Flash Now TV Box with Roku LT firmware?

Hi, not much help, but I was wondering the same thing, I have picked one of those up and would certainly like to turn it into a fully fledged Roku box.

I can understand why Sky have limited the box, but the amount of limit they have put on is a bit bad, the only way to install unofficial channels is as a zip, and I cannot find many zip files across the internet ?

Anybody have an sources for them ? Or anybody tried flashing this ? Does anybody have an official Roku that they could try and backup the firmware from, or is it somehow linked to the box ?

---------- Post added at 10:30 AM ---------- Previous post was at 10:26 AM ----------

The other option may be a proxy which provides the official lt firmware as an update instead of the now tv one ?

I too am playing with this box. Plex is set up but I have encountered a snag when installing plex onto my lmited NAS.

So am too wondering if this can be flashed or what other apps are available as Zips to sideload?

Also wandering the exact same thing! Just got mine ordered today. It would be great to get it to be just like the normal roku as it sounds like they've limited the apps for it quite a bit.
Hopefully someone can figure this out!

NOWTV Developer access gone?

I have just got the NOWTV box and have tried to get developer access - so i set it up on thenow tv box and it told me it was enabling developer mode.
However i cannot access the developer webservice from pc browser and even ping won't detect the NowTV device.

I got it in the 1st August and it immediately updated itself - i wonder if they have removed this developer access page.

Anyone any ideas?

pknut said:

I have just got the NOWTV box and have tried to get developer access - so i set it up on thenow tv box and it told me it was enabling developer mode.
However i cannot access the developer webservice from pc browser and even ping won't detect the NowTV device.

I got it in the 1st August and it immediately updated itself - i wonder if they have removed this developer access page.

Anyone any ideas?

Click to expand...

Click to collapse

just installed mine got plex on before I put the net in due to your post lol however the update does not kill dev mode

I got Plex on through the developer interface no problem, but I've not found many other apps out there available as source, so this method won't be very useful if you want things like Netflix, etc.

I've had a play about with the settings in the other secret menu (home x5, FF x3, RW x2) letting you change the channel store server and the software update server. The software update server can change from beta to release, but both just reinstall the same version. Changing the channel store server gives you 4 or 5 options, but only the main one actually work, the rest just return an error when you try to access the store, and in some cases the channels vanish from your home screen, so this wasn't helpful either.

What's worth mentioning is that, with traditional Roku LT boxes, you'd get a "link code" that you'd enter on the Roku website that lets you send channels from their website to the box, among other things. This NOW TV box didn't offer that code at all.

One last thing, in that secret menu I mentioned before. At the bottom of the info dump on the left, it ends with Uptime in minutes, followed by "unregistered". I'm curious what this means. Could be something to do with the Now TV subscription, not sure. If anyone has a NOW TV subscription, could you see if this says "registered" or something else?

Nope

bobmarleypeople said:

One last thing, in that secret menu I mentioned before. At the bottom of the info dump on the left, it ends with Uptime in minutes, followed by "unregistered". I'm curious what this means. Could be something to do with the Now TV subscription, not sure. If anyone has a NOW TV subscription, could you see if this says "registered" or something else?

Click to expand...

Click to collapse

I'm afraid not, I have a now TV package and it still shows as 'unregistered'. I suspect this is where it would say registered if the Roku box was linked to the Roku website, but as theres no link code... :/

furblefox said:

I'm afraid not, I have a now TV package and it still shows as 'unregistered'. I suspect this is where it would say registered if the Roku box was linked to the Roku website, but as theres no link code... :/

Click to expand...

Click to collapse

Thanks a lot. If you're right, I'm wondering if the capability to generate and display a link code is still available on the device, only hidden. If there is, there may be a way to get the online store to send non-Sky-authorised channels onto the box without the need to change the firmware. Sadly, I wouldn't be surprised if the function to generate said code is hidden away from 3rd party channels. I'll keep having a play.

Now I don't own one, but if we can get this sorted I will be picking up a few.

Has anyone looked to see where the device tries to pull its updates from?
We could spoof a local server to delivery a standard Roku LT firmware to it instead. It see an update it does its install and bang. £10 Roku LT box.

Here is some info I found relating to the ROKU Netflix Branded box, sounds like a similar sort of affair.

http://www.cs.cmu.edu/~ecc/roku-nfp.html

A Signing key is needed. Not that this is a complete dead end, im sure that something can be hacked into place here. Its just a matter of the right people getting hold of the hardware. We can already run executables. Do executables not have the rights to 'root' the box?

I know fudge all about Roku development, so dont shoot me down in flames please.

Sci.

[Edit: This guy wanted to 'change the firmware' - if we use this method with official firmware, maybe the key is the same and it would work?]

You can register a new account on the first form page of buying and simply close the second page asking for payment details.

Some anonymous Roku dev might be able to release a sideloadable Roku OS for this box?

I've been trying to hack the communication between the nowtv box and its servers using a mix of redirection on the firewall and burpsuite; like others I want to see if I block sw updates and then get it to download standard Roku firmware.

speculatrix said:

I've been trying to hack the communication between the nowtv box and its servers using a mix of redirection on the firewall and burpsuite; like others I want to see if I block sw updates and then get it to download standard Roku firmware.

Click to expand...

Click to collapse

No luck I'm guessing yet then?
Have you discovered anything that could be handy for others attempting this?

Good luck btw!

Looking at the PCB, it seems that it is a depopulated board, its all marked out for the USB and everything else that is removed (see images below, sorry not my images). Though it does like its more than just the USB connection, it looks like some SM resistors and other bits are missing as well

ROKU LT board



NowTV Board



Close up of USB area

Where do I start...

With regard to tricking the LT firmware onto it (which was my plan) this does appear to be a no-go.

It makes an HTTPS request out to Roku for what I imagine is some kind of manifest/xml which dictates what the latest firmware is and some kind of hash to verify it.
The box will then download the firmware over HTTP (yay I thought..) so dnsmasq to the ready I renamed the LT (aka giga/024) image, it downloads it but fails to verify (error 006).

The firmware images themselves still require a lot of investigation, uboot and a kernel are in there plain (as you would expect) but the main filesystem is still to be found - after routing through the GPL pages it would appear to still be cramfs with different magic, but even then this isn't visible in the firmware so most probably encrypted.

(#define CRAMFS_MAGIC 0x28cd3d47 /* cramfs as modified by Roku */)

Encrypted by what?
Again judging by the roku GPL source, they store a 16byte aes key within the Broadcom Videocore - I can't envisage this being easy to recover without userland access.

(static unsigned char aes_k[16];
vc_otp_read(46, 4, aes_k)

Random Info:
Windsor does appear to be the codename for this box (makes sense for a british product I guess), other code names are giga, paolo, jackson and austin.
Mapping them out is not so straight forward though, the below is likely wrong:

ID -- Codename -- Model
024 giga Roku LT
025 ??
034 paolo ??
045 austin Roku 3
??? jackson ??

Failed Ideas:
MITM (SSL is validated - as you'd expect)
Firmware Interception/Replacement
thttpd exploits

Ideas Still to Look into:
Generate SSL certificate with "api.qa-uat.roku" as a subject alternative name, cycle channel store server to that and see what we can see.
libzip exploit (dev package upload - possibly too much hard work tbh, would need to know the target binary well)
There is a 20 pin arm jtag header exposed on the board...

legend474 said:

Already known that you can side load the Plex app for the Roku, but most people would wonder if someone can flash Roku firmware on this.

Click to expand...

Click to collapse

You can also sideload the MediaBrowser3 plugin for Roku.

See here if you're interested.

Maybe writing a Roku plugin/app that loads immediately upon start up and blocks the channel to Roku or similar constant/var place holders to stop the firmware update?

I found the thread on HUKD where someone had managed to break updates:

http://www.hotukdeals.com/deals/now-tv-box-10-inc-1615409?page=43#post18690920