decompile-tv-lib

Decompile stripped ARM32 firmware libraries from LG webOS televisions using Ghidra headless analysis.

39|7|Updated Jul 3, 2026
One-click install
npx skills add https://github.com/GLinnik21/plx-native --skill decompile-tv-lib-glinnik21
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: decompile-tv-lib
Source: https://github.com/GLinnik21/plx-native/tree/main/.agents/skills/decompile-tv-lib
Command: npx skills add https://github.com/GLinnik21/plx-native --skill decompile-tv-lib-glinnik21

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? LG's webOS media stack is closed-source, stripped of symbols, and undocumented, so questions like "does this firmware parse this JSON key" or "what does this struct layout look like" cannot be answered from headers or other clients' source code. This Skill harvests the actual libraries off the television and decompiles them locally with Ghidra, turning firmware behavior questions into one-command lookups instead of guesswork. ## Core Features & Use Cases - Firmware harvesting: Pull the media stack (libplayerAPIs, libpf, libAcbAPI, libcbe, DILE/VPQ layers) off the TV over SSH with a sha256 manifest per binary. - String and symbol search: Grep .rodata strings and exported dynsym symbols instantly to check whether a payload key or function exists before paying for a decompilation. - Function decompilation and string cross-references: Decompile functions matching a name pattern and find which functions reference a given string literal, with per-library analysis caching so repeat queries take seconds. - Use Case: Verify whether webOS 4.5 parses Dolby Vision Load-payload keys by running str playerAPIs DolbyHdrInfo and str libpf profileId, confirming the exact JSON paths the firmware accepts before sending them. ## Quick Start Ask the AI to check whether the TV firmware parses a specific payload key by running the decompile skill's string search against the harvested libraries.

Frequently Asked Questions about decompile-tv-lib

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decompile a function from an LG webOS TV library?

Harvest the library with decomp.sh pull, then run decomp.sh fn with a library substring and a name pattern, for example decomp.sh fn libpf DolbyHdrInfo 4. The first query on a library runs Ghidra analysis and takes 15-60 seconds; later queries are cached and take seconds.

How do I check if webOS firmware parses a specific JSON payload key?

Search .rodata strings first with decomp.sh str, since JSON key paths are literal strings in the binary. If the key appears, use decomp.sh xref to find which function references it, then decompile that function to see how the value is used.

Why does Ghidra show FUN_0005dd18 instead of real function names?

The TV libraries are stripped, so only exported dynsym names survive, and C++ exports appear mangled like _ZN3smp4util16getHdrTypeStringEi. Internal functions get synthetic names; start from an exported symbol and walk inward rather than grepping for internal names.

Does Ghidra on macOS need a cask install or a formula?

Ghidra is a Homebrew formula, not a cask; brew install --cask ghidra fails. You also need openjdk@21 because Ghidra is a Java application and macOS ships no JDK, and the script locates the keg-only JDK and sets JAVA_HOME itself.

What are the limitations of decompiling stripped firmware binaries?

A string's presence proves the parser knows a name, not that the value reaches hardware, and data table contents like std::map initializers are not visible in disassembly. Recovering table contents requires reading the initializer or observing the function at runtime.