I found firmware for Slingbox 500 by sniffing the outgoing connections it is making. Having trouble making heads or tails of it though. I'd really love to see the filesystem because it's running dropbear ssh server!
files as follow, were obtained from http://mdconfig.sling.com/config/v2/type/ngsb/product/intrepidCbfu/version/01.10.095.json --
{
"payload":
"{"config":
{
"updateVersion":"01.10.102",
"rebootTimeMsec":68000,
"firmwareComponents":
{
"appfsRecovery":
{
"critical":false,
"crc":123,
"order":1,
"reboot":false,
"url":"www.navjit.com",
"size":123,
"version":"0.5.102"
},
"uImageMain":
{
"critical":false,
"crc":1863698014,
"order":2,
"reboot":false,
"url":"http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.bin",
"size":5463888,
"version":"1.9.118"
},
"FW3":
{
"critical":false,
"crc":2050778634,
"order":3,
"reboot":false,
"url":"http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.bin",
"size":262144,
"version":"1.5.432"
},
"FW2":
{
"critical":false,
"crc":2050778634,
"order":4,
"reboot":false,
"url":"www.navjit.com",
"size":123,
"version":"0.5.472"
},
"FW1":
{
"critical":false,
"crc":123,
"order":5,
"reboot":false,
"url":"www.navjit.com",
"size":123,
"version":"0.5.472"
},
"uImageRecovery":
{
"critical":false,
"crc":123,
"order":0,
"reboot":false,
"url":"www.navjit.com",
"size":123,
"version":"1.5.002"
}
},
"applications":
{
"sbCore":
{
"urlMeta":"http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar",
"critical":false,
"sizeMeta":10240,
"reboot":true,
"type":"file_system",
"url":"http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aes",
"version":"01.10.102",
"size":99865328
}
}
}
}",
"header":
{
"signatureEncoding":"base64",
"msgType":"plain",
"signature":" MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAADGCAg8wggILAgEBMHkwdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAoTC1NsaW5nIE1lZGlhMRMwEQYDVQQDEwpNRCBET1dOIENBMSUwIwYJKoZIhvcNAQkBFhZtZGFkbWluQHNsaW5nbWVkaWEuY29tAgEDMA0GCWCGSAFlAwQCAQUAoGkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwNDI3MDYxNzIyWjAvBgkqhkiG9w0BCQQxIgQgdMg3fnkpkxTXkZzmAgvCH613L0YpH70/9yGDYSN0D7YwDQYJKoZIhvcNAQEBBQAEggEApKOkHp4k8EgaMxPIxelQX2E2iKP91HgUnx4lkYkffirQU5ObvIFWd4DAyEmb6QO8X3BVA/tWnDDaIwunUy/2WVjgcwyTiSLr20tPlEPDJcACEQERx2xzAss3Y+voeXmwBrmDWFXn5ILNUN86GsL3mUyfySR6ZPly4Wu2Krb55e58FIu9WqS6ynCD1Qdt4djQ6VgeG+2+CBmUp7mvoemgr+Kzs0wNCOOm9/561Cqsl3MCbHrt8hXikcb2lTyH3UkNRlBmYt66hb7MB1r1osT8KLLERuJ1kFOhYf6edefTFjyQVM/EUUwK5TO5NzFGB8wosG9jzbLpbE9qXQrj62j6tAAAAAAAAA==",
"configEncoding":"none"
}
}
Binwalk is blank on both of these files:
The following tar file expands into three separate files:
- http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar
- FW5_sig.smime <-- don't know how to decode these smime files, but the contain strings like "Intrepid pkg key", "Intrepid pkg signer", and "OpenSSL Generated Certificate", and have interesting names which might be useful!
- FW5_enc_params.smime
- ubi_fw_size --> "128057344"
And probably the most interesting file which appears thoroughly encrypted (95 MB):
So here I am wondering if there is a chance to get further or if I'm stuck. I'm not against hardware tinkering, though I would certainly be clumsy with it and would require some handholding. Any thoughts? Thanks.
