Decoder Sky Q Internet Version

Neither the drivers nor the operating system on the device are open source. There are certainly no compilers for the processor either.

This is all kept under wraps by the manufacturers.

This means that even if you somehow got hold of the operating system, which isn't that easy, you would still have to reverse engineer the processor.

You have to keep in mind that you would then have to write a compiler for the unknown processor in order to get Open Source Linux on it.

But then you still don't have any drivers and you would have to examine all external components separately.

No way too complex and too complicated

Quote from calumario

Hi to everyone,

For curiosity I am currently digging on Sky Q decoder (internet version), I discovered that it uses a realtek RTD1311VS SoC. On the board I found a possible JTAG port but I currently don't have the right tools to access it. I then moved on to analyze the data traffic, I managed to discover the domain from where the decoder obtains the firmware, but since it is protected by TLS I cannot decode the request completely. I tried to decode the protected traffic using TLS downgrade and sslstrip techniques, which worked with other APIs but without success for the firmware API. Has anyone already reversed this new decoder or want to contribute?

Send me a private message for discussing further :)

Quote from calumario

Hi to everyone,

For curiosity I am currently digging on Sky Q decoder (internet version), I discovered that it uses a realtek RTD1311VS SoC. On the board I found a possible JTAG port but I currently don't have the right tools to access it. I then moved on to analyze the data traffic, I managed to discover the domain from where the decoder obtains the firmware, but since it is protected by TLS I cannot decode the request completely. I tried to decode the protected traffic using TLS downgrade and sslstrip techniques, which worked with other APIs but without success for the firmware API. Has anyone already reversed this new decoder or want to contribute?

Hey! Any luck with reverse engineering the Sky Q box? I've saved one from the landfill and I wondered whether it's possible to replace the proprietary OS with a linux distro so to use the box as a computer.

No way yet sorry

I've got the bad boy under the microscope. I'll leave some images here if you're interested.

1.jpg  3.jpg

4.png 5.png

6.png

and so far managed to access only one UART (the others have disconnected rails):

All I got is the following data:

Sky Titan MCU Bootloader started, Ver: 3.3.1.0, CRC: 9497F12B CRC Good, release build, compiled on Mar 27 2019 at 11:56:12
05
07
09
21
0B
19-02
02-84
16
0C
18
03-03.03.01.00-B8ED0A1C
12
........