Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem (USENIX Security '25) [Restricted Artifact]

Overview The repository contains the restricted artifact of the paper: "Watch Out Your TV Box: Reversing and Blocking a P2P-based Illegal Streaming Ecosystem", which has been accepted by USENIX Security '25. Here, restricted means that access is limited to authorized parties, such as law enforcement and trusted researchers. In line with Open Science principles and reviewer recommendations, these potentially dangerous exploit codes, associated materials, and privacy-sensitive peer data are separated to prevent malicious abuse while still enabling controlled, responsible research and verification. Description of Files The restricted.zip archive file contains the sensitive materials for blocking EVPAD ecosystem, including identified vulnerabilities that are restricted due to potential misuse risks. There are three directories corresponding to the live streaming P2P traffic analysis and the two distinct vulnerabilities discovered in the research. /scale_estimation Contains codes and reference data for collecting information about peers and streaming servers through real-time P2P network monitoring. This data can be extended beyond EVPAD to analyze P2P traffic, service users, and server traces in other ISDs such as SVICloud and DIGIBox. /vulnerability_bypass_authentication Contains exploit codes (Frida script), related data, and a demo video targeting the EVPAD 3P device and StarLive app. This exploit leverages an authentication bypass to allow unauthorized access. Nox emulator is used to replicate the target EVPAD device's behavior without requiring actual hardware. /vulnerability_dos_attack Contains exploit codes (Frida script) and a demo video targeting the EVPAD 10P device and StarV10 app. This attack exploits a memory corruption vulnerability in the P2P networking library (libtvcore) used for live streaming, enabling forced termination of service apps.