yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] jonathanxda:
tv packet traffic

Enjoying this thread, esp the xor bits.

I wanted to see what sort of traffic my NSX40GT1 TV generates when it's sitting idle.

Since I run dd-wrt on my router, it was easy to add the iptables commands to clone traffic to my pc and capture with wireshark.

iptables -t mangle -A POSTROUTING -d 192.168.3.134 -j ROUTE --tee --gw 192.168.3.100
iptables -t mangle -A PREROUTING -s 192.168.3.134 -j ROUTE --tee --gw 192.168.3.100

3.134 is the TV. 3.100 is my pc.

CSV of capture is attached. Mostly it's the TV updating the safebrowsing list, which is google's blacklist of known nasty sites.

Line 34 and following is interesting.

It looks up clients.l.google.com and initiates a brief ssl conversation, which makes me suspect that the TV is sending things to google they'd rather not have us see.

For the time being, I added the following to dd-wrt dnsmasq additional options to prevent any conversation with the urls in the capture file to observe the results. Since making the change, I still see dns lookup requests, but no attempts to communicate beyond that, which you can see in the second capture file.

address=/clients.l.google.com/127.0.0.1
address=/clients2.google.com/127.0.0.1
address=/safebrowsing.clients.google.com/127.0.0.1
address=/safebrowsing-cache.google.com/127.0.0.1
address=/safebrowsing.cache.l.google.com/127.0.0.1

Also seen are android.l.google.com and android.clients.google.com.

Those are sources for update packages; I saw ssl conversations there, too.
[Android Software/Hacking General [Developers Only]] rad_thundercat:
Awesome work guys. I picked up my Revue yesterday and will be watching this thread very close!
[Android Software/Hacking General [Developers Only]] subyfan:
Bump bump bump bump!!!
[Android Software/Hacking General [Developers Only]] Chahk:
I really hope someone roots the Revue and GT1 boxes soon. They only thing that's missing on them is ability to run Market and side-load apps.

The modified Flash 10.1 player alone would make these units 1000% more useful by bypassing the networks' OS checks and allowing all "blocked" content to play.
[Android Software/Hacking General [Developers Only]] hharte:
Some of the Logitech binaries run on Ubuntu, and you can strace them to see what they are doing. Tried it with recovery, but basically it fails loading shared libraries. One thing I'm going to try is booting Android-x86 and copying all of the Logitech files to a USB stick and then chroot to it, and see if I can run init or recovery.

Also, on the Logitech support site, they say holding the reset button while plugging in the device does do a recovery. It appears to actually do a factory data reset, but looking through the Logitech rootfs, I'm thinking thatb it's actually "auto recovery" and there is a script for it. Maybe the key is to press reset while powering on, and then press some key on the keyboard to get into the full recovery, instead of auto recovery.

Another possibility is to try and build the Logitech kernel from source and try to run the whole thing from a PC or from qemu.
[Android Software/Hacking General [Developers Only]] hkoutso:
Another OTA is on the way (at least for Logitech Revue)

I heard from a reliable source (that I cannot name at the moment) that the Revue is up for another OTA by the end of the week.

I don't know how reliable my source is but I am just mentioning it in case we can find the new link and play around with the update.
[Android Software/Hacking General [Developers Only]] majortom1981:
sony

the sony one has gotten a second update already so the logitech update is probably fixing the same bugs.
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
It's possible the logitech update (which is not XOR'ed) could reveal the XOR key used by sony. Then any of the sony-only stuff could also be decoded.
[Android Software/Hacking General [Developers Only]] hharte:
I hesitate to say it's not possible, but the Logitech and Sony updates thus far have been packaged very differently. The Logitech is basically a ZIP with all files to be replaced along with a couple .img files which contain the root and recovery filesystems, while Sony is a collection of obfuscated .tar.gz files.

Essentially, you would be trying to get the xor pad from apples, and applying it to oranges.

We can always hope the next Logitech update will be in unobfuscated .tar.gz.
[Android Software/Hacking General [Developers Only]] danger-rat:
Heads up.

Logitech Revue software build 39953 just downloaded on my unit...
[Android Software/Hacking General [Developers Only]] moussam:
I got the update notice last night as well. I did not want to update in case it closed some root hack hole, so I canceled. When first setting up the device they do not let you get around the update, but now they do. I unplugged my ethernet in case it would happen automatically when I was sleeping.

Has anybody been able to download this update to their computer so that we can take a look at it?

Also did anybody who did apply the patch notice any differences?
[Android Software/Hacking General [Developers Only]] danger-rat:
I ran the update, but there's no apparent difference (although, I can't say I was intimate with everything yet).
[Android Software/Hacking General [Developers Only]] hharte:
Can someone please try to sniff the update URL? I tried this morning, but my box was already updated, so now it's too late.

Thanks
[Android Software/Hacking General [Developers Only]] danger-rat:
Would it be possible to pull the Revue app apart, and see how it's communicating with the Revue itself? (I haven't got a clue, but it's another angle)
[Android Software/Hacking General [Developers Only]] hharte:
I think the Revue app is communicating via WiFi, so sniffing it (or running tcpdump on the phone) would probably be easiest. I seem to remember Google mentioning that they came up with a remote control protocol over TCP/IP when I was at Google I/O, and that they would release the specs for it.
[Android Software/Hacking General [Developers Only]] mdloops:
Communicating over TCP/IP will not help obtain root. The way communication is done over TCP/IP does not reveal anything about how to change privileges on the OS, unfortunately.
[Android Software/Hacking General [Developers Only]] Chahk:
But it can help intercept the updates (or at least get their address) and possibly get access to the devices via ADB interface.
[Android Software/Hacking General [Developers Only]] fmkaiba:
The problem there is from evidence gained from the updates, it isn't running the adbd service... so we can't adb into it to try to exploit anything
[Android Software/Hacking General [Developers Only]] hharte:
Android exploit through the browser

Here's something that looks promising:

http://www.exploit-db.com/exploits/15423/

http://www.computerworld.com/s/article/9195058/Researcher_releases_Web_based_Android_attack

I have an old Droid running 2.0.1, so will try to reproduce on that, then try it on Google TV.
[Android Software/Hacking General [Developers Only]] theillustratedlife:
hharte:

What does that do? It looks like it just writes an unbelievable amount of jibberish into the page. (That unicode is a bunch of Chinese characters and capital Ws.) I imagine the goal is to overload an allocated amount of memory, which would then allow you to dump your own bytecode into memory?
[Android Software/Hacking General [Developers Only]] hharte:
Description The bug used is CVE-2010-1807. The rshell page uses a spray to fill the heap with a large relative jump sled that gets the pc to the shellcode.

I believe the shellcode is ARM code, so would have to be rewritten in x86 to work on Google TV. But, I tried running rshell as-is (ARM) on Google TV and at least expected the browser to crash, meaning the vulnerability existed. The Google TV browser did not crash, so it leads me to believe this vulnerability does not exist on Google TV's Chrome browser.

You can try it for yourself: www.magicandroidapps.com/rshell.html
[Android Software/Hacking General [Developers Only]] Kermode:
It was a webkit bug wasn't it? And whilst Chrome was borne of that it may have changed enough that it doesn't have that bug.

Perhaps its easier to wait until the market becomes available to find weaknesses :)
[Android Software/Hacking General [Developers Only]] theillustratedlife:
I think we're trying to root now to create TV apps before the SDK is officially shipped. =)
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
Flash is probably a good attack vector

http://www.mobilecrunch.com/2010/10...revealed-for-android-fix-coming-november-9th/
[Android Software/Hacking General [Developers Only]] cbenz80:
Everyone is looking forward to apps available on Google TV from the market, but I am personally looking forward to extracting the Netflix apk from my GT1. With the lack of Netflix for Android, I am looking for a way to confront those iPhone users with DroidDoes Netflix! Hopefully it will scale to work on the Droid X.

Keep up the good work, I am following every bit & looking forward to an open internet experience on a rooted Google TV. Thanks!

CB
[Android Software/Hacking General [Developers Only]] liza2010:
O great!

I have any info about it. I have listen about it so i am searching it from google then i found this info....

Thanks.....
[Android Software/Hacking General [Developers Only]] rodolfo7171:
what service do you have?

i have comcast and i noticed that it sometimes doesnt turn on my cable box. what i do is turn the tv on first, then press and hold the bd/ext power until the cable box turns on. if it doesnt i press up then enter then try it again and it turns on my cable box. then i press amp then bd/ext power and turn on my surround sound.

hope it helps.
[Android Software/Hacking General [Developers Only]] Qualis:
XOR pad analysis

--Deleted--
[Android Software/Hacking General [Developers Only]] Apeman42:
Why did you delete it....? You seemed to be making progress.
[Android Software/Hacking General [Developers Only]] subyfan:
BUMP>>>

Bumpity BUMP BUMP!!!
[Android Software/Hacking General [Developers Only]] lsanderlin:
Was going to say the same Damn thing. First actual good work I've seen here so far.
[Android Software/Hacking General [Developers Only]] rjr162:
I highly doubt it would help, but I know my one friend works at a company who helped produce some of the Google TV device software, though I think it was more of the JVM stuff than the kernel level. Depending on exactly what you're looking for, I can maybe slyly ask for some info

Edit> I'm not sure if samsung has a google TV product released yet (I know they are suppose to now or very soon), but you may want to keep an eye on

opensource.samsung.com/

OR as some of the bluray players and TV's already support Netflix, etc maybe poke around in the releases and see what you can find that way
[Android Software/Hacking General [Developers Only]] fmkaiba:
If you can find out anything related to getting into the recovery. like the sony one has the trick when booting it up to get into the recovery screen. that would be one step.

we need to know how to atempt to push files onto the device, or access the shell before real attacks can start. since ADB is not possible
[Android Software/Hacking General [Developers Only]] rjr162:
Well, I again *highly* doubt this will be of much help, but the logitech update.. the obfuscator file when viewed in IDA de-compiler links to the libfishtank.so library. Unfortunately it's way too many little sections to screen shot, and the free trial version doesn't allow you to save.

I know _fishtank_obfuscate lists

; Attributes: thunk

_fishtank_obfuscate proc near

jmp ds:off_8049B58

_fishtank_obfuscate endp

Like I said, that's one small part, have no clue if it would help with the sony unit at all, and if mentioning the whole fishtank thing helps in any way. (I'm no good at really understanding decompiled code :-p)

I will check tomorrow though and see what my friend may know
[Android Software/Hacking General [Developers Only]] rjr162:
No response from him yet... I'll update when I hear anything.
[Android Software/Hacking General [Developers Only]] Zenofex:
So did anybody get the new update url?

Also I found a way to repeatedly crash the TV application but haven't found a good use for it yet, It creates an exception out of bounds error and provides a lot of report material. I will provide details to replicate to anyone who pm's me but am refraining from posting it in case it is of value to the end cause of rooting the device. Someone earlier in the thread mentioned that if we could somehow crash the device multiple times it may trigger recovery mode on boot. I tried this with this particular crash but believe since its only crashing the application and not the entire device the recovery mode reboot doesn't apply.
[Android Software/Hacking General [Developers Only]] Geoowl:
It's great. I love this.

Thanks!
[Android Software/Hacking General [Developers Only]] BusterChestnut:
Easily Crash Logitech Revue

For what it's worth - I noticed that plugging in my FAT32 1TB passport external HDD (while my 500 GB is recognized just fine) that the revue will repeatedly popup "preparing disk" (while i have noticed no destructive nature of this process) and will not allow for navigation within any menu. Upon removal of said USB device (waiting hours to see if it eventually "PREPARES" my disk) the revue will reboot itself, this can be recreated every time just by plugging in this 1TB drive (probably unsupported media). I wonder if a properly named file in the root of a properly "prepared" (android file structure i suppose, not to be confused with file system) possibly a script folder that flashes upon boot up similar to what is done to flash ePads/tablets with Flytouch ROMs.
[Android Software/Hacking General [Developers Only]] Zenofex:
I've got a nice trick to be able to investigate the system logs on my revue. I first power down my revue and power it back up (to clear the log), then I play with a few misc applications and keyboard presses to find out anything new I can and then I purposefully crash the device to get the crash report. Inside the crash report is a system log and event log both of which have a lot of great info. One such cool trick I've found is that if you type: tv://passthrough into the url bar you are passed to live tv. I assume there are a number of these but so far tv:// is the only one I've been able to get working. Some others mentioned in the system logs are

hdmi://localhost?port=2

content://settings/system/notification_sound

I'll post when I find more, these were found after only a few minutes of playing with the system logs. Also another thing to note is that the updates are incremental and do not contain the full OS. There are a number of library files missing from the updates so I am unable to run the OS locally. If I can get more update files maybe I can get more of these binaries working. Something to note is that the obfuscator binary inside of /system/bin/ does seem to work, not sure what its use i'm wondering if it could be of any use to decode the sony files. One last thing, In the logs I noticed a line mentioning the fish_tank encryption library but it looks like this is specifically used for to decrypt the hdmi info.

I'll keep playing today and will post more when I figure it out.
[Android Software/Hacking General [Developers Only]] hharte:
Sony OTA v2.1_20101021.205528

I captured the OTA update.zip download link from my Sony NSZ-GT1:

http://android.clients.google.com/p...d.package_list_ogm_2.1_2010102101ON_eagle.zip

Interesting that this one is actually smaller than the previous one. Also the system/build.prop "device" has changed from "asura" to "eagle":

ro.product.model=Internet TV Box

ro.product.brand=sony

ro.product.name=NSZGT1

ro.product.device=eagle
[Android Software/Hacking General [Developers Only]] Tinalv:
Looks great, will give it a shot
[Android Software/Hacking General [Developers Only]] subyfan:
WOW...

I'm actually pretty surprised that none of the amazing devs/hackers have found a way to access, much less root, either of the Google TV implementations yet. What do you guys think is the hold up? Source code?
[Android Software/Hacking General [Developers Only]] Chahk:
Most likely that's because many of these devs and hackers have not been able to get their hands on one of these boxes/TVs. There is no carrier subsidy like the phone world, so shelling out $300+ may not be one of their top priorities.
[Android Software/Hacking General [Developers Only]] hharte:
Ok, to help mitigate the lack of incentive to root the Google TV, I am offering a bounty of $1000USD for the first person to root the device to be able to accept third-party apps:

http://www.magicandroidapps.com/wiki//index.php?title=GoogleTvRootBounty
[Android Software/Hacking General [Developers Only]] subyfan:
Well that should get things moving along nicely! We saw how the bounty approach helped in achieving the open source driver for Kinect! Good man and Happy Hacking!!!
[Android Software/Hacking General [Developers Only]] tresdizz614:
hit me up, i have some useful info involving rooting google tv and developing apps
[Android Software/Hacking General [Developers Only]] jonjonk:
just you watch lol with the $1000 reward, google tv will be hacked in less than a week.
[Android Software/Hacking General [Developers Only]] Zenofex:
From what I understand google pays out more for proper disclosure. I wanted to post a link but since I'm a new account I was unable to.

EDIT: If anyone is interested in chatting or sharing progress in rooting the device I have set up a irc channel at irc.freenode.net #googletv , I will be idling in there for the time being. Feel free to drop in and chat, it should serve as a way to communicate quicker and a little more privately than on here.
[Android Software/Hacking General [Developers Only]] AndroidUniverse:
Wonder who's gona get the bounty
[Android Software/Hacking General [Developers Only]] dcplaya:
anyone try to plug the Logitech box into a laptop/desktop using a USB cord? I dont have a type A to type A laying around unfortunately.

Made a little headway I think.

Enabling Remote debugging and then trying to connect via adb

./adb connect 192.168.1.xxx:5222

or

./adb connect 192.168.1.xxx:1100

gives an output of

List of devices attached
192.168.1.137:1100	offline
192.168.1.137:5222	offline

obviously the 137 is my internal IP of the box.

Other ports just get a "unable to connect" error

Did a open port scanner, the ports that are open are 1100,5222,5223,9551,9552 and all of them give me the same results as above

Looking through logs I see that there is no DTS firmware installed (maybe a future update will solve DTS problems)
[Android Software/Hacking General [Developers Only]] Chahk:
Someone tried this before with same results. Looks like the ADBD service is not running on the GTV boxes by default. Unless we can somehow force it on, there is no way to access the shell via ADB.

I think we need a different attack route. Possibly seeing if there are any security holes that could be exploited to gain access to Terminal on the box itself, like with the original G1. Crashing the Browser with overflow is another (I think someone had some level of success doing that) which might open up some doors to code execution.
[Android Software/Hacking General [Developers Only]] Zenofex:
I've found an exploit in chrome on the gtv but am having a hard time getting my payload to execute. For now my payload is just some shell code to reboot the box but If I can get it to successfully execute I'll change it to a port binding shell (didn't have time to write more in depth x86 android shell code). The vector I'm looking at currently is an integer overflow which makes it difficult to exploit on the remote box without any type of debugging tools. I have a few different home made fuzzers running on the box to see if I can find an easier to exploit bug as well but am also working on playing with the current bug to see if I can get it working. I would like to disclose more info but do not want the bug to be patched without either retrieving a portion of the bounty or applying for the proper disclosure bug payout directly through google.

Feel free to come chat on IRC @ irc.freenode.net #googletv

-Zenofex
[Android Software/Hacking General [Developers Only]] Calla969:
I am a complete idiot when it comes to this stuff, but I'm very interested. I have a hacked and rooted Droid 1 and I just bought the Logitech GTV. I tried plugging my phone into the USB port to see what happens, and it seems to charge and connect like normal. I wonder if there is some type of tool that could be developed and installed on an Android phone that could help root the GTV.
[Android Software/Hacking General [Developers Only]] x10man:
The only way i can think of to get a shell is plug in a keyboard and control alt f1 like you can on linux i know this works for android x86 so it mightnwork for gtv i dont know becuase im in the uk
[Android Software/Hacking General [Developers Only]] dcplaya:
I can try that later on tonight after we finish Black Ops haha.

I tried any keystroke I could think of last night on boot up and I got nothing at all

If anyone can understand obfuscator files, here is what I got from the Revue box in /system/bin http://pastebin.com/KrQgrh0V

Poking around the file iDTSRmtSrv, I found a few interesting strings

One says OpenSSL isnt supported on this build http://pastebin.com/3MuFXWnU

And another referencing a iDTS Remote Service and how to connect to it http://pastebin.com/eFtWaW5A

Seems that iDTS is "Intel Diagnostics Tool Suite" http://pastebin.com/A6JMwwQM

ADB is not running by default http://pastebin.com/rsWtUHEW

If we can change that value to 1 then ADB should be working like a charm over ethernet

Anyone have any idea what this means

rebootRecovery:I = 0x7f040013
[Android Software/Hacking General [Developers Only]] Calla969:
I really wish there was something I could do to help this along. I have been trying everything I can think of to find the recovery menu, but I don't know what I'm doing. I am just hoping for dumb luck. I hate just sitting here waiting for someone else to figure it out. I don't even care about the $1,000 reward, I just want inside this thing! Is there anything a noob can do to help make progress? I have a little experience with my Droid, but I don't have any Linux experience or knowledge. I have a Logitech Revue and a Droid and a PC laptop. I would really like to help.
[Android Software/Hacking General [Developers Only]] subyfan:
I know your pain man...

I have a good bit of experience with ADB and basic Linux commands, but nowhere near the experience that would be necessary to tackle something like this. I am more than willing to try any ideas that people may have, but it seems like people may be genuinely stumped on getting into this sucker. Reminds me of the Incredible. My friend got one the day it came out and let's just say he had a very frustrating wait before he could do any of the useful stuff that my Droid could do. DROID and Android FTW!!!
[Android Software/Hacking General [Developers Only]] Calla969:
What exactly is the Recovery Menu for? I would assume it is used when there is some type of system failure. Does that mean that if we can cause or fake some type of error, tech support may tell us how to boot into recovery mode to address the issue? Maybe we just need to ask someone how to get to the recovery mode. Of course, I would think that one of them would be tempted by the $1,000 reward. Even if you make a good living, that is a decent amount of money. I would think someone would leak this info for a small fee. I think we could pool enough money together to tempt someone, if we knew who that someone was.