Specialists in region free dvd codes, blu-ray, pc dvd unlock software, movie secrets, replacement dvd cover art & dvd copy software.
Root my TV: Hack Philips PFL9. Do you want to control your TV and your devices smart?
Take a look at this Kickstarter campaign. I try to get root access on my Philips PFL9. TV. Why? don’t ask…The TV runs a 2.
MIPS3. 2 2. 40. MHz CPU, compiled with a Monta. Vista toolchain. I need YOUR help to root the Philips TV! Please write a comment (end of the article) or email me if you have any hints, thanks! RC triggered service modes: Customer Service Mode (CSM): 1. Insert USB stick, put the remote in DVD mode and press 2. USB stick (binary). Service Alignment Mode (SAM): 0.
I didn’t find a option to enable the serial console! Service Default Mode (SDM): 0. Purpose: To create a pre- defined setting, to get the same measurement results as given in the service manual. Manual software upgrade: Disconnect the TV from the AC Power, press + hold the OK button of the RC and connect set to mains. Back- up Software Upgrade Application: Disconnect the TV from the AC Power, press + hold the INFO button (or cursor down) of the RC and connect set to mains. Jett mode: Disconnect the TV from the AC Power, switch to DVD RC, press + hold the INFO button and connect set to mains.
Now you TV is in the Jett mode – but we need some files now, which are NOT available! We should create a directory on the root of the USB drive which is called JETTFILES and put two files called “Memory. Test. PNX8. 63. 5. Those files are part of a software package called “TESTSCRIPT Q5. I guess in this mode, serial access *could* be possible, however the protocol will change, as there is only binary stuff visible after the bootloader tries to load the kernel. This could be a side effect of the missing JETTFILES, but I’m not sure.
Perhaps some kind of 3 Wire SPI mode? See “Serial Port dumps” below. Philips write about this in the service manual: – Install the computer program “BOARDTESTLOGGER” (available in “TESTSCRIPT Q5. PC– Connect a “Com. Pair/service”- cable from the service- connector in the set to the COM1- port of the PC– Start- up the program “BOARDTESTLOGGER” and select “COM1”– Put the USB stick into the TV and start- up the TV while pressing the “i+”- button on a Philips DVD RC6 remote control (it’s also possible to use a TV remote in “DVD”- mode)– On the PC the memory test is shown now. This is alsovisible on the TV screen.– In “BOARDTESTLOGGER” an option “Send extra UART command” can be found where the “AUD1” can be selected.
This command generates hear test tones of 2. Hz. Serial Port access.
To access the serial port of the TV you need a EIB cable – basically a serial (db. This is my professional EIB cable ; )Terminal settings: 3.
Baud 8. N1. Web Server: On port 8. Web Server, more precisely a Allegro- Software- Rom. Pager/4. 6. 1. There is only a test page visible: 1. Rom. Pager. Embedded Web Server.
First Page. The value of the test variable is: Hello World! Some basic tests: 1. GET / HTTP/1. 1rn. Host: '"1. 92. 1. Authenticate: " . A' x 1. 02. 4 . "rnrn"' nc "1.
HTTP/1. 1 4. 00 Bad Request. Content- Length: 0. Server: Allegro- Software- Rom.
Pager/4. 6. 1. Connection: closebash- 3. GET / HTTP/1. 1rn. Host: '"1. 92. 1. HTTP/1. 1 2. 00 OKContent- Type: text/html.
DVD PLAYERS: All DVD Players listed are 110-220 volts multisystem, multiregion, codefree zone free and come with 1 year INTERNATIONAL WARRANTY, If you have any. Hack Details for your PHILIPS DVD, Blu-Ray or HD DVD Player PHILIPS HTS 3100 Press stop until disk tray ejects then pressing 99990 and thats it all done.
Date: Sat, 0. 1 Jan 2. GMTCache- Control: no- cache.
Title Make Your DVD Player Region Free This information sold on eBay as Dvd Unlocker - Unlock your DVD 1000+ CODES Multiregion UNLOCK YOUR DVD PLAYER - make it MULTI. Unlock Philips DVD players - DVD hack Philips 14PT6107 / 15PT6807. Press 062596, MENU in TV mode; Select 'DVD' Press ENTER; Select 'Region' Enter 0 for multi-region. Buy the DVD region Unlocker crack codes software and make your player region free. Complete list to unlock most dvd region codes in seconds! Do you want to control your TV and your devices smart? Take a look at this Kickstarter campaign. I try to get root access on my Philips PFL9703 TV.
Expires: Thu, 2. 6 Oct 1. GMTTransfer- Encoding: chunked. Server: Allegro- Software- Rom. Pager/4. 6. 1I didn’t find and vulnerability/information about this webserver…Firmware: Get the firmware here http: //philips.
The firmware is encrypted, with some help from the www. I was more or less able to get the firmware header (first 7. SWU" */uint. 32_t magic. TXV" - magic[i] + 1 */uint. Str /* Q5. 91. E- 0. 1. 00. 0. 0_commercial */}; Those 1. This block is different in each firmware version!
Someone in the hifi- forum wrote, that the firmware is encrypted AND signed, but this is unconfirmed! Edit 1. 3. 2. 0. 9: The Firmware is encrypted AND signed, see comment #1. Other users observed, that there are quite a lot of repeating patterns in the firmware. An interesting idea is to search for JFFS2 inodes magic bytes (8. Varon thinks, that the firmware (or parts of it) are encrypted with a 1. Here is a hexdump of the firmware header: 1.
SWU3. TXV.. 8.. 0. Pb..`.... 0. 00. 00. Release for TV5. 2 0.
R2. Q5. 91. E- 0. Generatio 0. 00. 00. Z. JIL.. O... 0. 00. H. b. 0. 00. 00. 24. M 0. 00. 00. 25. 0 2.
M[F)....! 0. 00. 00. J. d. A. b. V. t. 0. Jk.... z. N.+g 0. L. 7. 0. 00. 00. 2a. KIM..`. 0. 00. 00.
Q5. 91. E- 0. 1. 00. I checked the firmware with draca: 1. DRACA. Draft Crypto Analyzer.
Version 0. 5. 7b by Ilya O. Levin. Preliminary detection and analysis of crypto algorithms within executables. File: . autorun. upg, 2. AES/Rijndael - 9%. Twofish - 1. 7%total 2 algorithm(s) recognized. Edit 1. 3. 2. 0. 9: I guess those results are useless because draca is searching for crypto constants in the firmware – which do simply not exist there. Philips also released source code of the parts of Philips TV software that fall under open source licenses.
Here is the firmware layout (in the flash, not the upgrade file): Attack Vectors: 1) decode firmware, modify and repack. S1. 4) find a secret key combo to activate the terminal (aka deactivate philps industrial mode)Useful links: General Information: http: //www. Firmware Mirror: http: //philips. Jointspace Project: jointspace project. Service Manuals: http: //www.
Philips- Ch- q. 52. Lbhttp: //www. ayslearningcentre. Training%2. 0Material/TV/tv. Serial Port dumps: Jett mode: 1. Jan 1. 6 2. 00. 8 1. Boot device. ST NAND5.
W3. A. OKSearching Boot. Loader. tdf. Load /bffs. Boot. Loader. tdf- Done.
Start /bffs. 0/Boot. Loader. tdf. JBL (boottime improvement. Boot. Loader OS_R0. Feb 2. 5 2. 00. 8 1. Searching boot. bat.
Execute /bffs. 2/boot. Execute /bffs. 1/boot. SR5- > Fact JETT* On error goto 7.
Load /bffs. 1/Kernel. Load /bffs. 1/RFSBoot. Mem. Fill 0x. 87fff. Signal 3. 0* Cmd Line. CMD_LINE arguments passed by JBL : console=tty.
S1,3. 84. 00n. 8 mem=1. M kgdb=tty. S1 loglevel=3 init=/init ip=none root=/dev/ram lpj=1.
Start /bffs. 1/Kernel. TV Boot: 1. 23. 45. Jan 1. 6 2. 00. 8 1.
Boot device. ST NAND5. W3. A. OKSearching Boot. Loader. tdf. Load /bffs. Boot. Loader. tdf- Done. Start /bffs. 0/Boot.
Loader. tdf. JBL (boottime improvement. Boot. Loader OS_R0. Feb 2. 5 2. 00. 8 1. Searching boot. bat. Execute /bffs. 2/boot.
SR1- > Coldboot* On error goto 6. Load /bffs. 2/atv.
Tm. 0App. tdf - ok* Load /bffs. Pnx. 51xx. App. tdf - ok* Load /bffs. Download. TM0. tdf - ok* Starting early. Start. TM* Load /bffs.
Pnx. 51xx. Co. App_tm. Load /bffs. 3/tmvpr. Pnx. 51xx. Co. App_tm.
Load /bffs. 2/Kernel. Mem. Fill 0x. 87fff. Signal 3. 0* Cmd Line. CMD_LINE arguments passed by JBL : console=tty.
S0,3. 84. 00n. 8 mem=4. M kgdb=tty. S1 loglevel=3 root=/dev/mtdblock. Start /bffs. 2/Kernel. EU/9. 2 startup script ..""Mounting file systems"Total usertime mount for /proc: 0,0. Sec]Total systemtime mount for /proc: 0,0. Sec]Total usertime mount for /sys: 0,0.
Sec]Total systemtime mount for /sys: 0,0. Sec]Total usertime mount for /dev/shm: 0,0. Sec]Total systemtime mount for /dev/shm: 0,0. Sec]Total usertime mount for /dev/pts: 0,0.
Sec]Total systemtime mount for /dev/pts: 0,0. Sec]"Mounting the flash file systems"Total usertime mount for /mnt/jffs.
Sec]Total systemtime mount for /mnt/jffs. Sec]"Loading PNX5.
Image""Launching TV application"Using errlib version 0. Errlib communication with plfapp failed, will retry laterredirecting 1 to 1. MB memory on board. MB memory MAP0. 0 0.
NO0. 0 0. 02. 4. 67 Standby version 3. Expected standby version 3. Init clearing m_Init. Done. Blunk. 00 0.
Using errlib version 0. Errlib 0. 9 registered from process 1. Reference timestamp. Mount check passes, 0 iterations- 1 0. Fusion. Dale/Config: Parsing config file '/etc/fusiondalerc'.- 1 0. Fusion. Dale v. 0.
Fusion/SHM: NOT using MADV_REMOVE (2. Direct/Thread: Running 'Fusion Dispatch' (MESSAGING, 1. App : Init. Fusion. Dale- 1 0. 02. 5. Errlib communication with plfapp failed, will retry later. Errlib 0. 9 registered from process 1.
Layoutcheck OK0. 0 0. Display flash file : Layout version = 8 ; Content version = 2. Display flash file : Project Id = 1 ; Branch Id = 5. DISPT_0. 01. 0. 58. Fusion. Dale v. 0.
Using screen option 1. LCD LGD WUF SAC1 4. Diversity: Board. Type=/9. 2, Board. Version=3, Detected pnx. M2. 00 0. 02. 8. 58 Ambient.
Light. Generator : None. Ambient. Light. Mode : Triple. Ambient. Light. Technology : Led.
Cabinet. Number : 3. Channel. Decoder. Type : Tda. Channel. Decoder. Type : None. Clear. Lcd. Supported : False. Dimming. Backlight.
Supported : True. Display. Delay. Compensation : 3. Display. Raw. Number : 1.
Dvb. Hd. Supported : False. Epld. Present : True. HDMIMux. Present : Mux. HDMISide. Present : True. If. Dem. Version : V2. Light. Sensor : Present.
Light. Sensor. Type : Aura. Sti. 71. 00. Present : False. Pacific. Present : False. Region : Europe. Pnx. 50. 50. Present : False. Pnx. 51. 00. Present : True. Saw. Version : New.
IF Mode (DVB- C) : Direct IF0. Tuner. I2c. Config : Via. Channel. Decoder. Tuner. Type : 2. Phil. Td. 17. 16. F)- 1 0. 02. 9. 77 am. App: Platform returned wakeup reason [src: 0, sys: 0, cmd: 4]- 1 0.
RU Flash file not found in /mnt/jffs. RO Flash file not found in /mnt/jffs. Local flash file not found in file/cabinet.
RU Flash file found in /mnt/jffs. Cabinet flash file : Layout version = 4 ; Content version = 8.
Cabinet flash file : Project Id = 1 ; Branch Id = 0. ACSTS_0. 01. 0. 00. App : Init. Direct. FB- 1 0. 03. 2. 79 Grabbing keyboard- 1 0. Ungrabbing keyboard- 1 0. App : Init. Sa. WMan- 1 0. App. Man: Process added (1.
App. Man: Process added (1. App. Man: Window added (0,0- 1x. Using cabinet option 3, name VE8 A_Normal. Bass. 00 0. 03. 4. PQ private flash file : Layout version = 8 ; Content version = 9. PQ private flash file : Project Id = 1 ; Branch Id = 0. PRFPV_0. 01. 0. 00.
SHINCO. audiovox COBY NEXT SDAT GO VIDEO.