gomez’s blog

Few days ago I had interesting request to tweak Linux on Samsung LCD TV. At first, I was kind of surprised that Linux is supported on TV, but it is normal. Linux is very strong competitor on the appliance based market and it was just about time to face those kind of installations. The main goal was to enable telnet on firmware in order to be able to connect to TV, and after that to load Common Internet File System to be able to use network mounts. Since I didn’t know anything about Samsung TV series and belonging firmware versions I needed to read something about that. Basically, there are differences in versions based on producing years and processors that are supported. This text is about to cover Samsung LCD TV LE40A756 and A856 with firmware T-RBYDEU. I need to mention that it is kind of easier to work with other models of Samsung LCD TVs since they seam to open more possibilities (this is just my opinion) for firmware hacking but this version was very interesting to play with as well. Since this firmware (as much as all other appliance based firmware versions) is using squash file system, to be able to add something on filesystem we would need to unsquash file system (unsquash is viable thru squashfs-tools) and then perform necessary changes. Since I am using Ubuntu which is providing newer version of squashfs-tools package than it is required (Ubuntu is providing squashfs-tools version 3.1 and it is required to have version 2.0) I didn’t follow that procedure. However, for those that would like to give it a try you can follow this procedure. We will follow other procedure.

Downloads

Navigate to Samsung web site > Support > Downloads > TV Audio Video > Choose a product type>: Television > Choose a product subtype: LCD TV > Select your TV model and then click on Select. You will be provided with the link to download your firmware version. In our case firmware is called T-RBYDEU.exe.

Firmware work

Using some of the decompression tools like 7zip, WinRAR or some other program that you use on the daily basis, we need to extract .exe file that we have downloaded. I will describe procedure under Linux operating system using 7zip:

7z x T-RBYDEU.exe

Once done, you will be able to see extracted files in directory T-RBYDEU. Please note that you will be able to see those files:

gomez@gomez-laptop:/media/Data_/T-RBYDEU$ ls -la
total 40
drwx—— 1 gomez gomez     0 2009-05-11 23:38 .
drwx—— 1 gomez gomez  4096 2010-04-01 16:22 ..
-rwxrwxrwx 1 gomez gomez 18929 2009-04-17 16:16 crc
drwx—— 1 gomez gomez  4096 2009-05-11 23:38 image
-rwxrwxrwx 2 gomez gomez  8676 2009-04-17 16:16 MicomCtrl
gomez@gomez-laptop:/media/Data_/T-RBYDEU$ cd image/
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ ls -la
total 58166
drwx—— 1 gomez gomez     4096 2009-05-11 23:38 .
drwx—— 1 gomez gomez        0 2009-05-11 23:38 ..
-rwxrwxrwx 1 gomez gomez  8155136 2009-04-17 16:16 appdata.img
-rwxrwxrwx 1 gomez gomez   602112 2009-04-17 16:16 boot.img
-rwxrwxrwx 1 gomez gomez 37646336 2009-04-17 16:16 exe.img
-rwxrwxrwx 1 gomez gomez   177920 2009-04-17 16:16 fnw.bin
-rwxrwxrwx 1 gomez gomez       17 2009-04-17 16:16 info.txt
-rwxrwxrwx 1 gomez gomez    99680 2009-04-17 16:16 oneboot.bin
-rwxrwxrwx 1 gomez gomez  3424256 2009-04-17 16:16 rootfs.img
-rwxrwxrwx 2 gomez gomez  3172612 2009-04-17 16:16 T-RBYDAUM
-rwxrwxrwx 2 gomez gomez  3172612 2009-04-17 16:16 T-RBYDEUM
-rwxrwxrwx 1 gomez gomez   228296 2009-04-17 16:16 u-boot.bin
-rwxrwxrwx 2 gomez gomez       47 2009-04-17 16:16 validinfo.txt
-rwxrwxrwx 2 gomez gomez       43 2009-04-17 16:16 version_info.txt
-rwxrwxrwx 1 gomez gomez  2864533 2009-04-17 16:16 vmlinux.ub
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$

As per above output, please note that we have directory called image, and from the interesting files we have exe.img and validinfo.txt which will be used in following text.

Firmware tweaks

Next thing that we need to do is to prepare exe.img for additional changes in order to be able to telnet to TV and use some networking services like CIFS. Now, navigate to image directory and create directory temp:

gomez@gomez-laptop:/media/Data_/T-RBYDEU$ cd image/
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ mkdir temp
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$

Once done, we will mount exe.img with the type of vfat to newly created temp directory:

gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ sudo mount -t vfat -o loop exe.img temp/

With above command, we have mounted exe.img to temp directory. Please note that we have following files inside temp directory:

gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ cd temp/
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image/temp$ ls -la
total 28980
drwxr-xr-x 3 root root 16384 1970-01-01 01:00 .
drwx—— 1 gomez gomez 4096 2010-04-04 19:06 ..
-rwxr-xr-x 1 root root 29487160 2009-04-17 16:16 exeDSP
drwxr-xr-x 3 root root 8192 2009-04-17 16:16 modules
-r-xr-xr-x 1 root root 131072 2009-04-17 16:16 $rfs_log.lo$
-r-xr-xr-x 1 root root 8192 2009-04-17 16:16 rfs_pool.sy$
-rwxr-xr-x 1 root root 4374 2009-04-17 16:16 run
-rwxr-xr-x 1 root root 4525 2009-04-17 16:16 start.sh
gomez@gomez-laptop:/media/Data_/T-RBYDEU/image/temp$

Please note that we have start.sh file which we will use in following text.

Scripts

Using your favourite text editor, replace current start.sh file with following:

#!/bin/sh

if [ -e /mtd_chmap/start.sh ]
then
echo “user start.sh found!”
/mtd_chmap/start.sh
else

export PATH=/sbin:/usr/sbin:/usr/bin:/bin:/usr/local/bin:/usr/local/sbin
#export LD_LIBRARY_PATH=/usr/local/lib:/usr/lib:/lib
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/mtd_cmmlib:/usr/local/lib:/usr/lib:/lib
export HOME=/tmp/root
export TERM=linux
export LOGNAME=”root”
cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`
echo $PU
$PU/usb.sh &

mount

## mount -n -t usbfs none /proc/bus/usb

ulimit -s 2048

export PS1=’\h:\w\$ ‘

## STAPI Root Device Name?## ———————-
ST_DEV_ROOT_NAME=stapi
export ST_DEV_ROOT_NAME

## STAVMEM Device Name
## ——————-
STAVMEM_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stavmem_ioctl
export STAVMEM_IOCTL_DEV_PATH

## STAUDLX Device Name
## ——————-
STAUDLX_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/staudlx_ioctl
export STAUDLX_IOCTL_DEV_PATH

## STBLAST Device Name
## ——————-
STBLAST_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stblast_ioctl
export STBLAST_IOCTL_DEV_PATH

## STBLIT Device Name
## ——————
STBLIT_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stblit_ioctl
export STBLIT_IOCTL_DEV_PATH

## STCC Device Name
## —————-
STCC_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stcc_ioctl
export STCC_IOCTL_DEV_PATH

## STCLKRV Device Name
## ——————-
STCLKRV_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stclkrv_ioctl
export STCLKRV_IOCTL_DEV_PATH

## STDENC Device Name
## ——————
STDENC_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stdenc_ioctl
export STDENC_IOCTL_DEV_PATH

## STEVT Device Name
## —————–
STEVT_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stevt_ioctl
export STEVT_IOCTL_DEV_PATH

## STFASTFILTER Device Name
## ————————
STFASTFILTER_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stfastfilter_ioctl
export STFASTFILTER_IOCTL_DEV_PATH

## STFDMA Device Name
## ——————
STFDMA_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stfdma_ioctl
export STFDMA_IOCTL_DEV_PATH

## STGFB Device Name
## —————–
STGFB_CORE_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stgfb_core
export STGFB_CORE_DEV_PATH
STGFB_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stgfb_ioctl
export STGFB_IOCTL_DEV_PATH

## STHDMI Device Name
## ——————
STHDMI_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/sthdmi_ioctl
export STHDMI_IOCTL_DEV_PATH

## STI2C Device Name
## —————–
STI2C_IOCTL_DEV_PATH=”/dev/${ST_DEV_ROOT_NAME}/sti2c_ioctl”
export STI2C_IOCTL_DEV_PATH

## STLAYER Device Name
## ——————-
STLAYER_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stlayer_ioctl
export STLAYER_IOCTL_DEV_PATH

## STMERGE Device Name
## ——————-
STMERGE_IOCTL_DEV_PATH=”/dev/${ST_DEV_ROOT_NAME}/stmerge_ioctl”
export STMERGE_IOCTL_DEV_PATH

## STPIO Device Name
## —————–
STPIO_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stpio_ioctl
export STPIO_IOCTL_DEV_PATH

## STPTI4 Device Name
## ——————
STPTI4_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stpti4_ioctl
export STPTI4_IOCTL_DEV_PATH

## STSMART Device Name
## ——————-
STSMART_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stsmart_ioctl
export STSMART_IOCTL_DEV_PATH

## STSYS Device Name
## —————–
STSYS_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stsys_ioctl
export STSYS_IOCTL_DEV_PATH

## STTTX Device Name
## —————–
STTTX_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stttx_ioctl
export STTTX_IOCTL_DEV_PATH

## STTUNER Device Name
## ——————-
STTUNER_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/sttuner_ioctl
export STTUNER_DEV_PATH

## STVBI Device Name
## —————–
STVBI_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvbi_ioctl
export STVBI_IOCTL_DEV_PATH

## STVID Device Name
## —————–
STVID_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvid_ioctl
export STVID_IOCTL_DEV_PATH

## STVIN Device Name
## —————–
STVIN_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvin_ioctl
export STVIN_IOCTL_DEV_PATH

## STVMIX Device Name
## ——————
STVMIX_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvmix_ioctl
export STVMIX_IOCTL_DEV_PATH

## STVOUT Device Name
## ——————
STVOUT_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvout_ioctl
export STVOUT_IOCTL_DEV_PATH

## STVTG Device Name
## —————–
STVTG_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/stvtg_ioctl
export STVTG_IOCTL_DEV_PATH

STTKDMA_IOCTL_DEV_PATH=/dev/${ST_DEV_ROOT_NAME}/sttkdma_ioctl
export STTKDMA_IOCTL_DEV_PATH

RUN=1
/exe/exeDSP

Please note bold lines. Basically, it is the same file except that we are instructing our Linux firmware to load usb.sh script which needs to be located on USB root directory. usb.sh script will instruct Linux firmware to start busybox instance of telnet deamon so that we are able to telnet to our TV, and additionally it will load cifs.ko kernel module which will enable Common Internet File System so that we are able to mount some network devices on our Linux firmware. usb.sh script looks like:

#! /bin/sh

echo “!!!!!!!!!!!!!! USB START !!!!!!!!!!!!!!”

/bin/stty -F /dev/ttyAS0 ospeed 57600 ispeed 57600
#line before enables console for speed 57600. Put ‘debug’ to console and you see menu, put ’12′ and ENTER
echo “!!!!!!!!!!!!!! start console on 57600 !!!!!!!!!!!!!!”

#sleep 25 sec is need for wait ethernet start
sleep 25

cd /dtv/usb
PU=`cat log | grep Mount`
PU=`echo ${PU##MountDir : }`

echo “!!!!!!!!!!!!!! start telnet !!!!!!!!!!!!!!”
$PU/busybox telnetd -l /bin/sh

echo “!!!!!!!!!!!!!! start cifs.ko !!!!!!!!!!!!!!”
cd $PU
insmod cifs.ko

sleep 4

echo “!!!!!!!!!!!!!! clear old contents USB on TV !!!!!!!!!!!!!!”
rm /mtd_contents/V* -R
rm /mtd_contents/database -R

echo “!!!!!!!!!!!!!! start mount !!!!!!!!!!!!!!”
mount -t cifs //192.168.0.1/photo $PU/photo -o user=user_xp -o pass=password_xp
mount -t cifs //192.168.0.1/mp3 $PU/mp3 -o user=user_xp -o pass=password_xp
mount -t cifs //192.168.0.1/video $PU/video -o user=user_xp -o pass=password_xp

mount

echo “!!!!!!!!!!!!!! USB END !!!!!!!!!!!!!!”

Please note bold lines. Basically, we are starting telnet daemon and loading cifs.ko kernel module. After that, we are mounting some Windows XP shares from our personal computer which is working on 192.168.0.1 IP address. Once this file is loaded, and those mount locations are created you will be able to use files within above directories on your TV from the TV menus.

Please note that usb.sh, cifs.ko, busybox files and mp3, video, and photo directories needs to be located on USB root location.

Once done with that, we are ready to preform final changes to our firmware. First thing that we need to do is to umount temp directory:

gomez@gomez-laptop:/media/Data_/T-RBYDEU$ sudo umount /home/gomez/Desktop/T-RBYDEU/temp

Then, we need to delete temp directory:

gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ sudo rm -rf temp/

Once done with that, we need to change CRC information, because we have changed exe.img file. We can do that as follows:

gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ crc32 exe.img
cdc8080c

Once we have CRC information, we need to enter new value to validinfo.txt file:

gomez@gomez-laptop:/media/Data_/T-RBYDEU/image$ cat validinfo.txt
*007_exe.img_663430d9*011_appdata.img_a485b538

Please note value 663430d9. We need to change that value with cdc8080c that we have got as output from crc32 command. You can do that by using your favourite text editor. Once done with that, we are done with tweaking our Linux firmware. Your USB pen content should look like this:

gomez@gomez-laptop:~/Desktop/USB$ ls -la
total 3644
drwxr-xr-x 6 gomez gomez    4096 2010-04-05 08:59 .
drwx—— 8 gomez gomez    4096 2010-04-05 09:03 ..
-rwxrwxrwx 1 gomez gomez  992084 2009-11-18 23:13 busybox
-rwxrwxrwx 1 gomez gomez 2707316 2009-11-17 20:08 cifs.ko
drwx—— 2 gomez gomez    4096 2009-12-28 09:12 mp3
drwx—— 2 gomez gomez    4096 2009-12-28 09:12 photo
drwx—— 3 gomez gomez    4096 2010-04-05 08:59 T-RBYDEU
-rwxrwxrwx 1 gomez gomez    1026 2009-12-28 09:14 usb.sh
drwx—— 2 gomez gomez    4096 2009-12-28 09:12 video

If that is the case, you can put this USB to your TV, turn it on and you will be prompted to upgrade firmware with firmware version listed on your USB pen. Once you perform this upgrade, you will be able to telnet to your TV. Check your TV IP address from TV menus, and then using Linux shell, or if you are Windows user using Putty, telnet to your TV and enjoy power of your Linux shell. Also, using TV menus and Common Internet File System – CIFS, you can play some music, video or photos on your TV (as described above).

If you are lazy to give a check to this procedure, you can download fully operational USB image on this link. You are doing that on your own risk and author of this blog post is not responsible for any damage that you might cause by some operation.

Enjoy power of Linux shell on your Samsung TV!

For more information please visit following links:

1. SamyGo wiki pages
2. How to enable Telnet on Samsung TV’s
3. Hacking T-RBYDEUC Firmware – LE40A756 and A856