Decrypting Bravia Firmware BIN File

[coolrecep]

Hi everybody,

I would really like to get your thoughts on how to handle Bravia 52LX900 encrypted firmware file.

The TV uses following software:

Code: Select all

linux-kernel
busybox
pump-autoip
libjs
dosfstools
directfb
iptables
cairo
glib
pango
exceptionmonitor

I think the first thing is to detect the encryption type. I have tried a lot of tools both on Linux and on Windows but none was able to detect it. Yet, I am sure tools like OpenSSL and XOR-analyze will do the job but I don't know how to use them effectiveley.

The firmware file is here:

Code: Select all

mediafire . com /?371sodalbkui26h

From offset 0 to 2906 (actual file is 44 MB):

Code: Select all

64 2E 3E 5F 49 A6 BC 8B AB F6 E8 DC F8 8B D6 9C 20 FE 81 6E 52 FC E9 36 6B 97 C7 02 B2 02 E7 28 A2 E0 91 E4 8A BC 4D AA 51 D1 B4 19 45 B0 EC 52 D6 F1 F3 9F BB 4D 69 B0 D6 83 2F CB BB 5D A2 3E C2 EC 0A C6 6F 4B F6 A9 8D BF 49 92 D5 F1 33 FD 8E E2 23 04 B0 AE D2 50 C8 61 B9 EA 05 B6 01 B0 A1 AE DC B6 55 E1 AB 71 E3 23 1C 9D D7 5D 00 C6 3C 94 FE 27 24 32 61 EF 13 BD 3E 8E BE FB 73 9F CC 4E 1A D1 A7 A8 75 9C A5 EF 5F 37 C4 7A A1 CF 70 C2 66 D7 91 76 E2 C2 B1 A4 8F 56 81 C5 8B 56 72 CA 98 D0 91 50 B7 23 C7 EF 2D E8 26 AE 06 69 3C 6F 98 25 C3 73 7B 39 06 1D 15 CC B7 F4 25 D8 85 45 C2 ED 89 73 57 67 1E D7 D6 3D F9 B0 7A 64 22 F0 A4 A9 97 B0 64 2B C6 60 32 45 0F 07 6D E4 54 2C F8 C7 22 70 B1 FC E0 A4 69 1A AF FF D4 F1 7C 6A C4 BE 77 C4 EF 66 15 F8 57 51 79 77 5B E8 33 1E E4 76 53 F5 F7 33 ED CF AF B3 F7 B1 50 A3 ED 3E F8 8C 40 3C C3 4B 81 90 AC B6 C5 46 BB DF 39 66 38 55 BD 68 A0 65 47 80 85 DA 6E 03 CF D9 B6 6B 3F 8A 3C 00 33 1A 44 26 61 BE BE CE B5 7E AC 40 E7 ED 65 30 B5 40 B2 9A 9E 2E 15 38 F7 D8 51 AC 5C 92 CF 23 D3 6F 4A 58 48 1F 57 AA F5 A2 41 1D 2F 88 F9 FC 60 7E C7 CC 09 45 2D D6 D5 89 03 D0 9D 33 1E BF B3 8F AF 7E D9 ED 32 F6 E0 99 8C 53 57 1B 93 E7 66 33 F2 0A 97 E4 E5 5A EA 3D 98 BA 9B 14 F2 12 86 59 85 77 03 1C F1 0B 8B B3 1B C9 6A 0D D8 FC 7E FC 7B 6E 18 46 CD EB D7 40 0E 22 BB 22 6B FD 3A 80 59 7A CC 44 D9 3B 87 14 25 FD 82 F8 93 E4 A8 2F 59 31 15 5F 9E 8A EC 67 F5 AA 23 CC 0B 22 F6 AE 2C 59 17 31 F4 CD 7D AC 1C 8C AA 29 CC 9C 91 A5 5B 19 DC 47 4B F0 60 37 06 40 C1 02 3B 8F A8 A1 C1 73 5E 33 6A 51 56 91 77 94 FF 36 76 49 C1 B8 81 9C 68 FB 26 1E 73 26 BA 43 42 EA AD C7 A0 88 08 6B DB A2 65 ED B5 E3 2C 3B 99 B1 04 82 A3 09 70 F4 9B FC E2 F1 50 ED 23 05 27 80 B6 77 C1 F1 EB B0 61 E5 69 85 EB 3A 4E C8 68 D1 1C AD D0 26 09 8F 0C 27 3A 84 C2 2B 1F C0 B3 A7 E2 AE E9 95 A6 04 CB 49 0D 64 87 43 5F F8 19 5B 79 33 D0 55 43 CF 32 6C 1A BC D3 4C 0E A6 3B 8C 96 64 23 88 03 23 29 99 9A B4 D1 EB 72 22 EB 7C 1B D0 DD E2 CB A9 96 3A A3 19 9A 12 73 7B F3 28 1A A1 F3 54 4F 15 A5 D5 94 11 08 1E 75 85 F2 CE 4F 9A 77 AF E5 E6 1D DD 3D 19 BD 9E ED 45 16 C8 16 A7 0D 62 A1 90 71 56 75 36 F9 FD 90 D8 18 DE C9 7B E4 FC 81 62 F0 05 94 B9 5F C9 28 B0 FA A3 D3 A5 7D 80 C6 4D F3 D4 A9 7A 90 9C 40 13 E3 CF 89 EF 45 2C 4F 84 59 1F B8 2F EC 99 79 4C D4 02 3D 3C 63 C7 E2 1A 52 71 E7 E0 7A 8F F2 9C 31 A4 0B 9C 64 BB CD 59 F0 3B 9E 70 4E 09 A7 4C 02 07 E3 4E A2 88 89 16 68 9B 7F 4D 2A 79 81 8D 57 86 0E 56 B0 D5 79 7F F2 F2 26 32 62 E3 E5 D1 B9 00 09 97 BC F5 FE CA 32 6D 11 2D 61 56 D8 3B A7 0C 18 DF D5 01 41 55 4F 2F 86 62 A9 F5 55 CF 3E C2 BF F4 83 35 A3 E7 BF 62 91 EC A7 3A B5 32 61 D3 25 6A E7 0B A1 51 0E 7B 5B 39 CE E1 7B 60 19 9F AD 2E E3 D6 14 B3 5A CA F2 32 29 62 F9 96 50 D0 3D 3E CA EB B5 7C 12 F0 2A DA C1 49 BA A0 5E 97 63 C6 4A FC 7B 67 04 0A DB 6A CF B3 64 D5 F3 F3 1D 1C 2A 33 1C 0F 20 B2 B4 58 C1 53 B5 49 7B D8 28 54 BB DE E7 38 81 B3 D7 66 EF D3 19 C0 57 CD 36 DC D0 DA 20 ED A9 79 3B D3 D7 74 A4 91 84 0A 1E 91 48 65 54 FC 9F E9 F0 64 B4 E2 3A EC 58 1F 5B EF E4 C8 E0 C9 A6 74 A3 9F 06 32 C5 A6 AA 62 7E A5 8B 0B 54 7C B9 44 66 A8 43 96 90 05 4B 73 5E E0 95 97 A5 CE A6 81 CB 9B D8 4B 7B F0 BF 69 5C 31 75 25 FB 7D A1 B2 D3 3A D3 F8 87 52 62 03 EC 95 2F E6 1E A1 DB 3F C3 49 D2 4B DF D1 D8 C3 DC 73 74 A8 3C 93 9A BD 94 71 18 84 1E 61 97 34 9E 2F F9 E3 F0 AF 51 C8 EC 19 F0 9A 2C 9F 99 09 8C FA BD 3F BC 14 50 B2 F8 D0 AB 9B A2 4A 88 47 BB 31 C3 E4 CF 34 B9 18 8C 93 09 BB 03 02 97 74 6C 7F 37 49 AF 93 76 40 0D 17 04 BA 3C 63 B7 08 74 0D ED 1E 53 3B 4F CA B0 02 4B 47 04 37 23 51 96 9F CA A4 4B F0 BB 01 89 17 4A 58 F1 38 D6 05 D7 C1 76 14 88 FB B2 E7 F4 77 24 19 F2 4D 50 0C 4A 0F D5 0D 61 CE B6 84 D2 62 D2 8A 12 12 E1 27 E9 E3 21 35 B6 79 2F 85 58 32 DE 3A D6 6F BC 4D C8 5E 63 E9 33 8A B5 63 61 86 29 E9 78 47 05 F3 4D 43 D7 97 A7 D1 24 9C 12 17 12 D9 C1 EC 6E AC 2E 51 D7 6D 60 38 B9 47 3A 17 59 1A 24 4C 7C 0E 2D 04 E2 4E 4A 32 44 C7 B3 13 19 CD 24 06 3A B1 00 45 8E 87 61 BA 30 C2 C9 EF BA F5 05 36 67 2F FC F0 4B 89 D7 40 D5 57 60 9D 6F 2C A7 86 77 76 C0 75 BE BD C5 BB C9 86 39 4B D9 0A 3B BE DB 9C FD BB 21 6A 0A 89 43 31 67 A6 9C 46 39 4A 6D 8F F3 8B C4 BA 32 37 44 7E E6 D5 D4 35 B6 12 26 CA AC 42 8D 43 8D 8E 36 12 6B 0E E5 C4 69 0F B4 0D 50 2E C5 5B 50 5B 00 AC 2B 0A F6 5E 10 22 43 CD 05 B2 5F 05 11 8D 96 3D B0 A0 08 06 CF F8 F6 0C 3F 76 2D D5 C4 B1 73 F1 E5 2A 9D E8 4D 53 06 02 A5 B8 6F 18 02 31 B2 48 0D 71 B7 B1 AA 4A FD 06 41 39 C7 C2 A0 65 3E 9F 27 49 A9 6E 84 79 D0 1B 96 96 47 B7 4E B3 AC A3 94 3A 3D F1 09 F3 50 57 7D 58 4E 70 0D 9D CC F0 CC 38 50 B9 AB FF 24 EE D9 50 C5 38 3A 7E 01 F3 9F E4 C6 7E 3F E0 9F 39 C0 98 38 81 E7 12 64 BF EB A6 73 46 CE 6B 36 0E 77 77 04 CD 6D E8 08 22 01 F4 3F 9C 78 11 BE DD F7 D8 D6 8B 22 F1 35 2F B0 80 06 53 D8 58 ED 57 6E 7C 8B 18 2E C8 B3 26 8C 64 FD FA 9B 36 ED 23 7D 8E F3 2E 46 38 1C 68 C5 A0 ED AD 50 42 18 0E 0F 7C 30 AE A9 CB 9B 94 38 D2 43 85 1E 6E 58 62 B8 D8 31 89 F2 03 33 66 62 93 D1 3B 7A E3 AE 0E 6F 12 B2 F8 5A 15 36 B7 B3 32 10 61 E8 DB 88 EF 3F A5 FA 0F 2D 78 D3 E7 19 25 0C 04 60 7C A4 F1 45 C9 16 61 61 A9 27 0A 08 E3 54 6F 6E 96 F1 D8 77 23 86 D3 4E 20 51 42 F2 EF E3 C1 B6 34 D2 EF F0 34 7E F6 E0 6B 7A 50 BC C8 D0 63 23 23 CB 74 F7 E7 4C 62 A0 CC F0 EE C6 10 62 10 F0 AA 2A 4C CE 68 A7 9C E2 3E B3 A3 8B 75 3E 26 A7 3D 1F A7 4D 55 D4 A3 33 A5 01 A9 85 37 35 11 54 3A 30 77 58 32 E6 A3 FF 53 27 48 3A A0 B4 E0 70 46 9A 88 E6 D1 E9 19 D5 E9 B6 AA B4 4A D5 AD 45 57 0E 3A 6D A2 B8 1C B8 8C AD 1A 5B 11 70 EE CA 34 8E 8F 22 B6 35 5A FF 53 7B 77 71 F2 A0 46 21 08 DD 87 99 C9 01 71 2A E0 EA 88 0B E3 27 04 FC A4 8D 65 A3 DC 34 0B 75 D3 86 27 04 E6 BC 6D 62 3E 60 6D AE 77 D7 40 E3 CB BA C1 52 36 C7 A0 B9 CD D2 F5 20 BE FA C6 52 1E EC 9B AD 8E 21 54 6E 1E 61 4A 02 54 2D C1 DC 4B 93 54 A5 8C 36 29 E8 34 2A 91 DB 2B DA E6 CD 2C 37 84 3D A9 65 B4 D8 B7 C7 03 81 1F 37 B7 50 ED BD 14 AB 1D 99 88 A7 1A DD 4B 85 E3 BE EB 27 1B D4 96 24 71 F8 B4 8C 9F F2 C0 A4 8E 34 25 B5 64 83 ED 55 AB 22 34 33 F1 9D 0E B6 CF 4E 96 3C CC B9 09 34 26 8E E6 27 2E AF FE CC 6D BC 80 B9 5A 69 D3 7F EC 94 F0 80 E6 ED 3C BD C3 2A D1 65 8A 9E F1 B5 52 14 07 79 B0 4E F4 21 12 31 C1 00 26 C3 2A BB A0 33 59 31 C0 AE 67 C9 31 00 8E 8C 96 60 68 0F A7 B1 D0 2A 36 8F 72 9F 80 75 BD 63 C2 19 54 8B FB 06 11 D1 9D 9B 1C 85 D4 B6 FB 8A 4E 6E 6C 1C B8 3A CA C0 A8 5D B9 25 76 44 C1 01 64 45 B4 04 4F 0B 8C 38 7D 16 B4 B7 7D 3D 59 15 8A 4A 84 F2 41 F3 14 A4 1F 99 8C 64 62 B7 85 0F 6B 3B 94 35 45 7B 45 9C D0 CB 81 ED 6B 6D 73 8B 4F 42 3A EB 9C A7 EA C0 3B 2A E5 AA A6 37 10 56 EE A1 B7 8E 2B E5 B0 8A 8F F1 9A 60 CA 8E AA 00 84 33 F3 23 33 D3 62 FE F7 F8 CB 66 E1 8B 97 35 BB B4 F9 B0 2C 65 12 B6 A1 59 AA 67 8B 7C 6C D0 EB 49 2B 0B DC 83 E7 37 4F A0 AA A7 63 24 24 59 95 0E BE 01 37 22 57 58 B5 9C 8B D2 07 0D E8 9B 24 E0 50 EA 8D DA 08 0D 17 AE 41 20 B2 39 F0 30 21 D9 48 BD 9A 87 49 5A CF C0 5F 23 37 2E 7D E5 97 B6 5F 16 7F 4F 34 D8 F2 E6 BC B5 56 88 26 F7 91 04 E4 A7 B3 C6 8C 86 E0 1C 00 86 96 CF A7 09 1A C9 5D EE B5 CC 3F 16 B7 13 C3 20 85 EE 00 85 1E 08 CC EB C6 EF 45 BC F8 EF 1A B5 D5 D6 D4 5D CD 96 39 BA 3A BE 60 F4 6C 77 0E 5C C4 5F F2 33 F5 D1 65 95 4D 31 45 72 6B 3D F4 F2 97 61 5B F7 CF 36 4D 7F 77 E7 E4 42 02 5F 2C 9C 22 38 B3 D0 6F EC 12 80 DF 33 13 95 AE 58 77 43 41 9B 37 C6 31 0C 0D 93 47 34 F5 B1 EF C2 42 27 E7 6A 0E 3E 84 D9 89 E1 DA D2 10 C4 CE 15 2B CA 9F B4 8C 77 59 DF 16 A0 37 E3 79 3D 85 96 C5 F4 94 53 E6 E4 02 0A 58 FD 07 D1 2C 05 C0 BF 0E 99 48 71 31 29 09 11 31 E3 A2 0B 3D 99 01 9F 0D 03 F2 63 88 52 4F D5 39 BF 8D E0 46 27 DD 6E EC 36 63 E5 D0 36 D4 7C 8D AE B9 E1 5F 9F 8E 92 B4 92 56 33 BF D9 CD 12 F3 BB 58 63 EF C8 3A 38 CF 28 4B 8F B8 C0 A8 59 52 29 EE DE 20 27 20 5E 24 1F 7B D7 3D 41 B7 A2 A2 C6 33 D6 63 D8 16 67 AE FD 0C 0B 60 DD EF C2 EF FC 05 C1 34 08 6C 8A B6 AD 5A 22 19 61 3B E4 19 31 7D B0 CD 59 A9 D7 20 6E 72 62 A7 84 86 11 B8 02 BE 35 BE 37 43 E4 0F 1F E3 19 88 1D 36 C8 A9 96 A1 BB 06 9E 26 CD FB A3 9F 34 F7 97 D2 EC 81 6B 63 49 70 26 B1 E8 F4 27 A0 8F 02 29 E5 56 27 22 33 28 F3 10 E4 18 AA 0D 36 3A B7 46 26 7E 09 81 47 39 ED BA A2 99 7F E0 DC 9F 51 62 FB C8 1D AD 84 50 48 3F F8 E0 2B 60 29 F2 4A 40 37 DA 1C 66 77 9E 0F 4B D3 B6 24 03 C4 18 88 9D 6D D5 6F 87 EC 72 1F CC 01 B5 F9 53 43 EF 8D 2C 3F 51 61 11 71 22 53 52 8E 72 4B 12 02 6D 59 8F A2 D9 84 0A D4 7D F2 B8 8F 09 A9 07 07 E0 AB AE 25 5A 62 ED E3 73 DE 21 98 CA 08 33 B7 1D EE 2C 20 96 0F 2B C5 4A 5C 60 6B 1E 45 B4 2F 3E F8 29 A6 50 24 5B B0 D5 41 5C CA 02 F5 F5 DA 4C 33 1B FA CB C0 28 69 D2 D7 BB FD 5E B8 17 9F 5B 92 AF BC 8A 35 70 4D 4B E8 B6 25 2C FC AB 15 AD D6 28 1A 8C B0 0B 31 A4 EF EF E1 D6 CB E9 EC BB 73 FB 22 58 C2 D0 23 EA C2 22 99 22 0A B3 4C DD ED E5 3C 2F 53 A4 8F 2C 12 C1 8A 10 21 37 D1 BE 86 8E D4 AA F4 2A CE 80 68 FD 3E ED C6 E5 6A 66 EC 06 8A 9D 81 04 9F 58 75 DF AF F2 E6 18 1D 26 20 CA B1 5C

And here is the source code:

Code: Select all

www . sony . net/Products/Linux/TV/KDL-40NX700 . html

If software approach won't be enough, I would like to go hardware. Do you think visible ports on the TV will be enough to pull some data from inside? Or I have to open it up and look for JTAG port?

Any help and idea is welcomed.

Thanks


FYI: I have JTAGged two XBOX 360s before. Have an SPI Flasher in hand

[erdem_ua]

Inspected the file. But doesn't create a any idea on me.

[coolrecep]

I am also very pissed at that situation. There is nothing. Absolutely no info...

Anyway, thank you for your help. I will kepp tryin'.

[coolrecep]

OK. I am back with new info!

Code: Select all

root@ubuntu:/home/user/?ndirilenler/binwalk-0.3.9/src# binwalk fw.bin
binwalk: /usr/local/lib/libcurl.so.4: no version information available (required by binwalk)

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
3485529   	0x352F59  	bzip2 compressed data, block size = u00k
23646804  	0x168D254 	bzip2 compressed data, block size = S00k
24439192  	0x174E998 	BFLT executable  version 3698180314,  code offset: 0xD0DBFC89,  data segment starts at: 0xFC57E3C8,  bss segment starts at: 0x314AD91C,  bss segment ends at: 0x579AC36E,  stack size: -209315630 bytes,  relocation records start at: 0x10C36FC1,  number of reolcation records: 1388897630,  gotpic gzdata
32409668  	0x1EE8844 	bzip2 compressed data
40790549  	0x26E6A15 	gzip compressed data, ASCII, has CRC, extra field, last modified: Sat Dec  8 07:18:40 2012
41683215  	0x27C090F 	bzip2 compressed data
44487229  	0x2A6D23D 	bzip2 compressed data, block size = X00k

So, what do you say?

I have also applied that command:

$ dd if=fw.bin bs=1 skip=3485529 of=out.bin

And here is the out.bin:

www . mediafire . com/?obd981k9gz57u77

[erdem_ua]

Okey will inspect more. ReDownloading.

[erdem_ua]

bunzip2 says that this is not a bz2 file.. I don't know what is the binwalk's algorithm. But this also could be false positive.
I guess this file has some kind of encryption and I am not gonna decrypt it.

It's better to root that device than try to read firmware dumps.I bet It's easier thing to do...

[coolrecep]

How can I root it? Is there a software for this? I have rooted a lot of phones but haven't rooted a TV yet

I also believe that binwalk is probably wrong.

[erdem_ua]

Who knows?
Does TV allows some widgets? Does it have some developer support on sony? Might you try to enter from there.
Or open TV back case and search for serial access.
At worst case, you can try to read TV's NAND chips. (require desolder and resolder NAND chips, TV will bricked on failure...) than read the chips under their specs. Require good electronic skills and some exotic equipments, probably even I don't have (or I have?) Anyway, there are always a workarounds.
There is no school for teaching how to hack device. You just needed to try everything that comes to your mind.
And there is no rule that everyone needed to find way to root TVs. You also needed to pry to God. That makes the difference.

[coolrecep]

I think I will take the the option I know the best: HARDware I will probably open it up and do some reading if there is COM port or etc.

The TV has widgets but none of them are 3rd party.

OK. I have found the WDK but apps must be appreoved to be run on the TV

I will connect the TV to the internet over my PC and sniff the data while downloading a widget

[coolrecep]

Just a little update for the curius. Here is the tear down.

http://www.technopat.net/forum/led-lcd- ... l#post4536

Ok got some update. Investigating service manual, I saw a port named:

UART0_TXD/RXD
UART1_TXD/RXD

DEBUG I/F

Looks like the show is about to begin Hell yeah. Got a lot actual jobs to do. So I am gonna leave it to the next weekend