VistaBug forums

I purchased LN52A650 yesterday and I  couldn't wait to see what's inside.  Luckily for me, Samsung posted firmware upgrade for the 650 series. at http://www.samsungsupport.com/650/ so i did not have to take the TV apart.

I downloaded the firmware and unpacked it. It runs linux (2.6.18 ARM kernel) and it is hackable!

You can easily customize all bitmaps, sounds, and text strings.

For those interested in exploring this further:

The firmware images use squashfs filesystem. To mount them you need to add squashfs support to your favorite linux distribution.

The firmware comes as a set of images:

chip.img stores kernel module for samsung chips. Lots of debug info available.

boot.img contains scripts to initialize the following modules:
8139too.ko
cs89x0.ko
ehci-hcd.ko
ohci-hcd.ko
rfs.ko
rt73.ko
usb-storage.ko
usbcore.ko
xsr.ko
xsr_stl.ko

exe.img contains a huge executable file (main TV application, also lots of debuginfo):
-rwxr-xr-x 1 1007 100 12418868 2008-04-30 00:44 exeDSP
It may be possible to replace this application with the one from 8 series (and newer)  to get more functionality.

rootfs.img is the OS (busybox-based) No telnet/ssh available (darn!), however, getty runs passwordless shell on a serial port (should be available inside the TV). /etc/passwd contains this:

root::0:0:root:/root:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
lp:*:5:7:lp:/var/spool/lpd:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
mail:*:9:11:mail:/var/spool/mail:
news:*:10:12:news:/var/spool/news:
uucp:*:11:13:uucp:/var/spool/uucp:
operator:*:12:0:operator:/root:
games:*:13:100:games:/usr/games:
ftp:*:15:14:ftp:/var/ftp:
man:*:16:100:man:/var/cache/man:
telnetd:*:17:100:telnetd:/var/tmp:
nobody:*:65534:65534:nobody:/home:/bin/sh

Root directory:

-rw-r--r--  1 1010 100   16 2008-04-09 21:59 0417
drwxrwxrwx  2 1010 100  456 2008-02-03 19:33 bin
drwxrwxrwx  9 1010 100  666 2008-01-01 18:17 dev
drwxrwxrwx  2 1010 100    3 2007-09-19 23:43 dtv
drwxrwxrwx  5 1010 100  300 2008-04-16 16:00 etc
drwxrwxrwx  2 1010 100    3 2007-07-12 05:38 home
-rwxrwxrwx  1 1010 100   10 2008-04-09 22:46 .info
drwxrwxrwx  3 1010 100  991 2007-12-06 22:04 lib
drwxrwxrwx  2 1010 100    3 2007-08-29 00:13 mnt
drwxrwxrwx  2 1010 100    3 2007-08-23 10:51 mtd_appdata
drwxrwxrwx  2 1010 100    3 2007-09-20 22:35 mtd_boot
lrwxrwxrwx  1 1010 100   11 2008-04-16 03:50 mtd_chmap -> mtd_rwarea/
drwxrwxrwx  2 1010 100    3 2007-09-30 18:27 mtd_contents
drwxrwxrwx  2 1010 100    3 2007-08-23 01:05 mtd_drv
lrwxrwxrwx  1 1010 100   11 2008-04-16 03:50 mtd_epg -> mtd_rwarea/
drwxrwxrwx  2 1010 100    3 2007-08-16 01:02 mtd_exe
drwxrwxrwx  2 1010 100   38 2007-09-17 19:32 mtd_rwarea
drwxrwxrwx  2 1010 100    3 2007-05-25 00:05 proc
drwxrwxrwx  3 1010 100  378 2008-04-16 15:59 sbin
drwxrwxrwx  3 1010 100   23 2008-02-01 22:18 share
drwxrwxrwx  2 1010 100    3 2007-05-25 00:04 sys
drwxrwxrwx  2 1010 100    3 2007-05-25 00:04 tmp
drwxrwxrwx  2 1010 100    3 2008-02-01 22:13 usb
drwxrwxrwx  6 1010 100   47 2008-01-01 17:49 usr

We should expect java support in the newer models. These are from Samsung's rc.local (java partition is not currently used):

mount -t squashfs  $EXE_PARTITION /mtd_exe/
mount -t squashfs  $APPDATA_PARTITION /mtd_appdata/
#mount -t squashfs  $JAVA_PARTITION /Java/
mount -t squashfs  $CHIP_PARTITION /mtd_drv/


I do not have time to continue with this, but I hope this inspires somebody else.

Everything described here should apply to all 5 through 9 series samsung LCDs, including:
5-series: LN40A550 LN46A550 LN52A550
6-series: LN40A650 LN46A650 LN52A650
7-series: LN46A750 LN52A750
8-series: LN46A850 LN52A850
9-series: LN46A850 LN55A950
... and others.

Last edited by fearwall (2008-09-10 15:13:27)