Category:TV/Porting postmarketos to tv: Difference between revisions
Line 120: | Line 120: | ||
====Linux-based==== | ====Linux-based==== | ||
Old exploit which has been patched by aa0206pf update: https://github.com/CFSworks/nimue | Old exploit which has been patched by aa0206pf update: https://github.com/CFSworks/nimue | ||
===Roku=== | |||
RootMyRoku, a root exploit which has since been patched: https://github.com/llamasoft/RootMyRoku | |||
In theory, any Roku device running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable. | |||
Exploitee.rs, known as GTVHacker back then has published a guide earlier in the Roku 3 days: https://exploitee.rs/index.php/Exploiting_Roku , as of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce. | |||
The Roku HD1000 has been hacked to install VLC media player: https://www.jpsaman.org/node/3 | |||
The Roku XT has been rooted in 2021 and covers a 6-part long documentation about the roku including internels and serial ports: https://tdot.fish/tag/roku/ | |||
== Documentation == | == Documentation == |
Revision as of 17:49, 28 November 2022
postmarketOS does not currently supports any TVs. Some targets in the future could include WebOS or Tizen based systems (among others and older ones), which are already based on Linux. Android-based TVs (including Fire OS) already have pages.
Vendors
Samsung
Samsung has used Tizen in their modern TVs. 2008-2014 models used the Orsay (possible codename, unknown source) or otherwise known as the (retroactively renamed) "Samsung Legacy Platform", see here.
Getting access via debug port (recommended method for root and most likely installation vector)
See https://wiki.samygo.tv/index.php?title=Ex-Link_Cable_for_C/D/E_Series_and_BD_players
Firmware extraction and modification (only works for E-series and below)
Extracting
1. Setup a Python 2.7 environment with pycryptodomex (most recommended), pycryptodome, or pycrypt/pycrypto (what the script is made for, but outdated and vulnerable) 2. Download samygo_patcher.py from https://github.com/george-hopkins/samygo-patcher/blob/master/samygo_patcher.py and aquire the firmware image of your television if you haven’t already (only up to E-Series (2012) is supported. Either extract the .EXE file using 7zip, or running it on Windows or Wine. 3. Run samygo_patcher.py in python 2, and tell it to decrypt_all and point to the folder beginning usually with T-. If you have renamed or moved the image folder or point to the image folder, you will get an error. 4. The decrypted image files can be extracted with 7zip or even better, mounted as a drive, except the file “Image” as it’s a binary file.
- exe.img contains the Orsay operating system and its resources
- rootfs.img contains most of the Linux kernel and it’s resources.
- Image is an unextractable binary file, most likely uboot
- emanual.img most likely contains the manual information for the television model.
Modifying firmwares
1. Follow the tutorial to extract the firmware, but mount the images in step 4 with write permission. 2. Modify the firmware however you would like 3. Run SamyGO patcher, but this time tell it to encrypt and point to the file you would like to encrypt, or say encrypt_all and point towards the folder. 4. Move or delete the decrypted files and install them on your TV (or TV motherboard, for you salvagers out there)
Method 1
This method works on almost all current (2010 onwards) Samsung LCD sets, including HD and UHD versions. Put the TV into standby mode. On the remote, press {Info} {Menu} {Mute} {Power} in sequence. If successful the TV will turn on and the service menu will now display.
Method 2
Put the TV into standby mode. On the remote, press {Mute} followed by {1},{8}, {2}, {Power} in sequence. If successful the service menu will now display.
Method 3
With the TV in standby, press the {DISPLAY} {P.STD} {MUTE} {POWER} on the remote.
Method 4
With the TV in standby, press the {SLEEP} {P.STD} {MUTE} {POWER} on the remote.
Method 5
With the TV in standby, press the {DISPLAY} {MENU} {MUTE} {POWER} on the remote.
Method 6
With the TV in standby. On the remote, press {MUTE} followed by {1} {1} {9} {ENTER} in sequence.
Tizen
Samsung explicitly writes in the software license information that they only provide the source code for the TV if it is requested by someone at the latest three years after they shipped the last batch of the model. If you have a Samsung TV that is only a few years old and the source is not already published you might want to request the source code now, in case you want to look at it in the future. |
Orsay/Samsung Legacy Platform
The user SkyBladeCloud has used the Ubuntu userspace on the 46ES8000, so it seems that the legacy platform is also Linux based. See here. The original TV operating system runs in an X-window server opened when the Smart Hub button on the remote is pressed, and may be available in pmOS as an application like Waydroid.
See also the SamyGo project and this LWN article about it.
LG
LG used Netcast in their 2010-2014 models and WebOS (which uses OpenEmbedded) since then.
LG is publishing open source code on https://opensource.lge.com
According to an OpenLGTV developer, there are no TVs with mainline support, because there are a lot of hardware customizations. Booting a custom kernel requires hacking the bootloader which is normally verifying signatures.
External Links
- OpenLGTV Discord (Note that postmarketOS doesn't recommend proprietary platforms like Discord.)
webOS
webOS-based televisions can be rooted via visiting https://rootmy.tv/ and sliding the slider (just like JailbreakMe back in the old iPhone days, and will install the webOS Homebrew Channel (just like in the Wii days).
External Links
NetCast
Google TV/Android
LG has made two models based on Android, the 55G2 and the 47G2.
Recovery Menus
According to a recently released video there is way to access the recovery menu on the LG TV' that has Google TV (Android OS) on it.
Tested Hardware
- LG 55" Class Cinema 3D LED Google TV - 55GA7900
Procedure
Shut down the TV and disconnect it from power.
- Connect the TV to power but don't turn it on.
- Press the "settings symbol" button first and while holding it press the "channel down" button.
- Release the "settings symbol" button and then release the "channel down" button.
The TV will turn on and will show the Android Recover Menu. Use the volume keys to navigate the options and press the "Wheel-button" to select the options.
Source
Roku OS
See Roku section
Philips
Philips used NetTV on older models and Android TV on newer TVs.
NetTV
https://fredericb.info/2014/11/exploitation-of-philips-smart-tv.html
The serial port, which is a generic 3.5mm port just like Samsung's is exploitable, and gives a shell, and is vulnerable to CVE-2012-5958.
Linux version 2.6.28.9-oslinuxR7.5 (root@lxdevenv) (gcc version 4.2.4) #1 Thu Jun 16 23:27:36 CEST 2011 console [early0] enabled CPU revision is: 00019651 (MIPS 24Kc) FPU revision is: 01739300 282 MB SDRAM allocated to Linux on MIPS 512 MB total SDRAM size Endianess : LITTLE [...]
Android TV
The Android TV models can be rooted, except when dm-verify is enabled: https://forum.xda-developers.com/t/guide-how-to-root-2015-philips-android-tv.3323912/
Possibility for booting into other kernels using kexec.
CVE-2019-2215 is a temporary root vulnerability: https://github.com/LIznzn/CVE-2019-2215
Sony
Sony Bravia TVs run a Linux-based proprietary operating system, however newer ones run Android TV.
Linux-based
Old exploit which has been patched by aa0206pf update: https://github.com/CFSworks/nimue
Roku
RootMyRoku, a root exploit which has since been patched: https://github.com/llamasoft/RootMyRoku In theory, any Roku device running RokuOS v9.4.0 build 4200 or earlier that uses a Realtek WiFi chip is vulnerable.
Exploitee.rs, known as GTVHacker back then has published a guide earlier in the Roku 3 days: https://exploitee.rs/index.php/Exploiting_Roku , as of version 3063 this bug no longer works. We released this attack on a Saturday during the US New Year holiday weekend and it was patched the following day by an OTA update. The bug was introduced into Roku code two months prior to our finding it meaning that affected versions in the wild are scarce.
The Roku HD1000 has been hacked to install VLC media player: https://www.jpsaman.org/node/3
The Roku XT has been rooted in 2021 and covers a 6-part long documentation about the roku including internels and serial ports: https://tdot.fish/tag/roku/
Documentation
TODO: This section is primarily about LG. Either divide this, or merge this with the Vendors -> LG |
Some software and documentation is available in the repos of OpenLGTV here.
DTV systems
Name | Market |
---|---|
arib | Japan |
dvb | Europe |
atsc | North America |
EPK Naming (previous convention)
Example: starfish-atsc-secured-goldfinger-38.arches-380605-04.33.05-prodkey_usb_V3_SECURED.epk
Part | Description |
---|---|
starfish
|
OS codename |
atsc
|
DTV system |
secured
|
it’s a signed firmware |
goldfinger
|
release type? |
38
|
package sequential number? |
arches
|
platform codename |
380605
|
build/revision number? |
04.33.05
|
firmware version |
prodkey
|
signing key used |
usb
|
firmware update delivery method |
V3
|
EPK version (EPK3 in this case) |
SECURED
|
EPK is signed |
Platform table
Platform | Codename | SOC | Example |
---|---|---|---|
arches | starfish-atsc-secured-goldfinger-38.arches-380605-04.33.05-prodkey_usb_V3_SECURED.epk | ||
angeles | starfish-atsc-secured-goldfinger-57.angeles.t2dongle-570006-09.00.06_nsu_V3_SECURED.epk |
EPK Naming (new convention)
Example: starfish-dvb-secured-lm14a-biscayne-1343-04.25.65-prodkey_usb_V3_SECURED.epk
Part | Description |
---|---|
starfish
|
OS codename |
dvb
|
DTV system |
secured
|
it’s a signed firmware |
lm14a
|
platform (2014 in this case) |
biscayne
|
release codename (can have multiple platforms) |
1343
|
build number? |
04.25.65
|
firmware version |
prodkey
|
signing key used |
usb
|
firmware update delivery method |
V3
|
EPK version (EPK3 in this case) |
SECURED
|
EPK is signed |
Platform table
Platform | Codename | SOC | Example |
---|---|---|---|
k3lp | dixie, drto, dunggir | Realtek | starfish-dvb-secured-k3lp-573.drto.k3lp-57304-04.70.04-prodkey_nsu_V3_SECURED.epk |
lm14a | biscayne | starfish-dvb-secured-lm14a-biscayne-1343-04.25.65-prodkey_usb_V3_SECURED.epk | |
m16p3 | gyeryongsan | lib32-starfish-arib-secured-m16p3-538.gyeryongsan.m16p3-53802-05.00.02_prodkey_usb_V3_SECURED.epk | |
m16p3 | gyeongju | lib32-starfish-dvb-secured-m16p3-520.gyeongju.m16p3-52002-04.80.02_prodkey_usb_V3_SECURED.epk | |
k5lp | gulaga | starfish-dvb-secured-k5lp-507.4ooZC7hKgulaga.k5lp-50717-04.71.30_prodkey_nsu_V3_SECURED.epk | |
k5lp | gyeryongsan | Realtek | starfish-dvb-secured-k5lp-539.gyeryongsan.k5lp-53902-05.00.02_prodkey_usb_V3_SECURED.epk |
lm18a | goobang | MStar | starfish-dvb-secured-lm18a-97.goobang.lm18a-9703-05.30.10_prodkey_usb_V3_SECURED.epk |
o18 | glacier | starfish-dvb-secured-o18-56.glacier.o18-5629-05.10.45_prodkey_usb_V3_SECURED.epk | |
o20 | japoon | starfish-atsc-secured-o20-37.japoon.o20-37060109-03.11.26_prodkey_usb_V3_SECURED | |
o20 | jardine | lib32-starfis8lUAcjpCh-atsc-secured-o20-jardine-290904-03.21.16_prodkey_nsu_V3_SECURED.epk |
There is some platform/codename relation.
mach- codename and folder in /drivers/mstar2/hal/ | defconfig filename |
---|---|
maxim | lm17a |
mustang | m2r |
m7621 | lm18a |
munich | m2 |
External links
This category currently contains no pages or media.