Rooting LATEST H firmware [discuss]

[dudelove]

i think if you block the url some apps might not work correctly but i am not sure becouse my tv got OTN disabled

[mad_ady]

I've uploaded new packet captures after blocking samsungcloudsolution.net and trying the update option in the menu (see my previous post for the link).

Here's what's strange: On one update attempt, the capture shows no traffic to external services (just some DHCP messages) - as if it knew there were no updates and didn't bother checking. In a different capture, it shows queries to samsungcloudsolution.net and no answer. Visually the TV behaved the same way - reported no updates are available almost instantly.

I also did a packet capture of the startup sequence. Again, you can see DNS requests to *.samsungcloudsolution.net that are left unanswered.

Should I try blocking other domains as well (I don't know what infolink.pavv.co.kr is for, but I see requests to it)? Smart Hub behaves normally so far...

[mad_ady]

Well, does anybody have any more suggestions on what to block, or can we (finally) consider that online updates are cut off?

[id001]

Hello, everyone!
I'm kind of new here, but found something interesting. I'm not sure if it's new information for the advanced members here but check out this document here about the security of the Smart TV Apps:

https://www.ei.rub.de/forschung/veroeff ... /smart-tv/

The interesting thing is that they get File system access using the HTML <object> tag. Then use XMLHttpRequest to the read the files.

They used Samsung UE22H5670 with firmware 2606 -

I'm not really a programmer, but created my first ever Samsung app to try it on my TV UE55H700 with the latest firmware 2750 and was able to do the same with the Object tag:

object.jpg

I know it just a read-only method, but maybe you can use something else from that study, too.
I hope it will be helpful for someone with more knowledge.

[sectroyer]

Looks like it might be useful for some users so when you have time release here what you did

[id001]

As it's written in the study it's basically this:

Code: Select all

<object width="1920" height="1060" data="file:///">
</object>

You need a mouse to navigate the directories.

I attached a simple app.

[ubiquitous]

I've written a tool utilizing XMLHttpRequests and libFilesystem functions to traverse and dump the filesystem or specific files if it's of any interest.

[id001]

That would be great, thanks.

BTW Is it possible to decrypt the recordings, using this? I mean we can download everything from the TV. I'm not sure how are the files encrypted, but the key is probably in the TV somewhere and we can access it, right?

[zoelechat]

the key is probably in the TV somewhere and we can access it, right?

No, there's no known way to get it on H, even in "TV memory", and key-in-a-file is over since D series

[ubiquitous]

That would be great, thanks.

BTW Is it possible to decrypt the recordings, using this? I mean we can download everything from the TV. I'm not sure how are the files encrypted, but the key is probably in the TV somewhere and we can access it, right?

No. It's probably just useful for people who want to download system binaries and shared libraries for reverse engineering purposes.