non-LG BCM3556 based TV sets

European models : LD6xx, LD7xx, LE5500, LE8500, LE9500, LX, PK7xx, PK9xx, SmartTV.

Moderator: xeros

Post Reply
Hansjpk
Posts: 4
Joined: 03 Apr 2012, 09:03
My TV model: Medion MD30486

non-LG BCM3556 based TV sets

Post by Hansjpk » 03 Apr 2012, 10:53

Is it possible to adapt and/or apply the openlgtv mods to other brand HDTV than LG, but also using BCM3556 plaform ???

I own a Vestel build model, which seems to be OEM brand-labeled under many different names (Medion, Hitachi, Toshiba, Grundig and even Loewe).
They all seem to have similar software and build blocks. Difference in functionality being largely defined by standard OEM-specific 'setup' files, or additional images to be flashed to (otherwise) unused Flash blocks. Software and hardware definitions can clearly be identified (toros_hwprofile, toros_swprofile).

So far I din't need console access. The unit is able to boot from USB, so all dumps/mods/logs can be done from script.
This way I managed to succesfully cross-flash a Medion model to Hitachi. By playing around with both models settings I managed to change the 'skin' drastically and keep a balanced set of functionality of both models. Any real-new functionality as PVR and or internet functionality still does not work however....
Is it only because of (still) wrong settings? Or because of missing additional images to flashed ?? I don't know (yet)...
One thing I did encounter is that the main FS is regretfully packed as Sqaushfs and therefor RO.... Now way to easily modify anything there...

So, I would like to :
- enable the (USB) PVR function (which is now listed as disabled) (what format is used in toros_swprofile???)
- improve wifi compatibility, to support more BCM based sticks than just the ones 'pre-scribed'or sold by the OEM manufacturer.....
- enable some kind of internet access/platform
- enable IP-TV??

Anybody any experience or suggestions ??

xeros
Posts: 1115
Joined: 21 Feb 2011, 18:34
My TV model: BCM

Re: non-LG BCM3556 based TV sets

Post by xeros » 04 Apr 2012, 08:34

Hansjpk wrote:Is it possible to adapt and/or apply the openlgtv mods to other brand HDTV than LG, but also using BCM3556 plaform ???
That depends on firmware.
Recently I've seen 2009 year BCM3556 LG models from Brazil and Japan which are not compatibile with OpenLGTV BCM and bringing support for those would need a lot of changes.
Hansjpk wrote:I own a Vestel build model, which seems to be OEM brand-labeled under many different names (Medion, Hitachi, Toshiba, Grundig and even Loewe).
They all seem to have similar software and build blocks. Difference in functionality being largely defined by standard OEM-specific 'setup' files, or additional images to be flashed to (otherwise) unused Flash blocks. Software and hardware definitions can clearly be identified (toros_hwprofile, toros_swprofile).
I guess that's totally different firmware than LG uses.
LG has touched all aspects of firmware, even all open source libs binaries used in TV are modified by them (some modifications are even doubtful to be useful/needed) and everything is specific to LG.
Hansjpk wrote:So far I din't need console access. The unit is able to boot from USB, so all dumps/mods/logs can be done from script.
This way I managed to succesfully cross-flash a Medion model to Hitachi. By playing around with both models settings I managed to change the 'skin' drastically and keep a balanced set of functionality of both models. Any real-new functionality as PVR and or internet functionality still does not work however....
Is it only because of (still) wrong settings? Or because of missing additional images to flashed ?? I don't know (yet)...
Nice, but I don't know those firmwares to talk about them yet.
Hansjpk wrote:One thing I did encounter is that the main FS is regretfully packed as Sqaushfs and therefor RO.... Now way to easily modify anything there...
If there's no extra security then you should be able to dump it to file, unpack, make changes, pack, and flash again.
You may also choose any other writable partition for custom things.
Hansjpk wrote:So, I would like to :
- enable the (USB) PVR function (which is now listed as disabled) (what format is used in toros_swprofile???)
I would like that, too ;-) Here so far only BCM3556 with ATSC/ISDB tuners have DVR functionality in firmware.
Unfortunately that parts of firmware are not compatibile with models that use different tuners (DVB-T/C).
Hansjpk wrote:- improve wifi compatibility, to support more BCM based sticks than just the ones 'pre-scribed'or sold by the OEM manufacturer.....
That's the job at Linux kernel level. It depends what's compiled in kernel that those TVs use.
Generally it _should_ be possible but amount work depends on drivers and kernel build.
In LG TVs I found it's not worth the work needed (at least for me) - that would require many changes to drivers sources.
Btw. do you have Linux kernel and open source apps/libs sources released by any of these vendors?
To satisfy (L)GPL and few other open source licences they must release them on any request.
Hansjpk wrote:- enable some kind of internet access/platform
That might be possible but it will need some work with porting Webkit browser and GTK libs for them.
Hansjpk wrote:- enable IP-TV??
That depends if firmware is monolithic like LG makes or modular and if drivers for BCM hardware are running at kernel level (older LG models) or at userspace app (LG BCM3556 and up).

Can you get some logs of boot process, tools available?
I would like also to see firmware dump from such TVs.
What's the kernel version and C libs there?

2009 year LG BCM3556 models have kernel 2.6.18 (with squashfs 3.x), 2010 year models have kernel 2.6.31 (with squashfs 4.x).
Both use uClibc 0.9.29.
Firmware is very monolithic - most drivers for hardware + app are controlled by 'RELEASE' application (LG proprietary, binary blob), web browser and flash player are using libs which are hooking into it, too.
RELEASE keeps hardware settings in text config + EEPROM and NVRAM partition but it has bultin drivers for specific hardware only so when flashing even firmware from other country (but the same model) can make brick ((mostly) unstoppable crashes + boot loop) due to missing drivers for tuners, etc.
== OpenLGTV BCM developer: viewtopic.php?f=9&t=44 ==

Hansjpk
Posts: 4
Joined: 03 Apr 2012, 09:03
My TV model: Medion MD30486

Re: non-LG BCM3556 based TV sets

Post by Hansjpk » 04 Apr 2012, 10:39

Thanks for your extensive elaboration..... You are clearly more into this matter as I am ;)

I only have superficial Linux knowledge, so I couldn't possible level with you or answer all related questions.
As a matter of fact you van download the (Hitachi) firmware I used on :
http://www.uloz.to/x8e6t58/v0-8-5-2-for-32h8l06-zip
It is identical in build-up to the my original Medion LIFE P15068 model MD30486 firmware (Vestel MB70 chassis/ Remote Control VESTEL/RC5111).
The package is self explanatory I think. As far as I can tell it is based on Linux kernel 2.6.18 and uses uClibc-0.9.29.
It has 2x valid KernelFS (one main, one for recovery/flashing), and a large Squashfs v3 image, which contains the main libs/apps. There are a number of flashblocks that don't get flashed by this update. Apparently these are just optional. From the complete flash dump I made, these indeed appear to be blank (full FF).

The Hitachi model is supposed to have USB-PVR, HBB-TV and Wifi enabled, but lacks DLNA. The Medion has (limmited) wifi support and excelent DLNA, playing even mkv H264 files!! Both models lack internet plaform, but the software images clearly indicate it was designed to be able to do so (startup-url, Yahoo_data etc).

What I found out is that the main 'user' functionality is defined by toros_swprofile.bin. Replacing just this single file completely alters the set's functionality. Likewise hardware is defined in toros_HWprofile.bin. The Hitachi firmware works 1:1 on my set, as long as I keep my original toros_HW file.
Unfortunetly I can't decipher the file format used by the toros files so I can't manually 'customize' settings.... (Any hints are welcome....)
What is a bit confusing are the bti_xx.bin files. These seem to hold some kind of settings as well, but modifying those sofar did not visibly change anything at all.
The main running application seems to be /opt/nexus/app.elf, clearly different from LG's.
Lay-out and skin is indeed different from Medion as well, but there user's functionality and technical compatibilty clearly match fine.

If I apply manual changes to certain files (like passwd), these seem to be lost or overwritten again after boot.... :twisted:
I can extract and edit individual files from the main squashfs image, but am not able to re-pack those into any flashable format. Supported squashfs and crimsfs are both RO, only jffs would be RW. I don't have any obb/ecc parameters which would probably be required for a new fs, so I wonder how to produce a new flashable fs-image ...?

I don't have source code (nor the knowledge to do anything with it..... :P )
But generally speaking if at all, OEMs only partially comply with GPL. Any 'core' applications source is never released to the public domain anyway....

I can send you my dumps/logs, but honestly don't know how to do that through this forum.....
But I think once you take a look a the image link I mentioned, most of your questions will be answered....

Hans

xeros
Posts: 1115
Joined: 21 Feb 2011, 18:34
My TV model: BCM

Re: non-LG BCM3556 based TV sets

Post by xeros » 04 Apr 2012, 20:15

Thanks for link and info.
I've made a quick look at it's contents and it looks interesting.
Hansjpk wrote: Unfortunetly I can't decipher the file format used by the toros files so I can't manually 'customize' settings.... (Any hints are welcome....)
Looks like each file has text strings separated from data.
First part of file (besides the header) has probably offsets (in RAM?) or values for strings at the end of file.
But I've took a quick look only, without checking values, yet.
Hansjpk wrote:What is a bit confusing are the bti_xx.bin files. These seem to hold some kind of settings as well, but modifying those sofar did not visibly change anything at all.
It looks like those have some settings for display and audio(?)
Hansjpk wrote:The main running application seems to be /opt/nexus/app.elf, clearly different from LG's.
It has some simmilaries with LG's 'RELEASE' app.
Looks like Broadcom is sharing some 'starting' code which gets adated and extended by each vendors on their own later.
Hansjpk wrote:If I apply manual changes to certain files (like passwd), these seem to be lost or overwritten again after boot.... :twisted:
I can extract and edit individual files from the main squashfs image, but am not able to re-pack those into any flashable format. Supported squashfs and crimsfs are both RO, only jffs would be RW. I don't have any obb/ecc parameters which would probably be required for a new fs, so I wonder how to produce a new flashable fs-image ...?
That's easy to change.
For squashfs use mksquashfs from squashfs-tools 3.0 (current 4.x versions wont work with this 2.6.18 kernel) to prepare compatibile image to be flashed.
And as for jffs2 - erasesize (needed to prepare virtual mtdram device for mounting jffs2 image) is 128KB (different than here: 256KB). Preparing custom jffs2 without making changes to squashfs partition would be useless at this stage if you plan to do some mod on it. And you shouldn't need to prepare new jffs2 image - you can copy files to/from it in TV directly.
And as you have some other partitions which are empty, you may use them as jffs2 to store custom things which need to be edited.
Hansjpk wrote:I don't have source code (nor the knowledge to do anything with it..... :P )
But generally speaking if at all, OEMs only partially comply with GPL. Any 'core' applications source is never released to the public domain anyway....
So you can request them. To compile things toolchain from LG BCM3556 models should be OK for yours TV but you will still need kernel sources to compile any custom kernel modules or complete custom kernel.
Hansjpk wrote:I can send you my dumps/logs, but honestly don't know how to do that through this forum.....
You can do that as attachment to message.
Hansjpk wrote:But I think once you take a look a the image link I mentioned, most of your questions will be answered....
Yes, everything is clear.
So all those TV vendors have got some 'starting' libs and sources from Broadcom and those TVs that you've mentioned have one type of customized firmware and LG has other types (few ones) but those things from Broadcom are clearly findable in all of them.
uClibc libs are exactly the same, just rest of binaries is changed. Some scripts are simmilar (looks like they were from the same source but just modified).
Regarding IP-TV, networked services, etc... yes it looks like that firmware has just deleted necessary files (stagecraft, yahoo widgets engine, web browser).
I can't say for sure yet, but if they haven't ripped too much code from main app then there should be some chance to add them back from LG TVs.
But as I said before - LG has made changes to all components so there might be problems because of missing functions in libs, etc.
Looks like that firmware should support DirectFB (via shared mem region) like in LG firmware. If that's true then this gives big possibilities for using custom apps ported from Linux PCs or other Linux based embedded devices.
But that's just my hypothesis for now.

Porting OpenLGTV BCM / LGMOD / LGMOD S7 is useless as there are too many differences but there's possibility to prepare other mod for those TVs.

Btw. both platforms are binary compatibile but BCM3556 boards can have differences in hardware that would make problems with firmware migrations.
== OpenLGTV BCM developer: viewtopic.php?f=9&t=44 ==

pasko
Posts: 1
Joined: 02 Jun 2012, 07:42
My TV model: LOEWE CONNECT 22

Re: non-LG BCM3556 based TV sets

Post by pasko » 11 Jul 2012, 21:07

Hi. First post here.
I'd like to share with you my findings in this issue.
I own a Loewe Connect 22, whith chassis MB180.
Most of the info regarding update files, ro / rw filesystem, etc. applies also to my device.
I have even noticed that there is a telnet daemon running.
Indeed, using the hash ( jloR2vYuxmvsk ) from the etc/passwd file in the cramfs filesystem already available here, I was able to obtain
the password: mb704725 . This may be useful if your modifications are overwritten after reboot.
Once I have logged in, there's a set of standard linux processed (mostly for usb control and broadcom modules) and the already mentioned
app.elf, in which I was able to find the ftp addresses for loewe update servers alone with username and passwords in plaintext.
I would also like to customize the interface. This model has no internet portal, but DLNA support is decent (no mkv, but many formats are supported)
and also has hbbtv support (in this case providers are the ones lagging behind in my country)
I have tried adding urls to mnt/settings/browser/bookmark.dat and modifying starturl.txt, but didn't notice any changes.

These are my 2 cents.

Hansjpk
Posts: 4
Joined: 03 Apr 2012, 09:03
My TV model: Medion MD30486

Re: non-LG BCM3556 based TV sets

Post by Hansjpk » 11 Jul 2012, 21:58

Pasko,

Thanks for your comments.
The telnet password appears to be 'logically' compossed of (Vestel)boardname(MB70)+hotelmode pin(4725).....
The telnet daemon in my set by default is not set active, but can be switched on in hotel mode under /diagnostic/telnet/on.
Once switched on, this password also works here! Thanks a lot for the tip!! (how the hell did you 'crack' the hash....?)

Meanwhile I have obtained new software from medion (v0.9.4), having PVR, timeshift, Wifi and and internetportal enabled. And a much nicer 'golden' skin.
Furthermore, the set recently auto-updated over the internet to v 0.10.1, bugfixing broken timeshift viewing, but not (visibly) adding any new functionality.
Essentially my original questions regarding upgrading the functionality of this Medion TVset have (almost) all been satisfied....

That leaves my curiosity :-)
I would be most interrested in looking at and trying your toros_swprofile.bin, since that appears to define the main functionality of the TVset. Yours has HBBtv enabled .... Obviously I can forward you the various versions I have of medion and hitachi. It may allow you to enable the portal and PVR/timeshoft function?
I must supose you know how to extract and flash those to your set.

Hans

xeros
Posts: 1115
Joined: 21 Feb 2011, 18:34
My TV model: BCM

Re: non-LG BCM3556 based TV sets

Post by xeros » 11 Jul 2012, 22:27

Nice findings!
Would you guys dump whole firmware for me?
I'd like to compare it with LG TVs firmware.
As I read things that you mention there are many things different but apps might be binary compatibile.
== OpenLGTV BCM developer: viewtopic.php?f=9&t=44 ==

Hansjpk
Posts: 4
Joined: 03 Apr 2012, 09:03
My TV model: Medion MD30486

Re: non-LG BCM3556 based TV sets

Post by Hansjpk » 11 Jul 2012, 22:42

Yes, of course I can forward you the Vestel based firmware versions I have. I forwarded you the link to Hitachi FW 9.x before.
My latest Medion version came over the internet, of which I don't have a backup yet.
The backup script I found on this site basically works on Medion/Vestel sets aswell, so I will do that one of these days....
How can I best upload the image (compressed app. 30-40MB!!) ?

xeros
Posts: 1115
Joined: 21 Feb 2011, 18:34
My TV model: BCM

Re: non-LG BCM3556 based TV sets

Post by xeros » 11 Jul 2012, 22:49

Hansjpk wrote:The backup script I found on this site basically works on Medion/Vestel sets aswell, so I will do that one of these days....
How can I best upload the image (compressed app. 30-40MB!!) ?
Only via external upload services. Quota on forum is too small.
You may compress it with password if you're worried about privacy (serial number for example).
== OpenLGTV BCM developer: viewtopic.php?f=9&t=44 ==

Post Reply