Hi guys, the smart and non-smart both have a UART. The non-smart has a header on the mainboard unlike the smart. The three UART pins TX, RX and GND are always connected with pins 15, 12 and 9 of the VGA connector on TVs and monitors with a MSTAR chipset. So there is no need to open the TV and soldering a header. For TVs without a VGA, the UART pins are connected with SCART pins if they have that connector.
I use one of
these PL2303 USB to UART adapters for the ridiculous low price of 0,49€ including shipping from China
Then I use three of
these Dupont female to male wires for an entirely non-soldering solution.
The UART can be used as a debug interface and both for dumping and reverse engineering the system software it is an indispensable tool.
I decided to dump the entire content of the 512MB NAND for several reasons:
- I wasn't sure the update shared by forum users could be used for my DVX5S, because my TV's serial number is not in the same range. If I end up with a brick I can always unbrick it with the backup. Luckily it turned out I could use the update without any problems
- A firmware update file does not necessarily include all non-volatile system data, e.g. unique serial numbers, mac addresses, hdcp certificates, etc.
Dumping is done by attaching a USB Storage stick and then run the bootloader command "nandbinall". The bootloader is actually a U-Boot, but MSTAR calls it MBoot.
I did find some older Mstar system software source code which speeds up the reverse engineering. The best is that the firmware modules are digitally signed and encrypted with default keys from leaked older SDK code. So I am now able to sign and encrypt the kernel, root file system, applications, trusted execution environment (tee) and all other modules.
I have reached the point where I want to flash application and customer configuration firmware partitions from other Mstar TVs such as Changhong, Panasonic, SEIKI and some others. The basic idea is to enhance the smart tv functionalities and enable miracast/widi, netflix, youtube and amazon.
I will keep posting status updates in this thread.
If there is anyone interested and has the guts to do similar experiments, I can post the tools I developed for unpacking/packing and signing/encrypting firmware files. This TV has similar development potential as the good old Dbox and Enigma E2 STBs
Have fun,
JockyW