yashsingh1/xdaforums huggingface dataset:
[Android Software Development] fellaw:
You may want to try

/3rd_rw/sigma/mtksigma_start_wfd.sh

or

/mnt/usb/sda1/sigma/mtksigma_start_wfd.sh

Those are attempted to be executed on my MT53xx based philips TV.

I did mention this here a while ago:

https://xdaforums.com/t/rooting-mediatek-based-linux-smart-tv.3150281/page-11#post-85123333
[Android Software Development] chris1892006:
Has anyone rooted the tv yet? I have my Hisense 43A6H boot.img but after patching and flashing in fastboot, still no root... On Android 11. I tried almost every version like 6 magisk versions and all same result. Whats the deal?
[Android Software Development] chris1892006:
Can you help with that Hisense root file you uploaded? I had to use an updated adb to get it to work yet it still wouldn't work...

D:\HISENSE 43A6H GOOGLE TV\Root\root>root.bat

╥╗╝ⁿroot╣ñ╛▀ú¼▓╗╚╖╢¿╦∙╙╨╗·╨═─▄╙├ú¼by ╦º▓╗╖│í¡í¡

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

╟δ╩Σ╚δ╡τ╩╙(║╨╫╙)╡─IP╡╪╓╖ú║

┐¬╩╝┴¼╜╙í¡í¡

unable to connect to :5555

adbd cannot run as root in production builds

/system/bin/sh: /system/bin/remount: inaccessible or not found

failed to copy 'su' to '/system/bin/su': couldn't create file: Read-only file system

failed to copy 'Superuser.apk' to '/system/app/Superuser.apk': couldn't create file: Read-only file system

chmod: /system/bin/su: No such file or directory

╓╪╞⌠╡τ╩╙(║╨╫╙)ú¼╡╚╞⌠╢»═Ω╛═╛═╩╟root┴╦ú¼╒Γ╕÷┼·┤ª└φ┐╔╥╘╣╪┴╦í¡í¡
[Android Software Development] chris1892006:
Any update because I used Python Binwalk to extract my Hisense 43A6H firmware and no dice once i extracted the .pkg it had two .gz files in there that couldn't be extracted using gzip in Python. I plan on upgrading to a Sony google tv and want to root it, your thoughts?
[Android Software Development] D@rkbytes:
Greetings.

Does anyone know how to extract encrypted MTK firmware for TV?

I saw that they mentioned something about MTK_RESERVED_MAGIC and I have some firmware that have that byte string:

9BF7ED4FDA262A8E58FC63CF38F6E8A9

I have been trying for a long time to find some script or program that can unpack them, but so far I have not been able to find it.

I appreciate any information about it.

Thank you.
[Android Software Development] fellaw:
Can you post the first 0x20 bytes or so? I did write myself a small python program to decrypt and split the Philips QN141E firmwares once I had their key and iv. Not sure if it could be used in your case. Guess depends on whether the decrypted structure is similar, i.e. with a per-section magic after decrypt, for the split part.

A pure decrypt should be possible with just openssl if you have a key, an iv, and if you have a rough guess of the used cipher (i.e. from binwalk).
[Android Software Development] D@rkbytes:
Greetings.

In the post I attached a photo where you can see the first 20 bytes and a little more.

This is the firmware link

I am attaching only 2 MB of the file for an analysis of the header.

I would be very grateful if you can find something.

Thank you.
[Android Software Development] fellaw:
Different structure than the Philips QN141E firmwares and definitely encrypted. My python programm won't help here, sorry.

You won't be able to decrypt it at all without the proper key. Binwalk signature and entropy results:

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
38906177 0x251A941 MySQL ISAM index file Version 8
63339658 0x3C67C8A GPG key trust database version 123
73058385 0x45AC851 Windows Script Encoded Data (screnc.exe)
206542461 0xC4F967D End of Zip archive
218627908 0xD07FF44 MySQL MISAM compressed data file Version 11
236573427 0xE19D2F3 Cisco IOS experimental microcode, for "6H"
255992819 0xF4223F3 MySQL MISAM compressed data file Version 7

DECIMAL HEXADECIMAL ENTROPY
--------------------------------------------------------------------------------
0 0x0 Rising entropy edge (0.999946)
817248256 0x30B63800 Falling entropy edge (0.286431)
818937856 0x30D00000 Rising entropy edge (0.984514)
827326464 0x31500000 Rising entropy edge (0.993762)
832569344 0x31A00000 Falling entropy edge (0.604618)
833617920 0x31B00000 Rising entropy edge (0.996891)

Signature results are certainly false positives given the entropy results.
[Android Software Development] D@rkbytes:
Yes, I understand.

I also could not find the type of compressor or encryption used.

Although it occurs to me that I can find something via UART using a port sniffer.

Thank you for taking the trouble to research the subject.
[Android Software Development] Nsomnia:
whst model again? I've got an old smart tv non android hisense board the t works just the screen broke thst IIRC I found a few test points and also can serial uart in through the vga/hdmi on 3 pins I'd have to find the pdf ahakn a edit somewhre but they run Linux with uboot/mboot 3.0.1 I beleive.

with enough pushing I'd thst matched yours I coild try focusing on thst old hisense (uses the mt5655kphj, I've got the pcb half traced for interesting test points or uart/jtag and with said pdf on bootloader) if your device has the same mtk SoC.

ive just been focusing on my A65H/A6H/U6H gonna explore the firmware on Linux one weekend here seen some posts about unlocking the bootloader but none for su rights nor any guides or steps

firmware: https://www.hisense-usa.com/support/43a65h-hisense-43-inch-a6-series-led-4k-uhd-smart-google-tv-2021

old firmware link pkg https://api.hsp.hisenseportal.com/api/v1/public/model/download/43g2225ahh00443/716

but that's my new daily driver tv however those old mtk smart tvs definitely seem like we could get some very basic Linux going through a shell and boot+part dumps.

remind me what your working with your working with? [replying to get notifications here 🤣😼]
[Android Software Development] D@rkbytes:
All I'm trying to do is unpack/decrypt the firmware I posted earlier.

Do not extract it from the eMMC, for that I have the RT809H programmer or Mstar Debug Board that also works for Mediatek and Realtek.
[Android Software Development] jerrydevis:
Hey giofrida,

I wanted to ask you that does UART provide root shell or just normal shell?, I am trying to dump some system files from my Hisense 50A71F TV Which is based on mediatek board.
[Android Software Development] elguy:
Sad day - "UART BUS OFF!!" on my Hisense U6G. Some Googling looks like you need to jump some pins on the main board or flash some service image :(

Edit (the very next day!): did some Googling after work and found a script (not sure if I can post it here) to enable the UART bus, and now it's all working :)
[Android Software Development] jerrydevis:
Hey, did you get root shell using VCP?
[Android Software Development] ru.thto.ma.s:
you can also try this >>>>>>>>>>>>
[Android Software Development] meieu:
Could you please explain that in detail? I've go access to UART, but there's a username and password prompt for login.
[Android Software Development] vache:
I've uploaded some extracted files here : http://vache-android.com/?dir=hisense

If someone want to have a look... I had no luck mounting or unpacking 3drw.img (Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-0000-675f-946fc0f9f25b (extents) (large files))

Looks like there's a console on ttyMT0

From init : /sbin/getty -n -L ttyMT0 115200 vt100 -l /bin/sh

Interesting link : https://smarttvhacking.wordpress.com/2015/08/24/hacking-the-sony-kdl-48r510c-smart-tv/

Another one : http://neophob.com/2010/01/root-my-tv-hack-philips-pfl9703/

We have a serial jack port (called "Service") on the TV, a cable like this could be used to debug : http://www.amazon.com/SF-Cable-Female-Serial-Cable-6/dp/B004T9BBJC. [MENTION=709992]borillion_star[/MENTION] you bought somethink like this ?
[Android Software Development] borillion_star:
Thanks Vache, I have not purchased that no, I did not know they existed. I will look at the files you have and compare them with what I as able to extract. I don't think 3rd had anything significant in it.
[Android Software Development] borillion_star:
So mine has this on the board. I am not sure the serial to the 2.5mm jack device will work on it. Interesting.
[Android Software Development] tommyk999:
Here is PDF for your TV

https://mega.nz/#!NsRXWACB!7pP5JYus-4Gy3_fN8Oa5GAs3Hw-Wdeen1n-8phPoNRA

---------- Post added at 10:57 PM ---------- Previous post was at 10:54 PM ----------

How ever in that file there is photo with description of surrounding connectors apart this one. Dam but you might find something else useful

---------- Post added at 11:34 PM ---------- Previous post was at 10:57 PM ----------

It is four pin upgrade interface port :)
[Android Software Development] vache:
Just noticed that using Browser and going to file:// (we can use keyboard and mouse with it) we can browse entire file system.
[Android Software Development] tommyk999:
Nice find thx
[Android Software Development] vache:
56789 and 56790 ports are used by something like this : https://gfiber.googlesource.com/vendor/opensource/dial/

Ex.: http://192.168.1.19:56790/dd.xml

http://192.168.1.19:56789/apps/YouTube

http://192.168.1.19:56789/apps/Netflix

It uses Mongoose as web server, didn't find exploit for it.
[Android Software Development] borillion_star:
[MENTION=1829889]vache[/MENTION]

mount 3rd DMVERITY(SquashFS read-only,

I am concerned about this, this has a block level verification on the nand.

DM-Verity - validates the data blocks contained in a file system against a list of cryptographic hash values.

Now on Chrome OS devices, the systems have a developer mode switch. Nothing like this appears to be present on this board.

It could be software based, but it may not exist at all.

Use Caution.
[Android Software Development] vache:
Yeah i saw that too. There is also a 4k blocks header in upgrade file before both squashfs file, containing md5 sum. I think it's use before flashing.

Repacking may be harder than i think.
[Android Software Development] vache:
[MENTION=709992]borillion_star[/MENTION] Could you try to capture logs while update running ?
[Android Software Development] vache:
Thks for the logs, it have some interesting lines.

Could you give me a link to your firmware ? Can't find it by myself :/
[Android Software Development] hawkeyeru:
I split the firmware file into sections.

Also attached image rfsa.img (rootfs) and ubi3rdw.img (mounted in the 3rd folder)

The script collect file _sb.sh of parts for the firmware.

0_ubi_mount.sh script - mounts partitions with UBI UBIFS.

upgrade_loader_pkg.orig - the original firmware.

tcpdump caps - https://yadi.sk/d/k-G3hLF6rUEBp

console logs - https://yadi.sk/d/WsaNpKRsrUEM6

firmware fw408 - https://yadi.sk/d/ptDTDuq-rUEQs
[Android Software Development] vache:
Again, thanks for all.

How did you open a root shell ?
[Android Software Development] hawkeyeru:
I have connected to the UART.

I hit the [dtv_app_mtk]>

Then, by pressing Ctrl + C hit the linux shell.

I think so at all TVs on the MTK with Opera-TV.

I think that can be flash section rootfs from uboot.

Since the firmware protection md5 this section and generally checked a "digest".

But I'm not sure whether the checksum is checked during startup.

Apparently Modified root-fs partition from uboot should be safe, as in any case, I can then flash the original firmware ..
[Android Software Development] vache:
I think i'll have to buy a debug cable before going further.

Could someone tell me wich cable to use ?
[Android Software Development] hawkeyeru:
You need a USB-to-TTL adapter (http:// ru.aliexpress.com/item/1pcs-USB-to-TTL-UART-module-CH340G-CH340-3-3V-5V-CH340-module/32346814935.html) - 1$.

and a few wires to connect to the TV UART-jack.

UART connector (on my main board RSAG7.820.5872/ROH - UART-jack named "XP3") on the board is about VGA.
[Android Software Development] vache:
To not forget, here is how to enter factory/hotel modes :

Go to Settings, Sound, Advanced, select "Balance", then press

1 -> 9 -> 6 -> 9 for factory mode

0 -> 4 -> 5 -> 8 for hotel mode

On Samsung, they use hotel mode to make a backup and restore a modded firmware, but our hotel mode doesn't allow to make a full backup.

And didn't find anything interesting on those menus.
[Android Software Development] hawkeyeru:
My achievements.

I added to the startup telnetd, and ftpd.

I found cifs.ko. kernel module And now added to mount network folders on boot. It works faster than dlna, in addition, I was able to solve the problem with the display of some of the file names in the Russian keyboard layout that used to be displayed as question marks.

More to do did not work. I tried to run widgets and programs of the firmware of other models, but the problem is the differences between versions of the library libc and other...

It is also working the thttpd, but I have not figured out how it can be used.
[Android Software Development] borillion_star:
WOW amazing! to think I was trying to find how the cpu boots up U-Boot and if it was signed. How did you do this without bricking?
[Android Software Development] hawkeyeru:
I did not change the bootloader.

The thing is that after the launch of available root shell via the UART connector. Going through it, I found I just replaced the file "test_smart_remote_common", organized by remote control via the network to a script, which have run telnetd, and ftpd, load module and mount smb share.

Change any applications, including file "test_smart_remote_common" it turned out to be very simple, because they are located on disk 3rd_rw, access to which is permitted to record, and the checksum is not checked, since it stores the settings for the service files.

busybox file and kernel module I took out of the firmware for sony TV. If interested I can lay out.

I copy all information to forum: http://openlgtv.org.ru/forum/viewtopic.php?f=17&t=170280
[Android Software Development] vache:
A bit off topic : 40EC591 and 40K321 got an update (G0226/G0312), here's the changelog :

Cached memory deleted on shut down

Fixed AR on USB playback

Better USB detection
[Android Software Development] GChriss:
Vizio-provided source code (MediaTek MT53xx/MT588x)

We have source code now: github.com -> spartan263 -> vizio_oss

(Note to admins: pls. do edit this post to include a proper hyperlink)
[Android Software Development] hawkeyeru:
You can put the firmware on it or partitions?

Do you have a toolchain?

(I really have not figured out yet wanted to do with it :)

Perhaps the kernel module to support NFS network file system ...
[Android Software Development] vache:
NFS is already enable in kernel config.

Édit : just check again, i was wrong..
[Android Software Development] GChriss:
Toolchain sources

Yes? I haven't attempted to do so yet.

It's a GCC-based toolchain. 'toolchain.txt' lists all of the files I have; at 2GB it's a little big for GitHub but I can provide these files on request. I think it's standardized C code, though, so I'm not sure that it's entirely necessary.
[Android Software Development] drdoolittle:
any chance that it would be possible to install kodi for linux on such a tv?
[Android Software Development] goldchang:
[MENTION=2832728]GChriss[/MENTION]

Great work

Will need toolchain if we need to cross compile
[Android Software Development] GChriss:
Toolchain sources

It looks like cross-compile tools will be necessary after all. Please do make local copies as there's no guarantee of continued GitHub hosting:

https://github.com/spartan263/vizio_oss-toolchain

Original configure line for GCC 4.5.1, in case anyone is interested in rebasing to more recent GCC releases:

../gcc-4.5.1/configure --prefix=/tmp/root/usr/toolchain-4.5.1-vfp/corte
x-a9/gcc --host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --target=armv7a-mediatek-linux-gnueabi --with-sysroot=/tmp/root/usr/toolchai
n-4.5.1-vfp/cortex-a9/gcc/sysroot --with-arch=armv7-a --with-tune=cortex-a9 --with-cpu=cortex-a9 --with-interwork --with-fpu=vfp --with-float=softfp --with-gnu-as --with-gnu-ld --disable-nls --enable-shared --enable-__cxa_atexit --disable-multilib --enable-c99 --enable-long-long --enable-threads=posix --enable-languages=c,c++ --with-gmp=/tmp/root/build/i686 --with-mpfr=/tmp/root/build/i686 --with-ppl=/tmp/root/build/i686 --with-cloog=/tmp/root/build/i686 --with-libelf=/tmp/root/build/i686 --program-transform-name='s,^,armv7a-mediatek451_001_vfp-linux-gnueabi-,' --with-mpc=/tmp/root/build/i686 --enable-lto --without-system-libunwind --disable-rpath --with-host-libstdcxx='-static-libgcc -Wl,-Bstatic,-lstdc++,-Bdynamic,-lm' --with-specs='%{!fno-unwind-tables:-funwind-tables}' --with-build-time-tools=/tmp/root/usr/toolchain-4.5.1-vfp/cortex-a9/binutils/armv7a-mediatek-linux-gnueabi/bin/ --enable-cxx-flags='-g -O2'
[Android Software Development] hawkeyeru:
I ask you to give a little advice on how to do krosskompilirovat.

For example how to compile the kernel ..

Better yet, some simple program that would use directfb to display.
[Android Software Development] techtrails:
Hey,

I have a working command injection at the moment on my Vizio Smart TV, I've also managed to launch the Opera browser via /3rd/opera/browser (there is no browser bundled with the Vizio TV Software that my TV is running), most of it is in Japanese but it is usable.

How would I go about enabling telnet? I've checked -- there's no netcat or the like available, and telnet doesn't seem to be enabled from a port scan. I can access the file system via Opera with "file://"

If you're interested in trying the exploit, go to Menu > Network > Hidden Network. All commands typed within `` seem to execute as root.

I've also been able to copy the file system to a USB drive by running "cp -r / /tmp/mnt/usb/sda1". I'd imagine you wouldn't need an upload considering that there already seems to be a version of the firmware uploaded on GitHub in the thread.

It's also worth noting that the TV has BusyBox installed based on the file system.

Thanks for the help,

techtrails
[Android Software Development] hawkeyeru:
Earlier I wrote how I started the telnet and ftp, as well as to mount network folders on the cifs protocol.

You can start telnetd by command: "busybox telnetd -l /bin/sh".

After that, for example:

1. Make a copy of the file:

cp /3rd_rw/dialserver/dialserver /3rd_rw/dialserver/dialserver.exe

2. put in file /3rd_rw/dialserver/dialserver startup script to run the necessary commands:

cat ./dialserver

#!/bin/sh

/3rd_rw/dialserver/dialserver.exe -N Netflix &

/3rd_rw/opt/etc/rc.local

If you will not be difficult - make me an archive of its firmware files.
[Android Software Development] jakubpawlo:
techtrails many thanks for command injection !

I'm looking to install chrome browser and vlc media player on my TV to make it really "Smart".

My TV, Thomson 40FZ5533 is using same firmware with OperaOS

Support site (I can't post links yet..): thomsontv _dot_ pl/serwis/do-pobrania?serie=47&product=258

links to (I can't post links yet..) www _dot_ mediacenter _dot_ tcl _dot_ eu/downloaddoc?product_id=6188

which contains upgrade_loader.pkg and flashing instruction.

I wrote small bash script that extract the binary blobs from .pkg files, and later used binwalk to analyze it

#!/bin/bash

#input file
INPUT=upgrade_loader.pkg
#position of first record (logo), one byte after END in INPUT file
OFFSET=310

SIZE=`du -b "$INPUT" | cut -f1`

echo "processing $INPUT size $SIZE"

while [ $OFFSET -lt $SIZE ]; do
LEN_POS=8

FNAME=`hexdump -s $OFFSET -n 4 -v -e '1/1 "%c"' $INPUT`
FNAME="$FNAME.bin"

#go to lenght
OFFSET=$((OFFSET + LEN_POS))
LEN=`hexdump -s $OFFSET -n 4 -v -e '1/4 "%d"' $INPUT`
#go to start of binary content
OFFSET=$((OFFSET + 4))

echo "saving $FNAME from offset $OFFSET, this may take a while..."

dd skip=$OFFSET count=$LEN if=$INPUT of=$FNAME bs=1
OFFSET=$((OFFSET + LEN))
done

My tv have 3 USB ports, one of them is marked as "Service Port". Anyone know if it can be used to do anything interesting (except from firmware update)?
[Android Software Development] puercoespin:
Hi. I don't wanna sound irritating, but Instead of making all these thing through low-level software, why don't you apply all your wisdom and knowledge on making apps for the OS. All based on HTML5 will run ok.

I got some IPTV channels working on the system by using the OTTPlayer (the widget online that is html5 based instead of an export from other OSs). If anyone around was looking for this, you just have to go to the widget online of the app through the normal web browser of the TV (hisense, bgh, noblex, and some other chinese or local american brands)...go to options, change the HLS player to "default", all other players just leave at HTML5 as they were. The rest of the way is easy to learn, the ottplayer has a cloud where you can upload your m3u playlists or a remote playlist that has daily updates.

I'd appreciate if you make things like this little app that improved a lot the experience with the device (considering the limitations of the hardware, because our TVs are not DLNA capable, they're just Upnp streaming capable that is different...like a really old DLNA protocol in the market).

It's not that I'm telling you what to do, but I check out the OperaTVStore every month and it still the same since the day I bought this TV. So It'll be very helpful if people that are looking "how to hack" or "how to change the whole system", put that effort to do what normal people need or what a common person could do. I hope I didn't offend you by saying this...have a nice day. :D
[Android Software Development] birry:
Hi anyone, I have telnet access to my TV, I want to see the tunner model, anyone know how could I find it?

Also tried to find how to use dtv console mode but have no luck, anyone know how it could be used?
[Android Software Development] borillion_star:
Silicon Labs Si2157

http://www.silabs.com/Support Documents/TechnicalDocs/Si2157-short.pdf

https://www.linuxtv.org/wiki/index.php/Silicon_Labs_Si2157