Announcement

**tn245** · 02-09-2016, 04:34 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

The script I posted should extract mboot from SPI to usb from a set with a working mboot.

**gabiz_ro** · 02-09-2016, 05:00 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Didn't test this.
But I think we need two kind of usb_auto_update_A1.txt

One to backup mboot and read or save enviroment.
If that command is available,at least print and save env exist but save it on spi chip.
Second way is to open dumped mboot and somewhere in area 0x01d0000 -0x01f0000 (may be wrong address from my memory) here is saved enviroment,then we can adjust other address to correct ones to dump nand
Second one prepared with address obtained from first step.

**michael dranfield** · 02-09-2016, 05:40 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by tn245 View Post

I just have one like this: http://www.ebay.co.uk/itm/25-SPI-Ser...UAAOSwGotWk17h

It didn't list the SPI chip I had but it worked anyway.

Oh dear I paid over £500 for mine and that was 10 years ago, I looked at dataman 48 but at over £1k it will have to wait until christmas !

I have just ordered one now , many thanks for that.

**vinceroger69** · 02-09-2016, 05:53 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I have one of the ebay cheap programmers they dont come with any software in this you tube link theres a download link for it as it also lets you change the language to english
https://www.youtube.com/watch?v=L0ChYNwunUE

**ReeceyBurger123** · 02-09-2016, 05:55 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Im buying one, slowly getting all much equipment rather than using my uncles all the time. Thanks

**tn245** · 02-09-2016, 09:34 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by gabiz_ro View Post

Didn't test this.
But I think we need two kind of usb_auto_update_A1.txt

One to backup mboot and read or save enviroment.
If that command is available,at least print and save env exist but save it on spi chip.
Second way is to open dumped mboot and somewhere in area 0x01d0000 -0x01f0000 (may be wrong address from my memory) here is saved enviroment,then we can adjust other address to correct ones to dump nand
Second one prepared with address obtained from first step.

You can just comment out the unneeded lines in my script to just dump the bits you want (SPI, RFS/CONF etc..).

I think actually the values were the same on all the versions I played with so maybe it will work for most. I just wanted to point out that it could possibly be a problem to look out for.

**gabiz_ro** · 02-09-2016, 10:49 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I know that,but is more ... easy to have two file,to comment uncomment line every time.
Can use two usb sticks,one to dump mboot and address ,second one modified with what you need,according to what you get from first one.

I don't think they are the same address,many times when programming spi flah boot sequence on TV stop like a kernel panic.
Looks like tryied to boot but encountered problem and in log window two or three segments of few hex line .

**michael dranfield** · 02-09-2016, 05:08 PM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I have tried the program again on a different set and still cant get it to download any files from the TV to a usb stick , is there something I am doing wrong ?
I held ok button down and after a slight pause the led blinks for a bit and then goes back to ST/BY but there is nothing on the USB stick apart from the reader program.

**tn245** · 02-10-2016, 05:43 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Interesting. I will have to dig mine out to test it and see what's going on.

**gabiz_ro** · 02-10-2016, 08:55 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Stick must be FAT32
If FAT windows complain that disk must be checked,after files are gone.
Try to open files without checking disk disk file error.

On FAT32 works.

On UBIA seems to hang,wait for some time then commented in file.
ON UBIB I get some error

Code:

>> nand read.e 80400000 UBIB 

NAND read: device 0 offset 0x86A0000, size 0x7860000


Bad block at 0xFE00000 in erase block from 0xFE00000 will be skipped

Seems to hang too,so I commented in file

Console log

Code:

À keypad_pressed is [0] 
 ir_pressed is [1] 
check_sw_upgrade 
no OAD Flag 
Check USB port[1]:
No USB is connecting
usb init failed
Error, couldn't init Lowlevel part
Check USB port[0]:
Host type:2 
scanning bus for devices... 1 USB Device(s) found
port_switch is:0
    scanning bus for storage devices... bulk max packet size:200
iobuf[0]:0
max USB Storage Device reached: 1 stopping
1 Storage Device(s) found
no need to start factory usb download 

 #* 1. NAND is already programmed (not Empty) ***
reading usb_auto_update_A1.txt

1 bytes read
reading usb_auto_update_A1.txt

746 bytes read

>> spi_rdc 80400000 0x00000000 0x0200000 
offset 0x0, size 0x200000

>> fatwrite usb 0:1 80400000 mboot.bin 0x0200000 
file mboot.bin not found
fd:0, cur_cluster:2, cursect:8192, offset:7
#set getno = 16 and clust_size = 8
################################

>> envbin 
(Re)start USB...
Check USB port[0]:
Host type:2 
scanning bus for devices... 1 USB Device(s) found
    scanning bus for storage devices... bulk max packet size:200
iobuf[0]:0
max USB Storage Device reached: 1 stopping
1 Storage Device(s) found
buff:spi_rdc 0x82000000 0x1D0000 0x10000
offset 0x1D0000, size 0x10000
crc:5F9F844F,crcNew:5F9F844F
buff:fatwrite usb 0 0x82000000 env.bin 0x10000
file env.bin not found
fd:0, cur_cluster:2, cursect:8192, offset:8
#set getno = 16 and clust_size = 8
#
ok

>> nand read.e 80400000 KL 

NAND read: device 0 offset 0x0, size 0x500000


Reading data from 0x0x -- 100% complete.
 5242880 bytes read: OK

>> fatwrite usb 0:1 80400000 KL.BIN 0x500000 
file KL.BIN not found
fd:0, cur_cluster:2, cursect:8192, offset:9
#set getno = 16 and clust_size = 8
################################################################
################

>> nand read.e 80400000 CONF 

NAND read: device 0 offset 0x500000, size 0xFA0000


Reading data from 0x5242880x -- 100% complete.
 16384000 bytes read: OK

>> fatwrite usb 0:1 80400000 CONF.BIN 0xFA0000 
file CONF.BIN not found
fd:0, cur_cluster:2, cursect:8192, offset:10
#set getno = 16 and clust_size = 8
################################################################
################################################################
################################################################
##########################################################

>> setenv bootdelay 5 

>> saveenv 
Saving Environment to spiflash...
Flash is detected (0x0507, 0xC2, 0x20, 0x15)
Write addr=0x001D0000, size=0x00010000

>> reset

Attached Files

usb_auto_update_A1.txt (746 Bytes, 203 views)

**tn245** · 02-10-2016, 10:52 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Good point about FAT32. Could be Michael's problem?

UBIA is a much larger volume than the others so takes longer to read and write. It may complete if you just leave it for a long while.

UBIB seems to be used for backups of the other volumes so could be useful to restore if other volumes have been corrupted.

**stj** · 02-10-2016, 11:20 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by vinceroger69 View Post

I have one of the ebay cheap programmers they dont come with any software in this you tube link theres a download link for it as it also lets you change the language to english
https://www.youtube.com/watch?v=L0ChYNwunUE

your not reading the forum much,
i have been collecting, cleaning up, and posting that software on this forum for months!

https://www.badcaps.net/forum/showpo...3&postcount=11

**vinceroger69** · 02-10-2016, 11:31 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by stj View Post

your not reading the forum much,
i have been collecting, cleaning up, and posting that software on this forum for months!

https://www.badcaps.net/forum/showpo...3&postcount=11

I think i actually posted in that thread as well too be honest, and yes your software is a lot newer as soon as ive reformatted my laptop i will have ask you for a download link/files.

**stj** · 02-10-2016, 11:33 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

it's in that thread.

**vinceroger69** · 02-10-2016, 11:34 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by stj View Post

it's in that thread.

Cheers just found the thread now
https://www.badcaps.net/forum/showth...rom+programmer

**michael dranfield** · 02-11-2016, 05:34 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Originally posted by gabiz_ro View Post

Stick must be FAT32
If FAT windows complain that disk must be checked,after files are gone.
Try to open files without checking disk disk file error.

On FAT32 works.

On UBIA seems to hang,wait for some time then commented in file.
ON UBIB I get some error

Code:

>> nand read.e 80400000 UBIB 

NAND read: device 0 offset 0x86A0000, size 0x7860000


Bad block at 0xFE00000 in erase block from 0xFE00000 will be skipped

Seems to hang too,so I commented in file

Console log

Code:

À keypad_pressed is [0] 
 ir_pressed is [1] 
check_sw_upgrade 
no OAD Flag 
Check USB port[1]:
No USB is connecting
usb init failed
Error, couldn't init Lowlevel part
Check USB port[0]:
Host type:2 
scanning bus for devices... 1 USB Device(s) found
port_switch is:0
    scanning bus for storage devices... bulk max packet size:200
iobuf[0]:0
max USB Storage Device reached: 1 stopping
1 Storage Device(s) found
no need to start factory usb download 

 #* 1. NAND is already programmed (not Empty) ***
reading usb_auto_update_A1.txt

1 bytes read
reading usb_auto_update_A1.txt

746 bytes read

>> spi_rdc 80400000 0x00000000 0x0200000 
offset 0x0, size 0x200000

>> fatwrite usb 0:1 80400000 mboot.bin 0x0200000 
file mboot.bin not found
fd:0, cur_cluster:2, cursect:8192, offset:7
#set getno = 16 and clust_size = 8
################################

>> envbin 
(Re)start USB...
Check USB port[0]:
Host type:2 
scanning bus for devices... 1 USB Device(s) found
    scanning bus for storage devices... bulk max packet size:200
iobuf[0]:0
max USB Storage Device reached: 1 stopping
1 Storage Device(s) found
buff:spi_rdc 0x82000000 0x1D0000 0x10000
offset 0x1D0000, size 0x10000
crc:5F9F844F,crcNew:5F9F844F
buff:fatwrite usb 0 0x82000000 env.bin 0x10000
file env.bin not found
fd:0, cur_cluster:2, cursect:8192, offset:8
#set getno = 16 and clust_size = 8
#
ok

>> nand read.e 80400000 KL 

NAND read: device 0 offset 0x0, size 0x500000


Reading data from 0x0x -- 100% complete.
 5242880 bytes read: OK

>> fatwrite usb 0:1 80400000 KL.BIN 0x500000 
file KL.BIN not found
fd:0, cur_cluster:2, cursect:8192, offset:9
#set getno = 16 and clust_size = 8
################################################################
################

>> nand read.e 80400000 CONF 

NAND read: device 0 offset 0x500000, size 0xFA0000


Reading data from 0x5242880x -- 100% complete.
 16384000 bytes read: OK

>> fatwrite usb 0:1 80400000 CONF.BIN 0xFA0000 
file CONF.BIN not found
fd:0, cur_cluster:2, cursect:8192, offset:10
#set getno = 16 and clust_size = 8
################################################################
################################################################
################################################################
##########################################################

>> setenv bootdelay 5 

>> saveenv 
Saving Environment to spiflash...
Flash is detected (0x0507, 0xC2, 0x20, 0x15)
Write addr=0x001D0000, size=0x00010000

>> reset

First of all I would very much like to thank TN245 and GABIZ-RO for there help with this project I still have much to learn but am making good progress, I have got both programs to work but the one from Gabiz_ro is much quicker at downloading to the stick,
I have observed the following , this set has 2 x USB inputs , when I run the program in the top USB it only downloads file only M Boot 2048Kb, but if I download from the bottom USB it downloads 4 files M Boot 2048Kb , Config 16,000Kb , KL 5120Kb and Env 64Kb,
How would I open these files in something more meaning full so I can search for the remote control commands ? All I have at the moment is Hex workshop.

**gabiz_ro** · 02-11-2016, 06:02 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

My TV has also two USB ports,didn't notice something strange,but from console messages,after reading mboot,seems like enumerating again USB ports.
In other words after mboot dumped and saved,search again and some messages like USB 1 cannot enable low level or something like this,next was USB 0 found,storage ...

Is much quicker because I commented dump for UBIA and UBIB

To make some useful from dumps I think you must use some UBI filesystem tools.
can't find one for windows,so must be done under linux.

TV was returned to customer.For now no more tests possible.

I have tryied other methods,need to have one file on usb stick,enter service menu and choose usb operation.
Config file as hwprofile and swprofile are saved to stick.
Modifying of swprofile info was found on some german forum and blog.
Attempts to modify hwprofile (did too many once) resulted in some kind of kernel panic.
Anyway I see here something remote type,can't remember but was something like RC1912 and other one RC48

**tn245** · 02-11-2016, 06:25 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Remote control info seems to be in the file mb95_hwprofile.bin in CONF. You can extract files from CONF.BIN using the scripts downloaded from https://github.com/jrspruitt/ubi_reader

**gabiz_ro** · 02-11-2016, 06:48 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Maybe just a dumb ideea.
Many items in hwprofile are 00h after reading dump.
If we make that 01h maybe then option isn't read only in service menu.
And like I see in swprofile in german forum, take address of next byte,reverse it,like 0x006c1A become 1a6c,search for hex value, then experiment.
In swprofile
Is something like
00 00 00 00 1a 6c 00 00 function disabled (but I'm not sure about last 00 00)
01 00 00 00 1a 6c 00 00 function enabled ( but ... like I said in previous example)

But in hwprofile seems that string is shorter.
01 00 XY ZC (xy zc are address)

Or maybe I'm wrong.

Edit
You can extract hwprofile and swprofile alone.
Info here http://blog.loetzimmer.de/2015/01/fo...l3433.html?m=1

**tn245** · 02-11-2016, 07:51 AM

Re: Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

I changed the tuner type succesfully just by changing the line here from Si2156 to Si2157 (see image). Just above that you can see Rc5117. I guess this refers to the remote control. There are codes for many remote listed elsewhere in the file including some with brand names (most without):

Panasonic-Rc4861
Sharp-RC484x
Technisat-Rc4850
Technisat-Rc4852
TOSHIBA-Rc3412
TOSHIBA-Rc4826
TOSHIBA-Rc4827_8

I think you should be able to replace that with the code for your remote if you can figure out which one it is.

Attached Files

Announcement

Bush (Vestel) led40127fhdcntd - turns off and on repeatedly

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment