Easy shell : PHPShell

The first thing to do to when you want to start developing on the WDTV
is to connect to the shell.

Using telnet or ssh requires a fresh new compiling of Busybox and activating
many options. A much faster way is to use the integrated PHP server to add a web shell. This solution is not perfect but does not require compiling code. The base functions allow you to run most of commands. The only limitation is with commands requesting
a confirmation. The shell input must then be done using the JTAG …

PhpShell is very quick to install. Download and unzip the archive phpShell-2.4.zip in the ~ / wdtvgen3/PALACE_1_05_18_G/build/root/webserver/htdocs/ (see the post First compiled GLP code)

rename the folder phpShell-2.4 to phpShell

Edit config.php to add your login / password
admin = "wdtvgen3"

Restart the command make firmware

Flash your WDTV Live. You can now connect to the shell with the address http://ip_of_wdtv/phpshell/phpshell.php

Unbrick of the death !

If your WDTV reboots or restarts blocked, it is because your flash failed.
But there is a solution (that doesn’t work in all cases but will allow you to take control via JTAG) !

To force the flash, you will have to invalidate the primary file system !

You must remove the motherboard from the case. Then desolder the metal shield.
You must use a high power soldering iron if the heat is absorbed by the metal plate. Personally, I use a mini torch.

Then you have to solder a wire on a pin of the “Chip Enable” flash chipset. (Use a low power iron soldering now).

The wire must be long enough to go around the mainboard and touch the VCC jtag pin.

Now it should boot without touching for now. This is what the JTAG displays :

Reading NAND CS0, addr 0x01280000, size 0x00000800 to 0xb5ffbfc0
Reading NAND CS0, addr 0x01280800, size 0x003aac00 to 0xb5ffc7c0

There are tree reading operations.
Reading NAND CS0, addr 0x00d80000, size 0x00000800 to 0xb63fbfe0
Reading NAND CS0, addr 0x00d80800, size 0x00022400 to 0xb63fc7e0

Reading zboot
Reading NAND CS0, addr 0x01280000, size 0x00000800 to 0xb5ffbfc0
Reading NAND CS0, addr 0x01280800, size 0x003aac00 to 0xb5ffc7c0

Reading primary file system
Reading NAND CS0, addr 0x00780000, size 0x00000800 to 0x01840000
Reading NAND CS0, addr 0x00780800, size 0x00402400 to 0x01840800

Reading secondary file system

The readings two and tree only take tree second. You must then operate during the second reading, then make the wire touch the VCC for less than a half of a second. The primary filesystem MD5 will be invalid. The WDTV will then directly boot to the secondary file system but will only partially execute the init script.

You should now get the jtag bash. If this is not the case, it’s very bad !
Insert the USB drive with the homebrew and run the command ./init upgrade.
Wait, reboot and flash.

I performed this only two times, but both flawlessly.

Good luck !


Warning : Opening your WDTV Live Streaming device will void its warranty !

To open your WDTV Live Streaming Gen3, first find the screw under the back label (near the mac address). Use a Torx size T10 screwdriver . Unscrew and push the screw to open the case.

You must use a RS232 to TTL converter to connect your computer to the WDTV Live. The converter transforms +9V/-9V RS232 signal to 0V/3.3V TTL.

The TX WDTV must be connected to the RX computer and the RX WDTV must be connected to the TX computer.

Transfer parameters : 115200 baud, 8bits, no parity, no control flux.

Western blocked input so you can’t use Yamon option or bash command. (except in special cases that i will explain in a next post…)