[HN Gopher] Turning a TV set-top box into a Linux computer (2022)
___________________________________________________________________
Turning a TV set-top box into a Linux computer (2022)
Author : todsacerdoti
Score : 311 points
Date : 2023-02-14 11:11 UTC (11 hours ago)
(HTM) web link (zeus.ugent.be)
(TXT) w3m dump (zeus.ugent.be)
| devsda wrote:
| It is impressive that that they were able to run linux without
| making permanent destructive changes.
|
| Had a pogoplug that I was able to repurpose as a linux server for
| some odd cron jobs and occasional backups.
|
| Assuming there are no such constraints to revert, what other
| general purpose consumer devices are hack friendly and can be
| turned into low powered linux boxes ?
| trevithick wrote:
| Check out the OpenWRT Table of Hardware.[0] It runs on all
| kinds of stuff.
|
| [0] https://openwrt.org/toh/start
| reginaldo wrote:
| Take a look at
| https://www.armbian.com/download/?device_support=Supported as
| well
| RobotToaster wrote:
| Not exactly a consumer device, but old thin clients are cheap
| and can be repurposed this way.
| rbanffy wrote:
| And the x86 ones are just PCs, so all the software bringup
| part is trivial (which is why I managed to succeed at that
| ;-) )
| thomastjeffery wrote:
| It's an Android TV box. It was running Linux already.
|
| The main difficultly is usually unlocking the bootloader.
| rbanffy wrote:
| Getting an updated kernel is also an issue - the article
| describes the device tree hacks they had to go through before
| the machine was usable.
| anthk wrote:
| That's my issue with PostmarketOS and the Pocket Chip and
| the 7" Android Netbook.
| cassepipe wrote:
| Almost all my friends in France have a old ISP modem router that
| their former ISP did not bother getting their hands back onto
| when they changed providers.
|
| I would love to repurpose them. Where do I start with ?
| mk_stjames wrote:
| This is a good article that covers the basics of looking for a
| UART debug port that could be used as a way to get some low
| level access to the router and go from there:
|
| https://www.riverloopsecurity.com/blog/2020/01/hw-101-uart/
| redfast00 wrote:
| Try to identify a serial port on the PCB, connect a serial
| adaptor to it (careful to get the pins and voltage right!) and
| take it from there
|
| (Edit: or google the PCB board markings, maybe somebody already
| did this)
| mritzmann wrote:
| Check whether an alternative firmware already exists (e.g.
| OpenWrt or DD-WRT).
|
| https://openwrt.org/toh/start
| Klasiaster wrote:
| You can also get a similar board with that CPU here:
| https://libre.computer/products/aml-s905x-cc/
|
| It's optimized for mainline Linux and since u-boot supports UEFI
| booting, you can just throw a downloaded Fedora arm64 image on it
| and it will boot.
| kelvie wrote:
| Oh wow, if this had an M.2 slot i'd consider getting these for
| my home k8s cluster (I use rpi4s which are hard to get and such
| cause USB SSDs are flaky with power, and an odroid M1, which
| has a pretty slow processor, but is otherwise perfect)
| tracker1 wrote:
| I've found the Argon power supplies (18W, 3.5A) for RPi are
| probably the best option when using USB powered storage... I
| swapped out the ones that came with my DeskPi cases. I have
| tried several, an earlier model didn't have the inline
| switch, which I don't really use but a nice to have feature.
|
| https://www.amazon.com/gp/product/B0919CQKQ8/
| NayamAmarshe wrote:
| +1 for Libre Computer. Le Potato is awesome.
| wyldfire wrote:
| I've had trouble sourcing reliable SD cards for these SBCs. I
| have had the Le Potato, ODROIDs, RasPis. And they will
| generally work really well 98% of the time. But I keep them in
| a closet and I hate that I need to service them once a year or
| so. I tried buying SD cards from several different retailers
| and never got reliable results like from SATA SSDs (or even
| rotating disks it seems).
|
| I eventually just bought an intel NUC which I saw as a big
| defeat but also a remarkably practical solution.
| NotYourLawyer wrote:
| SD cards are flaky in general.
| mikepurvis wrote:
| Can you network boot a Raspi? This source seems to think so,
| as of the 3B+, anyway: https://www.makeuseof.com/tag/network-
| boot-raspberry-pi-with...
|
| I guess it requires them to be on wired network, but if
| they're in a closet, that's probably the case anyway.
| Maursault wrote:
| > you can just throw a downloaded Fedora arm64 image on it and
| it will boot.
|
| I know what you meant, but I have known and loathed hardware
| for which this would occur quite literally
| Jasper_ wrote:
| Oh hey, the Amlogic chips. I worked for a company that wanted
| to turn an Amlogic S805 STB kit into a Linux computer. I think
| the reason that it works fairly well out of the box is because
| of some of the drivers we contributed to the effort :)
|
| Their display controller driver was fun to figure out.
| https://github.com/torvalds/linux/tree/master/drivers/gpu/dr...
| colordrops wrote:
| Is there anything that can be done with unused Roku boxes? I have
| a Roku Ultra 4k that I'd love to install open source software
| onto.
| granra wrote:
| I made a similar write up on running mainline Linux on a similar
| device a few years ago. Interesting read though.
|
| https://codedbearder.com/posts/mainline-linux-on-tx3-mini/
| NKosmatos wrote:
| Vendors of STBs should unlock them so that we don't get so much
| e-waste.
|
| These boxes are most of the times locked, whereas they could be
| repurposed for many interesting uses (linux machines, android
| boxes, educational devices...), now they will be thrown away,
| remain in closets/garages or at the best be recycled.
|
| Tried to unlock my Vodafone TV box (Sagemcom DIW387 if I'm not
| mistaken), but with no luck since there is no community to "hack"
| it.
| ChuckNorris89 wrote:
| What about game consoles?
| beebeepka wrote:
| Good luck with that. I just don't see Arris or Sagemcom opening
| up any time soon. These things are fairly locked down and
| drivers are tuned for specific things.
|
| I spent a few years dealing with some of these STBs and yeah,
| they make great little computers. Such a waste. Just like
| smartphones,
| vctrnk wrote:
| I won't hold my breath. From the article:
|
| > In theory, we might be asked to give this device back. In
| practice, these devices are written off as soon as they're sent
| to customers.
|
| In my country, there are various ISPs with the same OEM boxes
| from SDMCtech. They went to the trouble of asking manufacturer
| to put a custom SDIO encryption chip onboard. If someone dares
| to touch the firmware and/or included apps (not system, but
| phone-home ones) the device automatically bricks forever. Not
| even a NAND change fixes this, as the SoC/cryptochip/NAND trio
| is somehow "mated" at factory. This derived in a literal
| _invasion_ of these at flea markets, charity stores etc. Almost
| none of them work, and if they do they are thoroughly locked.
|
| Some people like me had limited success tweaking things through
| ADB. This box seems to accept a launcher change as long as the
| original isn't erased. That works until the box updates itself
| and bitches again about "pirating/unauthorized use", which is
| quite frequent.
|
| Our ISPs are well aware of said e-waste, and still won't budge
| their up-the-ass attitude.
| bigape911 wrote:
| Then when it's time to get rid of it, throw it back at their
| door step since it doesn't belong to you
| mschuster91 wrote:
| Most of the common STBs have _piss poor_ performance because
| their specs are barely adequate as providers don 't give a fuck
| about anything except BOM cost.
| avidiax wrote:
| They are really excellent at decoding video, as you would
| expect. They can't run a 4k UI generally, however.
|
| I think it's holding the industry back somewhat. Having a bit
| more power might make these boxes a home hub, a video calling
| device, a gaming device, or at least a bit future-proof.
|
| One thing I like to do with Android TV devices is install
| tailscale on them. At least I can ADB to them from anywhere,
| and I can also setup the exit node. They use hardly any
| power, so it's a nice solution to have access to your home
| network or home internet connection.
| larodi wrote:
| It must be a low. Like self unlock after 513 boots
| anonuser123456 wrote:
| We aren't going to modify our security protocols so a handful
| of people can mod their STB, sorry :P
| NegativeK wrote:
| Given how quickly support is dropped for consumer
| electronics, not opening up access to them is unacceptable.
|
| And that isn't really addressing the fact that many companies
| don't have the funding or the will to secure these devices.
| BizarroLand wrote:
| I mean, if nothing else when the device reaches EOL what
| would it hurt to release a bootloader unlock?
| NotYourLawyer wrote:
| "What would it hurt" is the wrong question. The question
| is "how would it profit them"?
|
| If it wouldn't, they have zero incentive to do it.
| Clamchop wrote:
| I think the desire to repurpose obsolete electronic
| appliances is probably far too small to make a meaningful
| dent in e-waste. Not much to be done at scale with random,
| idiosyncratic, and underpowered SBCs.
|
| I don't know for sure but I do strongly suspect it.
| allenrb wrote:
| Excellent work once again. Would have loved to find something
| like this when I was a student... back when computers occupied
| entire desks.
|
| This seems similar, if not identical, to the free streaming box I
| told Xfinity they could keep. Might go revisit that decision now.
| almost_noone wrote:
| I work for an ISP and my role is pretty much to have the TV STBs
| become ewaste as late as possible (trying my best to do my part).
| Currently our security is pretty bad [1] (that's why I'm posting
| from a throwaway account), but I have a mainline Linux booting
| off a USB storage without touching internal storage (with very
| little changes). I plan to fix those security issues, and make
| this boot-from-usb official within few months. We're far from
| thrashing those units, but when we will, it'll be too late to
| open them up.
|
| [1] related to security of user private data
| jeroenhd wrote:
| That's great, be sure to post your story here on HN when you've
| finished the project!
| tinus_hn wrote:
| Has anyone ever tried to find out how one can connect to the TV
| servers and how the DRM works? In the EU you'd be allowed to get
| the keys from the provider.
| avidiax wrote:
| Sometimes it is just an app that knows where the streams are,
| and sometimes there is a devices attestation certificate burned
| into a TPM. The latter you are probably not going to hack, and
| even if you could, the various pirate IPTV providers will
| provide it for less cost if you value your time at minimum
| wage.
| bigape911 wrote:
| Nice. Repurpose and reuse for when these things get thrown away
| next year.
| haolez wrote:
| I've worked with STB hardware before and they usually suck. The
| processors that I worked with were all from MIPS and it felt like
| all useful instructions were removed, except for the bare basics.
| Forget anything related to vectorization, for example. They were
| painfully slow.
| kasabali wrote:
| These boxes generally utilize stock Cortex A53/A55 which are
| quite good IMO.
| avidiax wrote:
| "Good" as in they can do anything slowly. A7x boxes won't
| struggle.
| n8henrie wrote:
| I love these kinds of writeups, thank you!
|
| How did you determine what addresses to read things into? (the
| chainloaded bootloader, then its initrd/ FDT / etc.).
| redfast00 wrote:
| Mainly by looking at what addresses the original bootloader
| loads them into. The addresses don't matter too much, as long
| as you load them into valid memory, since for most you pass a
| reference to them anyway in later steps.
| n8henrie wrote:
| Thanks for your response!
|
| I'm a hobbyist that's been tinkering with uboot now and again
| for years and can never figure out the right addresses for
| stuff, or where / how to learn this.
|
| I assume this memory is subsequently released for the OS? Or
| does the OS just work around it?
|
| Are you hobbling your runtime experience in some way if you
| load to the wrong address?
| redfast00 wrote:
| author here, surprised to see this on HN. If you have any
| questions, don't hesitate to ask :)
| webdevver wrote:
| Out of interest, what logic analyzer/logic analyzer software is
| the author using?
| c0wb0yc0d3r wrote:
| Looks like sigrok[0]. From the screenshots, the logic analyzer
| looks similar to a saleae clone.
|
| [0]:https://sigrok.org/wiki/Main_Page
| unwind wrote:
| ... and if you're not aware, Saleae clones are widely
| available on e.g. Amazon, prices before shipping seem to
| start around $7 in the US. This is possible since the
| original Saleae is basically just a CY7C68013A [1] in a box,
| and once others realized that cloning it was not difficult.
| No idea about patents and so on here, obviously it's not OK
| for clones to use Saleae's firmware without licensing it.
|
| I have one, it worked fine and is of course highly
| recommended since the combination of a cheap way to get
| signals into the computer and Sigrok's protocol analyzers
| makes things really neat.
|
| [1]: https://www.infineon.com/cms/en/product/universal-
| serial-bus...
| retSava wrote:
| I had a clone once upon a time, together with several
| Saleaes and have recommended them to many many people, and
| that clone was not accurate to me. While the chip and the
| firmware was probably exactly the same as the original one,
| the rest of the hardware was cost minimized and did not
| work as well. I compared. The clone must have had
| capacitive coupling or something, since signals was often
| slightly delayed in unpredictable ways. Eg, a bit here and
| there could be shifted early or late, which is kind of bad
| when you work on protocols or timing.
| [deleted]
| redfast00 wrote:
| (author here) this is indeed a Salea clone (one of the first
| results when searching for 'logic analyzer' on Aliexpress),
| with pulseview/sigrok as software. I try to use cheap tools if
| possible, so it's more accessible for other people to
| reproduce.
| irsagent wrote:
| It's impressive that a set-top box can be turned into a Linux
| Computer. I feel with such a reality like that any device can
| electronic device, if it has the right compents can run linux,
| like how Doom is used as the base case.
| emsixteen wrote:
| Very cool, I wish I could do this sort of thing.
| trevithick wrote:
| Same here. I appreciate the projects like OpenWRT that make
| this kind of thing possible for mere mortals like me. I flashed
| OpenWRT onto an old Verizon combo DSL modem/router[0] and now
| it's a VPN endpoint. I think the most complicated part was
| uploading the initial firmware via TFTP. But it looks like you
| can now just use the web interface, so it's even easier. Props
| to the people who figure this stuff out and make it available.
|
| [0] https://openwrt.org/toh/actiontec/gt784wnv
| qbasic_forever wrote:
| Bootlin's embedded Linux class is fantastic and will teach you
| how to do all of this--uboot setup, building a kernel and root
| fs, etc. All of the materials for the class are free downloads
| so if you're motivated you can read the slides and follow it
| all yourself. I highly recommend it:
| https://bootlin.com/training/embedded-linux/
| larodi wrote:
| I love this article so much for some u known reason. Hacking
| should be praised! Amen
| pizzaknife wrote:
| yes but have you ported doom to it's hand held controller?
| donatj wrote:
| I find "set-top" a funny leftover term from the age of CRTs.
| There's no way to set anything on top of TV's these days. My
| Kinect is still teetering atop it, but even that seems
| precarious.
| death916 wrote:
| Really interesting writeup. Might be fun to try something similar
| with some old devices I have.
| moremetadata wrote:
| Its on my bucket list of things to do, because here in the UK
| there are plenty of TalkTalk Youview (Huewei DN372T) TV boxes
| with 320GB hard drives that overheat and hang with the last
| official update from Youview and despite asking there is no way
| to revert these back.
|
| However with so many being available on Ebay et al and the HD-
| less (DN360T) forcing people onto streaming services, I think
| its only right to reprovision these to work in a hive networked
| manner with external storage so people can store as much
| broadcast footage as they have storage for, and stream from any
| device.
|
| Being an early adopter of Media Portal over a decade ago, but
| finding it impossible to secure windows even back then despite
| only using it for satellite transmissions, I think Linux should
| receive more attention now.
| desimafiamanish wrote:
| [flagged]
| squarefoot wrote:
| Very interesting writeup, bookmarked! I wish there was a
| community willing to reverse engineer those very cheap DVR/NVR
| video surveillance boxes and boards sold on Ebay and Aliexpress.
| They have USB, SATA, some GPIOs and quite fast ADC chips on board
| to achieve high definition video sampling so they could be
| repurposed for various uses like SDR. They already run Linux
| inside, although it is predictably tight closed, not updated
| security-wise and often phones home to Chinese servers, so
| reverse engineering them would be worth beyond mere hacking.
|
| Here's one of these boards, just search for "ahd dvr board".
|
| https://www.aliexpress.us/item/3256804455950963.html
| detrites wrote:
| Do you happen to know other spec's on these or similar? (Eg,
| CPU type/speed, RAM etc)
| xwdv wrote:
| I struggle to think of what purpose a device that wasn't meant to
| be a Linux computer would realistically serve beyond nefarious
| goals.
| pjc50 wrote:
| Running Linux is the goal. It might be useful if you want to
| drive a TV, say. And of course, since it already runs Android,
| it's pretty close to "intended to run Linux" to start with.
| hakube wrote:
| less e-waste. If you cared enough about our planet, you'll know
| that
| felipesoc wrote:
| I have an android TV using armbian with a nextcloud instance,
| transmission, pydownloader, radarr and sonarr. I have another
| running a quake 3 server. They are cheap raspberry pi
| alternatives with a nice case and a very good power supply
| using 12v instead of 5v, which is more stable.
| severine wrote:
| Vey interesting, does the remote also work? How do you asses
| Linux compatibility of those boxes?
| felipesoc wrote:
| I just look for ones with a rk322x chip and use this image:
|
| https://forum.armbian.com/topic/12656-csc-armbian-for-
| rk322x...
| no_time wrote:
| On the contrary, I struggle to think of "nefarious" goals.
| jeroenhd wrote:
| Many of these SBCs are programmed in stupid ways. For
| example, there was a whole subforum on a popular Dutch site
| that was shut down because it turned out the way ISPs make
| you pay for premium channels is to... not encrypt them in any
| special way and hide them in the front end. This was all
| configured through a JSON file over an unencrypted protocol.
| The whole project began because people wanted to record their
| shows onto the disabled USB drive, and ended up exposing
| trivial ways to get around subscription limitations.
|
| People immediately MitM'd these devices to get unlimited free
| bonus stuff, and the forum was copyright struck to hell.
|
| These devices are programmed so badly that once you give any
| user any modicum of control over them, you can bypass almost
| every restriction your TV provider can think of. Modify one
| or two files and you've got an excellent piracy box.
|
| Personally, I think this whole situation is terrible and I
| think that it's up to providers to fix their shitty DRM, but
| legally speaking these boxes don't become your property.
| bornfreddy wrote:
| Do you have the name of the forum maybe?
| BoatyPrint wrote:
| Plenty of applications for a Linux box that aren't "nefarious".
| Maybe digital signage, or backup server, to name two.
| ilyt wrote:
| ...to not have to throw it into a landfill ? How's that not
| natural conclusion to you ? It's in the title of article...
| hbossy wrote:
| Getting a cheap NAS.
| rbanffy wrote:
| Or, if you manage to get a dozen, it can become an
| educational cluster where students can get hands-on
| experience with managing computer clusters.
| theodric wrote:
| Entirely correct, although I question the value of
| investing time with such a goal in mind when ex-corp
| laptops, desktops, and thin clients are available,
| inexpensive, likely more powerful, and require no
| hackarounds to be serviceable Linux systems. I feel an
| effort like this should be enjoyed for its hack value,
| rather than for any potential practical purposes.
| rbanffy wrote:
| If you get one model up and runnning, getting a couple
| dozen of them up and running is easy. 2GB and 4 cores per
| node is not too shabby either. My last Pi-based cluster
| has Pi Zero's as nodes, with single puny core with a very
| minimal 512MB per node.
| dsr_ wrote:
| I don't know about supported video playback capabilities, but
| being a settop box under your own control is pretty good by
| itself. It can play back music, video, do light desktop duty --
| any place you just need one or two browser tabs, it will
| probably work.
| tenebrisalietum wrote:
| This is an ethically neutral activity. The mere act of
| transforming a device into such a computer doesn't add or
| remove any nefarious goals, if you have those goals, you can
| get another device intended to be a Linux computer and still
| accomplish them (and it would be much easier). If the
| transformation is done in contravention of the owner, it's bad,
| but it sounds like from the article that the ISP has written it
| off and in any case, they say they are doing this
| nondestructively.
| jrm4 wrote:
| I'd argue 100% ethically positive; it's the sprinkling of
| unnecessary devices by companies that's the negative.
| redfast00 wrote:
| (author here) We use the device instead of a Raspberry Pi, not
| for anything too serious: we attached it to a screen and have a
| small server running with an API where you can write single
| pixels into the framebuffer (a bit like /r/place)
| joezydeco wrote:
| Ironically, the Raspberry Pi started as a failed set-top box.
| rbanffy wrote:
| I always thought that SoC was wildly popular.
| joezydeco wrote:
| It is, because Broadcom had a surplus of them and
| couldn't get anyone to adopt it for a streaming device.
| So an enterprising Broadcom FAE decided to turn it into
| an "educational" Linux desktop device.
|
| The "wildly popular" part came when people realized BRCM
| was dumping these boards cheaper than any existing Linux
| SBC at the time. The educational angle is long gone.
| rootbear wrote:
| The educational angle is far from gone. The Raspberry Pi
| Foundation handles that part of it now.
|
| https://www.raspberrypi.org
|
| I would agree that most of the Pis sold are not used for
| education, but that doesn't diminish their importance in
| that area.
| Symbiote wrote:
| The education part continues. Raspberry Pi continue to
| make teaching materials, run training etc. I think the
| focus is the UK.
| rbanffy wrote:
| Pretty much any device like these (as well as most modern TVs
| with network ports) can probably be turned into computers or,
| at least, X terminals.
___________________________________________________________________
(page generated 2023-02-14 23:00 UTC)