Difference between revisions of "Sony NSX-40GT1 (Internet TV)"

From Exploitee.rs
Jump to navigationJump to search
 
(15 intermediate revisions by 5 users not shown)
Line 2: Line 2:
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]
[[File:Sony_NSX-40GT1.jpg|250px|left|thumb]]


==Specs==
* [[Intel Atom CE4170]]


== Recovery Mode ==
== Recovery Mode ==
Line 18: Line 20:
[[File:Nsxgtvport.jpg]]
[[File:Nsxgtvport.jpg]]


Presumably the beige connector is for a custom ribbon cable.  The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V.  If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp  I have not yet been able to transmit anything useful.  
Presumably the beige connector is for a custom ribbon cable.  The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V.  If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp  .  This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.


Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np [[nsx-40gt1 uart log]]


On the ribbon cable, if we number the pins starting at 1 on the bottom left, pin 9 is the same as TX below; pin 10 is the same as RX below.  Pins 7, 12, 14, 16, and 17 are pulled high when the TV is on, so some of them could be RX/TX pins for other uarts. I didn't seem to see any traffic on them during boot though. --[[User:Abliss|Abliss]] 13:40, 10 February 2011 (CST)
On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.


Looks like pin 17 is TX for another UART: https://pastee.org/53vm9
# GND
                                                     
# ?
# 3.3V (connected to the 4th solder pad)
# N/C
# (connected to the 4th solder pad)
# N/C (Though it is routed to a via)
# ? (normally high, but low during a reset)
# GND
# TX1 (Connected to 3rd solder pad)
# RX1  (Connected to 2nd solder pad)
# N/C
# ? (normally high, but low during a reset)
# ?
# (connected to the 4th solder pad)
# RESET
# ? (high)
# TX2 (bootloader output, 115200/8N1)
# GND


Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np
== USB Update ==
The steps to access recovery mode are listed in the "Recovery Menu" section at the top of this page. Also, a list of OTA sony downloads can be found [http://gtvhacker.com/index.php/Sony_Update_Downloads#Download_Links Here]


== USB Update ==
In recovery mode, any USB storage device will be automounted when inserted.  If it's inserted at the start of recovery mode, the device will attempt to do a USB update.  This executes the following:
In recovery mode, any USB storage device will be automounted when inserted.  If it's inserted at the start of recovery mode, the device will attempt to do a USB update.  This executes the following:
[code]
<pre>
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip
[/code]
</pre>


For a USB update to succeed, the following are necessary (but not sufficient):
For a USB update to succeed, the following are necessary (but not sufficient):
1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
# there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched:  system/build.prop"
# the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched:  system/build.prop"
3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched:  package_list_*.txt"
# the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched:  package_list_*.txt"
# The system/build.prop must have an ro.build.id that is greater than the current values.  Otherwise you get an onscreen message saying "USB data is old".
# At '''this''' point, the signature is checked:
<pre>                           
package update start !                                                         
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'. 
dtv_sym_tv_updating.png = w: 1920, h: 1080.                                   
Verifying..                                                                   
Error in main(47):Footer Error                                                 
Signing Verify Error                                                           
Error!!       
</pre>
 
If a valid-looking zipfile on a USB storage device is plugged in when the system goes through a normal boot, it will abort and reboot into the recovery mode.
 
== Device Menus ==
Information can be found on the system menus at: [[Sony Settings Menus]]
 
== GPL Code ==
Code for the first gen Sony TV's can be found [http://www.sony.net/Products/Linux/TV/NSX-24GT1.html here]
 


After this, it appears to fail silently.
[[Category:Google TV]]
[[Category:Sony NSX-40GT1]]
[[Category:Sony]]

Latest revision as of 02:15, 4 January 2017

"Although the information we release has been verified and shown to work to the best our knowledge, we cant be held accountable for bricked devices or roots gone wrong."

Sony NSX-40GT1.jpg

Specs

Recovery Mode

Apeman42 from XDA Developers found Recovery Menu

  1. Have everything plugged into the unit except the power coord. Have the power coord in your hand.
  2. Press and hold the power button and plug the unit in.
  3. Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
  4. Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
  5. After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
  6. You can now press the numbers assigned to the commands!

Serial Console

The Sony NSX series TVs have an easy-open debug port on the back:

Nsxgtvport.jpg

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp . This port echoes characters (if hardware flow control is off) but seems to totally ignore all incoming characters.

Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np nsx-40gt1 uart log

On the ribbon cable connector, number the pins from 1 on the (lower) left side to 18 on the (upper) right side.

  1. GND
  2. ?
  3. 3.3V (connected to the 4th solder pad)
  4. N/C
  5. (connected to the 4th solder pad)
  6. N/C (Though it is routed to a via)
  7. ? (normally high, but low during a reset)
  8. GND
  9. TX1 (Connected to 3rd solder pad)
  10. RX1 (Connected to 2nd solder pad)
  11. N/C
  12. ? (normally high, but low during a reset)
  13. ?
  14. (connected to the 4th solder pad)
  15. RESET
  16. ? (high)
  17. TX2 (bootloader output, 115200/8N1)
  18. GND

USB Update

The steps to access recovery mode are listed in the "Recovery Menu" section at the top of this page. Also, a list of OTA sony downloads can be found Here

In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following: 

cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_"
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip

For a USB update to succeed, the following are necessary (but not sufficient):

  1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !"
  2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop"
  3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"
  4. The system/build.prop must have an ro.build.id that is greater than the current values. Otherwise you get an onscreen message saying "USB data is old".
  5. At this point, the signature is checked:
                            
package update start !                                                          
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1
(*) Direct/Interface: Loaded 'PNG' implementation of 'IDirectFBImageProvider'.  
dtv_sym_tv_updating.png = w: 1920, h: 1080.                                     
Verifying..                                                                     
Error in main(47):Footer Error                                                  
Signing Verify Error                                                            
Error!!

If a valid-looking zipfile on a USB storage device is plugged in when the system goes through a normal boot, it will abort and reboot into the recovery mode.

Device Menus

Information can be found on the system menus at: Sony Settings Menus

GPL Code

Code for the first gen Sony TV's can be found here

Retrieved from "http://www.Exploitee.rs/index.php?title=Sony_NSX-40GT1_(Internet_TV)&oldid=2640"