Replies: 4 comments 24 replies
-
|
Been there, done that. The bricked solo is not calling home to get a new firmware load. |
Beta Was this translation helpful? Give feedback.
-
|
Do you think there is possible firmware for the 500 that would have the Manufactuer List and codes to the remotes? |
Beta Was this translation helpful? Give feedback.
-
|
The more immediate issue with the 500 is getting the output source configured. There is already a Rosetta Stone of sorts for all the remote codes. See #165 |
Beta Was this translation helpful? Give feedback.
-
|
@DoogieHowitzerWMD Thank you. I wish I could undertand the issues pertaining to the output source. Im sorry I cant contribute to the group other than the menial things I found with the passwords. I will take a look. |
Beta Was this translation helpful? Give feedback.
-
STOP hijacking threads !! |
Beta Was this translation helpful? Give feedback.
-
|
It does when you hold the reset button - I have put the json in place and it has tried to fetch the firmware - which I have not put in place yet as I am not sure what version to put into place yet - The json seems to suggest that the 250 version is the latest but requests it is doing against the analytics server seem to suggest that my slingbox may be running a 270 firmware |
Beta Was this translation helpful? Give feedback.
-
|
Because the suggestion requires some detailed explanation to start, and is not a simple and straight forward thing. If it works you can share it for others later. Anyway if you're interested please DM me and I can discuss and explain more. No problem if you're not interested. Regards. |
Beta Was this translation helpful? Give feedback.
-
|
OK - How do I find you on Discord? |
Beta Was this translation helpful? Give feedback.
-
|
First, you need to join the Discord Slinger server via this https://discord.gg/gBqxUjAR Then either find one of my posts (most are in the ProHD thread) or look under the Memberlist for my username (same as here), then click my profile and use the message @ to reach out. I'm in Australia, and seems like you're in the UK... so keep in mind time differences if I don't reply straight away. Chat soon. |
Beta Was this translation helpful? Give feedback.
-
|
Invite link is expired - I think you are on some of the Reddit threads as well so you can DM me there - I am HubertusH on reddit. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, it was a link I just copied from here. This one should work https://discord.gg/t7c5nrcd |
Beta Was this translation helpful? Give feedback.
-
|
Based on the URL you mentioned, it almost seems like the version of the SOLO firmware is now 2.1.110. The JSON response suggests that 2.1.250 is the latest firmware (2.1.270 is actually the latest).
http://services.sling.com/configservices/rest/v2/configuration/product/SOLO/version/2.1.110.json |
Beta Was this translation helpful? Give feedback.
-
|
I am actually starting to believe that it is not the firmware it is cryppled - The json that the 270 firmware pulls from the servers has a device id="" at the bottom which I think may have crippled things so somebody with a slingbox pro could try to replicate what I have done and play with the json without that field in it... |
Beta Was this translation helpful? Give feedback.
-
|
It's never been that the FW was crippled imo. First, you need to understand the relationship of their SPARCS server and their ver 2 FW for Solo (applies to Pro and SB120 Iris too). i.e. "Controlling Slingbox from SPARCS: some parameters can be configured from SPARCS and sent to Slingbox as part of SPARCS-Slingbox register response." There are other Admin comm control flags that get set by SPARCS through parameters they can configure on their server and also set as part of the initial register response of a reset (unconfigured box). You also need to appreciate the importance of the LAN streaming and configuration i.e. SP 1.5 Setup Asst app connection to create a session and socket, just prior to auth of admin. And then the SPARCS control parameter of allowing or denying LAN streaming as well as timebombs they have embedded in the FW as potential issues or causes for what people are seeing. It's not as straight-forward as people seem to think like they just changed the admin password, we need to just figure out the new password. Anyway, this in part was what I was intending to edify you on when we chat. As well as other things, before suggesting something you can try further. |
Beta Was this translation helpful? Give feedback.
-
|
Actually, I don't believe the passwords got changed at all after N9, only the SPARCS parms. If you try to access a bricked box with an incorrect password, it returns the expected bad password error 0x2 (authorization failure), whereas if you use the correct password you get error 0x2b (stream disabled on LAN). You should get error 0x34 (stream disabled on WAN) if you tried to access a bricked box from the internet. |
Beta Was this translation helpful? Give feedback.
-
|
This is good stuff. I never noticed the different error codes when using my code. So I guess the question of the day is: If it can be bricked can it be unbricked? We need to decrypt the killer message to port 5678 to see what's being sent and received. My call in a different thread for a cryptographer to help figure out the encryption key has fallen on deaf ears. We know the encryption algorithm, we have the encrypted data and an excellent idea what some of the plain text is. All we need is someone who knows what their doing. |
Beta Was this translation helpful? Give feedback.
-
|
It might be handy to know the content of the killer message, but the fact is we do already know that they're sending a control parameter to flag the disabling of LAN (and WAN) streaming. And without LAN streaming enabled you'll never be able to get SP 1.5 PC or Mac 1.0.10 app to connect and configure any reset Solo or Pro boxes even with the default admin password. Having looked into the firmware versions my best guess is that unlike the ProHD, the Pro and Solo FW are perhaps set by default to have LAN streaming disabled for an unconfigured/reset box. Whether this by their SPARCS control flag that is sticking even after reset or by default in the those Solo and Pro FW, and unlike the ProHD which may be set as default for LAN enabled or their flag (SPARCS bricking parameter) isn't sticking in a FW rollback from reset. In any event, in a Solo or Pro a reset bricked box it shows this; "name":"MySlingbox","isRegistered":"0",..."isConfigured":"0",.."CanStreamOnLan":"0".... and it is likely that during power up behind the scenes through its initial register response to SPARCS after DHCP IP assignment it would receive a control parameter to enable LAN streaming which would then allow SP setup assistant to establish the session and socket, then authenticate Admin control using the default 'admin admin'. Another potential is that in the Ver2.x Solo FW there's specific SPARCS CFG CtrlBits and AdminConnMode controls, being set too. And regardless of either of the two above scenarios there's a catch 22 now, you can't connect to SPARCS without being bricked. And they probably changed the control parameter it now sets as their FW documents states "Slingbox will allow / deny LAN / WAN streaming based on this SPARCS controls". Also in the Solo FW 2.1.270 bin it shows as part of the timebomb limit expired feature "LAN & WAN streaming is not allowed now pro solo iris" which is an clear indication that the Solo Pro and Iris share the same feature-sets when it comes to SPARCS control parameters. However, if you look into the Solo FwV1.2.18 compared to the FwV2.x you'll notice there isn't those same SPARCS CFG Admin Controls and others... the same applies to FW ver 1.0.39 versus 1.4.20 for the Pro. I was going to explain this to the OP through a chat and try work with him to go through all of this, but essentially if it were me I would be hex hacking the header older FW 1.2.18 into higher version, modding the json and feeding a FW upgrade (downgrade) of those older versions which seem less reliant on SPARCS. And might also hopefully have LAN streaming enabled by default to see if the SP can connect with the default admin admin; which defined clearly in the FW and what SP attempts to use on any unconfigured Solo, Pro or ProHD it sees. Of course, there's no guarantee that such a FW rollback from a ver 2 to 1 will not fail and make a true boat anchor of the box. But at the same time, someone has to try it and see, and the OP has setup the server DNS mimicking to give it a go. All I can say is not all the options to unbrick have been explored at this stage, and this is what I would do (and would have already done/tested) if I had a bricked Solo or Pro here. Unfortunately, as Slingboxes aren't even sold in Australia, and my ProHDs (the only units I own) are physically located in Japan, I have to work with others like RandomMan719 and Proudx to do the actual testing and work through things as a process, like we three did on the ProHD unit. Anyway, this is the other part of the initial investigation into the Firmware, SPARCS and SP setup assistant admin password reason for not authenticating, and some thoughts as to how one could try to unbrick a Solo or Pro. It may lead to nothing but hopefully, someone can give it a go, or the OP can publish a guide for others to setup a system to mimic Slings services.sling.com and cbfu-prod.slingbox.com based on what he uses, so someone else might be able to give it try. |
Beta Was this translation helpful? Give feedback.
-
|
Posting for Mikoshi-nyudo 👍 And without LAN streaming enabled you'll never be able to get SP 1.5 PC or Mac 1.0.10 app to connect and configure any reset Solo or Pro boxes even with the default admin password. Having looked into the firmware versions my best guess is that unlike the ProHD, the Pro and Solo FW are perhaps set by default to have LAN streaming disabled for an unconfigured/reset box. Whether this by their SPARCS control flag that is sticking even after reset or by default in the those Solo and Pro FW, and unlike the ProHD which may be set as default for LAN enabled or their flag (SPARCS bricking parameter) isn't sticking in a FW rollback from reset. In any event, in a Solo or Pro a reset bricked box it shows this; "name":"MySlingbox","isRegistered":"0",..."isConfigured":"0",.."CanStreamOnLan":"0".... and it is likely that during power up behind the scenes through its initial register response to SPARCS after DHCP IP assignment it would receive a control parameter to enable LAN streaming which would then allow SP setup assistant to establish the session and socket, then authenticate Admin control using the default 'admin admin'. Another potential is that in the Ver2.x Solo FW there's specific SPARCS CFG CtrlBits and AdminConnMode controls, being set too. And regardless of either of the two above scenarios there's a catch 22 now, you can't connect to SPARCS without being bricked. And they probably changed the control parameter it now sets as their FW documents states "Slingbox will allow / deny LAN / WAN streaming based on this SPARCS controls". Also in the Solo FW 2.1.270 bin it shows as part of the timebomb limit expired feature "LAN & WAN streaming is not allowed now pro solo iris" which is an clear indication that the Solo Pro and Iris share the same feature-sets when it comes to SPARCS control parameters. However, if you look into the Solo FwV1.2.18 compared to the FwV2.x you'll notice there isn't those same SPARCS CFG Admin Controls and others... the same applies to FW ver 1.0.39 versus 1.4.20 for the Pro. I was going to explain this to the OP through a chat and try work with him to go through all of this, but essentially if it were me I would be hex hacking the header older FW 1.2.18 into higher version, modding the json and feeding a FW upgrade (downgrade) of those older versions which seem less reliant on SPARCS. And might also hopefully have LAN streaming enabled by default to see if the SP can connect with the default admin admin; which defined clearly in the FW and what SP attempts to use on any unconfigured Solo, Pro or ProHD it sees. Of course, there's no guarantee that such a FW rollback from a ver 2 to 1 will not fail and make a true boat anchor of the box. But at the same time, someone has to try it and see, and the OP has setup the server DNS mimicking to give it a go. All I can say is not all the options to unbrick have been explored at this stage, and this is what I would do (and would have already done/tested) if I had a bricked Solo or Pro here. Unfortunately, as Slingboxes aren't even sold in Australia, and my ProHDs (the only units I own) are physically located in Japan, I have to work with others like RandomMan719 and Proudx to do the actual testing and work through things as a process, like we three did on the ProHD unit. Anyway, this is the other part of the initial investigation into the Firmware, SPARCS and SP setup assistant admin password reason for not authenticating, and some thoughts as to how one could try to unbrick a Solo or Pro. It may lead to nothing but hopefully, someone can give it a go, or the OP can publish a guide for others to setup a system to mimic Slings services.sling.com and cbfu-prod.slingbox.com based on what he uses, so someone else might be able to give it try. |
Beta Was this translation helpful? Give feedback.
-
|
@gerry, Unfortunately, I didn't expect Dish to be so sneaky, so I now have 2 bricked Solo boxes (SB260-XXX) and an old Classic (SB151-110). Now it might be a bit cumbersome to send the boxes to Australia (I think I understood that you live in Australia ... I'd like to "come over" and dive the Great Barrier Reef ;-) ). But back to the boxes. I believe I have the understanding and also the equipment to help or assist you in trying to unlock the boxes. So if you are able to describe scenarios and configurations to me, I could run them here with my boxes and share the results with you. I've been following the discussions here and on Discord. But unfortunately the revival of the ProHD is the only success so far :-( |
Beta Was this translation helpful? Give feedback.
-
|
and all boxes get bricked just because mrsling access via port 5678? thats surgical. and so delicate. |
Beta Was this translation helpful? Give feedback.
-
|
I'm in Nova Scotia Canada. Thanks for the offer but I've got a bricked Solo of my own. So I'm good for now. Toei79: Just to be clear, Mr. Sling does not contact the box via port 5678. The slingbox talks out going to Mr. Sling on port 5678. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for posting that on my behalf, Gerry. My Gitub account has finally been unflagged, so I can post again, and my previous posts should be visible again. I take it the OP never tried to downgrade to the early version I suggested, so until someone else tries then this will remain TBD as to whether it will or won't unbrick the Solo and Pro units. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
My singbox solo is pretty much bricked and I tried the factory reset to try and configure it with little success.....
BUT - The slingbox is currently unable to make outbound connections as they are blocked with ip tables on my main router. - I have redirected all sling.com etc DNS entries to a honeypod style linux box and in the webserver logs I worked out it tries to pull a json file from http://services.sling.com/configservices/rest/v2/configuration/product/solo/version/2.1.110/device/.json
This bit of Json looks interesting:
{
"config": {
"product-id": "solo",
"set": [
{
"r": {
"type": "get",
"compression": "None",
"crc": -197069916,
"content": "http://cbfu-prod.slingbox.com/Solo/SlingboxSoloFwV2_1_250HwV1_0_3Current.bin",
"name": "solo-firmware",
"version": "2.1.250"
},
"name": "fw-components"
},
{
"r": {
"type": "string",
"latest-forced": "2.1.100",
"content": "normal",
"latest-ver": "2.1.250",
"min-ver": "2.1.250",
"name": "fw-update"
},
"name": "update"
},
{
"r": [
{
"type": "int",
"content": 300,
"name": "inactive-seconds"
},
{
"type": "int",
"content": 86400,
"name": "next-check-seconds"
},
{
"type": "int",
"content": 3,
"name": "read-attempts"
},
{
"type": "int",
"content": 3866688,
"name": "size-bytes"
}
],
"name": "utility"
}
],
"version": "2.1.110"
}
}
This suggests to me it will download the firmware from the given URL and I managed to grab an older version of the FW from there as well so I will be populating my honeypod with the relevant files to see if I can get the slingbox to pull an older version of the firmware when I am local to it.
Does this sound like a plan or am I on a path of total destruction with my brick.
Best regards
Beta Was this translation helpful? Give feedback.
All reactions