Page 1 of 1

Rooting T-MST9DEUC

Posted: Wed Jan 18, 2017 10:59 pm
by jabev56
Hi there,

I am new on these forums. I have an UEH32EH5000 with T-MST9DEUC-1022.0 and have been reading around (mostly SamyGO forums and wiki) to see whether it's possible to achieve root access.

Related forum threads (some are old): I would like to know if you have information about rooting this firmware. Approaches I have individuated (but do not know if tried/viable):
  1. write to a hex memory address (can't find physical memory write, only register write) to patch in-memory kernel
  2. re-encrypt a firmware update with patched kernel (need AES key for this) and install it via USB
  3. exploit a SIGSEGV from the TDM (there are many, but hard to impossible to use as a vector)
  4. exploit some buffer overflow with specially crafted media to play from USB (might not be a good vector if memory protections are in place)
I think the best should be method (2).

Re: Rooting T-MST9DEUC

Posted: Wed Jan 18, 2017 10:59 pm
by jabev56
The official page is this:

I see there is there an upgrade to 1042.0 (which I do not plan to install), but filename is T-NT14LDEUC_1042.0.exe - isn't this strange?

Where can I find AES keys to try with v1019.0 and v1021.0 (found here https://forum.samygo.tv/viewtopic.php?t=5052)?

Re: Rooting T-MST9DEUC

Posted: Wed Jan 18, 2017 11:00 pm
by juusso
Even if we know how to decrypt firmware upgrade files, we still do not know how to force TV accept it after modiffication.

For aes key check latest samygo.py or SamyGO Firmware Decrypter from download.samygo.tv tools...

Re: Rooting T-MST9DEUC

Posted: Wed Jan 18, 2017 11:00 pm
by jabev56
juusso wrote:Even if we know how to decrypt firmware upgrade files, we still do not know how to force TV accept it after modiffication.
What do you mean? I have not played around with firmwares so I am new to this. It simply does not accept firmwares put in the USB, even if re-encrypted with the key?
juusso wrote:For aes key check latest samygo.py or SamyGO Firmware Decrypter from download.samygo.tv tools...
I just tried, this firmware is not recognized. thanks for your reply

Re: Rooting T-MST9DEUC

Posted: Thu Jan 19, 2017 6:07 pm
by juusso
Yes, even if you know key and you encrypt firmware back, TV won`t accept such firmware for upgrade. Some internal hash checking etc in SS with not yet know algos/functions. I`m not good with that stuf to explane you in details...