Getting root on a Sony TV

The Sony Bravia series of HDTVs are a great piece of kit; they’re nice displays that usually have enough inputs for the craziest home theatre setups. These TVs also run Linux, but until now we haven’t seen anything that capitalizes on the fact these displays are wall-mounted Linux boxen. [Sam] sent in an exploit to root any Bravia TV – hopefully the first step towards replacing our home media server.

The exploit itself is a regular buffer overflow initialized by a Python script. The script sets up a Telnet server on any Sony Bravia with a USB port, and provides complete root access. [Sam] was able to get a Debian install running off a USB drive and all the Debian programs run correctly.

If you have a Bravia you’d like to test [Sam]’s script on, you’ll need a USB network adapter for the TV and a Telnet client to explore your TV’s file system. Right now there’s not much to do with a rooted Bravia, but at least now running XMBC or other media server on a TV is possible.

If anyone would like to start porting XMBC to a Bravia TV, [Sam] says he’s more than willing to help out. We’re not aware of any HDTV modding communities on the Internet, so if you’re part of one post a link in the comments.

109 thoughts on “Getting root on a Sony TV

  1. KDL-40EX40B

    Is there anyway to modify the video decoder to read other file formats? I am using the PIVOS AIOS box to stream video since the DNLA is limited to about three video formats. Most of my video is .avi, .mkv, and .mp4. I also have a few .vob.

  2. I have a KDL 40HX805

    when I execute

    telnet 192.168.2.24 52323
    i get this

    Connected to 192.168.2.24.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key (i.e. space) I get this

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 05 Jan 2013 11:00:08 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-40HX805/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-40HX805″; mv=”1.7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-40HX805″;

    my be this gives some ideas for you …

  3. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  4. Is there a way to get Simulview working, or at least getting the IR tranmitter to send left/left and right/right codes to the Sony glasses? Getting tired of waiting for Sony to do the update, especially when its all over the web of others using HDMI detective and such to use Simulview… one kid was able to get a Sony tablet to mimk the IR codes as well. It is really coming to be evident that Sony is limiting Simulview use by resricting authorized EDID codes from the Bravia TV’s.

    http://community.sony.com/t5/Television-Picture-Sound/SimulView-Updates-For-Bravia-Question-Query/m-p/45511

  5. This is finally something that may lead me to scripting my own JB and HB’s… Iv been playing by their rules for a bit now and am done with the way the treat their existing consumer base!!!

  6. hey… i’m not a techno geek but really into it for some devices. My Sony KLV-32BX300 runs only .mpg video files. If anyone has any idea how to install additional format codecs into it please do help.please. (abuzerali@hotmail.com).

  7. I have a BRAVIA KDL-46NX720
    when I execute

    telnet 192.168.2.5 52323
    i get this

    Connected to 192.168.2.5.
    Escape character is ‘^]’.

    when and do nothing , after a few seconds the connection will be closed by the TV

    when I type any key following output appears

    HTTP/1.1 400 Bad Request
    Connection: close
    Date: Sat, 10 Aug 2013 04:32:18 GMT
    Server: Linux/2.6 UPnP/1.0 KDL-46NX720/1.7
    X-AV-Server-Info: av=5.0; cn=”Sony Corporation”; mn=”BRAVIA KDL-46NX720″; mv=”1.
    7″;
    X-AV-Physical-Unit-Info: pa=”BRAVIA KDL-46NX720″;
    Connection to host lost.

  8. Hypothesis – Highly suspect any Cable Box-DVR when connected to a smart TV can and currently is being used as a gateway to access files on a connected USB Drive or similar connected device thru a cable network. IE big brother.. Now to prove it!

  9. Can some One help me, with Sony Bravia KDL-26EX30R , japan made, accidentally Hard disk was formatted and now just displays only Sony, nothing works plz help Thank you so much

  10. angelomert are these the keys that your on about ?

    develop.key

    N : A4974EA6BADC526AD2F1AD323E694E4B983F8969395B2B7DC04B4825701B94A2113E47AF74CFBCF4EC7C42C6E3A0ABA6DFB770B31C6B7A518CF426A27F6962524230AC90800F2D9FFBCBA32A25386D1CE9AA15B892DFFC33E43BBFA4CB11D8A5AF672699982BDCD018A45BAD8503BB3AA3AB631AF1CF0F1D4B9966D0B2D4743E17C9D6A83CEEC750E8260DC8E08B6D4E4487970A1FAE51BD6E124D7BA6FB66F67DB6FF2ECF9212409D0E70D2814074F390EF845D33594CE5895B3BCDD8D8BC513CDCC43B5C717FC81E40A595154422DE01594EA14ACE0D4346859B6E30E1392ADBAA06235C167F1D882C722FCAC767310E7DC496EE6D35E5609D779C3A66F84D
    E : 03
    KEYID : 0
    HASHTYPE : SHA1

    PRODUCTION.KEY

    N : D8C1F78FBD67DE5425B3934E97E20D901EEF1465E006DE5B142F4D8CBAEB538331BC9791F94DCA881BE2C61E1DE2F8C69A980F3CFC26FC68397A3534FD9AD911CE6DC53F842284898E54B63F6B57F82D7A4A3805D368F1FCCE4339D0203C0697E0E91C05FA6AB2887BC8FE33FBF3C5B91A5FB6B15BAB737539453F49E55C96695DF22B66CB1CF10A55E847836C165A017E7BE5594E05D0938942937445180038243B5248A358757051C01556C9751E2BBDF7451382AFEDD84A6A6E169E6C372783A0AEC357E3EB32D48101E96EB435CF8B69E730167F70D650AFF61C301E9A680E128F94C8D257E505A7ADC8D886CDF3B1BDA58830BA9D98E323006CA0C23399
    E : 03
    KEYID : 0.0
    HASHTYPE : SHA1

    # Cryptocore 3.x key rights:
    # KEYRIGHTS : SIGN_IRAM

    if they are the right ones il upload if of any help to anyone

  11. Hi all! Thanks a lot for all this!
    I want to log onto my bravia KDL-40W605B, using wifi and a computer running Ubuntu.
    How can I?
    One interesting thing: when I had set up my wifi internet connection with the bravia, I created an allow exception on my access point wifi allowed device list, using the MAC address I found on my bravia using its own properties.
    Guess what? The MAC address provided with the tv, inside the tv, wasn’t correct!
    I had to deactivate wifi protections on the access point, so every device could access it, I found out the correct MAC address of the tv wifi card using Fing from my android smartphone and then wrote it down correctly and restored the allowed devices!

  12. Hi all! I have a Bravia KDL-40W605B.
    I couldn’t connect to my access point wifi, because the MAC address
    I read inside the tv Settings was INCORRECT!!!
    I had to allow every device to access my wifi, let the tv connect to
    it and then find out my tv correct MAC address using Fing from my android smartphone!
    I would love to run nimue.py on my tv, but how? Up to now I’m only at this point:

    ale@beast:~$ sudo nmap -sP 192.168.0.0/24
    Starting Nmap 6.40 ( http://nmap.org ) at 2014-12-07 16:36 CET
    […]
    Nmap scan report for 192.168.0.8
    Host is up (0.050s latency).
    MAC Address: 38:B1:DB:6E:9B:DD (Unknown)
    […]
    Nmap done: 256 IP addresses (5 hosts up) scanned in 2.36 seconds
    ale@beast:~$

    ale@beast:~$ nmap 192.168.0.8 -p0-60000
    Starting Nmap 6.40 ( http://nmap.org ) at 2014-12-07 16:45 CET
    Nmap scan report for 192.168.0.8
    Host is up (0.044s latency).
    Not shown: 59995 closed ports
    PORT STATE SERVICE
    80/tcp open http
    20031/tcp filtered unknown
    41824/tcp open unknown
    42824/tcp open unknown
    52323/tcp open unknown
    54400/tcp open unknown

    Nmap done: 1 IP address (1 host up) scanned in 25.96 seconds
    ale@beast:~$

    What can I do?

  13. I have Sony KDL-22EX420 TV and i downloaded source code too. please let me know how to compile those source code?, ie how to make .bin file(firmware PKG4.027GAA). I want to port VLC player on my TV

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s