Updating slingbox

6854933580_2c8b688306_z

Pulse-Eight sells both custom and off the shelf hardware products primarily designed for Kodi, such as remote controls, HTPC systems and accessories, including a HTPC PVR set-top-box pre-installed with Kodi that they call "Pulse Box" Xtreamer Ultra and Xtreamer Ultra 2, manufactured by the South Korean company Unicorn Information Systems, are nettops based on Nvidia graphics and Intel Atom processors and pre-installed Open ELEC and Kodi software.

The first-generation Xtreamer Ultra uses Nvidia Ion chipset with a 1.80 GHz Dual-Core Intel Atom D525 CPU, while the Xtreamer Ultra 2 uses discrete Ge Force GT 520M graphics with a 2.13 GHz Dual-Core Intel Atom D2700 CPU.

Luckily, the firmware updates for the NTV300 aren’t encrypted.

A binwalk scan of the firmware update image reveals a few firmware headers and two Squash FS images: DECIMAL HEX DESCRIPTION ------------------------------------------------------------------------------------------------------- 63944 0x F9C8 Mediatek bootloader 111840 0x1B4E0 Mediatek bootloader 128133 0x1F485 LZMA compressed data, properties: 0x80, dictionary size: 1073741824 bytes, uncompressed size: 196608 bytes 293660 0x47B1C JFFS2 filesystem data little endian, JFFS node length: 8195 410769 0x64491 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 410793 0x644A9 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 410817 0x644C1 LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes 428064 0x68820 u Image header, header size: 64 bytes, header CRC: 0x2023172F, created: Tue Oct 16 2012, image size: 1896744 bytes, Data Address: 0x DA00000, Entry Point: 0x DA00000, data CRC: 0x FD61E493, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: 429156 0x68C64 LZMA compressed data, properties: 0x87, dictionary size: 250216448 bytes, uncompressed size: 14786800 bytes 445513 0x6CC49 gzip compressed data, from Unix, last modified: Sun Oct 14 2012, max compression 4182784 0x3FD300 Squashfs filesystem, little endian, version 4.0, compression: gzip, size: 76854395 bytes, 905 inodes, blocksize: 131072 bytes, created: Tue Oct 16 2012 30793205 0x1D5DDF5 PNG image, 133 x 133, 8-bit/color RGBA, non-interlaced 70987253 0x43B2DF5 JFFS2 filesystem data little endian, JFFS node length: 102880 72970663 0x45971A7 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73055216 0x45ABBF0 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73172060 0x45C845C PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73261506 0x45DE1C2 PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73386095 0x45FC86F PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 73436271 0x4608C6F PNG image, 240 x 204, 8-bit/color RGBA, non-interlaced 78240759 0x4A9DBF7 PNG image, 780 x 870, 8-bit/color RGBA, non-interlaced 81538240 0x4DC2CC0 Squashfs filesystem, little endian, version 4.0, compression: gzip, size: 17109954 bytes, 326 inodes, blocksize: 131072 bytes, created: Thu Oct 4 2012 98651328 0x5E14CC0 PNG image, 1280 x 720, 8-bit/color RGB, non-interlaced 98675264 0x5E1AA40 PNG image, 720 x 480, 8-bit/color RGB, non-interlaced While the firmware update does not appear to contain a complete file system, most of the interesting stuff appears to be in the first Squash FS image.

All the interesting bits – such as Netflix streaming, or the ability to build a custom firmware image – are not included.

Inside the NTV300 we find a Mediatek ARM So C, a 128MB NAND flash chip and 256MB of RAM: The four pin header in the top right corner of the PCB is a serial port (115200 baud 8N1), and while it provides access to the U-Boot boot loader, it does not provide a root shell.

There is no command echoing, and a ton of debug output is intermixed with the command output.

Let’s see if we can find an easier way to get a shell – preferably one that doesn’t involve taking the device apart.

updating slingbox-30updating slingbox-23

Open ELEC is an extremely small and very fast-booting Linux based distribution, primarily designed to boot from flash memory card such as Compact Flash or a solid-state drive, similar to that of the XBMCbuntu (formerly XBMC Live) distribution but specifically targeted to a minimum set-top box hardware setup based on an ARM So Cs or Intel x86 processor and graphics." % len(funcs) With functions properly named, reversing can begin in ernest, and the code in ntv300ui isn’t exactly confidence inspiring.It looks like Netgear hired some Unix admins and told them to write an application in C; for example, here is how they re-implemented libc’s stat() function: While this provides us with a minimalist shell, it is not very user friendly.For an open-source project like Kodi to compete with the commercial products, it will probably have to simplify the process of finding and setting up add-ons.Open ELEC 5 brings Kodi closer than ever to being a plug-and-play product, but it is not quite foolproof yet.Negear’s Neo TV set top boxes are designed to compete with the popular Roku, and can stream video from all the usual sources (Netflix, Hulu Plus, Youtube, etc).

You must have an account to comment. Please register or login here!