Hi,
I've got a Toshiba 32L2963DG (10124529) for repair and I'd like to share some info that I gathered so far. I don't usually repair TV's, so I'm exploring this new field. The TV randomly restarts while playing DVB-T2 or stops responding to remote control. It was connected to a wifi but internet apps were never used. Backlight LEDs were replaced in past by me. All voltages are stable, capacitors look fine.
The main board is Vestel 17MB211S with Novatek SoC (ARMv7), TC58NVG2S0HTA00 NAND memory (4Gbit) and 25Q16JVSIQ SPI memory (16Mbit). I started the diagnosis by connecting to the UART console. This requires installing two resistors (R3011, R3012, very close to the VGA connector, see schematic) to connect the Novatek's UART to pins 10 (RX) and 12 (TX) of SCART, which is hidden under the block of three Cinch connectors. It uses 0/3.3V levels where 3.3V is the idle state (not RS232-compatible), baud rate is 115200. In service menu, Diagnostic/Uart Rx must be enabled to make full use of the console.
By typing hash (#) and pressing enter, linux shell can be opened. It's also possible to run a telnetd server for more comfortable access:
and an anonymous FTP server to transfer files:
The NAND flash is partitioned according to the kernel command line argument:
and can be accessed through /dev/mtdX devices (nanddump and nandwrite commands can be used). For each 4096-byte page, the chip has a 256-byte out-of-band block for CRC. On this board, it seems that only a 128-byte CRC per page is used. This is handled transparently (by the hardware, I think), but nanddump is also able to read data without CRC correction.
Some partitions (xboot, uboot, ker0, ker1, ...) are raw data. Read-only filesystems (fs0, ap0, ap1) use squashfs inside UBI, read-write filesystems (apdat0, buffer) use ubifs inside UBI.
When reading the partitions using nanddump, quite a lot of bit-flips were reported, and any attempt to read "misc" partition immediately triggered kernel fault and restart:
From this I conclude that the NAND memory is either corrupted or faulty. I did find what seems to be the proper firmware:
http://televid-sib.ru/index.php?topic=116720.0
But when I copy these files to a USB stick and hold OK on the remote while plugging the TV in, nothing happens, it just starts normally.
I can't see any messages from u-boot on the console. The first few lines come from the SPI firmware, immediately followed by the messages from the kernel starting, nothing in between. BTW, looking at the SPI memory contents, it's obviously not ARM code, it must be something that runs on an embedded controller inside of Novatek SoC. I haven't found what kind of architecture it is.
The shredder_usb_update.bin is encrypted with aes-128-ecb. After spending some time with Ghidra, studying the "uboot" partition that I downloaded from the TV, I found the key there. It's getting written to some registers, which means the Novatek chip has a hardware encryption module. I could not find any datasheet from Novatek.
So the firmware binary can be decrypted like this:
Meanwhile, doing some tests with nandwrite, I probably messed the CRCs in one of the partitions, so the TV doesn't start at all, the kernel just crashes after a few seconds. This would be easily recoverable if the USB reflash was working, but it is not and I don't know why. So I ordered a TSOP48 NAND programmer and will continue my attempts when it arrives.
Of course, this kind of repair doesn't make any economical sense for such a cheap TV, this is just my curiosity and refusal to give up 😁
I've got a Toshiba 32L2963DG (10124529) for repair and I'd like to share some info that I gathered so far. I don't usually repair TV's, so I'm exploring this new field. The TV randomly restarts while playing DVB-T2 or stops responding to remote control. It was connected to a wifi but internet apps were never used. Backlight LEDs were replaced in past by me. All voltages are stable, capacitors look fine.
The main board is Vestel 17MB211S with Novatek SoC (ARMv7), TC58NVG2S0HTA00 NAND memory (4Gbit) and 25Q16JVSIQ SPI memory (16Mbit). I started the diagnosis by connecting to the UART console. This requires installing two resistors (R3011, R3012, very close to the VGA connector, see schematic) to connect the Novatek's UART to pins 10 (RX) and 12 (TX) of SCART, which is hidden under the block of three Cinch connectors. It uses 0/3.3V levels where 3.3V is the idle state (not RS232-compatible), baud rate is 115200. In service menu, Diagnostic/Uart Rx must be enabled to make full use of the console.
By typing hash (#) and pressing enter, linux shell can be opened. It's also possible to run a telnetd server for more comfortable access:
Code:
mkdir /dev/pts mount -t devpts none /dev/pts telnetd -l /bin/sh
Code:
tcpsvd -vE 0.0.0.0 21 ftpd -a root /
Code:
mtdparts=nvt_nand:768k(xboot),768k(ddrcfg),768k(ddrbud),768k(xbootdat),2304k(misc),3584k(secos),1280k(uboot),768k(fdt0),768k(fdt1),7168k(ker0),17408k(ker1),20480k(fs0),184320k(ap0),20480k(ap1),40960k(apdat0),218112k(buffer),2560k(logo)
Some partitions (xboot, uboot, ker0, ker1, ...) are raw data. Read-only filesystems (fs0, ap0, ap1) use squashfs inside UBI, read-write filesystems (apdat0, buffer) use ubifs inside UBI.
When reading the partitions using nanddump, quite a lot of bit-flips were reported, and any attempt to read "misc" partition immediately triggered kernel fault and restart:
Code:
[ 2254.585684] Backtrace: [ 2254.588151] [<c031d314>] (ahb_read32+0x0/0x30) from [<c031ddf8>] (nt72_nand_nfc_dump_regs+0x90/0xd4) [ 2254.597254] [<c031dd68>] (nt72_nand_nfc_dump_regs+0x0/0xd4) from [<c031e7f4>] (nt72_nand_nfc_error_handling+0x34/0x74) [ 2254.607907] r7:00000001 r6:00000000 r5:00000300 r4:c08ab450 [ 2254.613618] [<c031e7c0>] (nt72_nand_nfc_error_handling+0x0/0x74) from [<c031f2d8>] (nt72_nand_nfc_read_page+0x250/0x2c0) [ 2254.624443] r7:0000000a r6:00000000 r5:00000300 r4:c08ab450 [ 2254.630154] [<c031f088>] (nt72_nand_nfc_read_page+0x0/0x2c0) from [<c031dbf0>] (nt72_nand_cmdfunc+0x70/0x180) [ 2254.640040] [<c031db80>] (nt72_nand_cmdfunc+0x0/0x180) from [<c0318f98>] (nand_do_read_ops+0x150/0x42c) [ 2254.649396] r7:e895be10 r6:c7400000 r5:c08ab6a0 r4:c08ab450 [ 2254.655107] [<c0318e48>] (nand_do_read_ops+0x0/0x42c) from [<c031959c>] (nand_read+0x64/0x88) [ 2254.663609] [<c0319538>] (nand_read+0x0/0x88) from [<c0310ec4>] (part_read+0x58/0x90) [ 2254.671410] r7:00000000 r6:00000000 r5:00000695 r4:ebb08400 [ 2254.677120] [<c0310e6c>] (part_read+0x0/0x90) from [<c030e938>] (mtd_read+0x90/0xc4) [ 2254.684828] r9:00000000 r8:00100000 r6:00240000 r5:c7400000 r4:ebb08400 [ 2254.691592] [<c030e8a8>] (mtd_read+0x0/0xc4) from [<c031367c>] (mtdchar_read+0x140/0x220) [ 2254.699732] r9:00000000 r8:00240000 r7:ebb08400 r6:e895bf78 r4:00100000 [ 2254.706503] [<c031353c>] (mtdchar_read+0x0/0x220) from [<c0130458>] (vfs_read+0xbc/0x13c) [ 2254.714654] [<c013039c>] (vfs_read+0x0/0x13c) from [<c0130a5c>] (SyS_read+0x50/0x78) [ 2254.722369] r8:00000000 r7:00100000 r6:00000000 r5:b63e9008 r4:c7d440c0 [ 2254.729136] [<c0130a0c>] (SyS_read+0x0/0x78) from [<c000e000>] (ret_fast_syscall+0x0/0x48) [ 2254.737369] r9:e895a000 r8:c000e284 r7:00000003 r6:00000000 r5:b6757744 r4:b6757340 [ 2254.745270] Code: e5933010 e0833000 e5930000 f57ff04f (e89da800)
http://televid-sib.ru/index.php?topic=116720.0
But when I copy these files to a USB stick and hold OK on the remote while plugging the TV in, nothing happens, it just starts normally.
I can't see any messages from u-boot on the console. The first few lines come from the SPI firmware, immediately followed by the messages from the kernel starting, nothing in between. BTW, looking at the SPI memory contents, it's obviously not ARM code, it must be something that runs on an embedded controller inside of Novatek SoC. I haven't found what kind of architecture it is.
The shredder_usb_update.bin is encrypted with aes-128-ecb. After spending some time with Ghidra, studying the "uboot" partition that I downloaded from the TV, I found the key there. It's getting written to some registers, which means the Novatek chip has a hardware encryption module. I could not find any datasheet from Novatek.
So the firmware binary can be decrypted like this:
Code:
openssl aes-128-ecb -nopad -in shredder_usb_update.bin -out decrypted.bin -K A9A05FC6F986254382DF2C93DEDF7B98
Of course, this kind of repair doesn't make any economical sense for such a cheap TV, this is just my curiosity and refusal to give up 😁
Comment