vizio app hacks

Search This thread

ang1dust

Senior Member
Oct 1, 2009
386
27
Anyone know if XDA will be opening hacking for some of the new tv's with apps built in? Or if anyone knows of a site that supports it?
 

jaymzway

Senior Member
Mar 12, 2013
83
17
If u had wifi tethering on your phone you could share your internet to the tv but what good will it do anyways other than a over pricey netflicks n check your emails. Im ashamed of yahoo. Leaving such a nice tv just sit like a worthless tv n not invest into the market and sit back n wait for devs to come up with ideas rather than being a go getter... why????
 

DudeOfAwesome

New member
Jun 28, 2014
3
0
I just tried to enter $(reboot) in the SSID field (per the article you linked) and that seems to have failed.

It looks like Vizio has disabled execution of shell commands in an update.
 

fastvan67

Senior Member
Jan 16, 2010
72
5
I have the Vizio 701i-A3. It has whats called Yahoo apps. The apps themselves look to me like smartphone apps. I then found this site Yahoo Connected TV. Would love to be able to install XBMC/Kodi on this thing. According to the site, people can create their own apps and post them. Then log into the settings on the TV and install the app to the TV using Yahoo Apps.
 

DudeOfAwesome

New member
Jun 28, 2014
3
0
I have the Vizio 701i-A3. It has whats called Yahoo apps. The apps themselves look to me like smartphone apps. I then found this site Yahoo Connected TV. Would love to be able to install XBMC/Kodi on this thing. According to the site, people can create their own apps and post them. Then log into the settings on the TV and install the app to the TV using Yahoo Apps.

That's correct. The TV uses HTML5 technology to run the apps. It looks like it is somewhat similar to writing a browser extension.

As for porting Kodi to work on the TV, I would say that is unlikely, as Kodi is written in mostly C++, which would have to be rewritten as Javascript for the TV. If someone were to find a way to get shell access on the TV, then there is a chance you could run an Ubuntu build of Kodi.
 

extranatural

New member
Dec 18, 2015
4
2
Hidden Menu/Browser on Vizio E32-C1

I have a Vizio E32-C1 2015 that I picked up a few months ago. The Vizio e-series are a pretty good deal IMHO.

I was trying to turn it on in the dark the other day, and ended up pressing some unknown button combination as I fumbled in the dark.

The result was rather surprising, the TV turned on and revealed a gray screen (from the look of it it was an HTML form) with the title "Opera App Launcher". Below the title was an input field and a submit button. Next to the input field in parentheses was the text "(0-9)".

I was able to move from element on the page from the arrow navigation buttons on the remote.

So I entered the number '5' from my remote, and hit the submit button. After a few seconds the Vizio official website loaded up. I was able to navigate the page and browse, but couldn't find a way to return to the grey screen or enter a URL manually.

So far I've had no luck finding what button combo I entered. From searching the web I've gotten no hits about how to get into the service menu from the e-series, let alone anyone else who has encountered the "Opera App Launcher".

Has anyone else seen anything like this? I'm really eager to get low-level access to my Smart TV.
 
Last edited:

4cylndrfury

New member
Feb 25, 2016
1
1
I'm no programmer (I can write VBA macros in excel, that's the extent of my skills), but did come across an Avast article on breaking into operations in the code of Vizio smart tv's. Posting as a guest, I can't post url strings, but googling "The Anatomy of an IoT Hack - Avast Blog" will bring up their article from November 2015.

Seems like there's some insight into vizio operating systems, and ways to execute commands. It states that vizio issued an update that circumvents the vulnerabilities, but hopefully, there is still an opportunity to work out a browser app, or maybe a way to get an early android os loaded (hoping somehow to get the time Warner cable app into one of my tvs).
 
  • Like
Reactions: tinyheck

victoriaexlabore

New member
Feb 11, 2014
1
0
Chicago
I have a Vizio E32-C1 2015 that I picked up a few months ago. The Vizio e-series are a pretty good deal IMHO.

I was trying to turn it on in the dark the other day, and ended up pressing some unknown button combination as I fumbled in the dark.

The result was rather surprising, the TV turned on and revealed a gray screen (from the look of it it was an HTML form) with the title "Opera App Launcher". Below the title was an input field and a submit button. Next to the input field in parentheses was the text "(0-9)".

I was able to move from element on the page from the arrow navigation buttons on the remote.

So I entered the number '5' from my remote, and hit the submit button. After a few seconds the Vizio official website loaded up. I was able to navigate the page and browse, but couldn't find a way to return to the grey screen or enter a URL manually.

So far I've had no luck finding what button combo I entered. From searching the web I've gotten no hits about how to get into the service menu from the e-series, let alone anyone else who has encountered the "Opera App Launcher".

Has anyone else seen anything like this? I'm really eager to get low-level access to my Smart TV.

Interesting. From what I can tell, if someone could get a distribution of the Firefox OS TV, we could theoretically flash the Vizio TV to this instead of its current OS. The two seem built on similar architectures, since they are less an OS and more of a browser with apps that you can download built as an OS using JavaScript. I could see the lightweight Firefox OS for TV working on older E-Series Vizio models. The problem from what everyone is saying is that it's near impossible to do, which is unfortunate considering the garbage Yahoo OS that is currently installed.
 
Last edited:

extranatural

New member
Dec 18, 2015
4
2
Interesting. From what I can tell, if someone could get a distribution of the Firefox OS TV, we could theoretically flash the Vizio TV to this instead of its current OS. The two seem built on similar architectures, since they are less an OS and more of a browser with apps that you can download built as an OS using JavaScript. I could see the lightweight Firefox OS for TV working on older E-Series Vizio models. The problem from what everyone is saying is that it's near impossible to do, which is unfortunate considering the garbage Yahoo OS that is currently installed.

So there isn't a Yahoo operating system running on the Vizio per se. Yahoo's app is more of an package manager / app store for apps written in Javascript. What's important to understand it that whole thing is in turn appears to be running some variant of Linux.

A quick nmap of the TV's ip address revealed that it's running a Linux kernel underneath it all:

Code:
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5

Trouble is they've done a good job of locking down the TV, I've not found any open ports to exploit, nor any keyboard commands to give me a bash session. If someone wants to totally replace the OS, they'd almost certainly need to remove the back of the TV, and probe the SoC trying to find a way of directly flashing the integrated circuit.
 

edglenn

New member
Apr 5, 2016
1
0
I'm impressed with this thread. I was looking for a browser app for my Visio E55-C1. I'm amazed that a simple on-board browser isn't available for this tv. I'll have to connect a regular PC to it for now, but what a waste of a tv!
I'm truly surprised that Visio doesn't have an app for browsing, along with their other available apps. Can't imagine why they would intentionally block this feature...
 

lvtbowman

New member
May 5, 2016
1
0
I have a Vizio with the V.I.A (Vizio Internet Apps) Plus. I was wondering how do I download other apps onto my tv that aren't there? I was hoping to download a code converter. Anyone?
 

toptrailer

New member
Aug 3, 2016
1
0
I scan ports with netmaster on my Iphone 5s on my Vizio m55-c2 and I received this message: 8 open ports !!!
port 111 sun remote procedure call
port 1234 - 7892 - 8099 unknown port type
port 52113 - 56789 - 56790 - 65528 private/dynamic port
 

ben63vw

Senior Member
Oct 2, 2010
204
58
With VIA Plus just use Plex app to stream all your media content from your pc/mac or even a nas. It plays dam near every media format out there. And for about $60 just get a "Raspberry Pi 3" (search it on Amazon). For that price you'll get a case, micro sd, power cord (but can be powered by tvs usb port) & hdmi cable. There are images readily available that it runs many distros of linux with some of them customized with Kodi/xbmc pre installed. It's small and can just be attached to the back of any tv (no clutter) & it has built in wifi. DONE... now you can browse to your hearts content.
 

ltagliamonte

New member
Nov 20, 2016
1
1
For what is worth today i used nmap on my vizio M60-C3 and i discovered the following open ports:
Code:
nmap -v -A 192.168.1.16

Starting Nmap 7.31 ( https://nmap.org ) at 2016-11-20 12:48 PST
NSE: Loaded 142 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 12:48
Completed NSE at 12:48, 0.00s elapsed
Initiating NSE at 12:48
Completed NSE at 12:48, 0.00s elapsed
Initiating Ping Scan at 12:48
Scanning 192.168.1.16 [2 ports]
Completed Ping Scan at 12:48, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:48
Completed Parallel DNS resolution of 1 host. at 12:48, 0.01s elapsed
Initiating Connect Scan at 12:48
Scanning 192.168.1.16 [1000 ports]
Discovered open port 111/tcp on 192.168.1.16
Discovered open port 1234/tcp on 192.168.1.16
Completed Connect Scan at 12:48, 0.15s elapsed (1000 total ports)
Initiating Service scan at 12:48
Scanning 2 services on 192.168.1.16
Completed Service scan at 12:48, 6.01s elapsed (2 services on 1 host)
NSE: Script scanning 192.168.1.16.
Initiating NSE at 12:48
Completed NSE at 12:48, 0.02s elapsed
Initiating NSE at 12:48
Completed NSE at 12:48, 0.01s elapsed
Nmap scan report for 192.168.1.16
Host is up (0.0078s latency).
Not shown: 998 closed ports
PORT     STATE SERVICE VERSION
111/tcp  open  rpcbind 2 (RPC #100000)
| rpcinfo: 
|   program version   port/proto  service
|   100000  2            111/tcp  rpcbind
|_  100000  2            111/udp  rpcbind
1234/tcp open  textui  Vizio television textui
Service Info: Device: media device

NSE: Script Post-scanning.
Initiating NSE at 12:48
Completed NSE at 12:48, 0.00s elapsed
Initiating NSE at 12:48
Completed NSE at 12:48, 0.00s elapsed
Read data files from: /usr/local/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.69 seconds
Using telnet i connected the 1234 port and i got something that recalls a terminal session:
Code:
telnet 192.168.1.16 1234
Trying 192.168.1.16...
Connected to 192.168.1.16.
Escape character is '^]'.
help
/plugin/method param1 param2 ... : execute method exposed by plugin
cd [app_name/path], if no parameter, display current path, else change to the path
list [app_name/path], list direct subpath/method
find [pattern], find the pattern in all plugin and methods
callr /app_name/path/to/plugin/method output_sel param1 param2 ..., call registered method
callc plugin so_name func_name prototype output_sel param1 param2 ..., call a C function in a shared library
pack fmt arg1 arg2 ..., pack params to a struct and return the struct as a string
unpack fmt str, unpack a struct(in str), return fields value seperated by space
help [/plugin/method]
exit
I tried some commands but i wasn't lucky, maybe someone here on the forum can discover something more useful.
 
Last edited:
  • Like
Reactions: jaymzway
Impressive that this thread has been going for 2-3+ years. Having a ball running PMS on an old Linux box, paired with my Vizio E420i-b0 (2014?) but incredibly disappointed i can't natively access HBO go. Not really looking to buy yet another device to hang around the television, but considered picking up a $30 Chromecast as the SoC seems to be incredibly underpowered and after a while of running Plex, YouTube, whatever app the responsiveness of the tv begins to slow to a crawl -- at certain points you cannot even turn the volume up or down... it'll remember every button press on the remote, but sometimes the delay in reaching the tv is more than 30 seconds. The gf has been using the Plex app on our old Vizio more than Netflix lately, that's a really good sign. It just works.

Bravo to everyone who still gets excited about the potential of these type things. Appreciate this community.
 

nightlyshade

New member
Jun 29, 2014
2
2
ive been trying to do a directory traversal with known file names using dotdotpwn but i have had no prevail...
i was able to reach the spots where everyone found using this tutorial...
hacking-the-sony-kdl-48r510c-smart-tv (you can google it, cant post the link)

the person who wrote it was able to install busybox which is what im attempting to do... but i have not found anything even remotely possible. i know there is a way to upload to the tv because they upload firmware to it in order to update the tv... im attempting to try and find the exact incoming url, viewing the firmware file could possible help gain some knowledge
 
  • Like
Reactions: jaymzway

jaymzway

Senior Member
Mar 12, 2013
83
17
The more i research this tv its near like yahoo was on the hopes of gaining the same audiences that android has gained in helping them to launch tv apps n have failed cause they do offer out sdk just as android has done. Guess the whole otg thing with cell phones keeps a tv just as it is a tv just something that watches movies
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    My hope is that they at least add Yahoo View. The app is currently mostly pointless, but the finished version should end up being pretty much the same as Hulu Free but accessible by mobile devices, not just PCs.
    It would add some new life to these TVs.
    2
    Impressive that this thread has been going for 2-3+ years. Having a ball running PMS on an old Linux box, paired with my Vizio E420i-b0 (2014?) but incredibly disappointed i can't natively access HBO go. Not really looking to buy yet another device to hang around the television, but considered picking up a $30 Chromecast as the SoC seems to be incredibly underpowered and after a while of running Plex, YouTube, whatever app the responsiveness of the tv begins to slow to a crawl -- at certain points you cannot even turn the volume up or down... it'll remember every button press on the remote, but sometimes the delay in reaching the tv is more than 30 seconds. The gf has been using the Plex app on our old Vizio more than Netflix lately, that's a really good sign. It just works.

    Bravo to everyone who still gets excited about the potential of these type things. Appreciate this community.
    2
    Hidden Menu/Browser on Vizio E32-C1

    I have a Vizio E32-C1 2015 that I picked up a few months ago. The Vizio e-series are a pretty good deal IMHO.

    I was trying to turn it on in the dark the other day, and ended up pressing some unknown button combination as I fumbled in the dark.

    The result was rather surprising, the TV turned on and revealed a gray screen (from the look of it it was an HTML form) with the title "Opera App Launcher". Below the title was an input field and a submit button. Next to the input field in parentheses was the text "(0-9)".

    I was able to move from element on the page from the arrow navigation buttons on the remote.

    So I entered the number '5' from my remote, and hit the submit button. After a few seconds the Vizio official website loaded up. I was able to navigate the page and browse, but couldn't find a way to return to the grey screen or enter a URL manually.

    So far I've had no luck finding what button combo I entered. From searching the web I've gotten no hits about how to get into the service menu from the e-series, let alone anyone else who has encountered the "Opera App Launcher".

    Has anyone else seen anything like this? I'm really eager to get low-level access to my Smart TV.
    1
    While there might be a good amount of interest with this. I dont see work being done on it, as theres no central OS each tv would be completely different.
    Plus its alot easier to attach a small computer to the tv and go from there

    Sent from my GT-N7000 using xda premium

    I have a Vizio E3D470VX and decided to probe the wazoo out of it. nmap reports on an OS request it's replying Linux, but it's also responding and sending out SSDP requests (most likely the multi media network detection that's incomplete in this model).

    The only open port through the network hookup is 13000. I started this little adventure in a hope of finding a backdoor so I might control my TV with my Kindle (yes, I'm that darn ?lazy? :)) I can't seem to figure out what this port is yet.. No matter what sequence I try sending the port, it closes after a varying input sequence (UDP). Via TCP, it just auto closes.

    nmap hasn't the foggiest either, even after a deep scan+UDP run on the port. But it does look like the TV has a sort of firewall response to SYN flooding, that was comical as I saw the spread between identification attempts widen from 10ms to 8000ms over a period of 6 minutes.

    So, I'd be VERY interested in taking a closer look at this particular port opening. I might not go as far as to jack with the USB ports, sides, who knows if they are even active for sideloading. My real question is... is there some port connection software out there already that will run input/output test sequences to an ip address via TCP/UDP/etc and log the results to a log? I hate recreating a wheel if there's already a tool.
    1
    Hi~ After years of lurking I finally have made an XDA account just to breathe life into this sometimes-resurrectable 2012 topic.

    I'm a relative newb in the tech world--a couple of years back XDA helped me flash my kindle fire 7 and I'd never ripped the back of a board off and I think it awoke something menacing and wonderful in me. Anyway, I'm still young enough be so ambitious as to waste my time recycling stuff like this so I'll be heckin' around with Kali to follow the breadcrumbs left here and snoop around the sources y'all have pointed to ambiguously. Just wanted to remind yins that your mischievous approaches and technical guidance for the curious inspires babes all the time. There may be smarter solutions (trust I make this ol' E3D420VX work for me even if it's as a glorified monitor) but I love all of you who persevere to climb mountains just to get there. I'll be back someday~

    Gonna drop links to more sources to add to the breadcrumb log: