I've got the bad boy under the microscope. I'll leave some images here if you're interested.
and so far managed to access only one UART (the others have disconnected rails):
All I got is the following data:
Sky Titan MCU Bootloader started, Ver: 3.3.1.0, CRC: 9497F12B CRC Good, release build, compiled on Mar 27 2019 at 11:56:12
05
07
09
21
0B
19-02
02-84
16
0C
18
03-03.03.01.00-B8ED0A1C
12
........Hi to everyone,
For curiosity I am currently digging on Sky Q decoder (internet version), I discovered that it uses a realtek RTD1311VS SoC. On the board I found a possible JTAG port but I currently don't have the right tools to access it. I then moved on to analyze the data traffic, I managed to discover the domain from where the decoder obtains the firmware, but since it is protected by TLS I cannot decode the request completely. I tried to decode the protected traffic using TLS downgrade and sslstrip techniques, which worked with other APIs but without success for the firmware API. Has anyone already reversed this new decoder or want to contribute?
Hey! Any luck with reverse engineering the Sky Q box? I've saved one from the landfill and I wondered whether it's possible to replace the proprietary OS with a linux distro so to use the box as a computer.
