Tag Archives: Smart TV

Firmware downgrade for LG Smart TVs

208 Replies

I must admit, I’m baffled to see LG pull a stunt like this after having faced public backlash over their spying on their customers’ TV viewing habits. After backpedaling on the issue last year, they’ve now done a full 180 and reserve the right to record your entire viewing habits and share this data with everyone and their mom, even in countries with most likely less strict data protection laws. And here’s the kicker: if you don’t agree to these terms, many of the SmartTV features you paid for will be lost!

That’s apparently par for the course cause LG also removed the ability to switch audio tracks on local DLNA playback some firmwares ago (alledgedly due to copyright reasons). And when I set my LG TV to a non-existant gateway to stop it from sending my data to LG (my old Fritzbox does not blacklist), I could not connect to my local NAS anymore despite it being in the same network segment.

Also bad is the fact that, probably due to being embarrassed on a regular basis by all the bugs and removed features of their firmwares, LG does not offer changelogs. So when you’ve updated your TV’s firmware on the slim hope of seeing some improvements/fixes, you’ll notice the new terms you’ll be forced to agree to only after the fact! And since LG offers no way to downgrade the firmware, you’re suddenly stuck with a device with less features and more spying on you than you bargained for.

Fortunately, some Russian hackers felt the need to adress the issue and reverse engineered the firmware update process and made a small business out of giving the LG customers what they want. Others took note and devised a do-it-yourself approach to downgrade your TV (thx, nenif).

How to downgrade your LG TV’s firmware
The idea is simple enough: download an older official firmware from the LG website and use your own DNS server on your PC/laptop to trick your TV into thinking it’s downloading from the official site. Supposedly this method applies to the 2012/2013 models, I’ve successfully done it with my 40LN5758 (downgrading from 04.22.xx to 04.04.05) using the instructions below. With more recent firmwares you might have to add some additional steps mentionend in the comments (thanks to all contributers). So if at first you don’t succeed, please check em out.

NOTE: I’M NOT RESPONSIBLE FOR ANYTHING THAT MIGHT GO WRONG WITH THE DOWNGRADE – YOU’RE DOING THIS AT YOUR OWN RISK!

I can’t stress that enough! Apparently some people have had weird experiences with their downgrade attempts. If you have other models/versions than those mentioned here as being applicable, don’t try this or you might brick your device!

  • Download LgDTVUpDater_new.zip and unzip it to your drive c:\ so that you end up with a dir called c:\LgDTVUpDater (another destination will likely result in error messages later on).
  • Check out the folder “Antwort” inside the htdocs folder. That’s a translation of “response”, meaning the server’s responses people already received and listed for your convenience. Browsing the files inside you can see links to lots of older firmwares.
  • Download the firmware you want to downgrade to and unzip it to C:\LgDTVUpDater\htdocs\
  • Open C:\LgDTVUpDater\dns\AcrylicHosts.txt in an editor like Notepad++ and change the IP adress of snu.lge.com in the last line to your PC’s address (in my case 10.10.10.40), then save the file. As suggested in the comments, downgrading from more recent firmwares might require to add additional servers: rdvs.alljoyn.org, fi.lgtvsdp.com, us.lgtvsdp.com – one per line – with the same IP address.
  • Start C:\LgDTVUpDater\startDNS.bat and then C:\LgDTVUpDater\startHTTP.bat with a double-click resulting in 2 black windows (showing that the Acrylic DNS server and the Apache server are running) and probably your firewall complaining. In that case, allow both.
  • On your TV select Settings > Network Connection > Start Connection > Cancel > Manual Setup > Wired (firmware updates are huge and any disconnects over wireless might lead to bricking your TV). Keep IP MODE on Auto Input, set DNS MODE to Manual Input and enter your PC’s IP address
  • Select Settings > Support > Software Update > Check Update Version but do not update! Close when the check has been performed. This check generates a file with some needed info on your TV’s model.
  • Open C:\LgDTVUpDater\htdocs\in_dump.txt and copy your TV’s model name from inside the MODEL_NM-tag. For my LN5758 it’s
    HE_DTV_NC4M_AFAAABAA
  • Check C:\LgDTVUpDater\htdocs\ if a file of that name already exists (these are text files with a simple xml structure inside, they have no extension like .txt or .xml). If not, copy one of the other files over to that name
  • Edit the new file, in my case HE_DTV_NC4H_AFAAABAA. It will look quite jumbled cause there are no line breaks. If you add them manually, it looks something like this:

    response

  • There are only a few entries to change:
    IMAGE_URL: the IP of your PC
    IMAGE_NAME: name of the firmware file you unzipped
    CDN_URLIP: IP of your PC and name of the firmware

    You can also change
    UPDATE_MAJOR_VER: major version of the firmware
    UPDATE_MINOR_VER: minor version of the firmware

    but this should only be cosmetic cause the revision number is also stored inside the epk. The FORCE_FLAG set to Y should ensure any current version being overwritten with the one you’ve downloaded, thus enabling the downgrade in the first place.
    Save the file.

  • Now close the two command prompt windows and double-click again on C:\LgDTVUpDater\startDNS.bat and then C:\LgDTVUpDater\startHTTP.bat
  • On your TV select Settings > Support > Software Update > Check Update Version: a new firmware is found! Update.
  • When the update is through (which should be pretty fast since it’s done from your PC), the TV will reboot.
  • Upon restart, you’ll get a message window with another progress bar (in my case a yellow frame with the foreign language text flipped). The firmware you just downloaded to your TV is now being installed. Once this is through, the downgrade is complete.
  • For good measure you should reset the TV to factory defaults. Please note, that you will have to scan and sort channels after that. Even if you don’t reset, you’ll have to agree to this firmware’s terms of use before you can use Smart TV functionality. As mentioned above, these should be less restrictive than the ones you had to agree to before. If not, downgrade to an even older version ;)

Feel free to add model numbers of TVs you successfully downgraded or links to firmwares in the comment section.

LG 42LN5758 – Why LG? Why indeed!

lgsux

True, it’s been a while since my last entry. Regrettably that doesn’t mean I haven’t seen crappy devices over the last few years. However, of all the devices I’ve tested recently, the LG annoyed me enough to write about it, so here it goes. I figured, Amazon’s Cyber Monday might be the right time to get a bargain on a new TV for the inlaws and the feature list of the LG 42LN5758 looked appealing. Little did I know at the time of LG’s sneaky way of logging info on their users’ viewing habits as uncovered by DoctorBeet. And sure enough, my model on firmware 03.20.38 does send the filenames of all media files on an attached USB drive to an LG server:

sniff

Of course, I could block the URLs in my router (there’s not even an option in the menu to turn this off) or wait for a firmware update dealing with this once LG figured out, the public backlash wasn’t worth the extra pennies they might gain from advertisers (apparently it’s time now, please check the update at the bottom of this page). However, I’ve read a lot of complaints about firmware updates removing features with no chance of getting them back as well as LG making it next to impossible to downgrade to a previous version.

nooption

That’s obviously par for the course cause LG makes it needlessly complicated to do the initial channel scan: you have to select ALL instead of ASTRA and then NONE which is quit unintuitive if you’ve seen the menu. Hilariously enough, they seem to think their method of sorting channels on the TV with the remote involves only a few simple steps “making your life so much easier”, I kid you not. To transfer the channel list to USB to do the sorting on your PC, you have to take this clumsy approach:

– use a regular LG remote (fortunately there’s no oh-so-improved ‘Magic Remote’ or Logitech Harmony required)
– press and hold SETTINGS until the channel info appears at the top of the screen
– release immediately and as fast as you can enter ‘1105’ followed by OK
– in the upcoming Installation Menu select USB Cloning > Send to USB
– sort the channels in Chansort on your PC and repeat the process

Why does it have to be this complicated? Why can’t the channel list be copied from a regular menu? Beats me! Apparently all TV manufacturers consider this data to be so much more than a bunch of parameters, easily being stored and edited in a simple CSV file like this

Pr#;Channel Name;Favorites;Lock;Skip;Hide;Encrypted;Satellite;Ch/Tp;Freq;ONID;TSID;SymRate;SID;VPID;APID
40;CNN Int.;0;;;;;ASTRA 19.2E;;11778;1;1068;27500;28522;165;100

they make you jump through extra hoops to get it.

The same goes for USB recording: it’s embarassing to see manufacturers – in an act of preemptive obedience towards rightsholders – encrypt all lawful (!) recordings so they cannot be watched elsewhere. But what’s the point of using exotic filesystems which renders a recording USB HDD useless for anything else? The Samsung UE40D8090 uses XFS as a filesystem but writes to drives already partitioned with it. Thus I can split my drive into NTFS/XFS partitions and play back media files from the NTFS partition and record to the XFS partition, all on the same drive. Not so with the LG, even an already paritioned drive (with JFS in this case) will be formatted. The LG apparently creates an extra 50 MB ext3 partition with a 500 KB binary ‘LGDB.vol’ file on it and if even if you keep this partition/file when resizing the JFS partition and adding a new NTFS partition, the LG deems the drive unusable and wants to format it again which prevents you from using it for anything else.

jfs-usb-recording

Also annoying is the fact that you cannot switch inputs fast cause pressing INPUT on your remote usually opens the fancy input list where repeated presses of INPUT do cycle through the input sources which still need to be confirmed by pressing OK. Switching from USB playback to TV like this, however, does not work, you need to press BACK (which apparently manufacturers just cannot agree on where to place on a remote) several times, depending on how deep down you were in the folder structure of your USB device, to get back to the input list where only then you can select another source. Worse, to eject the USB device you first need to switch to another source to be able to call up the Quick Menu (Q.MENU on the remote) where you need to press RIGHT 11 (!) times to reach the ‘Eject USB device’ button (how’s that for quick?) cause the generally commendable first-to-last/last-to-first vertical navigation in menus inconsistently does not apply to right/left navigation.

The main issue for the inlaws however is that one of them is hard of hearing and therefore needs to listen to the TV with a wireless TV headphone while the spouse listens via the TV’s speakers (a not too uncommon arrangement, IMO). Their current CRT TV has a cinch line-out so the speakers do stay on with the volume-adjustable headphones attached. Unfortunately the LG only has a cinch line-in and the headphone jack mutes the speakers once a headphone is plugged in. And of course you cannot turn this off and therefore cannot have audio over headphones and speakers simultaneously.

So why is there an option in the audio menu to switch between speakers and headphones, you ask? My guess is that some of the geniuses at LG eventually figured out that the placement of the headphone jack (which looks like a dummy connector, by the way) on the rear side (!) of the TV would make it inaccessible with the TV being mounted to the wall. Guess how many customers did not think of this and had to unscrew the TV again. That was probably the same genius that placed the volume/channel/settings buttons on the rear side of the device too.

lgrear

While waiting for LG customer support to comment on this, I found various entries on popular consumer electronics boards suggesting this feature has been requested by customers like forever. And sure enough, LG support told me the only way to get audio from speakers and headphone simultaneously would be to use a SCART to RCA adapter which I’d already tried in the meantime resulting in speakers and headphone being slightly out of sync and therefore unusable but especially as there is no sound coming out of the headphones when recordings/media files are played back from an attached USB device! Facing these facts, the support acted in true LG fashion by shifting the blame on me, suggesting they’d expect customers to conduct proper research into a device’s features prior purchase.

Of course I didn’t bother to ask how the phrase ‘AUDIO menu items are disabled when connecting a headphone’ from the manual PDF could possibly be construed to mean that simultaneous audio is impossible, nor did I bother to test the validity of the phrase ‘Optical Digital Audio Out is not available when connecting a headphone’ by buying a Toslink to Cinch converter. I simply decided to switch to another brand.

Why LG? Why indeed!

Update, December 14th
Apparently LG has finally caved and released update 04.20.29 (currently only available via the TV’s support menu) that stops sending unencrypted user data and USB filenames to LG (HBBTV data apparently is still being sent to the networks). You can verify this by downloading this dump file and browsing it in Wireshark. Right-click > save as and once downloaded rename to .zip (I can’t be bothered to purchase WordPress’ Space Upgrade just for a new filetype). While logging this file I briefly watched ARD (with HBBTV) and ZDF before switching to USB and playing back the file “LGsux.avi”.

While it’s nice to see that LG finally got it, it took them two intermediate updates (04.00.49 and 04.04.05) the latter of which forced you to agree to a new privacy policy which only was possible AFTER the upgrade! Failing to accept the new terms of the Collection and Use of Data (PDF in German), would result in not being able to adjust basic settings, like choice of satellite. And to top it all off, LG apparently changed the TTL file format in this one which means, channels cannot be sorted on the PC anymore until Chansort is updated to handle this!

In case you were wondering: NO, of course LG did NOT enable simultaneous audio over TV speakers and headphones in any of these updates. Hey, it’s only been requested for 2 years or so…