Skip to content
DougHickok edited this page Jan 12, 2015 · 2 revisions

Samsung NX Web Browser

There is a web browser application on the Tizen-based cameras.

tl;dr: run the following command to open any web site:

web-browser __AUL_MIME_TYPE__ mime mode-dial 7 wifi-key popup url https://op-co.de/

Reverse Engineering Samsung's Web Browser Calling Conventions

One way to launch the web browser from the camera UI is:

  • Wi-Fi mode
  • Social Networks / Cloud
  • SkyDrive --> confirm login request popup

After that, the Microsoft account sign-in is opened in a web browser, and we can see the app in ps ax:

440 ?        SLsl   3:47 /usr/bin/web-browser `zaybxcwdveuftgsh` __AUL_MIME_TYPE__ JwAAAAEEAAASAAAAX19BVUxfTUlNRV9UWVBFX18ABQAAAG1pbWUA url kgEAAAEEAAAEAAAAdXJsAH4BAABodHRwczovL2xvZ2luLmxpdmUuY29tL29hdXRoMjBfYXV0aG9yaXplLnNyZj9jbGllbnRfaWQ9MDAwMDAwMDA0NDA3M0UyNyZzY29wZT13bC5zaWduaW4rd2wub2ZmbGluZV9hY2Nlc3Mrd2wuYmFzaWMrd2wuZW1haWxzK3dsLnNreWRyaXZlK3dsLnBob3Rvcyt3bC5za3lkcml2ZV91cGRhdGUrd2wuZXZlbnRzX2NyZWF0ZSt3bC5jb250YWN0c19waG90b3MmcmVzcG9uc2VfdHlwZT1jb2RlJmRpc3BsYXk9dG91Y2gmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGc25zZ3cuc2Ftc3VuZ21vYmlsZS5jb20lMkZza3lkcml2ZSUyRmF1dGglMkZjYWxsYmFjayUzRnNuc2d3a2V5JTNEMzBlOTgxZmJkZmY5NGZkMGE2OTM4MDExMmE4MzE1MGJ1c2VyX2FnZW50JTNEREktTlgzMDAA mode-dial HAAAAAEEAAAKAAAAbW9kZS1kaWFsAAIAAAA3AA== wifi-key HgAAAAEEAAAJAAAAd2lmaS1rZXkABQAAAGV4aXQA __AUL_STARTTIME__ NAAAAAEEAAASAAAAX19BVUxfU1RBUlRUSU1FX18AEgAAADE0MjA3OTY4MDQvMzY1MjgxAA== __AUL_CALLER_PID__ JwAAAAEEAAATAAAAX19BVUxfQ0FMTEVSX1BJRF9fAAQAAAA0MjkA

Parameter Hell

Now this is a real lot of gibberish in there, let's see what it means. The first argument is some kind of security(?) cookie (it persists across reboots and is required as the first argument). Searching for it reveals, among libbundle.so (a "Simple string key/val dictionary library"), this:

linux-3.5/crypto/ansi_cprng.c:#define DEFAULT_V_SEED "zaybxcwdveuftgsh"

Further research leads into bundle_import_from_argv that has two ways to parse commandline arguments:

  1. ```zaybxcwdveuftgsh` ``
  2. <key> <value> <key> <value> <key <value> ...

Each <B64CHUNK> is a kind of length-value encoded key-value string pair, representing human readable data in the end. Now we just need to convert the B64-encoded parameters into their respective key-value strings, and can go on.

Required Parameters

It looks like the browser expects the arguments __AUL_MIME_TYPE__ = mime, mode-dial = 7, wifi-key (any value) and url (you choose!) to be present, so we can launch it from a script or from telnet in the following way:

web-browser __AUL_MIME_TYPE__ mime mode-dial 7 wifi-key popup url file:///
web-browser __AUL_MIME_TYPE__ mime mode-dial 7 wifi-key popup url https://op-co.de/

As can be seen, the web browser supports the file:// protocol, so it can be used to display local HTML files, photos from the SD card, etc.

Note: The "mode-dial" needs to match the current dial setting, otherwise the browser doesn't load. Values are 0 (Auto) through 7 (Wi-Fi).

Note: The file:// protocol works with static files, but NOT with named pipes. However, named pipes could be used by a script to interact with the user. Once the user clicks a link to a named pipe, a shell script can kill the browser and react to the input. Thus, the web browser may be the best built-in customizable UI available.