Partition Editing

From Openlgtv
Jump to: navigation, search

This article covers editing of read-only squashfs partitions on Linux. Theoretically you could edit/modify other than squashfs formatted partitions too. But in LG tv's the most interesting parts of the firmware are stored in squashfs partitions. The procedure is rather common for all models, althrough it's originally based on Broadcom models.

Required knowledge

For doing anything posted in this instruction you need busybox shell access and extracted firmware partitions images, so before you proceed you'll have to read How_to_backup_TV_firmware first.


Consider to leave the following partitions untouched as you could break TV unrecoverably otherwise. We don't tell you that other partitions are safe for editing, but these ones are most critical for basic hardware function to work!

Broadcom based models

mtd0: "boot"
mtd1: "mtdinfo"
mtd2: "crc32info"
mtd38: "bbminfo"
mtd39: "reserved"
mtd40: "total"
Saturn 6 based models

mtd0: "bbminfo"
mtd1: "boot"
mtd2: "mtdinfo"
Saturn 7 based models

mtd0: "bbminfo"
mtd1: "boot"
mtd2: "mtdinfo"
mtd5: "boot"
mtd6: "crc32info"

What partitions to edit

When you are in busybox shell you can list which of the mtd partitions are squashfs formatted by running the following command:


You should get result simmilar to this one:

/dev/root on / type squashfs (ro,relatime)
/dev/mtdblock4 on /mnt/lg/lginit type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
tmp on /tmp type ramfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
usbfs on /proc/bus/usb type usbfs (rw,relatime)
bt on /mnt/lg/bt type tmpfs (rw,relatime,size=10240k)
/dev/mtdblock5 on /mnt/lg/model type squashfs (ro,relatime)
/dev/mtdblock10 on /mnt/lg/res/lgres type squashfs (ro,relatime)
/dev/mtdblock12 on /mnt/lg/res/ezcal type squashfs (ro,relatime)
/dev/mtdblock13 on /mnt/lg/res/estreamer type squashfs (ro,relatime)
/dev/mtdblock14 on /usr/local type squashfs (ro,relatime)
tmpfs on /usr/local/etc type tmpfs (rw,relatime,size=1024k)
/dev/mtdblock15 on /mnt/addon type squashfs (ro,relatime)
/dev/mtdblock23 on /mnt/lg/ciplus/cert type squashfs (ro,relatime)
/dev/mtdblock24 on /mnt/lg/ciplus/authcxt type yaffs2 (rw,relatime)
/dev/mtdblock7 on /mnt/lg/cmn_data type yaffs2 (rw,noatime)
/dev/mtdblock7 on /mnt/flash/data type yaffs2 (rw,noatime)
/dev/mtdblock25 on /mnt/user type jffs2 (rw,relatime)
/dev/mtdblock16 on /mnt/game type squashfs (ro,relatime)
/dev/mtdblock17 on /mnt/cache/flash type yaffs2 (rw,noatime)
/dev/mtdblock18 on /mnt/browser type squashfs (ro,relatime)
/dev/mtdblock19 on /mnt/cache/browser type yaffs2 (rw,noatime)
/dev/mtdblock19 on /home type yaffs2 (rw,noatime)
lgapp_xip on /mnt/lg/lgapp type cramfs (ro,relatime)
/dev/mtdblock11 on /mnt/lg/res/lgfont type squashfs (ro,relatime)

Take a look at partitions mounted as squashfs.

'mtdblockXX' are just different representation of 'mtdXX' devices with the difference that 'mtdblockXX' are block devices and 'mtdXX' are character devices. 'mtdblockXX' devices are needed for mounting and only 'mtdXX' devices are used in this article for dump and flash.

Unpacking partitions

On yours Linux PC you can use Epk2extract (see Firmware_unpack_tools), a universal tool for LG TV firmware extraction, using the command:

epk2extract mtd15_addon

You should get a new directory named 'mtd15_addon.unsquashfs' with unpacked contents of this partition.

Now you can make changes to files on this partition.

Packing partitions

At the moment for partition packing you'll need 'mksquashfs' command from squashfs-tools (be sure to use version 3.1 for Saturn 6 & 7 devices and 4.0 for Broadcom platform devices!), for example this way:

mksquashfs mtd15_addon.unsquashfs mtd15_addon_mod.sqf

If you've get no errors, then 'mtd15_addon_mod.sqf' file should contain all the files from mtd15_addon.unsquashfs directory.

Be sure that the output file ('mtd15_addon_mod.sqf') is not bigger than the partition dump file ('mtd15')!

Now, put the file on USB stick, disconnect it from PC and connect it to TV.

Flashing partitions

Now the most fragile part. The partition flashing needs the following steps:

1. Preparation

For Saturn 6 & 7 devices only there is a need to adjust the image size to be multiple of 4096 bytes before flashing it. Therefore the image size must be increased accordingly by appending the appropriate number of bytes (0x00 or 0xFF).

It can be done using this command on your linux pc:

ibytes=`cat file | wc -c`; blockscount=`echo $ibytes/4096 | bc -l | cut -f1 -d. `;\
obytes=`echo \($blockscount+1\)*4096 | bc -l`; abytes=`echo $obytes-$ibytes | bc -l`;\
cp file file.flash; for i in `seq $abytes`; do printf "\xff" >> file.flash; done
  • file - input image file
  • file.flash - output file

2. Erasing

It's needed as with trying to flash without erasing first you'll get ECC errors and corrupted partition! So you have to do the following in busybox shell on tv:

flash_eraseall /dev/mtd15

Be sure that there's no error after executing this command!

You should get output simmilar to this:

Erasing 128 Kibyte @ 0 --  0 % complete."
Erasing 128 Kibyte @ 7e0000 -- 98 % complete."

and get back to shell.

3. Flashing

cat /mnt/usb1/Drive1/mtd15_addon_mod.sqf > /dev/mtd15

As in previous step, be sure that there's no error message!

After a while you should get back to the shell without any output from the command above.

That's it! Now just reboot TV using 'reboot' command and you should have modified partition contents mounted.