I am new to reverse engineering , but as I am home these days , I wanted to hack my sat receiver the receiver is based on c-sky v1 architecture

searching forums , I managed to get the firmware decomposed ( app.squashfs , app_rootfs.jffs2 , loader.bin ,logo.cramfs , upgrade_rootfs.squashfs and zImage )

I then extracted a file called "dvbapp" from app.squashfs wich I think is main app that does it all

it is an ELF file , but can not be detected by ghidra as it doesn't support c-sky , radare neither

my question is what can I do further ? can I even inspect the app ins and outs ( qemu maybe ? ) , or disassemble / decompile it ?

the c-sky has a big repository for its toolset ( here: https://github.com/c-sky ) , but I can't understand much about linux development

Thank you


Yes that is the main app, telnet into the stb via network, user root, no password. You will find the stb has that block mounted as /dvb/out.elf which is this file.

Its the main app, most command line utils are all in busybox, else a couple of scripts after OS boot and network or usb insertion.

Serial port (maybe not installed to back panel) is used for firmware loading not tty.

2 versions I know off with C610 processor, GX6605s and GX6622 which has cat5 as well as wifi support, bigger flash and ram.

The tuner/demod, the panel, and the frame buffer dvb output are all loaded as kernel modules which the dvb app uses to control the IO.

Also there is a working NFS client, user is gx, home dir is writable and stored to flash, also /home/gx has a working bin dir where you will find the mentioned scripts.

A lot of different makes sell the same OEM box, factory tools allow defining your user themes, images and look on the same operating firmware.

I am looking at re purposing these boxes as they are a cheap and complete sbc with 2 I2C and SPI for $20 in a box although not as powerful as other sbc choices.

The only way seems to be use the buildroot and Qemu tools and setup with the same kernel etc as the box firmware. I am trying yo use it to create binarys for the stb, run them direct from your linux box over NFS. It will be a learning curve. Assuming dvb user is gx:

mkdir /home/gx/XXX

mount -t nfs -o rw,tcp,nolock 192.168.XXX.XXX:/home/hca/ /home/gx/XXX/

umount -f -l /home/gx/XXX

RE ELF, maybe start here. https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/

binwalk and readelf are helpfull.

Hope this helps.

  • thanks a lot for your valuable reply I have tried logging into telnet with no success , the telnet port doesnt seem to be open ports open are (1835 1878 8085 9095 19000 20000 20001 ) I got these scripts you talk about and the busybox binary by decompressing the firmware ( using 7zip ) , I also got the makefile using that too will give you more feedback later , thanks
    – Selmen
    Aug 2 '20 at 17:55

Firstly I am using the GX6622 version right now. I have one GX6605s version which requires the usb wifi but not yet powered it up. Still finalising the track layout and pin out under the microscope. But my understanding is both chip versions with different brand names sold here in Indonesia both have telnet. I have seen a few variants of the board layout but all seem to have the same components.

The GX6622 version has 100+ pins, 1gb of external DDR, 8mb SPI flash, RS232, 2 USB and cat5 ethernet. The GX6605S version is 68 pins, 512mb internal, 4mb SPI flash and 2 USB. Uart 3v TTL TXD pin 26 RXD pin 27 to pads under the board if not on top.

There is another version GX????, I suspect latter cpu version which uses a 16mb SPI flash.

The size of your firmware image would confirm the GX chip you have. Because the flash is 8 pin SOIC SPI external it is possible to swap to a 16mbyte flash and mod the code to use it. Also as you can reflash the flash IC so you cant brick the box.

I am using putty by ip on port 23 as per defaults for telnet. Possibly your firmware is different? I cant find those ports you mention open here, only 23.

There is no ssh in the firmware here, I wonder what your open ports are for. The serial is at 115200, in my box it puts out about 10 characters and then seems to wait on something from the uploading program.

I have spend many weeks searching in Chinese and other languages for this project and have accumulated quite some info. The problem is while the Csky C610 processor is documented on github and their site is very active with support of newer Csky cpu's, there is no release of the rest of the Soc data which is produced by another company. Makes it hard without the IO datasheet. There is a helpful pinout Gx 6605s in the Csky dev board schematic on their Github. So reverse engineering the code to use the IO seems unavoidable. Fortunately the IO is separate in modules, not in the main app.

Some of the config and test tools I have found indicate the main app can work with large number of io devices, so expect the main dvb ap code to have may options of tuner and demod code within, somewhere there will be in the flash "data" block definitions of which one is used as they are configurable in the flash with config software tools.

Here is a list of the IO kernel modules I have you may already have found, and an what I think they do.

In /lib/modules/ av.ko is video output

fe.ko is I2C for the front end, probably GX3211 demod in the Soc and a RDA5815M tuner chip under the shielding.

gpio.ko -still investigating connections.

panel.ko is I2C for a custom chip for which I have a datasheet, drives up to 4 led, 4 press button and the 7 seg displays.

rt5370sta.ko is the wifi.

So I have collected a lot of firmware tools, code and snippets for these chips also some datasheets of devices in the GX family. Shortly I will start uploading it and links to github as linux project, firstly I want to make one into a DVB-S2 weather satellite receiver but have no data on the GX3211 demod in the Soc as yet.

It seems the I2C and Spi Flash are used via standard linux methods like ioctl and mtb, flash tools etc.

As soon as I verify the pinout and schematic of the GX6605s board, I will sort out and start uploading all the info I cave collated and work I have done and as a RE project on my github. It will also take some time. https://github.com/vk-hca

BTW what kink of hack do you wish to implement on the STB?


from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor. my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-unhide menu) Dump.bin extraction gives 7 other bin files boot.bin,data.bin,info.bin,kernel.bin,logo.bin,root.bin,table.bin..

Kernel.bin is lzma compressed so using a hex editor i removed the lzma header to search the menu password but could'nt find it may be due to a lay man's approach.I also used binwalk with various commands to further extract the fragments but now clueless what to do next. I request the group members to help me & guide me in choosing the appropriate approach. Thank you..

firmware link is shared below https://drive.google.com/file/d/1c2SyGaHu5I9P1jRCWKQomAYNQBYbgmg4/view?usp=sharing

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.