Debug mode connection

From Openlgtv
Jump to: navigation, search

The debug mode can be accessed after normal TV startup while channel is showing on the TV. The exact procedure to get debug mode access varies for different firmware versions.

Prerequisites

Debug mode on 2009 year firmware versions

By default TV is in Product mode. In this mode, TV listens to special two letter commands described in TV's user manual. You can leave this mode and enter to the Debug mode. To do that type "debug" and hit ENTER. Nothing will be echoed back.

  • Select one of the #Debug mode menus by typing a single character WITHOUT a following ENTER.

Alternatively you can enter to the #debugMain menu from Product mode by the following procedure:

1. Press F9 (you should see: "Enabling display debug message")

2. Press F10 to enter #debugMain menu. To return to Product mode just press F10 again.

Note: you need a terminal program which supports F-keys (putty for example).

Any time (in any mode) you can press F1 to see F-keys help screen:

Function Key helps(gnDebugLevel is 0)
== Primitive functions keys(LGTerm, CRT/linux, CRT/SCOANSI) ===================
  F01  : Show this help message,         F02  : Reset debug menu level
  F03  : Toggle overrun check method     F04  : Reserved for future use
  F05  : Show task resource table        F06  : Show OSA task information
  F07  : Show OSA semaphore information  F08  : Show OSA Message Information
  F09  : Toggle debug message output     F10  : Enter debug main menu
  F11  : Show misc information           F12  : Enter memory monitor
== Shifted functions keys(LGTERM and CRT/SCOANSI only) =========================
  S+F03: Toggle H/W mem logs(BCM)        S+F04: Reserved for future use
  S+F05: Reserved for future use         S+F06: Reserved for future use
  S+F07: Reserved for future use         S+F08: Reserved for future use
  S+F09: Reserved for future use         S+F10: Reserved for future use
== LGTerm/Linux/SCOANSI(Other control keys) ===================================
  INSERT/HOME /HOME : Show OSA hash table
  DELETE/END  /END  : Dump raw task table
  END   /PGUP /PGUP : Dump raw Resource table
  PGDN  /PGDN /PGDN : Dump raw mapped memory list
================================================================================

Debug mode on post 2009 year firmware versions

By default, new firmwares (>2009) have disabled/secured debug mode.

Debug mode is disabled on:

  • PK/PJ on Saturn 6 platform with firmware 3.20 and higher.
  • PK/LD/LE/LX on Broadcom platform with firmware higher than 03.05.
  • LD/LE on Saturn 7 platform with firmware higher than 03.01.

To enable debug mode:

Debug status in IN_START service menu

First step is to check / modify the Debug status option in IN_START service menu.

Debug mode password

  • Note the debug mode password: MODELNAMEelqjrm
    • MODELNAME has to be replaced with you specific tv model name. It is equals to that showed in customer care menu (Main menu -> red button (customer care) -> product/service Info): for example 42PJ650-ZA, 50PK950-ZA, 32LD420-ZA, etc.
    • elqjrm - constant 'secret' sequence

For example the debug mode password for an european LG 50PK950-ZA tv is '50PK950-ZAelqjrm'.

The procedure to enter that debug mode password varies for different firmware versions. So you have to probe for the right one. The variable <DEBUG_MODE_PASSWORD> has to be replaced with the debug mode password explained above.

Procedure 1

  • Type 'd<Space><DEBUG_MODE_PASSWORD><Enter>'.

After that you have to enable debug messages by pressing F9 first (until you get 'enabled debug messages' message) and after that enter debug menu shell by hitting F10.

Attention: You should press and hold the keys until you get some visual feedback from tv.

Hint: if yours terminal does not support function escape key codes then paste that codes (just the the bold parts): ^[[20~ (as F9) and ^[[21~ (as F10)

Procedure 2

  • Type '<DEBUG_MODE_PASSWORD><Enter>d<Enter>d'

Procedure 3

  • Type 'd<Space><DEBUG_MODE_PASSWORD><Enter>debug<Enter>d'

Procedure 4

  • Hit F9, then F10 in compatibile serial terminal (like Putty for example)

Debug mode menus

Ch Up/Down menu

=================== [ Ch Up/Down ] ===================
   ']' : Ch.Up, '\' Ch.Down   [ESC] : Mode Exit
======================================================

UI Keyboard Test Mode menu

=================== [ UI Keyboard Test Mode ] ===================
    '0' ~ '9' : Number Key,     '-' : Dash
    ',' : Vol.Down,   '.' : Vol.Up,  '>' : Ch.Up,  '<' Ch.Down
    '[' : Up,         '/' : Down,    ';' : Left,  ''' : Right
    'M' : Main Menu,  'H' : Home Menu,   'X' : Exit,      'I' : Brief Info.
    'B' : flashBack,  'A' : SAP(audio),  'U' : Mute,      'P' : Pip
    'R' : Ratio,      'V' : Ext.Input,   'C' : Caption,   'F' : favorite
    'D' : DW TS,      'E' : HDMI_CEC     'G' : Guide,     's' : INSTOP
    'K' : In start,    'L' : Adjust
   [ESC] : UI Keyboard Mode Exit
=================================================================

debugMain menu

   help,?   Print this help message
   ============================================================
 * show     Show Various status
   ver      Show VERsion data
   sh       Excute OS shell
   md       Memory dump
   mm       Modify memory
   mf       Memory fill
   mmap     Map kernel physical memory to user vitrual memory
   dsm      Disassemble memory
   regs     Dump current exception registers
   i2cd     Dump I2C Device
   i2cm     Modify I2C Device
   nvmd     Dump NVRAM Device
   nvmm     Modify NVRAM Device
   nvmclr   Clear(Reset) NVRAM
   num      Print number in hex/dec/bin
   uptime   Print system up time
   pdm      XX_PRINTF() off/on control
   call     Call a function
   reset    Reset system
   mtd      Show current MTD. map info.
   cfg      Show current CFG. set value
 * orgm     Enter Org style debug menu
   ------ debugMain    ----------------------------------------
 * sys      System debug
 * test     Test basic functions
 * info     Sample hard link menu
 > gcmt     Set memory check threshold ---> gcmt@debugSystem
 > gcmo     Set memory check option  ---> gcmo@debugSystem
 > tcmo     Set memory check option(per task) ---> tcmo@debugSystem
 * soc      SOC Menu
   ============================================================
   exit     Exit from debugMain menu
1:debugMain $

WARNING! Be very carefull writing commands as you can't use delete or backspace to correct mistakes. And some commands can brick TV.

Debug menu

   help,?   Print this help message
   ============================================================
 * show     Show Various status
   ver      Show VERsion data
   sh       Excute OS shell
   md       Memory dump
   mm       Modify memory
   mf       Memory fill
   mmap     Map kernel physical memory to user vitrual memory
   dsm      Disassemble memory
   regs     Dump current exception registers
   i2cd     Dump I2C Device
   i2cm     Modify I2C Device
   nvmd     Dump NVRAM Device
   nvmm     Modify NVRAM Device
   nvmclr   Clear(Reset) NVRAM
   num      Print number in hex/dec/bin
   uptime   Print system up time
   pdm      XX_PRINTF() off/on control
   call     Call a function
   reset    Reset system
   mtd      Show current MTD. map info.
   cfg      Show current CFG. set value
 * orgm     Enter Org style debug menu
   ------ ORG MAIN     ----------------------------------------
   1        Print Mask Menu
   2        S/W Version Info
   3        Select Country Group
   10       SDEC Menu
   11       VDEC Menu
   12       VIDEO Menu
   13       ADEC Menu
   14       GFXOSD Menu
   15       Pictue Quality Driver Menu
   16       Pictue Quality MW Menu
   23       Front End Menu
   24       AUDIO DDI Menu
   25       AUDIO API Menu
   26       EMP Menu
   30       GPIO Menu
   31       I2C Menu
   32       NVM Menu
   50       Micom Menu
   51       SUMDSVC Menu
   52       FRC
   53       Fan Menu
   55       HDMISW
   56       Local Dimming
   60       SSU Menu
   80       SI Menu
   81       CM Menu
   82       CI Menu
   90       MRE Menu
   91       UTIL Menu
   92       PWM Menu
   a4       EME Menu
   a5       MLM Menu
   af       MFS Menu
   b0       SWU Menu
   b2       Autotest Menu
   e0       UI Menu
   e3       Subtitle Menu
   e4       Teletext Menu
   e5       OAE Menu
   f0       MHEG Menu
   f1       EDID Menu
   f3       Bluetooth Menu
   f6       Hotel Mode Menu
   f7       LcdModule Menu
   df       OSD Multi-Language
   d1       BSI
   d2       Show Config. Data
   d3       LED Menu
   d4       Init Tool Option from CFG file to Eeprom
   z1       REG control Menu
   ============================================================
   exit     Exit from ORG MAIN menu
1:ORG MAIN $


ver

  --------------------------------------------------------------------------------------------
 Package  Version     DateOfCompilation     builder@computer:/directory
 UserApp  V0.1.53.64  May 21 2009, 20:29:26 ainaying@swfarm-l2:/home/work/ainaying/Server_PQ/src/apps/prj/atsc_saturn5
 -------  SVN r14006
 --------------------------------------------------------------------------------------------

sh

Drops you into Busybox as root. If you aren't linux literate go get a PC linux distro and learn somewhere safe. Hint: If the 'sh' command is disabled/not present see #Busybox_shell_access.

mtd

mtd00: 00020000-00004000 bbminfo
mtd01: 00040000-00004000 boot
mtd02: 00020000-00004000 mtdinfo
mtd03: 00180000-00004000 rootfs
mtd04: 00020000-00004000 model
mtd05: 00500000-00004000 emanual
mtd06: 00400000-00004000 ezcal
mtd07: 00280000-00004000 kernel
mtd08: 00900000-00004000 lgapp
mtd09: 00380000-00004000 lgres
mtd10: 00900000-00004000 lgfont
mtd11: 00280000-00004000 kernel
mtd12: 00900000-00004000 lgapp
mtd13: 00380000-00004000 lgres
mtd14: 00900000-00004000 lgfont
mtd15: 00020000-00004000 recdb
mtd16: 00040000-00004000 system
mtd17: 00260000-00004000 user
mtd18: 00200000-00004000 reserved

Busybox shell access

On the latest firmware versions 'sh' command in debug menu is disabled. Let's try to access it:

Attempt #1

Choose your platform and type in debug shell:

Saturn 6

call debug_os_shell+0xac

Saturn 7

call debug_os_shell+0xb0

Broadcom

call debug_os_shell+0x90

Attempt #2 (by sirius)

You may try

call _exit

to get shell access. If this is successfull sadly the RELEASE executable is stopped and therefore picture on tv freezes. But you should get shell prompt then. As RELEASE is stopped you can't examine the running system in this case. You might want to mount an usb stick after exiting RELEASE with

mount /dev/sda1 /mnt/usb1/Drive1 -t vfat -o codepage=437,iocharset=utf8

Attempt #3 (by QueZt)

If you want to try things without killing RELEASE, you can try an alternative procedure to get into Busybox shell with intact RELEASE.

ATTENTION: This procedure was tested on some TVs, but it's experimental. If you get segfaults, don't repeat the process and search for a safe memory area for your TV.

Get into debug menu as usual. After F10 (debug menu command prompt) do a memory modification:

mm l 0x2b14f000 1  

mm command = modify memory, 1st param = mode (l for 32 bit edit), 2nd param = mem address to edit. I choose 0x2b14f000 becaue it's an empty area I tried and it seems to be safe in my 32LD650 with 03.20.12 FW. If this address doesn't work for you (you get segfaults), dump memory and search for a safe addr. 3rd param = count.

When done, type this:

0x00006873 

It's the string "sh" we are storing into that 32 bit address, little endian (so it's in reverse order)

Now we'll call the system function and use the address we modified as the parameter to be passed:

call system 0x2b14f000

Voila! If everything went well, you'll get the shell prompt

So if everything works this way simple copy and paste the following to your serial terminal:

mm l 0x2b14f000 1
0x00006873
call system 0x2b14f000

Attempt #4

To get into Busybox shell from debug shell on Saturn 6, you can try to use simple procedure:

Get into debug shell as usual. After F9 and F10 (debug menu command prompt) do:

mm 0x400000

and after that type: 0

RELEASE should segfault and you should get lgsw# shell prompt.

Note: Above procedure will not work on Saturn 7 and Broadcoms, because segfault instead of running the shell, leads to the showing yellow screen on the TV.

Attempt #5 (by 0x1001)

To get a shell before lginit / RELEASE is called on a Saturn 7 try the following procedure:

  • Press ESC key at boot time (during u-boot) to stop uboot boot procedure
  • Wait for Saturn 7 prompt and press enter a few times
  • Then type:
setenv bootargs init=/sbin/getty -L ttyS0 115200 root=/dev/mtdblock3 lginit=/dev/mtdblock4 rootfstype=squashfs
run bootcmd

All being well you should see the kernel start up then drop to a login prompt - enter root (no password)

Note: The init boot argument will be invoked before the lginit is invoked. At this point you must mount the MTD partitions yourself. Alternatively, invoke lginit - however you will lose you shell session as RELEASE takes over /dev/ttyS0