BD Firmware Downgrade (SamyGO Proof of Concept)

[mrlumpy]

BD-D5100 update:

The BD-D5100 requires a certain domain to resolve BEFORE the upgrade server is contacted. Here is the log of HTTP requests made using standard DNS:

[site blocked: http://www.samsungotn.net] from source 192.168.1.122, Thursday, June 21,2012 22:10:56
[site allowed: m.icq.com] from source 192.168.1.122, Thursday, June 21,2012 22:10:44
[site allowed: http://www.icq.com] from source 192.168.1.122, Thursday, June 21,2012 22:10:43

Note that the ICQ resolve is required before Samsung is contacted.

If ICQ is blocked, or down, the BD-D5100 tries another domain:

[site allowed: http://www.internic.net] from source 192.168.1.122, Thursday, June 21,2012 22:14:55

And if that is blocked:

[site allowed: www.yahoo.com] from source 192.168.1.122, Thursday, June 21,2012 22:24:28

(it also tries these in random order)

I believe

The BD-D5100 REQUIRES DOMAIN NAME RESOLUTION

before it attempts to contact http://www.samsungotn.net.

Therefore, arris69 (if possible) should modify his apache (using a simple .htaccess file, or firewall chain rule) config to resolve all DNS requests to his "www.samsungotn.net" server, OR, modify all requests BUT "www.samsungotn.net" to an empty HTML file/directory.

I am going to assume that more BD units in the future will work like this, resolving domains before allowing upgrades. Luckily, it's a simple fix.

Thanks again arris69!

[arris69]

BD-D5100 update:

The BD-D5100 requires a certain domain to resolve BEFORE the upgrade server is contacted. Here is the log of HTTP requests made using standard DNS:

[site blocked: http://www.samsungotn.net] from source 192.168.1.122, Thursday, June 21,2012 22:10:56
[site allowed: m.icq.com] from source 192.168.1.122, Thursday, June 21,2012 22:10:44
[site allowed: http://www.icq.com] from source 192.168.1.122, Thursday, June 21,2012 22:10:43

Note that the ICQ resolve is required before Samsung is contacted.

the device has smarthub? are you sure that no icq widget is installed? are your 100% sure requests came from bd-device and not from other computer?

If ICQ is blocked, or down, the BD-D5100 tries another domain:

[site allowed: http://www.internic.net] from source 192.168.1.122, Thursday, June 21,2012 22:14:55

And if that is blocked:

[site allowed: http://www.yahoo.com] from source 192.168.1.122, Thursday, June 21,2012 22:24:28

(it also tries these in random order)

for me it looks like some IM try to contact some servers

I believe

The BD-D5100 REQUIRES DOMAIN NAME RESOLUTION

before it attempts to contact http://www.samsungotn.net.

Therefore, arris69 (if possible) should modify his apache (using a simple .htaccess file, or firewall chain rule) config to resolve all DNS requests to his "www.samsungotn.net" server, OR, modify all requests BUT "www.samsungotn.net" to an empty HTML file/directory.

this won't work. what you can do is maybe some NAT rules or host defines on your router

I am going to assume that more BD units in the future will work like this, resolving domains before allowing upgrades. Luckily, it's a simple fix.

Thanks again arris69!

can you make some network-traffic dump (maybe with tcpdump?)
like:

Code: Select all

tcpdump -i <correct nw interface> -e host <ip of bdplayer> -s0 -w out.cap

regards
arris

[mrlumpy]

Hi arris!

Thanks for the response.

The DVD-D5100 is at my mother-in-law's, connected to a standard netgear router. No editing of DNS entries is possible, it's standard consumer stuff. Hence why I used your DNS server.

Perhaps wireshark on Win7 may work though to do a TCP dump...

I'm going to try and see if there is a public editable DNS service that will allow me to redirect www.samsungotn.net to your custom server, I'll let you know how it turns out.

Thanks,

mrlumpy

PS The D5100 uses DNLA / AllShare (on your windows box), there is no "smart hub" option or button.

[chicky2207]

Hi, do you planning downgrade firmware for HT-D5550?

Thanks for reply.

[OlsBean]

Worked on BD-D5500, thank you very very much

Can someone please tell me how to disable the auto firmware update on the BD-D5500, I've switched off "update in standbye mode" from within the settings but it still keeps asking and then trying to update to the latest Samsung Firmware.

[juusso]

I dont know how bout BD, but for TV it is needed to switch off OTN in service menu - control - sub option - otn.

[OlsBean]

Thanks for the reply, does anyone know how to access the service menu in the BD-D5500, I've searched and can't find a concise answer.

TIA

[arris69]

Hi, do you planning downgrade firmware for HT-D5550?

Thanks for reply.

no, no plans for "downgrade" for FIR* based devices.

[mafgr]

Do we need to enable OTN in our BR players??
I am ready to test it but i need to find how to access the service menu.
Is it Info menu mute power like the tvs???
Please tell us how to proceed.

arris69 propably i cancelled the update i have the 1025.0 and today i shall be ready to test it.
When i tried to download it showed me the 1090 firmware.After downloading is the firmware masked as 10.15??
Can you please help me out??

Forgot to mention i have a BD-D5500,and i have a serious problem i do not know if it is due to cinavia or not???The dts tracks are constantly interupted.

[arris69]

Do we need to enable OTN in our BR players??
I am ready to test it but i need to find how to access the service menu.
Is it Info menu mute power like the tvs???
Please tell us how to proceed.

if you don't know how to access the service menu then you never turned it off (logically). per default it's enabled

arris69 propably i cancelled the update i have the 1025.0 and today i shall be ready to test it.
When i tried to download it showed me the 1090 firmware.After downloading is the firmware masked as 10.15??

on some devices yes on some not. pls. report what's on yours. but if you make a factory reset (read manual of device how to do it) it "should" show the correct version (1015.?)

Can you please help me out??

Forgot to mention i have a BD-D5500,and i have a serious problem i do not know if it is due to cinavia or not???The dts tracks are constantly interupted.

not really helpful the modelname, then from my point of view there are just different firmware-classes like B-BRCMBSP B-BRCM53BSP B-BRCM65BSP etc.