You are not logged in.
I have gotten an old internet radio, this one:
https://www.amazon.com/Aluratek-AIRMM01 … B00192VWVY
I was able to flash the radio with a firmware I got for it with a USB, and it works. Basically they take lists of webcast stations and classifies them. I've listen to some pretty diverse stuff but some is non-functional.
The firmware file is a .bin file. I looks like a image file. Anyone know what to use to edit the file? It looks like matrix algebra from webpages. I have no idea what I'm getting into. But it'll keep me busy in addition. (Another pandemic insomnia project.)
Last edited by trilobite (2021-03-11 01:08:13)
{Linux-using people I haven't met are friends yet to be made.}
Online
Use binwalk to examine the blob. It'll tell you about the structure of the firmware image, and this in turn will give you hints how to extract things from it, possibly things that can be disassembled or unpacked.
Music makes us braver
Offline
I suppose the radio stations are hard-coded in the firmware and unable to be changed, so this makes sense.
Real Men Use Linux
Offline
Thanks! I like the calling it a "blob". There's no risk in playing with the firm ware I think, can always flash it back.
{Linux-using people I haven't met are friends yet to be made.}
Online
Thanks! I like the calling it a "blob". There's no risk in playing with the firm ware I think, can always flash it back.
If you can see the coded radio station strings in the blob bet you can carefully edit them to valid stations then. Note that the strings may be null terminated and be careful not to disturb the null bytes when editing.
Let us know how this goes.
Another command you can use to dump the strings within the blob is strings.
Last edited by DeepDayze (2021-03-15 19:07:45)
Real Men Use Linux
Offline
I get the following:
$ binwalk -e -M ShrekW.BIN
Scan Time: 2021-03-15 21:35:06
Target File: /home/trilobite/aluratek/ShrekW.BIN
MD5 Checksum: 638407b087be6282b2ae9713915b236a
Signatures: 386
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
168005 0x29045 XML document, version: "1.0"
169728 0x29700 XML document, version: "1.0"
174251 0x2A8AB XML document, version: "1.0"
178129 0x2B7D1 XML document, version: "1.0"
527723 0x80D6B HTML document header
$ binwalk -E ShrekW.BIN
DECIMAL HEXADECIMAL ENTROPY
--------------------------------------------------------------------------------
0 0x0 Falling entropy edge (0.829779)
28672 0x7000 Falling entropy edge (0.223081)
34816 0x8800 Rising entropy edge (0.952960)
36864 0x9000 Rising entropy edge (0.951714)
40960 0xA000 Falling entropy edge (0.562619)
373760 0x5B400 Rising entropy edge (0.950901)
478208 0x74C00 Falling entropy edge (0.809969)
529408 0x81400 Falling entropy edge (0.703562)
533504 0x82400 Falling entropy edge (0.745119)
566272 0x8A400 Rising entropy edge (0.980455)
569344 0x8B000 Falling entropy edge (0.760723)
I did
$ strings ShrekW.BIN &> shrek.txt
The output is first a bunch of random characters in lines 6 and 3 characters long,then a series of dashes ------- and fffffffff lines, followed by this:
Piano right
Copyright
1997 von Bernd Kr
'u8<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<device>
<deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType>
<friendlyName>Aluratek AIRMM01F</friendlyName>
<manufacturer>Aluratek</manufacturer>
<manufacturerURL>http://www.aluratek.com</manufacturerURL>
<modelDescription>Internet Radio Alarm Clock w/built-in WiFi</modelDescription>
<modelName>Internet Radio Alarm Clock w/built-in WiFi</modelName>
<modelNumber>AIRMM01F</modelNumber>
<UDN>uuid:00000000-0000-0000-0000-000000000000</UDN>
<UPC>0000 000 00000</UPC>
<serviceList>
<service>
<serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType>
<serviceId>urn:upnp-org:serviceId:RenderingControlServiceID</serviceId>
<SCPDURL>/RenderingControl/desc.xml</SCPDURL>
<controlURL>/RenderingControl/ctrl</controlURL>
<eventSubURL>/RenderingControl/evt</eventSubURL>
</service>
<service>
<serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType>
<serviceId>urn:upnp-org:serviceId:ConnectionManagerServiceID</serviceId>
<SCPDURL>/ConnectionManager/desc.xml</SCPDURL>
<controlURL>/ConnectionManager/ctrl</controlURL>
<eventSubURL>/ConnectionManager/evt</eventSubURL>
</service>
This repeats to give the radio instructions I guess. Then it repeats the random characters and ends. I see calls within the code re volume, setting memory stations, playing media from a computer through the radio. In the second section of random characters there's an occasional part of a word, like "ersion" and "microso" and almost IP numbers "5.188.23_4.120". No seeing stations.
I emailed the manufacturer and their support replied that it isn't supported any more. Expected. Not sure what next step is.
Last edited by trilobite (2021-03-15 22:33:40)
{Linux-using people I haven't met are friends yet to be made.}
Online
Maybe search online for any people who have "hacked" this device and what they did?
Bummer that the firmware file search didn't turn up any useful info such as the stations. Perhaps the station info may been encoded somehow.
Last edited by DeepDayze (2021-03-16 13:28:03)
Real Men Use Linux
Offline
I get the following:
$ binwalk -e -M ShrekW.BIN Scan Time: 2021-03-15 21:35:06 Target File: /home/trilobite/aluratek/ShrekW.BIN MD5 Checksum: 638407b087be6282b2ae9713915b236a Signatures: 386 DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 168005 0x29045 XML document, version: "1.0" 169728 0x29700 XML document, version: "1.0" 174251 0x2A8AB XML document, version: "1.0" 178129 0x2B7D1 XML document, version: "1.0" 527723 0x80D6B HTML document header
$ binwalk -E ShrekW.BIN DECIMAL HEXADECIMAL ENTROPY -------------------------------------------------------------------------------- 0 0x0 Falling entropy edge (0.829779) 28672 0x7000 Falling entropy edge (0.223081) 34816 0x8800 Rising entropy edge (0.952960) 36864 0x9000 Rising entropy edge (0.951714) 40960 0xA000 Falling entropy edge (0.562619) 373760 0x5B400 Rising entropy edge (0.950901) 478208 0x74C00 Falling entropy edge (0.809969) 529408 0x81400 Falling entropy edge (0.703562) 533504 0x82400 Falling entropy edge (0.745119) 566272 0x8A400 Rising entropy edge (0.980455) 569344 0x8B000 Falling entropy edge (0.760723)
I did
$ strings ShrekW.BIN &> shrek.txtThe output is first a bunch of random characters in lines 6 and 3 characters long,then a series of dashes ------- and fffffffff lines, followed by this:
Piano right Copyright 1997 von Bernd Kr 'u8<?xml version="1.0"?> <root xmlns="urn:schemas-upnp-org:device-1-0"> <specVersion> <major>1</major> <minor>0</minor> </specVersion> <device> <deviceType>urn:schemas-upnp-org:device:MediaRenderer:1</deviceType> <friendlyName>Aluratek AIRMM01F</friendlyName> <manufacturer>Aluratek</manufacturer> <manufacturerURL>http://www.aluratek.com</manufacturerURL> <modelDescription>Internet Radio Alarm Clock w/built-in WiFi</modelDescription> <modelName>Internet Radio Alarm Clock w/built-in WiFi</modelName> <modelNumber>AIRMM01F</modelNumber> <UDN>uuid:00000000-0000-0000-0000-000000000000</UDN> <UPC>0000 000 00000</UPC> <serviceList> <service> <serviceType>urn:schemas-upnp-org:service:RenderingControl:1</serviceType> <serviceId>urn:upnp-org:serviceId:RenderingControlServiceID</serviceId> <SCPDURL>/RenderingControl/desc.xml</SCPDURL> <controlURL>/RenderingControl/ctrl</controlURL> <eventSubURL>/RenderingControl/evt</eventSubURL> </service> <service> <serviceType>urn:schemas-upnp-org:service:ConnectionManager:1</serviceType> <serviceId>urn:upnp-org:serviceId:ConnectionManagerServiceID</serviceId> <SCPDURL>/ConnectionManager/desc.xml</SCPDURL> <controlURL>/ConnectionManager/ctrl</controlURL> <eventSubURL>/ConnectionManager/evt</eventSubURL> </service>
This repeats to give the radio instructions I guess. Then it repeats the random characters and ends. I see calls within the code re volume, setting memory stations, playing media from a computer through the radio. In the second section of random characters there's an occasional part of a word, like "ersion" and "microso" and almost IP numbers "5.188.23_4.120". No seeing stations.
I emailed the manufacturer and their support replied that it isn't supported any more. Expected. Not sure what next step is.
The XML is a universal plug and play interface description. It means, that if you're on the same network, a upnp client (or any http client) can query and/or send payloads to the HTTP endpoints defined for the listed services, the ConnectionManager and/or RenderingControl. you can try it with curl, for example, or a browser. Go to http://theipaddressoftheradio/<any of the endpoints listed above> and see what you find.
I wonder if this is even a complete firmware. One should try a disassembler. Can you upload the firmware e.g. to 0x0.st? BTW; the same radio seems to have been also sold as https://cdn.medion.com/downloads/anleit … 5651de.pdf in Germany.
Music makes us braver
Offline
Trying to access the http brings up "can't connect".
Uploaded to 0x0.st, firmware is at
https://0x0.st/-Ned.BIN
Thanks for the other info re different brandname. There's a different firmware noted in those instructions: ShrekW_R102C7.zip Looking for that got me to see that it is also called Sagem. https://manualzz.com/doc/1490595/sagem-700-user-guide
I got no where with any online instructions for the radio firmware or hacking.
The info seems to indicate that the radio calls stations from aluratek.vtuner.com. I can put in the radio serial number and it wants an email login. I emailed the support, and they do not respond (yet?). Somewhere there is an email and password associated with this radio. Perhaps this is not a functioning site - "no support".
Last edited by trilobite (2021-03-17 17:59:57)
{Linux-using people I haven't met are friends yet to be made.}
Online
Trying to access the http brings up "can't connect".
Uploaded to 0x0.st, firmware is at
https://0x0.st/-Ned.BIN
Thanks for the other info re different brandname. There's a different firmware noted in those instructions: ShrekW_R102C7.zip Looking for that got me to see that it is also called Sagem. https://manualzz.com/doc/1490595/sagem-700-user-guide
I got no where with any online instructions for the radio firmware or hacking.
The info seems to indicate that the radio calls stations from aluratek.vtuner.com. I can put in the radio serial number and it wants an email login. I emailed the support, and they do not respond (yet?). Somewhere there is an email and password associated with this radio. Perhaps this is not a functioning site - "no support".
Is there any option to create an account after you enter the serial#? Think you might have to do that as part of activating the radio.
Took a look at the Aluratek vtuner site and while there is a signon, there's another box below where you enter the serial. This where you entered the serial?
Here's what I saw in the help about the ID#:
About the Internet Radio Alarm Clock ID #
The ID # is a unique name that identifies your device. It consists of a series of numbers and letters.
The ID # is available by navigating the menus on your device.
How to login:
1. Retrieve your ID #
1. Navigate to the Internet Radio menu, and click the right arrow
2. Navigate to the Help menu, and click the right arrow
3. The second item listed is your ID#
2. Login to the aluratek.vtuner.com Web site.
Enter your ID # in the 'Sign in with your ID #' area, then click the 'Go' button.
Last edited by DeepDayze (2021-03-17 18:13:11)
Real Men Use Linux
Offline
Yes I did that with the serial and it wants and email sign-in after that. Obviously it was registered before. A 2 step login.
Which I don't have the email. So I emailed the support telling the story, no answer.
{Linux-using people I haven't met are friends yet to be made.}
Online