LExxB650 T2P CI+ hacking

[robbiesz]

Hi All!

I've been working on some tools that potentially could open hacking for CI+ devices. For now I am looking for someone who owns a CI+ unit and could do some testing for me.

All I need from you is to have a serial debug cable connected to a PC, debug mode turned on the TV and that the PC logging the output.
You would have to copy some file(s) onto a memory stick.

This is not for flashing new firmware! only for trying to exploit some security holes...

If you're interested PM me!

Robbiesz

[dynamic1969]

Hi robbiesz,

has anybody volunteered so far to support this or is the response level "zero" ?

Regards
dynamic

[robbiesz]

Hi Dynamic1969

I've had three people respond so far but no testing has been done yet. Even though the code is pretty much harmless in terms of what it does, I can understand that people get quite nervous when it comes to their £500-£1500 investment..

Hopefully we can start early next week. I'll keep you updated.

regards,
Robbiesz

[dj-tumor]

Just wondering.
Is there any other country going to use that stupid CI+ or is it just us idiots from germany
For HD+ by Astra ?

[robbiesz]

Update:

We did some initial testing on a B750 TV (Thanks Robert!). Although the code did not generate the output we were expecting it did crash the tv a couple times.. This is great as now we've gathered some info about the kernel...

I'll revise the code and we'll do another testing later this week.

regards,
Robbiesz

[jeroenvoc]

I own a LExxB650 CI+ device, and I'm willing to test.
Go a serial cable in place...

Let me know...

[aquadran]

why not try first access to uboot ?
viewtopic.php?f=2&t=53&start=20#p615

[jeroenvoc]

I did try that; no luck...
The console doesn't seem to respond on any input whatsoever.

I got the telnet-enabler V1 working, so I got telnet access.

[arris69]

I did try that; no luck...
The console doesn't seem to respond on any input whatsoever.

I got the telnet-enabler V1 working, so I got telnet access.

so when we see partition dump from /dev/bml0/20 /dev/bml0/18 /dev/bml0/16 ??

arris

[erdem_ua]

I did try that; no luck...
The console doesn't seem to respond on any input whatsoever.

I got the telnet-enabler V1 working, so I got telnet access.

WOW