Reverse Engineer Samsung TV TizenOS

[edgarfroes]

Tizen is slow and full of ads, telemetry, all the bad stuff.

Is it possible to have rea reverse engineer a Samsung TV and install a custom OS on bare metal?

[deuxdoom]

REA can help inspect a firmware image you already have, but it doesn't provide a Samsung TV OS replacement or flashing workflow. Its current firmware support is offline inspection and extraction on Linux. What TV model and firmware version are you working with? Those would help narrow down a useful first investigation.

[edgarfroes]

It's a Samsung QN65Q80AAGXZD — Q80A 65" QLED, 2021, Brazilian retail variant. Platform codename 21_NIKEM2_QTV, Tizen 6.0 (model group 21TV_PREMIUM1), firmware family T-NKM2UABC, currently on BR build 2301.1. Dev mode is ON, but sdb shell/root are denied on this firmware.
Happy to pull the image — tell me what input REA handles best (Samsung's distributed package vs. something else) and I'll bring it.

[metaljay]

I’ve applied for ChatGPT blue to try help as well

[lehelbabos]

Interested in this as well.

I was able to build a custom app that acts as a Home replacement which works decently well, and adguard blocks a lot of the telemetry, but would prefer a fully de-bloated firmware that has the ads, spyware and bloatware stripped out completely.

Looks like Samsung has made some of its firmware files downloadable, but coverage on this seems spotty at best.

[metaljay]

I managed todo it:

sebastianspicker/tiz0wn#1 (comment)

[ylwl1997]

Related community note (Android TV ADB ops — different stack)

Your Tizen / Samsung TV thread is useful for own-set reverse-engineering questions. If anyone lands here with an Android TV / Google TV box instead (not Tizen), there is a short community teaching checklist for an authorized ADB ops loop: same Wi-Fi → human enables developer mode → approve on the TV → package inventory / pm disable-user for preinstall ad/bloat shells → sideload clearly open-source clients; optional REA inspect_android_package on an APK you already chose.

Live write-up (independent community site, unofficial / not affiliated with the REA maintainers):

• https://rea.run/showcase/android-tv-adb-rea-ops/

Compliance framing on that page: own/authorized devices only; no DRM or paid-stream cracks; ToS/copyright risk for any community clients stays with the operator. For Tizen-specific protocols this does not substitute a Tizen analysis — it is only a sibling “own TV” shape on a different OS.

Official source of truth: https://github.com/morluto/rea · device lane notes: https://rea.run/docs/android-adb/

[amitpadhan525]

Since the TV has Tizen 6.0, I think analyzing the official firmware package with REA would be a good starting point. Binwalk may help identify the firmware structure and extract its components. The main challenge will be bypassing firmware protections and finding a safe way to boot a modified image. A fully custom OS may not be practical without bootloader support.

[edgarfroes]

Will do this now. Since claude is ditching rea support, I'm using my Windows computer with rea over opencode and DeepSeek models, both on PowerShell and WSL as needed. I'm not sure how it's going to be, so with me luck with this one. Will report progress.

[xvertile]

https://github.com/chris-ritsen/samsung-tv-root