Reverse engineering my Samsung Odyssey G5 monitor firmware (SPARC V8 scaler, hidden factory menu, dead TCON code)

[umutcagand]

I got curious about my Odyssey G5's firmware and ended up going pretty deep. Sharing what I found.

The monitor runs a Novatek scaler with two processors: an 8051 helper (bootloader, USB, power) and a SPARC V8 big-endian main app (OSD, menus, everything you actually see). The .img is a multi-section package with a simple 16-bit byte-sum checksum that matches the [XXXX] tag in the filename.

A few things I dug out:

The USB updater's "signature check" isn't real crypto — the boot validator always returns success. But the updater does gate on a strict filename/version format, which trips you up if you patch naively (learned this the hard way).

There's a hidden factory calibration page (MGA) reachable by holding the joystick up. One byte flips it from "Not supported" to showing all 35 rows. Rows stay read-only though — I checked why, and forcing them writable is unsafe (wrong storage target, truncates the value range).

The TCON FW Update / FPGA / PDIC menu entries everyone gets excited about are dead code in this build — leftover strings from a shared platform, no working handler. Documented the evidence so nobody wastes time (or a panel) chasing them.

I flashed a signed build over USB with my name in the EDID, works fine. No SPI programmer, no recovery, so I kept the actual modification to two bytes.

Also wrote an 8051 and a SPARC V8 emulator to test things, and cross-checked the function recovery against Ghidra. ~4700 functions catalogued, but I only named the ~400 I had real evidence for — the rest are marked UNRESOLVED on purpose. I'd rather leave a blank than guess.

(I wrote this text but my grammer wasnt so good so claude did capital letters and the other things)