I try to get root access on my Philips PFL9703 TV. Why? don’t ask…

The TV runs a 2.6.18 ker­nel, pnx8535 MIPS32 240MHz CPU, com­piled with a Mon­taVista toolchain.

I need YOUR help to root the Philips TV! Please write a com­ment (end of the arti­cle) or email me if you have any hints, thanks!

RC trig­gered ser­vice modes:
Cus­tomer Ser­vice Mode (CSM): 123654. Insert USB stick, put the remote in DVD mode and press 2679 — this will cre­ate an appli­ca­tion dump of the tv appli­ca­tion file on the USB stick (binary).

Ser­vice Align­ment Mode (SAM): 062596info. I didn’t find a option to enable the ser­ial console!

Ser­vice Default Mode (SDM): 062596menu. Pur­pose: To cre­ate a pre-defined set­ting, to get the same mea­sure­ment results as given in the ser­vice manual.

Man­ual soft­ware upgrade: Dis­con­nect the TV from the AC Power, press + hold the OK but­ton of the RC and con­nect set to mains.

Back-up Soft­ware Upgrade Appli­ca­tion: Dis­con­nect the TV from the AC Power, press + hold the INFO but­ton (or cur­sor down) of the RC and con­nect set to mains.

Jett mode: Dis­con­nect the TV from the AC Power, switch to DVD RC, press + hold the INFO but­ton and con­nect set to mains. Now you TV is in the Jett mode — but we need some files now, which are NOT avail­able! We should cre­ate a direc­tory on the root of the USB drive which is called JETTFILES and put two files called “MemoryTestPNX8635.bin” and “autojett.bin”. Those files are part of a soft­ware pack­age called “TESTSCRIPT Q529”…
I guess in this mode, ser­ial access *could* be pos­si­ble, how­ever the pro­to­col will change, as there is only binary stuff vis­i­ble after the boot­loader tries to load the ker­nel. This could be a side effect of the miss­ing JETTFILES, but I’m not sure. Per­haps some kind of 3 Wire SPI mode? another binary ser­ial mode? See “Ser­ial Port dumps” below.

Philips write about this in the ser­vice manual:

– Install the com­puter pro­gram “BOARDTESTLOGGER” (avail­able in “TESTSCRIPT Q529”) on the PC
– Con­nect a “ComPair/service”-cable from the service-connector in the set to the COM1-port of the PC
– Start-up the pro­gram “BOARDTESTLOGGER” and select “COM1”
– Put the USB stick into the TV and start-up the TV while press­ing the “i+”-button on a Philips DVD RC6 remote con­trol (it’s also pos­si­ble to use a TV remote in “DVD”-mode)
– On the PC the mem­ory test is shown now. This is also
vis­i­ble on the TV screen.
– In “BOARDTESTLOGGER” an option “Send extra UART com­mand” can be found where the “AUD1” can be selected. This com­mand gen­er­ates hear test tones of 200, 400, 1000, 2000, 3000, 5000, 8000 and 12500Hz

Ser­ial Port access
To access the ser­ial port of the TV you need a EIB cable — basi­cally a ser­ial (db9) to stereo jack cable.

This is my pro­fes­sional EIB cable ;)

Ter­mi­nal set­tings: 38400 Baud 8N1.

Web Server:
On port 8080 runs a Web Server, more pre­cisely a Allegro-Software-RomPager/4.61. There is only a test page visible:

1
2
3
4
RomPager
Embed­ded Web Server
First Page
The value of the test vari­able is: Hello World!

Some basic tests:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
bash-3.2$ perl –e ‘print “GET / HTTP/1.1rnHost: ’”192.168.111.16″‘rnAuthenticate: ” . ‘A’ x 1024 . “rnrn“‘ | nc “192.168.111.16″ 8080
HTTP/1.1 400 Bad Request
Content-Length: 0
Server: Allegro-Software-RomPager/4.61
Con­nec­tion: close

bash-3.2$ perl –e ‘print “GET / HTTP/1.1rnHost: ’”192.168.111.16″‘rnrn“‘ | nc “192.168.111.16″ 8080
HTTP/1.1 200 OK
Content-Type: text/html
Date: Sat, 01 Jan 2000 02:05:41 GMT
Cache-Control: no-cache
Expires: Thu, 26 Oct 1995 00:00:00 GMT
Transfer-Encoding: chun­ked
Server: Allegro-Software-RomPager/4.61

I didn’t find and vulnerability/information about this webserver…

Firmware:
Get the firmware here http://philips.samipupu.com/9x03.html. The firmware is encrypted, with some help from the www.hifi-forum.de thread, I was more or less able to get the firmware header (first 732 bytes of the firmware):

1
2
3
4
5
6
7
8
9
10
11
12
13
struct philips_header {
  uint32_t magic;         /* “2SWU” */
  uint32_t magic1;        /* “3TXV” — magic[i] + 1 */
  uint32_t header_size;   /* 732 bytes */
  uint32_t data_size;     /* image size with­out header */
  uint32_t crc;           /* dif­fer from release to release */
  uint32_t unknown;       /* data: 00 00 00 60, unknown, indus­trial mode enabled/disabled? */
  uint32_t padding1;      /* data: 00 00 00 00 */
  uint32_t padding2;      /* data: 00 00 00 00 */
  char[512] descrip­tion;  /* release ver­sion */
  char[160] sig­na­ture
  char[28] releaseStr     /* Q591E-0.100.0.0_commercial */
};

Those 160 bytes in the firmware header is quite inter­est­ing… This block is dif­fer­ent in each firmware ver­sion! Some­one in the hifi-forum wrote, that the firmware is encrypted AND signed, but this is uncon­firmed!
Edit 13.2.09: The Firmware is encrypted AND signed, see com­ment #14!

Other users observed, that there are quite a lot of repeat­ing pat­terns in the firmware. An inter­est­ing idea is to search for JFFS2 inodes magic bytes (85h 19h). Varon thinks, that the firmware (or parts of it) are encrypted with a 128b key, but the crypto algo­rithm is unknown.

Here is a hex­dump of the firmware header:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
00000000  32 53 57 55 33 54 58 56  dc 02 00 00 38 b1 b6 01  |2SWU3TXV.…8…|
00000010  a9 67 50 62 00 00 00 60  00 00 00 00 00 00 00 00  |.gPb…‘.….…|
00000020  52 65 6c 65 61 73 65 20  66 6f 72 20 54 56 35 32  |Release for TV52|
00000030  30 20 52 32 3a 0d 51 35  39 31 45 2d 30 2e 31 30  |0 R2:.Q591E-0.10|
00000040  30 2e 30 2e 30 0d 0d 47  65 6e 65 72 61 74 69 6f  |0.0.0..Generatio|
00000050  6e 20 64 61 74 65 3a 0d  34 2f 31 32 2f 32 30 30  |n date:.4/12/200|
00000060  39 20 31 30 3a 33 31 3a  32 32 0d 00 00 00 00 00  |9 10:31:22.…..|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |.….….….…|
*
00000220  9f f0 5a c2 4a 49 4c 18  11 1f 4f 9f 89 d6 b9 87  |..Z.JIL…O.….|
00000230  7f 2f a9 98 fb 10 8e 81  7d fb 05 48 c4 62 8d f6  |./.…..}..H.b..|
00000240  ab 62 f7 1b 0a 80 7d b2  fb fc 89 6d 3b 65 70 4d  |.b.…}.…m;epM|
00000250  22 10 81 f9 4d 5b 46 29  e8 96 92 dd a0 3b a9 21  |”…M[F).….;.!|
00000260  ca 0b d5 b4 4a a1 64 41  97 62 e4 00 56 9e 74 15  |.…J.dA.b..V.t.|
00000270  71 4a 6b 09 b5 07 05 bc  8f 0f 7a 15 4e ff 2b 67  |qJk.……z.N.+g|
00000280  1f b0 26 bc 37 7e 8d 7a  81 a9 25 f9 1f e2 90 cd  |..&.7~.z..%.….|
00000290  99 9a 17 d1 d6 dc 89 19  df 70 4c 9c a4 37 ef 1a  |.….….pL..7..|
000002a0  1b 08 06 6e ff 1f ba a9  89 10 76 ff 22 b2 8a 14  |…n.…..v.”…|
000002b0  2f e3 2c d6 39 1c bc af  4b 49 4d ff 9c d7 60 c9  |/.,.9…KIM…‘.|
000002c0  51 35 39 31 45 2d 30 2e  31 30 30 2e 30 2e 30 5f  |Q591E-0.100.0.0_|
000002d0  63 6f 6d 6d 65 72 63 69  61 6c 00 00              |commercial..|

I checked the firmware with draca:

1
2
3
4
5
6
7
8
9
10
c:tmpdraca>draca ..autorun.upg
DRACA. Draft Crypto Ana­lyzer. Ver­sion 0.5.7b by Ilya O. Levin
Pre­lim­i­nary detec­tion and analy­sis of crypto algo­rithms within exe­cuta­bles.
File: .. autorun.upg, 28750144 byte(s)
ana­lyz­ing… done
results:
* AES/Rijndael — 9%
* Twofish — 17%

total 2 algorithm(s) recognized

Edit 13.2.09: I guess those results are use­less because draca is search­ing for crypto con­stants in the firmware — which do sim­ply not exist there.

Philips also released source code of the parts of Philips TV soft­ware that fall under open source licenses.

Here is the firmware lay­out (in the flash, not the upgrade file):

Attack Vec­tors:
1) decode firmware, mod­ify and repack
2) jett mode and test­files, ser­ial access *could* be pos­si­ble
3) ker­nel gdb on ttyS1
4) find a secret key combo to acti­vate the ter­mi­nal (aka deac­ti­vate philps indus­trial mode)

Use­ful links:
Gen­eral Infor­ma­tion:
http://www.hifi-forum.de/viewthread-152‑1851.html
http://samygo.sourceforge.net/
http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n//

Firmware Mir­ror:
http://philips.samipupu.com/

Jointspace Project:
jointspace project

Ser­vice Man­u­als:
http://www.scribd.com/doc/23986104/Philips-Ch-q529-1e-Lb
http://www.ayslearningcentre.philips.com/userfiles/Training%20Material/TV/tv522-training%20booklet%20for%20printing%20.pdf

Ser­ial Port dumps:
Jett mode:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
retail Jan 16 2008 12:03:04
Boot deviceST NAND512W3A
BFFS init
OK

Search­ing BootLoader.tdfLoad  /bffs0/BootLoader.tdf– Done
Start /bffs0/BootLoader.tdf

JBL (boot­time improve­ment

Boot­Loader OS_R0.7.2assert Feb 25 2008 12:49:28Searching boot.bat
Exe­cute /bffs2/boot.bat from label [14]
unknown com­mand, line 302
Exe­cute /bffs1/boot.bat from label [14]
* SR5->Fact JETT
* On error goto 70
* Load /bffs1/Kernel.tdf — ok
* Load /bffs1/RFSBoot1.tdf — ok
* Mem­Fill 0x87fff000 0x1000 0xff
* Sig­nal 30
* Cmd Line
CMD_LINE argu­ments passed by JBL :  console=ttyS1,38400n8 mem=16M kgdb=ttyS1 loglevel=3 init=/init ip=none root=/dev/ram lpj=1196032 rd_start=0x80500000 rd_size=1814528* Start /bffs1/Kernel.tdf (binary garbage here)

TV Boot:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
retail Jan 16 2008 12:03:04
Boot deviceST NAND512W3A
BFFS init
OK

Search­ing BootLoader.tdfLoad  /bffs0/BootLoader.tdf– Done
Start /bffs0/BootLoader.tdf

JBL (boot­time improve­ment

Boot­Loader OS_R0.7.2assert Feb 25 2008 12:49:28Searching boot.bat
Exe­cute /bffs2/boot.bat from label [1]
* SR1->Coldboot
* On error goto 60
* Load /bffs2/atvTm0App.tdf — ok
* Load /bffs3/tmpvbPnx51xxApp.tdf — ok
* Load /bffs2/cdDownloadTM0.tdf — ok

* Start­ing earlyStartTM* Load /bffs3/tmvprPnx51xxCoApp_tm2.tdf — ok
* Load /bffs3/tmvprPnx51xxCoApp_tm3.tdf — ok
* Load /bffs2/Kernel.tdf — ok
* Mem­Fill 0x87fff000 0x1000 0xff
* Sig­nal 30
* Cmd Line
CMD_LINE argu­ments passed by JBL :  console=ttyS0,38400n8 mem=48M kgdb=ttyS1 loglevel=3 root=/dev/mtdblock5 lpj=1196032 init=/init ip=none jffs2_gc_delay=30
* Start /bffs2/Kernel.tdf“htv520EU/92 startup script …“
“Mount­ing file sys­tems“
Total user­time mount for   /proc: 0,000000 [Sec]
Total sys­tem­time mount for /proc: 0,000000 [Sec]
Total user­time mount for   /sys: 0,000000 [Sec]
Total sys­tem­time mount for /sys: 0,000000 [Sec]
Total user­time mount for   /dev/shm: 0,000000 [Sec]
Total sys­tem­time mount for /dev/shm: 0,000000 [Sec]
Total user­time mount for   /dev/pts: 0,000000 [Sec]
Total sys­tem­time mount for /dev/pts: 0,000000 [Sec]
“Mount­ing the flash file sys­tems“
Total user­time mount for   /mnt/jffs0: 0,000000 [Sec]
Total sys­tem­time mount for /mnt/jffs0: 0,100000 [Sec]
“Load­ing PNX5100 Image“
“Launch­ing TV appli­ca­tion“
Using errlib ver­sion 0.9
Errlib com­mu­ni­ca­tion with plfapp failed, will retry later
redi­rect­ing 1 to 14
00 002.467 128MB mem­ory on board
00 002.467 128MB mem­ory MAP
00 002.467 check­ing hot­boot: NO
00 002.467 Standby ver­sion 35.x.1.13
00 002.467 Expected standby ver­sion 36.x.0.0 (or higher), please update your standby image
00 002.467 start_Init clear­ing m_InitDoneBlunk
00 002.467 Using errlib ver­sion 0.9
00 002.467 Errlib 0.9 reg­is­tered from process 118
00 002.467 2402 — Ref­er­ence time­stamp
00 002.467 mounted:
00 002.467 Mount check passes,  0 iter­a­tions
–1 002.589 (*) FusionDale/Config: Pars­ing con­fig file ‘/etc/fusiondalerc’.
–1 002.589      *————–) Fusion­Dale v0.1.1 (————–*
–1 002.589                 © 2006–2007  directfb.org
–1 002.589        ———————————————–
–1 002.589 (*) Fusion/SHM: NOT using MADV_REMOVE (2.6.18.0 < 2.6.19.2)! [0x02061200]
–1 002.589 (*) Direct/Thread: Run­ning ‘Fusion Dis­patch’ (MESSAGING, 119)…
–1 002.599 redi­rect­ing 2 to 12
–1 002.599 start­ing :  /philips/apps/ceplfapp
–1 002.599 amApp : Init­Fu­sion­Dale
–1 002.599 Errlib com­mu­ni­ca­tion with plfapp failed, will retry later
00 002.694  /mnt/jffs0/rupg/tvplf/cetv/display foundEr­rlib 0.9 reg­is­tered from process 116
00 002.694  - Lay­outcheck OK
00 002.694  Dis­play flash file : Lay­out ver­sion = 8 ; Con­tent ver­sion = 28
00 002.694  Dis­play flash file : Project Id = 1 ; Branch Id = 58
00 002.694  ver­sion string:     DISPT_001.058.008.028
00 002.750      *————–) Fusion­Dale v0.1.1 (————–*
00 002.750                 © 2006–2007  directfb.org
00 002.750        ———————————————–
00 002.858  Using screen option 143, name LCD LGD WUF SAC1 42“Diversity: BoardType=/92, BoardVersion=3, Detected pnx8535 version=M2
00 002.858 Ambi­ent­Light­Gen­er­a­tor       : None
00 002.858 Ambi­ent­Light­Mode            : Triple
00 002.858 Ambi­ent­Light­Tech­nol­ogy      : Led
00 002.858 Cab­i­net­Num­ber               : 3
00 002.858 Chan­nelDe­coder­Type          : Tda10048
00 002.858 ChannelDecoder2Type         : None
00 002.858 ClearL­cd­Sup­ported           : False
00 002.858 Dim­ming­Back­light­Sup­ported   : True
00 002.858 Dis­play­De­lay­Compen­sa­tion    : 36 — 190
00 002.858 Dis­playRawNum­ber            : 143
00 002.858 Dvb­Hd­Sup­ported              : False
00 002.858 Epld­P­re­sent                 : True
00 002.858 HDMIMux­P­re­sent              : Mux4
00 002.858 HDMISide­P­re­sent             : True
00 002.858 IfDemVer­sion                : V2
00 002.858 Light­Sen­sor                 : Present
00 002.858 Light­Sen­sorType             : Aura
00 002.858 Sti7100Present              : False
00 002.858 Paci­ficP­re­sent              : False
00 002.858 Region                      : Europe
00 002.858 Pnx5050Present              : False
00 002.858 Pnx5100Present              : True
00 002.858 SawVer­sion                  : New
00 002.858 IF Mode (DVB-C)             : Direct IF
00 002.858 TunerI2cConfig              : ViaChan­nelDe­coder
00 002.858 Tuner­Type                   : 25 (PhilTd1716F)
–1 002.977 amApp: Plat­form returned wakeup rea­son [src: 0, sys: 0, cmd: 4]
–1 003.139 start­ing :  /philips/apps/tveu 5 4 0
00 003.172  RU Flash file not found in /mnt/jffs0/rupg/tvplf/tv520avi/cabinet3
00 003.172  RO Flash file not found in /mnt/jffs0/ro/tvplf/tv520avi/cabinet3
00 003.172  Local flash file not found in file/cabinet3
00 003.172  RU Flash file found in /mnt/jffs0/rupg/tvplf/tv520avi/cabinet
00 003.172  Cab­i­net flash file : Lay­out ver­sion = 4 ; Con­tent ver­sion = 8
00 003.172  Cab­i­net flash file : Project Id = 1 ; Branch Id = 0
00 003.172  ver­sion string:     ACSTS_001.000.004.008
–1 003.279 amApp : Init­Di­rectFB
–1 003.279 Grab­bing key­board
–1 003.279 Ungrab­bing key­board
–1 003.279 amApp : Init­SaW­Man
–1 003.279 App­Man: Process added (118) [1]!
–1 003.279 App­Man: Process added (116) [2]!
–1 003.279 App­Man: Win­dow added (0,0-1x1) [1] — 1!
00 003.444  Using cab­i­net option 3, name VE8 A_NormalBass
00 003.444  /mnt/jffs0/rupg/tvplf/cetv/pqprivate found
00 003.444  PQ pri­vate flash file : Lay­out ver­sion = 8 ; Con­tent ver­sion = 9
00 003.444  PQ pri­vate flash file : Project Id = 1 ; Branch Id = 0
00 003.444  ver­sion string:     PRFPV_001.000.008.009********************** ipow_Init 1 0
00 003.444  /mnt/jffs0/rupg/tvplf/cetv/ambientlight found
00 003.444  Ambi­ent­light flash file : Lay­out ver­sion = 3 ; Con­tent ver­sion = 12
00 003.444  Ambi­ent­light flash file : Project Id = 1 ; Branch Id = 0
00 003.489  ver­sion string:     PRFAM_001.000.003.012i5100pow_Init
00 003.528
00 003.528  /mnt/jffs0/rupg/tvplf/cetv/pqpublic found
00 003.528  PQ pub­lic flash file : Lay­out ver­sion = 4 ; Con­tent ver­sion = 11
00 003.528  PQ pub­lic flash file : Project Id = 1 ; Branch Id = 0
00 003.550  ver­sion string:     PRFPB_001.000.004.011plfdmx_mdmx: DEBUG_ERROR_PRINT enabled
00 003.573 Plat­form Appli­ca­tion from Dec  4 2009 10:29:04,
00 003.573  built on PC: BEQBRGBRG1TSS15 by user: beq00908
00 003.573  CCM_build_id:
00 003.573 Startup m_InitDoneBlunk: 0,   m_InitDoneMain: 1
–1 003.597 Called icplfapisetup_pow_SetTvPower( 3 )
00 003.894 Check TM down­load idrv_DspReady_Ready
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.972 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.994 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.994 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.994 Cre­ate Thread with pri­or­ity 70 (=45)
00 003.994 Cre­ate Thread with pri­or­ity 70 (=45)
00 004.012 Cre­ate Thread with pri­or­ity 70 (=45)
00 004.020 PNX5100: Using PCI com­mu­ni­ca­tion for all i2c write mess­sages!!
00 004.023 PNX5100: Input Wdw: 1944 1104 Out­put Freq: 100
00 004.025 PNX5100: Input Wdw: 1944 1104 Out­put Freq: 120
00 004.028 PNX5100: Hard­ware Id [5100hwid]
00 004.030          Soft­ware Id [20081111]
00 004.032          Boot­Nvm Id [   8]
00 004.035 5100 Drv Get­Boot­sta­tus via PCI : 0
01 004.069 tvApp : entered main.…
00 004.077 TM down­load OK
01 004.079 amApp is pass­ing 4 argu­ments
01 004.082 tvApp : Param 1 = 5 Param 2 = 4
01 004.085  Tvmain: start_Init called
00 004.119 5100 Drv Get­Boot­sta­tus via PCI : 0
00 004.138 Firmware ver­sion 5.1 for TDA10048 suc­ces­fully down­loaded
01 004.141 Using errlib ver­sion 0.9
00 004.152 Errlib 0.9 reg­is­tered from process 164
01 004.193 (*) FusionDale/Config: Pars­ing con­fig file ‘/etc/fusiondalerc’.
00 004.197 5100 Drv Get­Boot­sta­tus via PCI : 2
00 004.199 PNX5100&amp;&amp;&amp;&amp;&amp;&amp; Boot­sta­tus on 2 after 2 retries
01 004.212      *————–) Fusion­Dale v0.1.1 (————–*
01 004.212                 © 2006–2007  directfb.org
01 004.212        ———————————————–
01 004.220 (*) Fusion/SHM: NOT using MADV_REMOVE (2.6.18.0 < 2.6.19.2)! [0x02061200]
01 004.239 (*) Direct/Thread: Run­ning ‘Fusion Dis­patch’ (MESSAGING, 184)…
00 004.319 i5100pow_TurnOn
00 004.324 phatvEngine5100Proxy__pow_TurnOn using udma dri­ver for autotv !!gOemRegTbl:0x3658C0
00 004.378 cetvbend_mpowon: iambl_SetState onoff = 0
00 004.523 cetvbend_mpowon: powon_TurnOn
–1 004.559 App­Man: Process added (164) [3]!
–1 004.630 icplfapisetup_powN_OnTvPowerChanged for state 3
01 004.788 svspow_m.c:2922::Start Init of svspow called.MsecSinceInit: 1791999667
01 004.794 svspow_m.c:2265::Wakeup Rea­son is RCX
01 004.819 svspow_m.c:2954::Quick Turn On Ini­ti­ated
01 004.819 svspow_m.c:1380::Double call in Ini­tialis­eSoft­ware
–1 004.947 App­Man: Win­dow added (100,100-480x300) [2] — 0!
–1 004.947 Bor­der win­dow attached
–1 004.947 App­Man: Switch focus to 0x5132da00 [2]
–1 004.947 App­Man: Win­dow added (100,100-480x300) [3] — 1!
–1 004.947 Audio node attached
–1 004.957 amApp: Enabling key­board
–1 004.959 amApp: dst setup called for 2
–1 004.966 amApp: Enabling key­board
–1 004.969 amApp: dst setup called for 3
01 005.149 FUNCTION:hsveuins__impow_Init, LINE:219, InsStatus.Medium:255
01 005.165 MAINVIDEOWINDOW=2,sizeof(NoClearData):8,retval:0,retval1:0
01 005.332 svspow_m.c:1526::All Sub­sys­tems inited
00 005.335 cetvbend_mpowon: cetvambi_ambilight_Disable
01 005.379 mlock patch inited
01 005.410 svspow_m.c:3193::keywkp2n:Req pow = ON
–1 005.413 HK_REQUEST_PS received for 5
01 005.417 GCK****************Hot key received by tvApp
01 005.417 svspow_m.c:4711::HK_PREPARE_PS received for cmd = 5
01 005.417 GCK******************Hot key pre­pare PS received by psc
01 005.417 svspow_m.c:4055::powctl_SetPowerMode to PscPowOn
–1 005.424 Send­ing HK_PREPARE_PS to appli­ca­tion index 1, win­dow 0x5132da00
01 005.426 svspow_m.c:2854::REQUEST_PS for cmd: 5
01 005.458 svspow_m.c:1575::Reached SW Turn On 1
01 005.473 svspow_m.c:1634::Reached HandleTurnOn1Event with Event = 16
01 005.475 svspow_m.c:1634::Reached HandleTurnOn1Event with Event = 1
00 005.547 vpcecps__cecc2_SetOSDName len = 7
00 005.554 vpcecps__cecc2_SetDeviceVendorID len = 8
01 005.571 RB Ana­log file name /mnt/jffs0/boot/tv/hysvc/HsvAntennaAnalogTable
01 005.573 RB Digts file name /mnt/jffs0/boot/tv/hysvc/HsvAntennaDigPtcTable
01 005.575 RB digsrvc file name /mnt/jffs0/boot/tv/hysvc/HsvAntennaDigSrvcTable
01 005.577 Fre­quec­nyMap file name /mnt/jffs0/boot/tv/hysvc/HsvAntennaFreqMapTable
01 005.708 Ana­log file::IsImmediateFlashUpdateReqd set to:0
01 005.710 RB Ana­log file open Sucess­full
01 005.712 Proceed1:1
01 005.714 gen­er­at­ing dig tables
01 005.723 ANTENNA_FLASH_ANALOG_TABLE: records:36
01 005.725 RB Ana­log file closed
01 005.727 Cur­ren­tONID = 8948
01 005.730 euins_m:Medium from NVM = 0
01 005.732 Mohanan : Unable to open /mnt/jffs0/boot/tv/hysvc/HsvNITFreqListFile
01 005.748 Mohanan : Unable to open NIT­Fre­qList fileEPG: sysset_GetInstallCountry = 24
01 005.758 svspow_m.c:3586::cesvc powntf received for Ssby
01 005.760 svspow_m.c:1634::Reached HandleTurnOn1Event with Event = 2
01 005.782 svspow_m.c:750::Set has reached Semi­sby state
00 005.785 cetvbend_mpowon: iambl_SetState onoff = 0
01 005.820 svspow_m.c:1718::Reached SW Turn On 2
00 005.887 FUNCID_CEC_ONTRANSMITCOMPLETED
00 005.920 cetvbend_mpowon: iambl_SetState onoff = 0
01 005.998 cbmhgpow_mpow: selrqd_IsProgSelReqd = TRUE
01 006.002 <5>     6002 ZAP_BEGIN — Select­Pro­gram
01 006.004 svspow_m.c:953::First Pre­set Seln made at 1792000884
01 006.178  svbas pgselN_OnProgramChangeRequested
01 006.180 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 1
01 006.310 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 16
00 006.317 FUNCID_CEC_ONTRANSMITCOMPLETED
01 006.338 svspow_m.c:3634::cesvc powntf received for ON
01 006.340 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 2
01 006.713  hsvprins: hsvprins__feapiN_OnStationFound
01 006.839 svspow_m.c:4595::First pgsel com­pleted at 1792001718
01 006.843  svbas pgselN_OnProgramChangeCompleted
00 006.860 5100 Drv Get­Boot­sta­tus via PCI : 2
00 006.863 cetvbend_mpowon: cetvdisplay_preheatN_OnEvent
00 006.865 cetvbend_mpowon: UpdateAm­bi­ent­Light => cetvambi_ambl_SetState
00 006.986  m_FieldFreq = 50
00 006.988 Send DVP ValidSig­nal (576, 720, 50, 0, 0)
01 007.106 svspow_m.c:4759::Detected Mute = FALSE in vmtN
01 007.111 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 2048
01 007.113 RFS not found in envi­ron­ment
01 007.117 <5>     7116 ZAP_END — UnBlank
01 007.127  RFS not found in envi­ron­ment
01 007.129 FLASH sys­tem, mount request for par­ti­tion 2 accepted
01 007.940 svspow_m.c:4766::flashopN_OnPartitionMounted::partitionid:2
01 007.961 svspow_m.c:4778::Sent flashopN_OnPartitionMounted::MOUNT_ON_EVENT hsvprins: hsvprins__feapiN_OnMeasReady
00 007.967 cetvbend_mpowon: cetvambi_ambilight_Disable
01 007.976  hsvprins: hsvprins__feapiN_OnMeasReady
00 008.013 mounted:
00 008.013 Mount check passes,  44 iter­a­tions
00 008.013 pffsN_OnMounted sets m_InitDoneBlunk to true
00 008.013 Startup m_InitDoneBlunk: 1,   m_InitDoneMain: 1
01 008.180 svspow_m.c:1872::gfx set­power ON
01 008.187 svspow_m.c:1875::gfx powntf for ON
01 008.189 cbmhgpow_mpow: Set­Power to ON
01 008.192 cbmhgpow_mpow: Turn­ing On
01 008.221 cbmhgpow_mpow: OnPow­er­Changed
01 008.228 svspow_m.c:3428::cbmhg powntf received for ON
01 008.231 svspow_m.c:1913::cbmhg set­power On
01 008.377 svspow_m.c:1926::JUICE set­power On
01 008.393 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 16
01 008.399 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 256
–1 008.412 App­Man: Win­dow added (0,0-852x480) [4] — 2!
01 008.418 Sur­face 0, PlaneId 2 in Attach­Sur­face
00 008.793 argv[0] is /philips/bin/networkhelper
00 008.793 udhcpc gave me decon­fig
00 008.793 Han­dleUd­hcpc­No­tif : msgq is 32769
00 009.941 argv[0] is /philips/bin/networkhelper
00 009.941 udhcpc gave me bound
00 009.941 udhcpc gave me bound
00 009.941 IP address is 192.168.111.16
00 009.941 sub­net mask is 255.255.255.0
00 009.941 $router is 192.168.111.1
00 009.941 First Gate­way is 192.168.111.1
00 009.941 $dns is 62.2.24.162 62.2.17.61 62.2.24.158
00 009.941 DNS1 is 62.2.24.162
00 009.941 DNS2 is 62.2.17.61
00 009.941 Inter­face is eth0
00 009.941 Han­dleUd­hcpc­No­tif : msgq is 32769
00 010.050 route: SIOC[ADD|DEL]RT: No such process
01 010.316 svspow_m.c:3497::juice powntf received for ON
–1 010.343 App­Man: Win­dow con­fig — unhid­ing win­dow
–1 010.343 Relay­out of win­dow 4
–1 010.356 App­Man: Switch focus to 0x5132d600 [4]
01 010.369 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 512
01 010.376 svspow_m.c:1943::ceapps set­power On
00 010.415  (!!!)  *** WARNING [color key­ing does not work on UPPER layer] *** [Philips/DirectFB/systems/cetvfb/primary.c:202 in get_color_minmax()]
01 010.568 Ceapps : Timer for CB BreakIn Time­out Started
01 010.651 svspow_m.c:3479::apps powntf received for ON
01 010.688 svspow_m.c:1803::Reached HandleTurnOn2Event with Event = 1024
01 010.729 svspow_m.c:693::Set Reached on state at 1792005608
01 010.729 svspow_m.c:755::Set has reached ON state
01 010.729 InitCe­htv­Data done
01 011.054  hsvprins: hsvprins__feapiN_OnAfcFreqChanged
01 011.074 Read­Ce­htv­Data Con­fig­u­ra­tion file /bffs1/product.xml could not be read
01 011.081 Read­Ce­htv­Data done, Con­figOK: FALSE
00 011.139 cetvbend_mpowon: iambl_SetState onoff = 1
00 011.142 cetvbend_mpowon: iambl_SetState onoff => cetvambi_ambl_SetState
00 011.148 cetvbend_mpowon: cetvambi_ambilight_Enable
–1 011.259 HK_PREPARE_PS_DONE received for cmd: 5, src: 1
–1 011.259 Remain­ing Pow­er­ChangeBitmap: 0
–1 011.259 start­ing :  /philips/apps/spettApp
–1 011.259 start­ing :  /philips/apps/media
01 011.273 svspow_m.c:2871::PREPARE_PS_DONE for cmd: 5
02 011.500      *————–) Fusion­Dale v0.1.1 (————–*
02 011.500                 © 2006–2007  directfb.org
02 011.500        ———————————————–
02 011.511 Using errlib ver­sion 0.9
02 011.511 ***SPETT*** Fusion­Dale Init done
02 011.511 ***SPETT*** Win­dows cre­ated
00 011.516 Errlib 0.9 reg­is­tered from process 222
00 011.516 *** DirectFB Sur­face allo­ca­tion FALLBACK! Acquir­ing id 6 with size 376320
–1 011.520 App­Man: Process added (222) [4]!
–1 011.520 App­Man: Win­dow added (0,0-800x600) [5] — 0!
–1 011.520 Bor­der win­dow attached
–1 011.520 App­Man: Win­dow added (100,100-672x280) [6] — 2!
–1 011.520 App­Man: Win­dow con­fig — unhid­ing win­dow
–1 011.520 App­Man: Switch focus to 0x5132d200 [6]
02 011.535 Event class:  DFEC_WINDOW
00 011.579 FUNCID_CEC_ONTRANSMITCOMPLETED
03 011.896  Medi­aApp: Ini­tal­ized and run­ning
00 011.898 FUNCID_CEC_ONTRANSMITCOMPLETED
03 011.978 (*) FusionDale/Config: Pars­ing con­fig file ‘/etc/fusiondalerc’.
03 011.978      *————–) Fusion­Dale v0.1.1 (————–*
03 011.978                 © 2006–2007  directfb.org
03 011.978        ———————————————–
03 011.978 (*) Fusion/SHM: NOT using MADV_REMOVE (2.6.18.0 < 2.6.19.2)! [0x02061200]
03 011.978 (*) Direct/Thread: Run­ning ‘Fusion Dis­patch’ (MESSAGING, 240)…
03 012.007  Using errlib ver­sion 0.9
03 012.007 Medi­aApp: Call back Init  from gplib
00 012.012 Errlib 0.9 reg­is­tered from process 223
00 012.041 FUNCID_CEC_ONTRANSMITCOMPLETED
02 012.088 ***SPETT*** All inits done
02 012.093 ***SPETT*** gpilib.startr.Init done
03 012.215 arunkp: mplfabsav2_m.c: 209: mplfabsav2__pow_Init:
–1 012.315 App­Man: Process added (223) [5]!
03 012.349 Medi­aApp: Gfx Init done
03 012.575 medi­aApp: fusion­dale Init, reg­is­ter called
03 012.575 mlock patch inited
–1 012.579 App­Man: Win­dow added (100,100-480x300) [7] — 0!
–1 012.579 Bor­der win­dow attached
–1 012.579 App­Man: Switch focus to 0x51334000 [7]
–1 012.579 App­Man: Win­dow added (100,100-480x300) [8] — 1!
–1 012.579 Audio node attached
–1 012.597 App­Man: Switch focus to 0x51334000 [7]
03 012.637 Net­work enabled and avail­able —  enabling alle­gro
03 012.639 allegroenb_Enable
03 012.974 The address is: 192.168.111.16
03 012.978 arunkp: mplfabsav2_m.c: 219: mplfabsav2__pow_TurnOn:
–1 013.088 App­Man: Win­dow added (0,0-852x480) [9] — 2!
00 013.097 *** DirectFB Sur­face allo­ca­tion FALLBACK! Acquir­ing id 0 with size 410880
03 013.101 Sur­face 0, PlaneId 2 in Attach­Sur­face
00 013.117  (!!!)  *** WARNING [color key­ing does not work on UPPER layer] *** [Philips/DirectFB/systems/cetvfb/primary.c:202 in get_color_minmax()]
03 013.239 Infra­struc­ture Resource Gained by medi­aApp
03 013.242 (resourcechanged &amp;&amp; !(Resource­Owned &amp; FULL_STATE) : Set­ting mappstate_mediaIdle
–1 013.292 App­Man: Win­dow con­fig — unhid­ing win­dow
03 013.363 Cen­sus Found device uuid: 898f9738-d930-4db4-a3cf-000934278452
03 013.367  Device­Type: schemas-upnp-org:device:MediaServer:1
00 013.458 ***GVC: T2 — ceisusb_m.c (951): “usbdevspN_OnDeviceError( Device­Un­know­nAt­tached­Er­ror, –1 )” noti­fi­ca­tion given
03 013.699 Deepak sta­tus = 0
03 013.701 Adding new device to list
03 013.708 McSub­scribe returned 0
00 014.473 ***GVC: T2 — ceisusb_m.c (951): “usbdevspN_OnDeviceError( Device­Un­know­nAt­tached­Er­ror, –1 )” noti­fi­ca­tion given
01 019.016 <5>    19014 ZAP_BEGIN — Select­Pro­gram
01 019.087  svbas pgselN_OnProgramChangeRequested
01 019.602  hsvprins: hsvprins__feapiN_OnStationFound
01 019.621  svbas pgselN_OnProgramChangeCompleted
00 019.870  m_FieldFreq = 50
00 019.872 Send DVP ValidSig­nal (576, 720, 50, 0, 0)
01 019.947 <5>    19945 ZAP_END — UnBlank
01 020.413   hsvprins: hsvprins__feapiN_OnMeasReady
01 020.420  hsvprins: hsvprins__feapiN_OnMeasReady
–1 020.429 For­ward­ing event to /philips/apps/tveu
–1 020.727 For­ward­ing event to /philips/apps/tveu
–1 020.727 For­ward­ing event to /philips/apps/tveu
–1 020.974 For­ward­ing event to /philips/apps/tveu
–1 020.974 For­ward­ing event to /philips/apps/tveu
–1 021.210 For­ward­ing event to /philips/apps/tveu
–1 021.210 For­ward­ing event to /philips/apps/tveu
–1 021.425 For­ward­ing event to /philips/apps/tveu
–1 021.425 For­ward­ing event to /philips/apps/tveu
–1 021.650 For­ward­ing event to /philips/apps/tveu
–1 021.650 For­ward­ing event to /philips/apps/tveu
–1 021.914 For­ward­ing event to /philips/apps/tveu
–1 022.827 For­ward­ing event to /philips/apps/tveu
–1 023.086 For­ward­ing event to /philips/apps/tveu
00 024.139 — pass 0 —
00 024.142 freeMem    :    27212
00 024.144 pgma­j­fault :        0
00 024.146 sec­torsread:    11426

Force Firmware update:
In case the down­load appli­ca­tion has been started man­u­ally, the “autorun.upg” will maybe not be rec­og­nized. What to do in this case:
1. Cre­ate a direc­tory “UPGRADES” on the USB stick.
2. Rename the “autorun.upg” to some­thing else, e.g. to “software.upg”. Do not use long or com­pli­cated names, keep it sim­ple. Make sure that “AUTORUN.UPG” is no longer present in the root of the USB stick.
3. Copy the renamed “upg” file into this directory.

Firmware update log:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
“Launch­ing SW Down­load Appli­ca­tion From Boot2“
check­ing hot­boot: NO
Standby ver­sion 35.x.1.13

Expected standby ver­sion 36.x.0.0 (or higher), please update your standby image

start_Init clear­ing m_InitDoneBlunk
Using errlib ver­sion 0.9
Errlib 0.9 reg­is­tered from process 135
13387 — Ref­er­eRW par­ti­tion: 4
mount­ing par­ti­tion 4 to jffs2 file sys­tem passed

RW par­ti­tion: 5
mount­ing par­ti­tion 5 to jffs2 file sys­tem passed

mounted:
Mount check passes,  0 iter­a­tions
mounted:
Mount check passes,  0 iter­a­tions
pffsN_OnMounted sets m_InitDoneBlunk to true
InitCe­htv­Data done
Read­Ce­htv­Data Con­fig­u­ra­tion file /bffs1/product.xml does not exist
Read­Ce­htv­Data done, Con­figOK: FALSE
Could allo­cate 36701184.

Startup m_InitDoneBlunk: 1,   m_InitDoneMain: 1

/mnt/jffs0/rupg/tvplf/cetv/display found — Lay­outcheck OK
Dis­play flash file : Lay­out ver­sion = 8 ; Con­tent ver­sion = 28
Dis­play flash file : Project Id = 1 ; Branch Id = 58
ver­sion string:     DISPT_001.058.008.028
Using screen option 143, name LCD LGD WUF SAC1 42″

MMIO address obtained from pnx5xxx drv = 0x28000000

redi­rect­ing 1 to 22
00 015.088 redi­rect­ing 2 to 23
00 015.091 ***GVC: T2 — ceisusb_m.c (951): “usbdevspN_OnDeviceError( Device­Un­know­nAt­tached­Er­ror, –1 )” noti­fi­ca­tion given
00 015.093 ***GVC: T2 — ceisusb_m.c (951): “usbdevspN_OnDeviceError( Device­Un­know­nAt­tached­Er­ror, –1 )” noti­fi­ca­tion given
00 015.095 ***GVC: T2 — ceisusb_m.c (817): “usbdevspN_OnPhysicalDeviceConnected( 0 )” noti­fi­ca­tion given…
00 015.270 startr_init
00 015.270 Startup m_InitDoneBlunk: 1,   m_InitDoneMain: 1
00 015.372 gfx­ptr: 2de8d000
00 015.372 mal­loc 776527880
00 015.378 S18,0,Q591E_0.100.0.0
00 015.430 Go!!!!!!!
00 018.092 ***GVC: T2 — ceisusb_m.c (1199): “usbdevspN_OnNewDevice( 0 )” noti­fi­ca­tion given.
00 018.242 ***GVC: T2 — ceisusb_m.c (1408): “usbdevspN_OnDriveMounted( 0 )” noti­fi­ca­tion given
00 018.244 OnDrive­Mounted : 0
00 018.247 ceapps OnUp­grade­sChanged : 2
00 018.281 Amount of upgs on usb 1
00 018.645 1 upgs found on USB. Press right to enter the list.
00 018.645 sw   <—    Upgrade now
00 018.645  Soft­ware is equal or older,
00 018.645   — press OK to stop
00 018.645       - press down + OK to con­tinue
00 052.837 L: 0%
…
00 088.345 L: 98%
00 088.608 Read­Ce­htv­Data done, Con­figOK: FALSE
00 088.887 V: 0%
…
00 105.628 V: 100%
00 106.169 P: 0%
00 106.709 P: 0%
00 106.786  /data/boot/* is being scanned for size
00 106.788  cur­rent flash­size: 16:
00 106.791  cur­rent flash­size: 84908:
00 106.793  /data/data/* is being scanned for size
00 106.867  cur­rent flash­size: 5380224:
00 106.869  /squash/* is being scanned for size
00 106.871  cur­rent flash­size: 14358656:
00 106.873  /bffs3/* is being scanned for size
00 106.875  cur­rent flash­size: 16882143:
00 106.877  cur­rent flash­size: 17629790:
00 106.879  cur­rent flash­size: 18374492:
00 106.881  /bffs2/* is being scanned for size
00 106.883  cur­rent flash­size: 18387152:
00 106.885  cur­rent flash­size: 18387227:
00 106.887  cur­rent flash­size: 23047555:
00 106.889  cur­rent flash­size: 23148767:
00 106.891  cur­rent flash­size: 24189379:
00 106.893  cur­rent flash­size: 25783095:
00 106.900 m_JffsMounted = 3
00 106.902 Sync called
00 106.904 Sync DONE
00 106.906 Check­Un­Mount:  /mnt/jffs0
00 106.909 /mnt/jffs0 is mounted
00 106.911 Unmount /mnt/jffs0
00 106.915 /mnt/jffs0 is not mounted
00 106.917 umount­ing /mnt/jffs0 ok
00 106.919 umount­ing par­ti­tion 4 from jffs2 file sys­tem passed
00 106.921 Sync called
00 106.923 Sync DONE
00 106.925 Check­Un­Mount:  /mnt/jffs1
00 106.927 /mnt/jffs1 is mounted
00 106.929 Unmount /mnt/jffs1
00 106.935 /mnt/jffs1 is not mounted
00 106.936 umount­ing /mnt/jffs1 ok
00 106.938 umount­ing par­ti­tion 5 from jffs2 file sys­tem passed
00 107.249 P: 0%
00 107.790 P: 0%
00 108.156  For­mat suc­ces­full
00 108.157  Total­size flashed: 0, Total­Pro­gram­Size: 25783095
00 108.160 m_JffsMounted = 0
00 108.162 spawn­ing flash_eraseall
00 108.164   param: flash_eraseall
00 108.166   param: –q
00 108.168   param: /dev/mtd5
00 108.329 P: 0%
00 109.949 P: 0%
00 110.015 sta­tus: 1 ‚eras­ing par­tim­age par­ti­tion suc­ces­full
00 110.017   Total­size flashed: 0, Total­Pro­gram­Size: 25783095
00 110.020 m_JffsMounted = 0
00 110.490 P: 0%
00 110.829  For­mat suc­ces­full
00 110.832  Total­size flashed: 0, Total­Pro­gram­Size: 25783095
00 110.860 m_JffsMounted = 0
00 110.862  Total­size flashed: 0, Total­Pro­gram­Size: 25783095
00 110.890 m_JffsMounted = 0
00 110.892 JFFS found to write /data/boot/tv
00 110.996 mount­ing par­ti­tion 4 to jffs2 file sys­tem passed
00 110.998  Total­size flashed: 0, Total­Pro­gram­Size: 25783095
00 111.030 P: 0%
00 111.569 P: 0%
00 112.060 m_JffsMounted = 1
00 112.062 Sync called
00 112.065 Sync DONE
00 112.067 Check­Un­Mount:  /mnt/jffs0
00 112.070 /mnt/jffs0 is mounted
00 112.072 Unmount /mnt/jffs0
00 112.076 /mnt/jffs0 is not mounted
00 112.078 umount­ing /mnt/jffs0 ok
00 112.080 umount­ing par­ti­tion 4 from jffs2 file sys­tem passed
00 112.082 JFFS found to write /data/data/tv
00 112.112 P: 0%
00 112.649 P: 0%
00 112.878 mount­ing par­ti­tion 5 to jffs2 file sys­tem passed
00 112.880  Total­size flashed: 84908, Total­Pro­gram­Size: 25783095
00 113.189 P: 0%
…
00 127.229 P: 19%
00 127.330 m_JffsMounted = 2
00 127.332 Sync called
00 127.769 P: 19%
00 128.016 Sync DONE
00 128.018 Check­Un­Mount:  /mnt/jffs1
00 128.020 /mnt/jffs1 is mounted
00 128.022 Unmount /mnt/jffs1
00 128.058 /mnt/jffs1 is not mounted
00 128.060 umount­ing /mnt/jffs1 ok
00 128.062 umount­ing par­ti­tion 5 from jffs2 file sys­tem passed
00 128.064 v1 squash
00 128.066  Total­size flashed: 5380224, Total­Pro­gram­Size: 25783095
00 128.068 spawn­ing nand­write
00 128.070   param: nand­write
00 128.072   param: –z
00 128.074   param: 8978432
00 128.076   param: /dev/mtd5
00 128.077   param: /philips/pipe
00 128.095  exe­cute nand­write OK
00 128.309 P: 19%
…
00 139.991 Writ­ing data to block 88c000
00 141.206 P: 54%
00 141.206 /philips/pipe could is closed
00 141.206 m_JffsMounted = 0
00 141.206  Total­size flashed: 14358656, Total­Pro­gram­Size: 25783095
00 141.206 P: 54%
…
00 150.430 P: 70%
00 150.432 m_JffsMounted = 0
00 150.434  Total­size flashed: 18374492, Total­Pro­gram­Size: 25783095
00 150.970 P: 70%
…
00 168.791 P: 98%
00 169.280 m_JffsMounted = 0
00 169.282  Total­size flashed: 25783095, Total­Pro­gram­Size: 25783095
00 169.331 P: 100%
00 169.333 Com­pleted !!
00 169.511 Oper­a­tion Suc­cess­ful! Remove all inserted media and restart the TV set.

Root my TV: Hack Philips PFL9703

60 Comments

  • 1 topsy.com wrote:

    January 26, 2010 at 11:33 Permalink

  • 2 lbpb wrote:

    Hi,
    I’d like to root my TV too. I tried to look at the FW upgrade and as you wrote there are sev­eral parts with lots of rep­e­ti­tion. So it is prob­a­bly just obfus­cated but not really encrypted or at least not all of it. My guess is that it is some kind of structure/archive just xored with some key, but then this archive con­tains com­pressed files, how­ever just unob­fus­cat­ing it might reveal use­ful info. Any­way I couldn’t get any fur­ther for now. Other notes: my 8664 has port 80 open, but not answer­ing to any request I tried. Port 8080 seems closed. There is a guy claim­ing to have fw sources: http://www.avforums.com/forums/lcd-led-lcd-televisions/1119695-there-any-custom-firmware-philips-televisions-firmware-editor-maybe.html (will try to con­tact him).

    January 29, 2010 at 11:47 Permalink

  • 3 rooter wrote:

    Hi,

    I had a look at the newer firmware for the cur­rent 8xxx series.

    First, I stripped off the header and the, I think, sig­na­ture to obtain the encrypted part. Then, I looked at all 16 byte blocks, sorted and counted them. One block occured very often, about 5000 times. Search­ing this block in the file revealed large areas with this block repeated in them. I found more then 100 sep­a­rate areas dis­trib­uted over the whole file.

    IMO this shows that the whole file is encrypted with the same 128 bit block algo­rithm. I think the encrypted rep­e­ti­tious block con­tains fill bytes, either all 0x00 or all 0xff.

    I think it’s def­i­nitely no XOR chiffre. In that case I would assume that some of the 16 byte block before the repeated areas would show some bytes of the repeated block in its last bytes, since I would assume that some of the pre­vi­ous areas wouldn’t end at a 16 byte bound­ary and hence end with the fill byte. But that’s appar­ently nowhere the case.

    You should use your draca tool again, but only on the encrypted part. Maybe we get some infor­ma­tion about the block chiffre used that way. But I assume it’s not so easy to crack the key, even if I assume the clear­t­ext to be known.

    Another way would be to either sol­der off the NAND flash and read it out, or use a JTAG inter­face to read the NAND flash through the CPU. Not easy either…

    January 29, 2010 at 19:01 Permalink

  • 4 lbpb wrote:

    I still think it’s just xor, for 2 rea­sons:
    1– it would be very stu­pid to use more advanced crypt and still encrypt every 128 bit block indi­vid­u­ally. Of course you could use more advanced block modes with xor too, but if you are just try­ing to lightly obfus­cate, then it can make sense to just apply a sim­ple xor;
    2– for some of the repeated blocks, there are also some nearby blocks that begin with the same bytes but end dif­fer­ently and some that end with the same bytes but begin dif­fer­ently. If it were a more advanced crypto, this would be very improb­a­ble.
    Of course this is not a guaranteee…anyway my next step is: take every block that repeats sev­eral times, xor the whole file with it and see if with any of them I get any­thing more inter­est­ing. This won’t work very well if dif­fer­ent parts of the file are “coded” with dif­fer­ent xor keys. Will post results.

    January 29, 2010 at 20:29 Permalink

  • 5 michu wrote:

    The draca results do not dif­fer if I run it against the header-less firmware file.

    I also assume the 160 bytes in the header is the sig­na­ture of the firmware.

    There are sim­i­lar pat­terns in each firmware, but never the SAME — so the key has to be dif­fer­ent in each firmware (check http://www.neophob.com/serendipity/index.php?/archives/183-Firmware-Visualizer-fwimage.html).

    Per­haps the ASCII text in the header is part of the key? (some­thing like Q591E-0.100.0.0_)?

    January 30, 2010 at 00:01 Permalink

  • 6 lbpb wrote:

    Well try­ing to xor with the pat­terns didn’t lead any­where. Also the non aligned blocks are very few and might be caused by encrypt­ing dif­fer­ent sec­tions of the file indi­vid­u­ally. Just of note is that one sin­gle 128 bit block is repeated 5000 times, spread through­out the whole file, while the sec­ond most fre­quent block appears just about 500 times and is much more localized.

    January 30, 2010 at 08:28 Permalink

  • 7 rooter wrote:

    It’s pre­sum­ably some kind of block chiffre with a 128 bit key. As if the 128 bit key size isn’t enough of a chal­lenge, deduc­ing which encryp­tion algo­rithm was used might be pos­si­ble for a crypto expert, but not for me.

    The best bet might really be to some­how read out the NAND flash. Pre­sum­ing that the par­ti­tion con­tent is not encrypted, we could read out the soft­ware and use a dis­as­sem­bler to learn how it works — there’s one for MIPS in the obj­dump GNU utility.

    Defec­tive SSB’s any­one? Any cur­rent Philips TV with a firmware struc­ture like this would be eligible.

    January 30, 2010 at 10:29 Permalink

  • 8 michu wrote:

    The firmware is encrypted with blowfish/AES/… as a sim­ple xor does not decrypt the file. The key dif­fers in each release…

    February 8, 2010 at 20:44 Permalink

  • 9 Tom wrote:

    Regard­ing the binary garbage on the ser­ial inter­face in the Jett mode: this looks like a bitrate/mode mis­match on the ser­ial line. Try other speed set­tings. And don’t rely on the “console=ttyS1,38400n8” state­ment. I’ve seen ker­nels which just ignored set­tings passed by the boot­loader and used hard­coded values.

    Good luck! :-)

    February 8, 2010 at 22:33 Permalink

  • 10 lbpb wrote:

    Mod­els with NetTV also have an inter­nal Opera 9.5 browser, with javascript sup­port but no flash/macromedia. It might be pos­si­ble to use some opera exploit but I couldn’t find any for MIPS architecture…

    February 9, 2010 at 08:57 Permalink

  • 11 rooter wrote:

    Hmm… that idea is not bad.

    Metas­ploit has some opera exploits, and a shell pay­load for MIPS linux. The busy­box con­fig­u­ra­tion from the open source pub­li­ca­tion pack sug­gests that there’s no shell, hence another pay­load would have to be devel­opped — an exec of “busy­box” for a list of the really avail­able com­mands would be the first thing to do.

    Any­way, the first thing to ver­ify is that the browser is really vul­ner­a­ble for one of the known exploits.

    February 9, 2010 at 20:10 Permalink

  • 12 michu wrote:

    I used those unknown 160 bytes in the header to decrypt the firmware, I tried AES-128-ECB, IDEA-ECB, DES, BLOWFISH, I used the key as lit­tle endian or big endian — with­out success.

    —
    #!/bin/bash
    for i in {0..146}
    do
    echo “———- $i“
    dd if=key of=key.tmp bs=1 count=16 skip=$i 2> /dev/null
    openssl aes-128-ecb –d –nos­alt –in nohde –out decr.xxx –kfile key.tmp
    dd if=decr.xxx skip=28554720 bs=1 count=128 2> /dev/null| hex­dump –Cv
    done
    —

    February 9, 2010 at 22:58 Permalink

  • 13 lbpb wrote:

    Appar­ently my tv is not affected by the exploit I found on Metas­ploit (I just found 1 any­way, if you found more then I must have missed something).

    February 12, 2010 at 09:06 Permalink

  • 14 michu wrote:

    hmm why is the firmware file-size 28’750’876 (-732 bytes header) bytes while the flashed size is only 25’783’095 bytes (Total­size flashed: 25783095, Total­Pro­gram­Size: 25783095)? What are the remain­ing 2’967’049 bytes?

    February 13, 2010 at 16:49 Permalink

  • 15 michu wrote:

    Ok those 160 bytes in the header are really a sig­na­ture, I nulled out those 160 bytes and tried to flash it. The val­i­da­tion process fails:

    00 052.448 V: 93%
    00 052.989 V: 97%
    00 053.439 Invalid Firmware! Bad check­sum or bad signature.

    February 13, 2010 at 17:51 Permalink

  • 16 michu wrote:

    I just found an inter­est­ing note in the ser­vice manual:

    The set soft­ware and secu­rity keys are stored in a NAND– Flash, which is con­nected to the PNX8541 via the PCI bus.

    February 18, 2010 at 21:15 Permalink

  • 17 rooter wrote:

    That’s why I asked for defec­tive PCB’s :-)

    February 19, 2010 at 08:35 Permalink

  • 18 michu wrote:

    Infos about “Option num­ber” in the SAM Menu:

    The first line (group 1) indi­cates hard­ware options 1 to 4.
    The sec­ond line (group 2) indi­cates soft­ware options 5 to 8.

    February 22, 2010 at 01:17 Permalink

  • 19 alterpeople wrote:

    fix­ing a q591e –la with mpeg4 hard­ware actived wrongly.
    Boot­ing with jet­files, con­nect the com­pair, select q52x
    use nvm edi­tor and set the address 0124 the value 42

    ;-)

    March 13, 2010 at 17:07 Permalink

  • 20 alterpeople wrote:

    the same for value must be changed for 10EF and 16E8 loca­tion addresses .

    enjoy

    ;)

    March 13, 2010 at 18:47 Permalink

  • 21 Joao wrote:

    I do not cur­rently own a Philips Net TV but I’m con­sid­er­ing buy­ing one. Some­one please cor­rect me if I’m wrong but these TV mod­els do not have Blue­tooth sup­port. From what I read so far, text input is cum­ber­some (not only on the Philips but on every other brand), so Blue­tooth would be good in order to have a wire­less key­board. Playsta­tion, for instance, sup­ports a Blue­tooth key­board. Being able to change the firmware would have, at least, one inter­est­ing objec­tive: adding Blue­tooth support!

    April 15, 2010 at 09:56 Permalink

  • 22 michu wrote:

    hey joao

    You’re right, there is no blue­tooth hard­ware installed, at least not on my model.

    April 15, 2010 at 11:27 Permalink

  • 23 Steve wrote:

    That’s why I asked for defec­tive PCB’s :-)

    May 29, 2010 at 10:16 Permalink

  • 24 Baris wrote:

    I am try­ing to make an EIB cable but I am with­out luck.
    Does the ser­ial port of the TV need to be acti­vated somehow?

    I made a “stereo jack to ser­ial” which I linked to a ser­ial to USB don­gle. I tried both 115200 and 38400 baud.

    Do I need to enable/disable soft­ware or hard­ware con­trol in the ter­mi­nal program?

    June 1, 2010 at 16:23 Permalink

  • 25 michu wrote:

    I also use an USB don­gle, with­out any prob­lems, ter­mi­nal set­tings: 38400 Baud 8N1. try to switch rx and tx. and you see log mes­sages if you startup the tv or press some keys on the rc.

    June 1, 2010 at 17:24 Permalink

  • 26 MartiniB wrote:

    just idea, the key(or index of it) can be in the header

    i have com­pared two same version(Release for TV520 R2:Q591E-0.83.0.0 Gen­er­a­tion date:29/09/2008 13:44:08) firmwares
    !!! ver­sion is the same but dif­fer­ent autorun.upg
    first 543 butes are exactly same
    544 to 703 ???????????
    704 to 728 plain text “Q591E-0.83.0.0_commercial“
    729 to 28648764 ???????????

    June 10, 2010 at 10:15 Permalink

  • 27 michu wrote:

    I dont think so — I assume this bytes in the header are an encrypted check­sum (sha1 or some­thing) — check the arti­cle, I nulled out those bytes and tried to upload this firmware. It failed btw ;)

    June 10, 2010 at 11:35 Permalink

  • 28 Terap wrote:

    Some LG info,
    http://www.lg-hack.info/ is an LG LCD TV hack­ing web­site, with details on unpacking/repacking the EPK/PAK firmware files.

    openl­gtv, http://mikko.korkalo.fi/openlgtv/ is a Linux dis­tri­b­u­tion that replaces the LG offi­cial firmware.

    June 25, 2010 at 00:03 Permalink

  • 29 Mark Zocher wrote:

    Wow, you’ve got­ten way fur­ther with this project than I ever did! (see http://www.myrejectedprojects.com/2010/09/hacking-my-philips-tv/). Did you see the progress the SamyGo project has made on the Sam­sungs? (http://samygo.sourceforge.net)

    October 7, 2010 at 17:08 Permalink

  • 30 Bert wrote:

    I’m also look­ing for con­nec­tion to my Philips TV. The Help men­tions Busy­Box, which reminds me of the Xtreamer. The Xtreamer can be reached by putting some .php files on a USB device and “open” one of these (fakeshell.php). Files can be found at http://www.mavvy.net

    October 26, 2010 at 20:51 Permalink

  • 31 bla wrote:

    Found fol­low­ing in http://www.scribd.com/doc/23986104/Philips-Ch-q529-1e-Lb:

    Read­Ce­htv­Data Con­figVer­sion: [0.01] OK
    Read­Ce­htv­Data Pro­duc­tID: [Q591E] OK
    Read­Ce­htv­Data OUI: [0000903E] OK
    Read­Ce­htv­Data Hard­ware­Model: [0203] OK
    Read­Ce­htv­Data Hard­ware­Ver­sion: [0100] OK
    ConvertAscii2Bin started
    ConvertAscii2Bin done
    ConvertAscii2Bin started
    ConvertAscii2Bin done
    Read­Ce­htv­Data Pub­licKey: OK
    Read­Ce­htv­Data done, Con­figOK: TRUE

    —>

    Read­Ce­htv­Data Pub­licKey: OK means that it uses some asym­met­ric encryp­tion or?

    January 4, 2011 at 18:45 Permalink

  • 32 michu wrote:

    yes, but I don’t know whats meant with “Read­Ce­htv­Data Pub­licKey”. There is a signed part in the firmware header and there are also stored key’s in the eep­rom of the tv.

    January 4, 2011 at 21:40 Permalink

  • 33 bla wrote:

    160 Byte is 1280 bit. There is also RSA-1280. Is RSA used here?

    January 5, 2011 at 11:02 Permalink

  • 34 none wrote:

    No firmware hack, but access to the tv via net­work allows remote con­trol and stream­ing to the ‘TV’: http://sourceforge.net/apps/mediawiki/jointspace/index.php?title=Introduction

    January 5, 2011 at 14:23 Permalink

  • 35 michu wrote:

    I don’t have a clue, what kind of encryp­tion is used here…

    January 5, 2011 at 15:02 Permalink

  • 36 rysmario wrote:

    the file seems to be com­pressed too.. refer­ring to Q5551_v1.140.27.0.upg upgrade log 81mb Update ‘iStored­Size’ are cumu­lated 81190368 bytes whereas the image pay­load is only 74936429 bytes large.

    encryp­tion must be 128bit block-cypher — if i take the image apart refer­ring to the header details — it is padded to fit 16byte blocks…

    January 8, 2011 at 08:56 Permalink

  • 37 bak wrote:

    may pro­vide a clue on algo­rithms used (gzip, sha1) — at least on this 58″

    http://www.p4c.philips.com/files/5/58pfl9955h_12/58pfl9955h_12_osr_eng.txt

    January 12, 2011 at 17:00 Permalink

  • 38 michu wrote:

    Good Idea, here are the rel­e­vant infos:
    Tom­Crypt (http://libtomcrypt.com/index.old.html.LibTomCrypt)
    OpenSSL
    Adler-32 CRC (http://en.wikipedia.org/wiki/Adler-32)
    SHA1 algo­rithm (http://gladman.plushost.co.uk/oldsite/cryptography_technology/sha/sha2-07–01-07.zip)

    January 12, 2011 at 17:21 Permalink

  • 39 bla wrote:

    Some­one tried to write a Hello-World pro­gramm and to exe­cute with the Jett mode?

    January 18, 2011 at 16:11 Permalink

  • 40 bla wrote:

    Here is EEPROM-dump of 42pf9631d :
    http://www.badcaps.net/forum/showthread.php?t=9751

    January 18, 2011 at 16:31 Permalink

  • 41 Mark wrote:

    It seems that the unique way to read the NVM is to dis­man­tle it from the tv’s pcb. No man­ual edit mode ? Hyper­T­er­mi­nal on ser­vice UART is able to show logs only, what about a way to enter as root so mak­ing read and write pos­si­ble? Thanks for some answer.

    February 2, 2011 at 04:39 Permalink

  • 42 Joshua wrote:

    Here anther NVM dump:
    http://dump.elektroda.pl/download13244.html

    February 9, 2011 at 23:19 Permalink

  • 43 ScripTrix wrote:

    Have u take a look to the HELPFILE UPG ?
    it’s no “Ver­sion Header” only 00h.
    From 211h — 2DF is crypt stuff/header or so ? how­ever the com­er­cial string is present with a parm ->
    xxxxx_commercial.FORCEUPGRADE

    February 22, 2011 at 09:11 Permalink

  • 44 michu wrote:

    which helpfile.upg?

    February 22, 2011 at 09:34 Permalink

  • 45 ScripTrix wrote:

    e.g. for my TV 7605 -> http://www.p4c.philips.com/files/4/40pfl7605h_12/40pfl7605h_12_mus_deu.zip

    It’s a ~3 MB File includ­ing the Help­sys­tem manual

    February 23, 2011 at 08:55 Permalink

  • 46 gigirex wrote:

    Hi!
    Did you have the HsvAn­ten­naDigSrvcTable file for­mat?
    Thanks

    July 18, 2011 at 15:32 Permalink

  • 47 George wrote:

    Inter­est­ing info on the Com­Pair & Jett files: http://www.scribd.com/doc/53185886/philips-ComPair-training-20January-2008

    July 22, 2011 at 17:56 Permalink

  • 48 Ian wrote:

    I’ve just realised that my Phillips TV runs Linux. I was so exited. Then the dis­ap­point­ment of find­ing there is no way in yet. One huge hole in the GPL, yes you can down­load the source, yes you can mod­ify it and com­pile it, no you can’t run it because you can’t sign it!

    July 30, 2011 at 19:25 Permalink

  • 49 Recep wrote:

    Try bin­walk. I used it to ana­lyze son bravia firmware

    October 3, 2011 at 23:24 Permalink

  • 50 Detektei wrote:

    Is there a chance to upgrade the unsup­ported Firmware of 37PFL8404..?

    November 7, 2011 at 00:28 Permalink

  • 51 Anonymous wrote:

    I don’t think you can decrypt the firmware very easy. This series pow­erPC proces­sors has on-chip fuses which can’t be read back an inter­nal proces­sor can use these data do decrypt data. prob­a­bly an AES-key is stored there.

    With­out: the pri­vate AES-key, much-patient in brute­force, rainbow-tables or cor­rupt Phillips employ­ees you are at an dead end.

    At the com­pany where I work we use this proces­sor in a Set­Top­Box with no smart­card. The key pro­grammed in the fuses is the iden­ti­fi­ca­tion of the box.

    December 5, 2011 at 22:22 Permalink

  • 52 corecoder wrote:

    A dif­fer­ent vec­tor than firmware:: the Nettv series run Opera 10 and it’s pos­si­ble to enter any URL. It sup­ports Javascript and the 2011 TVs sup­port SWF. Any ideas if or how this can be exploited?

    December 16, 2011 at 17:39 Permalink

  • 53 bkgg wrote:

    Well, I’m no prati­tioner, but maybe 2 cents from me.

    Regard­ing the Encryp­tion:
    With my model, a xxpfl5xxx, if you want to record some­thing (regard­less of timeshift or nor­mal) the TV wants to for­mat a con­nected HDD. The man­ual states, that you cant use this HDD in this con­di­tion oth­er­wise.
    This could either be because its for­mated for Linux, or because its encrypted. In lat­ter case, maybe its made with the same method and key as the firmware, because it has to be decoded again, and why use a sec­ond key for this. That would add cost.

    Other pos­si­bil­ity would be jointspace. Your arti­cel is now 2 years old, and it has prob­a­bly more func­tions now than then.
    First the web­server is now in use with xxPFL5xx6 to xxPFL9xx6 mod­els. Via port 1925 you can use some GET and two POST meth­ods. SO no big deal for root­ing I gues.
    But Jointspace has a lot of meth­ods in use. With this you can prorgamm soft­ware which is exe­cuted on your PC but shown on your TV. So maybe, if there is a weak­ness in their draw­ing func­tion it is pos­si­ble to acti­vate tel­net through a puffer­over­flow or some­thing like this.
    (For exam­ple there is soft­ware for just show­ing your mon­i­tor on TV via eth­er­net or for play­ing Doom, con­trolled by remote­con­trol http://jointspace.sourceforge.net/download.html )

    January 8, 2012 at 12:09 Permalink

  • 54 corecoder wrote:

    The HDD is not encrypted, just for­mat­ted as extfs. But the record­ings are encrypted to only allow play­back on the TV they were recorded -> maybe this?

    There also is an exploit for the Alle­gro Rompager Web­server:: http://www.securiteam.com/exploits/5XP0M0UCUO.html
    But I’m no expert on how to use this.

    January 20, 2012 at 23:10 Permalink

  • 55 Anonymous wrote:

    This is the pub­lic key from the TV used as cookie to iden­tify a debug USB stick dur­ing bootup (from /proc/public_key).

    Maybe this is also used for the Firmware?

    MIME-Version: 1.0
    Content-Type: application/octet-stream; name=“public_key256.out“
    Content-Transfer-Encoding: base64
    Content-Disposition: attach­ment; filename=“public_key256.out”

    QYMOXtEEAtDq1L/2xwExIU6qcuV4njMeDz68CCwzpoFTlgrK6IfrefrAe1R/jfLJBAOCKN+tf8Vt
    D/9n9W1Z/GWJYEFEe7hT5H2U+hxMBOnhGGJ3Ggl2JtPccEhOdXWL3uCZ8bqjCSghP6qtAEfZzG1Z
    BH+aE/jnhHD5UO+4gvqEqWM4TrpgY9DM4zYhOCEnLsIa24zoygMmNTnLkEYTftmlqgqrhg01X87w
    77ptPRskrxnm71z4BCMDXedmzKaw/lIEvfIuDYlGqSUOmQCv3m4YW1gddqymMu/yNyKnC5zr5gvE
    0cExBC05MkyFaU9365LJBongz5Rr0WIFuU7GvwEAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

    March 7, 2012 at 11:56 Permalink

  • 56 Anonymous wrote:

    I for­got — this is the key from the PFL 7xx6 series

    March 7, 2012 at 12:02 Permalink

  • 57 pippo wrote:

    @55: where did you get that pub­lic key from?
    And what’s the debug usb stick is sup­posed to do?

    April 9, 2012 at 16:38 Permalink

  • 58 Anonymous wrote:

    /proc/public_key is used to decrypt UPG. But it must be 256 bytes. This key is too big.

    April 18, 2012 at 11:22 Permalink

  • 59 Anonymous wrote:

    The file has 512 bytes, yes, but if you look at the hex dump, only the first 256 bytes have use­ful “ran­dom­like” val­ues. The remain­ing bytes are 01 00 01 00 00 00 00 …

    April 30, 2012 at 12:34 Permalink

  • 60 Anonymous wrote:

    01 00 01 00 00… is a well-known RSA pub­lic expo­nent, while first half of the file is a RSA mod­u­lus.
    UPG is crypted using AES-256. Decryp­tion key and SHA-1 check­sum are stored in RSA crypted block (0x220-0x2A0).
    To decrypt 128 bytes you will need a mod­u­lus of 128 bytes, not 256.

    May 3, 2012 at 06:45 Permalink

One Trackback

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*