Official Boxee Box software update link

Although not listed as an entry on the download page (as of yet) the following URL will always host the latest boxee.iso: http://www.boxee.tv/download/boxeebox

The Online Update Protocol

A query for an update (using a fake release):

Returns this:

Which contains these links:

These two files are described in more detail below.


[B]Boxee Box by D-Link[/B][CR]Thanks for purchasing the Boxee Box
by D-Link.[CR]Welcome to Boxee 1.0 with access to Boxee's brand new interface, global search, new Apps, HTML 5, and more.[CR][CR]You'll be getting updates for the Boxee Box on a regular basis as we add content and fix anything that isn't quite perfect over the next few weeks.[CR]Enjoy your Boxee Box!


Boxee Box software updates are distributed as a file named boxee.iso. The file is not an CD-ROM ISO per se, but actually a SquashFS filesystem.

These updates appear to perform a fresh OS install, rather than applying incremental updates. In Recovery Mode, the system can install a boxee.iso file from a USB storage device. In this way, it may be possible to install a customized OS wrapped in a boxee.iso file.

This version of the boxee.iso has an MD5 check sum of 610f2ee2021efb96f7f9a0b3107753da.

Attempting to update with a boxee.iso of a different MD5 sum gives the error "Operation Failed, error code 0x314".

Examination of the boxee.iso file shows a number of ".sign" files (corresponding to filenames in the boxee.iso file) of 128 bytes apiece, and the run-time.sig file which is exactly 256 bytes. These correspond to signatures of a 1024 bit and 2048 bit RSA keys.

Examining the Recovery Console image reveals the public key used for signing:


Signatures (".sign" files) are verified by the '''RecoveryConsole''' application using openssl thusly:

/opt/local/bin/openssl dgst -verify /opt/boxee/publickey.pem -sha256 -signature [sign file] [file to verify]

Attempting to update with a boxee.iso with some (or all) ".sign" files deleted generates the error "Operation Failed, error code 0x320". It is however possible to trick the RecoveryConsole to flash a boxee.iso that uses signatures generated with your own key.

Mounting boxee.iso

Under Linux (Debian 64bit)

wget http://dl.boxee.tv/version/dlink.dsm380/
mkdir boxee
apt-get install squashfs-modules-2.6-amd64
apt-get install squashfs-tools
mount -o loop boxee.iso boxee

Under Windows XP / 7 (x86/x64)

  1. Download and extract the following utility: SquashFS-tools for Windows
  2. Drag the <tt>boxee.iso</tt> file onto the <tt>unsquashfs.exe</tt> icon. The contents will extract in a new folder within the current directory, named <tt>squashfs-root</tt>.

The boxee.iso Filesystem

linuxbox:~/src/boxee# find ./

Inside the "normal.img" are two files:

linuxbox:~/src/boxee/normal.img$ find ./

Inside the "dlink_boxee_runtime.img" is the updated Boxee OS. If you mount the normal.img file, you can then mount the dlink_boxee_runtime.img file - both using the same function pattern as above:

mount -o loop dlink_boxee_runtime.img mountpoint

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License