Project BraviaGo

Burak Alkan · 8 Ekim 2011

Reverse Engineering Bravia KDL-52LX900 Firmware.

Index:

Firmware Information
Service Manuals
Widget Development Kit
nmap scan result and Service Menu info
The tear down
Parts used in the TV

Update! Service Manuals!

Software Manual for Sony KDL-52LX900 (Version Up Procedure)

Service (Repair) Manual for Sony KDL-52LX900

The Firmware: 00050100_01fb0000.bin

The source code: Sony Global - Source Code Distribution Service

It is now certain that TV runs Linux 2.6.22. Look down for the nmap result. 2 ports open via Wireless, 4 ports open via LAN.

The firmware is updated via USB. When insterted, TV detects USB and looks for the Firmware. After that TV unpacks the firmware and then flashes. This takes about 30 seconds. TV reboots itself.

The firmware consists of:

Kod:

linux-kernel 
busybox 
pump-autoip 
libjs dosfstools 
directfb 
iptables 
cairo 
glib 
pango 
exceptionmonitor

Binwalk analysis (Probably Wrong) - Now re-analyzed with BinWalk 4.1:

Kod:

binwalk: /usr/local/lib/libcurl.so.4: no version information available (required by binwalk)

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
24439192  	0x174E998 	BFLT executable  version 3698180314,  code offset: 0xD0DBFC89,  data segment starts at: 0xFC57E3C8,  bss segment starts at: 0x314AD91C,  bss segment ends at: 0x579AC36E,  stack size: -209315630 bytes,  relocation records start at: 0x10C36FC1,  number of reolcation records: 1388897630,  gotpic gzdata
40790549  	0x26E6A15 	gzip compressed data, ASCII, has CRC, extra field, last modified: Sat Dec  8 07:18:40 2012

New Firmware Version from Sony Analyzed:

Kod:

root@ubuntu:/home/İndirilenler/sony_dtv0FA00A00A0A0_00050100# binwalk fw.bin
binwalk: /usr/local/lib/libcurl.so.4: no version information available (required by binwalk)

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
9400157   	0x8F6F5D  	JFFS2 filesystem data little endian, JFFS node length: 840583
15166178  	0xE76AE2  	gzip compressed data, ASCII, has CRC, has comment, comment, encrypted, last modified: Thu Jul 25 23:42:10 2019
15652966  	0xEED866  	JFFS2 filesystem data little endian, JFFS node length: 572650
29628716  	0x1C4192C 	JFFS2 filesystem (old) data little endian, JFFS node length: 692636

Burak Alkan · 10 Ekim 2011

Widget Development Kit for the TV

DOWNLOAD THE VM ubuntu_10.04_ctv.vmwarevm.7z (641.83 MB)	Step 1 Download and uncompress this distribution of the Ubuntu 10.04 virtual machine. This very large file (over 650 MB) is archived using 7-Zip (Download) and may take a long time to download.
DOWNLOAD THE WDK ywe-wdk-i386.zip (7.6 MB)	Step 2 Once you have downloaded the virtual machine (VM), open the VM with VMware or VirtualBox and install this WDK Debian software package on the VM.

Burak Alkan · 14 Ekim 2011

nmap result:

Kod:

Starting Nmap 5.21 ( http://nmap.org ) at 2011-10-14 20:51 EEST
NSE: Loaded 36 scripts for scanning.
Initiating ARP Ping Scan at 20:51
Scanning 10.0.0.49 [1 port]
Completed ARP Ping Scan at 20:51, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:51
Completed Parallel DNS resolution of 1 host. at 20:51, 0.00s elapsed
Initiating SYN Stealth Scan at 20:51
Scanning braviaffb549ae53e8ded4.zyxel.com (10.0.0.49) [65535 ports]
Discovered open port 9784/tcp on 10.0.0.49
Discovered open port 52323/tcp on 10.0.0.49
Completed SYN Stealth Scan at 20:51, 29.79s elapsed (65535 total ports)
Initiating Service scan at 20:51
Scanning 2 services on braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
Completed Service scan at 20:51, 5.34s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
NSE: Script scanning 10.0.0.49.
NSE: Script Scanning completed.
Nmap scan report for braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)
Host is up (0.0034s latency).
Not shown: 65533 closed ports
PORT      STATE SERVICE    VERSION
9784/tcp  open  tcpwrapped
52323/tcp open  tcpwrapped
MAC Address: 00:A0:96:43:9B:98 (Mitumi Electric CO.)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.22
Uptime guess: 0.505 days (since Fri Oct 14 08:44:28 2011)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=204 (Good luck!)
IP ID Sequence Generation: All zeros


HOP RTT     ADDRESS
1   3.42 ms braviaffb549ae53e8ded4.zyxel.com (10.0.0.49)


Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.97 seconds
           Raw packets sent: 65983 (2.904MB) | Rcvd: 65551 (2.623MB)

Processor of the TV:

Bravia Engine 3

Renesas(NEC)EMMA3TH (MC-10153)

Sony Bravia 52LX900 Service Menu:

Turn off the TV
Press i+, 5, Mute and then Power
TV will power up with the service menu

Press 0 and 8 to reset TV settings.

Burak Alkan · 15 Ekim 2011

Finally opened up the TV. For the whole album: http://photobucket.com/52LX900/

The board used on the TV has a part number of 1-881-779-12 but a search on Google does not show anything up. But very interesting, Sony says that MCB FOR TV with part number 185776211 can be used on 52LX900. Also accroding to the service manual, it is A-1783-050-A

Tha panel:

Manufacturer Part#: A1793141A (Also search for: A-179-3141-A)
Manufacturer: SONY PARTS
Description: P-MOD 52LETT

And more info: The panel have Sharp UV2A technology.

This is the CN202 Port on Sharp CPWBX RUNTK 4351TP:

And Sharp CPWBX RUNTK 4351TP:

CN201 and CN104 . I don't know whether they are ports or not. These are on Sharp CPWBX RUNTK 4351TP:

After this part, everthing is you will see is on the mainboard of the TV (1-881-779-12 - the photo on the top), not the Sharp LED controller.

Part number 015402105. Got some info here and here saying "Pin, Cotter". Also interesting ABCDEF pins...:

CN5502 Port on Sony 1-881-779-12 Board. Also on top, LC245 IC.

Another printing I saw on the board: 603N4033-01R

CN2300, J2300 CN2404, CN3800 ports and a "DIP" (maybe DIP switch):

Sony D2817R IC with a port at the bottom. Looks like a JTAG but no info...

Sony CXA3803R Audio DAC + Driver for TV:

CN2400 Ethernet port. Micrel KSZ8041RNL IC is used for that. It is 10BASET/ 100BASE-TX. Why not Gbit Sony? Anyway it is labeled as IC2400. There are also CN2600, CN5500, CN5501 and for the record, F5500 3.15A

IC5000, CN5001, CN5000, IC3704, F3702, F1000 3.15A and CN2902 which is Optical output:

AD0G22153381
SUT-AE101Z
859772000
1324665

I could not find any info about this part buy Sony may find me with the barcode lol

NEC 720114 USB 2.0 Controller dubbed IC2403 This is not controllinng the USB port of the TV. Probably goes to wireless adapter.

2 x Samsung 025 K9F1208U0C-PIB0 64M x 8 Bits NAND Flash Memory.

Fujitsu Japan MB91F313A

The FR family* is a line of microcontrollers based on a high-performance 32-bit RISC CPU that contains a
variety of built-in I/O resources for embedded control applications which require high-performance, highspeed CPU processing.
MB91313A series has multiple communication macro channels, suitable for embedded control applications
such as TV control.
* : FR, the abbreviation of FUJITSU RISC controller, is a line of products of Fujitsu Semiconductor Limited.

IC2200 Slicion Image Sil98278CNU. No info on the web but it is the HDMI controller of the 4 HDMI ports on the board. One of them dubbed CN2261

CN2403. Interesting that NEC USB controller was also dubbed IC2403. This port is empty. Maybe it's our magic port

The blue PCB at the bottom is the Wireless card connected via USB 2.0 to NEC Controller. The cable is custom made by Sony.

The whole board with the CPU and all the other ICs and connectors. I did not remove the CPU cooler thinking that I could find info about the board and learn the CPU but that did not work. I may remove it later to see the CPU. Requires some soldering....

This is the back of the TV. On the left, the power supply. In the middle, Sharp CPWBX RUNTK 4351TP and on the right, 1-881-779-12 board.

The power supply board APS-267 with the part number 1-881-894-11

APS-267 GE4A & APS-268 GE4B

Part number 1-881-894-11