Getting root on a Sony TV

The Sony Bravia series of HDTVs are a great piece of kit; they’re nice displays that usually have enough inputs for the craziest home theatre setups. These TVs also run Linux, but until now we haven’t seen anything that capitalizes on the fact these displays are wall-mounted Linux boxen. [Sam] sent in an exploit to root any Bravia TV – hopefully the first step towards replacing our home media server.

The exploit itself is a regular buffer overflow initialized by a Python script. The script sets up a Telnet server on any Sony Bravia with a USB port, and provides complete root access. [Sam] was able to get a Debian install running off a USB drive and all the Debian programs run correctly.

If you have a Bravia you’d like to test [Sam]‘s script on, you’ll need a USB network adapter for the TV and a Telnet client to explore your TV’s file system. Right now there’s not much to do with a rooted Bravia, but at least now running XMBC or other media server on a TV is possible.

If anyone would like to start porting XMBC to a Bravia TV, [Sam] says he’s more than willing to help out. We’re not aware of any HDTV modding communities on the Internet, so if you’re part of one post a link in the comments.

106 thoughts on “Getting root on a Sony TV

  1. KDL-40EX40B

    Is there anyway to modify the video decoder to read other file formats? I am using the PIVOS AIOS box to stream video since the DNLA is limited to about three video formats. Most of my video is .avi, .mkv, and .mp4. I also have a few .vob.

  2. I have a KDL 40HX805

    when I execute

    telnet 192.168.2.24 52323
    i get this

    Connected to 192.168.2.24.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key (i.e. space) I get this

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 05 Jan 2013 11:00:08 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-40HX805/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-40HX805″; mv=”1.7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-40HX805″;

    my be this gives some ideas for you …

  3. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  4. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  5. This is finally something that may lead me to scripting my own JB and HB’s… Iv been playing by their rules for a bit now and am done with the way the treat their existing consumer base!!!

  6. hey… i’m not a techno geek but really into it for some devices. My Sony KLV-32BX300 runs only .mpg video files. If anyone has any idea how to install additional format codecs into it please do help.please. (abuzerali@hotmail.com).

  7. I have a BRAVIA KDL-46NX720
    when I execute

    telnet 192.168.2.5 52323
    i get this

    Connected to 192.168.2.5.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key following output appears

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 10 Aug 2013 04:32:18 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-46NX720/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-46NX720″; mv=”1.
    7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-46NX720″;
    Connection to host lost.

  8. Hypothesis – Highly suspect any Cable Box-DVR when connected to a smart TV can and currently is being used as a gateway to access files on a connected USB Drive or similar connected device thru a cable network. IE big brother.. Now to prove it!

  9. Can some One help me, with Sony Bravia KDL-26EX30R , japan made, accidentally Hard disk was formatted and now just displays only Sony, nothing works plz help Thank you so much

  10. angelomert are these the keys that your on about ?

    develop.key

    N : A4974EA6BADC526AD2F1AD323E694E4B983F8969395B2B7DC04B4825701B94A2113E47AF74CFBCF4EC7C42C6E3A0ABA6DFB770B31C6B7A518CF426A27F6962524230AC90800F2D9FFBCBA32A25386D1CE9AA15B892DFFC33E43BBFA4CB11D8A5AF672699982BDCD018A45BAD8503BB3AA3AB631AF1CF0F1D4B9966D0B2D4743E17C9D6A83CEEC750E8260DC8E08B6D4E4487970A1FAE51BD6E124D7BA6FB66F67DB6FF2ECF9212409D0E70D2814074F390EF845D33594CE5895B3BCDD8D8BC513CDCC43B5C717FC81E40A595154422DE01594EA14ACE0D4346859B6E30E1392ADBAA06235C167F1D882C722FCAC767310E7DC496EE6D35E5609D779C3A66F84D
    E : 03
    KEYID : 0
    HASHTYPE : SHA1

    PRODUCTION.KEY

    N : D8C1F78FBD67DE5425B3934E97E20D901EEF1465E006DE5B142F4D8CBAEB538331BC9791F94DCA881BE2C61E1DE2F8C69A980F3CFC26FC68397A3534FD9AD911CE6DC53F842284898E54B63F6B57F82D7A4A3805D368F1FCCE4339D0203C0697E0E91C05FA6AB2887BC8FE33FBF3C5B91A5FB6B15BAB737539453F49E55C96695DF22B66CB1CF10A55E847836C165A017E7BE5594E05D0938942937445180038243B5248A358757051C01556C9751E2BBDF7451382AFEDD84A6A6E169E6C372783A0AEC357E3EB32D48101E96EB435CF8B69E730167F70D650AFF61C301E9A680E128F94C8D257E505A7ADC8D886CDF3B1BDA58830BA9D98E323006CA0C23399
    E : 03
    KEYID : 0.0
    HASHTYPE : SHA1

    # Cryptocore 3.x key rights:
    # KEYRIGHTS : SIGN_IRAM

    if they are the right ones il upload if of any help to anyone

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s