Vizio D32f tv -> embedded linux device

[rival villager]

I like attaching RaspberryPis to TVs to make them do different kinds of kiosk things. Pis are impossible to find, and pretty much all of our smart TVs are a) already running Linux and b) more than capable of doing more or less what a Pi can do. Hot gluing an SBC onto an already embedded linux computer - just to join them with an HDMI cable - seems like a huge waste of perfectly usable hardware.

 

However, I've run out of ideas how to get into the Linux part of this Vizio "smart" TV. Suggestions of what to do next, where to go looking, or if other brands are perhaps easier to deal with are welcome.

 

thanks!

 

Here's what I do have:

 

* Full serial (UART) console output via a BusPirate, with lots and lots of output.

* The CPU is a Mediatek 5583, which is likely just a variant of the 558x made for Vizio? and running an ubuntu-like Linux distro.

* onboard storage is 4GB of HS400 eMMC

* bootloader is U-Boot 2011.06

* the firmware updater file downloaded from Vizio. the binary blob file looks like two sections: first is a JWT and then what seems like the actual firmware - encrypted. I assume encrypted because the entire remainder of the ~530MB looks like noise.

 

Here's what I know from reading the console output:

 

* As U-Boot does, the first thing it does is gets moved to RAM. It then reads some basic configuration from EEPROM (somewhere) getting the network MAC address (seems to be set in software rather than burned into the hardware) and then immediately disables the UART input:

 

!!!! enable_uart_rx=[0] !!!!
Disable UART
In:    serial
Out:   serial
Err:   serial

 

* a USB flash drive will be automatically mounted if present, and uboot(?) will look for several files like MstarUpgrade.bin, SbootUpgrade.bin, MbootUpgrade.bin, and UrsaUpgrade.bin.

* during normal operation, the USB flash drive is mounted at /mnt/usb/sda1.

* the custom ubuntu is called "ViziOS" and is version 1.3.432.468.0

* there is a shell and/or busy box available, but it's not accessible because the UART rx is disabled

* an external keyboard (at least the only Mac keyboard I have around here) seems to be recognized as a present USB device, but is almost always otherwise ignored - it can sometimes be used for input

* command injection by using backticks around the wireless network name does _not_ appear to have any effect in this version of the firmware, although it was apparently possible in older versions

* Likewise, vulnerabilities around https://<ip_address>:7345/scpl/ don't seem to be present anymore

* Despite being factory reset and never connected to Netflix ever, since I won't let the tv connect to the internet (it will automatically upgrade the firmware), it (internally) loses its mind because it can't send telemetry to Netflix. That's another big reason I'm not at all satisfied to just "throw a chromecast/etc onto an HDMI port and be done with it" - I want to turn off all the telemetry crap.

* There are a couple of "secretKey" messages that might be interesting/useful, but I don't know what to do with them

 

[SECRETKEY DBG]in func:getSecretKey line:94 strModelName=Vizio_D32f-J04
[SECRETKEY DBG]out func:getSecretKey line:104 (hashed)strKey=dcaa76a2 strKey.length()=48

 

* When there is no USB drive present, the following network ports are listening:

 

7345/tcp 
8005/tcp
9223/tcp
56789/tcp
56790/tcp

 

* However, when the drive is removed, 36675/tcp is also listening.

* Lastly, there's old firmware sourcecode on github, but honestly I have no idea what to do with it or if I even could.

 

There is no obviously accessible EEPROM on the board. I suspect that it's probably part of the SOC. Both the eMMC and the SOC are BGA chips, so there's no way to probe them directly even if I understood how to do such a thing.