I found firmware for Slingbox 500 by sniffing the outgoing connections it is making. Having trouble making heads or tails of it though. I'd really love to see the filesystem because it's running dropbear ssh server!files as follow, were obtained from http://mdconfig.sling.com/config/v2/type/ngsb/product/intrepidCbfu/version/01.10.095.json --{payload:    {config:        {         updateVersion:01.10.102,         rebootTimeMsec:68000,         firmwareComponents:            {            appfsRecovery:                {                    critical:false,                    crc:123,                    order:1,                    reboot:false,                    url:www.navjit.com,                    size:123,                    version:0.5.102                },            uImageMain:                {                    critical:false,                    crc:1863698014,                    order:2,                    reboot:false,                    url:http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.bin,                    size:5463888,                    version:1.9.118                },            FW3:                {                    critical:false,                    crc:2050778634,                    order:3,                    reboot:false,                    url:http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.bin,                    size:262144,                    version:1.5.432                },            FW2:                {                    critical:false,                    crc:2050778634,                    order:4,                    reboot:false,                    url:www.navjit.com,                    size:123,                    version:0.5.472                },            FW1:                {                    critical:false,                    crc:123,                    order:5,                    reboot:false,                    url:www.navjit.com,                    size:123,                    version:0.5.472                },            uImageRecovery:                {                    critical:false,                    crc:123,                    order:0,                    reboot:false,                    url:www.navjit.com,                    size:123,                    version:1.5.002                }            },        applications:            {                sbCore:                    {                        urlMeta:http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tar,                        critical:false,                        sizeMeta:10240,                        reboot:true,                        type:file_system,                        url:http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aes,                        version:01.10.102,                        size:99865328                    }            }        }    },        header:            {                signatureEncoding:base64,                msgType:plain,                signature: MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAADGCAg8wggILAgEBMHkwdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAoTC1NsaW5nIE1lZGlhMRMwEQYDVQQDEwpNRCBET1dOIENBMSUwIwYJKoZIhvcNAQkBFhZtZGFkbWluQHNsaW5nbWVkaWEuY29tAgEDMA0GCWCGSAFlAwQCAQUAoGkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwNDI3MDYxNzIyWjAvBgkqhkiG9w0BCQQxIgQgdMg3fnkpkxTXkZzmAgvCH613L0YpH70/9yGDYSN0D7YwDQYJKoZIhvcNAQEBBQAEggEApKOkHp4k8EgaMxPIxelQX2E2iKP91HgUnx4lkYkffirQU5ObvIFWd4DAyEmb6QO8X3BVA/tWnDDaIwunUy/2WVjgcwyTiSLr20tPlEPDJcACEQERx2xzAss3Y+voeXmwBrmDWFXn5ILNUN86GsL3mUyfySR6ZPly4Wu2Krb55e58FIu9WqS6ynCD1Qdt4djQ6VgeG+2+CBmUp7mvoemgr+Kzs0wNCOOm9/561Cqsl3MCbHrt8hXikcb2lTyH3UkNRlBmYt66hb7MB1r1osT8KLLERuJ1kFOhYf6edefTFjyQVM/EUUwK5TO5NzFGB8wosG9jzbLpbE9qXQrj62j6tAAAAAAAAA==,configEncoding:none            }}Binwalk is blank on both of these files: http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/s_fw4_uImage_mips_gz_118.binhttp://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw3_f_p_1_5_432.binThe following tar file expands into three separate files:http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/FW5_SIG_01_10_102.tarFW5_sig.smime <-- don't know how to decode these smime files, but the contain strings like Intrepid pkg key, Intrepid pkg signer, and OpenSSL Generated Certificate, and have interesting names which might be useful!FW5_enc_params.smimeubi_fw_size --> 128057344And probably the most interesting file which appears thoroughly encrypted (95 MB):http://cbfu-prod.slingbox.com/Intrepid/Intrepid_FW_01_10_102/intrepid_fw5_full_01.10.102_nand.ubi.gz.aesSo here I am wondering if there is a chance to get further or if I'm stuck. I'm not against hardware tinkering, though I would certainly be clumsy with it and would require some handholding. Any thoughts? Thanks.
help getting at encrypted firmware [includes .SMIME and .gz.aes files]
firmware;encryption
Most likely the decryption key is hardcoded in the firmware on the device or in some storage there. You will probably need to get into the device somehow to figure out how it does the firmware update decryption.