Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I think the only fix for these is to get a Flash analyser remove old Ic freeze it, read data reload it on to new Ic and problem solved. I have tried for hours to get it work no luck what so ever.

Are you looking for firmware for this set ????????

[ReeceyBurger123]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

No just saying.

[vinceroger69]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I now wish i had read my eeprom chip before i soldered it too the board sods law another set will come along with the same fault. I do have two cheap ebay usb programmer/readers but never got around too actually using them. https://www.youtube.com/watch?v=L0ChYNwunUE

[gabiz_ro]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Looking at one set of files
dectest aesecb 0x80400000 0x06C00010
0x80400000 is loading address of mb90_en.bin
mb90_en.bin size is 0x06C00013 but last 4 bytes are CRC32 checksum

So key for AES decription must be known by mboot?
Since mboot is wide compatible seems that key must be something wide used.
(I say is wide compatible because even old versions was able to decrypt mb90_en.bin of new versions but was complaining about some unknown command from new usb_auto_update_A1.txt)

later edit.
I see that one line commented is about CRC32,as for now not used
Maybe is just suplementary checks or maybe in early stage firmware was not encrypted and CRC32 was used to validate good firmware,also maybe that part still exist in mboot and instead passing crypted firmware we can use uncrypted and disable encryption and use CRC32

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Hi .gabiz ro you sound like the person I am looking for that may be able to help. On some vestel sets you can put a USB stick into the set ,press a few buttons on the remote and download some of the flash files from the set to the memory stick,the files downloadable only relate to tuner and user settings.However if a change could be made to the software so the same procedure would download the whole of the nand flash contents on to a USB stick this could be very useful .I see you are conversant with programming ,do you think this would be possible ??

[gabiz_ro]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I think it would be possible but I get only errors.
I use serial connection through scart and hyperterminal or realterm.
Need to add some bootdelay to be able to interrupt starup process.

I use some commands like bin2nand,nandbin,nandbin2,ubibin
But in the end all get errors and under windows OS complain that USB stick need to be checked for errors.

Not all version of mboot have all these commands,you may find them using help command.

Also after powering up,I can see root filesystem using ls command but can't find a way to change directory.

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Thank you for the reply, is there any free programs I can use to dissasemble the files to have a look , all I have at the moment is hex workshop that opens the file in hex which is o.k for editing files but not much use for anything else .

[gabiz_ro]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

At this moment I don't know and I don't have something to read nand.
Haven't tryied on dumps from models with two spi flash.

mb90 bin for usb is encrypted
dectest command do almost nothing visible

But since aes ecb is weak and as far as I read supports some kind of attack maybe we can use enctest command to encode some plain text

Now depends on what you need.

My actual problem is with one JVC 17MB95M just blinking led.
All firmware upgrades tested didn't work.
Connected to PC via serial and I see many nand bad blocks
Replaced nand,upgrades works TV boot up but blank screen,only backlight.
Find out that motherboards with spi and nand flash use some EDID data
But that is preserved during normal upgrade.
You may see area 0x01C0000 0x01F0000 is preserved,skipped write from mboot.bin
What I found until now is that at 0x01E1680 are 0x100 size area with EDID info.

Just tested with that region extracted from mboot and software for analyze edid recognize data.
But further checks reveal that VES315WNDS T-CON board is defective,one shorted C-E transistor and one low resistance capacitor,20 ohms.
I'll replace them next week.

For other things I think we need to find key to decrypt firmware.

[tn245]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Hi all

It's been a while since working on this stuff and I don't have one set up right now so going from memory. Will try to help.

Below is a script which dumps spi (bootloader) and partitions from nand on mb9x boards. Can't guarantee it will work with everything because there may be variation in volume sizes.

It's very useful I think if you can to make yourself a uart to SCART cable (pin 10 rx, pin 12 tx + GND). I'm using a usb to serial adapter. Then you can get onto the U-Boot console and see what's going on. If you let it boot up fully you can even get a linux console.

Firmware dump script:

# <- this is for comment / total file size must be less than 4KB

## read 2MB from SPI and write to usb
spi_rdc 80400000 0x00000000 0x0200000
fatwrite usb 0:1 80400000 mboot.bin 0x0200000

## NAND Partitions:
# 0x500000(KL),0xFA0000(CONF),0x7200000(UBIA),0x7860000(UBIB)
nand read.e 80400000 KL
fatwrite usb 0:1 80400000 KL.BIN 0x500000
nand read.e 80400000 CONF
fatwrite usb 0:1 80400000 CONF.BIN 0xFA0000
nand read.e 80400000 UBIA
fatwrite usb 0:1 80400000 UBIA.BIN 0x7200000

## UBIB - used for backups
#nand read.e 80400000 UBIB
#fatwrite usb 0:1 80400000 UBIB.BIN 0x7860000


## useful if connecting via serial cable - press enter during countdown to get to console
#setenv bootdelay 5
#saveenv

reset

% <- this is end of file symbol

Save as usb_auto_update_A1.txt
Put on usb stick. Hold OK on remote while plugging in TV. Wait quite a while until TV resets. This will give you several files on the usb stick. The CONF.BIN file holds the configuration. I was able to unpack the file with the utils from here: https://github.com/jrspruitt/ubi_reader

However from the serial console using ubifsls and ubifsload commands I think you can copy individual files directly from the partitions onto usb stick.

I THINK the panel file I played with was VESTEL_D1_Plus_PNL.bin. I was able to substitute panel files from other firmwares to eventually find one that worked.

I only encountered problems with encryption on later versions of firmware, and I think CONF partition may not have been encrypted. Can't remember exactly.

[tn245]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

The thing is though. On the set I was working on, I was able to get it all working nicely, but after just a few power on/off cycles it would corrupt again every time. So some other problem causing the software to corrupt. Perhaps need to go back to look at caps/regulators again? Anyway I got tired with this one and put it away for the time being.

[gabiz_ro]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Did you use nand erase and nand scrub and again nand erase?
From what I read that's sequence to use.
nand erase - erase nand
nand scrub - erase everything,even marked bad blocks
nand erase - again to update actual bad blocks.

Take note that nand scrub require confirmation and have timeout.
You need to be wired via serial and confirm with y keypad then enter key in timeout period

I have that one on which not ever complete firmware upgrade,after wiring serial communication I can see many badblocks reported.
Replaced nand and seems to go on.
Even that,still get some reports for badblocks,but strange,they are on top of 4GB limit.
Something like
bad block 0xFEXXXXXX
Few lines with different address.

[tn245]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I fitted a brand new replacement nand, loaded firmware and still it corrupted again.

[gabiz_ro]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Could be a firmware problem or nand problem.
Take a look at what badblocks are reported.
Run update with nand erase ,nand scrub, nand erase.
Run update again,compare initial badblocks with actual.

I've replaced mine once with nand from old Tomtom GPS,and get many errors for badblocks.
Second attempt was with nand from some chinese tablet,didn't expect to work since was 4GB ones,indeed didn't work.
Third attempt was with nand stolen from old MMC card,that seems OK,some badblocks reported like I said but don.t know why so high address.

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Hi all

It's been a while since working on this stuff and I don't have one set up right now so going from memory. Will try to help.

Below is a script which dumps spi (bootloader) and partitions from nand on mb9x boards. Can't guarantee it will work with everything because there may be variation in volume sizes.

It's very useful I think if you can to make yourself a uart to SCART cable (pin 10 rx, pin 12 tx + GND). I'm using a usb to serial adapter. Then you can get onto the U-Boot console and see what's going on. If you let it boot up fully you can even get a linux console.

Firmware dump script:

# <- this is for comment / total file size must be less than 4KB

## read 2MB from SPI and write to usb
spi_rdc 80400000 0x00000000 0x0200000
fatwrite usb 0:1 80400000 mboot.bin 0x0200000

## NAND Partitions:
# 0x500000(KL),0xFA0000(CONF),0x7200000(UBIA),0x7860000(UBIB)
nand read.e 80400000 KL
fatwrite usb 0:1 80400000 KL.BIN 0x500000
nand read.e 80400000 CONF
fatwrite usb 0:1 80400000 CONF.BIN 0xFA0000
nand read.e 80400000 UBIA
fatwrite usb 0:1 80400000 UBIA.BIN 0x7200000

## UBIB - used for backups
#nand read.e 80400000 UBIB
#fatwrite usb 0:1 80400000 UBIB.BIN 0x7860000


## useful if connecting via serial cable - press enter during countdown to get to console
#setenv bootdelay 5
#saveenv

reset

% <- this is end of file symbol

Save as usb_auto_update_A1.txt
Put on usb stick. Hold OK on remote while plugging in TV. Wait quite a while until TV resets. This will give you several files on the usb stick. The CONF.BIN file holds the configuration. I was able to unpack the file with the utils from here: https://github.com/jrspruitt/ubi_reader

However from the serial console using ubifsls and ubifsload commands I think you can copy individual files directly from the partitions onto usb stick.

I THINK the panel file I played with was VESTEL_D1_Plus_PNL.bin. I was able to substitute panel files from other firmwares to eventually find one that worked.

I only encountered problems with encryption on later versions of firmware, and I think CONF partition may not have been encrypted. Can't remember exactly.

O.K this seems to be just what I am looking for but I am electronics engineer not software engineer , would it be at all possible to write me this program in such a form so I can transfer it straight to a USB stick ?

[tn245]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Here you go. Put on usb stick, put in TV, hold ok on remote while plugging in. I think LED will flash for a few minutes, then TV should reset itself. If it works you should have the files on the usb.

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

What a star you you are , this is just what I have been looking for and why I joined this forum, I am working on a Toshiba set at the moment and cant get the correct firmware but I have managed to find a file for a bush set that works , same LCD panel ETC , BUT Toshiba use there own remote control code so allthough the set is now working it only works with a vestel remote control and not the Toshiba one it came in with and I figure if I could find where the data is held for the remote I could change it over but I dont have any software for Toshiba sets to compare with so I figured if I could dump the software form a working toshiba set I could compare the files with hex workshop and try some changes.

Toshiba do have the firmware listed on there website but its only the main program and does not have the M BOOT file so its only good for a set which comes out of stand by , I downloaded this and added my own M BOOT file but the set would now not come on at all which I find a bit odd so I am assuming there are different versions of the m boot file and if I could extract one from a working set I could file compare and edit.

[ReeceyBurger123]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Here you go. Put on usb stick, put in TV, hold ok on remote while plugging in. I think LED will flash for a few minutes, then TV should reset itself. If it works you should have the files on the usb.

Awesome

[michael dranfield]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Awesome

See you do like vestels after all !

[ReeceyBurger123]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

No still think they are crap but good to have that file, I sold this exact same Tv a few weeks back so just in case lol. Also only some pre 2012 Toshiba Led Vestel Tv's use real (non Vestel) Toshiba remotes.

[ReeceyBurger123]

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Also on these 17MB95S make sure to stick the Usb update in the bottom port ! If you put it in the top one it will mess it up massive time and the board will need a whole new flash Ic