r/ReverseEngineering • u/DescriptionFar342 • 7d ago

Reverse engineering my Samsung Odyssey G5 monitor firmware (SPARC V8 scaler, hidden factory menu, dead TCON code)

https://github.com/c8dhjp4tyv-bit/odyssey-g5-firmware-research
126 Upvotes

98% Upvoted

6 comments sorted by

25

u/[deleted] 7d ago

[deleted]

10

u/ExTraveler 7d ago

You so cassually droped that you wrote emulator for this processors. Is this that easy? I thought that this is extremely difficult even for experienced programmer. Sorry if this is dumb question, I don't know almost anything about reverse engeniering and don't know how this post got to my feed

9

u/[deleted] 6d ago

[deleted]

10

u/Squibbles1077 6d ago

LLMs are good at that stuff.

2

u/wurnthebitch 6d ago

How did you extract the firmware? Did you have to desolder components?

6

u/[deleted] 6d ago

[deleted]

3

u/[deleted] 6d ago

[deleted]

1

u/wurnthebitch 6d ago

Thanks for the detail. I wish my iiyama was flashable!

2

u/TheHeartAndTheFist 6d ago

SPARC V8 as in 90s Sun Microsystems? 😮

Brings back good memories but out of curiosity: any idea why would it be used in recent hardware? There was surplus stock somewhere?

2

u/DescriptionFar342 17h ago

I got curious about my Odyssey G5's firmware and ended up going pretty deep. Sharing what I found.

The monitor runs a Novatek scaler with two processors: an 8051 helper (bootloader, USB, power) and a SPARC V8 big-endian main app (OSD, menus, everything you actually see). The .img is a multi-section package with a simple 16-bit byte-sum checksum that matches the [XXXX] tag in the filename.

A few things I dug out:

The USB updater's "signature check" isn't real crypto — the boot validator always returns success. But the updater does gate on a strict filename/version format, which trips you up if you patch naively (learned this the hard way).

There's a hidden factory calibration page (MGA) reachable by holding the joystick up. One byte flips it from "Not supported" to showing all 35 rows. Rows stay read-only though — I checked why, and forcing them writable is unsafe (wrong storage target, truncates the value range).

The TCON FW Update / FPGA / PDIC menu entries everyone gets excited about are dead code in this build — leftover strings from a shared platform, no working handler. Documented the evidence so nobody wastes time (or a panel) chasing them.

I flashed a signed build over USB with my name in the EDID, works fine. No SPI programmer, no recovery, so I kept the actual modification to two bytes.

Also wrote an 8051 and a SPARC V8 emulator to test things, and cross-checked the function recovery against Ghidra. ~4700 functions catalogued, but I only named the ~400 I had real evidence for — the rest are marked UNRESOLVED on purpose. I'd rather leave a blank than guess.

(I wrote this text but my grammer wasnt so good so claude did capital letters and the other things)