Decrypt Password

[rbf121]

I figured out a way to decrypt the passwords found in the Slingplayer Desktop console.log. Before I post steps, I'm wondering if someone wouldn't mind being a test subject. Does anyone have both the 15 character password that works in Slinger and the hashed password found in the log and wouldn't mind sharing to validate this works? You can just share the hashed pw and then I will post the password to confirm it's a match. (could also do this over DM)

The hashed password is something like this, followed by 64 characters.
"password":"E1:

Edit: Slinger v3.0.8f can handle the encrypted passwords now.

[Mikoshi-nyudo]

password="E1:5733E985252008DC29D20ED21E21E1ED45243B5C027A3F1725131DF2F2D4CA74"

[rbf121]

Hm, the formatting looks different so I'm guessing this is not correct but is the password, Edit: removed confirmed pw

There is something called hashKey which I'm unsure if it's required or differs per install.

[Mikoshi-nyudo]

Yes! well done. It is from the SP app SBProfile.xml.. same encryption/hashing though.

[Mikoshi-nyudo]

So I wonder if it might eventually it be possible from a JTAG NAND dump to then be able to read that Hashed/Encrypted password from the Solo or Pro boxes.... as I would assume they store it on the box in that format too. Would allow users to get into Setup Assistant again, and maybe FW hex hack update like ProHD if that's eventually needed too.

[sp222222]

man ! this might be the whole key to unbricking IF the spm1.5 tab with admin password takes this found cracked password you speak of from JTAG NAND

[bunklung]

Can someone explain to me the difference between the 64 character hash, the clear text, and the 15 character password Slinger uses?

I know my clear text admin password, but it's not working in Slinger. I did not pull this 15 character password from the Sling service, but I do have backups of xxxxx_Slingboxes.dat on both Android and the WebSlingPlayer. They both show adminPassword: hashes, but I think they are salted so they are different between these two files. Even if you decrypt this, will this mean I still can't use Slinger for lack of a 15 character password?

[almoney]

Very interesting. Now we need to find out how to generate the E1 password and unlock the reset slingboxes.

[GerryDazoo]

RandomMan: Not sure that would advance the cause. I'd like to get my hands on the firmware that got downloaded to the bricked box. Just to see if there might be a new default admin password. It must be online somewhere but you'd need the file name. Right now to get that info somebody might have to sacrifice a Solo for the cause and do a packet capture while it's getting bricked.
Unless someone could whip up a Solo simulator to send the new firmware check request.
Right now I'm not convinced that the brick firmware would even have a new password. If it was me, I would have disabled all logins.

[PeteSki1618]

First, thank you rbf121 for decrypting them for me. Those were the passwords that I knew and tried. Evidently, I am one of the guys that left my boxes on and now I have 3 Pros that are dead. It just kept giving me a Password error so I thought that's what was wrong. If anyone figures out a way to "unbrick" them, PLEASE let me know! Thanks to all for your help.
I just borrowed an M1 from a friend and got that to stream. Working on getting the Remote to work so I might be back on asking for help again. In the meantime, thanks again to all for your help.

[JoeM2016]

Check out #265 They have a procedure to unbrick Pro HD's.

[PeteSki1618]

Thanks JoeM2016. I took a quick look but am not too sure what to do besides doing a hard reset. Will give it another look tomorrow. Thanks for the info. I appreciate it!

[PeteSki1618]

I have finally been able to revive an M1, modified one of the remotes to work with my cable box, and can successfully view it remotely from outside the house. Thank you SO much to all for your help. I still have 3 ProHD's that are bricked and still cannot get to work. Thanks JoeM2016 for referring me to #265. I tried it on a Win11 machine with both versions of SlingPlayer with no luck. I will see if I can set up a virtual Win7 machine and try it there. At least I have ONE working box (but it's my friend's so may have to give it back which is why I'd like to get the Pros up and running. Thanks again!

[sp222222]

It’s simple : you need a valid administrator password to utilize the slinGER process/script. They have cracked the 350/500 password so sit tight until that genius can get things in order for all to enjoy the spoils.

…

On Tue, Nov 15, 2022 at 8:54 PM bunklung ***@***.***> wrote: Can someone explain to me the difference between the 64 character hash, the clear text, and the 15 character password Slinger uses? I know my clear text admin password, but it's not working in Slinger. I did not pull this 15 character password from the Sling service, but I do have backups of xxxxx_Slingboxes.dat on both Android and the WebSlingPlayer. They both show adminPassword: hashes, but I think they are salted so they are different between these two files. Even if you decrypt this, will this mean I still can't use Slinger for lack of a 15 character password? — Reply to this email directly, view it on GitHub <#296 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2NHSG7UJQIMFYQUPQWONRTWIQ5ELANCNFSM6AAAAAASAQG4KE> . You are receiving this because you commented.Message ID: ***@***.***>

[bunklung]

Hmm, then my brain is not remembering the password correctly, cause it's not working when I use the less than 15 character clear text password I had. Maybe my Slingbox is not working either? Do you have to put this clear text password in quotes?
;sbtype="240"
password=mypassword
or
password="mypassword"
; uncomment the next lines ipaddress and port with your local network info

[rbf121]

Try,
dHmOwKpGGaa2CZi

4u8wnxR3kQtaXVd

[bunklung]

Okay, I was expecting them to be the same decrypted 15 character string. I figured there was some salting going on. Anyhow, the first one worked! It would be interesting to understand how you decrypt it down to the original clear text password for the users that do NOT have old log/dat files. Then they could encrypt this to the 15 character string needed for Slinger. I found mine since I happen to have a old app backups from a rooted phone. I also had an old PC backup and found the dat file that way.

Thank you so much for your help and effort!

[RandomMan719]

rbf121 can you decrypt these for me?

I got two, the first one is a M2

E1:A21B6C268C42FA3773DC92B007C1838CEC3531C09E553D5672A154F5A8682ECA

and Here's a 350

E1:f83dbf17634f9b7e354bca30d8a796309b2e572bcf1dde1084c90638031c8d68

[rbf121]

33pl5y1xdf0uelc
6ogxanVwf0B71MQ

[RandomMan719]

Correct

[mdehrlich]

Am I missing something? Slinger works with the long encrypted password. What value is there in the cleartext password?

[rbf121]

You can use slinger with the long password (64 characters coming after E1:)? I think folks were only able to use the 15 character adminPassword with slinger, if they retrieved them before the servers shutdown. What device are you using which will take the encrypted password? It did not work on the M1 I tested.

The benefit of this is that after shutdown, you cannot get the adminPassword unless you find it in a log file somewhere. And some people are reporting only seeing the E1: passwords in the log. So for those folks, it may be possible to find the encrypted password (64 characters for 350/500/M1, may be shorter for other devices) in localstorage of devices where Slingplayer software was run (SlingPlayer Desktop, etc) and decrypt them to the password used in slinger. This is more of a recovery benefit for someone who did not get their passwords in time.

[mdehrlich]

ok. Thanks for clarifying this.

[RandomMan719]

Does @GerryDazoo know, if the E1: password works with Slinger?

[GerryDazoo]

The login message to the slingbox only has room for max 16 characters for the password. So I would think not.

[Drano32]

Hi rbf121, I have a 500 - E1:f36eed87be76c343db4ef73b32bd5866f9d39694ab89a1898ddc37f490464985

and an M1 - E1:5687D58440C92654746BA400CAA51A8AACB1A286770B663E82BD6D9A000193E4

I thought I knew the password for both but apparently not!

[Drano32]

And a third one, my other 500 - E1:66e9eaac35142e3af74ab5ff7ff748644362c45ca6d5924a00072ad60e534725

[rbf121]

What device do you have that will take the 64 character E1: password through slinger?

[rbf121]

Someone said it but I was not able to do it myself on the M1. I suppose it's possible it could work on other devices.

[RandomMan719]

Someone said it but I was not able to do it myself on the M1. I suppose it's possible it could work on other devices.

Deleted thanks

[Drano32]

I've now tried the three long encrypted E1 passwords and they just don't work on my two 500s and M2 - RBF121, if you can decrypt them for me it would be greatly appreciated! If easier by DM in the Discord server let me know.

[Drano32]

Have not tried the 64 character strings on my 500s (and the other box is actually an M2 not an M1). I could try using these strings - but would appreciate the unencrypted versions greatly though!

[Drano32]

Thank you rbf121, will try this one now!

[Drano32]

First one helped me use Slinger successfully for 1st time, it revived one of my 500s! Thank you so much. I'll double check the other two to make sure that I copied all of the text.

[Drano32]

Remaining ones (confirmed that I copied all of the text):

E1:66e9eaac35142e3af74ab5ff7ff748644362c45ca6d5924a00072ad60e534725

E1:5687D58440C92654746BA400CAA51A8AACB1A286770B663E82BD6D9A000193E4

First one is a 500, second one is an M2.

[rbf121]

"password":"iBbjMEe3BnnJXZQ"
"password":"805fjwaw3cy6f8h"

[Drano32]

This has made my weekend, thank you again!

[sp222222]

Can you change channels on that M1 ? I thought we could not configure inputs.

…

On Sun, Nov 20, 2022 at 12:00 PM PeteSki1618 ***@***.***> wrote: I have finally been able to revive an M1, modified one of the remotes to work with my cable box, and can successfully view it remotely from outside the house. Thank you SO much to all for your help. I still have 3 ProHD's that are bricked and still cannot get to work. Thanks JoeM2016 for referring me to #265 <#265>. I tried it on a Win11 machine with both versions of SlingPlayer with no luck. I will see if I can set up a virtual Win7 machine and try it there. At least I have ONE working box (but it's my friend's so may have to give it back which is why I'd like to get the Pros up and running. Thanks again! — Reply to this email directly, view it on GitHub <#296 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2NHSG4V32JT5IE26ZSZ25TWJJKMXANCNFSM6AAAAAASAQG4KE> . You are receiving this because you commented.Message ID: ***@***.***>

[PeteSki1618]

Yes. I have full functionality. I had to look at the codes the remote was sending and by a lot of trial and error, got the correct codes to send to my Optimum cable box.

[mobrad0729]

Rbf121. Would it be possible to provide me with the short password for these devices? I guess I was hoping that someone would pick up the slingbox product and didn't start looking at alternatives until too late.

350
E1:cfa4adb5e5ad43c6bccce47f5a8a485772e0512a345e1b469a1df6811958ed3f

M1
E1:35CC7A5ECD62CC6B83C689E48C415E5F7EF3EF85577BE471D40894462EEA17B7

I also have a third one which I don't have immediate access to but has the following
E1:98A216F66ABB721EBA605E2F9F519F52CB50C57DE753E930998C516A06BC4C77

Appreciate

[PeteSki1618]

I jinxed myself. Yesterday I had full functionality on the remote both in the house and remotely. Today, I tried resurrecting my ProHD's so was playing around with them with no luck. Just hooked the M1 back up and now the remote doesn't work. Checked all wires. Any ideas would be greatly appreciated?

[AME-Miguel]

Rbf121. Would it be possible to provide me with the short password for these devices please?

E1:52A8C588D0A7EB32ECD85E491C57FC6DBBCEDC1CC5033D709674363E0690A304
E1:DA7BF99114593B89DC3433615B3CCAE31D0A892F86F5ABAD

Thanks in advance

[AME-Miguel]

They are both M1s

[tom76017]

In windows, look at: %appdata%\Sling Media\Slingplayer Desktop\Logs\console.log
I found my M1 password there. Search for "admin","PASSWORD"

[AME-Miguel]

Thanks, tom76017 but the passwords I found in this console.log did not work for me. That is why I was hoping sending the following hash passwords for my two M1s would help rbf121 generate the working slinger passwords:

E1:52A8C588D0A7EB32ECD85E491C57FC6DBBCEDC1CC5033D709674363E0690A304
E1:DA7BF99114593B89DC3433615B3CCAE31D0A892F86F5ABAD

Could you please rbf121? Thanks

[mobrad0729]

I may not have put this at the right level.

Rbf121. Would it be possible to provide me with the short password for these devices? I guess I was hoping that someone would pick up the slingbox product and didn't start looking at alternatives until too late.

350
E1:cfa4adb5e5ad43c6bccce47f5a8a485772e0512a345e1b469a1df6811958ed3f

M1
E1:35CC7A5ECD62CC6B83C689E48C415E5F7EF3EF85577BE471D40894462EEA17B7

I also have a third one which I don't have immediate access to but has the following
E1:98A216F66ABB721EBA605E2F9F519F52CB50C57DE753E930998C516A06BC4C77

Appreciate

[rbf121]

5LMeofsMykxnZtU
o3oenj9mo3829o3
jf5oozq0776q4vs

[AME-Miguel]

rbf121, could you please provide me with the short passwords fort these M1 devices please?

E1:52A8C588D0A7EB32ECD85E491C57FC6DBBCEDC1CC5033D709674363E0690A304
E1:DA7BF99114593B89DC3433615B3CCAE31D0A892F86F5ABAD

thanks

[rbf121]

chichariro14
miguelito7

[tryin100]

I have four 500 units with these "E1" passwords.
Any help you could provide decrypting them would be greatly appreciated.
Thanks

"password":"E1:e25150b2d57c34ff9a99b90b7cd6154aeb3532ab4d02da6c1d97764c01179170"
"password":"E1:4a0a847d370147999b8ad73680c1ab7359fc25895572ca278a041b9a04e7978f"
"password":"E1:c57927202c6bdeeafded9a771e5d03418ffaacda2bcc88070804ae318e9097ac"
"password":"E1:e90952e28e6570f4cb75f21ed27ecc178d7c50d1900cf3470f05cc7c98a6cad1"

[rbf121]

nuaIOi8TukPyEsd
x4d0ReWcfHZkGWX
rjxAeks8EepC7iv
XS2wMPB1lQhlYvf

[tryin100]

these worked perfectly. thank you so much!

[tryin100]

I understand that the new slinger code will decrypt the E1 passwords so they can be used, but could you decrypt this one last E1 password for me so I have a complete set of decrypted passwords for all my 500s? Thanks
password":"E1:2da72e95d08a877c2a201679dac615cf330642b9c620c9d7ca95105976a1287a"

[rbf121]

It took quite a while to figure out but I'm finally able to decrypt/encrypt passwords using python code. It leverages the Slingplayer DLL code to call the DecryptPassword method directly. I'll clean it up and post the code when I have a chance. There may be some other functions/methods in there of use.

[rbf121]

This one seems interesting, for the bricked boxes:

def FirmwareUpload(self, fileName=defaultNamedNotOptArg, bRestartAfterUpdate=defaultNamedNotOptArg):
	'Firmware bin file will be uploaded to the box'
	return self._oleobj_.InvokeTypes(14, LCID, 1, (24, 0), ((8, 1), (3, 1)),fileName
		, bRestartAfterUpdate)

[RandomMan719]

@rbf121 Nice Work!

[GerryDazoo]

rbf121: Can you email me directly about how your using the DLL. We might be able unbrick the ProHDs much easier with this.
[email protected].

[rein-10]

so i have an m1 and following the e1 its only 48 characters. You think you can help me? E1: 8870BAD2EE0965778870BAD2EE0965778EFE3D3FC7CA57D3

[rbf121]

Encrypted Password: [E1:8870BAD2EE0965778870BAD2EE0965778EFE3D3FC7CA57D3]
Decrypted Password: [holahola10]

[rbf121]

I posted the python code to run the DecryptPassword method via WebSlingPlayer DLL/COM methods here:
https://github.com/rbf121/Slinger-Utility

There may be some other useful methods in there for other utility purposes, if someone can figure out how to use them.
Specifically, these seem interesting,

	def FirmwareUpload(self, fileName=defaultNamedNotOptArg, bRestartAfterUpdate=defaultNamedNotOptArg):
		'Firmware bin file will be uploaded to the box'

and

	def UploadIRBinFile(self, fileName=defaultNamedNotOptArg):
		'IR bin file will be uploaded into box, current input must not be tuner.'

I also had a brainstorming session with Gerry and it should be possible to update Slinger app to support the E1: encrypted passwords in the config.ini as well. I believe he will be rolling that out in a future release which will eliminate the need for this utility method.

[rick624]

Hi rbf121, I have an E1 encryption password from my Pro-HD, could you provide me decrypt the short password please?
Thanks
E1:AAC746203E72E6BF8478491D63966225

[GerryDazoo]

E1:AAC746203E72E6BF8478491D63966225-> mnc453

[rick624]

Thanks GerryDazoo, This decrypted password is really my old admin password,
But my Pro-HD is already bricked Orz

[GerryDazoo]

If it's bricked you need to do a factory reset. New password will be "admin"

[rein-10]

mine is also my old admin password but it wont work. Any advice?

[rein-10]

never mind just saw another post that i can reset it and use admin. I dont have a problem with it not having an ir blaster since i have a harmony in that room

[PeteSki1618]

I have 3 bricked ProHD's. I have tried doing a factory reset but then Slingplayer doesn't find it. I've read through several of these threads to try and figure out how to revive it. Does anyone have a step-by-step installation procedure for dummy's just like the PDF someone posted for setting up the server? I got my friend's M1 up and running with full functionality but not the ProHD's. I tried on a Win11, Win10 and XP computer. Someone mentioned needing a Win7 PC which I don't have. Any help would be greatly appreciated. Thanks in advance. Happy Thanksgiving to all!

[Mikoshi-nyudo]

I have 3 bricked ProHD's. I have tried doing a factory reset but then Slingplayer doesn't find it. I've read through several of these threads to try and figure out how to revive it. Does anyone have a step-by-step installation procedure for dummy's just like the PDF someone posted for setting up the server?

#357

[PeteSki1618]

Thanks. I'll give it a try.

[Toei79]

question i did a reset on one 350, then i not longer can use remote? guess Gerry already answer me this but try see this progressing here.

my issue i only can hear audio in my 350 but not video from composite maybe its component so i only get audio but idk if its

and where i get encrypted password? i check rbf121 slinger utility documents anyway

edit i get those , i have three boxes. two 350 and one sb300
any help with those too? thank you so much!

E1944C1591041CD07947996757282636F2E78D3643F34652
E1:886bc39716e311ecc47a8ed97d9907d57adbee2661f41134ae4a9f0846e91aa7
E1:ef8e2c1dea5275a7d1563da8d4e57824ed464caffb1feb34255300a241840c88

i tried those in the .ini file but not working.

[GerryDazoo]

You're probably using the wrong VideoSource

[GerryDazoo]

The latest version of slingbox_server support using the E1: password. The slinger code will do the decryption.

[Toei79]

The latest version of slingbox_server support using the E1: password. The slinger code will do the decryption.

how you add it? i mean, you need start E1: And large numbers letters, or just large numbers letters without E1:
i tried without success unfortunately

[GerryDazoo]

I thought the release notes and my announcement here about the new version made it very clear you need the E1:
i.e. password=E1:DA7BF99114593B89DC3433615B3CCAE31D0A892F86F5ABAD

[Toei79]

OK yea, i just add Password

[SLINGBOX]
sbtype="350/500/M1/M2"
;sbtype="Solo/Pro/ProHD"
;sbtype="240"
password=E1:ef8e2c1dea5275a7d1563da8d4e57824ed464caffb1feb34255300a241840c88

here but its not working. the finderid match with this password its a 350 but keep get this error.

and i have one that i reset using adm password its working. still just audio in that one.

[GerryDazoo]

Toei: The finderid is NOT the password, sorry,

[Toei79]

well but im using the password not the finderid.

i have three slingboxes, when i run .py it gives me finderid of the one im running, then i compare with the one from console log, so i know which one im using the one that match finderid. i can do a video showing the .ini file and command running.

for what im understand you see finderid, password on the console.log. they are different of course,

[rein-10]

Found an app that lets you see the logs of an android smartphone. Viewing the log I found something that looks as a key. The problem is that when ever I use the new server i get an error of missing characters and when trying utility by itself i get some strange characters. This is what i think is my key but im not sure. de4d7fa50352a19abb99d48eaa5873511eee11afb342f9d37c55a1c3b1008b53

And next is the full line of code

#EXT-X-KEY METHOD=AES-128,URI="sling://de4d7fa50352a19abb99d48eaa5873511eee11afb342f9d37c55a1c3b1008b53"

[tryin100]

I understand that the new slinger code will decrypt the E1 passwords so they can be used, but could you decrypt this one last E1 password for me so I have a complete set of decrypted passwords for all my 500s? Thanks
password":"E1:2da72e95d08a877c2a201679dac615cf330642b9c620c9d7ca95105976a1287a"

[lepmail]

Try: C3VyCcaM0wzbnQY

[tryin100]

thank you

[Toei79]

Can you decryp mines too?, I'm unable to make work so far honestly

E1:E1944C1591041CD07947996757282636F2E78D3643F34652
E1:886bc39716e311ecc47a8ed97d9907d57adbee2661f41134ae4a9f0846e91aa7
E1:ef8e2c1dea5275a7d1563da8d4e57824ed464caffb1feb34255300a241840c88

Thank you

[socelillyhammer]

@Toei79 if you understand and know how to read and run the coding the slingbox_server.py has the coding to decryt the PY (from what I can read and semi-understand). Search "decryt" to find the script in the py file

So if you are more coder tech savy than me you could , i assume, extract that coding, and run it somewhere to decrypt and you will see your pw.

I dont know how to do this stuff but if I could I would help.

[Toei79]

I just paste the password to the .ini file the one large starts with E:

For what you said i need check "decryt" in the .ini file

I thought it was just paste in password in the .ini file ,

I wish know more , sometimes I give up and back to see it I fix things there.

Here its where I place it

[GerryDazoo]

Yes, that's the right place put in the E1: password there
E1:blahblahblah
Make sure you leave in the E1:

You do not have to hack the code as soccilliy suggests.

[salahkanaan]

Hi. Can you decrypt mine.
E1:646608a8c13707ae850fecfe20f34d75b97555fcbd3dc3a0a32f14c43b4a05
E1:563deba5114b2ee5ea0a41aa76e4ea288879c650bfb9c5faa793f859786d2c0
I have the 350 model.
thanks a lot

[salahkanaan]

I figured out a way to decrypt the passwords found in the Slingplayer Desktop console.log. Before I post steps, I'm wondering if someone wouldn't mind being a test subject. Does anyone have both the 15 character password that works in Slinger and the hashed password found in the log and wouldn't mind sharing to validate this works? You can just share the hashed pw and then I will post the password to confirm it's a match. (could also do this over DM)

The hashed password is something like this, followed by 64 characters. "password":"E1:

Edit: Slinger v3.0.8f can handle the encrypted passwords now.

Hi. Can you decrypt mine.
E1:646608a8c13707ae850fecfe20f34d75b97555fcbd3dc3a0a32f14c43b4a05
E1:563deba5114b2ee5ea0a41aa76e4ea288879c650bfb9c5faa793f859786d2c0
I have the 350 model.
thanks a lot

[salahkanaan]

Also this one please
E1:08a8c137050fecfe20£34d75b9645 d3dc3aOaea32f364a64

[GerryDazoo]

You don't need to decrypt it. The server will do it for you. Just set it as your password.

[salahkanaan]

Many thanks. I did reset the box. VLC is opening up with no errors. But screen is black and not streaming.

…

On 2 Apr 2023, at 12:04 PM, GerryDazoo ***@***.***> wrote: You don't need to decrypt it. The server will do it for you. Just set it as your password. — Reply to this email directly, view it on GitHub <#296 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A5TR2LGAPQLOFRWBPM7CG2DW7E6LFANCNFSM6AAAAAASAQG4KE>. You are receiving this because you commented.

[GerryDazoo]

without you posting the server output it's hard to say what's happening. Make sure you have the correct videosource selected.

[salahkanaan]

Many thanks. All works fine. In my case, No need to decrypt the password which I do not have. I have reset my slingbox 350 to default and put the below configuration with "admin" as password and works like a charm. Many thanks for this script.
[SLINGBOX]
sbtype="350/500/M1/M2"
;sbtype="Solo/Pro/ProHD"
;sbtype="240"
password=admin
And it would better to input the IP and port addresses