By Chatziliontos Christodoulos
draft version – Step by step procedure to transform LG TV 42LE7500-ZA into a free internet browser (proceed with your own risk) – Μετατροπή της τηλεόρασης σε σέρφερ του ίντερνετ!
1. Use remote control (mine is the AKB72914004) and press MENU->Customer Support (press red colored button)->Product/Service Info (select it and press OK). It shows the following info: -Model/Type: 42LE7500-ZA, -Software Version: 03.06.07, -Serial Number: 010WRJCAD036, –ESN: e8:5b:5b:0e:85:6a (specific info comes from my LG TV) etc.
2. An alternative way to discover firmware version: with remote control press MENU->Customer Support (press red colored button)->Software Update (select it and press OK). It shows the Current version (mine is 03.06.07). By pressing the Check Update Version it is possible to see “New Update Version Found” (Ver.04.00.00 in my case), which is an official LG firmware version we do not want to install.
3. An alternative way to auto check for new firmware version: with remote control press NetCast (“Checking for software update…” message displayed). LG TV searches internet, through home LAN connection, for new possible version. If found a new one, user has the option to select Cancel or Starting Update. Cancel unloads NetCast. So Starting Update is the only choise to proceed with NetCast (after updating its applications of course). In case a factory set LG TV is not connected to internet, NetCast application is loaded with a list of application windows (1. AccuWeather.com, 2. Youtube Videos and 3. Picasa Web Albums which all 3 are web applicatios) but they are useless because there is no internet connection. If found none new firmware, Netcast is loaded to let the user play with its applications. It would be exciting to have an option install new window applications (thats a reason to allow NetCast install a newly found official LG firmware) or better install our custom applications, e.g. a web browser (thats a reason not to permit NetCast install a newly found official LG firmware but install our custom firmware)
4. Lets suppose we have accepted the newly found updated official version . It is necessary to roll back to the previous one in order to be able to install custom firmwares. This action can be accomplished as following: with remote control press MENU->Option (selected by using < > ^ v buttons and pressing OK). On new opened window there are many parameters waiting to be changed. Parameter language is selected (blue colored), but our target is not to make any change. We must transfer the focus of selector upon the briefcase icon by pressing the < remote button. Under these circumstances press remote number 9 seven times. If all of the seven IR signals have been transmitted succesfully on LG TV the message “Program restore has been completed. Rebooting” is visible, which means that the previous firmware version restored and TV restarts automatically.
5. We are still far away from the target, which is transforming LG TV 42LE7500-ZA into a free internet browser. Secret LG service menu must be revealed first. Ez-Adjust and In-Start service menu contain basic parameters for debugging and booting the TV model. This service menu becomes visible by sending special IR commands to our TV set. My AKB72914004 remote control is not capable to do this, but the LG Remocon 105-201M or a Logitech Harmony 600 remote control can do that. I decided to buy Logitech Harmony 600 which is fully programmed by a usb port with a pc using a web or standalone software. It is also equiped with a digital screen which helps you see or select which command to execute.
6. How to program a Logitech Harmony 600? Click here http://images.harmonyremote.com/EasyZapper/Downloads/releases/logitech/7.5.0/LogitechHarmonyRemote7.5.0-WIN-x86.exe to download the software and install it. During installation the program will make several checks for internet connection and need for updates. Finally it loads the login page where it waits for you to login. Go here http://members.harmonyremote.com, click Next, click Create New Account, select “No – Install the remote software now”, click Next, select “No, I will upgrade the software later”, click Next, write down your email inside the Login ID field, check “I Agree”, click Next, at the next page give your personal data (First Name, Last Name, email address, country etc) and click Next. This way a personal database is created for the user. Login data are given to the software by the user in order to start programming the remote control. Using the software, add your device model but dont select 42LE7500-ZA because it contains no option for service menu, instead select 47LE5300-UC (user must learn and find how to handle software options). Connect your remote control to pc through the given usb cable and press the orange button “Update Remote”. If everything went ok the remote control is ready for usage, containing the two secret commands, Ez-Adjust and In-Start.
7. By navigating the remote digital screen select In-Start command. TV will ask you for a password. Give 0413 and IN START menu becomes visible in front of your eyes. Navigate menu options and reach submenu “4. System 1”. Go to System 1 submenu option “14. Debug Status” and set “DEBUG”. By default this option is set to “RELEASE”. Also, set the submenu “0. Baudrate” to “115200” and press remote “exit” to leave IN START menu. Few steps left to hack the TV.
8. We need putty software and a serial cable to connect TV RS232 port with computer. Click here, http://the.earth.li/~sgtatham/putty/latest/x86/putty-0.62-installer.exe, and install this program. Run putty.exe. Settings need some adjustment, eg speed=115200, Data bits=8, Stop bits=1, Parity=None, Flow control=XON/XOFF, Terminal->Implicit CR in every LF=checked, Terminal->Implicit LF in every CF=checked, Terminal->Local echo=Force on. Press the Open button and the terminal waits for your commands. Do some testing, eg write down the following characters:
ke 0 0
and press your keyboard enter. It should force TV set to mute and rapidly a response is visible:
e 01 OK00x
To bring back the sound write the following command:
ke 0 1
and press enter. It should force TV set to unmute and rapidly a response is visible:
e 01 OK01x
This test is needed to verify that rs232 communication is feasible between TV and pc.
9. Debugging process: now write debug on putty terminal and press enter. TV does not respond back. Press d, press once the space bar, write 42LE7500-ZA and press enter. TV does not respond back. Press F9 and the message “Enabling display debug message” comes as a response from TV at putty terminal. Press F10 and the message “1:debugMain $” comes as a response from TV at putty terminal. Its a prompt for the user to enter a command. Press F1 and here it is what you get:
Function Key helps(gnDebugLevel is 1)
== Primitive functions keys(LGTerm, CRT/linux, CRT/SCOANSI) ===================
F01 : Show this help message, F02 : Reset debug menu level
F03 : Toggle overrun check method F04 : Reserved for future use
F05 : Show task resource table F06 : Show OSA task information
F07 : Show OSA semaphore information F08 : Show OSA Message Information
F09 : Toggle debug message output F10 : Enter debug main menu
F11 : Top utility F12 : Enter task monitoring tool
== Shifted functions keys(LGTERM and CRT/SCOANSI only) =========================
S+F03: Toggle H/W mem logs(BCM) S+F04: Reserved for future use
S+F05: Reserved for future use S+F06: Reserved for future use
S+F07: Reserved for future use S+F08: Reserved for future use
S+F09: Reserved for future use S+F10: Reserved for future use
== LGTerm/Linux/SCOANSI(Other control keys) ===================================
INSERT/HOME /HOME : Show OSA hash table
DELETE/END /END : Dump raw task table
END /PGUP /PGUP : Dump raw Resource table
PGDN /PGDN /PGDN : Dump raw mapped memory list
Some Safety Measures
10. CFE Bootloader (http://dslab.lzu.edu.cn:8080/docs/2006summerschool/team1/teama/Documentation/lichanjuan/cfe.pdf): after you have seen succesfully the above debug menu, turn off TV, press and hold the ` character on your PC keyboard and turn on TV again until a new (CFE) menu set of options becomes visible
100 MB Full-Duplex (auto-neg) You should set IP address tru nset command! >>Input '-' to remove value<< netDev : eth0 - NET_SIPADDR Address : no => (needs text to be continued)