Updating slingbox failure to launch dating steps

" % len(funcs) With functions properly named, reversing can begin in ernest, and the code in ntv300ui isn’t exactly confidence inspiring.

A binwalk scan of the firmware update image reveals a few firmware headers and two Squash FS images: DECIMAL HEX DESCRIPTION ------------------------------------------------------------------------------------------------------- 63944 0x F9C8 Mediatek bootloader 111840 0x1B4E0 Mediatek bootloader 128133 0x1F485 LZMA compressed data, properties: 0x80, dictionary size: 1073741824 bytes, uncompressed size: 196608 bytes 293660 0x47B1C JFFS2 filesystem data little endian, JFFS node length: 8195 410769 0x64491 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 410793 0x644A9 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 410817 0x644C1 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 428064 0x68820 u Image header, header size: 64 bytes, header CRC: 0x2023172F, created: Tue Oct 16 2012, image size: 1896744 bytes, Data Address: 0x DA00000, Entry Point: 0x DA00000, data CRC: 0x FD61E493, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: 429156 0x68C64 LZMA compressed data, properties: 0x87, dictionary size: 250216448 bytes, uncompressed size: 14786800 bytes 445513 0x6CC49 gzip compressed data, from Unix, last modified: Sun Oct 14 2012, max compression 4182784 0x3FD300 Squashfs filesystem, little endian, version 4.0, compression: gzip, size: 76854395 bytes, 905 inodes, blocksize: 131072 bytes, created: Tue Oct 16 2012 30793205 0x1D5DDF5 PNG image, 133 x 133, 8-bit/color RGBA, non-interlaced 70987253 0x43B2DF5 JFFS2 filesystem data little endian, JFFS node length: 102880 72970663 0x45971A7 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73055216 0x45ABBF0 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73172060 0x45C845C PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73261506 0x45DE1C2 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73386095 0x45FC86F PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73436271 0x4608C6F PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 78240759 0x4A9DBF7 PNG image, 780 x 870, 8-bit/color RGBA, non-interlaced 81538240 0x4DC2CC0 Squashfs filesystem, little endian, version 4.0, compression: gzip, size: 17109954 bytes, 326 inodes, blocksize: 131072 bytes, created: Thu Oct 4 2012 98651328 0x5E14CC0 PNG image, 1280 x 720, 8-bit/color RGB, non-interlaced 98675264 0x5E1AA40 PNG image, 720 x 480, 8-bit/color RGB, non-interlaced While the firmware update does not appear to contain a complete file system, most of the interesting stuff appears to be in the first Squash FS image.

The /usr/local/bin/ntv300ui binary is particularly interesting as it is responsible for providing the NTV300’s user interface, including the handling of user input from both the remote control and the serial console.

Although the ntv300ui binary has been stripped, there are plenty of debug printfs that reveal the original function names: import re funcs = [] regex = re.compile('^[a-z A-Z_]*$') for xref in Xrefs To(Loc By Name("printf")): ea = found = False real_name = None for i in range(0, 10): ea -= 4 if Get Mnem(ea) == "LDR": opnd = Get Opnd(ea, 0) if opnd == "R1": r1_string = Get String(Loc By Name(Get Opnd(ea, 1)[1:])) if r1_string is not None and regex.match(r1_string) and len(r1_string) 3: real_name = r1_string else: real_name = None elif opnd in ["R0", "R2", "R3"]: r3_string = Get String(Loc By Name(Get Opnd(ea, 1)[1:])) if r3_string is not None and '%s' in r3_string: found = True break else: found = False if found and real_name is not None: name = Get Function Name(xref.frm) if name not in funcs: funcs.append(name) print real_name Make Name(Loc By Name(name), real_name) print "Renamed %d functions!

Negear’s Neo TV set top boxes are designed to compete with the popular Roku, and can stream video from all the usual sources (Netflix, Hulu Plus, Youtube, etc).

The NTV300 is one of the least expensive Neo TV models, and while a GPL release is available, it contains only copies of the various standard open source utilities used by the NTV300.

Search for updating slingbox:

updating slingbox-16updating slingbox-80updating slingbox-84updating slingbox-21

All the interesting bits – such as Netflix streaming, or the ability to build a custom firmware image – are not included.

Leave a Reply

Your email address will not be published. Required fields are marked *

One thought on “updating slingbox”