Vizio TV firmware reverse engineering

[ARGO]

Hello!
I'm trying to install mainboard from d50u-d1 into m65-c1 TV. They are the same, deference in panel settings only.
I got access to factory menu but it doesn't allow to change panel settings.
I have tried to replace MX25L3206E Flash chip from bad m65-c1 board to new d50u-d1, the TV turns on and works until power cycle. Then TV writes default d50u-d1 setting in flash chip and it doesn't work anymore.

I need help with analyzing file dumps to find where are panel settings to modify them in original file.

here are 3 files:
2 original dumps from d50u-d1 and m65-c1
1 m65-c1 rewritten by TV after first power cycle.

[CapLeaker]

Re: Vizio TV firmware reverse engineering

can we see some hi res, straight shot pics from the 2 boards? What is wrong with the original main board?

[ARGO]

Re: Vizio TV firmware reverse engineering

can we see some hi res, straight shot pics from the 2 boards? What is wrong with the original main board?

The problem is in BGA CPU. This is well-known problem for this series TV.
You can make a search in forum, there are a lot of topics about it.

[diif]

Re: Vizio TV firmware reverse engineering

You've checked there's nothing else that can store a model number on the mainboard ?

[ARGO]

Re: Vizio TV firmware reverse engineering

You've checked there's nothing else that can store a model number on the mainboard ?

I think that panel settings in dumped flash because once I replace it with flash from old board TV turns on with settings from old TV and works until power cycle.

[diif]

Re: Vizio TV firmware reverse engineering

It's usual for the settings to be read at startup from an EEPROM but they are written back from the NAND at power off.

[ARGO]

Re: Vizio TV firmware reverse engineering

It's usual for the settings to be read at startup from an EEPROM but they are written back from the NAND at power off.

this is not eeprom chip. This is SPI Flash and it has file system with files...
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
155892 0x260F4 CRC32 polynomial table, little endian
159496 0x26F08 CRC32 polynomial table, little endian
163592 0x27F08 CRC32 polynomial table, big endian
196624 0x30010 gzip compressed data, has original file name: "display.bin", from Unix, last modified: 2015-07-31 01:13:31
1376272 0x150010 gzip compressed data, has original file name: "database.TSE", from Unix, last modified: 2015-07-31 01:13:31
2097200 0x200030 gzip compressed data, has original file name: "LogoB.bin", from Unix, last modified: 2016-06-04 04:19:26
2228240 0x220010 gzip compressed data, has original file name: "display.bin", from Unix, last modified: 2016-06-04 04:20:17
3276816 0x320010 gzip compressed data, has original file name: "database.TSE", from Unix, last modified: 2016-06-04 04:20:17

[CapLeaker]

Re: Vizio TV firmware reverse engineering

Fact is that the main boards may look the same, the Tcon is surely not.
As diif already said, are you sure that there is not another device of some sort that can store information?

[ARGO]

Re: Vizio TV firmware reverse engineering

Fact is that the main boards may look the same, the Tcon is surely not.
As diif already said, are you sure that there is not another device of some sort that can store information?

Have you read my post? If I replace flash IC from m65-c1 to d50, d50 turns on with m65-c1 settings and works until power cycle. So I'm sure settings stored in it.

[CapLeaker]

Re: Vizio TV firmware reverse engineering

Umm... yaah... I can read... so good luck with it then... BYE!

[jjanssen7]

Re: Vizio TV firmware reverse engineering

I'm interested if you have success with this, I run into M65-c1 failure all the time... wonder if a similar thing can be done with other Vizio mains. So many BGA failures with the C1 series mains...