0xgalz

import idc
import idautils
import idaapi

FUNCTIONS_REGISTERS = {"g_log": "rcx", "g_log_error": "rdx"}


def get_string_for_function(call_func_addr, register):
    """
    :param start_addr: The function call address

psimoesbits

using System;
using System.IO.Ports;
using System.Threading;

namespace LGTV_BootloaderAccess
{
    internal class Program
    {
        private static void Main(string[] args)
        {

DavidBuchanan314

#!/usr/bin/python3

import sys
import os
import signal


PATTERN = b"root:x:0:0:root"
REPLACE = b"root::00:0:root"

DavidBuchanan314

/*
Decompiled from GetMeIn: https://forum.xda-developers.com/web-os/general/getmein-one-time-rooting-jailbreaking-t3887904

tl;dr it scans memory for its own `struct cred` in memory, changes its uid/gids to root.
*/

int __fastcall do_the_patching(uint8_t *a1, unsigned __int8 *creds, int a3, unsigned int a4)
{
  int i; // [sp+20h] [bp-Ch]
  uint8_t *memptr; // [sp+24h] [bp-8h]

wohali

Updating U4

1. Unscrew the case via the 4 screws on the back.
2. Desolder the positive lead of the rechargeable battery. This is necessary because the bootloader of U4 is only present immediately after power-on.
3. Configure Tigard (or other USB-TTL device) as follows:
   1. VTGT switch to 3V3
   2. TX to P1 (left side of U4, clearly marked
   3. RX to P2 (just above P1)
   4. GND to GND (just below P1, unmarked)
   5. Prep VTGT to connect to VTGT (just above P2, unmarked, trace goes to pin 2 of U4)

NeatMonster

Simple Hexdump

A simple hexdump module for Python.

Installation

The preferred installation method is:

pip install simple-hexdump

Informatic

#!/bin/sh

# Directory to store overlays in (one directory structure is created per overlay configured down below)
OVERLAY_BASE=/var/lib/webosbrew/customca

overlay() {
        set -e
        overlay_id="$(echo $1 | sed 's;/;__;g')"
        unset TARGET SOURCE FSTYPE OPTIONS
        eval $(findmnt -P $1)

throwaway96

Warnings

What you do with this information is your own responsibility. If you brick your TV trying this, it's not my fault. You should probably have some electronics experience if you want to attempt this.

This is going to involve opening your TV and attaching wires to the pins of an integrated circuit. If you're not comfortable with that, this is not for you.

This document is a work in progress.

debugstatus

LG TVs since at least the era of NetCast and "Global Platform" (webOS predecessors) have had the notion of a debug level, generally called "debugstatus". There are three modes: DEBUG, EVENT, and RELEASE. TVs normally operate in RELEASE mode. DEBUG mode enables a variety of logging and other debugging features in webOS, including access to the bootloader console and debug menus via serial. EVENT is similar to DEBUG, although it may not enable as much logging and has other relatively minor differences.

throwaway96

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

shinyquagsire23

DDC/CI Command Codes (antiquated MStar function, not real):
------
0xCC, 0xF1, 0xF0 - LG special? Only CC actually used.
3
1
0xC6
0xC8
0xF3
0xF5
0xB1