Sony NSX-40GT1 (Internet TV)

From Exploitee.rs
Jump to navigationJump to search

"Although the information we release has been verified and shown to work to the best our knowledge, we cant be held accountable for bricked devices or roots gone wrong."

Sony NSX-40GT1.jpg


Recovery Mode

Apeman42 from XDA Developers found Recovery Menu

  1. Have everything plugged into the unit except the power coord. Have the power coord in your hand.
  2. Press and hold the power button and plug the unit in.
  3. Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
  4. Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
  5. After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
  6. You can now press the numbers assigned to the commands!

Serial Console

The Sony NSX series TVs have an easy-open debug port on the back:

Nsxgtvport.jpg

Presumably the beige connector is for a custom ribbon cable. The row of four solder pads below it is the UART for ttyS0: GND, RX, TX, 3.3V. If you listen to the TX port while the TV boots up, you'll get a dmesg dump:https://pastee.org/v2ytp I have not yet been able to transmit anything useful.


On the ribbon cable, if we number the pins starting at 1 on the bottom left, pin 9 is the same as TX below; pin 10 is the same as RX below. Pins 7, 12, 14, 16, and 17 are pulled high when the TV is on, so some of them could be RX/TX pins for other uarts. I didn't seem to see any traffic on them during boot though. --Abliss 13:40, 10 February 2011 (CST)

Looks like pin 17 is TX for another UART: http://www.gtvhacker.com/index.php/Sony_NSX-40GT1_%28Internet_TV%29


Listening to the UART while going through the recovery mode menu items yields lots of juicy logs: https://pastee.org/ra8np

USB Update

In recovery mode, any USB storage device will be automounted when inserted. If it's inserted at the start of recovery mode, the device will attempt to do a USB update. This executes the following: [code] cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep "package_list_" cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip [/code]

For a USB update to succeed, the following are necessary (but not sufficient): 1. there must be a file matching /package_list_*.zip or else you get the error "find package error: no such a package !" 2. the zip must contain a file "system/build.prop" or else you get the error "caution: filename not matched: system/build.prop" 3. the zip must contain a file matching "package_list_*.txt" or else you get the error "caution: filename not matched: package_list_*.txt"

After this, it appears to fail silently.

Retrieved from "http://www.Exploitee.rs/index.php?title=Sony_NSX-40GT1_(Internet_TV)&oldid=517"