<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://wiki.exploitee.rs/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Catrane</id>
	<title>Exploitee.rs - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://wiki.exploitee.rs/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Catrane"/>
	<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Special:Contributions/Catrane"/>
	<updated>2026-05-06T17:44:14Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.45.0-alpha</generator>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=766</id>
		<title>Main Page/Devices</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=766"/>
		<updated>2012-05-16T22:02:47Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add link to &amp;quot;All Device Feature Matrix&amp;quot;.  Not sure I like the location of the link, but giving it a try to see how the front page looks with it.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[All_device_feature_matrix|All Device Feature Matrix]]&lt;br /&gt;
&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Current Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;logitech_section&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot;&lt;br /&gt;
| [[File:Revue-advert.gif|180px]]&lt;br /&gt;
|&lt;br /&gt;
*[[Steps to get root ]]&lt;br /&gt;
*[http://forum.gtvhacker.com/revue/ Join the Revue forum! ]&lt;br /&gt;
*[http://gtvhacker.com/blog/2011/logitech-revue-software-root/ Why no software root? ]&lt;br /&gt;
&lt;br /&gt;
*[http://gtvhacker.com/index.php/Category:Logitech_Revue Info on Logitech Revue]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSX-40GT1.jpg|180px]] &lt;br /&gt;
| colspan=&amp;quot;2&amp;quot;| &lt;br /&gt;
*[[Sony NSX-40GT1 (Internet TV)]]&lt;br /&gt;
*[http://forum.gtvhacker.com/nsx-40gt1/ Join the nsx-40gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSZ_GT1.jpg|180px]]&lt;br /&gt;
|colspan=&amp;quot;2&amp;quot;|&lt;br /&gt;
&lt;br /&gt;
*[[Sony NSZ-GT1 (Bluray Player)]] &lt;br /&gt;
*[http://forum.gtvhacker.com/nsz-gt1/ Join the nsz-gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
*[[Sony GTV Troubleshooting]]&lt;br /&gt;
*[[Sony Settings Menus]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Upcoming Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;vizio_section&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;[[Vizio]]&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Samsung&#039;&#039;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=All_device_feature_matrix&amp;diff=765</id>
		<title>All device feature matrix</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=All_device_feature_matrix&amp;diff=765"/>
		<updated>2012-05-16T22:00:43Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Initial device feature / rootability matrix.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;==Google TV Devices==&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot; style=&amp;quot;width: auto; text-align: center; font-size: smaller; table-layout: fixed; line-height:1.25&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Model&lt;br /&gt;
! Manufacturer&lt;br /&gt;
! Released&lt;br /&gt;
! Discontinued&lt;br /&gt;
! Initial MSRP&lt;br /&gt;
! Best price&lt;br /&gt;
! Screen size&lt;br /&gt;
! Disc player&lt;br /&gt;
! CPU&lt;br /&gt;
! Latest official release&lt;br /&gt;
! Root&lt;br /&gt;
! Root R/W FS&lt;br /&gt;
! Bugs&lt;br /&gt;
|-&lt;br /&gt;
! [[Logitech_Revue|Revue]]&lt;br /&gt;
| Logitech&lt;br /&gt;
| Oct 6, 2010&lt;br /&gt;
| Nov 2011&lt;br /&gt;
| $299.99&lt;br /&gt;
| $99.99&lt;br /&gt;
| N/A&lt;br /&gt;
| No&lt;br /&gt;
| Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU&lt;br /&gt;
| ?&lt;br /&gt;
| [[Steps_to_get_root|Hardware]]&lt;br /&gt;
| No&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
! [[Sony_NSX-40GT1_(Internet_TV)|NSX-xGT]]&lt;br /&gt;
| Sony&lt;br /&gt;
| Oct 6, 2010&lt;br /&gt;
| Feb 2012&lt;br /&gt;
| $799.99&lt;br /&gt;
| ?&lt;br /&gt;
| 24 in / 32 in / 40 in / 46 in&lt;br /&gt;
| No&lt;br /&gt;
| Intel Atom CE4170 1.7 GHz processor, with a 200 MHz GPU&lt;br /&gt;
| Android 3.2 (2012.02.22)&lt;br /&gt;
| [[Running_Unsigned_Kernels_On_Sony_GTV|Software]]&lt;br /&gt;
| Yes&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
! [[Sony_NSZ-GT1_(Bluray_Player)|NSZ-GT1]]&lt;br /&gt;
| Sony&lt;br /&gt;
| Oct 6, 2010&lt;br /&gt;
| N/A&lt;br /&gt;
| $399.99&lt;br /&gt;
| ?&lt;br /&gt;
| N/A&lt;br /&gt;
| Blu-ray&lt;br /&gt;
| Intel Atom CE4170 1.7 GHz processor, with a 200 MHz GPU&lt;br /&gt;
| Android 3.2 (2012.02.22)&lt;br /&gt;
| [[Running_Unsigned_Kernels_On_Sony_GTV|Software]]&lt;br /&gt;
| Yes&lt;br /&gt;
| ?&lt;br /&gt;
|-&lt;br /&gt;
! xG2&lt;br /&gt;
| LG&lt;br /&gt;
| May 21, 2012&lt;br /&gt;
| N/A&lt;br /&gt;
| $1699 / $2299&lt;br /&gt;
| ?&lt;br /&gt;
| 47 in / 55 in&lt;br /&gt;
| No&lt;br /&gt;
| &amp;quot;LG&#039;s dual-core processor&amp;quot;&lt;br /&gt;
| ?&lt;br /&gt;
| No&lt;br /&gt;
| N/A&lt;br /&gt;
| ?&lt;br /&gt;
|- class=&amp;quot;sortbottom&amp;quot;&lt;br /&gt;
! Model&lt;br /&gt;
! Manufacturer&lt;br /&gt;
! Released&lt;br /&gt;
! Discontinued&lt;br /&gt;
! Initial MSRP&lt;br /&gt;
! Best price&lt;br /&gt;
! Screen size&lt;br /&gt;
! Disc player&lt;br /&gt;
! CPU&lt;br /&gt;
! Latest official release&lt;br /&gt;
! Root&lt;br /&gt;
! Root R/W FS&lt;br /&gt;
! Bugs&lt;br /&gt;
|}&lt;br /&gt;
&amp;quot;x&amp;quot; = option number, such as screen size, in model number.&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_NSZ-GT1_(Bluray_Player)&amp;diff=764</id>
		<title>Sony NSZ-GT1 (Bluray Player)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_NSZ-GT1_(Bluray_Player)&amp;diff=764"/>
		<updated>2012-05-14T21:40:26Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Change tear-down URL to point to a pre-spam version of the page.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Disclaimer}}&lt;br /&gt;
[[File:Sony_NSZ_GT1.jpg|250px|left|thumb]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
This page will be dedicated to the hardware specifications, descriptions, and information related to the Sony NSZ-GT1 (Bluray Player).&lt;br /&gt;
&lt;br /&gt;
== Specs ==&lt;br /&gt;
*Intel Atom CE4170 1.7 GHz processor, with a 200 MHz GPU&amp;lt;sup&amp;gt;1&amp;lt;/sup&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Tear Down ==&lt;br /&gt;
[http://www.magicandroidapps.com/wiki//index.php?title=GoogleTvTeardown&amp;amp;oldid=443 Sony NSZ-GT1 Google TV Teardown]&lt;br /&gt;
&lt;br /&gt;
== Recovery Mode ==&lt;br /&gt;
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]&lt;br /&gt;
&lt;br /&gt;
#Have everything plugged into the unit except the power coord. Have the power coord in your hand.&lt;br /&gt;
#Press and hold the power button and plug the unit in.&lt;br /&gt;
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.&lt;br /&gt;
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.&lt;br /&gt;
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.&lt;br /&gt;
#You can now press the numbers assigned to the commands!&lt;br /&gt;
&lt;br /&gt;
== USB Update ==&lt;br /&gt;
The steps to access recovery mode are listed in the &amp;quot;Recovery Menu&amp;quot; section above. Also, a list of OTA sony downloads can be found [http://gtvhacker.com/index.php/Sony_Update_Downloads#Download_Links Here]&lt;br /&gt;
&lt;br /&gt;
In recovery mode, any USB storage device will be automounted when inserted.  If it&#039;s inserted at the start of recovery mode, the device will attempt to do a USB update.  This executes the following:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
cmd:ls /tmp/mnt/diskb1/package_list_*.zip | head -1 | grep &amp;quot;package_list_&amp;quot;&lt;br /&gt;
cmd:/bin/sony/check_version.sh /tmp/mnt/diskb1/package_list_0.zip&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
For a USB update to succeed, the following are necessary (but not sufficient):&lt;br /&gt;
# there must be a file matching /package_list_*.zip or else you get the error &amp;quot;find package error: no such a package !&amp;quot;&lt;br /&gt;
# the zip must contain a file &amp;quot;system/build.prop&amp;quot; or else you get the error &amp;quot;caution: filename not matched:  system/build.prop&amp;quot;&lt;br /&gt;
# the zip must contain a file matching &amp;quot;package_list_*.txt&amp;quot; or else you get the error &amp;quot;caution: filename not matched:  package_list_*.txt&amp;quot;&lt;br /&gt;
# The system/build.prop must have an ro.build.id that is greater than the current values.  Otherwise you get an onscreen message saying &amp;quot;USB data is old&amp;quot;.&lt;br /&gt;
# At &#039;&#039;&#039;this&#039;&#039;&#039; point, the signature is checked:&lt;br /&gt;
&amp;lt;pre&amp;gt;                            &lt;br /&gt;
package update start !                                                          &lt;br /&gt;
cmd:/package_update.sh -y -l 0 -p /tmp/mnt/diskb1/package_list_ogm_2.1_2011_asu1&lt;br /&gt;
(*) Direct/Interface: Loaded &#039;PNG&#039; implementation of &#039;IDirectFBImageProvider&#039;.  &lt;br /&gt;
dtv_sym_tv_updating.png = w: 1920, h: 1080.                                     &lt;br /&gt;
Verifying..                                                                     &lt;br /&gt;
Error in main(47):Footer Error                                                  &lt;br /&gt;
Signing Verify Error                                                            &lt;br /&gt;
Error!!        &lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
If a valid-looking zipfile on a USB storage device is plugged in when the system goes through a normal boot, it will abort and reboot into the recovery mode.&lt;br /&gt;
&lt;br /&gt;
== Related ==&lt;br /&gt;
[[Sony Update Downloads]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. http://www.windowsfordevices.com/c/a/News/Intel-CE4100/&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=759</id>
		<title>Patchloader</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=759"/>
		<updated>2012-03-17T03:00:14Z</updated>

		<summary type="html">&lt;p&gt;Catrane: So the sh in busybox is extremely incompatible with DOS CRLF. That sucks. Rework the script a bunch to not use temp files and actually work with DOS CRLF. Tested in both dos and unix formats.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Patchloader framework for packaging solutions for end-user install on GTV.  Intended to make solutions approachable and installs automatic.&lt;br /&gt;
&lt;br /&gt;
This page is only of use to developers.  End-users need not worry about trying to figure out if this will do anything for them.&lt;br /&gt;
An example of a deployed patchloader is here: [[Eject Bug Hack]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
busybox tr -d &#039;\r&#039; &amp;lt;$0 | busybox sed &#039;1,/^PATCHLOADER BEGIN$/ d; s|PATCHLOADER_SCRIPT=.*|PATCHLOADER_SCRIPT=&#039;$0&#039;|&#039; | /bin/sh 2&amp;gt;&amp;amp;1 | busybox tr -d &#039;\r&#039; | busybox sed &#039;/^ *$/ d&#039; # Keep comment here.&lt;br /&gt;
exit # Do not change or delete these first two lines or their comments, or DOS breaks.&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# NECESSARY LINE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Don&#039;t move or delete this line.  The second line of the file needs it.&lt;br /&gt;
PATCHLOADER BEGIN&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# The easiest way to get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as&lt;br /&gt;
# the MD5 below and let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;GARBAGE&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
PATCHLOADER_SCRIPT=$0&lt;br /&gt;
extractPatch ()&lt;br /&gt;
{&lt;br /&gt;
	busybox tr -d &#039;\r&#039; &amp;lt;$PATCHLOADER_SCRIPT | busybox sed &#039;1,/^PATCHLOADER PAYLOAD START$/ d; /^PATCHLOADER PAYLOAD END$/,$ d&#039;&lt;br /&gt;
}&lt;br /&gt;
MD5_CALC=&amp;quot;`extractPatch | busybox md5sum`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
		echo &amp;quot;A copy of your extracted patch is located at /tmp/extract.patch for verification.&amp;quot;&lt;br /&gt;
		extractPatch &amp;gt; /tmp/extract.patch&lt;br /&gt;
	fi&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
extractPatch | busybox patch -p1&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /tmp/patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /tmp/patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# END OF SCRIPT.  DO NOT MOVE OR REMOVE&lt;br /&gt;
# -----------------&lt;br /&gt;
exit&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;PATCHLOADER PAYLOAD START&amp;quot; line here.&lt;br /&gt;
PATCHLOADER PAYLOAD START&lt;br /&gt;
&amp;lt;delete this line and insert payload here&amp;gt;&lt;br /&gt;
PATCHLOADER PAYLOAD END&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=758</id>
		<title>Eject Bug Hack</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=758"/>
		<updated>2012-03-17T02:58:38Z</updated>

		<summary type="html">&lt;p&gt;Catrane: So the sh in busybox is extremely incompatible with DOS CRLF.  That sucks.  Rework the script a bunch to not use temp files and actually work with DOS CRLF.  Tested in both dos and unix formats.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a patchloader that consists of a script to detect and recover from the eject bug and the modification necessary to make that script be run as a service.  The user can follow the instructions below to install this on their GTV.&lt;br /&gt;
&lt;br /&gt;
The install procedure and the workaround itself are run as root, so there is of course the risk that the user could brick their system with no recourse for recovery.  As with any root-related activity, if you can&#039;t afford to lose it, don&#039;t do it.&lt;br /&gt;
&lt;br /&gt;
Developers: The patchloader framework used for this can be found [[Patchloader|here]] and used for deploying other fixes or updates.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
busybox tr -d &#039;\r&#039; &amp;lt;$0 | busybox sed &#039;1,/^PATCHLOADER BEGIN$/ d; s|PATCHLOADER_SCRIPT=.*|PATCHLOADER_SCRIPT=&#039;$0&#039;|&#039; | /bin/sh 2&amp;gt;&amp;amp;1 | busybox tr -d &#039;\r&#039; | busybox sed &#039;/^ *$/ d&#039; # Keep comment here.&lt;br /&gt;
exit # Do not change or delete these first two lines or their comments, or DOS breaks.&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
# Bluray disc eject workaround, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /tmp/patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /tmp/patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# NECESSARY LINE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Don&#039;t move or delete this line.  The second line of the file needs it.&lt;br /&gt;
PATCHLOADER BEGIN&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# The easiest way to get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as&lt;br /&gt;
# the MD5 below and let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;7fc5242685822432b8220b4e760629bf  -&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
PATCHLOADER_SCRIPT=$0&lt;br /&gt;
extractPatch ()&lt;br /&gt;
{&lt;br /&gt;
	busybox tr -d &#039;\r&#039; &amp;lt;$PATCHLOADER_SCRIPT | busybox sed &#039;1,/^PATCHLOADER PAYLOAD START$/ d; /^PATCHLOADER PAYLOAD END$/,$ d&#039;&lt;br /&gt;
}&lt;br /&gt;
MD5_CALC=&amp;quot;`extractPatch | busybox md5sum`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
		echo &amp;quot;A copy of your extracted patch is located at /tmp/extract.patch for verification.&amp;quot;&lt;br /&gt;
		extractPatch &amp;gt; /tmp/extract.patch&lt;br /&gt;
	fi&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
extractPatch | busybox patch -p1&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
chmod 755 /system/bin/eject_bug_workaround.sh&lt;br /&gt;
rm $PATCHLOADER_SCRIPT&lt;br /&gt;
echo Please reboot your GTV via the power cord or ctrl-alt-del for this patch&lt;br /&gt;
echo to take effect.&lt;br /&gt;
echo This patch has a 60 second safety when loaded, so it will not actually run&lt;br /&gt;
echo until the GTV has been fully booted for 60 seconds.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# END OF SCRIPT.  DO NOT MOVE OR REMOVE&lt;br /&gt;
# -----------------&lt;br /&gt;
exit&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;PATCHLOADER PAYLOAD START&amp;quot; line here.&lt;br /&gt;
PATCHLOADER PAYLOAD START&lt;br /&gt;
---&lt;br /&gt;
 init.eagle.rc                      |    5 +++&lt;br /&gt;
 system/bin/eject_bug_workaround.sh |   53 ++++++++++++++++++++++++++++++++++++&lt;br /&gt;
 2 files changed, 58 insertions(+), 0 deletions(-)&lt;br /&gt;
 create mode 100644 system/bin/eject_bug_workaround.sh&lt;br /&gt;
&lt;br /&gt;
diff --git a/init.eagle.rc b/init.eagle.rc&lt;br /&gt;
index 2004d8a..685ce6f 100644&lt;br /&gt;
--- a/init.eagle.rc&lt;br /&gt;
+++ b/init.eagle.rc&lt;br /&gt;
@@ -329,6 +329,7 @@ on init&lt;br /&gt;
     setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
     export DISCPLAYER_KEEP_DMIX_ASIS true&lt;br /&gt;
     export DISCPLAYER_LOG_VERBOSE true&lt;br /&gt;
+    start ejectworkaround&lt;br /&gt;
 &lt;br /&gt;
   ## for lighttpd&lt;br /&gt;
     mkdir /var/log/lighttpd 0750 system system&lt;br /&gt;
@@ -439,6 +440,10 @@ service discplayer /system/bin/discplayer&lt;br /&gt;
     user root&lt;br /&gt;
     group system&lt;br /&gt;
 &lt;br /&gt;
+service ejectworkaround /system/bin/eject_bug_workaround.sh 60&lt;br /&gt;
+    user root&lt;br /&gt;
+    group system&lt;br /&gt;
+&lt;br /&gt;
 on property:com.sony.btv.discplayer.enable=1&lt;br /&gt;
     start discplayer&lt;br /&gt;
     start discservice&lt;br /&gt;
diff --git a/system/bin/eject_bug_workaround.sh b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
new file mode 100644&lt;br /&gt;
index 0000000..1f4f282&lt;br /&gt;
--- /dev/null&lt;br /&gt;
+++ b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
@@ -0,0 +1,53 @@&lt;br /&gt;
+#!/bin/sh&lt;br /&gt;
+&lt;br /&gt;
+# Reason:&lt;br /&gt;
+# There is a known problem that, for an unknown reason, disc eject fails on rooted NSZ-GT1 systems.&lt;br /&gt;
+# Side effects of this problem include the possibility that the disc is not ejected and in all cases&lt;br /&gt;
+# the problem that discs cannot be played after attempted eject.&lt;br /&gt;
+# Rebooting the system fixes the problem, but this solution eliminates the need for reboot.&lt;br /&gt;
+&lt;br /&gt;
+# Alternative solutions:&lt;br /&gt;
+# Restart the device via the power cord or ctrl-alt-del.&lt;br /&gt;
+&lt;br /&gt;
+# Caveats:&lt;br /&gt;
+# This fix does not detect the occurrence of any error, but rather occurrence of a known event which&lt;br /&gt;
+# reliably preceeds the error and is reliably followed by the error situation.&lt;br /&gt;
+# Error messages and odd behavior may be observed onscreen at the moment of eject, though none of&lt;br /&gt;
+# this causes any side-effects.&lt;br /&gt;
+&lt;br /&gt;
+# Stimulus:&lt;br /&gt;
+# From command: logcat -b main&lt;br /&gt;
+# Output: I DiscPlayerManager: onStartCommand: com.sony.btv.discplayer.EJECT_DISC&lt;br /&gt;
+&lt;br /&gt;
+# Response:&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+# busybox eject /dev/block/sr0&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+&lt;br /&gt;
+# Usage:&lt;br /&gt;
+#   eject_bug_workaround.sh &amp;amp;&lt;br /&gt;
+#   - Runs workaround in background.&lt;br /&gt;
+#   eject_bug_workaround.sh 600 &amp;amp;&lt;br /&gt;
+#   - Sleeps for 600 seconds before running, all in background.&lt;br /&gt;
+#   - Useful for ensuring a window of recovery in case any side-effects occur.&lt;br /&gt;
+&lt;br /&gt;
+if [ ! -z &amp;quot;$1&amp;quot; ]&lt;br /&gt;
+then&lt;br /&gt;
+	sleep $1&lt;br /&gt;
+fi&lt;br /&gt;
+&lt;br /&gt;
+LASTDECT=$(date)&lt;br /&gt;
+&lt;br /&gt;
+logcat -b main DiscPlayerManager:I *:S|busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {system(&amp;quot;echo onStartCommand: com.sony.btv.discplayer.EJECT_DISC&amp;quot;)}&#039;|while busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {exit 0}&#039;&lt;br /&gt;
+do&lt;br /&gt;
+	if [ &amp;quot;$LASTDECT&amp;quot; != &amp;quot;$(date)&amp;quot; ]&lt;br /&gt;
+	then&lt;br /&gt;
+		echo Detected eject failure.&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+		busybox eject /dev/block/sr0&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+		echo Eject failure repair complete.&lt;br /&gt;
+		LASTDECT=$(date)&lt;br /&gt;
+	fi&lt;br /&gt;
+done&lt;br /&gt;
+&lt;br /&gt;
-- &lt;br /&gt;
1.7.6.1&lt;br /&gt;
PATCHLOADER PAYLOAD END&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=757</id>
		<title>Eject Bug Hack</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=757"/>
		<updated>2012-03-16T14:00:55Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add link to Patchloader for developer reference.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a patchloader that consists of a script to detect and recover from the eject bug and the modification necessary to make that script be run as a service.  The user can follow the instructions below to install this on their GTV.&lt;br /&gt;
&lt;br /&gt;
The install procedure and the workaround itself are run as root, so there is of course the risk that the user could brick their system with no recourse for recovery.  As with any root-related activity, if you can&#039;t afford to lose it, don&#039;t do it.&lt;br /&gt;
&lt;br /&gt;
Developers: The patchloader framework used for this can be found [[Patchloader|here]] and used for deploying other fixes or updates.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
# Bluray disc eject workaround, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail -5 $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
---&lt;br /&gt;
 init.eagle.rc                      |    5 +++&lt;br /&gt;
 system/bin/eject_bug_workaround.sh |   53 ++++++++++++++++++++++++++++++++++++&lt;br /&gt;
 2 files changed, 58 insertions(+), 0 deletions(-)&lt;br /&gt;
 create mode 100644 system/bin/eject_bug_workaround.sh&lt;br /&gt;
&lt;br /&gt;
diff --git a/init.eagle.rc b/init.eagle.rc&lt;br /&gt;
index 2004d8a..685ce6f 100644&lt;br /&gt;
--- a/init.eagle.rc&lt;br /&gt;
+++ b/init.eagle.rc&lt;br /&gt;
@@ -329,6 +329,7 @@ on init&lt;br /&gt;
     setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
     export DISCPLAYER_KEEP_DMIX_ASIS true&lt;br /&gt;
     export DISCPLAYER_LOG_VERBOSE true&lt;br /&gt;
+    start ejectworkaround&lt;br /&gt;
 &lt;br /&gt;
   ## for lighttpd&lt;br /&gt;
     mkdir /var/log/lighttpd 0750 system system&lt;br /&gt;
@@ -439,6 +440,10 @@ service discplayer /system/bin/discplayer&lt;br /&gt;
     user root&lt;br /&gt;
     group system&lt;br /&gt;
 &lt;br /&gt;
+service ejectworkaround /system/bin/eject_bug_workaround.sh 60&lt;br /&gt;
+    user root&lt;br /&gt;
+    group system&lt;br /&gt;
+&lt;br /&gt;
 on property:com.sony.btv.discplayer.enable=1&lt;br /&gt;
     start discplayer&lt;br /&gt;
     start discservice&lt;br /&gt;
diff --git a/system/bin/eject_bug_workaround.sh b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
new file mode 100644&lt;br /&gt;
index 0000000..1f4f282&lt;br /&gt;
--- /dev/null&lt;br /&gt;
+++ b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
@@ -0,0 +1,53 @@&lt;br /&gt;
+#!/bin/sh&lt;br /&gt;
+&lt;br /&gt;
+# Reason:&lt;br /&gt;
+# There is a known problem that, for an unknown reason, disc eject fails on rooted NSZ-GT1 systems.&lt;br /&gt;
+# Side effects of this problem include the possibility that the disc is not ejected and in all cases&lt;br /&gt;
+# the problem that discs cannot be played after attempted eject.&lt;br /&gt;
+# Rebooting the system fixes the problem, but this solution eliminates the need for reboot.&lt;br /&gt;
+&lt;br /&gt;
+# Alternative solutions:&lt;br /&gt;
+# Restart the device via the power cord or ctrl-alt-del.&lt;br /&gt;
+&lt;br /&gt;
+# Caveats:&lt;br /&gt;
+# This fix does not detect the occurrence of any error, but rather occurrence of a known event which&lt;br /&gt;
+# reliably preceeds the error and is reliably followed by the error situation.&lt;br /&gt;
+# Error messages and odd behavior may be observed onscreen at the moment of eject, though none of&lt;br /&gt;
+# this causes any side-effects.&lt;br /&gt;
+&lt;br /&gt;
+# Stimulus:&lt;br /&gt;
+# From command: logcat -b main&lt;br /&gt;
+# Output: I DiscPlayerManager: onStartCommand: com.sony.btv.discplayer.EJECT_DISC&lt;br /&gt;
+&lt;br /&gt;
+# Response:&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+# busybox eject /dev/block/sr0&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+&lt;br /&gt;
+# Usage:&lt;br /&gt;
+#   eject_bug_workaround.sh &amp;amp;&lt;br /&gt;
+#   - Runs workaround in background.&lt;br /&gt;
+#   eject_bug_workaround.sh 600 &amp;amp;&lt;br /&gt;
+#   - Sleeps for 600 seconds before running, all in background.&lt;br /&gt;
+#   - Useful for ensuring a window of recovery in case any side-effects occur.&lt;br /&gt;
+&lt;br /&gt;
+if [ ! -z &amp;quot;$1&amp;quot; ]&lt;br /&gt;
+then&lt;br /&gt;
+	sleep $1&lt;br /&gt;
+fi&lt;br /&gt;
+&lt;br /&gt;
+LASTDECT=$(date)&lt;br /&gt;
+&lt;br /&gt;
+logcat -b main DiscPlayerManager:I *:S|busybox awk &#039;&amp;quot;&#039;&amp;quot;&#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {system(&amp;quot;echo onStartCommand: com.sony.btv.discplayer.EJECT_DISC&amp;quot;)}&#039;&amp;quot;&#039;&amp;quot;&#039;|while busybox awk &#039;&amp;quot;&#039;&amp;quot;&#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {exit 0}&#039;&amp;quot;&#039;&amp;quot;&#039;&lt;br /&gt;
+do&lt;br /&gt;
+	if [ &amp;quot;$LASTDECT&amp;quot; != &amp;quot;$(date)&amp;quot; ]&lt;br /&gt;
+	then&lt;br /&gt;
+		echo Detected eject failure.&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+		busybox eject /dev/block/sr0&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+		echo Eject failure repair complete.&lt;br /&gt;
+		LASTDECT=$(date)&lt;br /&gt;
+	fi&lt;br /&gt;
+done&lt;br /&gt;
+&lt;br /&gt;
-- &lt;br /&gt;
1.7.6.1&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;023aa9d02d4ef49af781fc65215d4fc7  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
chmod 755 /system/bin/eject_bug_workaround.sh&lt;br /&gt;
rm $0&lt;br /&gt;
echo Please reboot your GTV via the power cord or ctrl-alt-del for this patch&lt;br /&gt;
echo to take effect.&lt;br /&gt;
echo This patch has a 60 second safety when loaded, so it will not actually run&lt;br /&gt;
echo until the GTV has been fully booted for 60 seconds.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last five lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=756</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=756"/>
		<updated>2012-03-15T14:30:32Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Underbars to spaces.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
A video of the rooting process can be found [http://www.youtube.com/watch?v=tH8vTz01hR4 here]. Thanks icezer0z&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
* This is an advanced procedure and is far outside of normal computer use and designed function for the GTV.  Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware.  Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully.  If you find yourself having trouble, you may want to think long and hard before taking these risks.  If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren&#039;t a company or organization and can&#039;t perform miracles if you break something.&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== USB Drive Validation ===&lt;br /&gt;
&lt;br /&gt;
To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions.  We think they may reduce the chance that your Google TV won&#039;t work at all after the Downgrader/Reboot process.&lt;br /&gt;
# Read data off each of your USB drives by running the same dd/dd.exe command but swap the &amp;quot;if&amp;quot; and &amp;quot;of&amp;quot; and change USB1.img/USB2.img/USB3.img/USB4.img to test1.img/test2.img/test3.img/test4.img.  Also, make sure &amp;quot;bs=4096&amp;quot; is still there, and add &amp;quot;count=1280&amp;quot; for USB1/USB2 or &amp;quot;count=19200&amp;quot; for USB3/USB4.&lt;br /&gt;
# Calculate the MD5 hash (md5sum) of each of test1.img through test4.img.  (It looks like here&#039;s one for Windows, but we haven&#039;t tested it: http://www.pc-tools.net/win32/md5sums/)&lt;br /&gt;
# MD5 hash values should be as listed here (upper or lower case letters are fine):&lt;br /&gt;
#:   USB1 (Eagle): d6a82c60d70b3ecdb8e436ef44043e4c&lt;br /&gt;
#:   USB1 (Asura): f34e34f4d6bed978ed3d0e1afe596b99&lt;br /&gt;
#:   USB2: 4a491d61d836fdcd1f60dc6451f90965&lt;br /&gt;
#:   USB3: ff71d6432a0076a7b818713f3a60eb09&lt;br /&gt;
#:   USB4: 139ba91d8c01e927caced3eefa9fbd55&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# &#039;&#039;&#039;Danger! Danger! Danger! USB3 is really important, and we have no way of checking that you wrote it right and won&#039;t brick your GTV.  Consider using the &amp;quot;USB Drive Validation&amp;quot; steps above to make sure you aren&#039;t dumping garbage all over your GTV.&#039;&#039;&#039;&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. This can be remedied via the [[Eject Bug Hack]]; by removing power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=755</id>
		<title>Patchloader</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=755"/>
		<updated>2012-03-15T14:29:20Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add link to example.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Patchloader framework for packaging solutions for end-user install on GTV.  Intended to make solutions approachable and installs automatic.&lt;br /&gt;
&lt;br /&gt;
This page is only of use to developers.  End-users need not worry about trying to figure out if this will do anything for them.&lt;br /&gt;
An example of a deployed patchloader is here: [[Eject Bug Hack]]&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail -5 $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
&amp;lt;delete this line and insert payload here&amp;gt;&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;GARBAGE&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last five lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=754</id>
		<title>Eject Bug Hack</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=754"/>
		<updated>2012-03-15T14:25:40Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Package the patch into a patchloader for end-user use.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a patchloader that consists of a script to detect and recover from the eject bug and the modification necessary to make that script be run as a service.  The user can follow the instructions below to install this on their GTV.&lt;br /&gt;
&lt;br /&gt;
The install procedure and the workaround itself are run as root, so there is of course the risk that the user could brick their system with no recourse for recovery.  As with any root-related activity, if you can&#039;t afford to lose it, don&#039;t do it.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
# Bluray disc eject workaround, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail -5 $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
---&lt;br /&gt;
 init.eagle.rc                      |    5 +++&lt;br /&gt;
 system/bin/eject_bug_workaround.sh |   53 ++++++++++++++++++++++++++++++++++++&lt;br /&gt;
 2 files changed, 58 insertions(+), 0 deletions(-)&lt;br /&gt;
 create mode 100644 system/bin/eject_bug_workaround.sh&lt;br /&gt;
&lt;br /&gt;
diff --git a/init.eagle.rc b/init.eagle.rc&lt;br /&gt;
index 2004d8a..685ce6f 100644&lt;br /&gt;
--- a/init.eagle.rc&lt;br /&gt;
+++ b/init.eagle.rc&lt;br /&gt;
@@ -329,6 +329,7 @@ on init&lt;br /&gt;
     setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
     export DISCPLAYER_KEEP_DMIX_ASIS true&lt;br /&gt;
     export DISCPLAYER_LOG_VERBOSE true&lt;br /&gt;
+    start ejectworkaround&lt;br /&gt;
 &lt;br /&gt;
   ## for lighttpd&lt;br /&gt;
     mkdir /var/log/lighttpd 0750 system system&lt;br /&gt;
@@ -439,6 +440,10 @@ service discplayer /system/bin/discplayer&lt;br /&gt;
     user root&lt;br /&gt;
     group system&lt;br /&gt;
 &lt;br /&gt;
+service ejectworkaround /system/bin/eject_bug_workaround.sh 60&lt;br /&gt;
+    user root&lt;br /&gt;
+    group system&lt;br /&gt;
+&lt;br /&gt;
 on property:com.sony.btv.discplayer.enable=1&lt;br /&gt;
     start discplayer&lt;br /&gt;
     start discservice&lt;br /&gt;
diff --git a/system/bin/eject_bug_workaround.sh b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
new file mode 100644&lt;br /&gt;
index 0000000..1f4f282&lt;br /&gt;
--- /dev/null&lt;br /&gt;
+++ b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
@@ -0,0 +1,53 @@&lt;br /&gt;
+#!/bin/sh&lt;br /&gt;
+&lt;br /&gt;
+# Reason:&lt;br /&gt;
+# There is a known problem that, for an unknown reason, disc eject fails on rooted NSZ-GT1 systems.&lt;br /&gt;
+# Side effects of this problem include the possibility that the disc is not ejected and in all cases&lt;br /&gt;
+# the problem that discs cannot be played after attempted eject.&lt;br /&gt;
+# Rebooting the system fixes the problem, but this solution eliminates the need for reboot.&lt;br /&gt;
+&lt;br /&gt;
+# Alternative solutions:&lt;br /&gt;
+# Restart the device via the power cord or ctrl-alt-del.&lt;br /&gt;
+&lt;br /&gt;
+# Caveats:&lt;br /&gt;
+# This fix does not detect the occurrence of any error, but rather occurrence of a known event which&lt;br /&gt;
+# reliably preceeds the error and is reliably followed by the error situation.&lt;br /&gt;
+# Error messages and odd behavior may be observed onscreen at the moment of eject, though none of&lt;br /&gt;
+# this causes any side-effects.&lt;br /&gt;
+&lt;br /&gt;
+# Stimulus:&lt;br /&gt;
+# From command: logcat -b main&lt;br /&gt;
+# Output: I DiscPlayerManager: onStartCommand: com.sony.btv.discplayer.EJECT_DISC&lt;br /&gt;
+&lt;br /&gt;
+# Response:&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+# busybox eject /dev/block/sr0&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+&lt;br /&gt;
+# Usage:&lt;br /&gt;
+#   eject_bug_workaround.sh &amp;amp;&lt;br /&gt;
+#   - Runs workaround in background.&lt;br /&gt;
+#   eject_bug_workaround.sh 600 &amp;amp;&lt;br /&gt;
+#   - Sleeps for 600 seconds before running, all in background.&lt;br /&gt;
+#   - Useful for ensuring a window of recovery in case any side-effects occur.&lt;br /&gt;
+&lt;br /&gt;
+if [ ! -z &amp;quot;$1&amp;quot; ]&lt;br /&gt;
+then&lt;br /&gt;
+	sleep $1&lt;br /&gt;
+fi&lt;br /&gt;
+&lt;br /&gt;
+LASTDECT=$(date)&lt;br /&gt;
+&lt;br /&gt;
+logcat -b main DiscPlayerManager:I *:S|busybox awk &#039;&amp;quot;&#039;&amp;quot;&#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {system(&amp;quot;echo onStartCommand: com.sony.btv.discplayer.EJECT_DISC&amp;quot;)}&#039;&amp;quot;&#039;&amp;quot;&#039;|while busybox awk &#039;&amp;quot;&#039;&amp;quot;&#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {exit 0}&#039;&amp;quot;&#039;&amp;quot;&#039;&lt;br /&gt;
+do&lt;br /&gt;
+	if [ &amp;quot;$LASTDECT&amp;quot; != &amp;quot;$(date)&amp;quot; ]&lt;br /&gt;
+	then&lt;br /&gt;
+		echo Detected eject failure.&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+		busybox eject /dev/block/sr0&lt;br /&gt;
+		setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+		echo Eject failure repair complete.&lt;br /&gt;
+		LASTDECT=$(date)&lt;br /&gt;
+	fi&lt;br /&gt;
+done&lt;br /&gt;
+&lt;br /&gt;
-- &lt;br /&gt;
1.7.6.1&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;023aa9d02d4ef49af781fc65215d4fc7  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
chmod 755 /system/bin/eject_bug_workaround.sh&lt;br /&gt;
rm $0&lt;br /&gt;
echo Please reboot your GTV via the power cord or ctrl-alt-del for this patch&lt;br /&gt;
echo to take effect.&lt;br /&gt;
echo This patch has a 60 second safety when loaded, so it will not actually run&lt;br /&gt;
echo until the GTV has been fully booted for 60 seconds.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last five lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=753</id>
		<title>Patchloader</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=753"/>
		<updated>2012-03-15T14:20:18Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Minor fixes from testing.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Patchloader framework for packaging solutions for end-user install on GTV.  Intended to make solutions approachable and installs automatic.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail -5 $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
&amp;lt;delete this line and insert payload here&amp;gt;&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;GARBAGE&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo &amp;quot;$MD5_CALC&amp;quot;&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last five lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=752</id>
		<title>Patchloader</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=752"/>
		<updated>2012-03-15T02:45:28Z</updated>

		<summary type="html">&lt;p&gt;Catrane: bash -&amp;gt; sh&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Patchloader framework for packaging solutions for end-user install on GTV.  Intended to make solutions approachable and installs automatic.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
&amp;lt;delete this line and insert payload here&amp;gt;&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;GARBAGE&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo $MD5_CALC&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last ten lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=751</id>
		<title>Patchloader</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Patchloader&amp;diff=751"/>
		<updated>2012-03-14T21:12:02Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Patchloader script for packaging solutions for end-user install on GTV.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Patchloader framework for packaging solutions for end-user install on GTV.  Intended to make solutions approachable and installs automatic.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;#!/bin/bash&lt;br /&gt;
&lt;br /&gt;
# patchloader, by Catrane&lt;br /&gt;
#&lt;br /&gt;
# DEVELOPER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# Search for these sections below:&lt;br /&gt;
#  PRE PATCH, PATCH PAYLOAD, PATCH MD5, POST PATCH, and USER INSTRUCTIONS.&lt;br /&gt;
# Follow directions in each section.&lt;br /&gt;
# Do not modify any other sections.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER TRUNCATION CHECK&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox tail $0 | grep -q &amp;quot;[P]ATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Patchloader truncated.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
&lt;br /&gt;
# END PRE PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# PATCH PAYLOAD&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add patch content after the &amp;quot;echo&amp;quot; line here.  Be sure to escape any&lt;br /&gt;
# characters as necessary and adjust dos2unix/unix2dos settings as appropriate.&lt;br /&gt;
echo &#039;&lt;br /&gt;
&amp;lt;delete this line and insert payload here&amp;gt;&lt;br /&gt;
&#039; | busybox dos2unix -u &amp;gt; patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# PATCH MD5&lt;br /&gt;
# -----------------&lt;br /&gt;
# Calculate the MD5 hash of the patch file and set here for validation.&lt;br /&gt;
# Note that the script above starts and ends with a linefeed, so the best way to&lt;br /&gt;
# get the right value is to run the script with &amp;quot;GARBAGE&amp;quot; as the MD5 below and&lt;br /&gt;
# let it tell you the right value.&lt;br /&gt;
PATCH_MD5=&amp;quot;GARBAGE&amp;quot; # PATCH_MD5=&amp;quot;f7be3e1337c0d37b2850fabed5469d34  patchloader.patch&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# MD5 VALIDATION&lt;br /&gt;
# -----------------&lt;br /&gt;
MD5_CALC=&amp;quot;`busybox md5sum patchloader.patch`&amp;quot;&lt;br /&gt;
if [ &amp;quot;$PATCH_MD5&amp;quot; != &amp;quot;$MD5_CALC&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	if [ &amp;quot;GARBAGE&amp;quot; != &amp;quot;$PATCH_MD5&amp;quot; ]&lt;br /&gt;
	then&lt;br /&gt;
		echo &amp;quot;FATAL: Failure to validate patch integrity.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	else&lt;br /&gt;
		echo &amp;quot;patchloader MD5 hash is as follows.  Users should not see this message.&amp;quot;&lt;br /&gt;
		echo $MD5_CALC&lt;br /&gt;
	fi&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
# PATCH APPLICATION&lt;br /&gt;
# -----------------&lt;br /&gt;
busybox patch -p1 &amp;lt; patchloader.patch&lt;br /&gt;
if [ &amp;quot;$?&amp;quot; != &amp;quot;0&amp;quot; ]&lt;br /&gt;
then&lt;br /&gt;
	echo &amp;quot;FATAL: Error patching.  Please redownload and try again.&amp;quot;&lt;br /&gt;
	rm patchloader.patch&lt;br /&gt;
	exit&lt;br /&gt;
fi&lt;br /&gt;
rm patchloader.patch&lt;br /&gt;
&lt;br /&gt;
# POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
# Add any commands below which should be run prior to applying the patch.&lt;br /&gt;
# Include here any instructions for user to reboot if necessary.&lt;br /&gt;
&lt;br /&gt;
# END POST PATCH&lt;br /&gt;
# -----------------&lt;br /&gt;
&lt;br /&gt;
# USER INSTRUCTIONS&lt;br /&gt;
# -----------------&lt;br /&gt;
# The patch developer should move these instructions to directly above the&lt;br /&gt;
# &amp;quot;DEVELOPER INSTRUCTIONS&amp;quot; line atop this file, deleting these three&lt;br /&gt;
# developer instructions lines.&lt;br /&gt;
# 1) Save the full contents of this patchloader file to your computer.  This may&lt;br /&gt;
#    involve copying and pasting, or just downloading.&lt;br /&gt;
# 2) Connect to your device using adb.  adb usage is outside the scope of this&lt;br /&gt;
#    document.&lt;br /&gt;
# 3) Transfer this patchloader file to your device via adb so that it exists as&lt;br /&gt;
#    /patchloader.sh on your device.&lt;br /&gt;
#    e.g. adb push patchloader.sh /patchloader.sh&lt;br /&gt;
# 4) Execute the patchloader by running the following command via adb.&lt;br /&gt;
#    adb shell /bin/sh /patchloader.sh&lt;br /&gt;
# 5) Follow any instructions printed out by the patchloader.&lt;br /&gt;
&lt;br /&gt;
# PATCHLOADER END FILE SIGNATURE&lt;br /&gt;
# -----------------&lt;br /&gt;
# Do not remove this PATCHLOADER END FILE SIGNATURE from the end of the file or&lt;br /&gt;
# place anything after it.  Pretty much, the text &amp;quot;PATCHLOADER END FILE SIGNATURE&amp;quot;&lt;br /&gt;
# needs to be in the last ten lines so we can make sure nothing is missing.&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=749</id>
		<title>Eject Bug Hack</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=749"/>
		<updated>2012-03-14T04:41:10Z</updated>

		<summary type="html">&lt;p&gt;Catrane: add basic info (not good info)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a git patch that consists of a script to detect and recover from the eject bug and the modification necessary to make that script be run as a service.  Nothing about this install process is automatic, though once installed it runs fully automatic.  If you don&#039;t know how to read a git patch, you&#039;d best learn how.  Improper application of the contents of this patch to your system could certainly brick it.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
&lt;br /&gt;
Description of what follows, to clarify why it is this way:&lt;br /&gt;
The patch can only be applied to a GTV by manually reading the patch and making the changes described within it by hand.  It&#039;s merely packaged as a git patch because, well, git is damn awesome and if you can read a git patch it&#039;s impossible for the meaning of it to be misunderstood.  Git patches are a detailed documenting of additions, deletions, and context.&lt;br /&gt;
&lt;br /&gt;
The patch is divided into sections, the top being a basic email header that serves to identify who, when, and what; following that is a list of files affected, including a line of +/- indicating quantity of insertions and deletions, and note of any new files added or old files deleted along with standard UNIX permissions for those files; following this, the diff of each file affected is included with the format described above.  Within the diff, any line that begins with a &amp;quot;+&amp;quot; is an inserted line.  Any line that begins with a &amp;quot;-&amp;quot; is a removed line (there are none here).  Lines around those lines are context.  The lines that begin with &amp;quot;@@&amp;quot; indicate which line numbers the context included in the patch should be found at, and what the line numbers should be after the changes.&lt;br /&gt;
&lt;br /&gt;
It was packaged this way for convenience of publishing the information.  I&#039;m told it can be applied via the patch command included in busybox on the rooted GTV.  Super cool.  Hopefully someone can fix up my crappy documentation with something a little more usable.&lt;br /&gt;
&lt;br /&gt;
Unformatted patch follows:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;From f5b9194ad7865bfdaf43ad676965ff77c5895465 Mon Sep 17 00:00:00 2001&lt;br /&gt;
From: Catrane &amp;lt;catrane@gtvhacker&amp;gt;&lt;br /&gt;
Date: Mon, 12 Mar 2012 23:21:14 -0500&lt;br /&gt;
Subject: [PATCH] Hack workaround to make disc eject work on rooted NSZ-GT1.&lt;br /&gt;
 Includes 60 second delay before activating as a safety&lt;br /&gt;
 window.&lt;br /&gt;
&lt;br /&gt;
---&lt;br /&gt;
 init.eagle.rc                      |    5 +++&lt;br /&gt;
 system/bin/eject_bug_workaround.sh |   53 ++++++++++++++++++++++++++++++++++++&lt;br /&gt;
 2 files changed, 58 insertions(+), 0 deletions(-)&lt;br /&gt;
 create mode 100644 system/bin/eject_bug_workaround.sh&lt;br /&gt;
&lt;br /&gt;
diff --git a/init.eagle.rc b/init.eagle.rc&lt;br /&gt;
index 2004d8a..685ce6f 100644&lt;br /&gt;
--- a/init.eagle.rc&lt;br /&gt;
+++ b/init.eagle.rc&lt;br /&gt;
@@ -329,6 +329,7 @@ on init&lt;br /&gt;
     setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
     export DISCPLAYER_KEEP_DMIX_ASIS true&lt;br /&gt;
     export DISCPLAYER_LOG_VERBOSE true&lt;br /&gt;
+    start ejectworkaround&lt;br /&gt;
 &lt;br /&gt;
   ## for lighttpd&lt;br /&gt;
     mkdir /var/log/lighttpd 0750 system system&lt;br /&gt;
@@ -439,6 +440,10 @@ service discplayer /system/bin/discplayer&lt;br /&gt;
     user root&lt;br /&gt;
     group system&lt;br /&gt;
 &lt;br /&gt;
+service ejectworkaround /system/bin/eject_bug_workaround.sh 60&lt;br /&gt;
+    user root&lt;br /&gt;
+    group system&lt;br /&gt;
+&lt;br /&gt;
 on property:com.sony.btv.discplayer.enable=1&lt;br /&gt;
     start discplayer&lt;br /&gt;
     start discservice&lt;br /&gt;
diff --git a/system/bin/eject_bug_workaround.sh b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
new file mode 100644&lt;br /&gt;
index 0000000..1f4f282&lt;br /&gt;
--- /dev/null&lt;br /&gt;
+++ b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
@@ -0,0 +1,53 @@&lt;br /&gt;
+#!/bin/sh&lt;br /&gt;
+&lt;br /&gt;
+# Reason:&lt;br /&gt;
+# There is a known problem that, for an unknown reason, disc eject fails on rooted NSZ-GT1 systems.&lt;br /&gt;
+# Side effects of this problem include the possibility that the disc is not ejected and in all cases&lt;br /&gt;
+# the problem that discs cannot be played after attempted eject.&lt;br /&gt;
+# Rebooting the system fixes the problem, but this solution eliminates the need for reboot.&lt;br /&gt;
+&lt;br /&gt;
+# Alternative solutions:&lt;br /&gt;
+# Restart the device via the power cord or ctrl-alt-del.&lt;br /&gt;
+&lt;br /&gt;
+# Caveats:&lt;br /&gt;
+# This fix does not detect the occurrence of any error, but rather occurrence of a known event which&lt;br /&gt;
+# reliably preceeds the error and is reliably followed by the error situation.&lt;br /&gt;
+# Error messages and odd behavior may be observed onscreen at the moment of eject, though none of&lt;br /&gt;
+# this causes any side-effects.&lt;br /&gt;
+&lt;br /&gt;
+# Stimulus:&lt;br /&gt;
+# From command: logcat -b main&lt;br /&gt;
+# Output: I DiscPlayerManager: onStartCommand: com.sony.btv.discplayer.EJECT_DISC&lt;br /&gt;
+&lt;br /&gt;
+# Response:&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+# busybox eject /dev/block/sr0&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+&lt;br /&gt;
+# Usage:&lt;br /&gt;
+#   eject_bug_workaround.sh &amp;amp;&lt;br /&gt;
+#   - Runs workaround in background.&lt;br /&gt;
+#   eject_bug_workaround.sh 600 &amp;amp;&lt;br /&gt;
+#   - Sleeps for 600 seconds before running, all in background.&lt;br /&gt;
+#   - Useful for ensuring a window of recovery in case any side-effects occur.&lt;br /&gt;
+&lt;br /&gt;
+if [ ! -z &amp;quot;$1&amp;quot; ]&lt;br /&gt;
+then&lt;br /&gt;
+   sleep $1&lt;br /&gt;
+fi&lt;br /&gt;
+&lt;br /&gt;
+LASTDECT=$(date)&lt;br /&gt;
+&lt;br /&gt;
+logcat -b main DiscPlayerManager:I *:S|busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {system(&amp;quot;echo onStartCommand: com.sony.btv.discplayer.EJECT_DISC&amp;quot;)}&#039;|while busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {exit 0}&#039;&lt;br /&gt;
+do&lt;br /&gt;
+   if [ &amp;quot;$LASTDECT&amp;quot; != &amp;quot;$(date)&amp;quot; ]&lt;br /&gt;
+   then&lt;br /&gt;
+       echo Detected eject failure.&lt;br /&gt;
+       setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+       busybox eject /dev/block/sr0&lt;br /&gt;
+       setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+       echo Eject failure repair complete.&lt;br /&gt;
+       LASTDECT=$(date)&lt;br /&gt;
+   fi&lt;br /&gt;
+done&lt;br /&gt;
+&lt;br /&gt;
-- &lt;br /&gt;
1.7.6.1&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=748</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=748"/>
		<updated>2012-03-13T04:53:17Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Known Issues */   Add Eject Bug Hack&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
A video of the rooting process can be found [http://www.youtube.com/watch?v=tH8vTz01hR4 here]. Thanks icezer0z&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
* This is an advanced procedure and is far outside of normal computer use and designed function for the GTV.  Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware.  Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully.  If you find yourself having trouble, you may want to think long and hard before taking these risks.  If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren&#039;t a company or organization and can&#039;t perform miracles if you break something.&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== USB Drive Validation ===&lt;br /&gt;
&lt;br /&gt;
To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions.  We think they may reduce the chance that your Google TV won&#039;t work at all after the Downgrader/Reboot process.&lt;br /&gt;
# Read data off each of your USB drives by running the same dd/dd.exe command but swap the &amp;quot;if&amp;quot; and &amp;quot;of&amp;quot; and change USB1.img/USB2.img/USB3.img/USB4.img to test1.img/test2.img/test3.img/test4.img.  Also, make sure &amp;quot;bs=4096&amp;quot; is still there, and add &amp;quot;count=1280&amp;quot; for USB1/USB2 or &amp;quot;count=19200&amp;quot; for USB3/USB4.&lt;br /&gt;
# Calculate the MD5 hash (md5sum) of each of test1.img through test4.img.  (It looks like here&#039;s one for Windows, but we haven&#039;t tested it: http://www.pc-tools.net/win32/md5sums/)&lt;br /&gt;
# MD5 hash values should be as listed here (upper or lower case letters are fine):&lt;br /&gt;
#:   USB1 (Eagle): d6a82c60d70b3ecdb8e436ef44043e4c&lt;br /&gt;
#:   USB1 (Asura): f34e34f4d6bed978ed3d0e1afe596b99&lt;br /&gt;
#:   USB2: 4a491d61d836fdcd1f60dc6451f90965&lt;br /&gt;
#:   USB3: ff71d6432a0076a7b818713f3a60eb09&lt;br /&gt;
#:   USB4: 139ba91d8c01e927caced3eefa9fbd55&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# &#039;&#039;&#039;Danger! Danger! Danger! USB3 is really important, and we have no way of checking that you wrote it right and won&#039;t brick your GTV.  Consider using the &amp;quot;USB Drive Validation&amp;quot; steps above to make sure you aren&#039;t dumping garbage all over your GTV.&#039;&#039;&#039;&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. This can be remedied via the [[Eject_Bug_Hack]]; by removing power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=747</id>
		<title>Eject Bug Hack</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Eject_Bug_Hack&amp;diff=747"/>
		<updated>2012-03-13T04:52:36Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add patch describing eject bug workaround.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a git patch that consists of a script to detect and recover from the eject bug and the modification necessary to make that script be run as a service.  Nothing about this install process is automatic, though once installed it runs fully automatic.  If you don&#039;t know how to read a git patch, you&#039;d best learn how.  Improper application of the contents of this patch to your system could certainly brick it.&lt;br /&gt;
&lt;br /&gt;
Unformatted patch follows:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;From f5b9194ad7865bfdaf43ad676965ff77c5895465 Mon Sep 17 00:00:00 2001&lt;br /&gt;
From: Catrane &amp;lt;catrane@gtvhacker&amp;gt;&lt;br /&gt;
Date: Mon, 12 Mar 2012 23:21:14 -0500&lt;br /&gt;
Subject: [PATCH] Hack workaround to make disc eject work on rooted NSZ-GT1.&lt;br /&gt;
 Includes 60 second delay before activating as a safety&lt;br /&gt;
 window.&lt;br /&gt;
&lt;br /&gt;
---&lt;br /&gt;
 init.eagle.rc                      |    5 +++&lt;br /&gt;
 system/bin/eject_bug_workaround.sh |   53 ++++++++++++++++++++++++++++++++++++&lt;br /&gt;
 2 files changed, 58 insertions(+), 0 deletions(-)&lt;br /&gt;
 create mode 100644 system/bin/eject_bug_workaround.sh&lt;br /&gt;
&lt;br /&gt;
diff --git a/init.eagle.rc b/init.eagle.rc&lt;br /&gt;
index 2004d8a..685ce6f 100644&lt;br /&gt;
--- a/init.eagle.rc&lt;br /&gt;
+++ b/init.eagle.rc&lt;br /&gt;
@@ -329,6 +329,7 @@ on init&lt;br /&gt;
     setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
     export DISCPLAYER_KEEP_DMIX_ASIS true&lt;br /&gt;
     export DISCPLAYER_LOG_VERBOSE true&lt;br /&gt;
+    start ejectworkaround&lt;br /&gt;
 &lt;br /&gt;
   ## for lighttpd&lt;br /&gt;
     mkdir /var/log/lighttpd 0750 system system&lt;br /&gt;
@@ -439,6 +440,10 @@ service discplayer /system/bin/discplayer&lt;br /&gt;
     user root&lt;br /&gt;
     group system&lt;br /&gt;
 &lt;br /&gt;
+service ejectworkaround /system/bin/eject_bug_workaround.sh 60&lt;br /&gt;
+    user root&lt;br /&gt;
+    group system&lt;br /&gt;
+&lt;br /&gt;
 on property:com.sony.btv.discplayer.enable=1&lt;br /&gt;
     start discplayer&lt;br /&gt;
     start discservice&lt;br /&gt;
diff --git a/system/bin/eject_bug_workaround.sh b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
new file mode 100644&lt;br /&gt;
index 0000000..1f4f282&lt;br /&gt;
--- /dev/null&lt;br /&gt;
+++ b/system/bin/eject_bug_workaround.sh&lt;br /&gt;
@@ -0,0 +1,53 @@&lt;br /&gt;
+#!/bin/sh&lt;br /&gt;
+&lt;br /&gt;
+# Reason:&lt;br /&gt;
+# There is a known problem that, for an unknown reason, disc eject fails on rooted NSZ-GT1 systems.&lt;br /&gt;
+# Side effects of this problem include the possibility that the disc is not ejected and in all cases&lt;br /&gt;
+# the problem that discs cannot be played after attempted eject.&lt;br /&gt;
+# Rebooting the system fixes the problem, but this solution eliminates the need for reboot.&lt;br /&gt;
+&lt;br /&gt;
+# Alternative solutions:&lt;br /&gt;
+# Restart the device via the power cord or ctrl-alt-del.&lt;br /&gt;
+&lt;br /&gt;
+# Caveats:&lt;br /&gt;
+# This fix does not detect the occurrence of any error, but rather occurrence of a known event which&lt;br /&gt;
+# reliably preceeds the error and is reliably followed by the error situation.&lt;br /&gt;
+# Error messages and odd behavior may be observed onscreen at the moment of eject, though none of&lt;br /&gt;
+# this causes any side-effects.&lt;br /&gt;
+&lt;br /&gt;
+# Stimulus:&lt;br /&gt;
+# From command: logcat -b main&lt;br /&gt;
+# Output: I DiscPlayerManager: onStartCommand: com.sony.btv.discplayer.EJECT_DISC&lt;br /&gt;
+&lt;br /&gt;
+# Response:&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+# busybox eject /dev/block/sr0&lt;br /&gt;
+# setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+&lt;br /&gt;
+# Usage:&lt;br /&gt;
+#   eject_bug_workaround.sh &amp;amp;&lt;br /&gt;
+#   - Runs workaround in background.&lt;br /&gt;
+#   eject_bug_workaround.sh 600 &amp;amp;&lt;br /&gt;
+#   - Sleeps for 600 seconds before running, all in background.&lt;br /&gt;
+#   - Useful for ensuring a window of recovery in case any side-effects occur.&lt;br /&gt;
+&lt;br /&gt;
+if [ ! -z &amp;quot;$1&amp;quot; ]&lt;br /&gt;
+then&lt;br /&gt;
+   sleep $1&lt;br /&gt;
+fi&lt;br /&gt;
+&lt;br /&gt;
+LASTDECT=$(date)&lt;br /&gt;
+&lt;br /&gt;
+logcat -b main DiscPlayerManager:I *:S|busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {system(&amp;quot;echo onStartCommand: com.sony.btv.discplayer.EJECT_DISC&amp;quot;)}&#039;|while busybox awk &#039;/onStartCommand: com.sony.btv.discplayer.EJECT_DISC/ {exit 0}&#039;&lt;br /&gt;
+do&lt;br /&gt;
+   if [ &amp;quot;$LASTDECT&amp;quot; != &amp;quot;$(date)&amp;quot; ]&lt;br /&gt;
+   then&lt;br /&gt;
+       echo Detected eject failure.&lt;br /&gt;
+       setprop com.sony.btv.discplayer.enable 0&lt;br /&gt;
+       busybox eject /dev/block/sr0&lt;br /&gt;
+       setprop com.sony.btv.discplayer.enable 1&lt;br /&gt;
+       echo Eject failure repair complete.&lt;br /&gt;
+       LASTDECT=$(date)&lt;br /&gt;
+   fi&lt;br /&gt;
+done&lt;br /&gt;
+&lt;br /&gt;
-- &lt;br /&gt;
1.7.6.1&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=743</id>
		<title>Main Page/Devices</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=743"/>
		<updated>2012-03-09T05:22:14Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Complete&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Current Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;logitech_section&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot;&lt;br /&gt;
| [[File:Revue-advert.gif|180px]]&lt;br /&gt;
|&lt;br /&gt;
*[[Steps to get root ]]&lt;br /&gt;
*[http://forum.gtvhacker.com/revue/ Join the Revue forum! ]&lt;br /&gt;
*[http://gtvhacker.com/blog/2011/logitech-revue-software-root/ Why no software root? ]&lt;br /&gt;
&lt;br /&gt;
*[http://gtvhacker.com/index.php/Category:Logitech_Revue Info on Logitech Revue]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSX-40GT1.jpg|180px]] &lt;br /&gt;
| colspan=&amp;quot;2&amp;quot;| &lt;br /&gt;
*[[Sony NSX-40GT1 (Internet TV)]]&lt;br /&gt;
*[http://forum.gtvhacker.com/nsx-40gt1/ Join the nsx-40gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSZ_GT1.jpg|180px]]&lt;br /&gt;
|colspan=&amp;quot;2&amp;quot;|&lt;br /&gt;
&lt;br /&gt;
*[[Sony NSZ-GT1 (Bluray Player)]] &lt;br /&gt;
*[http://forum.gtvhacker.com/nsz-gt1/ Join the nsz-gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
*[[Sony GTV Troubleshooting]]&lt;br /&gt;
*[[Sony Settings Menus]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Upcoming Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;vizio_section&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;[[Vizio]]&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Samsung&#039;&#039;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=742</id>
		<title>Sony Settings Menus</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=742"/>
		<updated>2012-03-09T05:18:33Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Finish the list&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Because I found these menus so disorganized that I needed to write them down.  Also for handy reference when helping other GTV users.  These are taken from an NSZ-GT1 Blu-ray Google TV running 3.2 root.  Owners of the TV model can note any differences as they see them.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Network&#039;&#039;&#039;&lt;br /&gt;
*:Manage Internet Connection&lt;br /&gt;
**&#039;&#039;&#039;Ethernet&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Wi-Fi&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Status&#039;&#039;&#039;&lt;br /&gt;
**:View detailed network status&lt;br /&gt;
***&#039;&#039;&#039;IP address&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Ethernet MAC address&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Wi-Fi MAC address&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Local network&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Internet&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Ethernet&#039;&#039;&#039; (connection status)&lt;br /&gt;
***&#039;&#039;&#039;Wi-Fi&#039;&#039;&#039; (connection status)&lt;br /&gt;
***&#039;&#039;&#039;Private network&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Home network setup&#039;&#039;&#039;&lt;br /&gt;
**:Set up home network connections&lt;br /&gt;
***&#039;&#039;&#039;Edit device name&#039;&#039;&#039; (default = Sony Internet TV)&lt;br /&gt;
***&#039;&#039;&#039;Manage paired remote applications&#039;&#039;&#039;&lt;br /&gt;
***:Remove pair remote application for mobile&lt;br /&gt;
*&#039;&#039;&#039;Video input&#039;&#039;&#039;&lt;br /&gt;
*:Set up TV service provider&lt;br /&gt;
*:Lists configured devices.  Scans for sources and allows manual addition of devices.&lt;br /&gt;
**&#039;&#039;&#039;Edit channel list&#039;&#039;&#039;&lt;br /&gt;
**:Select the channels this device receives&lt;br /&gt;
**&#039;&#039;&#039;IR Blaster settings&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Advanced settings&#039;&#039;&#039;&lt;br /&gt;
****&#039;&#039;&#039;Zero padding&#039;&#039;&#039; (2..6 digits.  Default = Minimum)&lt;br /&gt;
****:Set the channel number digits&lt;br /&gt;
****&#039;&#039;&#039;Key interval&#039;&#039;&#039; (100..1000 by 50s.  Default = 250 msec)&lt;br /&gt;
****:Set the transmission interval for the channel number&lt;br /&gt;
****&#039;&#039;&#039;Send an &amp;quot;Enter&amp;quot; command (checkbox.  Default = checked)&lt;br /&gt;
****:Send an &amp;quot;Enter&amp;quot; command after the channel number&lt;br /&gt;
****&#039;&#039;&#039;Test&#039;&#039;&#039; (launches test)&lt;br /&gt;
****:Check if the setting is correct&lt;br /&gt;
***&#039;&#039;&#039;Type&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Code&#039;&#039;&#039; (allows manual entry of code)&lt;br /&gt;
**&#039;&#039;&#039;HD channels&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Enabled access to HD channels&lt;br /&gt;
**&#039;&#039;&#039;Disconnect device&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Default TV device&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Edit channel lineup&#039;&#039;&#039; (launches provider selection)&lt;br /&gt;
*&#039;&#039;&#039;TV &amp;amp; AVR&#039;&#039;&#039;&lt;br /&gt;
*:Set the IR Blaster to control the TV &amp;amp; AV Receiver&lt;br /&gt;
**&#039;&#039;&#039;TV control setting&#039;&#039;&#039; (opens manufacturer list)&lt;br /&gt;
**&#039;&#039;&#039;AV Receiver setting&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Control with IR Blaster&#039;&#039;&#039; (checkbox)&lt;br /&gt;
***:Mark the checkbox to control the AV Receiver with the IR Blaster&lt;br /&gt;
***&#039;&#039;&#039;Manufacturer&#039;&#039;&#039; (manually sets manufacturer)&lt;br /&gt;
***&#039;&#039;&#039;Code&#039;&#039;&#039; (manually sets code)&lt;br /&gt;
***&#039;&#039;&#039;IR Blaster test&#039;&#039;&#039; (launches test)&lt;br /&gt;
**&#039;&#039;&#039;Enable TV control&#039;&#039;&#039; (checkbox)&lt;br /&gt;
**:Mark the checkbox to control the TV with the IR Blaster&lt;br /&gt;
**&#039;&#039;&#039;TV &amp;amp; volume control settings&#039;&#039;&#039;&lt;br /&gt;
**:Available when Enable TV control is set to On&lt;br /&gt;
***:You can check if the setting is correct&lt;br /&gt;
*&#039;&#039;&#039;Picture &amp;amp; sound&#039;&#039;&#039;&lt;br /&gt;
*:Adjust the picture and sound&lt;br /&gt;
**&#039;&#039;&#039;3D settings&#039;&#039;&#039;&lt;br /&gt;
**:Change the 3D viewing environment&lt;br /&gt;
***&#039;&#039;&#039;3D output setting&#039;&#039;&#039;&lt;br /&gt;
***:Choose whether to output in 2D or 3D&lt;br /&gt;
***: Auto/Off (default = Auto)&lt;br /&gt;
***&#039;&#039;&#039;TV screen size setting for 3D BD&#039;&#039;&#039;&lt;br /&gt;
***:Set the screen size for 3D Blu-ray movies&lt;br /&gt;
***:Three-digit selector for screen size in inches.  (default = 46)&lt;br /&gt;
**&#039;&#039;&#039;Resolution&#039;&#039;&#039;&lt;br /&gt;
**:Select preferred TV resolution&lt;br /&gt;
**:Auto/1080p/1080i/720p (3D will not work unless set to Auto.  Default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Picture size&#039;&#039;&#039; (launches overscan calibration utility from initial setup)&lt;br /&gt;
**:Maximize your screen area&lt;br /&gt;
**&#039;&#039;&#039;Screen format&#039;&#039;&#039;&lt;br /&gt;
**:Set the source&#039;s aspect ratio when it differs from the TV&lt;br /&gt;
**:Original/Fixed aspect ratio (default = Original)&lt;br /&gt;
**&#039;&#039;&#039;YCbCr/RGB (HDMI&#039;&#039;&#039;&lt;br /&gt;
**:Set the color space conversion for the video signal from HDMI&lt;br /&gt;
**:Auto/YCbCr(4:4:4)/RGB (default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Noise reduction&#039;&#039;&#039;&lt;br /&gt;
**:Reduce repetitive random noise&lt;br /&gt;
**:High/Medium/Low/Off (default = Off)&lt;br /&gt;
**&#039;&#039;&#039;Screen saver&#039;&#039;&#039;&lt;br /&gt;
**:Set the screen saver&lt;br /&gt;
**:Off/10 min/30 min/1 h/2 h/3 h&lt;br /&gt;
**&#039;&#039;&#039;Audio (HDMI)&#039;&#039;&#039; (inactive)&lt;br /&gt;
**&#039;&#039;&#039;Audio output priority&#039;&#039;&#039;&lt;br /&gt;
**:Set the jack type for audio equipment connection&lt;br /&gt;
**:HDMI/Optical (default = HDMI)&lt;br /&gt;
**&#039;&#039;&#039;BD audio mix setting&#039;&#039;&#039;&lt;br /&gt;
**:Set whether to mix interactive audio and output&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Dolby Digital (Optical)&#039;&#039;&#039;&lt;br /&gt;
**:Set the Dolby Digital output signal from DIGITAL OUT&lt;br /&gt;
**:Off (Downmix PCM)/On (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Dolby Digital pass-through&#039;&#039;&#039;&lt;br /&gt;
**:Send Dolby Digital signals from HDMI devices to your audio system&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;DTS (Optical)&#039;&#039;&#039;&lt;br /&gt;
**:Set the DTS output signal from DIGITAL OUT&lt;br /&gt;
**:Off (Downmix PCM)/On (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Audio DRC&#039;&#039;&#039;&lt;br /&gt;
**:Set the sound effect when playing a BD or DVD&lt;br /&gt;
**:Auto/Standard/TV mode/Wide range (default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Downmix&#039;&#039;&#039;&lt;br /&gt;
**:Apply the surround effect to the output audio signal&lt;br /&gt;
**:Surround/Stereo (default = Surround)&lt;br /&gt;
**&#039;&#039;&#039;AV sync&#039;&#039;&#039;&lt;br /&gt;
**:Adjust the timing between picture and sound&lt;br /&gt;
**:0-120 msec at increments of 10 msec&lt;br /&gt;
**&#039;&#039;&#039;Sound effects&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Enable sound effects&lt;br /&gt;
**&#039;&#039;&#039;Notification sounds&#039;&#039;&#039; (Silent/Default.  Default = Silent)&lt;br /&gt;
**&#039;&#039;&#039;Text-to-speech&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Listen to an example&#039;&#039;&#039;&lt;br /&gt;
***:Play a short demonstration of speech synthesis&lt;br /&gt;
***&#039;&#039;&#039;Always use my settings&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
***:Default settings below override application settings&lt;br /&gt;
***&#039;&#039;&#039;Default Engine&#039;&#039;&#039; (only option is Pico TTS)&lt;br /&gt;
***:Sets the speech synthesis engine to be used for spoken text&lt;br /&gt;
***&#039;&#039;&#039;Install voice data&#039;&#039;&#039;&lt;br /&gt;
***:Install the voice data required for speech synthesis&lt;br /&gt;
***&#039;&#039;&#039;Speech rate&#039;&#039;&#039;&lt;br /&gt;
***:Speed at which the text is spoken&lt;br /&gt;
***:Very slow/Slow/Normal/Fast/Very fast&lt;br /&gt;
***&#039;&#039;&#039;Language&#039;&#039;&#039; (only option is English (United States))&lt;br /&gt;
***:Sets the language-specific voice for the spoken text&lt;br /&gt;
***&#039;&#039;&#039;Pico TTS&#039;&#039;&#039;&lt;br /&gt;
***:Pico TTS settings&lt;br /&gt;
*&#039;&#039;&#039;Disc Player settings&#039;&#039;&#039;&lt;br /&gt;
*:Change general settings&lt;br /&gt;
**&#039;&#039;&#039;Timer&#039;&#039;&#039;&lt;br /&gt;
**:Set timer to power on or off&lt;br /&gt;
**:Displays artsy clock.  Allows multiple setting timers for on or off (or so it appears) to time, day of week, and duration, as well as sleep timer of 15-120 minutes.&lt;br /&gt;
**&#039;&#039;&#039;Eco&#039;&#039;&#039;&lt;br /&gt;
**:Change the settings related to power consumption&lt;br /&gt;
***&#039;&#039;&#039;Quick start&#039;&#039;&#039;&lt;br /&gt;
***:Set the unit to power on quickly&lt;br /&gt;
***:On/Off.  Unit powers on much more quickly but consumes more power while powered off.&lt;br /&gt;
***&#039;&#039;&#039;Auto standby&#039;&#039;&#039;&lt;br /&gt;
***:The unit automatically turns off after 2 hours of non-operation.&lt;br /&gt;
***:On/Off (default = Off)&lt;br /&gt;
**&#039;&#039;&#039;HDMI settings&#039;&#039;&#039;&lt;br /&gt;
**:Change the settings for controlling compatible HDMI devices&lt;br /&gt;
***&#039;&#039;&#039;Control for HDMI&#039;&#039;&#039;&lt;br /&gt;
***:Control the unit with the HDMI-connected TV&lt;br /&gt;
***:On/Off (default = On)&lt;br /&gt;
***&#039;&#039;&#039;Unit auto power off&#039;&#039;&#039;&lt;br /&gt;
***:Power off unit when the HDMI-connected TV is turned off&lt;br /&gt;
***:On/Off (depends on previous option On.  Default = Off)&lt;br /&gt;
**&#039;&#039;&#039;Cinema conversion mode&#039;&#039;&#039;&lt;br /&gt;
**:Set the conversion method for video or film material&lt;br /&gt;
**:Auto/Video&lt;br /&gt;
**&#039;&#039;&#039;BD-ROM 1080/24p output&#039;&#039;&#039;&lt;br /&gt;
**:Output a 1080/24p video signal from HDMI&lt;br /&gt;
**:Auto/Off&lt;br /&gt;
**&#039;&#039;&#039;Auto display&#039;&#039;&#039;&lt;br /&gt;
**:Display info when switching audio modes or during playback&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;BD/DVD viewing settings&#039;&#039;&#039;&lt;br /&gt;
**:Set the language displayed on BD or DVD menus&lt;br /&gt;
***&#039;&#039;&#039;BD/DVD menu&#039;&#039;&#039; (opens language selector)&lt;br /&gt;
***:Set the language displayed on BD or DVD menus&lt;br /&gt;
***&#039;&#039;&#039;Audio&#039;&#039;&#039; (opens language selector.  Default = Original)&lt;br /&gt;
***:Set the audio language when playing a BD or DVD&lt;br /&gt;
***&#039;&#039;&#039;Subtitle&#039;&#039;&#039; (opens language selector)&lt;br /&gt;
***:Set the subtitle language when playing a BD or DVD&lt;br /&gt;
**&#039;&#039;&#039;BD Internet connection&#039;&#039;&#039;&lt;br /&gt;
**:Allow Internet connection from BD content&lt;br /&gt;
**:Allow/Do not allow (default = Do not allow)&lt;br /&gt;
**&#039;&#039;&#039;BD data management&#039;&#039;&#039;&lt;br /&gt;
**:BD data management&lt;br /&gt;
***&#039;&#039;&#039;Erase BD data&#039;&#039;&#039;&lt;br /&gt;
***:Used capacity listed&lt;br /&gt;
*&#039;&#039;&#039;Search&#039;&#039;&#039;&lt;br /&gt;
*:Manage searchable items, clear shortcuts&lt;br /&gt;
**&#039;&#039;&#039;Searchable items&#039;&#039;&#039; (opens list of installed applications with checkboxes for each)&lt;br /&gt;
**:Choose applications to search&lt;br /&gt;
**&#039;&#039;&#039;Clear shortcuts&#039;&#039;&#039;&lt;br /&gt;
**:Clear shortcuts to recently chosen search suggestions&lt;br /&gt;
*&#039;&#039;&#039;Applications&#039;&#039;&#039;&lt;br /&gt;
*:Manage applications and development options&lt;br /&gt;
**&#039;&#039;&#039;Manage applications&#039;&#039;&#039;&lt;br /&gt;
**:Manage and remove installed applications&lt;br /&gt;
**:View applications by Downloaded, All, or Running.  View internal storage amount used/free and RAM amount used/free.  View application storage use, access settings, and stop applications and services.&lt;br /&gt;
**&#039;&#039;&#039;Running services&#039;&#039;&#039;&lt;br /&gt;
**:View and control currently running services&lt;br /&gt;
**:Same as previous menu option, opening to different default page.&lt;br /&gt;
**&#039;&#039;&#039;Development&#039;&#039;&#039;&lt;br /&gt;
**:Set options for application development&lt;br /&gt;
***&#039;&#039;&#039;Remote debugging&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
***:Allow connections from debugging tools&lt;br /&gt;
***&#039;&#039;&#039;Debugger IP address&#039;&#039; (needs to be set to IP address of system you are running adb on)&lt;br /&gt;
***&#039;&#039;&#039;Mock locations&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
***:Allow mock locations&lt;br /&gt;
*&#039;&#039;&#039;Input device&#039;&#039;&#039;&lt;br /&gt;
*:Manage input devices, IP remotes&lt;br /&gt;
**&#039;&#039;&#039;Manage IP remotes&#039;&#039;&#039;&lt;br /&gt;
**:Connect and disconnect IP remotes&lt;br /&gt;
***&#039;&#039;&#039;Connect to new IP remotes (checkbox.  Default = checked)&lt;br /&gt;
***:Accept new pairing requests&lt;br /&gt;
***Paired IP remotes list if configured&lt;br /&gt;
**&#039;&#039;&#039;Chrome to TV&#039;&#039;&#039; (launches feature setup)&lt;br /&gt;
**:Push links to this device from Google Chrome&lt;br /&gt;
**&#039;&#039;&#039;Pointer speed&#039;&#039;&#039; (opens selection slider)&lt;br /&gt;
**:Mouse and trackpad speed&lt;br /&gt;
**&#039;&#039;&#039;Current keyboard&#039;&#039;&#039;&lt;br /&gt;
**:Configure current keyboard&lt;br /&gt;
***&#039;&#039;&#039;English (US) Keyboard (Android keyboard)&#039;&#039;&#039; / &#039;&#039;&#039;English Voice (Android keyboard)&#039;&#039;&#039; / &#039;&#039;&#039;Remote Keyboard&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Configure input methods&#039;&#039;&#039; (opens same panel as next option)&lt;br /&gt;
**&#039;&#039;&#039;Configure input methods&#039;&#039;&#039; (opens panel with inactive options)&lt;br /&gt;
**:Configure input methods&lt;br /&gt;
*&#039;&#039;&#039;Accounts &amp;amp; sync&#039;&#039;&#039;&lt;br /&gt;
*:Manage accounts and data sync&lt;br /&gt;
**&#039;&#039;&#039;Background data&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications can sync, send, and receive data at any time&lt;br /&gt;
**&#039;&#039;&#039;Auto-sync&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications sync data automatically&lt;br /&gt;
**Accounts listed if configured&lt;br /&gt;
**Option to add account&lt;br /&gt;
*&#039;&#039;&#039;Privacy &amp;amp; safety&#039;&#039;&#039;&lt;br /&gt;
*:Manage privacy, safety and lock settings&lt;br /&gt;
**&#039;&#039;&#039;Reporting&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Automatically send Google TV usage statistics and crash reports to Google&lt;br /&gt;
**&#039;&#039;&#039;Factory data reset&#039;&#039;&#039; (I&#039;m not going to see if this is clickable.)&lt;br /&gt;
**&#039;&#039;&#039;Video history&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Enable history of video watching such as TV channels&lt;br /&gt;
**&#039;&#039;&#039;Clear video history&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;SafeSearch&#039;&#039;&#039;&lt;br /&gt;
**:Block adult content from appearing in search results&lt;br /&gt;
***&#039;&#039;&#039;Strict filtering&#039;&#039;&#039; / &#039;&#039;&#039;Moderate filtering&#039;&#039;&#039; (default) / &#039;&#039;&#039;Do not filter&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Application lock&#039;&#039;&#039;&lt;br /&gt;
**:Require PIN to use Google Chrome &amp;amp; Market&lt;br /&gt;
***&#039;&#039;&#039;Lock Google Chrome &amp;amp; Market (checkbox.  Default = unchecked)&lt;br /&gt;
***&#039;&#039;&#039;Change PIN&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;Parental lock&#039;&#039;&#039; (launches prompt for &amp;quot;4 number&amp;quot; password)&lt;br /&gt;
**:Block unwanted programs or content&lt;br /&gt;
**&#039;&#039;&#039;Back up my data&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:Back up application data and other settings to Google servers&lt;br /&gt;
**&#039;&#039;&#039;Backup account&#039;&#039;&#039; (allows addition of account(s))&lt;br /&gt;
**&#039;&#039;&#039;Automatic restore&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:If I reinstall an application, restore backed up settings or other data&lt;br /&gt;
*&#039;&#039;&#039;Storage&#039;&#039;&#039;&lt;br /&gt;
*:Unmount USB storage, view available storage&lt;br /&gt;
**&#039;&#039;&#039;Total&#039;&#039;&#039; (non-clickable.  3.72GB for NSZ-GT1)&lt;br /&gt;
**&#039;&#039;&#039;Available&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Enable FTP access&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**Media storage devices listed if any are connected&lt;br /&gt;
*&#039;&#039;&#039;Date, time &amp;amp; location&#039;&#039;&#039;&lt;br /&gt;
*:Set date, time, time zone and formats&lt;br /&gt;
**&#039;&#039;&#039;Automatic&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Use network-privded time&lt;br /&gt;
**&#039;&#039;&#039;Set date&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select time zone&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set time&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Use 24-hour format&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select date format&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set location&#039;&#039;&#039; (zip code)&lt;br /&gt;
*&#039;&#039;&#039;Accessibility&#039;&#039;&#039;&lt;br /&gt;
*:Manage accessibility options&lt;br /&gt;
**&#039;&#039;&#039;Enable accessibility services&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;TalkBack&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Download accessibility scripts&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**:Allow applications to download accessibility scripts from Google&lt;br /&gt;
*&#039;&#039;&#039;About&#039;&#039;&#039;&lt;br /&gt;
*:System information&lt;br /&gt;
**&#039;&#039;&#039;System updates&#039;&#039;&#039; (checks for updates)&lt;br /&gt;
**&#039;&#039;&#039;System tutorial&#039;&#039;&#039; (launches tutorial)&lt;br /&gt;
**&#039;&#039;&#039;Model number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Firmware version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Build number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Contact Sony&#039;&#039;&#039;&lt;br /&gt;
**:Website and phone contact for Sony product support&lt;br /&gt;
***&#039;&#039;&#039;Website support&#039;&#039;&#039; (opens website)&lt;br /&gt;
***&#039;&#039;&#039;United States phone contact&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Model name&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Serial number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Software version&#039;&#039;&#039; (non-clickable &amp;amp; shows no info)&lt;br /&gt;
***&#039;&#039;&#039;Disc drive version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Sub micro version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;RF module version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Open source licenses&#039;&#039;&#039; (opens text window)&lt;br /&gt;
**&#039;&#039;&#039;Google legal&#039;&#039;&#039; (opens legal browser)&lt;br /&gt;
**&#039;&#039;&#039;Sony legal&#039;&#039;&#039; (opens legal browser)&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=741</id>
		<title>Sony Settings Menus</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=741"/>
		<updated>2012-03-08T06:42:20Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Extend list.  More yet to be added.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Because I found these menus so disorganized that I needed to write them down.  Also for handy reference when helping other GTV users.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Network&#039;&#039;&#039;&lt;br /&gt;
*:Manage Internet Connection&lt;br /&gt;
**&#039;&#039;&#039;Ethernet&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Video input&#039;&#039;&#039;&lt;br /&gt;
*:Set up TV service provider&lt;br /&gt;
*&#039;&#039;&#039;TV &amp;amp; AVR&#039;&#039;&#039;&lt;br /&gt;
*:Set the IR Blaster to control the TV &amp;amp; AV Receiver&lt;br /&gt;
*&#039;&#039;&#039;Picture &amp;amp; sound&#039;&#039;&#039;&lt;br /&gt;
*:Adjust the picture and sound&lt;br /&gt;
**&#039;&#039;&#039;3D settings&#039;&#039;&#039;&lt;br /&gt;
**:Change the 3D viewing environment&lt;br /&gt;
***&#039;&#039;&#039;3D output setting&#039;&#039;&#039;&lt;br /&gt;
***:Choose whether to output in 2D or 3D&lt;br /&gt;
***: Auto/Off (default = Auto)&lt;br /&gt;
***&#039;&#039;&#039;TV screen size setting for 3D BD&#039;&#039;&#039;&lt;br /&gt;
***:Set the screen size for 3D Blu-ray movies&lt;br /&gt;
***:Three-digit selector for screen size in inches.  (default = 46)&lt;br /&gt;
**&#039;&#039;&#039;Resolution&#039;&#039;&#039;&lt;br /&gt;
**:Select preferred TV resolution&lt;br /&gt;
**:Auto/1080p/1080i/720p (3D will not work unless set to Auto.  Default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Picture size&#039;&#039;&#039; (launches overscan calibration utility from initial setup)&lt;br /&gt;
**:Maximize your screen area&lt;br /&gt;
**&#039;&#039;&#039;Screen format&#039;&#039;&#039;&lt;br /&gt;
**:Set the source&#039;s aspect ratio when it differs from the TV&lt;br /&gt;
**:Original/Fixed aspect ratio (default = Original)&lt;br /&gt;
**&#039;&#039;&#039;YCbCr/RGB (HDMI&#039;&#039;&#039;&lt;br /&gt;
**:Set the color space conversion for the video signal from HDMI&lt;br /&gt;
**:Auto/YCbCr(4:4:4)/RGB (default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Noise reduction&#039;&#039;&#039;&lt;br /&gt;
**:Reduce repetitive random noise&lt;br /&gt;
**:High/Medium/Low/Off (default = Off)&lt;br /&gt;
**&#039;&#039;&#039;Screen saver&#039;&#039;&#039;&lt;br /&gt;
**:Set the screen saver&lt;br /&gt;
**:Off/10 min/30 min/1 h/2 h/3 h&lt;br /&gt;
**&#039;&#039;&#039;Audio (HDMI)&#039;&#039;&#039; (inactive)&lt;br /&gt;
**&#039;&#039;&#039;Audio output priority&#039;&#039;&#039;&lt;br /&gt;
**:Set the jack type for audio equipment connection&lt;br /&gt;
**:HDMI/Optical (default = HDMI)&lt;br /&gt;
**&#039;&#039;&#039;BD audio mix setting&#039;&#039;&#039;&lt;br /&gt;
**:Set whether to mix interactive audio and output&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Dolby Digital (Optical)&#039;&#039;&#039;&lt;br /&gt;
**:Set the Dolby Digital output signal from DIGITAL OUT&lt;br /&gt;
**:Off (Downmix PCM)/On (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Dolby Digital pass-through&#039;&#039;&#039;&lt;br /&gt;
**:Send Dolby Digital signals from HDMI devices to your audio system&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;DTS (Optical)&#039;&#039;&#039;&lt;br /&gt;
**:Set the DTS output signal from DIGITAL OUT&lt;br /&gt;
**:Off (Downmix PCM)/On (default = On)&lt;br /&gt;
**&#039;&#039;&#039;Audio DRC&#039;&#039;&#039;&lt;br /&gt;
**:Set the sound effect when playing a BD or DVD&lt;br /&gt;
**:Auto/Standard/TV mode/Wide range (default = Auto)&lt;br /&gt;
**&#039;&#039;&#039;Downmix&#039;&#039;&#039;&lt;br /&gt;
**:Apply the surround effect to the output audio signal&lt;br /&gt;
**:Surround/Stereo (default = Surround)&lt;br /&gt;
**&#039;&#039;&#039;AV sync&#039;&#039;&#039;&lt;br /&gt;
**:Adjust the timing between picture and sound&lt;br /&gt;
**:0-120 msec at increments of 10 msec&lt;br /&gt;
**&#039;&#039;&#039;Sound effects&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Enable sound effects&lt;br /&gt;
**&#039;&#039;&#039;Notification sounds&#039;&#039;&#039; (Silent/Default.  Default = Silent)&lt;br /&gt;
**&#039;&#039;&#039;Text-to-speech&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Listen to an example&#039;&#039;&#039;&lt;br /&gt;
***:Play a short demonstration of speech synthesis&lt;br /&gt;
***&#039;&#039;&#039;Always use my settings&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
***:Default settings below override application settings&lt;br /&gt;
***&#039;&#039;&#039;Default Engine&#039;&#039;&#039; (only option is Pico TTS)&lt;br /&gt;
***:Sets the speech synthesis engine to be used for spoken text&lt;br /&gt;
***&#039;&#039;&#039;Install voice data&#039;&#039;&#039;&lt;br /&gt;
***:Install the voice data required for speech synthesis&lt;br /&gt;
***&#039;&#039;&#039;Speech rate&#039;&#039;&#039;&lt;br /&gt;
***:Speed at which the text is spoken&lt;br /&gt;
***:Very slow/Slow/Normal/Fast/Very fast&lt;br /&gt;
***&#039;&#039;&#039;Language&#039;&#039;&#039; (only option is English (United States))&lt;br /&gt;
***:Sets the language-specific voice for the spoken text&lt;br /&gt;
***&#039;&#039;&#039;Pico TTS&#039;&#039;&#039;&lt;br /&gt;
***:Pico TTS settings&lt;br /&gt;
****START HERE&lt;br /&gt;
*&#039;&#039;&#039;Disc Player settings&#039;&#039;&#039;&lt;br /&gt;
*:Change general settings&lt;br /&gt;
**&#039;&#039;&#039;Timer&#039;&#039;&#039;&lt;br /&gt;
**:Set timer to power on or off&lt;br /&gt;
**:Displays artsy clock.  Allows multiple setting timers for on or off (or so it appears) to time, day of week, and duration, as well as sleep timer of 15-120 minutes.&lt;br /&gt;
**&#039;&#039;&#039;Eco&#039;&#039;&#039;&lt;br /&gt;
**:Change the settings related to power consumption&lt;br /&gt;
***&#039;&#039;&#039;Quick start&#039;&#039;&#039;&lt;br /&gt;
***:Set the unit to power on quickly&lt;br /&gt;
***:On/Off.  Unit powers on much more quickly but consumes more power while powered off.&lt;br /&gt;
***&#039;&#039;&#039;Auto standby&#039;&#039;&#039;&lt;br /&gt;
***:The unit automatically turns off after 2 hours of non-operation.&lt;br /&gt;
***:On/Off (default = Off)&lt;br /&gt;
**&#039;&#039;&#039;HDMI settings&#039;&#039;&#039;&lt;br /&gt;
**:Change the settings for controlling compatible HDMI devices&lt;br /&gt;
***&#039;&#039;&#039;Control for HDMI&#039;&#039;&#039;&lt;br /&gt;
***:Control the unit with the HDMI-connected TV&lt;br /&gt;
***:On/Off (default = On)&lt;br /&gt;
***&#039;&#039;&#039;Unit auto power off&#039;&#039;&#039;&lt;br /&gt;
***:Power off unit when the HDMI-connected TV is turned off&lt;br /&gt;
***:On/Off (depends on previous option On.  Default = Off)&lt;br /&gt;
**&#039;&#039;&#039;Cinema conversion mode&#039;&#039;&#039;&lt;br /&gt;
**:Set the conversion method for video or film material&lt;br /&gt;
**:Auto/Video&lt;br /&gt;
**&#039;&#039;&#039;BD-ROM 1080/24p output&#039;&#039;&#039;&lt;br /&gt;
**:Output a 1080/24p video signal from HDMI&lt;br /&gt;
**:Auto/Off&lt;br /&gt;
**&#039;&#039;&#039;Auto display&#039;&#039;&#039;&lt;br /&gt;
**:Display info when switching audio modes or during playback&lt;br /&gt;
**:On/Off (default = On)&lt;br /&gt;
**&#039;&#039;&#039;BD/DVD viewing settings&#039;&#039;&#039;&lt;br /&gt;
**:Set the language displayed on BD or DVD menus&lt;br /&gt;
***&#039;&#039;&#039;BD/DVD menu&#039;&#039;&#039; (opens language selector)&lt;br /&gt;
***:Set the language displayed on BD or DVD menus&lt;br /&gt;
***&#039;&#039;&#039;Audio&#039;&#039;&#039; (opens language selector.  Default = Original)&lt;br /&gt;
***:Set the audio language when playing a BD or DVD&lt;br /&gt;
***&#039;&#039;&#039;Subtitle&#039;&#039;&#039; (opens language selector)&lt;br /&gt;
***:Set the subtitle language when playing a BD or DVD&lt;br /&gt;
**&#039;&#039;&#039;BD Internet connection&#039;&#039;&#039;&lt;br /&gt;
**:Allow Internet connection from BD content&lt;br /&gt;
**:Allow/Do not allow (default = Do not allow)&lt;br /&gt;
**&#039;&#039;&#039;BD data management&#039;&#039;&#039;&lt;br /&gt;
**:BD data management&lt;br /&gt;
***&#039;&#039;&#039;Erase BD data&#039;&#039;&#039;&lt;br /&gt;
***:Used capacity listed&lt;br /&gt;
*&#039;&#039;&#039;Search&#039;&#039;&#039;&lt;br /&gt;
*:Manage searchable items, clear shortcuts&lt;br /&gt;
**&#039;&#039;&#039;Searchable items&#039;&#039;&#039; (opens list of installed applications with checkboxes for each)&lt;br /&gt;
**:Choose applications to search&lt;br /&gt;
**&#039;&#039;&#039;Clear shortcuts&#039;&#039;&#039;&lt;br /&gt;
**:Clear shortcuts to recently chosen search suggestions&lt;br /&gt;
*&#039;&#039;&#039;Applications&#039;&#039;&#039;&lt;br /&gt;
*:Manage applications and development options&lt;br /&gt;
**&#039;&#039;&#039;Manage applications&#039;&#039;&#039;&lt;br /&gt;
**:Manage and remove installed applications&lt;br /&gt;
**:View applications by Downloaded, All, or Running.  View internal storage amount used/free and RAM amount used/free.  View application storage use, access settings, and stop applications and services.&lt;br /&gt;
**&#039;&#039;&#039;Running services&#039;&#039;&#039;&lt;br /&gt;
**:View and control currently running services&lt;br /&gt;
**:Same as previous menu option, opening to different default page.&lt;br /&gt;
**&#039;&#039;&#039;Development&#039;&#039;&#039;&lt;br /&gt;
**:Set options for application development&lt;br /&gt;
***&#039;&#039;&#039;Remote debugging&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
***:Allow connections from debugging tools&lt;br /&gt;
***&#039;&#039;&#039;Debugger IP address&#039;&#039; (needs to be set to IP address of system you are running adb on)&lt;br /&gt;
***&#039;&#039;&#039;Mock locations&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
***:Allow mock locations&lt;br /&gt;
*&#039;&#039;&#039;Input device&#039;&#039;&#039;&lt;br /&gt;
*:Manage input devices, IP remotes&lt;br /&gt;
**&#039;&#039;&#039;Manage IP remotes&#039;&#039;&#039;&lt;br /&gt;
**:Connect and disconnect IP remotes&lt;br /&gt;
***&#039;&#039;&#039;Connect to new IP remotes (checkbox.  Default = checked)&lt;br /&gt;
***:Accept new pairing requests&lt;br /&gt;
***Paired IP remotes list if configured&lt;br /&gt;
**&#039;&#039;&#039;Chrome to TV&#039;&#039;&#039; (launches feature setup)&lt;br /&gt;
**:Push links to this device from Google Chrome&lt;br /&gt;
**&#039;&#039;&#039;Pointer speed&#039;&#039;&#039; (opens selection slider)&lt;br /&gt;
**:Mouse and trackpad speed&lt;br /&gt;
**&#039;&#039;&#039;Current keyboard&#039;&#039;&#039;&lt;br /&gt;
**:Configure current keyboard&lt;br /&gt;
***&#039;&#039;&#039;English (US) Keyboard (Android keyboard)&#039;&#039;&#039; / &#039;&#039;&#039;English Voice (Android keyboard)&#039;&#039;&#039; / &#039;&#039;&#039;Remote Keyboard&#039;&#039;&#039;&lt;br /&gt;
***&#039;&#039;&#039;Configure input methods&#039;&#039;&#039; (opens same panel as next option)&lt;br /&gt;
**&#039;&#039;&#039;Configure input methods&#039;&#039;&#039; (opens panel with inactive options)&lt;br /&gt;
**:Configure input methods&lt;br /&gt;
*&#039;&#039;&#039;Accounts &amp;amp; sync&#039;&#039;&#039;&lt;br /&gt;
*:Manage accounts and data sync&lt;br /&gt;
**&#039;&#039;&#039;Background data&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications can sync, send, and receive data at any time&lt;br /&gt;
**&#039;&#039;&#039;Auto-sync&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications sync data automatically&lt;br /&gt;
**Accounts listed if configured&lt;br /&gt;
**Option to add account&lt;br /&gt;
*&#039;&#039;&#039;Privacy &amp;amp; safety&#039;&#039;&#039;&lt;br /&gt;
*:Manage privacy, safety and lock settings&lt;br /&gt;
**&#039;&#039;&#039;Reporting&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Automatically send Google TV usage statistics and crash reports to Google&lt;br /&gt;
**&#039;&#039;&#039;Factory data reset&#039;&#039;&#039; (I&#039;m not going to see if this is clickable.)&lt;br /&gt;
**&#039;&#039;&#039;Video history&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Enable history of video watching such as TV channels&lt;br /&gt;
**&#039;&#039;&#039;Clear video history&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;SafeSearch&#039;&#039;&#039;&lt;br /&gt;
**:Block adult content from appearing in search results&lt;br /&gt;
***&#039;&#039;&#039;Strict filtering&#039;&#039;&#039; / &#039;&#039;&#039;Moderate filtering&#039;&#039;&#039; (default) / &#039;&#039;&#039;Do not filter&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Application lock&#039;&#039;&#039;&lt;br /&gt;
**:Require PIN to use Google Chrome &amp;amp; Market&lt;br /&gt;
***&#039;&#039;&#039;Lock Google Chrome &amp;amp; Market (checkbox.  Default = unchecked)&lt;br /&gt;
***&#039;&#039;&#039;Change PIN&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;Parental lock&#039;&#039;&#039; (launches prompt for &amp;quot;4 number&amp;quot; password)&lt;br /&gt;
**:Block unwanted programs or content&lt;br /&gt;
**&#039;&#039;&#039;Back up my data&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:Back up application data and other settings to Google servers&lt;br /&gt;
**&#039;&#039;&#039;Backup account&#039;&#039;&#039; (allows addition of account(s))&lt;br /&gt;
**&#039;&#039;&#039;Automatic restore&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:If I reinstall an application, restore backed up settings or other data&lt;br /&gt;
*&#039;&#039;&#039;Storage&#039;&#039;&#039;&lt;br /&gt;
*:Unmount USB storage, view available storage&lt;br /&gt;
**&#039;&#039;&#039;Total&#039;&#039;&#039; (non-clickable.  3.72GB for NSZ-GT1)&lt;br /&gt;
**&#039;&#039;&#039;Available&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Enable FTP access&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**Media storage devices listed if any are connected&lt;br /&gt;
*&#039;&#039;&#039;Date, time &amp;amp; location&#039;&#039;&#039;&lt;br /&gt;
*:Set date, time, time zone and formats&lt;br /&gt;
**&#039;&#039;&#039;Automatic&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Use network-privded time&lt;br /&gt;
**&#039;&#039;&#039;Set date&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select time zone&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set time&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Use 24-hour format&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select date format&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set location&#039;&#039;&#039; (zip code)&lt;br /&gt;
*&#039;&#039;&#039;Accessibility&#039;&#039;&#039;&lt;br /&gt;
*:Manage accessibility options&lt;br /&gt;
**&#039;&#039;&#039;Enable accessibility services&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;TalkBack&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Download accessibility scripts&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**:Allow applications to download accessibility scripts from Google&lt;br /&gt;
*&#039;&#039;&#039;About&#039;&#039;&#039;&lt;br /&gt;
*:System information&lt;br /&gt;
**&#039;&#039;&#039;System updates&#039;&#039;&#039; (checks for updates)&lt;br /&gt;
**&#039;&#039;&#039;System tutorial&#039;&#039;&#039; (launches tutorial)&lt;br /&gt;
**&#039;&#039;&#039;Model number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Firmware version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Build number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Contact Sony&#039;&#039;&#039;&lt;br /&gt;
**:Website and phone contact for Sony product support&lt;br /&gt;
***&#039;&#039;&#039;Website support&#039;&#039;&#039; (opens website)&lt;br /&gt;
***&#039;&#039;&#039;United States phone contact&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Model name&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Serial number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Software version&#039;&#039;&#039; (non-clickable &amp;amp; shows no info)&lt;br /&gt;
***&#039;&#039;&#039;Disc drive version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Sub micro version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;RF module version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Open source licenses&#039;&#039;&#039; (opens text window)&lt;br /&gt;
**&#039;&#039;&#039;Google legal&#039;&#039;&#039; (opens legal browser)&lt;br /&gt;
**&#039;&#039;&#039;Sony legal&#039;&#039;&#039; (opens legal browser)&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=740</id>
		<title>I&#039;ve rooted... now what?!</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=740"/>
		<updated>2012-03-07T23:00:13Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Make CBS, hulu, etc work */ Testing note wrt Amazon Instant Video&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A list of apps and things to do&lt;br /&gt;
&lt;br /&gt;
==Make CBS, hulu, etc work==&lt;br /&gt;
You will need to change your useragent in Chrome.&lt;br /&gt;
* Bring up the browser menu, then go to “more”, and then “settings”. From there go to “advanced” and then “mode”, and finally change the user agent. (Thanks to [http://www.gtvhub.com/2010/11/11/user-agent-fix-unblocks-fox-on-google-tv-for-now/ GTVHub].)&lt;br /&gt;
* Once there, you have two choices&lt;br /&gt;
** Copy or type in a useragent. It&#039;s best to use a real one; you can find one by going to http://whatsmyuseragent.com/ from a normal computer. Going there on your GTV will show the current user agent on the device.&lt;br /&gt;
** An alternative is to use the &amp;quot;Generic&amp;quot; user agent, instead of typing in a custom one. As of 3/5/2012, Hulu can be accessed when using the &amp;quot;Generic&amp;quot; user agent in combination with the GTVHacker root.  Amazon Instant Video is known to not work with a useragent of &amp;quot;Mozilla/5.0&amp;quot; but will work with more complex useragent strings and has not been tested with the &amp;quot;Generic&amp;quot; useragent.&lt;br /&gt;
&lt;br /&gt;
==Installing X86 Superuser.apk==&lt;br /&gt;
#Download the x86 version of [http://dl.dropbox.com/u/16800443/Superuser-3.0.7-efghi-x86.zip Superuser.apk]&lt;br /&gt;
#Extract the downloaded .zip file to a folder on your computer, making note of where you&#039;ve extracted it for the following 2 steps.&lt;br /&gt;
#Upload Superuser.apk to the googletv /system/app/ directory with the following command substituting the first argument &amp;quot;system/app/Superuser.apk&amp;quot; with the correct location.&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb push system/app/Superuser.apk /system/app/Superuser.apk&amp;lt;/code&amp;gt;&lt;br /&gt;
#Upload the su binary to the googletv /system/bin/ directory with the following command substituting the first arugment &amp;quot;system/bin/su&amp;quot; with the correct location.&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb push system/bin/su /system/bin/su&amp;lt;/code&amp;gt;&lt;br /&gt;
#Use the following command to add the correct permissions to the su binary on the device&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb shell chmod 6755 /system/bin/su&amp;lt;/code&amp;gt;&lt;br /&gt;
#Reboot the box&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb shell reboot&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Apps that are available now==&lt;br /&gt;
[http://market.android.com/details?id=ccc71.pmw free terminal emulator] This app has other features, and not all of them work on GTV. Note that pressing enter in the emulator will not execute a line; in fact, doing so will confuse busybox. Press the button instead.&lt;br /&gt;
&lt;br /&gt;
[http://market.android.com/details?id=com.fede.launcher LauncherPro] a few features don&#039;t work&lt;br /&gt;
&lt;br /&gt;
==Apps that need work before they are available on GTV==&lt;br /&gt;
[http://market.android.com/details?id=jackpal.androidterm android terminal emulator] - &#039;&#039;&#039;not available for GTV yet&#039;&#039;&#039; due to [http://github.com/jackpal/Android-Terminal-Emulator/issues/46 issue #46]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=739</id>
		<title>Main Page/Devices</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=739"/>
		<updated>2012-03-07T20:42:50Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add Sony Settings Menu link&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Current Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;logitech_section&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot;&lt;br /&gt;
| [[File:Revue-advert.gif|180px]]&lt;br /&gt;
|&lt;br /&gt;
*[[Steps to get root ]]&lt;br /&gt;
*[http://forum.gtvhacker.com/revue/ Join the Revue forum! ]&lt;br /&gt;
*[http://gtvhacker.com/blog/2011/logitech-revue-software-root/ Why no software root? ]&lt;br /&gt;
&lt;br /&gt;
*[http://gtvhacker.com/index.php/Category:Logitech_Revue Info on Logitech Revue]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSX-40GT1.jpg|180px]] &lt;br /&gt;
| colspan=&amp;quot;2&amp;quot;| &lt;br /&gt;
*[[Sony NSX-40GT1 (Internet TV)]]&lt;br /&gt;
*[http://forum.gtvhacker.com/nsx-40gt1/ Join the nsx-40gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSZ_GT1.jpg|180px]]&lt;br /&gt;
|colspan=&amp;quot;2&amp;quot;|&lt;br /&gt;
&lt;br /&gt;
*[[Sony NSZ-GT1 (Bluray Player)]] &lt;br /&gt;
*[http://forum.gtvhacker.com/nsz-gt1/ Join the nsz-gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
*[[Sony GTV Troubleshooting]]&lt;br /&gt;
*[[Sony Settings Menus]] (partially complete)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Upcoming Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;vizio_section&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;[[Vizio]]&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Samsung&#039;&#039;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=738</id>
		<title>Sony Settings Menus</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Settings_Menus&amp;diff=738"/>
		<updated>2012-03-07T20:41:33Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add document to detail settings menu structures and any undocumented notes on settings.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Because I found these menus so disorganized that I needed to write them down.  Also for handy reference when helping other GTV users.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Network&#039;&#039;&#039;&lt;br /&gt;
*:Manage Internet Connection&lt;br /&gt;
**&#039;&#039;&#039;Ethernet&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Video input&#039;&#039;&#039;&lt;br /&gt;
*:Set up TV service provider&lt;br /&gt;
*&#039;&#039;&#039;TV &amp;amp; AVR&#039;&#039;&#039;&lt;br /&gt;
*:Set the IR Blaster to control the TV &amp;amp; AV Receiver&lt;br /&gt;
*&#039;&#039;&#039;Picture &amp;amp; sound&#039;&#039;&#039;&lt;br /&gt;
*:Adjust the picture and sound&lt;br /&gt;
*&#039;&#039;&#039;Disc Player settings&#039;&#039;&#039;&lt;br /&gt;
*:Change general settings&lt;br /&gt;
*&#039;&#039;&#039;Search&#039;&#039;&#039;&lt;br /&gt;
*:Manage searchable items, clear shortcuts&lt;br /&gt;
*&#039;&#039;&#039;Applications&#039;&#039;&#039;&lt;br /&gt;
*:Manage applications and development options&lt;br /&gt;
*&#039;&#039;&#039;Input device&#039;&#039;&#039;&lt;br /&gt;
*:Manage input devices, IP remotes&lt;br /&gt;
&#039;&#039;&#039;Data is complete below this point.  Incomplete above this point.  So the stuff that matters is yet to come.&#039;&#039;&#039;&lt;br /&gt;
*&#039;&#039;&#039;Accounts &amp;amp; sync&#039;&#039;&#039;&lt;br /&gt;
*:Manage accounts and data sync&lt;br /&gt;
**&#039;&#039;&#039;Background data&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications can sync, send, and receive data at any time&lt;br /&gt;
**&#039;&#039;&#039;Auto-sync&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Applications sync data automatically&lt;br /&gt;
**Accounts listed if configured&lt;br /&gt;
**Option to add account&lt;br /&gt;
*&#039;&#039;&#039;Privacy &amp;amp; safety&#039;&#039;&#039;&lt;br /&gt;
*:Manage privacy, safety and lock settings&lt;br /&gt;
**&#039;&#039;&#039;Reporting&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Automatically send Google TV usage statistics and crash reports to Google&lt;br /&gt;
**&#039;&#039;&#039;Factory data reset&#039;&#039;&#039; (I&#039;m not going to see if this is clickable.)&lt;br /&gt;
**&#039;&#039;&#039;Video history&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**:Enable history of video watching such as TV channels&lt;br /&gt;
**&#039;&#039;&#039;Clear video history&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;SafeSearch&#039;&#039;&#039;&lt;br /&gt;
**:Block adult content from appearing in search results&lt;br /&gt;
***&#039;&#039;&#039;Strict filtering&#039;&#039;&#039; / &#039;&#039;&#039;Moderate filtering&#039;&#039;&#039; (default) / &#039;&#039;&#039;Do not filter&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Application lock&#039;&#039;&#039;&lt;br /&gt;
**:Require PIN to use Google Chrome &amp;amp; Market&lt;br /&gt;
***&#039;&#039;&#039;Lock Google Chrome &amp;amp; Market (checkbox.  Default = unchecked)&lt;br /&gt;
***&#039;&#039;&#039;Change PIN&#039;&#039;&#039; (depends on previous option checked)&lt;br /&gt;
**&#039;&#039;&#039;Parental lock&#039;&#039;&#039; (launches prompt for &amp;quot;4 number&amp;quot; password)&lt;br /&gt;
**:Block unwanted programs or content&lt;br /&gt;
**&#039;&#039;&#039;Back up my data&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:Back up application data and other settings to Google servers&lt;br /&gt;
**&#039;&#039;&#039;Backup account&#039;&#039;&#039; (allows addition of account(s))&lt;br /&gt;
**&#039;&#039;&#039;Automatic restore&#039;&#039;&#039; (checkbox.  Default = checked if Google account configured)&lt;br /&gt;
**:If I reinstall an application, restore backed up settings or other data&lt;br /&gt;
*&#039;&#039;&#039;Storage&#039;&#039;&#039;&lt;br /&gt;
*:Unmount USB storage, view available storage&lt;br /&gt;
**&#039;&#039;&#039;Total&#039;&#039;&#039; (non-clickable.  3.72GB for NSZ-GT1)&lt;br /&gt;
**&#039;&#039;&#039;Available&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Enable FTP access&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**Media storage devices listed if any are connected&lt;br /&gt;
*&#039;&#039;&#039;Date, time &amp;amp; location&#039;&#039;&#039;&lt;br /&gt;
*:Set date, time, time zone and formats&lt;br /&gt;
**&#039;&#039;&#039;Automatic&#039;&#039;&#039; (checkbox.  Default = checked)&lt;br /&gt;
**:Use network-privded time&lt;br /&gt;
**&#039;&#039;&#039;Set date&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select time zone&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set time&#039;&#039;&#039; (depends on first option unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Use 24-hour format&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Select date format&#039;&#039;&#039;&lt;br /&gt;
**&#039;&#039;&#039;Set location&#039;&#039;&#039; (zip code)&lt;br /&gt;
*&#039;&#039;&#039;Accessibility&#039;&#039;&#039;&lt;br /&gt;
*:Manage accessibility options&lt;br /&gt;
**&#039;&#039;&#039;Enable accessibility services&#039;&#039;&#039; (checkbox.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;TalkBack&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**&#039;&#039;&#039;Download accessibility scripts&#039;&#039;&#039; (checkbox.  depends on first option checked.  Default = unchecked)&lt;br /&gt;
**:Allow applications to download accessibility scripts from Google&lt;br /&gt;
*&#039;&#039;&#039;About&#039;&#039;&#039;&lt;br /&gt;
*:System information&lt;br /&gt;
**&#039;&#039;&#039;System updates&#039;&#039;&#039; (checks for updates)&lt;br /&gt;
**&#039;&#039;&#039;System tutorial&#039;&#039;&#039; (launches tutorial)&lt;br /&gt;
**&#039;&#039;&#039;Model number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Firmware version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Build number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Contact Sony&#039;&#039;&#039;&lt;br /&gt;
**:Website and phone contact for Sony product support&lt;br /&gt;
***&#039;&#039;&#039;Website support&#039;&#039;&#039; (opens website)&lt;br /&gt;
***&#039;&#039;&#039;United States phone contact&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Model name&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Serial number&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Software version&#039;&#039;&#039; (non-clickable &amp;amp; shows no info)&lt;br /&gt;
***&#039;&#039;&#039;Disc drive version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;Sub micro version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
***&#039;&#039;&#039;RF module version&#039;&#039;&#039; (non-clickable)&lt;br /&gt;
**&#039;&#039;&#039;Open source licenses&#039;&#039;&#039; (opens text window)&lt;br /&gt;
**&#039;&#039;&#039;Google legal&#039;&#039;&#039; (opens legal browser)&lt;br /&gt;
**&#039;&#039;&#039;Sony legal&#039;&#039;&#039; (opens legal browser)&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=737</id>
		<title>I&#039;ve rooted... now what?!</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=737"/>
		<updated>2012-03-07T14:16:50Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Installing X86 Superuser.apk */  typo.  not -&amp;gt; note&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A list of apps and things to do&lt;br /&gt;
&lt;br /&gt;
==Make CBS, hulu, etc work==&lt;br /&gt;
You will need to change your useragent in Chrome.&lt;br /&gt;
* Bring up the browser menu, then go to “more”, and then “settings”. From there go to “advanced” and then “mode”, and finally change the user agent. (Thanks to [http://www.gtvhub.com/2010/11/11/user-agent-fix-unblocks-fox-on-google-tv-for-now/ GTVHub].)&lt;br /&gt;
* Once there, you have two choices&lt;br /&gt;
** Copy or type in a useragent. It&#039;s best to use a real one; you can find one by going to http://whatsmyuseragent.com/ from a normal computer. Going there on your GTV will show the current user agent on the device.&lt;br /&gt;
** An alternative is to use the &amp;quot;Generic&amp;quot; user agent, instead of typing in a custom one. As of 3/5/2012, Hulu can be accessed when using the &amp;quot;Generic&amp;quot; user agent in combination with the GTVHacker root.&lt;br /&gt;
&lt;br /&gt;
==Installing X86 Superuser.apk==&lt;br /&gt;
#Download the x86 version of [http://dl.dropbox.com/u/16800443/Superuser-3.0.7-efghi-x86.zip Superuser.apk]&lt;br /&gt;
#Extract the downloaded .zip file to a folder on your computer, making note of where you&#039;ve extracted it for the following 2 steps.&lt;br /&gt;
#Upload Superuser.apk to the googletv /system/app/ directory with the following command substituting the first argument &amp;quot;system/app/Superuser.apk&amp;quot; with the correct location.&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb push system/app/Superuser.apk /system/app/Superuser.apk&amp;lt;/code&amp;gt;&lt;br /&gt;
#Upload the su binary to the googletv /system/bin/ directory with the following command substituting the first arugment &amp;quot;system/bin/su&amp;quot; with the correct location.&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb push system/bin/su /system/bin/su&amp;lt;/code&amp;gt;&lt;br /&gt;
#Use the following command to add the correct permissions to the su binary on the device&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb shell chmod 6755 /system/bin/su&amp;lt;/code&amp;gt;&lt;br /&gt;
#Reboot the box&lt;br /&gt;
#:&amp;lt;code&amp;gt;adb shell reboot&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==Apps that are available now==&lt;br /&gt;
[http://market.android.com/details?id=ccc71.pmw free terminal emulator] This app has other features, and not all of them work on GTV. Note that pressing enter in the emulator will not execute a line; in fact, doing so will confuse busybox. Press the button instead.&lt;br /&gt;
&lt;br /&gt;
[http://market.android.com/details?id=com.fede.launcher LauncherPro] a few features don&#039;t work&lt;br /&gt;
&lt;br /&gt;
==Apps that need work before they are available on GTV==&lt;br /&gt;
[http://market.android.com/details?id=jackpal.androidterm android terminal emulator] - &#039;&#039;&#039;not available for GTV yet&#039;&#039;&#039; due to [http://github.com/jackpal/Android-Terminal-Emulator/issues/46 issue #46]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=734</id>
		<title>Main Page/Devices</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Main_Page/Devices&amp;diff=734"/>
		<updated>2012-03-07T01:40:52Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add the &amp;quot;now what&amp;quot; to NSZ-GT1.  Add new troubleshooting page.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Current Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;logitech_section&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| border=&amp;quot;1&amp;quot;&lt;br /&gt;
| [[File:Revue-advert.gif|180px]]&lt;br /&gt;
|&lt;br /&gt;
*[[Steps to get root ]]&lt;br /&gt;
*[http://forum.gtvhacker.com/revue/ Join the Revue forum! ]&lt;br /&gt;
*[http://gtvhacker.com/blog/2011/logitech-revue-software-root/ Why no software root? ]&lt;br /&gt;
&lt;br /&gt;
*[http://gtvhacker.com/index.php/Category:Logitech_Revue Info on Logitech Revue]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSX-40GT1.jpg|180px]] &lt;br /&gt;
| colspan=&amp;quot;2&amp;quot;| &lt;br /&gt;
*[[Sony NSX-40GT1 (Internet TV)]]&lt;br /&gt;
*[http://forum.gtvhacker.com/nsx-40gt1/ Join the nsx-40gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
|-&lt;br /&gt;
| [[File:Sony_NSZ_GT1.jpg|180px]]&lt;br /&gt;
|colspan=&amp;quot;2&amp;quot;|&lt;br /&gt;
&lt;br /&gt;
*[[Sony NSZ-GT1 (Bluray Player)]] &lt;br /&gt;
*[http://forum.gtvhacker.com/nsz-gt1/ Join the nsz-gt1 forum! ]&lt;br /&gt;
*[[Running Unsigned Kernels On Sony GTV]]&lt;br /&gt;
*[[Enable Non-Market Apps on Sony GTV]]&lt;br /&gt;
*[[Sony NTFS]]&lt;br /&gt;
*[[I&#039;ve rooted... now what?!]]&lt;br /&gt;
*[[Sony GTV Troubleshooting]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;p style=&amp;quot;font-size:140%; padding:10px;&amp;quot;&amp;gt;Upcoming Google Devices &amp;lt;/p&amp;gt;&lt;br /&gt;
&amp;lt;div id=&amp;quot;vizio_section&amp;quot;&amp;gt;&lt;br /&gt;
&#039;&#039;[[Vizio]]&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Samsung&#039;&#039;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_GTV_Troubleshooting&amp;diff=733</id>
		<title>Sony GTV Troubleshooting</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_GTV_Troubleshooting&amp;diff=733"/>
		<updated>2012-03-07T01:40:32Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add Sony troubleshooting page.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A list of problems and solutions&lt;br /&gt;
&lt;br /&gt;
==NSZ-GT1 won&#039;t play 3D Blu-ray discs in 3D==&lt;br /&gt;
Possible causes of this problem and their solutions:&lt;br /&gt;
* Sony introduced 3D support in the 2012.01.26 update.  Check your software version in Settings -&amp;gt; About to make sure that you have 2012.01.26 or later.  If you have an older version of the software, you can update it by checking for updates in the menu or by downloading the appropriate update from [[Sony Update Downloads]] and installing it.&lt;br /&gt;
* 3D will not work if your display resolution is not set to Auto or if you have 3D set to Off.  In the Settings -&amp;gt; Picture set both of these to Auto in the respective submenus.&lt;br /&gt;
* Of course, if your TV doesn&#039;t support 3D you won&#039;t have 3D.&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=732</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=732"/>
		<updated>2012-03-06T23:43:00Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Downgrade/Rebooter Process */ Danger, Will Robinson!  Give warning about how important USB3 is.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
* This is an advanced procedure and is far outside of normal computer use and designed function for the GTV.  Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware.  Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully.  If you find yourself having trouble, you may want to think long and hard before taking these risks.  If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren&#039;t a company or organization and can&#039;t perform miracles if you break something.&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== USB Drive Validation ===&lt;br /&gt;
&lt;br /&gt;
To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions.  We think they may reduce the chance that your Google TV won&#039;t work at all after the Downgrader/Reboot process.&lt;br /&gt;
# Read data off each of your USB drives by running the same dd/dd.exe command but swap the &amp;quot;if&amp;quot; and &amp;quot;of&amp;quot; and change USB1.img/USB2.img/USB3.img/USB4.img to test1.img/test2.img/test3.img/test4.img.  Also, make sure &amp;quot;bs=4096&amp;quot; is still there, and add &amp;quot;count=1280&amp;quot; for USB1/USB2 or &amp;quot;count=19200&amp;quot; for USB3/USB4.&lt;br /&gt;
# Calculate the MD5 hash (md5sum) of each of test1.img through test4.img.  (It looks like here&#039;s one for Windows, but we haven&#039;t tested it: http://www.pc-tools.net/win32/md5sums/)&lt;br /&gt;
# MD5 hash values should be as listed here (upper or lower case letters are fine):&lt;br /&gt;
#:   USB1 (Eagle): d6a82c60d70b3ecdb8e436ef44043e4c&lt;br /&gt;
#:   USB1 (Asura): f34e34f4d6bed978ed3d0e1afe596b99&lt;br /&gt;
#:   USB2: 4a491d61d836fdcd1f60dc6451f90965&lt;br /&gt;
#:   USB3: ff71d6432a0076a7b818713f3a60eb09&lt;br /&gt;
#:   USB4: 139ba91d8c01e927caced3eefa9fbd55&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# &#039;&#039;&#039;Danger! Danger! Danger! USB3 is really important, and we have no way of checking that you wrote it right and won&#039;t brick your GTV.  Consider using the &amp;quot;USB Drive Validation&amp;quot; steps above to make sure you aren&#039;t dumping garbage all over your GTV.&#039;&#039;&#039;&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=731</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=731"/>
		<updated>2012-03-06T23:29:12Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Tools Needed */ Add instructions for verifying the USBs via re-read and md5 in an attempt to reduce bricks.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
* This is an advanced procedure and is far outside of normal computer use and designed function for the GTV.  Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware.  Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully.  If you find yourself having trouble, you may want to think long and hard before taking these risks.  If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren&#039;t a company or organization and can&#039;t perform miracles if you break something.&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# Optionally, consider verifying that these steps worked by following the &amp;quot;USB Drive Validation&amp;quot; steps below.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== USB Drive Validation ===&lt;br /&gt;
&lt;br /&gt;
To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions.  We think they may reduce the chance that your Google TV won&#039;t work at all after the Downgrader/Reboot process.&lt;br /&gt;
# Read data off each of your USB drives by running the same dd/dd.exe command but swap the &amp;quot;if&amp;quot; and &amp;quot;of&amp;quot; and change USB1.img/USB2.img/USB3.img/USB4.img to test1.img/test2.img/test3.img/test4.img.  Also, make sure &amp;quot;bs=4096&amp;quot; is still there, and add &amp;quot;count=1280&amp;quot; for USB1/USB2 or &amp;quot;count=19200&amp;quot; for USB3/USB4.&lt;br /&gt;
# Calculate the MD5 hash (md5sum) of each of test1.img through test4.img.  (It looks like here&#039;s one for Windows, but we haven&#039;t tested it: http://www.pc-tools.net/win32/md5sums/)&lt;br /&gt;
# MD5 hash values should be as listed here (upper or lower case letters are fine):&lt;br /&gt;
#:   USB1 (Eagle): d6a82c60d70b3ecdb8e436ef44043e4c&lt;br /&gt;
#:   USB1 (Asura): f34e34f4d6bed978ed3d0e1afe596b99&lt;br /&gt;
#:   USB2: 4a491d61d836fdcd1f60dc6451f90965&lt;br /&gt;
#:   USB3: ff71d6432a0076a7b818713f3a60eb09&lt;br /&gt;
#:   USB4: 139ba91d8c01e927caced3eefa9fbd55&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=730</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=730"/>
		<updated>2012-03-06T23:03:08Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Warnings */ Attempt and a friendly, yet honest, warning informing users of what they are getting themselves into.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
* This is an advanced procedure and is far outside of normal computer use and designed function for the GTV.  Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware.  Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully.  If you find yourself having trouble, you may want to think long and hard before taking these risks.  If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren&#039;t a company or organization and can&#039;t perform miracles if you break something.&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=729</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=729"/>
		<updated>2012-03-06T22:47:01Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Warnings */ No longer most recent.  :-(&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=728</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=728"/>
		<updated>2012-03-06T22:44:56Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Known Issues */ Add ctrl-alt-del for eject problem.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the most recent 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=727</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=727"/>
		<updated>2012-03-06T22:41:00Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add a couple cautions and checks relating to patches that disable this procedure.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the most recent 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Pre-Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
Disconnect your GTV from the internet!&lt;br /&gt;
# There are newer software versions that the procedure below won&#039;t work on.  If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.&lt;br /&gt;
# Tell your family, roommates, spouse, etc not to reconnect it.&lt;br /&gt;
&lt;br /&gt;
Check your software version to make sure you are on a version that can use this procedure&lt;br /&gt;
# Go to Settings -&amp;gt; About on your Google TV&lt;br /&gt;
# Look for version 20120126 or earlier.  Version 20120222 and later have been patched and will not work.&lt;br /&gt;
# If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from [[Sony Update Downloads]] and use a USB drive to install it before proceeding with this procedure.  (Eagle is the BluRay player, Asura is the TV)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=723</id>
		<title>I&#039;ve rooted... now what?!</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=I%27ve_rooted..._now_what%3F!&amp;diff=723"/>
		<updated>2012-03-03T19:35:59Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add mediocre instructions for useragent.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;A list of apps and things to do&lt;br /&gt;
&lt;br /&gt;
==Make CBS, hulu, etc work==&lt;br /&gt;
You will need to change your useragent in Chrome.  A good useragent to use is a real one.  Do a Google search for &amp;quot;what is my userid&amp;quot; and you&#039;ll find a web site that will show you what the useragent of your computer is.  Copy that for use on your GTV.&lt;br /&gt;
&lt;br /&gt;
==Apps that are available now==&lt;br /&gt;
[http://market.android.com/details?id=ccc71.pmw free terminal emulator] This app has other features, and not all of them work on GTV.&lt;br /&gt;
&lt;br /&gt;
[http://market.android.com/details?id=com.fede.launcher LauncherPro] a few features don&#039;t work&lt;br /&gt;
&lt;br /&gt;
==Apps that need work before they are available on GTV==&lt;br /&gt;
[http://market.android.com/details?id=jackpal.androidterm android terminal emulator] - &#039;&#039;&#039;not available for GTV yet&#039;&#039;&#039; due to [http://github.com/jackpal/Android-Terminal-Emulator/issues/46 issue #46]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=720</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=720"/>
		<updated>2012-03-03T17:42:35Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Windows Pre-setup */ Add another warning so users in over their head realize the gravity of these operations.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the most recent 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=719</id>
		<title>Sony Unsigned Kernels (SW Root)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Unsigned_Kernels_(SW_Root)&amp;diff=719"/>
		<updated>2012-03-03T17:38:44Z</updated>

		<summary type="html">&lt;p&gt;Catrane: /* Warnings */ User on IRC didn&amp;#039;t realize this would erase data on USB.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony NSX-40GT1]]&lt;br /&gt;
[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
[[File:Sony.png|frameless|caption]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== About ==&lt;br /&gt;
&lt;br /&gt;
The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the GTVHacker wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works.&lt;br /&gt;
[[About Sony Downgrade + Rebooter (Root)]]&lt;br /&gt;
&lt;br /&gt;
== Warnings ==&lt;br /&gt;
* This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.&lt;br /&gt;
* This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.&lt;br /&gt;
* This may brick your GTV. It shouldn&#039;t, but it still might!&lt;br /&gt;
* This will erase all data on the USB drive(s) used.&lt;br /&gt;
* &#039;&#039;&#039;You must be at the most recent 3.2 OTA (Over The Air) before proceeding!&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
== Tools Needed ==&lt;br /&gt;
&lt;br /&gt;
* 4 (512MB+) USB drives total&lt;br /&gt;
* Sony NSZ-GT1 (Eagle) or Sony 24&amp;quot;,32&amp;quot;,40&amp;quot;,46&amp;quot; GoogleTV (Asura)&lt;br /&gt;
&lt;br /&gt;
=== Windows Pre-setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open the a Windows command prompt (Windows key+R) or Start-&amp;gt;Run-&amp;gt;cmd then press enter.&lt;br /&gt;
# Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at [http://www.sophos.com/support/knowledgebase/article/13195.html Tutorial])&lt;br /&gt;
# Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Navigate into the Tools/ directory.&lt;br /&gt;
# Plug USB drive #1 in and then enter the following command into the command line:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	dd.exe --list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in &amp;quot;My Computer&amp;quot; to the corresponding &amp;quot;\\.\e:&amp;quot; (assuming the drive letter is e:). The format of the list should have the same syntax as the following:&lt;br /&gt;
#:&amp;lt;code&amp;gt;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&lt;br /&gt;
#:	  link to \\?\Device\Harddisk1\DP(1)0-0+11&lt;br /&gt;
#:	  removeable media&lt;br /&gt;
#:	  Mounted on \\.\e:&amp;lt;/code&amp;gt;&lt;br /&gt;
# Using the above example the information we are looking for is the top line &amp;quot;\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\&amp;quot;, we will want to remove the ending backslash and enter it into the following command syntax:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096&amp;lt;/code&amp;gt;	&lt;br /&gt;
# A successful completion would look as follows:&lt;br /&gt;
#:&amp;lt;code&amp;gt;rawwrite dd for windows version 0.5.&lt;br /&gt;
#:	Written by John Newbigin &amp;lt;jn@it.swin.edu.au&amp;gt;&lt;br /&gt;
#:	This program is covered by the GPL.  See copying.txt for details&lt;br /&gt;
#:	10240+0 records in&lt;br /&gt;
#:	10240+0 records out&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb&#039;s flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
# You are ready to start the downgrage + root.&lt;br /&gt;
&lt;br /&gt;
=== Mac Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Connect your USB Stick and open &amp;quot;Disk Utility&amp;quot; app.&lt;br /&gt;
# Open a terminal window and type the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	diskutil list&amp;lt;/code&amp;gt;&lt;br /&gt;
# Make note of which disk corresponds to your USB stick.&lt;br /&gt;
#:&amp;lt;code&amp;gt;	ex: dev/disk1&amp;lt;/code&amp;gt;&lt;br /&gt;
# View previously opened &amp;quot;Disk Utility&amp;quot; app and and select/highlight your thumb drives partition.&lt;br /&gt;
# Click the &amp;quot;unmount&amp;quot; button at the top of the &amp;quot;Disk Utility&amp;quot; window.&lt;br /&gt;
# In the terminal window type the following command replacing the &amp;quot;/dev/disk1&amp;quot; with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Syntax: dd if=USB#.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
#:&amp;lt;code&amp;gt;	Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.&lt;br /&gt;
&lt;br /&gt;
=== Linux Pre-Setup ===&lt;br /&gt;
&lt;br /&gt;
# Label 4 thumb drives with the numbers 1 2 3 and 4.&lt;br /&gt;
# Open a linux terminal.&lt;br /&gt;
# Plug in USB 1.&lt;br /&gt;
# Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player &amp;amp; Asura = Sony GoogleTV Panel) to USB1.img.&lt;br /&gt;
# Determine which device is your USB thumbdrive by using the command &amp;quot;dmesg&amp;quot; and looking for the last set of output with sdc/sdb/sdd/etc.&lt;br /&gt;
# Verify that the device is correct by matching the device name to the appropriate mount point in the following command:&lt;br /&gt;
#:&amp;lt;code&amp;gt;&amp;quot;cat /proc/mounts&amp;quot;&amp;lt;/code&amp;gt;&lt;br /&gt;
# If you believe you have the correct device then use the following command syntax for dd:&lt;br /&gt;
#:&amp;lt;code&amp;gt;Syntax:	dd if=USB#.img of=&amp;lt;volumeinfofromabove&amp;gt; bs=4096&lt;br /&gt;
#:	Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096&lt;br /&gt;
#:	Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096&amp;lt;/code&amp;gt;&lt;br /&gt;
# Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.&lt;br /&gt;
&lt;br /&gt;
== Downgrade/Rebooter Process ==&lt;br /&gt;
&lt;br /&gt;
# Boot Sony in recovery (hold power when plugging in).&lt;br /&gt;
# When the menu is displayed, insert &amp;quot;USB 1&amp;quot; and press 3 on the Sony keyboard.&lt;br /&gt;
# The device will ask if you want to [http://www.gtvhacker.com/index.php/File:Updateconfdg.jpg continue]. Remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 2&amp;quot;.  (Note: If the device does not ask you to continue, and instead displays &amp;quot;Update Data Error&amp;quot;, try using a different brand of USB stick.)&lt;br /&gt;
# Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.&lt;br /&gt;
# Wait another 20 seconds, The device should display an [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error]. Now press 0.&lt;br /&gt;
# The device should be showing the main recovery menu again, remove &amp;quot;USB 2&amp;quot; and then reinsert &amp;quot;USB 1&amp;quot;.&lt;br /&gt;
# Press 3 again. The device will ask if you want to continue, remove &amp;quot;USB 1&amp;quot; and insert &amp;quot;USB 3&amp;quot;.&lt;br /&gt;
# Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will [http://www.gtvhacker.com/index.php/File:Updatedataerror.jpg error].&lt;br /&gt;
# Press 0.&lt;br /&gt;
# Now unplug the box, and plug it back in while holding power. You should see the GTVHacker Sony splash, and you will now be in the old recovery.&lt;br /&gt;
# Insert &amp;quot;USB 4&amp;quot; and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read [http://www.gtvhacker.com/index.php/File:Systemupdatewithusb.jpg &amp;quot;System Update with USB checking for USB media mount status.&amp;quot;]&lt;br /&gt;
# When the update is complete the screen will change to show [http://www.gtvhacker.com/index.php/File:Updateconfrb.jpg &amp;quot;Install Complete - Press 0 and then 0!&amp;quot;]. Press 0, and then 0 again.&lt;br /&gt;
# The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!&lt;br /&gt;
&lt;br /&gt;
== Known Issues ==&lt;br /&gt;
----&lt;br /&gt;
* Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.&lt;br /&gt;
* 3.2 disables &amp;quot;Install from unknown sources&amp;quot; setting option, for instructions on manually setting this option visit [[http://gtvhacker.com/index.php/Enable_Non-Market_Apps_on_Sony_GTV Here]]&lt;br /&gt;
* dd.exe may not write properly under Windows 7.&lt;br /&gt;
* Blu-Ray eject light may continue to blink after disc is ejected. If so, remove power, and reboot.&lt;br /&gt;
&lt;br /&gt;
== Troubleshooting ==&lt;br /&gt;
&lt;br /&gt;
*You can get help from us or other users at:&lt;br /&gt;
&lt;br /&gt;
[http://forum.gtvhacker.com GTVHacker Forums]&lt;br /&gt;
&lt;br /&gt;
[http://www.gtvhacker.com GTVHacker Wiki]&lt;br /&gt;
&lt;br /&gt;
*or you can chat with us on IRC at:&lt;br /&gt;
&lt;br /&gt;
irc.freenode.net #gtvhacker&lt;br /&gt;
&lt;br /&gt;
[http://webchat.freenode.net/?randomnick=1&amp;amp;channels=gtvhacker&amp;amp;uio=d4 Freenode Webchat]&lt;br /&gt;
&lt;br /&gt;
(Someone may not be around right away to help, make sure to be willing to wait for a response)&lt;br /&gt;
&lt;br /&gt;
== Download ==&lt;br /&gt;
&lt;br /&gt;
* [http://www.zshare.net/download/9909845274c3c4c4/ Download Mirror 1]&lt;br /&gt;
* [http://www.wupload.com/file/2664230942/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 2]&lt;br /&gt;
* [http://www.filefactory.com/file/c3b4072/n/GTVHacker_-_Sony_Rebooter_&amp;amp;_Downgrader.zip Download Mirror 3]&lt;br /&gt;
* [http://uploading.com/files/88f92a25/GTVHacker%2B-%2BSony%2BRebooter%2B%2526%2BDowngrader.zip/ Download Mirror 4]&lt;br /&gt;
* [http://www.mediafire.com/?mjlbu2012s0r13i Download Mirror 5]&lt;br /&gt;
* [http://www.filedropper.com/gtvhacker-sonyrebooterdowngrader Download Mirror 6]&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=640</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=640"/>
		<updated>2011-11-01T17:49:52Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add link and release notes for GTV 3.1 OTA.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/a4affef29d91.package_list_ogm_2.1_2011052001ON_eagle.zip Sony Eagle 2011.05.20] (Appeared on June 1, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/b7e60d907b16.package_list_DMA-1_EAGLE_2011102306_WWV_ORSC.zip Sony Eagle 2011.10.23] (Android 3.1 - Appeared on November 1, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.05.20 ===&lt;br /&gt;
OGM (2011052001ON)&lt;br /&gt;
* Fix to be able to launch NBA Game Time.&lt;br /&gt;
* Playback compatibility for BD/CD was improved.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.10.23 ===&lt;br /&gt;
3.1_2011102306&lt;br /&gt;
&lt;br /&gt;
The Android 3.1 platform introduces many new and exciting features for users:&lt;br /&gt;
&lt;br /&gt;
- Experience a brand new, easy to navigate and customizable Home Screen.&lt;br /&gt;
&lt;br /&gt;
- Improve your ability to search for what you want to watch with Google TV&#039;s new &amp;quot;TV and Movies&amp;quot; application.&lt;br /&gt;
&lt;br /&gt;
- Enjoy YouTube in HD-quality channels created directly from your search queries.&lt;br /&gt;
&lt;br /&gt;
- Access to the new Android Market for TV. Download new forms of entertainment directly to your big screen with a variety of free and pay apps.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1557 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 (haven&#039;t check again as more found) bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f a9  d2 f9 52 eb ac 84 4a 5e  |..%C.._...R...J^|&lt;br /&gt;
00000450  79 8c 86 34 b8 09 31 66  81 91 6f 33 12 ba 6a 9c  |y..4..1f..o3..j.|&lt;br /&gt;
00000460  54 af 85 6c 0a 68 e0 c3  52 76 c4 a0 52 8e ee 42  |T..l.h..Rv..R..B|&lt;br /&gt;
00000470  c1 81 ac 2b 5f c2 0a 44  fe c5 41 c9 42 15 72 7f  |...+_..D..A.B.r.|&lt;br /&gt;
00000480  f2 2a 1a 4d ac 07 0a 02  ed 15 87 cb f7 f7 ab 5b  |.*.M...........[|&lt;br /&gt;
00000490  c3 9a a2 39 9b 18 82 4a  81 a6 0b 40 31 81 64 d2  |...9...J...@1.d.|&lt;br /&gt;
000004a0  75 96 17 c8 1c eb 62 01  25 b7 f2 9b 19 f6 13 4d  |u.....b.%......M|&lt;br /&gt;
000004b0  8a 26 61 a8 af ee b7 19  b7 6f 8c fb 4e 99 3a 5a  |.&amp;amp;a......o..N.:Z|&lt;br /&gt;
000004c0  46 d6 d9 e7 40 9f d5 7c  b0 25 56 e6 df 1e 36 84  |F...@..|.%V...6.|&lt;br /&gt;
000004d0  89 95 0f 79 4d 96 71 17  ca 1b 9f f2 d4 f6 39 f3  |...yM.q.......9.|&lt;br /&gt;
000004e0  77 5f 57 c7 1a 1b ee 60  13 58 14 03 38 3f 61 0d  |w_W....`.X..8?a.|&lt;br /&gt;
000004f0  95 ef 8f 56 f4 02 df f7  97 8f 4d b6 7b 72 e5 07  |...V......M.{r..|&lt;br /&gt;
00000500  82 62 e9 e4 25 4d a7 e3  c9 ab a3 f3 70 e0 2e 58  |.b..%M......p..X|&lt;br /&gt;
00000510  8c 3a 91 20 f0 b2 b6 ef  a9 04 0b a8 69 8b 0b 8f  |.:. ........i...|&lt;br /&gt;
00000520  e7 e7 21 55 df 3f 7f e4  02 a9 a9 c8 d4 5b 4f fd  |..!U.?.......[O.|&lt;br /&gt;
00000530  cb 19 1c ce 7a c0 1b 60  d4 d5 fb 80 29 d7 e8 f9  |....z..`....)...|&lt;br /&gt;
00000540  bb 9a 47 c1 79 42 82 e6  be 03 03 e6 45 0e 39 49  |..G.yB......E.9I|&lt;br /&gt;
00000550  e5 a6 99 72 eb 1b fb 79  38 38 e7 80 eb 5f 77 78  |...r...y88..._wx|&lt;br /&gt;
00000560  a9 31 87 42 14 d8 76 c7  02 94 00 e5 05 52 c7 68  |.1.B..v......R.h|&lt;br /&gt;
00000570  62 5a ce 65 ee a0 78 92  c1 16 99 1d d0 0c e4 67  |bZ.e..x........g|&lt;br /&gt;
00000580  91 d5 3e df 10 30 fe 38  dc f0 94 c6 f6 55 7d a3  |..&amp;gt;..0.8.....U}.|&lt;br /&gt;
00000590  89 57 3c 5e 5c 05 a1 d4  c1 fb 61 4f 51 ab 1c 38  |.W&amp;lt;^\.....aOQ..8|&lt;br /&gt;
000005a0  cd 64 a2 46 76 b9 e0 e5  ec 30 0f 98 48 3f 81 b5  |.d.Fv....0..H?..|&lt;br /&gt;
000005b0  d1 fc 2a 60 1e 89 cb d6  ef 9d 48 63 d0 6c 3f a8  |..*`......Hc.l?.|&lt;br /&gt;
000005c0  89 72 f3 60 03 b4 2b 4d  4c 14 25 4b 6b 73 62 18  |.r.`..+ML.%Kksb.|&lt;br /&gt;
000005d0  78 cb 09 66 be 4a 4b ba  b0 ec 5f bd ff 60 8a 05  |x..f.JK..._..`..|&lt;br /&gt;
000005e0  8c 32 5d 07 97 8c 63 1d  11 6c 56 af b1 d3 d1 fe  |.2]...c..lV.....|&lt;br /&gt;
000005f0  83 15 a9 a4 87 30 a3 09  42 46 46 58 74 1f 84 88  |.....0..BFFXt...|&lt;br /&gt;
00000600  97 37 0b 3c 83 95 3c 17  73 16 12 d0 e8 f9 fe 2e  |.7.&amp;lt;..&amp;lt;.s.......|&lt;br /&gt;
00000610  82 23 00 4a c0                                    |.#.J.|&lt;br /&gt;
00000615&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is not formatted. Start formating of spectra1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
UMOUNT /tmp/spe1&lt;br /&gt;
mkfs.ext3 /dev/Glob_Spectraa1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
if [ ! &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: no CURRENT_DATE&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
if [ &amp;quot;${BOUNDARY_DATE}&amp;quot; -lt &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: newer than boundary&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
echo &amp;quot;do factory reset&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# wipe data&lt;br /&gt;
#&lt;br /&gt;
mount /dev/sda7 /tmp/mnt7   ; chkerr&lt;br /&gt;
rm -rf /tmp/mnt7/*&lt;br /&gt;
&lt;br /&gt;
# make /data/system for default avsettings.db to be copied&lt;br /&gt;
mkdir -m 775 /tmp/mnt7/system    ; chkerr&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;partition was changed !!&amp;quot;&lt;br /&gt;
&lt;br /&gt;
umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda2  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda3  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda4  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda6  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda7  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda8  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda9  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
# delete partitions&lt;br /&gt;
printf &amp;quot;d\n 9\n d\n 8\n d\n 7\n d\n 6\n d\n 5\n d\n 4\n d\n 3\n d\n 2\n d\n 1\n w\n&amp;quot; | fdisk /dev/sda -H 16 -S 32 2&amp;gt; /dev/null 1&amp;gt;&amp;amp;2&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF00D0E552E552E7CFD9FF1200D9CFBE&lt;br /&gt;
:10097000E6FFE1CFD9FF040EE12600018C6BDF6AB0&lt;br /&gt;
:10098000010EDB6A6751050A01E1A2D0010A73E09A&lt;br /&gt;
:10099000070A5AE0010A44E0030A21E0010A05E0DF&lt;br /&gt;
:1009A000D9D80001010E8C6FC0D0020E8D5D0CE114&lt;br /&gt;
:1009B0008A51EA6AE60FE96E020EEA228DC0EFFF65&lt;br /&gt;
:1009C0008A2B010E676F0AD08D5104E1C3D8000154&lt;br /&gt;
:1009D000676B04D0BFD80001010E8C6FA6D0F00E5B&lt;br /&gt;
:1009E0008D1530080CE0F00E8D15400808E0F00E73&lt;br /&gt;
:1009F0008D15600804E0F00E8D1570080CE18A5129&lt;br /&gt;
:100A0000EA6AE60FE96E020E&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=586</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=586"/>
		<updated>2011-06-02T16:22:42Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add 2011052001ON link.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/a4affef29d91.package_list_ogm_2.1_2011052001ON_eagle.zip Sony Eagle 2011.05.20] (Appeared on June 1, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.05.20 ===&lt;br /&gt;
OGM (2011052001ON)&lt;br /&gt;
* Fix to be able to launch NBA Game Time.&lt;br /&gt;
* Playback compatibility for BD/CD was improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1557 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 (haven&#039;t check again as more found) bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f a9  d2 f9 52 eb ac 84 4a 5e  |..%C.._...R...J^|&lt;br /&gt;
00000450  79 8c 86 34 b8 09 31 66  81 91 6f 33 12 ba 6a 9c  |y..4..1f..o3..j.|&lt;br /&gt;
00000460  54 af 85 6c 0a 68 e0 c3  52 76 c4 a0 52 8e ee 42  |T..l.h..Rv..R..B|&lt;br /&gt;
00000470  c1 81 ac 2b 5f c2 0a 44  fe c5 41 c9 42 15 72 7f  |...+_..D..A.B.r.|&lt;br /&gt;
00000480  f2 2a 1a 4d ac 07 0a 02  ed 15 87 cb f7 f7 ab 5b  |.*.M...........[|&lt;br /&gt;
00000490  c3 9a a2 39 9b 18 82 4a  81 a6 0b 40 31 81 64 d2  |...9...J...@1.d.|&lt;br /&gt;
000004a0  75 96 17 c8 1c eb 62 01  25 b7 f2 9b 19 f6 13 4d  |u.....b.%......M|&lt;br /&gt;
000004b0  8a 26 61 a8 af ee b7 19  b7 6f 8c fb 4e 99 3a 5a  |.&amp;amp;a......o..N.:Z|&lt;br /&gt;
000004c0  46 d6 d9 e7 40 9f d5 7c  b0 25 56 e6 df 1e 36 84  |F...@..|.%V...6.|&lt;br /&gt;
000004d0  89 95 0f 79 4d 96 71 17  ca 1b 9f f2 d4 f6 39 f3  |...yM.q.......9.|&lt;br /&gt;
000004e0  77 5f 57 c7 1a 1b ee 60  13 58 14 03 38 3f 61 0d  |w_W....`.X..8?a.|&lt;br /&gt;
000004f0  95 ef 8f 56 f4 02 df f7  97 8f 4d b6 7b 72 e5 07  |...V......M.{r..|&lt;br /&gt;
00000500  82 62 e9 e4 25 4d a7 e3  c9 ab a3 f3 70 e0 2e 58  |.b..%M......p..X|&lt;br /&gt;
00000510  8c 3a 91 20 f0 b2 b6 ef  a9 04 0b a8 69 8b 0b 8f  |.:. ........i...|&lt;br /&gt;
00000520  e7 e7 21 55 df 3f 7f e4  02 a9 a9 c8 d4 5b 4f fd  |..!U.?.......[O.|&lt;br /&gt;
00000530  cb 19 1c ce 7a c0 1b 60  d4 d5 fb 80 29 d7 e8 f9  |....z..`....)...|&lt;br /&gt;
00000540  bb 9a 47 c1 79 42 82 e6  be 03 03 e6 45 0e 39 49  |..G.yB......E.9I|&lt;br /&gt;
00000550  e5 a6 99 72 eb 1b fb 79  38 38 e7 80 eb 5f 77 78  |...r...y88..._wx|&lt;br /&gt;
00000560  a9 31 87 42 14 d8 76 c7  02 94 00 e5 05 52 c7 68  |.1.B..v......R.h|&lt;br /&gt;
00000570  62 5a ce 65 ee a0 78 92  c1 16 99 1d d0 0c e4 67  |bZ.e..x........g|&lt;br /&gt;
00000580  91 d5 3e df 10 30 fe 38  dc f0 94 c6 f6 55 7d a3  |..&amp;gt;..0.8.....U}.|&lt;br /&gt;
00000590  89 57 3c 5e 5c 05 a1 d4  c1 fb 61 4f 51 ab 1c 38  |.W&amp;lt;^\.....aOQ..8|&lt;br /&gt;
000005a0  cd 64 a2 46 76 b9 e0 e5  ec 30 0f 98 48 3f 81 b5  |.d.Fv....0..H?..|&lt;br /&gt;
000005b0  d1 fc 2a 60 1e 89 cb d6  ef 9d 48 63 d0 6c 3f a8  |..*`......Hc.l?.|&lt;br /&gt;
000005c0  89 72 f3 60 03 b4 2b 4d  4c 14 25 4b 6b 73 62 18  |.r.`..+ML.%Kksb.|&lt;br /&gt;
000005d0  78 cb 09 66 be 4a 4b ba  b0 ec 5f bd ff 60 8a 05  |x..f.JK..._..`..|&lt;br /&gt;
000005e0  8c 32 5d 07 97 8c 63 1d  11 6c 56 af b1 d3 d1 fe  |.2]...c..lV.....|&lt;br /&gt;
000005f0  83 15 a9 a4 87 30 a3 09  42 46 46 58 74 1f 84 88  |.....0..BFFXt...|&lt;br /&gt;
00000600  97 37 0b 3c 83 95 3c 17  73 16 12 d0 e8 f9 fe 2e  |.7.&amp;lt;..&amp;lt;.s.......|&lt;br /&gt;
00000610  82 23 00 4a c0                                    |.#.J.|&lt;br /&gt;
00000615&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is not formatted. Start formating of spectra1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
UMOUNT /tmp/spe1&lt;br /&gt;
mkfs.ext3 /dev/Glob_Spectraa1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
if [ ! &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: no CURRENT_DATE&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
if [ &amp;quot;${BOUNDARY_DATE}&amp;quot; -lt &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: newer than boundary&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
echo &amp;quot;do factory reset&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# wipe data&lt;br /&gt;
#&lt;br /&gt;
mount /dev/sda7 /tmp/mnt7   ; chkerr&lt;br /&gt;
rm -rf /tmp/mnt7/*&lt;br /&gt;
&lt;br /&gt;
# make /data/system for default avsettings.db to be copied&lt;br /&gt;
mkdir -m 775 /tmp/mnt7/system    ; chkerr&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;partition was changed !!&amp;quot;&lt;br /&gt;
&lt;br /&gt;
umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda2  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda3  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda4  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda6  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda7  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda8  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda9  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
# delete partitions&lt;br /&gt;
printf &amp;quot;d\n 9\n d\n 8\n d\n 7\n d\n 6\n d\n 5\n d\n 4\n d\n 3\n d\n 2\n d\n 1\n w\n&amp;quot; | fdisk /dev/sda -H 16 -S 32 2&amp;gt; /dev/null 1&amp;gt;&amp;amp;2&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF00D0E552E552E7CFD9FF1200D9CFBE&lt;br /&gt;
:10097000E6FFE1CFD9FF040EE12600018C6BDF6AB0&lt;br /&gt;
:10098000010EDB6A6751050A01E1A2D0010A73E09A&lt;br /&gt;
:10099000070A5AE0010A44E0030A21E0010A05E0DF&lt;br /&gt;
:1009A000D9D80001010E8C6FC0D0020E8D5D0CE114&lt;br /&gt;
:1009B0008A51EA6AE60FE96E020EEA228DC0EFFF65&lt;br /&gt;
:1009C0008A2B010E676F0AD08D5104E1C3D8000154&lt;br /&gt;
:1009D000676B04D0BFD80001010E8C6FA6D0F00E5B&lt;br /&gt;
:1009E0008D1530080CE0F00E8D15400808E0F00E73&lt;br /&gt;
:1009F0008D15600804E0F00E8D1570080CE18A5129&lt;br /&gt;
:100A0000EA6AE60FE96E020E&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=585</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=585"/>
		<updated>2011-06-02T15:40:52Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add 2011052001ON release notes.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.05.20 ===&lt;br /&gt;
OGM (2011052001ON)&lt;br /&gt;
* Fix to be able to launch NBA Game Time.&lt;br /&gt;
* Playback compatibility for BD/CD was improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1557 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 (haven&#039;t check again as more found) bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f a9  d2 f9 52 eb ac 84 4a 5e  |..%C.._...R...J^|&lt;br /&gt;
00000450  79 8c 86 34 b8 09 31 66  81 91 6f 33 12 ba 6a 9c  |y..4..1f..o3..j.|&lt;br /&gt;
00000460  54 af 85 6c 0a 68 e0 c3  52 76 c4 a0 52 8e ee 42  |T..l.h..Rv..R..B|&lt;br /&gt;
00000470  c1 81 ac 2b 5f c2 0a 44  fe c5 41 c9 42 15 72 7f  |...+_..D..A.B.r.|&lt;br /&gt;
00000480  f2 2a 1a 4d ac 07 0a 02  ed 15 87 cb f7 f7 ab 5b  |.*.M...........[|&lt;br /&gt;
00000490  c3 9a a2 39 9b 18 82 4a  81 a6 0b 40 31 81 64 d2  |...9...J...@1.d.|&lt;br /&gt;
000004a0  75 96 17 c8 1c eb 62 01  25 b7 f2 9b 19 f6 13 4d  |u.....b.%......M|&lt;br /&gt;
000004b0  8a 26 61 a8 af ee b7 19  b7 6f 8c fb 4e 99 3a 5a  |.&amp;amp;a......o..N.:Z|&lt;br /&gt;
000004c0  46 d6 d9 e7 40 9f d5 7c  b0 25 56 e6 df 1e 36 84  |F...@..|.%V...6.|&lt;br /&gt;
000004d0  89 95 0f 79 4d 96 71 17  ca 1b 9f f2 d4 f6 39 f3  |...yM.q.......9.|&lt;br /&gt;
000004e0  77 5f 57 c7 1a 1b ee 60  13 58 14 03 38 3f 61 0d  |w_W....`.X..8?a.|&lt;br /&gt;
000004f0  95 ef 8f 56 f4 02 df f7  97 8f 4d b6 7b 72 e5 07  |...V......M.{r..|&lt;br /&gt;
00000500  82 62 e9 e4 25 4d a7 e3  c9 ab a3 f3 70 e0 2e 58  |.b..%M......p..X|&lt;br /&gt;
00000510  8c 3a 91 20 f0 b2 b6 ef  a9 04 0b a8 69 8b 0b 8f  |.:. ........i...|&lt;br /&gt;
00000520  e7 e7 21 55 df 3f 7f e4  02 a9 a9 c8 d4 5b 4f fd  |..!U.?.......[O.|&lt;br /&gt;
00000530  cb 19 1c ce 7a c0 1b 60  d4 d5 fb 80 29 d7 e8 f9  |....z..`....)...|&lt;br /&gt;
00000540  bb 9a 47 c1 79 42 82 e6  be 03 03 e6 45 0e 39 49  |..G.yB......E.9I|&lt;br /&gt;
00000550  e5 a6 99 72 eb 1b fb 79  38 38 e7 80 eb 5f 77 78  |...r...y88..._wx|&lt;br /&gt;
00000560  a9 31 87 42 14 d8 76 c7  02 94 00 e5 05 52 c7 68  |.1.B..v......R.h|&lt;br /&gt;
00000570  62 5a ce 65 ee a0 78 92  c1 16 99 1d d0 0c e4 67  |bZ.e..x........g|&lt;br /&gt;
00000580  91 d5 3e df 10 30 fe 38  dc f0 94 c6 f6 55 7d a3  |..&amp;gt;..0.8.....U}.|&lt;br /&gt;
00000590  89 57 3c 5e 5c 05 a1 d4  c1 fb 61 4f 51 ab 1c 38  |.W&amp;lt;^\.....aOQ..8|&lt;br /&gt;
000005a0  cd 64 a2 46 76 b9 e0 e5  ec 30 0f 98 48 3f 81 b5  |.d.Fv....0..H?..|&lt;br /&gt;
000005b0  d1 fc 2a 60 1e 89 cb d6  ef 9d 48 63 d0 6c 3f a8  |..*`......Hc.l?.|&lt;br /&gt;
000005c0  89 72 f3 60 03 b4 2b 4d  4c 14 25 4b 6b 73 62 18  |.r.`..+ML.%Kksb.|&lt;br /&gt;
000005d0  78 cb 09 66 be 4a 4b ba  b0 ec 5f bd ff 60 8a 05  |x..f.JK..._..`..|&lt;br /&gt;
000005e0  8c 32 5d 07 97 8c 63 1d  11 6c 56 af b1 d3 d1 fe  |.2]...c..lV.....|&lt;br /&gt;
000005f0  83 15 a9 a4 87 30 a3 09  42 46 46 58 74 1f 84 88  |.....0..BFFXt...|&lt;br /&gt;
00000600  97 37 0b 3c 83 95 3c 17  73 16 12 d0 e8 f9 fe 2e  |.7.&amp;lt;..&amp;lt;.s.......|&lt;br /&gt;
00000610  82 23 00 4a c0                                    |.#.J.|&lt;br /&gt;
00000615&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is not formatted. Start formating of spectra1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
UMOUNT /tmp/spe1&lt;br /&gt;
mkfs.ext3 /dev/Glob_Spectraa1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
if [ ! &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: no CURRENT_DATE&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
if [ &amp;quot;${BOUNDARY_DATE}&amp;quot; -lt &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: newer than boundary&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
echo &amp;quot;do factory reset&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# wipe data&lt;br /&gt;
#&lt;br /&gt;
mount /dev/sda7 /tmp/mnt7   ; chkerr&lt;br /&gt;
rm -rf /tmp/mnt7/*&lt;br /&gt;
&lt;br /&gt;
# make /data/system for default avsettings.db to be copied&lt;br /&gt;
mkdir -m 775 /tmp/mnt7/system    ; chkerr&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;partition was changed !!&amp;quot;&lt;br /&gt;
&lt;br /&gt;
umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda2  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda3  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda4  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda6  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda7  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda8  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda9  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
# delete partitions&lt;br /&gt;
printf &amp;quot;d\n 9\n d\n 8\n d\n 7\n d\n 6\n d\n 5\n d\n 4\n d\n 3\n d\n 2\n d\n 1\n w\n&amp;quot; | fdisk /dev/sda -H 16 -S 32 2&amp;gt; /dev/null 1&amp;gt;&amp;amp;2&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF00D0E552E552E7CFD9FF1200D9CFBE&lt;br /&gt;
:10097000E6FFE1CFD9FF040EE12600018C6BDF6AB0&lt;br /&gt;
:10098000010EDB6A6751050A01E1A2D0010A73E09A&lt;br /&gt;
:10099000070A5AE0010A44E0030A21E0010A05E0DF&lt;br /&gt;
:1009A000D9D80001010E8C6FC0D0020E8D5D0CE114&lt;br /&gt;
:1009B0008A51EA6AE60FE96E020EEA228DC0EFFF65&lt;br /&gt;
:1009C0008A2B010E676F0AD08D5104E1C3D8000154&lt;br /&gt;
:1009D000676B04D0BFD80001010E8C6FA6D0F00E5B&lt;br /&gt;
:1009E0008D1530080CE0F00E8D15400808E0F00E73&lt;br /&gt;
:1009F0008D15600804E0F00E8D1570080CE18A5129&lt;br /&gt;
:100A0000EA6AE60FE96E020E&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=574</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=574"/>
		<updated>2011-05-04T00:36:39Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Update to 1557 bytes.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1557 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 (haven&#039;t check again as more found) bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f a9  d2 f9 52 eb ac 84 4a 5e  |..%C.._...R...J^|&lt;br /&gt;
00000450  79 8c 86 34 b8 09 31 66  81 91 6f 33 12 ba 6a 9c  |y..4..1f..o3..j.|&lt;br /&gt;
00000460  54 af 85 6c 0a 68 e0 c3  52 76 c4 a0 52 8e ee 42  |T..l.h..Rv..R..B|&lt;br /&gt;
00000470  c1 81 ac 2b 5f c2 0a 44  fe c5 41 c9 42 15 72 7f  |...+_..D..A.B.r.|&lt;br /&gt;
00000480  f2 2a 1a 4d ac 07 0a 02  ed 15 87 cb f7 f7 ab 5b  |.*.M...........[|&lt;br /&gt;
00000490  c3 9a a2 39 9b 18 82 4a  81 a6 0b 40 31 81 64 d2  |...9...J...@1.d.|&lt;br /&gt;
000004a0  75 96 17 c8 1c eb 62 01  25 b7 f2 9b 19 f6 13 4d  |u.....b.%......M|&lt;br /&gt;
000004b0  8a 26 61 a8 af ee b7 19  b7 6f 8c fb 4e 99 3a 5a  |.&amp;amp;a......o..N.:Z|&lt;br /&gt;
000004c0  46 d6 d9 e7 40 9f d5 7c  b0 25 56 e6 df 1e 36 84  |F...@..|.%V...6.|&lt;br /&gt;
000004d0  89 95 0f 79 4d 96 71 17  ca 1b 9f f2 d4 f6 39 f3  |...yM.q.......9.|&lt;br /&gt;
000004e0  77 5f 57 c7 1a 1b ee 60  13 58 14 03 38 3f 61 0d  |w_W....`.X..8?a.|&lt;br /&gt;
000004f0  95 ef 8f 56 f4 02 df f7  97 8f 4d b6 7b 72 e5 07  |...V......M.{r..|&lt;br /&gt;
00000500  82 62 e9 e4 25 4d a7 e3  c9 ab a3 f3 70 e0 2e 58  |.b..%M......p..X|&lt;br /&gt;
00000510  8c 3a 91 20 f0 b2 b6 ef  a9 04 0b a8 69 8b 0b 8f  |.:. ........i...|&lt;br /&gt;
00000520  e7 e7 21 55 df 3f 7f e4  02 a9 a9 c8 d4 5b 4f fd  |..!U.?.......[O.|&lt;br /&gt;
00000530  cb 19 1c ce 7a c0 1b 60  d4 d5 fb 80 29 d7 e8 f9  |....z..`....)...|&lt;br /&gt;
00000540  bb 9a 47 c1 79 42 82 e6  be 03 03 e6 45 0e 39 49  |..G.yB......E.9I|&lt;br /&gt;
00000550  e5 a6 99 72 eb 1b fb 79  38 38 e7 80 eb 5f 77 78  |...r...y88..._wx|&lt;br /&gt;
00000560  a9 31 87 42 14 d8 76 c7  02 94 00 e5 05 52 c7 68  |.1.B..v......R.h|&lt;br /&gt;
00000570  62 5a ce 65 ee a0 78 92  c1 16 99 1d d0 0c e4 67  |bZ.e..x........g|&lt;br /&gt;
00000580  91 d5 3e df 10 30 fe 38  dc f0 94 c6 f6 55 7d a3  |..&amp;gt;..0.8.....U}.|&lt;br /&gt;
00000590  89 57 3c 5e 5c 05 a1 d4  c1 fb 61 4f 51 ab 1c 38  |.W&amp;lt;^\.....aOQ..8|&lt;br /&gt;
000005a0  cd 64 a2 46 76 b9 e0 e5  ec 30 0f 98 48 3f 81 b5  |.d.Fv....0..H?..|&lt;br /&gt;
000005b0  d1 fc 2a 60 1e 89 cb d6  ef 9d 48 63 d0 6c 3f a8  |..*`......Hc.l?.|&lt;br /&gt;
000005c0  89 72 f3 60 03 b4 2b 4d  4c 14 25 4b 6b 73 62 18  |.r.`..+ML.%Kksb.|&lt;br /&gt;
000005d0  78 cb 09 66 be 4a 4b ba  b0 ec 5f bd ff 60 8a 05  |x..f.JK..._..`..|&lt;br /&gt;
000005e0  8c 32 5d 07 97 8c 63 1d  11 6c 56 af b1 d3 d1 fe  |.2]...c..lV.....|&lt;br /&gt;
000005f0  83 15 a9 a4 87 30 a3 09  42 46 46 58 74 1f 84 88  |.....0..BFFXt...|&lt;br /&gt;
00000600  97 37 0b 3c 83 95 3c 17  73 16 12 d0 e8 f9 fe 2e  |.7.&amp;lt;..&amp;lt;.s.......|&lt;br /&gt;
00000610  82 23 00 4a c0                                    |.#.J.|&lt;br /&gt;
00000615&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is not formatted. Start formating of spectra1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
UMOUNT /tmp/spe1&lt;br /&gt;
mkfs.ext3 /dev/Glob_Spectraa1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
if [ ! &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: no CURRENT_DATE&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
if [ &amp;quot;${BOUNDARY_DATE}&amp;quot; -lt &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: newer than boundary&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
echo &amp;quot;do factory reset&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# wipe data&lt;br /&gt;
#&lt;br /&gt;
mount /dev/sda7 /tmp/mnt7   ; chkerr&lt;br /&gt;
rm -rf /tmp/mnt7/*&lt;br /&gt;
&lt;br /&gt;
# make /data/system for default avsettings.db to be copied&lt;br /&gt;
mkdir -m 775 /tmp/mnt7/system    ; chkerr&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;partition was changed !!&amp;quot;&lt;br /&gt;
&lt;br /&gt;
umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda2  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda3  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda4  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda6  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda7  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda8  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda9  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
# delete partitions&lt;br /&gt;
printf &amp;quot;d\n 9\n d\n 8\n d\n 7\n d\n 6\n d\n 5\n d\n 4\n d\n 3\n d\n 2\n d\n 1\n w\n&amp;quot; | fdisk /dev/sda -H 16 -S 32 2&amp;gt; /dev/null 1&amp;gt;&amp;amp;2&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF00D0E552E552E7CFD9FF1200D9CFBE&lt;br /&gt;
:10097000E6FFE1CFD9FF040EE12600018C6BDF6AB0&lt;br /&gt;
:10098000010EDB6A6751050A01E1A2D0010A73E09A&lt;br /&gt;
:10099000070A5AE0010A44E0030A21E0010A05E0DF&lt;br /&gt;
:1009A000D9D80001010E8C6FC0D0020E8D5D0CE114&lt;br /&gt;
:1009B0008A51EA6AE60FE96E020EEA228DC0EFFF65&lt;br /&gt;
:1009C0008A2B010E676F0AD08D5104E1C3D8000154&lt;br /&gt;
:1009D000676B04D0BFD80001010E8C6FA6D0F00E5B&lt;br /&gt;
:1009E0008D1530080CE0F00E8D15400808E0F00E73&lt;br /&gt;
:1009F0008D15600804E0F00E8D1570080CE18A5129&lt;br /&gt;
:100A0000EA6AE60FE96E020E&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=573</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=573"/>
		<updated>2011-05-03T17:41:16Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Extend hash to 1405 bytes.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1405 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 (haven&#039;t check again as more found) bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f a9  d2 f9 52 eb ac 84 4a 5e  |..%C.._...R...J^|&lt;br /&gt;
00000450  79 8c 86 34 b8 09 31 66  81 91 6f 33 12 ba 6a 9c  |y..4..1f..o3..j.|&lt;br /&gt;
00000460  54 af 85 6c 0a 68 e0 c3  52 76 c4 a0 52 8e ee 42  |T..l.h..Rv..R..B|&lt;br /&gt;
00000470  c1 81 ac 2b 5f c2 0a 44  fe c5 41 c9 42 15 72 7f  |...+_..D..A.B.r.|&lt;br /&gt;
00000480  f2 2a 1a 4d ac 07 0a 02  ed 15 87 cb f7 f7 ab 5b  |.*.M...........[|&lt;br /&gt;
00000490  c3 9a a2 39 9b 18 82 4a  81 a6 0b 40 31 81 64 d2  |...9...J...@1.d.|&lt;br /&gt;
000004a0  75 96 17 c8 1c eb 62 01  25 b7 f2 9b 19 f6 13 4d  |u.....b.%......M|&lt;br /&gt;
000004b0  8a 26 61 a8 af ee b7 19  b7 6f 8c fb 4e 99 3a 5a  |.&amp;amp;a......o..N.:Z|&lt;br /&gt;
000004c0  46 d6 d9 e7 40 9f d5 7c  b0 25 56 e6 df 1e 36 84  |F...@..|.%V...6.|&lt;br /&gt;
000004d0  89 95 0f 79 4d 96 71 17  ca 1b 9f f2 d4 f6 39 f3  |...yM.q.......9.|&lt;br /&gt;
000004e0  77 5f 57 c7 1a 1b ee 60  13 58 14 03 38 3f 61 0d  |w_W....`.X..8?a.|&lt;br /&gt;
000004f0  95 ef 8f 56 f4 02 df f7  97 8f 4d b6 7b 72 e5 07  |...V......M.{r..|&lt;br /&gt;
00000500  82 62 e9 e4 25 4d a7 e3  c9 ab a3 f3 70 e0 2e 58  |.b..%M......p..X|&lt;br /&gt;
00000510  8c 3a 91 20 f0 b2 b6 ef  a9 04 0b a8 69 8b 0b 8f  |.:. ........i...|&lt;br /&gt;
00000520  e7 e7 21 55 df 3f 7f e4  02 a9 a9 c8 d4 5b 4f fd  |..!U.?.......[O.|&lt;br /&gt;
00000530  cb 19 1c ce 7a c0 1b 60  d4 d5 fb 80 29 d7 e8 f9  |....z..`....)...|&lt;br /&gt;
00000540  bb 9a 47 c1 79 42 82 e6  be 03 03 e6 45 0e 39 49  |..G.yB......E.9I|&lt;br /&gt;
00000550  e5 a6 99 72 eb 1b fb 79  38 38 e7 80 eb 5f 77 78  |...r...y88..._wx|&lt;br /&gt;
00000560  a9 31 87 42 14 d8 76 c7  02 94 00 e5 05 52 c7 68  |.1.B..v......R.h|&lt;br /&gt;
00000570  62 5a ce 65 ee a0 78 92  c1 16 99 1d d0           |bZ.e..x......|&lt;br /&gt;
0000057d&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is not formatted. Start formating of spectra1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
UMOUNT /tmp/spe1&lt;br /&gt;
mkfs.ext3 /dev/Glob_Spectraa1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
if [ ! &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: no CURRENT_DATE&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
if [ &amp;quot;${BOUNDARY_DATE}&amp;quot; -lt &amp;quot;${CURRENT_DATE}&amp;quot; ]; then&lt;br /&gt;
    echo &amp;quot;donot factory reset: newer than boundary&amp;quot;&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
echo &amp;quot;do factory reset&amp;quot;&lt;br /&gt;
&lt;br /&gt;
# wipe data&lt;br /&gt;
#&lt;br /&gt;
mount&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;partition was changed !!&amp;quot;&lt;br /&gt;
&lt;br /&gt;
umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda2  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda3  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda4  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda6  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda7  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda8  2&amp;gt; /dev/null&lt;br /&gt;
umount /dev/sda9  2&amp;gt; /dev/null&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF00D0E552E552E7CFD9FF1200D9CFBE&lt;br /&gt;
:10097000E6FFE1CFD9FF040EE12600018C6BDF6AB0&lt;br /&gt;
:10098000010EDB6A6751050A01E1A2D0010A73E09A&lt;br /&gt;
:10099000070A5AE0010A44E0030A21E0010A05E0DF&lt;br /&gt;
:1009A000D9D80001010E8C6FC0D0020E8D5D0CE114&lt;br /&gt;
:1009B0008A51EA6AE60FE96E020EEA228DC0EFFF65&lt;br /&gt;
:1009C0008A2B010E676F0AD08D5104E1C3D8000154&lt;br /&gt;
:1009D000&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=572</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=572"/>
		<updated>2011-05-03T17:34:28Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Minor link wikicode fix.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1095 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f                           |..%C.._|&lt;br /&gt;
00000447&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is no&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -n&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
ech&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=567</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=567"/>
		<updated>2011-04-30T16:19:45Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add new link.  Minor cleanup.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
Unknown update on Mar 13, 2011.&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.02 (Missed link on Mar 15, 2011)&lt;br /&gt;
&lt;br /&gt;
Sony Eagle 2011.03.24 (Missed link on April 10, 2011)&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/data/ota/sony_eagle/6be261ddd991.package_list_ogm_2.1_2011042002ON_eagle.zip|Sony Eagle 2011.04.20] (Appeared on April 29, 2011)&lt;br /&gt;
&lt;br /&gt;
== Release Notes ==&lt;br /&gt;
=== Sony Eagle 2011.03.02 ===&lt;br /&gt;
OGM (2011030201ON)&lt;br /&gt;
* Music Unlimited powered by Qriocity has been supported&lt;br /&gt;
* The Media Player now supports WMA format&lt;br /&gt;
* WiFi connection stability has been improved&lt;br /&gt;
* Blu-ray disc compatibility has been improved&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.03.24 ===&lt;br /&gt;
OGM1.3.1 (2011032401ON)&lt;br /&gt;
* Security Patch.&lt;br /&gt;
&lt;br /&gt;
=== Sony Eagle 2011.04.20 ===&lt;br /&gt;
OGM (2011042002ON)&lt;br /&gt;
* Security patch.&lt;br /&gt;
* Music Unlimited powered by Qriocity has been improved.&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1095 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f                           |..%C.._|&lt;br /&gt;
00000447&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is no&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -n&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
ech&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=557</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=557"/>
		<updated>2011-03-15T03:34:33Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add documentation of a couple updates.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[Category:Sony]]&lt;br /&gt;
&lt;br /&gt;
== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
test 3 (the name displayed on the screen actually identified it as &amp;quot;test 3&amp;quot;.  I missed the link and probably won&#039;t be able to produce it.  Current as of Mar 13, 2011.)&lt;br /&gt;
&lt;br /&gt;
Unknown Title (This one just appeared the evening of Mar 14, 2011 but I didn&#039;t have my packet sniffer running.  Will probably try doing a factory reset on the device to see if it will redownload.)&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1095 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f                           |..%C.._|&lt;br /&gt;
00000447&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is no&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -n&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
ech&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=537</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=537"/>
		<updated>2011-02-12T17:58:06Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add note about test findings.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1095 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
* I tried applying the first 1024 bytes of the mask starting at every byte position in the RfHid_v0156_2010091601_NL.hex and only found valid content when applied to the start of the file.  This pretty well establishes that there&#039;s no repetition of the mask.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f                           |..%C.._|&lt;br /&gt;
00000447&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is no&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -n&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
ech&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=536</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=536"/>
		<updated>2011-02-12T17:08:40Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Updated pad.  756 -&amp;gt; 1095 bytes.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 1095 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 1095 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
000002f0  55 c5 ce dd 51 6c 38 a7  74 c5 e2 d6 e1 fb 01 1b  |U...Ql8.t.......|&lt;br /&gt;
00000300  c2 e3 d4 ff 3b 0c 9e 53  eb 67 e1 ce 80 65 ec d9  |....;..S.g...e..|&lt;br /&gt;
00000310  95 e5 f7 8e 45 64 fd 5d  29 6a c4 fe cc ce f0 61  |....Ed.])j.....a|&lt;br /&gt;
00000320  97 58 97 82 d5 69 b6 af  34 fe d1 ff 9c 4f b9 01  |.X...i..4....O..|&lt;br /&gt;
00000330  0e 27 92 f8 60 52 ee 03  e7 9a e7 42 f0 62 f6 87  |.&#039;..`R.....B.b..|&lt;br /&gt;
00000340  cd 3b d2 de d4 57 29 15  d2 9b 6e 8f 8a 37 8d 1e  |.;...W)...n..7..|&lt;br /&gt;
00000350  98 3e d0 b7 a1 83 a5 cb  7c c4 d4 60 1f 61 ea a6  |.&amp;gt;......|..`.a..|&lt;br /&gt;
00000360  56 fc b3 75 e5 fc c2 1e  cd 6f a9 1b 82 25 41 97  |V..u.....o...%A.|&lt;br /&gt;
00000370  16 d1 13 e3 90 c2 e8 48  ce 20 cc dc 91 d6 95 12  |.......H. ......|&lt;br /&gt;
00000380  d2 bd c6 94 8e 65 16 7f  da a4 64 11 95 76 b9 30  |.....e....d..v.0|&lt;br /&gt;
00000390  11 c8 d9 96 ef d6 b7 ea  d9 c1 a9 85 b7 d5 36 5f  |..............6_|&lt;br /&gt;
000003a0  c7 84 24 67 98 56 7a 2e  98 6c 14 7f de 5e 79 bf  |..$g.Vz..l...^y.|&lt;br /&gt;
000003b0  b1 10 1a 6f 64 ba 3b 05  ea 7a f0 57 a2 de d9 9b  |...od.;..z.W....|&lt;br /&gt;
000003c0  9b 1c 36 c8 2c 6a 31 b5  80 66 e8 0f c3 dc d3 84  |..6.,j1..f......|&lt;br /&gt;
000003d0  08 09 f2 11 74 6e 01 a4  74 c6 7d 70 f4 92 0f 63  |....tn..t.}p...c|&lt;br /&gt;
000003e0  c2 b2 5f bc e9 ba bd 76  56 ff 6b 69 90 a3 a1 a8  |.._....vV.ki....|&lt;br /&gt;
000003f0  4c 68 2d 53 06 63 14 87  b6 b6 a1 95 a6 98 40 33  |Lh-S.c........@3|&lt;br /&gt;
00000400  f5 1e 8a 22 fe 24 ff b6  d3 29 98 17 c4 af e0 06  |...&amp;quot;.$...)......|&lt;br /&gt;
00000410  50 ee eb b2 40 be a9 45  e8 45 69 cb cf be e6 73  |P...@..E.Ei....s|&lt;br /&gt;
00000420  09 5a 63 58 45 21 53 61  f1 b3 7f 4c 36 0f a6 70  |.ZcXE!Sa...L6..p|&lt;br /&gt;
00000430  d0 5e 80 c0 3b f1 89 ba  0f 5e e2 33 01 83 b9 c9  |.^..;....^.3....|&lt;br /&gt;
00000440  e8 9e 25 43 ce ff 5f                           |..%C.._|&lt;br /&gt;
00000447&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh (full file)&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  ret=$?&lt;br /&gt;
  if [ $ret -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
# arguments&lt;br /&gt;
#PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
#TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
#PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02, &lt;br /&gt;
#                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
&lt;br /&gt;
# for old installer support (evt only)&lt;br /&gt;
[ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
[ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
[ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
[ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
&lt;br /&gt;
mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
&lt;br /&gt;
printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board.conf&lt;br /&gt;
chown 0:0 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
chmod 444 /tmp/mnt1/etc/board.conf ; chkerr&lt;br /&gt;
&lt;br /&gt;
umount /tmp/mnt1&lt;br /&gt;
&lt;br /&gt;
exit 0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# unmount /tmp/mntx&lt;br /&gt;
UMOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    umount $1 2&amp;gt; /dev/null&lt;br /&gt;
    mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
&lt;br /&gt;
    echo Error!!&lt;br /&gt;
    exit ${ERROR_CODE}&lt;br /&gt;
}&lt;br /&gt;
#----------------------------------&lt;br /&gt;
# mount /dev/sdax /tmp/mntx&lt;br /&gt;
MOUNT()&lt;br /&gt;
{&lt;br /&gt;
    mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
&lt;br /&gt;
    mount $1 $2 $3 $4&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
#----------------------------------&lt;br /&gt;
&lt;br /&gt;
mkdir -p /tmp/spe1&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
sleep 2&lt;br /&gt;
MOUNT /dev/Glob_Spectraa1 /tmp/spe1&lt;br /&gt;
if [ $? -eq 0 ]; then&lt;br /&gt;
    UMOUNT /tmp/spe1&lt;br /&gt;
    exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
echo &amp;quot;spectra1 is no&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
# last modified 2010/10/12&lt;br /&gt;
#&lt;br /&gt;
# conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
# keep remote pairing&lt;br /&gt;
#&lt;br /&gt;
# assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
# package_list_xxx.txt files.&lt;br /&gt;
#&lt;br /&gt;
# applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
# by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
# is defined below.&lt;br /&gt;
# CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
# /system/build.prop on the target.&lt;br /&gt;
# the factory-reset itself in this script is the same as one in the&lt;br /&gt;
# history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
# GM softoware.&lt;br /&gt;
&lt;br /&gt;
BOUNDARY_DATE=1283319577&lt;br /&gt;
# 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
# above is the latest package before gtv0830 is introduced.&lt;br /&gt;
# 1283318267 autobuild_trunk-r8602_trunk-r938_eagle (20100901.141724)&lt;br /&gt;
# 1281411575 [GM] 2.1_2010081002U_eagle (20100810.123847)&lt;br /&gt;
# 1281092192 [GM] 2.1_2010080602U_asura (20100806.195537)&lt;br /&gt;
&lt;br /&gt;
#SENTINEL_FILE=&amp;quot;/tmp/mnt7/.eclair.4&amp;quot;&lt;br /&gt;
&lt;br /&gt;
[ &amp;quot;${BEAGLECMD}&amp;quot; ] || BEAGLECMD=/bin/sony/beaglecmd&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -n&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/bin/sh&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
&lt;br /&gt;
#    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
#    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
#    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
#    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
#    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
#&lt;br /&gt;
#   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
#/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
#/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
#/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
#/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
#/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
&lt;br /&gt;
chkerr()&lt;br /&gt;
{&lt;br /&gt;
  if [ $? -ne 0 ]; then&lt;br /&gt;
    echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
    exit 1&lt;br /&gt;
  fi&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
FDISK_HASH_CUR=`fdisk /dev/sda -l | md5sum`&lt;br /&gt;
if [ &amp;quot;${FDISK_HASH_CUR}&amp;quot; = &amp;quot;${FDISK_HASH_8G}&amp;quot; ] || [ &amp;quot;`mount | grep &amp;quot;/dev/sda6&amp;quot;`&amp;quot; ]; then&lt;br /&gt;
&lt;br /&gt;
  echo &amp;quot;clean sda1 &amp;amp; sda5&amp;quot;&lt;br /&gt;
&lt;br /&gt;
  umount /dev/sda1  2&amp;gt; /dev/null&lt;br /&gt;
  umount /dev/sda5  2&amp;gt; /dev/null&lt;br /&gt;
&lt;br /&gt;
  sleep 2&lt;br /&gt;
&lt;br /&gt;
  mkfs.ext2 /dev/sda1  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  mkfs.ext3 /dev/sda5  &amp;gt; /dev/null; chkerr&lt;br /&gt;
  exit 0&lt;br /&gt;
fi&lt;br /&gt;
&lt;br /&gt;
ech&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
:020000040000FA&lt;br /&gt;
:0600000091EF1FF0120059&lt;br /&gt;
:0600080004EF04F01200F9&lt;br /&gt;
:060018000CEF04F01200E1&lt;br /&gt;
:0608000091EF1FF0120051&lt;br /&gt;
:020806000000F0&lt;br /&gt;
:0608080030EF0EF01200BB&lt;br /&gt;
:02080E001200D6&lt;br /&gt;
:060818009EEF0EF012003D&lt;br /&gt;
:06082A00D9CFE6FFE1CF8B&lt;br /&gt;
:10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
:10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
:10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
:10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
:1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
:10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
:10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
:1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
:1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
:1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
:1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
:1008E0000001CB5105E1DAC0E6FF22DBE5520BD077&lt;br /&gt;
:1008F0000D0E0001DA5D07E3DA51180804E3DAC0EF&lt;br /&gt;
:10090000E6FF16DBE5521C0E0001DA5D01E0DA6B52&lt;br /&gt;
:100910000DD081BC0BD00001C25108E1170E0001BF&lt;br /&gt;
:10092000DA5D04E1220EE66E03DBE55200D0120030&lt;br /&gt;
:10093000D9CFE6FFE1CFD9FFE6520001010E8C6F5F&lt;br /&gt;
:10094000AB50DF6E8D6B060EDF1403E0AECF8DF083&lt;br /&gt;
:1009500005D0AECF8DF00BD800018C6F8C0501E176&lt;br /&gt;
:1009600064DF0&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Talk:Sony_Update_Downloads&amp;diff=534</id>
		<title>Talk:Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Talk:Sony_Update_Downloads&amp;diff=534"/>
		<updated>2011-02-12T04:05:32Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add my approach to the hash cracker script.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I worked on expanding the pad a bit.  Here&#039;s the script I use.&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/usr/bin/perl&lt;br /&gt;
use strict;&lt;br /&gt;
package abliss;&lt;br /&gt;
my $start = shift;&lt;br /&gt;
&lt;br /&gt;
open HEX, &amp;quot;&amp;lt;./history/other/RfHid_v0156_2010091601_NL.hex&amp;quot; or die;&lt;br /&gt;
open OUT, &amp;quot;&amp;gt;&amp;gt;pad.bin&amp;quot;;&lt;br /&gt;
open IN, &amp;quot;&amp;lt;pad.bin&amp;quot;;&lt;br /&gt;
my @files = (&lt;br /&gt;
    &amp;quot;./history/NBL/batch_sync-vfat.sh&amp;quot;,&lt;br /&gt;
    &amp;quot;./history/board_conf.sh&amp;quot;,&lt;br /&gt;
    &amp;quot;./history/other/check_spectra1_20100929.sh&amp;quot;,&lt;br /&gt;
    &amp;quot;./history/other/factory_reset_conditional_keepremote_20101012.sh&amp;quot;,&lt;br /&gt;
    &amp;quot;./history/other/format_sda_20100514.sh&amp;quot;);&lt;br /&gt;
my @fds;&lt;br /&gt;
for (my $i = 0; $i &amp;lt;= $#files; $i++) {&lt;br /&gt;
    open (my $fd, $files[$i]) or die &amp;quot;can&#039;t open &amp;quot; . $files[$i];&lt;br /&gt;
    push(@fds, $fd);&lt;br /&gt;
}&lt;br /&gt;
my @contents;&lt;br /&gt;
&lt;br /&gt;
my $hexbyte;&lt;br /&gt;
my @hexchars = qw(0 1 2 3 4 5 6 7 8 9 A B C D E F :);&lt;br /&gt;
push(@hexchars, &amp;quot;\r&amp;quot;);&lt;br /&gt;
push(@hexchars, &amp;quot;\n&amp;quot;);&lt;br /&gt;
my @output = ();&lt;br /&gt;
our $xorbyte;&lt;br /&gt;
while (read(HEX, $hexbyte, 1)) {&lt;br /&gt;
    for (my $i = 0; $i &amp;lt;= $#files; $i++) {&lt;br /&gt;
        my $char;&lt;br /&gt;
        if (read($fds[$i], $char, 1)) {&lt;br /&gt;
            $contents[$i] .= $char;&lt;br /&gt;
            if (length($contents[$i]) &amp;gt; 30) {&lt;br /&gt;
                $contents[$i] = substr($contents[$i], 1);&lt;br /&gt;
            }&lt;br /&gt;
        }&lt;br /&gt;
    }&lt;br /&gt;
    if ($start-- &amp;gt; 0) {&lt;br /&gt;
        my $char;&lt;br /&gt;
        read(IN, $char, 1);&lt;br /&gt;
        $xorbyte = ord($char);&lt;br /&gt;
    } else {&lt;br /&gt;
        for (my $j = 0; $j &amp;lt;= $#hexchars; $j++) {&lt;br /&gt;
            $xorbyte = ord($hexbyte) ^ ord($hexchars[$j]);&lt;br /&gt;
            my $choices = &amp;quot;&amp;quot;;&lt;br /&gt;
            my $ok = 1;&lt;br /&gt;
            for (my $i = 0; $i &amp;lt;= $#files; $i++) {&lt;br /&gt;
                my $neword = (ord(substr($contents[$i],length($contents[$i]) - 1)) ^ $xorbyte);&lt;br /&gt;
                if ($neword &amp;gt; 127 || &lt;br /&gt;
                    ($neword &amp;lt; 32 &amp;amp;&amp;amp; &lt;br /&gt;
                     $neword != 9 &amp;amp;&amp;amp; # tab&lt;br /&gt;
                     $neword != 10 &amp;amp;&amp;amp; # LF&lt;br /&gt;
                     $neword != 13 # CR&lt;br /&gt;
                    )) {&lt;br /&gt;
                    $ok = 0;&lt;br /&gt;
                    #printf &amp;quot;==== %2d ====\n%s\n&amp;quot;, $j, xorlastbyte($contents[$i]);&lt;br /&gt;
                    last;&lt;br /&gt;
                }&lt;br /&gt;
            }&lt;br /&gt;
            if ($ok) {&lt;br /&gt;
                printf &amp;quot;==== %2d ====\n%s\n&amp;quot;, $j, join(&amp;quot;\n--\n&amp;quot;, map {xorlastbyte($_)} @contents);&lt;br /&gt;
            }&lt;br /&gt;
        }&lt;br /&gt;
        my $answer = &amp;lt;STDIN&amp;gt;;&lt;br /&gt;
        chomp $answer;&lt;br /&gt;
        if ($answer eq &amp;quot;q&amp;quot;) {&lt;br /&gt;
            close OUT;&lt;br /&gt;
            die;&lt;br /&gt;
        }&lt;br /&gt;
        $xorbyte = ord($hexbyte) ^ ord($hexchars[$answer]);&lt;br /&gt;
        print OUT chr($xorbyte);&lt;br /&gt;
    }&lt;br /&gt;
    @contents = map {xorlastbyte($_)} @contents;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
sub xorlastbyte {&lt;br /&gt;
    my $content = shift;&lt;br /&gt;
    if ($content) {&lt;br /&gt;
        my @chars = split(//, $content);&lt;br /&gt;
        $chars[-1] = chr(ord($chars[-1])^ $xorbyte);&lt;br /&gt;
        return join(&#039;&#039;, @chars);&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Here&#039;s my pad, 134 chars:&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
00000080  b5 cf 2f 50 24 45                                 |../P$E|&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
I checked the checksums in the .hex file and they all validate so far.&lt;br /&gt;
&lt;br /&gt;
Catrane 2011.02.11:&lt;br /&gt;
Nice work, Abliss.    It sounds like we&#039;re running similar approaches.  Here&#039;s my script.  It prints one line for each byte, listing all the possibilities.  I then do a human search for anything that looks predictable and work it by hand.  The 756 byte key I posted was also verified using the .hex checksums in addition to visual inspection.  The typos in the code make visual inspection a little tricky.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
#!/usr/bin/perl&lt;br /&gt;
&lt;br /&gt;
use strict;&lt;br /&gt;
use warnings;&lt;br /&gt;
&lt;br /&gt;
use IO::File;&lt;br /&gt;
&lt;br /&gt;
my @files = ();&lt;br /&gt;
my @filters = ();&lt;br /&gt;
my @rules = ();&lt;br /&gt;
my %ruleinfo = ();&lt;br /&gt;
my $files_left = 0;&lt;br /&gt;
&lt;br /&gt;
#my $textfilter = &amp;quot;[[:print:]\x0a\x0b\t\n\r\f ]&amp;quot;;&lt;br /&gt;
my $textfilter = &amp;quot;[[:print:]\x0a\t ]&amp;quot;;&lt;br /&gt;
my $intelhexfilter = &amp;quot;[0-9A-F:\x0d\x0a]&amp;quot;;&lt;br /&gt;
&lt;br /&gt;
my $knownmasks = &amp;quot;&amp;quot;;&lt;br /&gt;
if ( -f &#039;knownmasks&#039; )&lt;br /&gt;
{&lt;br /&gt;
	$knownmasks = `cat knownmasks`;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
sub checkRules&lt;br /&gt;
{&lt;br /&gt;
	my ($rule,$char) = @_;&lt;br /&gt;
	if ( &amp;quot;text&amp;quot; eq $ruleinfo{$rule}{&#039;type&#039;} )&lt;br /&gt;
	{&lt;br /&gt;
	} elsif ( &amp;quot;intelhex&amp;quot; eq $ruleinfo{$rule}{&#039;type&#039;} ) {&lt;br /&gt;
		if ( $ruleinfo{$rule}{&#039;is_colon&#039;} )&lt;br /&gt;
		{&lt;br /&gt;
			return 0 unless ( &amp;quot;:&amp;quot; eq $char );&lt;br /&gt;
		}&lt;br /&gt;
		if ( $ruleinfo{$rule}{&#039;was_colon&#039;} &amp;gt; 0 )&lt;br /&gt;
		{&lt;br /&gt;
			return 0 if ( ($ruleinfo{$rule}{&#039;was_colon&#039;} &amp;lt; 12) &amp;amp;&amp;amp; (&amp;quot;\x0a&amp;quot; eq $char) );&lt;br /&gt;
			return 0 if ( ($ruleinfo{$rule}{&#039;was_colon&#039;} &amp;lt; 11) &amp;amp;&amp;amp; ((&amp;quot;\x0a&amp;quot; eq $char) || (&amp;quot;\x0d&amp;quot; eq $char)) );&lt;br /&gt;
			return 0 if ( &amp;quot;:&amp;quot; eq $char );&lt;br /&gt;
		}&lt;br /&gt;
		return 0 if ( ( &amp;quot;:&amp;quot; eq $char ) &amp;amp;&amp;amp; ! $ruleinfo{$rule}{&#039;was_maybe_0a&#039;} );&lt;br /&gt;
		return 0 if ( ( &amp;quot;\x0a&amp;quot; eq $char ) &amp;amp;&amp;amp; ! $ruleinfo{$rule}{&#039;was_maybe_0d&#039;} );&lt;br /&gt;
		&lt;br /&gt;
	}&lt;br /&gt;
	return 1;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
sub advanceRules&lt;br /&gt;
{&lt;br /&gt;
	my ($rule,$options) = @_;&lt;br /&gt;
	if ( &amp;quot;text&amp;quot; eq $ruleinfo{$rule}{&#039;type&#039;} )&lt;br /&gt;
	{&lt;br /&gt;
	} elsif ( &amp;quot;intelhex&amp;quot; eq $ruleinfo{$rule}{&#039;type&#039;} ) {&lt;br /&gt;
		my $is_nr = ( $options =~ m/^\\[nr]\\[nr]$/ );&lt;br /&gt;
		# 0d0a == \r\n&lt;br /&gt;
		my $is_maybe_0d = ( $options =~ m/\\r/ );&lt;br /&gt;
		my $is_maybe_0a = ( $options =~ m/\\n/ );&lt;br /&gt;
		if ( $ruleinfo{$rule}{&#039;was_colon&#039;} )&lt;br /&gt;
		{&lt;br /&gt;
			$ruleinfo{$rule}{&#039;was_colon&#039;}++;&lt;br /&gt;
			if ( $ruleinfo{$rule}{&#039;was_colon&#039;} &amp;gt; 12 )&lt;br /&gt;
			{&lt;br /&gt;
				$ruleinfo{$rule}{&#039;was_colon&#039;} = 0;&lt;br /&gt;
			}&lt;br /&gt;
		}&lt;br /&gt;
		if ( $ruleinfo{$rule}{&#039;is_colon&#039;} )&lt;br /&gt;
		{&lt;br /&gt;
			$ruleinfo{$rule}{&#039;is_colon&#039;} = 0;&lt;br /&gt;
			$ruleinfo{$rule}{&#039;was_colon&#039;} = 1;&lt;br /&gt;
		} elsif ( $ruleinfo{$rule}{&#039;was_nr&#039;} ) {&lt;br /&gt;
			$ruleinfo{$rule}{&#039;is_colon&#039;} = $is_nr;&lt;br /&gt;
		}&lt;br /&gt;
		$ruleinfo{$rule}{&#039;was_nr&#039;} = $is_nr;&lt;br /&gt;
		$ruleinfo{$rule}{&#039;was_maybe_0d&#039;} = $is_maybe_0d;&lt;br /&gt;
		$ruleinfo{$rule}{&#039;was_maybe_0a&#039;} = $is_maybe_0a;&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
while ( my $filter = shift )&lt;br /&gt;
{&lt;br /&gt;
	if ( &amp;quot;text&amp;quot; eq $filter )&lt;br /&gt;
	{&lt;br /&gt;
		push(@filters,$textfilter);&lt;br /&gt;
		push(@rules,$files_left);&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;type&#039;} = &amp;quot;text&amp;quot;;&lt;br /&gt;
	} elsif ( &amp;quot;intelhex&amp;quot; eq $filter ) {&lt;br /&gt;
		push(@filters,$intelhexfilter);&lt;br /&gt;
		push(@rules,$files_left);&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;type&#039;} = &amp;quot;intelhex&amp;quot;;&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;is_colon&#039;} = 1; # First must be colon.&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;was_colon&#039;} = 0;&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;was_nr&#039;} = 1; # Make like normal colon setup.&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;was_maybe_0d&#039;} = 0;&lt;br /&gt;
		$ruleinfo{$files_left}{&#039;was_maybe_0a&#039;} = 1; # Make like normal colon setup.&lt;br /&gt;
	} elsif ( &amp;quot;test_text&amp;quot; eq $filter ) {&lt;br /&gt;
		my $counter = 0;&lt;br /&gt;
		my $fh = IO::File-&amp;gt;new(&amp;quot;&amp;lt; &amp;quot;.shift) or die &amp;quot;Unable to open file.\n&amp;quot;;&lt;br /&gt;
		while ( defined( my $char = getc($fh) ) )&lt;br /&gt;
		{&lt;br /&gt;
			die &amp;quot;failed test at index $counter.\n&amp;quot; unless ( $char =~ m/$textfilter/ );&lt;br /&gt;
			$counter++;&lt;br /&gt;
		}&lt;br /&gt;
		print &amp;quot;test passed.\n&amp;quot;;&lt;br /&gt;
		exit;&lt;br /&gt;
	} elsif ( &amp;quot;test_intelhex&amp;quot; eq $filter ) {&lt;br /&gt;
		my $counter = 0;&lt;br /&gt;
		my $fh = IO::File-&amp;gt;new(&amp;quot;&amp;lt; &amp;quot;.shift) or die &amp;quot;Unable to open file.\n&amp;quot;;&lt;br /&gt;
		while ( defined( my $char = getc($fh) ) )&lt;br /&gt;
		{&lt;br /&gt;
			die &amp;quot;failed test at index $counter.\n&amp;quot; unless ( $char =~ m/$intelhexfilter/ );&lt;br /&gt;
			$counter++;&lt;br /&gt;
		}&lt;br /&gt;
		print &amp;quot;test passed.\n&amp;quot;;&lt;br /&gt;
		exit;&lt;br /&gt;
	} else {&lt;br /&gt;
		die &amp;quot;Invalid filter &#039;$filter&#039;.\n&amp;quot;;&lt;br /&gt;
	}&lt;br /&gt;
	my $file = shift;&lt;br /&gt;
	die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file;&lt;br /&gt;
	die &amp;quot;File &#039;$file&#039; does not exist.\n&amp;quot; unless ( -f $file );&lt;br /&gt;
	my $fh = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file&amp;quot;) or die &amp;quot;Unable to open file &#039;$file&#039;.\n&amp;quot;;&lt;br /&gt;
	push(@files,$fh);&lt;br /&gt;
	$files_left++;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
while ( $files_left )&lt;br /&gt;
{&lt;br /&gt;
	my @options = (&amp;quot;\x00&amp;quot;,&amp;quot;\x01&amp;quot;,&amp;quot;\x02&amp;quot;,&amp;quot;\x03&amp;quot;,&amp;quot;\x04&amp;quot;,&amp;quot;\x05&amp;quot;,&amp;quot;\x06&amp;quot;,&amp;quot;\x07&amp;quot;,&amp;quot;\x08&amp;quot;,&amp;quot;\x09&amp;quot;,&amp;quot;\x0a&amp;quot;,&amp;quot;\x0b&amp;quot;,&amp;quot;\x0c&amp;quot;,&amp;quot;\x0d&amp;quot;,&amp;quot;\x0e&amp;quot;,&amp;quot;\x0f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x10&amp;quot;,&amp;quot;\x11&amp;quot;,&amp;quot;\x12&amp;quot;,&amp;quot;\x13&amp;quot;,&amp;quot;\x14&amp;quot;,&amp;quot;\x15&amp;quot;,&amp;quot;\x16&amp;quot;,&amp;quot;\x17&amp;quot;,&amp;quot;\x18&amp;quot;,&amp;quot;\x19&amp;quot;,&amp;quot;\x1a&amp;quot;,&amp;quot;\x1b&amp;quot;,&amp;quot;\x1c&amp;quot;,&amp;quot;\x1d&amp;quot;,&amp;quot;\x1e&amp;quot;,&amp;quot;\x1f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x20&amp;quot;,&amp;quot;\x21&amp;quot;,&amp;quot;\x22&amp;quot;,&amp;quot;\x23&amp;quot;,&amp;quot;\x24&amp;quot;,&amp;quot;\x25&amp;quot;,&amp;quot;\x26&amp;quot;,&amp;quot;\x27&amp;quot;,&amp;quot;\x28&amp;quot;,&amp;quot;\x29&amp;quot;,&amp;quot;\x2a&amp;quot;,&amp;quot;\x2b&amp;quot;,&amp;quot;\x2c&amp;quot;,&amp;quot;\x2d&amp;quot;,&amp;quot;\x2e&amp;quot;,&amp;quot;\x2f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x30&amp;quot;,&amp;quot;\x31&amp;quot;,&amp;quot;\x32&amp;quot;,&amp;quot;\x33&amp;quot;,&amp;quot;\x34&amp;quot;,&amp;quot;\x35&amp;quot;,&amp;quot;\x36&amp;quot;,&amp;quot;\x37&amp;quot;,&amp;quot;\x38&amp;quot;,&amp;quot;\x39&amp;quot;,&amp;quot;\x3a&amp;quot;,&amp;quot;\x3b&amp;quot;,&amp;quot;\x3c&amp;quot;,&amp;quot;\x3d&amp;quot;,&amp;quot;\x3e&amp;quot;,&amp;quot;\x3f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x40&amp;quot;,&amp;quot;\x41&amp;quot;,&amp;quot;\x42&amp;quot;,&amp;quot;\x43&amp;quot;,&amp;quot;\x44&amp;quot;,&amp;quot;\x45&amp;quot;,&amp;quot;\x46&amp;quot;,&amp;quot;\x47&amp;quot;,&amp;quot;\x48&amp;quot;,&amp;quot;\x49&amp;quot;,&amp;quot;\x4a&amp;quot;,&amp;quot;\x4b&amp;quot;,&amp;quot;\x4c&amp;quot;,&amp;quot;\x4d&amp;quot;,&amp;quot;\x4e&amp;quot;,&amp;quot;\x4f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x50&amp;quot;,&amp;quot;\x51&amp;quot;,&amp;quot;\x52&amp;quot;,&amp;quot;\x53&amp;quot;,&amp;quot;\x54&amp;quot;,&amp;quot;\x55&amp;quot;,&amp;quot;\x56&amp;quot;,&amp;quot;\x57&amp;quot;,&amp;quot;\x58&amp;quot;,&amp;quot;\x59&amp;quot;,&amp;quot;\x5a&amp;quot;,&amp;quot;\x5b&amp;quot;,&amp;quot;\x5c&amp;quot;,&amp;quot;\x5d&amp;quot;,&amp;quot;\x5e&amp;quot;,&amp;quot;\x5f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x60&amp;quot;,&amp;quot;\x61&amp;quot;,&amp;quot;\x62&amp;quot;,&amp;quot;\x63&amp;quot;,&amp;quot;\x64&amp;quot;,&amp;quot;\x65&amp;quot;,&amp;quot;\x66&amp;quot;,&amp;quot;\x67&amp;quot;,&amp;quot;\x68&amp;quot;,&amp;quot;\x69&amp;quot;,&amp;quot;\x6a&amp;quot;,&amp;quot;\x6b&amp;quot;,&amp;quot;\x6c&amp;quot;,&amp;quot;\x6d&amp;quot;,&amp;quot;\x6e&amp;quot;,&amp;quot;\x6f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x70&amp;quot;,&amp;quot;\x71&amp;quot;,&amp;quot;\x72&amp;quot;,&amp;quot;\x73&amp;quot;,&amp;quot;\x74&amp;quot;,&amp;quot;\x75&amp;quot;,&amp;quot;\x76&amp;quot;,&amp;quot;\x77&amp;quot;,&amp;quot;\x78&amp;quot;,&amp;quot;\x79&amp;quot;,&amp;quot;\x7a&amp;quot;,&amp;quot;\x7b&amp;quot;,&amp;quot;\x7c&amp;quot;,&amp;quot;\x7d&amp;quot;,&amp;quot;\x7e&amp;quot;,&amp;quot;\x7f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x80&amp;quot;,&amp;quot;\x81&amp;quot;,&amp;quot;\x82&amp;quot;,&amp;quot;\x83&amp;quot;,&amp;quot;\x84&amp;quot;,&amp;quot;\x85&amp;quot;,&amp;quot;\x86&amp;quot;,&amp;quot;\x87&amp;quot;,&amp;quot;\x88&amp;quot;,&amp;quot;\x89&amp;quot;,&amp;quot;\x8a&amp;quot;,&amp;quot;\x8b&amp;quot;,&amp;quot;\x8c&amp;quot;,&amp;quot;\x8d&amp;quot;,&amp;quot;\x8e&amp;quot;,&amp;quot;\x8f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\x90&amp;quot;,&amp;quot;\x91&amp;quot;,&amp;quot;\x92&amp;quot;,&amp;quot;\x93&amp;quot;,&amp;quot;\x94&amp;quot;,&amp;quot;\x95&amp;quot;,&amp;quot;\x96&amp;quot;,&amp;quot;\x97&amp;quot;,&amp;quot;\x98&amp;quot;,&amp;quot;\x99&amp;quot;,&amp;quot;\x9a&amp;quot;,&amp;quot;\x9b&amp;quot;,&amp;quot;\x9c&amp;quot;,&amp;quot;\x9d&amp;quot;,&amp;quot;\x9e&amp;quot;,&amp;quot;\x9f&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xa0&amp;quot;,&amp;quot;\xa1&amp;quot;,&amp;quot;\xa2&amp;quot;,&amp;quot;\xa3&amp;quot;,&amp;quot;\xa4&amp;quot;,&amp;quot;\xa5&amp;quot;,&amp;quot;\xa6&amp;quot;,&amp;quot;\xa7&amp;quot;,&amp;quot;\xa8&amp;quot;,&amp;quot;\xa9&amp;quot;,&amp;quot;\xaa&amp;quot;,&amp;quot;\xab&amp;quot;,&amp;quot;\xac&amp;quot;,&amp;quot;\xad&amp;quot;,&amp;quot;\xae&amp;quot;,&amp;quot;\xaf&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xb0&amp;quot;,&amp;quot;\xb1&amp;quot;,&amp;quot;\xb2&amp;quot;,&amp;quot;\xb3&amp;quot;,&amp;quot;\xb4&amp;quot;,&amp;quot;\xb5&amp;quot;,&amp;quot;\xb6&amp;quot;,&amp;quot;\xb7&amp;quot;,&amp;quot;\xb8&amp;quot;,&amp;quot;\xb9&amp;quot;,&amp;quot;\xba&amp;quot;,&amp;quot;\xbb&amp;quot;,&amp;quot;\xbc&amp;quot;,&amp;quot;\xbd&amp;quot;,&amp;quot;\xbe&amp;quot;,&amp;quot;\xbf&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xc0&amp;quot;,&amp;quot;\xc1&amp;quot;,&amp;quot;\xc2&amp;quot;,&amp;quot;\xc3&amp;quot;,&amp;quot;\xc4&amp;quot;,&amp;quot;\xc5&amp;quot;,&amp;quot;\xc6&amp;quot;,&amp;quot;\xc7&amp;quot;,&amp;quot;\xc8&amp;quot;,&amp;quot;\xc9&amp;quot;,&amp;quot;\xca&amp;quot;,&amp;quot;\xcb&amp;quot;,&amp;quot;\xcc&amp;quot;,&amp;quot;\xcd&amp;quot;,&amp;quot;\xce&amp;quot;,&amp;quot;\xcf&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xd0&amp;quot;,&amp;quot;\xd1&amp;quot;,&amp;quot;\xd2&amp;quot;,&amp;quot;\xd3&amp;quot;,&amp;quot;\xd4&amp;quot;,&amp;quot;\xd5&amp;quot;,&amp;quot;\xd6&amp;quot;,&amp;quot;\xd7&amp;quot;,&amp;quot;\xd8&amp;quot;,&amp;quot;\xd9&amp;quot;,&amp;quot;\xda&amp;quot;,&amp;quot;\xdb&amp;quot;,&amp;quot;\xdc&amp;quot;,&amp;quot;\xdd&amp;quot;,&amp;quot;\xde&amp;quot;,&amp;quot;\xdf&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xe0&amp;quot;,&amp;quot;\xe1&amp;quot;,&amp;quot;\xe2&amp;quot;,&amp;quot;\xe3&amp;quot;,&amp;quot;\xe4&amp;quot;,&amp;quot;\xe5&amp;quot;,&amp;quot;\xe6&amp;quot;,&amp;quot;\xe7&amp;quot;,&amp;quot;\xe8&amp;quot;,&amp;quot;\xe9&amp;quot;,&amp;quot;\xea&amp;quot;,&amp;quot;\xeb&amp;quot;,&amp;quot;\xec&amp;quot;,&amp;quot;\xed&amp;quot;,&amp;quot;\xee&amp;quot;,&amp;quot;\xef&amp;quot;,&lt;br /&gt;
	               &amp;quot;\xf0&amp;quot;,&amp;quot;\xf1&amp;quot;,&amp;quot;\xf2&amp;quot;,&amp;quot;\xf3&amp;quot;,&amp;quot;\xf4&amp;quot;,&amp;quot;\xf5&amp;quot;,&amp;quot;\xf6&amp;quot;,&amp;quot;\xf7&amp;quot;,&amp;quot;\xf8&amp;quot;,&amp;quot;\xf9&amp;quot;,&amp;quot;\xfa&amp;quot;,&amp;quot;\xfb&amp;quot;,&amp;quot;\xfc&amp;quot;,&amp;quot;\xfd&amp;quot;,&amp;quot;\xfe&amp;quot;,&amp;quot;\xff&amp;quot;);&lt;br /&gt;
	my $options_left = 256;&lt;br /&gt;
	if ( $knownmasks =~ s/^(..)\n// )&lt;br /&gt;
	{&lt;br /&gt;
		my $knownmask = $1;&lt;br /&gt;
		if ( $knownmask =~ m/[0-9a-f]{2}/i )&lt;br /&gt;
		{&lt;br /&gt;
			my $val;&lt;br /&gt;
			eval(&#039;$val = &amp;quot;\\x&#039;.$knownmask.&#039;&amp;quot;;&#039;);&lt;br /&gt;
			$options[0] = $val;&lt;br /&gt;
			$options_left = 1;&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
&lt;br /&gt;
	my @filechars = ();&lt;br /&gt;
&lt;br /&gt;
	for ( my $i = 0; $i &amp;lt; $files_left; $i++ )&lt;br /&gt;
	{&lt;br /&gt;
		my $char = getc($files[$i]);&lt;br /&gt;
		if ( defined($char) )&lt;br /&gt;
		{&lt;br /&gt;
			$filechars[$i] = $char;&lt;br /&gt;
			my $filter = $filters[$i];&lt;br /&gt;
&lt;br /&gt;
			for ( my $x = 0; $x &amp;lt; $options_left; $x++ )&lt;br /&gt;
			{&lt;br /&gt;
#print &amp;quot;$x vs $options_left\n&amp;quot;;&lt;br /&gt;
#				print &amp;quot;char is $char\n&amp;quot;;&lt;br /&gt;
#				print &amp;quot;option is $options[$x]\n&amp;quot;;&lt;br /&gt;
				my $realchar = $char ^ $options[$x];&lt;br /&gt;
				unless ( ($realchar =~ m/$filter/) &amp;amp;&amp;amp; checkRules($rules[$i],$realchar) )&lt;br /&gt;
				{&lt;br /&gt;
					splice(@options,$x,1);&lt;br /&gt;
					$x--;&lt;br /&gt;
					$options_left--;&lt;br /&gt;
				}&lt;br /&gt;
			}&lt;br /&gt;
		} else {&lt;br /&gt;
			$files[$i]-&amp;gt;close;&lt;br /&gt;
			splice(@files,$i,1);&lt;br /&gt;
			splice(@filters,$i,1);&lt;br /&gt;
			splice(@rules,$i,1);&lt;br /&gt;
			$i--;&lt;br /&gt;
			$files_left--;&lt;br /&gt;
		}&lt;br /&gt;
	}&lt;br /&gt;
&lt;br /&gt;
	last unless $files_left;&lt;br /&gt;
&lt;br /&gt;
	die &amp;quot;Failed to solve.\n&amp;quot; unless $options_left;&lt;br /&gt;
	for ( my $i = 0; $i &amp;lt; $files_left; $i++ )&lt;br /&gt;
	{&lt;br /&gt;
		my $options = &amp;quot;&amp;quot;;&lt;br /&gt;
		for ( my $x = 0; $x &amp;lt; $options_left; $x++ )&lt;br /&gt;
		{&lt;br /&gt;
			my $realchar = $filechars[$i] ^ $options[$x];&lt;br /&gt;
			$realchar = &amp;quot;\\t&amp;quot; if ( $realchar eq &amp;quot;\t&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\r&amp;quot; if ( $realchar eq &amp;quot;\r&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\n&amp;quot; if ( $realchar eq &amp;quot;\n&amp;quot; );&lt;br /&gt;
			#$realchar = &amp;quot;\\v&amp;quot; if ( $realchar eq &amp;quot;\v&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\v&amp;quot; if ( $realchar eq &amp;quot;\x0b&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\a&amp;quot; if ( $realchar eq &amp;quot;\x0a&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\f&amp;quot; if ( $realchar eq &amp;quot;\f&amp;quot; );&lt;br /&gt;
			$realchar = &amp;quot;\\s&amp;quot; if ( $realchar eq &amp;quot; &amp;quot; );&lt;br /&gt;
			$options .= $realchar;&lt;br /&gt;
		}&lt;br /&gt;
		print $options.&amp;quot;\n&amp;quot; unless $i;&lt;br /&gt;
		advanceRules($rules[$i],$options);&lt;br /&gt;
	}&lt;br /&gt;
}&lt;br /&gt;
print &amp;quot;Done\n&amp;quot;;&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=User_talk:Abliss&amp;diff=530</id>
		<title>User talk:Abliss</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=User_talk:Abliss&amp;diff=530"/>
		<updated>2011-02-11T22:57:05Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Pad strategy.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Nice work on extending the pad!  What approach are you using?  I enhanced my file-crossreferencer so that in addition to knowing the valid character set of each of the six files, it understands the Intel .hex file format enough to force a colon after a definite \r\n, disallow colon if not on the line after a possible \n, disallow colon within 12 chars of a definite colon, and such.  After that I&#039;ve been using manual pattern searching to find standard shell script patterns in the possibilities (e.g. &amp;quot;| grep&amp;quot;) and then run a manual search of the dictionary file for sequences of options that look like they could be dictionary words.  A lot of brute force, but it&#039;s at least revealing the contents of the shell scripts.  The tgz files would require that we figure out the pattern though.&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=529</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=529"/>
		<updated>2011-02-11T22:45:55Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Pad extended. 134 -&amp;gt; 756.  Files extended as well.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 756 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 756 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
   00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
   00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
   00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
   00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
   00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
   00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
   00000060  1b 42 25 da a3 97 b8 e1  ba 54 13 5b 68 31 da ff  |.B%......T.[h1..|&lt;br /&gt;
   00000070  1c 5c 15 46 4e 32 f1 76  50 e0 4e f3 ab 9a 28 bb  |.\.FN2.vP.N...(.|&lt;br /&gt;
   00000080  b5 cf 2f 50 24 45 f7 ed  b3 5d c8 f6 21 fa aa d8  |../P$E...]..!...|&lt;br /&gt;
   00000090  42 4d 49 89 7f 76 c9 72  d8 30 1c 38 cd 09 d5 b7  |BMI..v.r.0.8....|&lt;br /&gt;
   000000a0  b0 69 ae 32 bd 0b db 1b  4a fc b5 77 cb 18 ff 32  |.i.2....J..w...2|&lt;br /&gt;
   000000b0  7b c6 aa 83 5d 94 22 e3  4c a1 ef bb 56 66 79 63  |{...].&amp;quot;.L...Vfyc|&lt;br /&gt;
   000000c0  56 43 00 87 b4 69 f4 7c  18 ce 53 c6 3d fd e4 11  |VC...i.|..S.=...|&lt;br /&gt;
   000000d0  0e 6e a7 65 60 b2 66 dc  6b d7 01 4a e4 9f d7 84  |.n.e`.f.k..J....|&lt;br /&gt;
   000000e0  3c 87 b6 6a 67 ec 8e a3  36 2c ce c0 ab 2e e2 4e  |&amp;lt;..jg...6,.....N|&lt;br /&gt;
   000000f0  4f ab 77 f3 0c da d8 e2  b1 98 fe a4 cf 20 a3 6f  |O.w.......... .o|&lt;br /&gt;
   00000100  27 cc f9 2b 47 09 e1 f8  a8 f5 a3 84 cd 53 b3 aa  |&#039;..+G........S..|&lt;br /&gt;
   00000110  12 cb 95 dc c2 7f 76 df  84 24 83 c8 60 fe dc 99  |......v..$..`...|&lt;br /&gt;
   00000120  3c 61 5c d5 4a bd 4b 19  10 ea 2b a9 ed 94 4e 08  |&amp;lt;a\.J.K...+...N.|&lt;br /&gt;
   00000130  2e 1e 0b 31 90 b7 47 76  55 40 1b 42 e5 cd 82 07  |...1..GvU@.B....|&lt;br /&gt;
   00000140  6c 75 61 3d 51 6f 91 ed  4e 3b e7 d0 68 7b ab 93  |lua=Qo..N;..h{..|&lt;br /&gt;
   00000150  b9 64 e7 82 80 0b b0 7a  1b da d0 70 a8 65 95 da  |.d.....z...p.e..|&lt;br /&gt;
   00000160  8b 06 37 34 0f 78 a2 35  87 f5 81 6b 0a ce 7d 28  |..74.x.5...k..}(|&lt;br /&gt;
   00000170  15 97 8c 8a 84 df b0 17  c7 ef 88 b3 41 61 3a a9  |............Aa:.|&lt;br /&gt;
   00000180  83 2f b8 7d 0e 9f 93 d9  2e 63 21 0e eb 81 64 a6  |./.}.....c!...d.|&lt;br /&gt;
   00000190  b7 f0 db ab dc cd fc 15  d5 4f fb 96 dd 28 fe d7  |.........O...(..|&lt;br /&gt;
   000001a0  17 be 8f 96 f0 3e 84 bc  d6 2e 80 d4 60 62 05 0a  |.....&amp;gt;......`b..|&lt;br /&gt;
   000001b0  f9 12 87 b1 56 7e 46 47  19 1f 84 73 df 42 ca cf  |....V~FG...s.B..|&lt;br /&gt;
   000001c0  f8 ff 96 de 87 ba 13 2b  12 c8 f8 76 ea 2d 56 23  |.......+...v.-V#|&lt;br /&gt;
   000001d0  44 32 93 84 a4 5b 78 8a  1c 00 fb 82 9d 91 3c f4  |D2...[x.......&amp;lt;.|&lt;br /&gt;
   000001e0  5c 2a 7f 13 f8 4a 74 2f  e4 5a 8e 34 28 51 c3 04  |\*...Jt/.Z.4(Q..|&lt;br /&gt;
   000001f0  c5 aa db 93 62 8b 92 41  bc 18 a5 47 94 06 b3 ed  |....b..A...G....|&lt;br /&gt;
   00000200  fb 8c 5b 08 d1 62 0d 59  9e 37 26 ff a9 40 63 a7  |..[..b.Y.7&amp;amp;..@c.|&lt;br /&gt;
   00000210  d3 f3 e6 30 ea 22 bc 3a  64 9c d9 fe 94 7c f2 3b  |...0.&amp;quot;.:d....|.;|&lt;br /&gt;
   00000220  34 4d ce 2c b4 c5 22 56  b4 e8 ad 31 ed 3b 66 b8  |4M.,..&amp;quot;V...1.;f.|&lt;br /&gt;
   00000230  38 86 e3 0d fa 77 8a 79  35 0a 7c 23 95 9f 15 2c  |8....w.y5.|#...,|&lt;br /&gt;
   00000240  9b c9 95 86 40 cf 92 7c  bd 37 36 c2 33 4b 09 c2  |....@..|.76.3K..|&lt;br /&gt;
   00000250  5c b1 a6 23 b2 ef d4 0c  f5 a5 24 90 12 85 6a 03  |\..#......$...j.|&lt;br /&gt;
   00000260  7b e5 61 48 d8 2f e6 1e  de 7e bb 18 e6 f5 b1 69  |{.aH./...~.....i|&lt;br /&gt;
   00000270  f1 f3 d1 32 dc e2 8f 99  1b f2 a6 71 90 3d 08 ed  |...2.......q.=..|&lt;br /&gt;
   00000280  05 c1 fe c1 c7 12 f9 33  a2 18 3f 52 76 9e 0e 6e  |.......3..?Rv..n|&lt;br /&gt;
   00000290  3d 94 dd cb 04 b7 4b 40  93 96 8f 01 df e1 57 d2  |=.....K@......W.|&lt;br /&gt;
   000002a0  0e e9 20 e2 bb c6 b6 36  27 d6 82 91 48 90 87 9f  |.. ....6&#039;...H...|&lt;br /&gt;
   000002b0  23 ea d5 78 2d 93 80 0a  ca 37 e3 40 85 6a 01 ad  |#..x-....7.@.j..|&lt;br /&gt;
   000002c0  c2 e7 5b d8 da 17 71 97  65 0a 00 4b 2f 3d ea 3c  |..[...q.e..K/=.&amp;lt;|&lt;br /&gt;
   000002d0  a0 06 ce 9a 3a d7 5d de  c0 82 4b 02 85 c7 36 bb  |....:.]...K...6.|&lt;br /&gt;
   000002e0  72 18 b1 0c 5b 39 73 1c  4c d0 cf 1a 70 fa 76 ba  |r...[9s.L...p.v.|&lt;br /&gt;
   000002f0  55 c5 ce dd 51                                    |U...Q|&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   &lt;br /&gt;
   chkerr()&lt;br /&gt;
   {&lt;br /&gt;
     ret=$?&lt;br /&gt;
     if [ $ret -ne 0 ]; then&lt;br /&gt;
       echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
       exit 1&lt;br /&gt;
     fi&lt;br /&gt;
   }&lt;br /&gt;
    &lt;br /&gt;
   # arguments&lt;br /&gt;
   #PRODUCT_TYPE=$1  # asura, eagle, *&lt;br /&gt;
   #TRIAL_LEVEL=$2   # evt2, dvt, pvt, pp, mp&lt;br /&gt;
   #PANELID=$3       # MONI-Z, M236H1-L01, LTY(Z)320HM02, LTY(Z)400HM02, LTY(Z)460HM02,&lt;br /&gt;
   #                 # T315HW07 V0, LTY(Z)400HM03, LTY(Z)460HM03, unknown&lt;br /&gt;
   &lt;br /&gt;
   # for old installer support (evt only)&lt;br /&gt;
   [ ${PRODUCT_TYPE} ]             || PRODUCT_TYPE=$1&lt;br /&gt;
   [ ${PANELID} ]                  || PANELID=&amp;quot;MONI-Z&amp;quot;&lt;br /&gt;
   [ ${TRIAL_LEVEL} ]              || TRIAL_LEVEL=&amp;quot;pvt&amp;quot;&lt;br /&gt;
   [ ${PRODUCT_TYPE} = &amp;quot;asura_p&amp;quot; ] &amp;amp;&amp;amp; PANELID=&amp;quot;PANEL&amp;quot;&lt;br /&gt;
      mount /dev/sda1 /tmp/mnt1 ; chkerr&lt;br /&gt;
   &lt;br /&gt;
   printf &amp;quot;product_type = $PRODUCT_TYPE\ntrial_level = $TRIAL_LEVEL\nmodelid = $MODELID\npanelid = $PANELID\n&amp;quot; &amp;gt; /tmp/mnt1/etc/board&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/NBL/batch_sync-vfat.sh (entire file)&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   &lt;br /&gt;
   unset -f MOUNT&lt;br /&gt;
   &lt;br /&gt;
   MOUNT()&lt;br /&gt;
   {&lt;br /&gt;
       mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
   &lt;br /&gt;
       if [ &amp;quot;$1&amp;quot; = &amp;quot;/dev/Glob_Spectraa2&amp;quot; ]&lt;br /&gt;
       then&lt;br /&gt;
           mount -t vfat -o rw,batch_sync,noatime $1 $2 $3 $4&lt;br /&gt;
       else&lt;br /&gt;
           mount $1 $2 $3 $4&lt;br /&gt;
       fi&lt;br /&gt;
   }&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   &lt;br /&gt;
   #----------------------------------&lt;br /&gt;
   # unmount /tmp/mntx&lt;br /&gt;
   UMOUNT()&lt;br /&gt;
   {&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0&lt;br /&gt;
   &lt;br /&gt;
       umount $1 2&amp;gt; /dev/null&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
   &lt;br /&gt;
       umount $1 2&amp;gt; /dev/null&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
   &lt;br /&gt;
       umount $1 2&amp;gt; /dev/null&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
   &lt;br /&gt;
       umount $1 2&amp;gt; /dev/null&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
   &lt;br /&gt;
       umount $1 2&amp;gt; /dev/null&lt;br /&gt;
       mount | grep $1 &amp;gt; /dev/null || return 0 ; sleep 1&lt;br /&gt;
        &lt;br /&gt;
       echo Error!!&lt;br /&gt;
       exit ${ERROR_CODE}&lt;br /&gt;
   }&lt;br /&gt;
   #----------------------------------&lt;br /&gt;
   # mount /dev/sdax /tmp/mntx&lt;br /&gt;
   MOUNT()&lt;br /&gt;
   {&lt;br /&gt;
       mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
   &lt;br /&gt;
       mount $1 $2 $3 $4&lt;br /&gt;
   }&lt;br /&gt;
   &lt;br /&gt;
   #----------------------------------&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   # last modified 2010/10/12&lt;br /&gt;
   #&lt;br /&gt;
   # conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
   # keep remote pairing&lt;br /&gt;
   #   &lt;br /&gt;
   # assuming to be placed before history/other/format_sda_xxx.sh in&lt;br /&gt;
   # package_list_xxx.txt files.&lt;br /&gt;
   #&lt;br /&gt;
   # applies factory-reset effect only when CURRENT_DATE which is exported&lt;br /&gt;
   # by package_update.sh is the same as or older than BOUNDARY_DATE which&lt;br /&gt;
   # is defined below.&lt;br /&gt;
   # CURRENT_DATE reflects the value of ro.build.date.utc in the file&lt;br /&gt;
   # /system/build.prop on the target.&lt;br /&gt;
   # the factory-reset itself in this script is the same as one in the&lt;br /&gt;
   # history/other/factory_reset_20100803.sh which is packaged in the&lt;br /&gt;
   # GM softoware.&lt;br /&gt;
    &lt;br /&gt;
   BOUNDARY_DATE=1283319577&lt;br /&gt;
   # 1283319577 autobuild_trunk-r8602_trunk-r938_asura (20100901.143920)&lt;br /&gt;
   # above is the latest p&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   &lt;br /&gt;
   FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
   FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e556c9c5966b07  -&amp;quot;&lt;br /&gt;
   &lt;br /&gt;
   #    /dev/sda1 (boot)   will be 0.5GB&lt;br /&gt;
   #    /dev/sda2 (misc)   will be   0GB&lt;br /&gt;
   #    /dev/sda5 (system) will be 1.5GB&lt;br /&gt;
   #    /dev/sda6 (cache)  will be 1.5GB&lt;br /&gt;
   #    /dev/sda7 (data)   will be 4.5GB&lt;br /&gt;
   # &lt;br /&gt;
   #   Device Boot      Start         End      Blocks  Id System&lt;br /&gt;
   #/dev/sda1               1        1908      488432  83 Linux&lt;br /&gt;
   #/dev/sda3            1909       30720     7375872   5 Extended&lt;br /&gt;
   #/dev/sda5            1909        7631     1465072  83 Linux&lt;br /&gt;
   #/dev/sda6            7632       13354     1465072  83 Linux&lt;br /&gt;
   #/dev/sda7           13355       30720     4445680  83 Linux&lt;br /&gt;
   &lt;br /&gt;
   chkerr()           &lt;br /&gt;
   {&lt;br /&gt;
     if [ $? -ne 0 ]; then&lt;br /&gt;
       echo &amp;quot;Error!!&amp;quot;&lt;br /&gt;
       exit 1&lt;br /&gt;
     fi&lt;br /&gt;
   }&lt;br /&gt;
   &lt;br /&gt;
   FDISK&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
   :020000040000FA&lt;br /&gt;
   :0600000091EF1FF0120059&lt;br /&gt;
   :0600080004EF04F01200F9&lt;br /&gt;
   :060018000CEF04F01200E1&lt;br /&gt;
   :0608000091EF1FF0120051&lt;br /&gt;
   :020806000000F0&lt;br /&gt;
   :0608080030EF0EF01200BB&lt;br /&gt;
   :02080E001200D6&lt;br /&gt;
   :060818009EEF0EF012003D&lt;br /&gt;
   :06082A00D9CFE6FFE1CF8B&lt;br /&gt;
   :10083000D9FFE652060EAC6E800EAB6E939E938A85&lt;br /&gt;
   :10084000330EAF6E900EAB6E0001686BDF6A180E50&lt;br /&gt;
   :10085000DF5C09E2DF50EA6A690FE96E000EEA2206&lt;br /&gt;
   :10086000EF6ADF2AF4D70001816BDF6A180EDF5CC4&lt;br /&gt;
   :1008700009E2DF50EA6AE60FE96E020EEA22EF6A49&lt;br /&gt;
   :10088000DF2AF4D700018A6B8B6B676B616B626B3D&lt;br /&gt;
   :10089000606B896B828382950001C26B0001956B4E&lt;br /&gt;
   :1008A00000D0E552E552E7CFD9FF1200000182A146&lt;br /&gt;
   :1008B00007D00001CC5104E1010EE66E39DBE552B0&lt;br /&gt;
   :1008C00081AC27D0000182B305D00001C25102E102&lt;br /&gt;
   :1008D000EFEC0DF00001DA511BE00001C25118E10C&lt;br /&gt;
   :1008E0000001CB5105E1DAC0E6FF22DBE55&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=522</id>
		<title>Sony Update Downloads</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_Update_Downloads&amp;diff=522"/>
		<updated>2011-02-10T21:58:51Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Documentation for Sony OTA.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Download Links ==&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_asura/a319425f3ff1.package_list_ogm_2.1_2010102101ON_asura.zip|Sony Asura 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/2a5eb14d611d.package_list_ogm_2.1_2010102101ON_eagle.zip|Sony Eagle 2010.10.21]&lt;br /&gt;
&lt;br /&gt;
[http://android.clients.google.com/packages/ota/sony_eagle/7a732a29e679.package_list_ogm_2.1_2010121503ON_eagle.zip|Sony Eagle 2010.12.15] (Current as of Feb 6, 2011)&lt;br /&gt;
&lt;br /&gt;
== Format ==&lt;br /&gt;
Download is a conventional zip file, containing a directory structure with a collection of tgz files as well as various others.  Contents are mostly obfuscated using a simple xor of some sort.  A pattern has yet to be found, but the mask for one file will apply byte-for-byte to any other obfuscated file in the zip.&lt;br /&gt;
&lt;br /&gt;
== Obfuscation ==&lt;br /&gt;
Here are the first 96 bytes of the Sony obfuscation hash.  It&#039;s applied as an xor.  I haven&#039;t put much work into finding a pattern yet.  Here&#039;s what I do know:&lt;br /&gt;
* It isn&#039;t just a static repeating pattern, or if it is then it&#039;s longer than 96 bytes before repeat.&lt;br /&gt;
* The mask for any given byte position is the same across all files, so a static mask that works for one file will work for all files.&lt;br /&gt;
&lt;br /&gt;
   00000000  38 cf 4f aa 7a 8a 2e 3e  2b 41 82 9a ad 31 e9 dc  |8.O.z..&amp;gt;+A...1..|&lt;br /&gt;
   00000010  ef 47 2f 0b 26 76 12 fe  5f 5b 58 e1 10 18 7d e6  |.G/.&amp;amp;v.._[X...}.|&lt;br /&gt;
   00000020  ad 92 1b 91 8e 90 69 f7  8a 9b 68 d8 98 58 fa 95  |......i...h..X..|&lt;br /&gt;
   00000030  63 81 d6 5f 04 7d 29 8b  09 cf b9 21 b8 d9 df dd  |c.._.})....!....|&lt;br /&gt;
   00000040  c4 7e 71 d9 3f 35 ea 7b  0d ec 7f d1 a3 76 64 88  |.~q.?5.{.....vd.|&lt;br /&gt;
   00000050  a5 8e 27 49 60 c0 a0 bc  77 54 31 e3 d6 6a bf e5  |..&#039;I`...wT1..j..|&lt;br /&gt;
&lt;br /&gt;
It could be a large random pad, as someone previously suggested.  Or if we&#039;re really lucky it could just be a random number sequence accessed via knowing it&#039;s seed and which rand algorithm it&#039;s using.  Or it could be an output feedback cipher, which could be a bugger if they used a non-zero key in the encryption.&lt;br /&gt;
&lt;br /&gt;
The approach I used was to find all the obfuscated text files I could, then write a small program to iterate over the hash options for each byte, weed out the ones that yield an invalid result in any of those files, and produce a character-by-character list of the possibilities.  This was facilitated by knowing that a shell script is only printable characters and whitespace and the .hex file is only hex characters, colons, and CRLFs.  If anybody has strong knowledge of limitations in gzip file content beyond the first 96 bytes, that could be used to further filter the options.&lt;br /&gt;
&lt;br /&gt;
Here are the decoded sections of the obfuscated text files I could find.  These are the same in all three versions of the Sony update that I have.&lt;br /&gt;
&lt;br /&gt;
history/board_conf.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   &lt;br /&gt;
   chkerr()&lt;br /&gt;
   {&lt;br /&gt;
     ret=$?&lt;br /&gt;
     if [ $ret -ne 0 ]; then&lt;br /&gt;
       echo &amp;quot;Error!!!&amp;quot;&lt;br /&gt;
       exit 1&lt;br /&gt;
     fi&lt;br /&gt;
   }&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/NBL/batch_sync-vfat.sh&lt;br /&gt;
   #!/bin/sh &lt;br /&gt;
   &lt;br /&gt;
   unset -f MOUNT&lt;br /&gt;
   &lt;br /&gt;
   MOUNT()&lt;br /&gt;
   {&lt;br /&gt;
       mount | grep &amp;quot;$2&amp;quot; &amp;gt; /dev/null &amp;amp;&amp;amp; return 0&lt;br /&gt;
   &lt;br /&gt;
       if [ &amp;quot;$1&amp;quot;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/check_spectra1_20100929.sh&lt;br /&gt;
   #!/bin/sh &lt;br /&gt;
   &lt;br /&gt;
   #----------------------------------&lt;br /&gt;
   # unmount /tmp/mntx&lt;br /&gt;
   UMOUNT()&lt;br /&gt;
   {&lt;br /&gt;
       mount | grep $1&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/factory_reset_conditional_keepremote_20101012.sh&lt;br /&gt;
   #!/bin/sh&lt;br /&gt;
   # last modified 2010/10/12&lt;br /&gt;
   #&lt;br /&gt;
   # conditional factory-reset for asura / eagle on updating.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/format_sda_20100514.sh&lt;br /&gt;
   #!/bin/sh &lt;br /&gt;
   FDISK_HASH_8G=&amp;quot;80dd0463e8cf28c0d2c0836408499e03  -&amp;quot;&lt;br /&gt;
   FDISK_HASH_2G=&amp;quot;fdd1d1adb5517785c3e&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
history/other/RfHid_v0156_2010091601_NL.hex&lt;br /&gt;
   :020000040000FA&lt;br /&gt;
   :0600000091EF1FF0120059&lt;br /&gt;
   :0600080004EF04F01200F9&lt;br /&gt;
   :060018000CEF04F01200E1&lt;br /&gt;
   :0608&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Here&#039;s a small script I wrote to apply the mask to any file.  First parameter is the mask file, second is the obfuscated file.  Result gets printed.  Since it&#039;s an xor, you can give it the mask file and plaintext file and it will obfuscate it for you if you&#039;d like to go that way.&lt;br /&gt;
&lt;br /&gt;
   #!/usr/bin/perl&lt;br /&gt;
   &lt;br /&gt;
   use strict;&lt;br /&gt;
   use warnings;&lt;br /&gt;
   &lt;br /&gt;
   use IO::File;&lt;br /&gt;
   &lt;br /&gt;
   my $file1 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file1;&lt;br /&gt;
   die &amp;quot;File &#039;$file1&#039; does not exist.\n&amp;quot; unless ( -f $file1 );my $fh1 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file1&amp;quot;) or die &amp;quot;Unable to open file &#039;$file1&#039;.\n&amp;quot;;&lt;br /&gt;
   my $file2 = shift;&lt;br /&gt;
   die &amp;quot;Missing filename parameter.\n&amp;quot; unless defined $file2;&lt;br /&gt;
   die &amp;quot;File &#039;$file2&#039; does not exist.\n&amp;quot; unless ( -f $file2 );my $fh2 = IO::File-&amp;gt;new(&amp;quot;&amp;lt; $file2&amp;quot;) or die &amp;quot;Unable to open file &#039;$file2&#039;.\n&amp;quot;;&lt;br /&gt;
   &lt;br /&gt;
   while ( defined ( my $c1 = getc($fh1) ) )&lt;br /&gt;
   {&lt;br /&gt;
           my $c2 = getc($fh2);&lt;br /&gt;
           $c2 = &amp;quot;\x00&amp;quot; unless defined $c2;&lt;br /&gt;
           my $o = $c1 ^ $c2;&lt;br /&gt;
           print $o;&lt;br /&gt;
   }&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
	<entry>
		<id>https://wiki.exploitee.rs/index.php?title=Sony_NSZ-GT1_(Bluray_Player)&amp;diff=519</id>
		<title>Sony NSZ-GT1 (Bluray Player)</title>
		<link rel="alternate" type="text/html" href="https://wiki.exploitee.rs/index.php?title=Sony_NSZ-GT1_(Bluray_Player)&amp;diff=519"/>
		<updated>2011-02-10T21:34:14Z</updated>

		<summary type="html">&lt;p&gt;Catrane: Add link to page for the download hacking.&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{Disclaimer}}&lt;br /&gt;
[[File:Sony_NSZ_GT1.jpg|250px|left|thumb]]&lt;br /&gt;
This page will be dedicated to the hardware specifications, descriptions, and information related to the Sony NSZ-GT1 (Bluray Player).&lt;br /&gt;
&lt;br /&gt;
== Specs ==&lt;br /&gt;
*Intel Atom CE4100 1.2 GHz processor, with a 200 MHz GPU&amp;lt;sup&amp;gt;1&amp;lt;/sup&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Tear Down ==&lt;br /&gt;
[http://www.magicandroidapps.com/wiki//index.php?title=GoogleTvTeardown Sony NSZ-GT1 Google TV Teardown]&lt;br /&gt;
&lt;br /&gt;
== Recovery Mode ==&lt;br /&gt;
Apeman42 from XDA Developers found [http://forum.xda-developers.com/showthread.php?t=812601 Recovery Menu]&lt;br /&gt;
&lt;br /&gt;
#Have everything plugged into the unit except the power coord. Have the power coord in your hand.&lt;br /&gt;
#Press and hold the power button and plug the unit in.&lt;br /&gt;
#Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.&lt;br /&gt;
#Wait a couple of seconds and it will say Sony, then you will see the recovery screen.&lt;br /&gt;
#After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.&lt;br /&gt;
#You can now press the numbers assigned to the commands!&lt;br /&gt;
&lt;br /&gt;
== Related ==&lt;br /&gt;
[[Sony Update Downloads]]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. http://www.windowsfordevices.com/c/a/News/Intel-CE4100/&lt;/div&gt;</summary>
		<author><name>Catrane</name></author>
	</entry>
</feed>