Getting root on a Sony TV

The Sony Bravia series of HDTVs are a great piece of kit; they’re nice displays that usually have enough inputs for the craziest home theatre setups. These TVs also run Linux, but until now we haven’t seen anything that capitalizes on the fact these displays are wall-mounted Linux boxen. [Sam] sent in an exploit to root any Bravia TV – hopefully the first step towards replacing our home media server.

The exploit itself is a regular buffer overflow initialized by a Python script. The script sets up a Telnet server on any Sony Bravia with a USB port, and provides complete root access. [Sam] was able to get a Debian install running off a USB drive and all the Debian programs run correctly.

If you have a Bravia you’d like to test [Sam]‘s script on, you’ll need a USB network adapter for the TV and a Telnet client to explore your TV’s file system. Right now there’s not much to do with a rooted Bravia, but at least now running XMBC or other media server on a TV is possible.

If anyone would like to start porting XMBC to a Bravia TV, [Sam] says he’s more than willing to help out. We’re not aware of any HDTV modding communities on the Internet, so if you’re part of one post a link in the comments.

Comments

  1. Lamoboy says:

    any more news on this? Where I can track the process of developing additional features for Bravia TV’s?

  2. William says:

    How to use a tv kdl-32ex340??
    I do not know which firmware uses

  3. Dante says:

    Is there still work going on with this? where can I track developments?

  4. sarat says:

    how do i run the script on tv?
    can anyone post the step by step procedure!

  5. Shaf says:

    KDL-40EX40B

    Is there anyway to modify the video decoder to read other file formats? I am using the PIVOS AIOS box to stream video since the DNLA is limited to about three video formats. Most of my video is .avi, .mkv, and .mp4. I also have a few .vob.

  6. Lamoboy says:

    Could someone add support for IPTV in Sony BRAVIA KDL-32W5500 with this hack?

  7. OlliM says:

    Any progress here or did it just stop working? Would love to jailbreak my Sony…

  8. Bernhard says:

    I have a KDL 40HX805

    when I execute

    telnet 192.168.2.24 52323
    i get this

    Connected to 192.168.2.24.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key (i.e. space) I get this

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 05 Jan 2013 11:00:08 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-40HX805/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-40HX805″; mv=”1.7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-40HX805″;

    my be this gives some ideas for you …

  9. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  10. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  11. This is finally something that may lead me to scripting my own JB and HB’s… Iv been playing by their rules for a bit now and am done with the way the treat their existing consumer base!!!

  12. Lamoboy says:

    Could someone make something useful based on this exploit? For example ability to watch IPTV channels without additional hardware.

  13. Ali Abuzer says:

    hey… i’m not a techno geek but really into it for some devices. My Sony KLV-32BX300 runs only .mpg video files. If anyone has any idea how to install additional format codecs into it please do help.please. (abuzerali@hotmail.com).

  14. René says:
  15. angelomerte says:

    Do you still have your rooted sony? what about reading out the keys used to encrypt firmware updates?

  16. RoBoy says:

    Looking for firmware upgrade for Sony Bravia KDL40X3100 that will enable EPG, any ideas???

  17. Amrith says:

    I have a BRAVIA KDL-46NX720
    when I execute

    telnet 192.168.2.5 52323
    i get this

    Connected to 192.168.2.5.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key following output appears

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 10 Aug 2013 04:32:18 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-46NX720/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-46NX720″; mv=”1.
    7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-46NX720″;
    Connection to host lost.

  18. augustborn says:

    Hypothesis – Highly suspect any Cable Box-DVR when connected to a smart TV can and currently is being used as a gateway to access files on a connected USB Drive or similar connected device thru a cable network. IE big brother.. Now to prove it!

  19. My Sony KDL-32EX340 wont even start the update. I only get a message on the screen that says that It cant read the USB. This TV set doesnt have any other port =( what can I do?

  20. thas says:

    Unfortunately, it did not work with Sony Bravia model KDL-40EX500
    sw PKG4.117EUL-0108. Sony locked all open ports.

  21. Khan says:

    Can some One help me, with Sony Bravia KDL-26EX30R , japan made, accidentally Hard disk was formatted and now just displays only Sony, nothing works plz help Thank you so much

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 96,434 other followers