[Android Software Development] p0isk:
[MENTION=3519610]giofrida[/MENTION], what TV do you have?

I fix extract.sh, so you can update it from github and test.

Did You see /3rd_rw/UI/model/model-video.js and /3rd_rw/UI/hisenseUI/modulePages/himedia/videoPlayer.js ?

They contain video player.

That is structure of 3rdw:

0x0000...0x100000 - uncompressed ext4
0x100000 - first LZHS signature of 1 block
0x100010 - second LZHS signature of 1 block:
a a a a b b b b c c c c
0x100000 00 00 40 00 B5 20 04 00 01 00 00 00 00 00 00 00
0x100010 00 00 40 00 A5 20 04 00 A6 00 00 00 00 00 00 00

first sign second sign
aaaa - compressed size comrpessed size
bbbb - uncompressed size+16 uncompressed size
cccc - number block checksum

lzhs_scanner from epk2extract fault on first signature, so I remove her processing.

There are 3 way to unpack 3rdp and rootfs:

sudo losetup -o 4096 /dev/loop0 3rdp.bin
mkdir 3rdp
sudo mount -t squashfs /dev/loop0 3rdp

dd if=3rdp.bin of=3rdp.hsqs bs=1 skip=4096
mkdir 3rdp
unsquashfs -f -d 3rdp 3rdp.hsqs

And use dmsetup, but I use first way.

How to extract kernel:

dd if=kern.bin of=kern.lzo bs=1 skip 40
lzop -d kern.lzo

---------- Post added at 03:13 AM ---------- Previous post was at 02:38 AM ----------

How did you get cmd_2_std.txt?

I think that it from /basic/dtv_driver.ko

How TV start up:

1. Internal ROM
2. MTK/DTV/ROMCODE/MSDCBOOT/V01.00
mmcblk0p1
0x00000000
3. Start Pmain
mmcblk0p1
0x00000180
(store RSA & AES keys in DMX SRAM)
4. Start Lmain
mmcblk0p1:
0x0000a040 LZHS
memory:
???
5. MT5890 Boot Loader v0.9
6. U-Boot 2011.12.12 (Jul 23 2015 - 15:49:37)
mmcblkop1:
0x000a0000 LZHS
memory:
0x1000000
7. Trustzone
mmcblk0p5:
0x2c5d10 LZHS
memory:
0x2000000
8. kernel
mmcblk0p5:
0x00000000 LZO
memory:
0x00007fc0

Kernel don't support nfs, nfs_rootfs and all other rootfs, except msdc.

aufs and unionfs not works too, because they patch kernel (fs/splice.c)

So, try to use to mmcblk0p27 (/data) for rootfs!

1. Unlzop kernel and copy to usb flash:

dd if=kern.bin of=kern.lzo bs=1 skip=40
lzop –d kern.lzo
cp kern /mnt/usb0

2. Remember address and size of kern at usb flash in sectors (512 bytes).

3. Unsquash rtfs.bin to /data:

dd if=rtfs.bin of=rtfs.hsqs bs=1 skip=4096
copy rtfs.hsqs to /3rd_rw/work/
sh-3.2# unsquashfs -f -d /data rtfs.hsqs

4. Boot into u-boot:

mt5890 # setenv loadaddr 7fc0
mt5890 # setenv bootargs root=/dev/mmcblk0p27 rootwait rootfstype=ext4 rw console=ttyMT0,115200n1 vmalloc=512mb quiet mtdparts=mt53xx-emmc:2M(uboot),2M(uboot_env),256k(part_02),256k(part_03),4M(kernelA),4M(kernelB),75M(rootfsA),75M(rootfsB),256k(basic),8M(perm),320M(3rd_ro),750M(rw_area),256k(reserved),256k(channelA),256k(channelB),256k(pq),256k(aq),75M(logo),256k(acfg_descr),256k(schedule_pvr),3M(adsp),256k(ci),256k(dvbsDB),256k(hdcp),1M(facs),256k(hiscfg),2048M(data) usbportusing=1,1,0,1 usbpwrgpio=-1:-1,-1:-1,-1:-1,-1:-1 usbocgpio=404:0,404:0,405:0,405:0 usbhubrstgpio=-1:-1 msdcgpio=76,-1,-1,176,-1,-1 tzsz=48m no_console_suspend gpustart=857415680 gpusize=0 gpuionsize=0 androidboot.serialno=8000c816f0032000
mt5890 # usb start
mt5890 # usb read 7fc0 <address> <size> // see item 2
mt5890 # nm 4b70b4
004b70b4: eb0001bd ? e1a00000
004b70b4: e1a00000 ? .
mt5890 # bootm

5. And look what we have:

sh-3.2# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext4 (rw,relatime,data=ordered)
none on /proc type proc (rw,relatime)
none on /sys type sysfs (rw,relatime)
none on /opt type tmpfs (rw,relatime)
none on /dev/shm type tmpfs (rw,relatime)
none on /var/run type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/mapper/dm-3 on /3rd type squashfs (ro,relatime)
/dev/mmcblk0p12 on /3rd_rw type ext4 (rw,relatime,data=ordered)
/dev/mmcblk0p27 on /data type ext4 (rw,noatime,nodiratime,data=ordered)
/dev/mmcblk0p10 on /perm type ext4 (rw,relatime,data=ordered)
/dev/sda1 on /dev/shm/shm_tmp/mnt/usb/sda1 type vfat (rw,noatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=437,iocharset=utf8,shortname=mixed,errors=continue)

Two words about nm 4b70b4.

If you look at init/do_mounts.c, you can see prepare_namespace() function:

590 /* If this succeeds, the ROOT_DEV will have changed. */
591 ROOT_DEV = dm_mount_nfsb(ROOT_DEV);
592
593 mount_root();

At 591 line kernel check RSA signature in NFSB (Netflix secure boot) header and do 'dmsetup' to get squashfs.

Replace this function by NOP, mount root, and boot!

(I have G0414 firmware, other version may have other address of dm_mount_nfsb call)

Conclusion:

+we can load any kernel

+we can write to root fs

-we don't have work kernel's configuration, need to tune mt5890_smp_mod_defconfig

P.S.: I found that the kernel loaded on githab is 3.10.27+, so I replace it by 3.10.27, which used by Hisense K700.