Exploitee.rs - User contributions [en]

Sony NSX-40GT1 (Internet TV)

2011-02-12T03:18:43Z

Abliss: ribbon cable pinout

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

# GND
# ?
# 3.3V (connected to the 4th solder pad)
# N/C
# (connected to the 4th solder pad)
# N/C (Though it is routed to a via)
# ? (normally high, but low during a reset)
# GND
# TX1 (Connected to 3rd solder pad)
# RX1 (Connected to 2nd solder pad)
# N/C
# ? (normally high, but low during a reset)
# ?
# (connected to the 4th solder pad)
# RESET
# ? (high)
# TX2 (bootloader output, 115200/8N1)
# GND

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
<pre>
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
</pre>

For a USB update to succeed, the following are necessary (but not sufficient):
# there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
# the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
# the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"
# The system/build.prop must have an ro.build.id that is greater than the current values. Otherwise you get an onscreen message saying "USB data is old".
# At '''this''' point, the signature is checked:
<pre>
package update start !
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.
dtv_sym_tv_updating.png = w: 1920, h: 1080.
Verifying..
Error in main(47):Footer Error
Signing Verify Error
Error!!
</pre>

If a valid-looking zipfile on a USB storage device is plugged in when the system goes through a normal boot, it will abort and reboot into the recovery mode.

Sony NSX-40GT1 (Internet TV)

2011-02-12T01:40:52Z

Abliss: /* USB Update */

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

Pin 1 is GND, connceted to the 1st solder pad
Pin 3 is 3.3V, it's connected to the fourth solder pad
Pin 9 is connected to the TX, 3rd solder pad
Pin 10 is connected to RX, the 2nd solder pad
Pin 15 is !RESET. Pulling it high causes the system to reset.
Pin 17 is TX for another UART. The bootloader spews this message on every reset: https://pastee.org/53vm9 . No pin echoes characters to this port.
Pin 18 is another GND.

Pins 5, 7, 12, 14, and 16 are hanging at 3.3V as if they are TX or RX for another UART. However, no pair of them echoes characters in either direction.

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
<pre>
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
</pre>

For a USB update to succeed, the following are necessary (but not sufficient):
# there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
# the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
# the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"
# The system/build.prop must have an ro.build.id that is greater than the current values. Otherwise you get an onscreen message saying "USB data is old".
# At '''this''' point, the signature is checked:
<pre>
package update start !
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.
dtv_sym_tv_updating.png = w: 1920, h: 1080.
Verifying..
Error in main(47):Footer Error
Signing Verify Error
Error!!
</pre>

If a valid-looking zipfile on a USB storage device is plugged in when the system goes through a normal boot, it will abort and reboot into the recovery mode.

User talk:Abliss

2011-02-11T23:09:56Z

Abliss:

Nice work on extending the pad! What approach are you using? I enhanced my file-crossreferencer so that in addition to knowing the valid character set of each of the six files, it understands the Intel .hex file format enough to force a colon after a definite \r\n, disallow colon if not on the line after a possible \n, disallow colon within 12 chars of a definite colon, and such. After that I've been using manual pattern searching to find standard shell script patterns in the possibilities (e.g. "| grep") and then run a manual search of the dictionary file for sequences of options that look like they could be dictionary words. A lot of brute force, but it's at least revealing the contents of the shell scripts. The tgz files would require that we figure out the pattern though.

* I have just been going one character at a time, trying to "intuit" the next character by looking at the shell scripts. Sometimes I go back and change my earlier answers once I see later bytes, and I periodically manually check the hex file for sanity and checksums. I posted my perl script on the discussion page. It's kinda fun actually, but exhausting and slow. I was toying with the idea of turning it into a MMOG so we could all collaboratively figure out the puzzle, but it's probably not worth it for the ~1kb that we'll be able to do this way. My hunch is that the pad is just the output of a standard PRNG with a 32-bit seed... perhaps with enough compute time we could brute-force it based one the first hundred bytes or so. --[[User:Abliss|Abliss]] 17:09, 11 February 2011 (CST)

Sony Update Downloads

2011-02-11T09:27:05Z

Abliss: /* Obfuscation */ updated with longer pad, 96 -> 134

== Download Links ==

[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]

[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]

[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)

== Format ==
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others. Contents are mostly obfuscated using a simple xor of some sort. A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.

== Obfuscation ==
Here are the first 134 bytes of the Sony obfuscation hash. It's applied as an xor. I haven't put much work into finding a pattern yet. Here's what I do know:
* It isn't just a static repeating pattern, or if it is then it's longer than 134 bytes before repeat.
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.
00000000 38 cf 4f aa 7a 8a 2e 3e 2b 41 82 9a ad 31 e9 dc |8.O.z..>+A...1..|
00000010 ef 47 2f 0b 26 76 12 fe 5f 5b 58 e1 10 18 7d e6 |.G/.&v.._[X...}.|
00000020 ad 92 1b 91 8e 90 69 f7 8a 9b 68 d8 98 58 fa 95 |......i...h..X..|
00000030 63 81 d6 5f 04 7d 29 8b 09 cf b9 21 b8 d9 df dd |c.._.})....!....|
00000040 c4 7e 71 d9 3f 35 ea 7b 0d ec 7f d1 a3 76 64 88 |.~q.?5.{.....vd.|
00000050 a5 8e 27 49 60 c0 a0 bc 77 54 31 e3 d6 6a bf e5 |..'I`...wT1..j..|
00000060 1b 42 25 da a3 97 b8 e1 ba 54 13 5b 68 31 da ff |.B%......T.[h1..|
00000070 1c 5c 15 46 4e 32 f1 76 50 e0 4e f3 ab 9a 28 bb |.\.FN2.vP.N...(.|
00000080 b5 cf 2f 50 24 45 |../P$E|
It could be a large random pad, as someone previously suggested. Or if we're really lucky it could just be a random number sequence accessed via knowing it's seed and which rand algorithm it's using. Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.

The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities. This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs. If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.

Here are the decoded sections of the obfuscated text files I could find. These are the same in all three versions of the Sony update that I have.

history/board_conf.sh
#!/bin/sh

chkerr()
{
ret=$?
if [ $ret -ne 0 ]; then
echo "Error!!!"
exit 1
fi
}

history/NBL/batch_sync-vfat.sh
#!/bin/sh

unset -f MOUNT

MOUNT()
{
mount | grep "$2" > /dev/null && return 0

if [ "$1"

history/other/check_spectra1_20100929.sh
#!/bin/sh

#----------------------------------
# unmount /tmp/mntx
UMOUNT()
{
mount | grep $1

history/other/factory_reset_conditional_keepremote_20101012.sh
#!/bin/sh
# last modified 2010/10/12
#
# conditional factory-reset for asura / eagle on updating.

history/other/format_sda_20100514.sh
#!/bin/sh
FDISK_HASH_8G="80dd0463e8cf28c0d2c0836408499e03 -"
FDISK_HASH_2G="fdd1d1adb5517785c3e

history/other/RfHid_v0156_2010091601_NL.hex
:020000040000FA
:0600000091EF1FF0120059
:0600080004EF04F01200F9
:060018000CEF04F01200E1
:0608

Here's a small script I wrote to apply the mask to any file. First parameter is the mask file, second is the obfuscated file. Result gets printed. Since it's an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you'd like to go that way.

#!/usr/bin/perl

use strict;
use warnings;

use IO::File;

my $file1 = shift;
die "Missing filename parameter.\n" unless defined $file1;
die "File '$file1' does not exist.\n" unless ( -f $file1 );my $fh1 = IO::File->new("< $file1") or die "Unable to open file '$file1'.\n";
my $file2 = shift;
die "Missing filename parameter.\n" unless defined $file2;
die "File '$file2' does not exist.\n" unless ( -f $file2 );my $fh2 = IO::File->new("< $file2") or die "Unable to open file '$file2'.\n";

while ( defined ( my $c1 = getc($fh1) ) )
{
my $c2 = getc($fh2);
$c2 = "\x00" unless defined $c2;
my $o = $c1 ^ $c2;
print $o;
}

Talk:Sony Update Downloads

2011-02-11T09:25:09Z

Abliss: contributing more chars of the pad (up to 134) and my script for building it out.

I worked on expanding the pad a bit. Here's the script I use.
<pre>
#!/usr/bin/perl
use strict;
package abliss;
my $start = shift;

open HEX, "<./history/other/RfHid_v0156_2010091601_NL.hex" or die;
open OUT, ">>pad.bin";
open IN, "<pad.bin";
my @files = (
"./history/NBL/batch_sync-vfat.sh",
"./history/board_conf.sh",
"./history/other/check_spectra1_20100929.sh",
"./history/other/factory_reset_conditional_keepremote_20101012.sh",
"./history/other/format_sda_20100514.sh");
my @fds;
for (my $i = 0; $i <= $#files; $i++) {
open (my $fd, $files[$i]) or die "can't open " . $files[$i];
push(@fds, $fd);
}
my @contents;

my $hexbyte;
my @hexchars = qw(0 1 2 3 4 5 6 7 8 9 A B C D E F :);
push(@hexchars, "\r");
push(@hexchars, "\n");
my @output = ();
our $xorbyte;
while (read(HEX, $hexbyte, 1)) {
for (my $i = 0; $i <= $#files; $i++) {
my $char;
if (read($fds[$i], $char, 1)) {
$contents[$i] .= $char;
if (length($contents[$i]) > 30) {
$contents[$i] = substr($contents[$i], 1);
}
}
}
if ($start-- > 0) {
my $char;
read(IN, $char, 1);
$xorbyte = ord($char);
} else {
for (my $j = 0; $j <= $#hexchars; $j++) {
$xorbyte = ord($hexbyte) ^ ord($hexchars[$j]);
my $choices = "";
my $ok = 1;
for (my $i = 0; $i <= $#files; $i++) {
my $neword = (ord(substr($contents[$i],length($contents[$i]) - 1)) ^ $xorbyte);
if ($neword > 127 ||
($neword < 32 &&
$neword != 9 && # tab
$neword != 10 && # LF
$neword != 13 # CR
)) {
$ok = 0;
#printf "==== %2d ====\n%s\n", $j, xorlastbyte($contents[$i]);
last;
}
}
if ($ok) {
printf "==== %2d ====\n%s\n", $j, join("\n--\n", map {xorlastbyte($_)} @contents);
}
}
my $answer = <STDIN>;
chomp $answer;
if ($answer eq "q") {
close OUT;
die;
}
$xorbyte = ord($hexbyte) ^ ord($hexchars[$answer]);
print OUT chr($xorbyte);
}
@contents = map {xorlastbyte($_)} @contents;
}

sub xorlastbyte {
my $content = shift;
if ($content) {
my @chars = split(//, $content);
$chars[-1] = chr(ord($chars[-1])^ $xorbyte);
return join('', @chars);
}
}
</pre>

Here's my pad, 134 chars:
<pre>
00000000 38 cf 4f aa 7a 8a 2e 3e 2b 41 82 9a ad 31 e9 dc |8.O.z..>+A...1..|
00000010 ef 47 2f 0b 26 76 12 fe 5f 5b 58 e1 10 18 7d e6 |.G/.&v.._[X...}.|
00000020 ad 92 1b 91 8e 90 69 f7 8a 9b 68 d8 98 58 fa 95 |......i...h..X..|
00000030 63 81 d6 5f 04 7d 29 8b 09 cf b9 21 b8 d9 df dd |c.._.})....!....|
00000040 c4 7e 71 d9 3f 35 ea 7b 0d ec 7f d1 a3 76 64 88 |.~q.?5.{.....vd.|
00000050 a5 8e 27 49 60 c0 a0 bc 77 54 31 e3 d6 6a bf e5 |..'I`...wT1..j..|
00000060 1b 42 25 da a3 97 b8 e1 ba 54 13 5b 68 31 da ff |.B%......T.[h1..|
00000070 1c 5c 15 46 4e 32 f1 76 50 e0 4e f3 ab 9a 28 bb |.\.FN2.vP.N...(.|
00000080 b5 cf 2f 50 24 45 |../P$E|
</pre>

I checked the checksums in the .hex file and they all validate so far.

Sony NSX-40GT1 (Internet TV)

2011-02-11T06:38:20Z

Abliss: /* USB Update */

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

Pin 1 is GND, connceted to the 1st solder pad
Pin 3 is 3.3V, it's connected to the fourth solder pad
Pin 9 is connected to the TX, 3rd solder pad
Pin 10 is connected to RX, the 2nd solder pad
Pin 15 is !RESET. Pulling it high causes the system to reset.
Pin 17 is TX for another UART. The bootloader spews this message on every reset: https://pastee.org/53vm9 . No pin echoes characters to this port.
Pin 18 is another GND.

Pins 5, 7, 12, 14, and 16 are hanging at 3.3V as if they are TX or RX for another UART. However, no pair of them echoes characters in either direction.

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
<pre>
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
</pre>

For a USB update to succeed, the following are necessary (but not sufficient):
# there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
# the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
# the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"
# The system/build.prop must have an ro.build.id that is greater than the current values. Otherwise you get an onscreen message saying "USB data is old".
# At '''this''' point, the signature is checked:
<pre>
package update start !
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.
dtv_sym_tv_updating.png = w: 1920, h: 1080.
Verifying..
Error in main(47):Footer Error
Signing Verify Error
Error!!
</pre>

Sony NSX-40GT1 (Internet TV)

2011-02-11T06:37:35Z

Abliss: /* USB Update */

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

Pin 1 is GND, connceted to the 1st solder pad
Pin 3 is 3.3V, it's connected to the fourth solder pad
Pin 9 is connected to the TX, 3rd solder pad
Pin 10 is connected to RX, the 2nd solder pad
Pin 15 is !RESET. Pulling it high causes the system to reset.
Pin 17 is TX for another UART. The bootloader spews this message on every reset: https://pastee.org/53vm9 . No pin echoes characters to this port.
Pin 18 is another GND.

Pins 5, 7, 12, 14, and 16 are hanging at 3.3V as if they are TX or RX for another UART. However, no pair of them echoes characters in either direction.

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
<pre>
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
</pre>

For a USB update to succeed, the following are necessary (but not sufficient):
# there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
# the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
# the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"
# The sstem/build.prop must have an ro.build.id that is greater than the current values. Otherwise you get an onscrean message saying "USB data is old".
After this, it appears to fail silently.
# At '''this''' point, the signature is checked:
<pre>
package update start !
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.
dtv_sym_tv_updating.png = w: 1920, h: 1080.
Verifying..
Error in main(47):Footer Error
Signing Verify Error
Error!!
</pre>

Sony NSX-40GT1 (Internet TV)

2011-02-11T05:58:14Z

Abliss: /* Serial Console */

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

Pin 1 is GND, connceted to the 1st solder pad
Pin 3 is 3.3V, it's connected to the fourth solder pad
Pin 9 is connected to the TX, 3rd solder pad
Pin 10 is connected to RX, the 2nd solder pad
Pin 15 is !RESET. Pulling it high causes the system to reset.
Pin 17 is TX for another UART. The bootloader spews this message on every reset: https://pastee.org/53vm9 . No pin echoes characters to this port.
Pin 18 is another GND.

Pins 5, 7, 12, 14, and 16 are hanging at 3.3V as if they are TX or RX for another UART. However, no pair of them echoes characters in either direction.

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
[code]
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
[/code]

For a USB update to succeed, the following are necessary (but not sufficient):
1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"

After this, it appears to fail silently.

Sony NSX-40GT1 (Internet TV)

2011-02-10T21:33:44Z

Abliss:

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp I have not yet been able to transmit anything useful.

On the ribbon cable, if we number the pins starting at 1 on the bottom left, pin 9 is the same as TX below; pin 10 is the same as RX below. Pins 7, 12, 14, 16, and 17 are pulled high when the TV is on, so some of them could be RX/TX pins for other uarts. I didn't seem to see any traffic on them during boot though. --[[User:Abliss|Abliss]] 13:40, 10 February 2011 (CST)

Looks like pin 17 is TX for another UART: https://pastee.org/53vm9

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
[code]
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
[/code]

For a USB update to succeed, the following are necessary (but not sufficient):
1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"

After this, it appears to fail silently.

Sony NSX-40GT1 (Internet TV)

2011-02-10T21:27:11Z

Abliss: /* Serial Console */

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp I have not yet been able to transmit anything useful.

On the ribbon cable, if we number the pins starting at 1 on the bottom left, pin 9 is the same as TX below; pin 10 is the same as RX below. Pins 7, 12, 14, 16, and 17 are pulled high when the TV is on, so some of them could be RX/TX pins for other uarts. I didn't seem to see any traffic on them during boot though. --[[User:Abliss|Abliss]] 13:40, 10 February 2011 (CST)

Looks like pin 17 is TX for another UART: http://www.gtvhacker.com/index.php/Sony_NSX-40GT1_%28Internet_TV%29

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
[code]
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
[/code]

For a USB update to succeed, the following are necessary (but not sufficient):
1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"

After this, it appears to fail silently.

Sony NSX-40GT1 (Internet TV)

2011-02-10T21:06:35Z

Abliss:

{{Disclaimer}}
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]

== Recovery Mode ==
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]

#Have everything plugged into the unit except the power coord. Have the power coord in your hand.
#Press and hold the power button and plug the unit in.
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
#You can now press the numbers assigned to the commands!

== Serial Console ==
The Sony NSX series TVs have an easy-open debug port on the back:

[[File:Nsxgtvport.jpg]]

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is a UART: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp I have not yet been able to transmit anything useful. --[[User:Abliss|Abliss]] 13:05, 10 February 2011 (CST)

On the ribbon cable, if we number the pins starting at 1 on the bottom left, pin 9 is the same as TX below; pin 10 is the same as RX below. Pins 7, 12, 14, 16, and 17 are pulled high when the TV is on, so some of them could be RX/TX pins for other uarts. I didn't seem to see any traffic on them during boot though. --[[User:Abliss|Abliss]] 13:40, 10 February 2011 (CST)

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following:
[code]
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
[/code]

For a USB update to succeed, the following are necessary (but not sufficient):
1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"

After this, it appears to fail silently.

Sony NSX-40GT1 (Internet TV)

2011-02-10T20:43:53Z

Abliss:

Sony NSX-40GT1 (Internet TV)

2011-02-10T20:20:10Z

Abliss:

Sony NSX-40GT1 (Internet TV)

2011-02-10T19:40:11Z

Abliss:

Sony NSX-40GT1 (Internet TV)

2011-02-10T19:05:07Z

Abliss: Add info on debug port, dmesg dump

File:Nsxgtvport.jpg

2011-02-10T19:01:12Z

Abliss: uploaded a new version of "File:Nsxgtvport.jpg"

Picture of the debug port on the back of Sony NSX-series Google TVs

File:Nsxgtvport.jpg

2011-02-10T18:59:02Z

Abliss: Picture of the debug port on the back of Sony NSX-series Google TVs

Picture of the debug port on the back of Sony NSX-series Google TVs