[Android Software Development] p0isk:
toolchain and linux source

Hi All!

[MENTION=5639635]birri[/MENTION], grep your dmesg output, its contain tuner model,e.g. Si2157.

K321/K700/K720 have this mmcblk config (can be copied from TV):

/dev/	size	FW	name	FS type	description
mmcblk0p1	2M	uboot	uboot
mmcblk0p2	2M	+	uboot_env	uboot envirment
mmcblk0p3	256k	part_02
mmcblk0p4	256k	part_03
mmcblk0p5	4M	+	kernelA	kernel
mmcblk0p6	4M	+	kernelB	kernel backup
mmcblk0p7	75M	+	rootfsA	squashfs	root fs
mmcblk0p8	75M	+	rootfsB	squashfs	root fs backup
mmcblk0p9	256k	basic
mmcblk0p10	8M	perm	ext4	/perm
mmcblk0p11	320M	+	3rd_ro	squashfs	/3rd
mmcblk0p12	750M	+	rw_area	ext4	/3rd_rw
mmcblk0p13	256k	reserved
mmcblk0p14	256k	channelA
mmcblk0p15	256k	channelB
mmcblk0p16	256k	+	pq	picture quality
mmcblk0p17	256k	+	aq
mmcblk0p18	75M	+	logo	jpg	startup logo	512k
mmcblk0p19	256k	acfg_descr
mmcblk0p20	256k	schedule_pvr
mmcblk0p21	3M	+	adsp
mmcblk0p22	256k	ci
mmcblk0p23	256k	dvbsDB
mmcblk0p24	256k	hdcp
mmcblk0p25	1M	+	facs
mmcblk0p26	256k	hiscfg
mmcblk0p27	2048M	data	ext4	/data	for update?

firmware contain this:

name	FS type	desciption
logo.bin	jpg	JPEG logo's
ddb.bin
load.bin	firmware update loader?
facs.bin
eepr.bin	EEPROM
uenv.bin	u-boot environment
adsp.bin	ADSP
aqda.bin
pqda.bin
3rdw.bin	LZHS(etx4)	/3rd_rw
3rdp.bin	squashfs	/3rd
rtfs.bin	squashfs	rootfs
kern.bin	LZO	kernel
usig.bin

Here You can find pkg tools to extract .bin from firmware:

github com/p0isk/pkg2extract

(based on epk2extrack for LG TV and jakubpawlo script)

1. Copy upgrade_loader.pkg to scripts/

2. Check 3 constant for your firmware:

OFFSET=427 - address of second entry 'logo'

EXTRA_DATA_LEN=64 - length of block like this:

69 4D 74 4B 38 00 00 00 10 00 00 00 55 53 42 5F iMtK8.......USB_
55 50 47 5F 56 45 52 53 49 4F 4E 00 69 50 41 64 UPG_VERSION.iPAd
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

HEADER_LEN=48 - lengh of block minus 12 byte (name of .bin, 0000, len of .bin) like this:

6C 6F 67 6F 00 00 00 00 8B B0 20 03 AF D2 12 17 logo....‹° .ЇТ..
6B 6D 06 A8 B8 88 FC F5 F0 19 8E CE D9 4F 8F C7 km.Ёё€ьхр.ЋОЩOЏЗ
DB EB D8 F1 FD C8 EC BC EA 5B 64 BB 6C 6E 35 4B ЫлШсэИмјк[d»ln5K
CB B7 90 A1 2E 8B 7A ED 18 59 FC 91 Л·ђЎ.‹zн.Yь‘

3. Execute

extract.sh

Now You can mount 3rdp.bin and rtfs.bin as squashfs.

4. 3rdw.bin is ext4 packed by LZHS. First 1MB isn't packed.

5. Build pkg2extract and execute

./lzhs_scanner 3rdw.bin 1
cat 3rdw.bin_file*.unlzhs > 3rdw.ext4

Now You can mount 3rdw.ext4 as ext4.

New toolchain 4.8.2 and linux-3.10.27 are available on github.com/p0isk

sudo apt-get install ncurses-dev procmail

git clone https://github.com/p0isk/gnu-toolchain_4.8.2
git clone https://github.com/p0isk/linux-3.10.27
cd linux-3.10.27
make mt5880_smp_mod_defconfig
make menuconfig
make modules

I compile cifs.ko module and mount share from NTFS drive. It works from browser and telnet, but not from Media UI (mounted folder just disappears).

Then I try FAT32 - it works fine!

How to mount:

mkdir /tmp/share
insmod cifs.ko
busybox mount -t cifs -o username=<username>,password=<password> //192.168.1.1/share /tmp/share
echo "/tmp/share;MyShare;0123456789" >> /tmp/usbs

Now You can see video from Media UI like from USB.

Media UI works through /3rd/browser/opera_dir_launcher/jsplugins/libmodeljs.so library and /3rd_rw/UI/hisenseUI/model/model.js which contains functions calls.

So it possible to create table of libmodeljs.so functions and examples of their use, maybe.

model.js written by Sascha Radike and has Copyright (c) 2014 LOEWE Opta GmbH, Kronach. But I didn't find anything about him.

modeljs has one interesting function 'sendam()':

for example sendAM(":am,am,remote:start=youtube")

'youtube' is described in file /basic/am_config

[ youtube ]
exec = /3rd/internet_browser/browser
args = -w 1920 -h 1080 -x youtube -m NO -4 YES -v YES -u http //www youtube com/tv --hw-dfb --allow-file-access-from-files --remote-debugging-port=9222 --log-level=0 --dfb-window-mode --enable-impl-side-painting --dfb-compositor-memory-limit-mb=46
id = YOUTUBE
app = youtube
loosely_exclusive_set = dtv
coexist_set = [dtv_app_mtk,hbbtv]
timeout_4_stop = 30
keymap = keymap.ini

or

[ netflix ]
exec = /3rd/netflix/nrd-app/netflix
args =
layer1_buffer_mode = window
change_focus_notify = true
id = MTK_NETFLIX
app = netflix
loosely_exclusive_set = dtv
coexist_set = [dtv_app_mtk,hbbtv]
keymap = keymap.ini
timeout_4_stop = 30
wait_for_started = true
backgm_support = default
hotkey = true

So we can try to run new browser (for webskype) or kodi...

/3rd/software-update/ and /3rd_rw/software-update/ contain ota-update scripts and tools.

Maybe it possible to replace read-only /3rd and rootfs by ext2 fs.

Sony Bravia Android TV has this cpu (and mt5891), but firmware is encrypted by AES.

It contains:

cfig
uenv
misc
recv
boot
sysm
usrd
cach
logo
rfsA
tvap
3rdw
perm
3rdp
svla
svlb
pnel
edid
ddbb
epg
adsp
upgr
ddri
ldat
dfw1
dfw2
fdat
udat
minf
b001
b002
spst
bost
ver
demo
tzbp
aqda
bdat
bdix
mafw
mlfw
ndat
pdat
pqda
udt

Wow, more than HiSense TV.

And Sony TV has serial control 3.5 mini jack, like HiSense:

graphics secondipity com/gr/images/nw/XBR49X830CSideRight02.jpg

(its X830C 4K Ultra HD with Android TV)

Maybe it possible to take image from eMMC.

And something interesting:

linux-3.10.27 source says that MT5890 is Cortex-A12 quad-core... arch/arm/boot/dts/MT5890_hmp.dts contain this:

cpus {
cpu0: cpu@0 {
device_type = "cpu";
compatible = "arm,cortex-a12";
cci-control-port = <&cci_control1>;
reg = <0x0>;
clock-frequency = <1000000000>;
};

cpu1: cpu@1 {
device_type = "cpu";
compatible = "arm,cortex-a12";
cci-control-port = <&cci_control1>;
reg = <0x1>;
clock-frequency = <1000000000>;
};

cpu2: cpu@2 {
device_type = "cpu";
compatible = "arm,cortex-a7";
cci-control-port = <&cci_control2>;
reg = <0x100>;
clock-frequency = <1000000000>;
};

cpu3: cpu@3 {
device_type = "cpu";
compatible = "arm,cortex-a7";
cci-control-port = <&cci_control2>;
reg = <0x101>;
clock-frequency = <1000000000>;
};
};

And config contain:

CONFIG_NR_CPUS=2

But dmesg says:

[ 0.000000] CPU: ARMv7 Processor [410fc0e0] revision 0 (ARMv7), cr=10c5387d
[ 5.165670] SMP: Total of 2 processors activated.

But 0x410fc0e0 means Cortex-A17...