Sony Android TV Users

[Dior DNA]

Recently i also purchase the sony android TV and its performance is good.

Same here, but uptime is constantly high because of aud_cpupost.

BRAVIA_VH2:/ $ uptime
 14:01:12 up 11:56,  0 users,  load average: 42.80, 42.77, 42.74


BRAVIA_VH2:/ $ top | egrep '(USER|aud_cpupost)'                                                                       
  PID USER         PR  NI VIRT  RES  SHR S[%CPU] %MEM     TIME+ ARGS                                                       
 3428 root         20   0  51M 3.4M 1.3M S 24.1   0.1 188:16.98 aud_cpupost

 

[hackwerk]

I read it here, but my English is pretty lousy, can anyone please tell me if I can root on the Sony Bravia XR-50X93J?
Thank you

See my 'BIG post' (page 85) with all paths we need to explore to finally root our Sony's!

Hi. I'm attempting to flash my x900h via fastboot. Getvar all says the bootloader is unlocked. Don't know how but it is. I want to try to downgrade it from android 10 to 9. Don't know it's a good idea. I've extracted flash images from payload.bin. I've attached the photo of what I've got. I don't know exact flash order. Maybe someone can help me with flash order and commands?

Getvar all freezes my tv. However some other getvars do work. Btw: I have to hard reboot (unplug) the tv to get out of fastboot.
Where did you get payload.bin!?
I would love to be able to have bins from a Sony firmware package encrypted) PKG, or from my current setup! (see my BIG post, point 2.2)
Keep us posted if you success, and if you find a root way.

 

[coolek33]

It's in update zip downloaded from sony site.

 

[hackwerk]

It's in update zip downloaded from sony site.

I see yes. You are so lucky. Our models still contain an encrypted PKG file instead of a zip/bins.

 

[coolek33]

Is there any way to get to fastboot mode without booting from system with adb? Maybe some power cord and button combo? I have only 1 button on my xh90.

 

[hackwerk]

Is there any way to get to fastboot mode without booting from system with adb? Maybe some power cord and button combo? I have only 1 button on my xh90.

Yes you can. I remember someone doing it by either holding one or more buttons on the back of the TV (maybe Power and +) and then plugging the tv back into power, OR holding keys on the remote while plugging tv back into power.
'Normal' phone Androids always want either Volume + and/or - being held while powering on.

WARNING: Power and - means a factory reset says Sony.

However, why wouldnt you do it with 'adb reboot bootloader' with a USB connection or over the air (with adb connect)?!

 

[coolek33]

My tv has only power button. I wanted to boot to bootloader cause it was bricked. I've flashed it with fastboot to downgrade. But then it was stuck on "updating" screen. Maybe if I could boot to bootloader I could fix it. Anyways sony fixed it for me

 

[hackwerk]

My tv has only power button. I wanted to boot to bootloader cause it was bricked. I've flashed it with fastboot to downgrade. But then it was stuck on "updating" screen. Maybe if I could boot to bootloader I could fix it. Anyways sony fixed it for me

Sony did? How?!

 

[coolek33]

Main board replacement under warranty

 

[lcsboy]

Same here, but uptime is constantly high because of aud_cpupost.

BRAVIA_VH2:/ $ uptime
 14:01:12 up 11:56,  0 users,  load average: 42.80, 42.77, 42.74


BRAVIA_VH2:/ $ top | egrep '(USER|aud_cpupost)'                                                                      
  PID USER         PR  NI VIRT  RES  SHR S[%CPU] %MEM     TIME+ ARGS                                                      
 3428 root         20   0  51M 3.4M 1.3M S 24.1   0.1 188:16.98 aud_cpupost

Hi DNA,

Are you the same 65" Sony TV? My model is also showed Bravia VH2.

Do you know how to root?

I tried Kingo Root, but it doesn't work.

 

[Dior DNA]

Hi DNA,

Are you the same 65" Sony TV? My model is also showed Bravia VH2.

Do you know how to root?

I tried Kingo Root, but it doesn't work.

mine is 55" and, no, I did not root it

 

[lcsboy]

Could some one know how to root Android 10 for Sony TV?

 

[matrox72]

Hi,

Does anyone know whether Sony ever would upgrade to Android 8 on KD-65XD8505? Mine is produced in April 2016. If I am not mistaken (reading from Sony support page), it received last fw update v5.457 in April 2021, which if I get it correctly brought along Android 7.

Talked to local Sony dealer here who was doubtful, believing that newer android simply would not fit in memory. Newer android would be helpful as my tv service provider offers an app which supports Android 8 or higher....

 

[hackwerk]

Hi,

Does anyone know whether Sony ever would upgrade to Android 8 on KD-65XD8505? Mine is produced in April 2016. If I am not mistaken (reading from Sony support page), it received last fw update v5.457 in April 2021, which if I get it correctly brought along Android 7.

Talked to local Sony dealer here who was doubtful, believing that newer android simply would not fit in memory. Newer android would be helpful as my tv service provider offers an app which supports Android 8 or higher....

As I already stated/asked in my 'big post' on page 85 ('part 1'), me too am really wanting to finally get this update, as DID the rest of the world! So strange 3/4 of the world with this exact tv already received it.
I get more and more Android apps that stop supporting ATV 7.0

I mailed Sony about it 2 months ago, and they answered:

"With reference to your enquiry regarding your Sony KD-55X8505C, we are sorry to learn about your frustration that Android 8 is not available for your TV yet.
We would like to explain that, unfortunately, we do not have communication regarding whether or not or when the update will be available in Europe. However, we recommend bookmarking the following page and checking it regularly for updates on this matter:
https://www.sony.co.uk/electronics/...ectors-lcd-tvs-android-/kd-55x8505c/downloads "

 

[matrox72]

As I already stated/asked in my 'big post' on page 85 ('part 1'), me too am really wanting to finally get this update, as DID the rest of the world! So strange 3/4 of the world with this exact tv already received it.
I get more and more Android apps that stop supporting ATV 7.0

I mailed Sony about it 2 months ago, and they answered:

"With reference to your enquiry regarding your Sony KD-55X8505C, we are sorry to learn about your frustration that Android 8 is not available for your TV yet.
We would like to explain that, unfortunately, we do not have communication regarding whether or not or when the update will be available in Europe. However, we recommend bookmarking the following page and checking it regularly for updates on this matter:
https://www.sony.co.uk/electronics/...ectors-lcd-tvs-android-/kd-55x8505c/downloads "

Thanks, it kind of sounds like it may come. Also, if the rest of the world has it, could a manual flashing work or it would brick the TV?

 

[hackwerk]

Thanks, it kind of sounds like it may come. Also, if the rest of the world has it, could a manual flashing work or it would brick the TV?

If you read my post, then you will realise that that is exactly my question (1.2/1.1).

 

[ff_rookie]

Sony Bravia 4K 2015 (KD-55X8505C EU)​

(Types/model explained: KD=TV,55=inch,X=premium,8=model,5=submodel,05=localdesign,C=2015)

WARNING: Everything is AT YOUR OWN RISK (as you may brick / destroy a good TV)!

Hi guys/gals,
I am still using this Android TV 7.0 by Sony (Bravia), and have lots of info, but even more questions still, most important being:
Part 1) Can I install the newest international (US/Asia) firmware (6.827 - Android 8.0) instead of our much older lame EU one (5.457 - Android 7.0)? Same hardware thus compatible or??
Part 2) Can we (temp) root it, and/or unlock bootloader, and/or install Magisk or any other custom images? Can I downgrade / revert back to older firmwares (to make it weaker to root)?

A lot of info can be found via the links (like the BeoBuild Vision & SmartTVHacking) and in the attached files from my TV.
ADB can be connected remotely, by first enabling Developer Options & USB Debugging, and using the IP of your TV in the command: adb connect [IP]


Part 1
I am still running 5.435 because it may be weaker. It would also may be able to downgrade, to re-enable some holes/weaknesses (see 2).
I would love to upgrade to Oreo (8.0) like everyone in the world with this TV except Europe.
Is it possible by;
1.1) Altering the firmware of Sony (see 2.2) or the download method by changing the IP by local DNS etc.?
1.2) Changing the TV region/settings/specs so it fits (see Service Menu)? Is the hardware exactly the same as Asia or US or is this dangerous?!

Part 2
2.1) Can we unlock the bootloader? I can boot to fastboot, but did not dare to try. There is no OEM Unlock option in Developers Options in Android.
Btw: A 'getvar all' in fastboot will give the partitions and then crash. A hard reboot is needed and then a 'fastboot reboot'.
2.2) Can we extract (or even package) the firmware (PKG = EPK?) files given to us by Sony? Binwalker seems to give us some but it seems you need a specific (unknown?) key to extract all, or to (re)package. For some other device types there are hacktools to extract firmwares by Sony, epk2extract by OpenLGtv or the older fork, pk2extract by p0isk (for same chipsetted HiSense, LG, Philips etc.)!
2.3) Is any of the hardware vulnerable? Like the MediaTek MT5890 (= MT5595 = ATV1) or Bluetooth chip/stack (using BlueBorne etc.)?
2.4) Can we use the serial method (RS-232C) using the mini jack (or VGA port) to connect and do some stuff?
2.5) Is Google (Chrome)Cast (this old 1.56.275391) vulnerable, or usable to do malicious stuff? Ports 8008, 8009, 8443 and 9000 are open. Maybe with altered sploits like HubCap or FlashCast etc (Team Eureka & fail0verflow & GTVHacker)? We can influence it anyways by using tools like pychromecast etc.
2.6) Are Sony's own systems for streaming and remote connection vulnerable? See Links for Control by Serial/IP/HTML5.
2.7) Are any of the preinstalled apps vulnerable, like Vewd browser (see links!) or any lib (see links!) etc.?
2.8) Does any of the closed source one click rooters (KingRoot/KingoRoot/One Click Root/Root Genius etc. etc.) work?
I will never try and do not trust rooters! It was mentioned that King or Kingo works by some users (own risk!).
2.9a) Is the so called TVoodoo attack by Valerio Mulas (using a Rubber Ducky / Remote IR spoofer) a valid one, or just a fun idea to use ADB etc?
2.9b) Can we use hidden/secret/extra IR codes (non official) to do stuff? In other words, which keys of the IR matrix are mapped or on any official remotes, and which ones are ALSO received/interpreted/useful?
2.10) Was the port 12345 (now closed) attack Nimue possible on our TV with older firmwares (seems only up to 2012)? And universals like Framaroot? Towelroot? BlueBorne? Etc?
2.11) Is the p0isk kernel to any use for us/me?
2.12) Can we use exploits like within Metasploit? Any vulns/exploits for Android in general? Like the mp4 HEVC-fright PoC (CVE-2019-2107) or Janus PoC (CVE-2017-13156)(with ie unsigned AmazonVideo.apk) or any User-After-Free (UAF)? Must be, with such old hardware and software a few years old!?
2.13) Injection/escalation possible using the Sony Channel Editor software or 3rd party ChanSort or SDBeditor etc? I remember another (Sony?) to be vulnerable to injection of chars/code into the channel list (sdb.xml) or so when (re-)importing to the TV (in Android or in Service Menu!)?


Service / Secret / Diagnostics Menu
Diagnostics menu: TV is off, then press in this order: i+ (or DISPLAY) > 5 > Volume DOWN > Power (on)
Service menu: TV is off, then press in this order: i+ (or DISPLAY) > 5 > Volume UP > Power (on)
Use numbers 1 and 4 to select item to adjust, and numbers 3 and 6 to adjust item (8 + 0/Enter will restore factory defaults). Then use Mute + 0/Enter to save (word Write will appear). Then turn TV off.

Other ATV with similar hardware
Bang & Olufsen BeoVision Horizon-40 (QM153E / bno_MT5593Uplus_EU)
HiSense (Vidaa TV)
Philips (and this one)
Sony Bravia (KD/KDL)
??? (you tell me!)

Links
BeoBuild Vision Hackathon by Labitat with lots of info (MT5890 ? MT5593)
WordPress - SmartTVHacking KDL-48R510C with MT5565 (? MT5880)(nice try, lots of info!)
XDA - Rooting MediaTek Based Linux Smart TV
XDA - Root on a Sony 65X8500G (via this very interesting Chinese post on Baidu)
TVoodoo attack by Valerio Mulas
AskVG - Service and Secret Menus
-
Sony - API/Dev info for Control by Serial/IP/HTML5
Sony - Source Codes for Devs (this/my KDL) !!!
Comprehensive List of Bravia Firmwares (via Bravia on Reddit)
-
GitHub - p0isk Kernel
GitHub - p0isk pkg2extract
-
ZeroDayInitiative - Vewd (browser < 4.11) sploit #1 (Pwn2Own)(test/find sploits in the Vewd Emulator 4.10 or 4.13 in VM?)(CVE-2017-5030 PoC by Brendon Tiszka etc.)
ZeroDayInitiative - Vewd (browser < 4.11) sploit #2 (Pwn2Own)
GitHub - Team Eureka Google Chromecast (dongle) sploits

A Chinese developer had posted a exp which could root Bravia with Android 8. (https://github.com/LIznzn/CVE-2019-2215) it did't work for my x9000h with Android 10. But I hope that's helpful for you.

 

[hackwerk]

A Chinese developer had posted a exp which could root Bravia with Android 8. (https://github.com/LIznzn/CVE-2019-2215) it did't work for my x9000h with Android 10. But I hope that's helpful for you.

Very nice! I already stated (2.12) that UAF (CVE 2019-2215) could be the way.
This specific UAF by Llznzn may be our holy grail. The bug was fixed 2019-10 and my tv is still on the older firmware (2019-05) and not newest.
I will post any results asap. I am not a programmer, but it may be needed to find other specific offset. Hope someone could help if needed.

Thanks for spotting!

 

[VerizonLover]

So I just ordered a 50x90j that is going to be here today.

I have a few question before it arrives:

1. Does anybody think they'll add the PiP feature like all other Android TVs have?
2. Is it possible to remove the ads from the home screen?
3. What is the best sideload launcher?

Coming from an LG 40j7700.

 

[hackwerk]

So I just ordered a 50x90j that is going to be here today.

I have a few question before it arrives:

1. Does anybody think they'll add the PiP feature like all other Android TVs have?
2. Is it possible to remove the ads from the home screen?
3. What is the best sideload launcher?

Coming from an LG 40j7700.

1. Why would that be not possible? Lots of Bravia can do it as you can find everywhere on YouTube and Google? And on specs pages like this one.
Btw: On many televisions like Samsung and Sony, there is a secret service mode, in which you can enable PiP/PoP. See my 'big post' section Service Menu.

2. You may root the tv, and then use AdAway or DNS services with ad-DNS blocking like this or this. Or put those DNS services in your home router/modem to block them all in your home network.
Second thing is to remove all the bloatware by (wireless) adb by hand or with any of the scripts like this and this. And dont forget to disable the Sony Shelf etc. And keep HOME button long pressed on any app shortcut to replace/remove it.