throwaway96

WTA backdoor/vulnerability

Overview

There is a vulnerability/backdoor in webOS 5+ that allows you to easily run arbitrary commands as root during the boot process. The easiest way to exploit it simply involves putting a file on a USB drive and having it connected to your TV while it boots. There are two other methods that are more complex and require additional exploits.

throwaway96

News

EOL (2024-07-21)

I'm not going to be maintaining this document anymore. I'm leaving it as-is since much of the FAQ section is still accurate and has yet to be incorporated into other resources.

Use CanI.RootMy.TV to find an exploit for your TV.

New exploit for webOS 3.5+: DejaVuln (2024-04-21)

throwaway96

Warnings

What you do with this information is your own responsibility. If you brick your TV trying this, it's not my fault. You should probably have some electronics experience if you want to attempt this.

This is going to involve opening your TV and attaching wires to the pins of an integrated circuit. If you're not comfortable with that, this is not for you.

This document is a work in progress.

debugstatus

LG TVs since at least the era of NetCast and "Global Platform" (webOS predecessors) have had the notion of a debug level, generally called "debugstatus". There are three modes: DEBUG, EVENT, and RELEASE. TVs normally operate in RELEASE mode. DEBUG mode enables a variety of logging and other debugging features in webOS, including access to the bootloader console and debug menus via serial. EVENT is similar to DEBUG, although it may not enable as much logging and has other relatively minor differences.

aabytt

Playling a link with standard LG webOS player

• id - id of the player app, com.webos.app.mediadiscovery for webOS 6+, com.webos.app.photovideo for webOS 3.x-5.x, com.webos.app.smartshare for webOS 1.0-2.x
• fullPath - url of the video file
• fileName - name of the video displayed in player. Filename is remembered by the player to continue playback from exit timestamp

from a web app

webOS.service.request("luna://com.webos.applicationManager", {
           method: "launch",

Ircama

Replacing Netflix and Amazon keys of the webOS LG TV LG Magic Remote with other apps

This procedure allows substituting one or both Netflix and Amazon keys of the Magic Remote Control Unit with other apps or TV control menus of the webOS LG TV.

Netflix and Amazon keys can be found just over the Red-Green-Yellow-Blue color buttons of such remote.

Assumption for this procedure is that you accept to uninstall the apps related to the keys to be substituted. Example: if you want to replace the Netflix key, you need to uninstall Netflix (possibly, you are not using Netflix if you do not need such key).

To uninstall Netflix or Amazon Prime, press the Home key of the Magic Remote, select the "LG Content Store" app, press "APP" at the top of the screen, press "My Apps", press the "Rem

figgis

#!/usr/bin/env python


"""
- ae(v): context-adaptive arithmetic entropy-coded syntax element. The parsing process for this descriptor is
         specified in clause 9.3.
- b(8):  byte having any pattern of bit string (8 bits). The parsing process
         for this descriptor is specified by the return value of the function
         read_bits( 8 ).
- f(n):  fixed-pattern bit string using n bits written (from left to right)

minikomi

package main

import (
	"bufio"
	"bytes"
	"fmt"
	"io"
	"log"
	"os"
)