yashsingh1/xdaforums huggingface dataset:
[Android Software Development] dipcore:
Look here https://github.com/dipcore/mstar-bin-tool/blob/master/pack.py The bin structure is straightforward, read comments in the file.
[Android Software Development] arabic devloper:
Sorry but i dont Understand you

crc calculate befor packing or after

can u give me example pls
[Android Software Development] dllxda:
dipcore......hi ............thank you for your great work

plz can you help me ...how to use aescrypt2 tool with extarcted keys files :AESBoot.bin ,AESUpgrade.bin ,

key_bank.bin,.............

i want to decrypt and unpack mboot.img , boot.img & recovery.img

thank you very much
[Android Software Development] dipcore:
Four steps to create bin:

1. create header (contains mboot script)

2. create bin part - it's merged image parts etc.

3. create footer

4. merge header + bin +footer

So on step #3 you need to generate two crc sums. First is crc sum of the header part (after it's generated). Second is crc sum of bin part (after it's merged). And generate footer. Footer structure is:

|MAGIC|SWAPPED HEADER CRC32|SWAPPED BIN CRC32|FIRST 16 BYTES OF HEADER|

Just look at the pack.py script, it's self explanatory. I do not know what else I can explain.
[Android Software Development] arabic devloper:
Madisonupgrade.bin

i know & its very sample but hhhhh

can u aplicate your methode in this software https://assets.kogan.com/files/support_files/KALED43SMTZA_V1_0_28/MadisonUpgrade.bin

because i am confuse

thank u again

aah can i test ur custom recovery in my tv or not
[Android Software Development] dipcore:
Just run it for help:

aescrypt2.exe
aescrypt2 <mode> <input filename> <output filename> <key>
<mode>: 0 = encrypt, 1 = decrypt
example: aescrypt2 0 file file.aes hex:E76B2413958B00E193

So you need to do:

aescrypt2 1 path_to_encrypted_image.img.aes path_where_to_put_decrypted_image.img path_to_AESBoot.bin_key

After you just need to unpack it. Use any available tool to unpack uboot multi-file image. (for instance http://www.matteomattei.com/extract-u-boot-multi-file-image-in-python/)

PS that's only for boot.img and recovery.img. You cannot unpack mboot.img it's binary file.
[Android Software Development] bamster89:
hey mate you can use this decryption/encryption key as default hex:0007FF4154534D92FC55AA0FFF0110E0

0 = encrypt

1 = decrypt

ex: aescrypt2 1 recovery.img recovery.img.dec hex:0007FF4154534D92FC55AA0FFF0110E0

use hex on recovery.img if you see MStar-linux(recovery) then you already decrypt recovery.img
[Android Software Development] dipcore:
That's right, many vendors do not change default AES keys provided by mstar. But to be sure you are using right key use extract_keys.py tool to extract working keys.

In my case the keys were different, so I have to write that extract tool to get right keys to decrypt my images.

PS 4th parameter of aescrypt2 tool can be hex value of the aes key (i.e. hex:0007FF4154534D92FC55AA0FFF0110E0) OR it can be path to aes key file extracted by extract_keys.py
[Android Software Development] dllxda:
dipcore

Thank u very much …………..but how to unpack decrypted recovery.img using extract_u-boot.py

C:\Users\.....\AppData\Local\Programs\Python\Python36>extract_u-boot.py d:\recovery.img

Traceback (most recent call last):

File "C:\Users\.....\AppData\Local\Programs\Python\Python36\extract_u-boot.py", line 23, in <module>

size = toNumber(buf)

File "C:\Users\.....\AppData\Local\Programs\Python\Python36\extract_u-boot.py", line 8, in toNumber

for b in buf: size=size*256+ord(b)

TypeError: ord() expected string of length 1, but int found
[Android Software Development] dipcore:
[MENTION=8125965]dllxda[/MENTION] Your images are decrypted fine.

It looks like you are using windows, so there is a tool you can use to pack/unpack boot.img and recovery.img

View attachment UBoot_win_Tools.zip

Ho to use it:

1. Unpack it

2. Put your boot.img and/or recovery.img to IN folder

3. Run _Boot.bat

4. In the command window enter 9 and press Enter (9-Init tools)

5. Next enter 1 or 2 depends what do you want to unpack and press enter (1-unpack boot, 2-unpack recovery)

6. In the Unpack folder you get it unpacked

7. Do your changes

8. In the command window press 11 or 12 to pack it back

9. You'll get packed images in Pack\Image folder.
[Android Software Development] dllxda:
hi dipcore thank u

but when i try to pack the partition ,I get.....................................................................

C:\Users\WS1\AppData\Local\Programs\Python\Python36\mstar-bin-tool-master\mstar-bin-tool-master>pack.py config/madison.ini

Traceback (most recent call last):

File "C:\Users\WS1\AppData\Local\Programs\Python\Python36\mstar-bin-tool-master\mstar-bin-tool-master\pack.py", line 60, in <module>

main = config['Main'];

File "C:\Users\WS1\AppData\Local\Programs\Python\Python36\lib\configparser.py", line 956, in __getitem__

raise KeyError(key)

KeyError: 'Main'
[Android Software Development] dipcore:
do you have madison.ini created?

you may want to do pack.py configs\dexp-madison-system.ini
[Android Software Development] jockyw2001:
[MENTION=6810881]dipcore[/MENTION]: thanks for your firmware unpacking tools. I just ordered a cheap 55" UHD Smart TV with a Mstar MSD 6488E to be delivered in the next days. The modelname is JAY-TECH GENESIS UHD 5.5 SMART DVX 5S. I think it is not an Android based Smart TV but rather a Linux based HbbTV. I think Caixun calls it a "Linux Connect" TV from what I read in their roadmap 2016/2017 doc. My TV supposably has 1GB RAM, only 512MB NAND or eMMC and a Wifi interface.

Do you know if there is a MSTAR Android SDK floating around for the MSD6488E chipset? And is it likely Ethernet NIC and eMMC interfaces are available on the mainboard, but just no connectors soldered? Finally, do you know whether UHD TV mainboards with Android OS are sold in China and do you happen to know a distributor? The display in the TV is apparently a Samsung LSC550FN06 with a standard 51 pin 8-Lane V-by-One Interface. I might swap the mainboard if it can improve things.

Best wishes,

JockyW
[Android Software Development] dipcore:
Hey JockyW,

Why not to use any android based tv box and connect it to your TV via HDMI? There are boxes with built-in tv tuners, if you really need the tv tuner.

If you want it as a separate board you can buy something like this http://www.cnx-software.com/2016/02...-supports-an-optional-dtv-tuner-crowdfunding/

It is mstar based android board with DVB-T2 or DVB-C tuner. I'm not sure which TV format is used in your area though. They also provide some sources so you can work with gpio on the board.
[Android Software Development] jockyw2001:
The built-in board has quite a few weak points: input lag 20-80ms, hdmi can only do 4:2:0 @60Hz, no eth nic, no emmc slot, poor 4k upscaler, no hdr, no android. Either I swap the board with e.g. a LeTV 3X-55 or Seiki SE55, if I can find those somewhere, or I try to get Android running on the current board just for the fun of hacking it in. The MSD6488E cpu seems capable enough (dual-core cortex-A53, quad-core mali450). I haven't searched that hard for it, but an appropriate mstar sdk seems hard to find...

I tried your firmware decoder on two mstar firmwares and got this:

Although the header script is stored in unpacked/~header and shows:
[Android Software Development] dipcore:
Its impossible to find full mstar sdk for your cpu. They ask to sign nda for all tv/projector vendors. :( It's funny because 90% of their code is from opensource world.

I never saw that kind of firmware (non android with nand), can you give me a link on your bin, so I can update my scripts.

I can find x3-55 or x4-55 board for you, if you really want to buy.
[Android Software Development] jockyw2001:
I think pretty soon something can be found in the usual chinese channels...

Here is a googledrive link

Nice. If physical interfaces with panel and power supply board are similar as on attached pics, then in the near future I am interested.

I downloaded a firmware for a Kogan TV and could successfully unpack it. Do you know in which part the hdcp keys are stored? My assumption is that for each production batch, the firmware includes all hdcp keys for that batch.
[Android Software Development] dipcore:
Look at tvcustomer.img it's ext4 image.

btw you need to put lzop binary to bin/linux-x86/lzop or create a link on it.
[Android Software Development] jockyw2001:
The tvcustomer.img from that Kogos firmware is not an ext4 image and as far as I can see does not include hdcp keys
[Android Software Development] dipcore:
just mounted it:

/media/sf_D_DRIVE/TMP/tvcustomer.img on /media/sf_D_DRIVE/TMP/1 type ext4 (rw)

so it's ext4

But you are right there are no hdcp keys.

Share these partitions I'll take a look:

Partition: tvservice	Offset: 1a9c4000	Size 5000000 (80.0 MB) -> unpacked/tvservice.img

Partition: tvcustomer	Offset: 1f9c4000	Size 1000000 (16.0 MB) -> unpacked/tvcustomer.img

Partition: tvdatabase	Offset: 209c4000	Size 800000 (8.0 MB) -> unpacked/tvdatabase.img

Partition: customercfg	Offset: 211c4000	Size 3000000 (48.0 MB) -> unpacked/customercfg.img
[Android Software Development] jockyw2001:
I used lzop.exe -d in windows and that failed, that's why I thought it is not an ext4

Here they are

edit: sorry I overlooked it, lzop is not at the right place ...
[Android Software Development] dipcore:
[MENTION=487710]jockyw2001[/MENTION] I opened all images and I cannot find hdcp keys. Not sure where they store them.

In my firmware all the keys are in tvcustomer.img
[Android Software Development] dipcore:
BTW look at tvservice.img and customercfg.img there are panel configs, may be helpful for you to get if it's configurable for your panel
[Android Software Development] jockyw2001:
Don't waste time on that firmware. It is for a Kogan KALED473DSMTZA and I only downloaded it to test your unpacker. I think hdcp keys can be found in the CtvUpgrade.bin once your unpacker supports these files.

But useful info about tvservice.img and customercfg.img !
[Android Software Development] zeid_zeid:
Rooting The MStar Tv CV628H_B42-LF1V001

hi i m trying to root my TV and i cannot figur out why the USB connection is blocked.

I followed steps i have read on the net.

First i connected through the adb connect (IP)

second I moved the files required to a tmp folder (su,busybox,superuser.apk)

third i have rebooted the device in to recovery (adb reboot recovery)

fourth i have rebooted my pc into linux

i run sudo nautilus so that i have root access on the device

now i have the pc connected to the device through USB cable but the pc doesn't see it

i can connect ftp or ssh but i will lose the root privileges to copy the files into the system folder.
[Android Software Development] jockyw2001:
I found a very useful reverse engineering site for a 65" Bauhn TV sold by Aldi in Australia. These TV's have a Linux OS and are powered by MStar just like my Jay-Tech:

Aldi_Bauhn TV firmware reverse engineering

His work is based on the gpl code made available by Kogan TV on this github

In the extracted filesystem the hdcp and ci keys can be found in folder certificate

Have fun!
[Android Software Development] bamster89:
use kingroot
[Android Software Development] dipcore:
I found that the system is unstable with kingroot, so you can replace kingroot with supersu after you get rooted. You can use supersu-me application to do so. An extended article of how to do so https://missingtricks.net/replace-kingroot-kinguser-with-supersu-superuser-android-guide/

There is an another way to do it - you can unpack your bin firmware. Mount system.img and add supersu manually to it. Pack system.img back to bin firmware and flash it. It requires some skills, but 100% working method of getting rooted.
[Android Software Development] kburdaz:
Hello.

I have P2US TV.

I unpacked *bin, unpacked and changed system.img

now i wanna pack fw but i havent config for ms68 platform...
[Android Software Development] dipcore:
You need to take a look what you have in the unpacked header script. Then compare it with any existing config and write your own.

Paste your header script to pastebin, I can help you with it.
[Android Software Development] dipcore:
Yes it's fine, they are using lzo to compress big partitions (system userdata etc)

Two more questions:

- What is your exact TV model name and vendor?

- What is exact firmware file name? (Many vendors change it from default MstarUpgrade.bin to something else for instance LetvUpgrade.bin)
[Android Software Development] kburdaz:
- TCL L43P2US. Same fw for P1US-series and all TV based on S68AT02 (MS68A-AP board).

- V8-S68AT02-LF1V*** (for example V8-S68AT02-LF1V108)
[Android Software Development] dipcore:
I uploaded the config to my github: https://github.com/dipcore/mstar-bin-tool/blob/master/configs/tcl-s68at02-system.ini

Do not forget - you need to create pack folder and put your updated system.img in it.

If you want to use other folder (path) to your updated images, you need to update line #10:

ProjectFolder=./pack

You also may need to update output firmware file name, it's in line #9.
[Android Software Development] kburdaz:
i already pack the system.img

I need config for pack all fw to .bin
[Android Software Development] dipcore:
That's what is it for.
[Android Software Development] ankush82:
Hi [MENTION=6810881]dipcore[/MENTION] [MENTION=8333250]kburdaz[/MENTION] if you guys could share me the modified bin file for L43P2US model with root enabled and updated gapps i will be highly thankful and obliged to you.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Hi buddy i am still waiting for your response please atleast help me how and what all files i need to add or replace to get root access and also to update the google play services. I am ready to help you with donation.
[Android Software Development] dipcore:
Give me your ROM Ill take a look.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] thanks for your response i will upload on google drive and share the same with you. FYI i have downloaded the same from pda forum with v150 version.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Here is the link of the rom for your kind perusal.
[Android Software Development] kburdaz:
Hello

I havent root my tv.

This is instruction how to update google services - 4pda.ru)

Description:

All necessary (missing and updated) components required for the Google Play Market to work on TCL LxxP1US, LxxP2US, LxxC1US, LxxC1CUS. Included in the archive of packages, libraries and binaries are taken from OpenGapps version of arm64, Android 5.1, tvstock. Works on all firmware, including V108 and V150.

A responsibility:

You are responsible for what you do with your device. If you are not sure of your abilities, do not do the described actions better. To avoid errors, it is recommended to copy-paste commands, rather than typing manually.

Installation:

1. It is assumed that you have the ADB utility installed on your computer.

2. Download zip-archive and unpack it into the directory where ADB is located.

3. Start the terminal ("cmd" for Windows) and go to the directory with ADB.

4. Check that there is a connection to the TV:

adb devices

Find IP of ur's TV

adb connect <ip>:5555

5. Copy the data to the device:

adb push tar-arm /sdcard
adb push tcl-system-gapps.tar /sdcard

6. Go to the remote system:

adb shell

Then we take a root

tclsu

7. Installing gapps

cd /system
cp /sdcard/tar-arm xbin/tar
chmod 0755 xbin/tar
tar -xf /sdcard/tcl-system-gapps.tar
rm /sdcard/tcl-system-gapps.tar /sdcard/tar-arm
exit

8. Done. If all commands are executed without errors, you can close the terminal and reboot the TV (it is better to disconnect from the socket).

9. After the reboot, we check the work of the market play. Attention: Play Market application from TCL Appstore must be installed. Do not worry, this is not the market itself, but only a shortcut for launching the built-in application from the shell.

Note #1: on MacOS / Linux before "adb" it is necessary to type "./"

Note #2: the reboot after installation lasts a very long time (I had about 5 minutes). This is normal, the system should index new packages.

Note #3: if something went wrong, and the TV is not loaded, you can return everything back, flashing through the flash drive with an alternative method from the cap.

Download gapps from my google drive - tvgapps

Or download it from opengapps.org
[Android Software Development] ankush82:
[MENTION=8333250]kburdaz[/MENTION] Hi thanks for your response yes i followed the above post and updated the gapps which was given on pda thread. But that was old now i need the recently updated gapps which i have downloaded from opengapps. Now the challenge is all files are packed in .lz format and i am using windows and unable to extract those files please help.
[Android Software Development] dipcore:
Nope
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Any update on my rom?
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Hey I am still waiting for your msg mate. Any luck for me?
[Android Software Development] dipcore:
Hey,

sorry I do not have enough time to look at it. A lot of job last days.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Hi in the mean while if you could help me to unpack boot.img it will be a great help. I have decrypted the boot.img woth your scripts but unable to unpack with any of the tools you have mentioned or available online.
[Android Software Development] dipcore:
Here is a tool you need: View attachment UBoot_win_Tools_v1.1.zip

It allows to unpack/repack boot.img, recovery.img and system.img

How to use:

1. Put your image in IN folder

2. Launch _Boot.bat

3. Choose "9-Init tools"

4. Next choose option 1 to 6, depends what do you want to unpack. To unpack boot press 1.

After you do your changes, and press 11-15 to pack it back.

Every time you want to start working with a new image press "19-CLEAN tools"
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] i used that tool its giving me following error " invalid uboot img". I have put the decrypted boot.img to IN folder.
[Android Software Development] dipcore:
Let me take a look on your image.
[Android Software Development] dipcore:
Please upload it somewhere
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Please find attach the boot.img and mboot.img

The attached boot.img is encrypted one that's why i have attached Mboot.img in case i was failed to decrypt the boot.img.

Decrypted Boot.img is here
[Android Software Development] dipcore:
It's not well decrypted.

The easiest way to check if it's decrypted well just open the image in any text editor, you will get a lot of garbage but close to the beginning of the file you should have a text "MStar-linux(recovery)" or "MStar-linux(boot)".

Here is your well decrypted boot: https://www.dropbox.com/s/l1qh61b7s85itph/boot.img.out?dl=0 Rename it to boot.img

To decrypt use:

bin\win32\aescrypt2.exe 1 project\boot.img project\boot.img.out hex:0007FF4154534D92FC55AA0FFF0110E0

To encrypt it back use:

bin\win32\aescrypt2.exe 0 project\boot.img.new project\boot.img.aes hex:0007FF4154534D92FC55AA0FFF0110E0

PS You have default MStar keys.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] i need the unpacked boot.img as i was unable to unpack the same.

I used the same commands what u have mentioned but used in windows environment.
[Android Software Development] dipcore:
I attached unpacked boot.img, look in my message above.
[Android Software Development] ankush82:
[MENTION=6810881]dipcore[/MENTION] Can u guide me now what all changes i required to root the device and unlock bootloader
[Android Software Development] dipcore:
Sorry that subject is too wide to give you a simple answer.
[Android Software Development] goujibing:
i want unpack boot.img.but i can't
[Android Software Development] ankush82:
[MENTION=7156654]goujibing[/MENTION] please see above msg it has decrypted boot.img just use uboot unpacker link is available in above posts of dipcore. If know what all changes required to get the root plz let me know i will do it and repack it which can help everyone.
[Android Software Development] goujibing:
Extract keys isn't use,no sure buffer.And Mboot maybe no key.
[Android Software Development] hexcoder:
[MENTION=4505077]ankush82[/MENTION] [MENTION=7156654]goujibing[/MENTION] Latest firmware for TCL P2US V8-S68AT02-LF1V185.bin if that helps ?:fingers-crossed:
[Android Software Development] L0neWarri0r:
Hi, where did you search for those p2us firmwares?

I have a problem with the game mode setting, newer versions, which came after 075, cancels it every time, when tv if turned off, or even, when I change a decktop resolution. Can somebody tell me what may causing that glitch?
[Android Software Development] hexcoder:
You can try this method to gain root.

---------- Post added at 08:32 AM ---------- Previous post was at 08:25 AM ----------

From a Chinese forum.

---------- Post added at 08:33 AM ---------- Previous post was at 08:32 AM ----------
[Android Software Development] hexcoder:
Are you facing the same issue on the newer version of the firmware that I shared ?
[Android Software Development] ankush82:
New version came with its own problem. Setting button stopped working now to open settings menu we hav to use setting app only. I revert back to v150

---------- Post added at 02:31 PM ---------- Previous post was at 02:29 PM ----------

This method doesn't work i tried. Tclsu is a location specific file we cant replace it with any other file. I tried this method and lost adb root many times bcoz it links with su binary which doesn't work.
[Android Software Development] hexcoder:
Well, then I guess its better to get an android box:mad:, anyways I'm returning my device to manufacturer as within span of 4 days there are like 5 dead pixels which have developed on the screen. Will have to wait to experiment. Until then I'll start working on the original firmware itself to unpack the boot.img and system.img for exploring any possible mod that we can do.
[Android Software Development] ankush82:
Here is my research till date.

1. To gain the basic command line adb root need to change the following in default.prop

ro.secure=0

2. There is a line in under file_context which is renaming su file to tclsu. if we can remove this line their is a possibility to put our su binary to gain root.

(Though i dont know much about how file_context works)

3. There is a anti root method which restore build.prop and put all custom binary into block list. I just forgot the name of that file will share once i found it.
[Android Software Development] L0neWarri0r:
Unfortunately, yes. Also, now I get "starting smart system" message every time I turn the tv on. But, what a most strange, different people have different problems with different firmware versions on similar tv and a root of this problem is unclear.
[Android Software Development] ankush82:
Another finding, there is a blacklist file which includes all the google apps like play service and others thats why play service not updated by its own. I need more guidance on this so that i can make changes and replace it with edited file.
[Android Software Development] ankush82:
I unpacked system.img and found following content in install-recovery.sh

/system/bin/sh

i=0

ret=-1

while ( [ $ret -ne 0 ] && [ $i -lt 200 ] )

do

/tvos/bin/tcli db.factory.watchdog

let "ret = $?"

let "i++"

log -t recovery "do tcli db.factory.watchdog."

log -t recovery $i

sleep 1

done

log -t recovery "finish tcli db.factory.watchdog."

file_context contain this line under devices section- /dev/watchdog	uobject_r:watchdog_device:s0

here we can find "watchdog" which is a anti root file. Now i am not able to find this watchdog file anywhere. I hope we can root [MENTION=6810881]dipcore[/MENTION] can help on this.

---------- Post added at 04:46 PM ---------- Previous post was at 04:07 PM ----------

I have extracted recovery.img and found watchdog file under \sbin folder. Now shell i delete this file please help [MENTION=6810881]dipcore[/MENTION]