...Xt.8M..L....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

But wait... second string of digest is look like first encrypted string! It's mean that after AES you need apply some operation with previous string. But which operation? Subtract? Maybe, but it does work for header. XOR is the answer!

Conclusion:

+we can sign selfmade firmware

-we can not sign part of firmware (mtk loader, uboot... ): it needed RSA key

-we don't have anything to sign

P.S.: Sharp Android TV based on mt5890 cpu and don't encrypt like Sony. Do you want Hisense Android TV?;)
[Android Software Development] giofrida:
WOW p0isk! They're a lot of new info.

I can confirm the AES key is correct for my firmware. The "openssl [...]" command gives "iv undefined", perhaps it misses the "-iv 0" option.

I really look forward to seeing where this will lead us to.
[Android Software Development] p0isk:
Thank's, I use openssl enc -aes-128-ebc, but openssl enc -aes-128-cbc -iv 0 is correct.
[Android Software Development] hawkeyeru:
Oh, I would be very glad if you could turn on the power on the network ... but alas.
[Android Software Development] p0isk:
Do you mean Wake-on-LAN?
[Android Software Development] birry:
I have no luck with telnet daemon either drdoolittle's and official BusyBox from debian web don't work :/
[Android Software Development] hawkeyeru:
You can run telnetd with build-in busybox.

Poisk - yes, i mean WOL.
[Android Software Development] bululu:
Do you think with all of this knowledge mounting Samba/CIFS shares would be possible, maybe as virtual USB drive?

I am asking because:

That was the workarround to bypass poor DLNA capabilities on my old Samsung TV:

For license reasons the old TV just supported basic DLNA, but when plugging in a USB Pendrive the TV was suddenly able to display almost all codecs that were available 2009 including AVC (H.264).

So the TV got "fooled" by mounting a Sambaserver as a directory "sda1" in the correct folder. Then playing all those codecs via network and using the internal TV playersoftware was possible.
[Android Software Development] hawkeyeru:
Why virtual, if you can insert a small USB flash drive?

Also discussed TV models do not have restrictions on the showing video on DLNA technology.
[Android Software Development] bululu:
Its not neccessary to make the flash drive virtual. Maybe mounting into an existing real drive is easier.

From my experience (up to 2013 though) smartTVs accept more fileformats from the usb port compared to DLNA. But maybe that changed during time.

I am thinking of files using as videocodec hevc and for audio aac or maybe opus.
[Android Software Development] bananasplit1:
This doesn't seem to work on a Hisense 40M3300 running firmware 0919. Although the menu tree is different.
[Android Software Development] bananasplit1:
Is the UART interface on the mainboard TTL?
[Android Software Development] darkside40:
Maybe its possible to use the Dirty Cow Vulnerability to root the TV, once you gained shell access?
[Android Software Development] bananasplit1:
I believe root access is already possible via the UART interface.
[Android Software Development] birry:
Excellent!!! Do you find where TV dlna name is stored? I mean the name of the TV when you cast YouTube from a mobile phone for example
[Android Software Development] giofrida:
If you mean the name you see in the "Anyview Cast" screen ("Smart TV" as default) then you can already change it under Settings > Network > TV Name > User Input
[Android Software Development] birry:
Mine has not this option, I have a ltdn40k360, perhaps editing the menu I could add this feature, do you see it at html code of your TV?
[Android Software Development] giofrida:
The script UI/hisenseUI/modulePages/setting/settingNetTVNameListDialog.js contains the code used to set the TV name: the function setSettingNetTVName sets the name of the TV by calling model.system.setMachinename(currTVName), with currTVName being the string which represents the name. To save the set name the function calls settingFirPageSetNetworkTVName(currTVName) in SettingFirPage.js.

Check if you have these functions in your files.
[Android Software Development] birry:
I have not /UI directory :/

here are some ls's

# ls /

3rd dev interfaces perm tmp

3rd_rw etc lib proc usr

_3rd gfxdrivers linuxrc sbin var

basic home mnt sys wm

bin inputdrivers opt systems

ls

3rd_ini libapp_socket_client.so

DockUI.xml libcmpb.so

am_config libconfig_parser.so

am_start.ini libdtv_common.so

app_man libdtv_svc_if.so

autorun.sh libhandle_app.so

bin libmtal.so

config libmtkapp.so

config.txt libmw_if2.so

dtv_driver.ko libnetwork_detect.so

dtv_svc librpc_ipc.so

dtv_svc.ini libtqtvd_atv_porting_layer.so

ept libusb_detect.so

fusion.ko modules

ginga post_keymap.ini

keymap.ini skype.ini

keymap_tv.ini tty_man

lib turnkey_cli

libapp_if.so upgrade

libapp_if_nonrpc.so wifi_ko

libapp_if_rpc.so yahoo.ini
[Android Software Development] giofrida:
The UI folder should be located in 3rd_rw. Perhaps it's better to chat via PM instead of using the thread. I wouldn't want to go OT more than it already is.
[Android Software Development] birry:
Good idea, yes, the thread is far away from the title, but there was found pretty interesting stuff investigating that ?
[Android Software Development] drdoolittle:
Well I wouldn't mind when you keep posting here, as there isn't much discussion here and I think it's not totally off topic.
[Android Software Development] birry:
Hey drdoolittle! Remember the telnet issue? Its's still not working, I have no idea what can be, perhaps we can compare some stuff, such as kernel or os
[Android Software Development] felymm:
hello everyone, is it possible Hisense tv to root

Model:HE58KEC730

thx
[Android Software Development] BigMatza:
Looking to connect to my Hisense 50H6C. Would any of these cables work:

https://www.amazon.com/dp/B00M33AQLK

http://www.mcmelectronics.com/product/FTDI-TTL-232R-3V3-AJ-/831-3228

I'm a little confused because your pin-out differs from the one here (http://www.instructables.com/id/USB-to-TTL-UART-Converter/). Although, it's more likely that the instructable is accounting for the UART Tx/Rx, rather than the set for the TV.

Thanks!
[Android Software Development] giofrida:
Hi. First of all, I'd like to clarify that these are not simply "cables": actually inside the USB connector there is a USB-TTL transceiver, a little board that (roughly) converts UART signals into USB signals.

Apart from that, the first two adapters won't work. The first one because works in the 5V range and the second one because it has a slightly different pinout (TX and RX are swapped). About the third one (the instructable) I think it's ok if you know how to make a PCB and solder by yourself.

My personal suggestion is to buy one of these adapters which are both 5V and 3.3V compliant (can be selected with the switch) and solder to the board an audio jack cable with the needed pinout. Alternative boards can be: https://www.seeedstudio.com/USB-To-Uart-5V&3V3-p-1832.html, https://www.amazon.com/Micro-Basic-Breakout-Module-Arduino/dp/B00N4MCS1A, https://www.amazon.com/WINGONEER-CP2102-Module-Serial-Converter/dp/B01LRVQIFQ, etc.. (just search "USB to UART 3.3V"). Be aware that FT232x-based boards may have a fake IC: they can still be used, but with some workarounds (read this).
[Android Software Development] drdoolittle:
Does anyone know where one can change the functionality of the TV buttons? Would love to remap some of the buttons respectively map functions, for example directly choosing a HDMI input with a certain button (because universal remotes have problems with the Hisense dynamic switching of sources).
[Android Software Development] p0isk:
All functionality are in /3rd_rw/UI/ JS files.

Also, F0723 firmware has functionality for remap LiveTV button to any source from menu, but I didn't find this functionality in G0828 firmware.
[Android Software Development] drdoolittle:
Thanks for the hint! My remote doesn't have a LiveTV button, just a input button which starts the source menu where I have to select the input.
[Android Software Development] broanic:
Hello, i have a Hisense TV 50k390 but i don't have android tv. Hisense support, said that i can put it on but he can not give me more information.

My model in the US and Australia have android. What I can do? Any firmware install it?

thanks
[Android Software Development] p0isk:
Some very very interesting files in boot.tar.gz:

http://opensource.lge.com/osSch/list?types=ALL&search=55LF592V-ZB

And there Sony OSS:

http://oss.sony.net/Products/Linux/TV/
[Android Software Development] birry:
Hi, I've checked out and my tv shows scanning manually a new firmware upgrade. I still keep from upgrading it just to use this chance to research some useful info.

I logged the tv out by serial and I found that it grabs firmware package from here

http://overseas.download.hismarttv.com/overseas/5652/LTDN40K360WAMN_10_pkg_20151119.pkg

Can it be useful for something? Any other idea to check out before upgrading?
[Android Software Development] pirate32:
The user fellaw posted in neophob com/2010/01/root-my-tv-hack-philips-pfl9703/ about exploiting Busybox DHCP client to get higher access to the TVs, here is the full post (for backup)
[Android Software Development] borillion_star:
Does anyone accidentally have 50H5G_V00.01.130a.F0113_us.zip anywhere, HiSense removed it from their site. :( [MENTION=1829889]vache[/MENTION] any chance? :P HAHA
[Android Software Development] vache:
Nop, sorry :/
[Android Software Development] Johnysamajhdar:
Mate i'm looking forward to root my LTDN55XT780XWAU3D model. I think it also runs Opera TV OS. Is it possible to change the firmware on TV ? Please help. I would like to install android firmware on my TV. Can it be done? Please suggest. I can post the pics of my TV and OS if needed.
[Android Software Development] diabl0w:
Does anyone know of a script that gets executed on boot automatically on the /3rd_rw partition? None of the examples given in this thread work for me on a Sony KDL model. I have a /3rd_rw/upgrade folder (different from the "update" folder mentioned in this thread) but when placing an "OtaUpgrade.sh" script in there, it is never exectuted. Interestingly, however, is that the TV won't boot with the script in that folder unless i unplug the tv from power and plug it back in. So I believe somehow the system is executing the script and then preventing bootup for security purposes