yashsingh1/xdaforums huggingface dataset:
[Android Software Development] giofrida:
Wow! Great findings! I've read the entire thread and I'd like to add some information:

The script 'extract.sh' works nicely but it fails when tries to extract cfig, eepr and usig. These sections do not contain the usual 64-byte signature (iMtK8...) and therefore the script removes 64 bytes of data.

I've been trying to find out the meaning of the signature at the beginning of every section in order to unpack the firmware and hopefully create a custom one. This is what I've got up to now:

Apparently every section contain the following 60-bytes signature:

4 bytes identifies the section (e.g.: cfig, logo, ddb)

4 bytes are always zero

00 00 00 00

4 bytes express the length of the section. The length is coded in hexadecimal and in little-endian order (from left to right: from the LSB to the MSB)

Example: 8B B0 20 03 becomes 03 20 B0 8B which means, in decimal: 52473995 bytes or 52,47MB (the size of logo section)

16 bytes are always the same:

AF D2 12 17 6B 6D 06 A8 B8 88 FC F5 F0 19 8E CE

the last 32 bytes change from section to section. Likely it's a kind of digest used to check the integrity of data, but I couldn't achieve the same result by calculating it from the extracted sections.

As already stated, every section (except for cfig, eepr and usig) contain a further 64-bytes signature: iMtK8...

The length of section expressed by 4 bytes

includes

this 64-bytes signature.

My main purpose out all of this is to edit a stupid setting which always stretches the videos playbacked from USB drives. Probably I don't have to create a custom firmware for this, but it would be really awesome to have an unlocked OS!

Edit:

I have followed p0isk guide to correctly unpack the firmware files but I've got some issues. Firstly, lzhs_scanner has always failed at the same offset with a segmentation error. I've solved this by building the official (and probably updated) epk2extract project, which you can find here: https://github.com/openlgtv/epk2extract. Just follow the straightforward compilation instructions provided in the README file.

However, even though the new lzhs_scanner has not crashed, it has failed to unpack many files, giving a CRC mismatch. At the moment, it's impossible for me to unpack 3rdw file.

Finally some good news. I correctly unpacked the squashfs files 3rdp and rtfs. Actually, I had to edit line 183 of src/util.c to adjust the offset of "md5" string. Personally, I had to change from 0xE to 0x1A. Then I could unpack those files by issuing the command "sudo ./epk2extract" + 3rdp/rtfs. Superuser is needed to extract all the contents out of rtfs file.
[Android Software Development] giofrida:
Hello p0isk and thank you for your response and information. I have an Hisense H43M3000 TV. The television is actually great but the OS is not, at all. It's laggy and definitely not up to the TV hardware.

After seeing extract.sh low I/O performance I ported the script into a simple C program. I'll test it on Linux and if it works without any issue I will post the source code here.

I will try to extract 3rdw again using pk2extract even though it crashed giving segmentation fault.

I wanted to start telnetd and ftpd by default. I have followed hawkeyeru's post but I can't understand where I should add the lines of code: dialserver or rc.local? I'm quite new to Linux.

Edit: tried using lzhs_scanner again (from pkg2extract) but when trying to extract the fourth file the program crashes giving "Segmentation error". Log:

Found possible LZHS header at 0x100010
Extracting to ../../ext/3rdw_file001.lzhs

---LZHS details---
Compressed:	272351
Uncompressed:	8388608
Checksum:	0xd4

[LZHS] Decoding Huffman...
[LZHS] Decoding LZSS...
[LZHS] Converting Thumb => ARM...
[LZHS] Calculating checksum...
Calculated checksum = 0xd4
---------------------------------------------------
Found possible LZHS header at 0x142810
Extracting to ../../ext/3rdw_file002.lzhs

---LZHS details---
Compressed:	262147
Uncompressed:	8388608
Checksum:	0x0

[LZHS] Decoding Huffman...
[LZHS] Decoding LZSS...
[LZHS] Converting Thumb => ARM...
[LZHS] Calculating checksum...
Calculated checksum = 0x0
---------------------------------------------------
Found possible LZHS header at 0x182840
Extracting to ../../ext/3rdw_file003.lzhs

---LZHS details---
Compressed:	262147
Uncompressed:	8388608
Checksum:	0x0

[LZHS] Decoding Huffman...
[LZHS] Decoding LZSS...
[LZHS] Converting Thumb => ARM...
[LZHS] Calculating checksum...
Calculated checksum = 0x0
---------------------------------------------------
Found possible LZHS header at 0x1c2870
Extracting to ../../ext/3rdw_file004.lzhs

---LZHS details---
Compressed:	730282
Uncompressed:	8388608
Checksum:	0x7b

[LZHS] Decoding Huffman...
[LZHS] Decoding LZSS...
Segmentation error (core dumped)

Note: I am using Ubuntu 16.04 x64. pk2extract has been compiled using x86_64 libs (default).
[Android Software Development] p0isk:
I forget that pkg2extract (and epk2extract) running on lunix corrupting first byte of *.unlzhs files. On cygwin they unpack only first half of the lzhs file. I add "dirty hack" to lzhs_lib.c. Now it works correct only on cygwin.

Try to replace lzhs_lib.c from epk2extract. And check 3rdw.bin_file001.unlzhs file: first bytes must be FD 81 00 00 .... (I use G0825 firmware from hisense.fr)
[Android Software Development] giofrida:
Something goes wrong. I also have the G0825 firmware (do you have the same TV?). I tried what you suggested but the first four bytes of file001.unzlhs are 00 81 00 00 and not FD 81 00 00 (even though the calculated checksum is correct!). Despite that, some of the files are not extracted correctly since checksums do not match.

What I suggest is to talk to the original creators of epk2extract: perhaps they could help us to correctly extract the 3rdw block.

Thank you for the hint. I finally adjusted the bad designed file browser.
[Android Software Development] blala:
Hello i'm smx-smx, an epk2extract author (this is an old account)

p0isk brought to my attention the Hisense pkg format, and i added it to epk2extract (https://github.com/openlgtv/epk2extract/commit/f1b93bb65c3d7695e5556dcef6113656e0f322bd)

Now unfortunately, the issue you are experiencing with LZHS is apparently a memory corruption which is causing random crashes and memory corruption.

I can try to nail it down when i get time.

By the way some LG smart TVs also shares the same MTK chipsets and infos from there apply here as well, and vice versa.

The p0isk signature bypass trick is very cool but it requires to boot into u-boot every time a custom boot is desired. I was working on kexec-mtk instead but I never completed it, and its likely harder to get going.
[Android Software Development] giofrida:
Thank you for your effort smx-smx! In the meanwhile I attach my small program "mtk2extract" used to extract blocks from pkg files faster than "extract.sh" does. Works on both Ubuntu and Windows. Compile using gcc. If needed edit the first three #define just like in extract.sh. Usage "mtk2extract file.pkg [output directory]" (if output directory is omitted the program will use the directory of pkg file).
[Android Software Development] blala:
That's nice, but i reversed the whole header structure ;)

https://github.com/openlgtv/epk2extract/blob/master/include/hisense.h

Per-partitions hacks (like checking the partition name) shouldn't be required anymore :)

Recompile epk2extract, then run

./epk2extract upgrade_loader.pkg

3rdw.pak fixes soon ;)
[Android Software Development] p0isk:
smx-smx, i see that you repair crashes and memory corruption in epk2extract, thanks!

some hisense TV:

K390 http://xdaforums.com/showpost.php?p=66688450&postcount=34

Thomson http://xdaforums.com/showpost.php?p=67673071&postcount=54

have different header:

#define UPG_HEADER_SIZE 0x98
#define PKG_SIGNATURE_SIZE 0x00
[Android Software Development] blala:
Those defines are wild guesses i made (EPK2 signature size is 0x80 bytes, aka 1024 bits). If you can figure out more details about how that header is structured (i mean the logic behind it) let me know
[Android Software Development] blala:
So the other 0x10 bytes might be an AES 128 key, but i doubt they'd put the key inside the header (that would be silly)

By the way keep in mind the current LZHS_FS extractor is not working properly. There is some problem after the 22nd chunk on the firmware i tested, where the next chunk has a gap of 0x03E9B8F0 - 0x03E94900 bytes = 0x6FF0, aka 28656 bytes. Maybe you can figure out why

Also the meaning of the checksums after the 1st one is unknown
[Android Software Development] giofrida:
From my H43M3000 TV while updating from G0422 to G0825.

open File = /mnt/usb_0/upgrade_loader.pkg
Header encrypt by AES
Header :
35 b3 67 73 08 b5 82 c3 7e d0 9c 0c 40 1c b9 ee 5.gs....~...@...
6e 0f be 55 cf 6e 7d 7c c9 e4 16 f6 00 9a f5 cc n..U.n}|........
ad 6a 83 6d 11 f8 b7 e3 b3 9c ce d1 2b 0f 77 69 .j.m........+.wi
ce 7f 88 25 45 cc 8b 55 c3 8e f2 ee 3e b3 b8 ce ...%E..U....>...
de 46 25 2a 5c 56 c3 d3 c4 4f 5f 8d a0 3f 9e 80 .F%*\V...O_..?..
05 07 43 02 63 35 d2 b9 92 11 d6 a2 6f 3b 7a 04 ..C.c5......o;z.
7a 96 b9 e5 8f c2 83 18 74 4e 13 61 ca fb 06 ff z.......tN.a....

Header :
68 69 73 65 23 44 48 40 46 69 52 6d 49 44 54 56 hise#DH@FiRmIDTV
31 34 30 31 5f 30 30 32 33 30 36 5f 31 32 5f 30 1401_002306_12_0
30 31 5f 33 37 5f 30 30 37 5f 32 31 31 5f 30 30 01_37_007_211_00
31 5f 33 5f 30 30 31 5f 32 00 00 00 00 00 00 00 1_3_001_2.......
00 00 00 00 00 00 00 00 33 cd 51 46 00 00 00 00 ........3.QF....
6d 74 35 38 39 30 5f 65 75 5f 6c 69 6e 75 78 00 mt5890_eu_linux.
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Validate codefile HMAC
open File = /mnt/usb_0/upgrade_loader.pkg
Encrypted digest:
9d 58 41 b4 47 bf b7 08 76 ca e1 e6 1a 39 09 92 .XA.G...v....9..
ac 5e e0 7c 7a 6b c6 1a 6f 52 29 fb 9b 52 fd 5a .^.|zk..oR)..R.Z

Download digest
8c d0 5c 0c 90 a3 5c 63 45 ad 04 00 d0 09 17 5b ..\...\cE......[
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

In my firmware (both G0319 and G0825) the encrypted header is 0x70 bytes long and begins from 0x00. The encrypted digest is 0x20 bytes long and begins right after the encrypted header (0x70).

I think this link could be helpful for understanding AES encryption/decryption of header: http://neophob.com/2010/01/root-my-tv-hack-philips-pfl9703/

Please, let me know if I can help in any way.
[Android Software Development] blala:
You could, by getting the AES key out of the device...

I should have some code around to do that, involves talking to the hypervisor/trustzone, unless it's stored differently
[Android Software Development] giofrida:
Yes, I can try, if the code provided doesn't write anything in special areas of the firmware which might void the warranty. My TV is quite new, I would like to keep as "stock" as possible, with no "suspicious" data inside. Actually, I have edited some .css and .js files (pointed by p0isk), but these files should be reverted to the default ones when I flash a new/the same firmware. Surely I backed them up in case of issues.
[Android Software Development] blala:
LZHS should be fully fixed now. I called the new format LZHS_FS.

Please download and build latest revision and let me know how it works.

The only problem is that it's very slow to extract over 100 chunks of LZHS data (the unpacker was never made with speed in mind, but just to extract bootloaders).

The fix isn't trivial unfortunately. Requires rewriting parts of the LZHS unpacker to be thread-aware. Currently it uses many global variables for the unpacker context.

I tried making it parallel with OMP (since it's the easiest way to add multithreading to an existing program), but the fact that the LZHS unpacker always writes to those variables makes it stall / corrupt the globals / unable to unpack anything.

Another way to make LZHS faster would be to add a kind of Huffman cache (since Huffman is the slowest part of the decompression, traverses the whole tree for every symbol). If you know or want to contribute anything please let me know.

Also keep in mind i'm available on IRC at #openlgtv (Freenode) through a bouncer.
[Android Software Development] giofrida:
Ok, it's extracting files right now. At the moment I can see many mismatched CRCs. As soon as it finishes I will attach the log here. Thanks again for your help.

In the meanwhile, would you take a look at the attached command list? It's been taken from the terminal of the service port, with the "ls" command. Inside the worksheet there's a description of each command too. I think some could be helpful to read the encryption key.

Edit: sorry, my mistake, I used lzhs_scanner instead of epk2extract.

Edit2: Okay, extraction is finally completed (43 mismatched CRCs on 188 segments). Log attached.
[Android Software Development] p0isk:
I try with K300 3rdw. scanner cann't unpack correctly 3rdw.bin_file16.unlzhs: last bytes fills by zero.

I think find RSA and AES keys.

Pmain after print "store RSA & AES keys in DMX SRAM"copy they to 0xFB005000 (and copy to 0xF120) and 0xFB005100.

fb005000: 749c426d 28f88861 0e17297f 02411512 mB.ta..(.)....A.
fb005010: 65736968 00000000 00000000 00000000 hise............
fb005020: 40484423 6d526946 00000000 00000000 #DH@FiRm........
fb005030: 3835746d 655f3039 696c5f75 0078756e mt5890_eu_linux.
fb005040: 00000000 00000000 00000000 00000000 ................
fb005050: 31313032 0032312e 00000000 00000000 2011.12.........
fb005060: 00000000 00000000 00000000 00000000 ................
fb005070: 00000000 00000000 00000000 00000000 ................
fb005080: 00000000 00000000 00000000 9b83c5e5 ................
fb005090: faec8b4b 3f332a44 0654e737 bfc7eb81 K...D*3?7.T.....
fb0050a0: 67e10c8b 8178b4dd abcea303 3d60622d ...g..x.....-b`=
fb0050b0: 9c9504c5 cefef636 ef2925ff 830880eb ....6....%).....
fb0050c0: b1a0cc37 e210fde2 f82680aa c5b33429 7.........&.)4..
fb0050d0: 315cc544 bd9513f6 0e6da288 895b3ddc D.\1......m..=[.
fb0050e0: 52bb935b 0875a096 24b817b2 b812e4a9 [..R..u....$....
fb0050f0: c09a585e c1d0d98a 8984c89f af29b1e0 ^X............).

At 0xFB005000 it was overwritten by Lmain, but at 0xF120:

0000f120: 749c426d 28f88861 0e17297f 02411512 mB.ta..(.)....A.
0000f130: 655df29b b2b973ea b76164a3 a457c8f0 ..]e.s...da...W.
0000f140: 932bd9ae ba01bfe8 07b24ed4 42620250 ..+......N..P.bB
0000f150: ddb9c137 c6c4b488 d94e521f 82654f7f 7........RN..Oe.
0000f160: d81a13e2 a71ff653 36b0b849 a54276a4 ....S...I..6.vB.
0000f170: 8112c907 1db151f4 7b1c5c7d b22f84e1 .....Q..}\.{../.
0000f180: a26e647f 5d6f29c4 bd50b40b 69b5e0cd .dn..)o]..P....i
0000f190: 7dcc374b c8e28db7 0a5aea4d 5f12b2d4 K7.}....M.Z...._
0000f1a0: 6e96ece8 f403ffc2 02366107 ad238547 ...n.....a6.G.#.
0000f1b0: faec8b4b 3f332a44 0654e737 bfc7eb81 K...D*3?7.T.....
0000f1c0: 67e10c8b 8178b4dd abcea303 3d60622d ...g..x.....-b`=
0000f1d0: 9c9504c5 cefef636 ef2925ff 830880eb ....6....%).....
0000f1e0: b1a0cc37 e210fde2 f82680aa c5b33429 7.........&.)4..
0000f1f0: 315cc544 bd9513f6 0e6da288 895b3ddc D.\1......m..=[.
0000f200: 52bb935b 0875a096 24b817b2 b812e4a9 [..R..u....$....
0000f210: c09a585e c1d0d98a 8984c89f af29b1e0 ^X............).

It's ok. It definitely used to encrytp usig section in firmware.

fb005100: 55555555 55555555 55555555 55555555 UUUUUUUUUUUUUUUU
fb005110: aaaaaaaa aaaaaaaa aaaaaaaa aaaaaaaa ................

It may be AES key.
[Android Software Development] blala:
p0isk: use epk2extract, not lzhs_scanner.

giofrida: Can you mount the resulting EXT4 filesystem?

p0isk: key doesn't seem correct
[Android Software Development] giofrida:
I tried to mount with "sudo losetup /dev/loop0 3rdw.ext4" but it does not show up.

[MENTION=4259916]blala[/MENTION]: if needed, here you can download the firmware for my TV.
[Android Software Development] p0isk:
Nope, 3rdw.pak.ext4 doesn't contain first uncompressed 1MB of data from 3rdw.pak. And 7'th chunk are broken.

There are correct *.lzsh and *.unlzhs files for K300: chttps://yadi.sk/d/1469c__6vCkiE

You can compare with it.

I will analyze Lmain and Pmain next.
[Android Software Development] blala:
p0isk: i forgot to copy first uncompressed MB from 3rdw :)

Also you won't find any key in bootloader, it's stored in a crypted partition and the crypto key is hidden by TrustZone (i know that, LG does the same ;)).

You need to use some magic APIs ;)
[Android Software Development] p0isk:
Do you mean mmcblk0boot0, mmcblk0boot1 or mmcblk0rpmb?

Wow, magic! Is it described at openlgtv.org.ru?
[Android Software Development] blala:
Nope it has nothing to do with the filesystem. The master key is stored on the chipset.

Nope it's not described yet (not yet at least ;)).

If you have root access you can reach me and we can try to get it working. Then we can write about it
[Android Software Development] drdoolittle:
If I may throw in, I own a Hisense H65MEC5550 and really would love to edit some files (e.g. remapping the remote control, enabling telnet etc.) and the latest firmware G0825 for this model can be found here: https://drive.google.com/file/d/0Bzy8wH__gwE6UEpwNmZNeXFlV1E/view?usp=sharing

Will the current version of epk2extract work with this? How do I repack and flash it?
[Android Software Development] giofrida:
You can extract your firmware using epk2extract. Clone it from github, build with "build.sh" inside the project and launch it from "build_linux" (if you're using Linux) with the following syntax: "epk2extract firmware.pkg". The program will split the firmware in blocks and extract them if possible. At the moment blala (aka smx-smx) is working on correctly unpacking the 3rd_rw block, which includes a lot of interesting files (such as the GUI). In addition, it's not possible for now to repack and flash the firmware, because part of it is encrypted with a key stored in a special (= not easily accessable) area of the chipset.

If you just want to edit some files, as I did, you can connect your PC to the television using a USB to UART converter (personally I use a FTDI FT2232H board). Using a program, such as Realterm, you can send commands to the TV and you can, for example, enable telnet.

If you're interested in this and you have a USB-UART converter, connect it to the TV on the Service Port using a 3.5" jack. The pinout of it is attached. Then, using Realterm configure your VCP with the following data:

Baud: 115200

Parity: none

Data bits: 8 bits

Stop bits: 1 bit

When you start seeing data diplayed on the terminal, send ^C (Ctrl+C) and you will be able to send commands from the shell.

Some useful commands:

Start telnet server: busybox telnetd -l /bin/sh

Start FTP server (log with anonymous): busybox tcpsvd 0.0.0.0 21 busybox ftpd -w /

Using FTP I could download files, edit them and eventually upload them.

I hope I've clearly answered your question. Let me know if you need any further help.
[Android Software Development] drdoolittle:
Wow thanks alot giofrida! I think then I'll go with telnetting to the TV right now. I already prepared a cable and ordered a CP2101 USB UART adapter a week ago, hopefully it'll arrive soon and work.
[Android Software Development] blala:
LZHS_FS (that's how i decided to name it) fixed, including the mismatching checksums!

Try latest epk2extract
[Android Software Development] giofrida:
Wow! It's finally working. I could correctly mount 3rdw with losetup and extract all the internal files. This is a huge step forward to the right direction.

No password is needed. As soon as you connect the USB-UART converter you will see all sorts of messages coming up on the computer screen.
[Android Software Development] drdoolittle:
Thats great! If I got it right: all that is now needed is the encryption Key stored in the TV in order to modify the whole firmware and reflash it? That would be really cool to have some community modded firmware, maybe even with Kodi or the game streaming app Moonlight preinstalled :p

How can I find out what kind of CPU and GPU is integrated in the TV?
[Android Software Development] blala:
No that's not it. The firmware cannot be modified because Secure Boot is in place.

We can work around Secure Boot probably but we cannot be completely free from it

The key we're talking about is to decrypt the header of the update file, which is crypted.

You can find the CPU/GPU by looking at the kernel source code, but it looks like Hisense uses the MT58xx series of chips
[Android Software Development] drdoolittle:
Oh I see., what a pity... well at least it seems to be possible to have direct access to service port, so this should be sufficient to modify the OS to one's needs, right?
[Android Software Development] giofrida:
Yes, most of the GUI is written in HTML, Javascript (with JQuery) and CSS. The JS scripts make calls to the TV functionalities (for example setting the screen position, the subtitle, audio track, etc.) using functions declared in model-xxx.js files. You can find these in 3rd_rw/UI/hisenseUI/model folder. So far I've modified the video player adding a fast seek feature (if you press a number on the remote you can directly go to a position of the stream; e.g.: if you press '2' you go to 20% of the stream) and increased the length of the file path (which was ridiculously short).

Previously I wrote a post including information of the 64-bytes 'signature' every block include at its beginning. If you remember correctly the last 20 bytes are meaningless. Since the encrypted digest is 20-bytes long it's probable that these bytes are encypted digests too, but calculated on the block's data. This, however, is just an assumption.

If we found out the meaning of those bytes and we properly put together the modified blocks (which of course must be correctly packed with their different compression format, such as LZHS), would it be possible to flash custom firmwares?
[Android Software Development] birry:
[MENTION=7706276]p0isk[/MENTION] excellent data!!!

I have looked and it appear to have a TDA18273 from NXP

[ 13.496698] [Vendor_Demod]tmbslTDA18273_Open OK
[ 14.263743] [Vendor_Demod]tmbslTDA18273_SetStandardMode OK
[ 14.264373] [Vendor_Demod]TDA18273 disable 16MHZ XOUT OK

the strange thing is that it does not tune digital cable channels, just the analog ones, but TDA18273 datasheet says that it is compatible with digital ones, could it be software-blocked? I could be amazing to forget using a stb and tune digital channels directly into tv!! :D

Another thing I would like to do is to change the boot logo (tv brand's logo), is it possible?

P.D.: TV info:

It's a hisense 40k 360

CPU info:

# cat /proc/cpuinfo
Processor : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 1694.10
Features : swp half thumb fastmult vfp edsp vfpv3 vfpv3d16
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MT5880
Revision : 0000
Serial : 0000000000000000

Modules loaded:

# lsmod
snd_mtk 8484 0 - Live 0xbf936000
uvcvideo 54752 0 - Live 0xbf925000
videodev 63460 1 uvcvideo, Live 0xbf912000
v4l2_int_device 2072 0 - Live 0xbf910000
mtk_mmap 1556 0 [permanent], Live 0xbf90a000 (P)
usbhid 24124 0 - Live 0xbf901000
ntfs 92868 0 - Live 0xbf8e7000
rtnet5572sta 39580 1 - Live 0xbf8da000
rt5572sta 1467244 1 rtnet5572sta, Live 0xbf772000 (P)
rtutil5572sta 35072 2 rtnet5572sta,rt5572sta, Live 0xbf768000
mtk_mod 7656662 1 snd_mtk,[permanent], Live 0xbf017000 (P)
fusion 79272 6 - Live 0xbf000000
[Android Software Development] drdoolittle:
I finally received the USB UART adapter and it works just fine :) When hitting CTRL+C right after u-boot / when the kernel loads I get a shell. How could I add telnetd and ftpd permanently to bootup? Everything relevant (like /etc) seems to be read-only, only 3rd_rw is writable but I can't seem to find relevant scripts there where I could put telnetd/ftpd? /3rd seems to have some promising scripts like the internet check function, but it gets mounted read-only too (squash-fs).

And: how do I reboot (with busybox)? I always use poweroff -f but I'm not really comfortable with that.
[Android Software Development] giofrida:
I've got the same issue. /etc/rc.d/rc.local is inside rtfs block, and therefore read-only. At the moment I don't know how this could be done.

To reboot just send the "reboot" command in the shell.