Exploitee.rs - User contributions [en]

Main Page/Devices

2012-12-29T04:34:34Z

AgentHH: Reorder devices

{| style="border: 0px solid #000000; cell-padding:0px; cell-spacing:0px;"
| valign="top"|
{| style="border: 1px solid #000000; cell-padding:0px; cell-spacing:0px; width:440px;" valign="top"
|+'''SECOND GENERATION DEVICES'''
| style="border-top: 0px solid #000000;"|[[File:Hisense pulse stock.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Hisense Pulse'''
*[[Hisense Pulse]]
*[http://forum.gtvhacker.com/pulse-gx1200v-f42/ Join The Hisense Pulse Forum! ]
|-
| style="border-top: 0px solid #000000;"|[[File:180px-NSZ-GS7.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Sony NSZ-GS7'''
*[[Sony NSZ-GS7 (Streamer)]]
*[http://forum.gtvhacker.com/nsz-gs7-streamer/ Join The NSZ-GS7 Forum! ]
|-
| style="border-top: 0px solid #000000;"|[[File:Costar01.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Vizio Co-Star'''
*[[Vizio Co-Star]]
*[http://forum.gtvhacker.com/star-vap430-f40/ Join The Co-Star Forum! ]
|-
| [[File:180px-LG_G2.jpg|180px]]
| colspan="2" valign="top" style="text-align: left;"|
'''LG 47G2/55G2'''
*[[LG 47G2/55G2 (Internet TV)]]
*[http://forum.gtvhacker.com/47g2-55g2-internet-f36/ Join the LG devices forum! ]

|}
| valign="top"|
{| style="border: 1px solid #000000; cell-padding:0px; cell-spacing:0px; width:440px"
|+'''FIRST GENERATION DEVICES'''
| style="border-top: 0px solid #000000;"| [[File:180px-revue.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Logitech Revue'''
*[[Revue software root]]
*[[Steps to get root ]]
*[http://forum.gtvhacker.com/revue/ Join the Revue forum! ]
*[http://gtvhacker.com/blog/2011/logitech-revue-software-root/ Why no software root? ]
*[http://gtvhacker.com/index.php/Category:Logitech_Revue Info on Logitech Revue]
|-
| style="border-top: 0px solid #000000;"|[[File:180px-Sony_NSZ_GT1_NSX_40GT1.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Sony NSZ-GT1'''
*[[Sony NSZ-GT1 (Bluray Player)]]
*[http://forum.gtvhacker.com/nsz-gt1/ Join The NSZ-GT1 Forum! ]
'''Sony NSX-##GT1'''
*[[Sony NSX-40GT1 (Internet TV)]]
*[http://forum.gtvhacker.com/nsx-40gt1/ Join The NSX-40GT1 Forum! ]
''' Sony Generic'''
*[[Root through UART Bootloader Access]]
*[[Running Unsigned Kernels On Sony GTV]]
*[[Sony SATA HW Root (Gen 1)]]
*[[I've rooted... now what?!]]
|}
{| style="border: 1px solid #000000; width:440px; cell-padding:0px; cell-spacing:0px;"
|+'''OTHER DEVICES'''
| style="border-top: 0px solid #000000;width:180px;"| [[File:Front-SMALL.jpg|180px]]
| colspan="2" valign="top" style="text-align: left; border-top: 0px solid #000000;"|
'''Boxee Box'''
*[[Boxee]]
|}
|}

[[All_device_feature_matrix|All Device Feature Matrix]]

LogitechRevueUpdates

2011-01-10T01:37:53Z

AgentHH: Added list of Revue updates

List of current Logitech Revue updates

{| border="1" cellspacing="0"
! Version number
! Date first seen
! Update link
|-
| b39389
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip
|-
| b39953
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip
|-
| b42449
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip
|}

GTV FileSystem

2011-01-10T01:29:56Z

AgentHH: /* Updates */ fix internal update link

The Google TV File System is similar to most other Android Operating Systems.

== Updates ==
Updates to the Google TV, unlike most the incremental updates that most Android phones receive, come as a complete file system meant to replace the previous. It is assumed that since Google TV devices are meant to be connected to high speed internet connections, downloading a full File System is more palatable than on a limited-bandwidth mobile device.

Updates are retrieved without user intervention from the Google Servers. You can use the device version number to check your current file system implementation (See [GoogleTV - Version Numbers] for more information). Updates are distributed as signed zip files including a recovery, system, and userdata image. The current update packages are:

[http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip Logitech Revue b42449]

List of all updates for:
*[[LogitechRevueUpdates|Logitech Revue]]

== file System Obfusication ==

== How to access the File System contained within an image ==
The Zip File is a simple matter to extract, however the images within them tack some massaging in order to explore. While they are a typical SquashFS File System, they have some padding bytes that prevented a simple "Unsquashing."

*It would be great if we could create a way to use dd to truncate the image instead of using a hex editor. You should be able ot somehow grep for the start and then dd the proper bits into a new file that could be explored correctly.*

Some data on the process is available here:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

== GTV Recovery Mode vs GTV(System) Mode ==

== GTV Boot Loader ==
The Boot Loader is included on the File System, currently in the X directory. The Boot Loader is based off of the Y Loader (More information can be found at Z).
For the Sony BlueRay player, the Boot Loader is ABC.

== Files of interest within the File System ==

== So, why can't I just edit a File System and use it to update my review? ==

GTV FileSystem

2011-01-10T01:28:59Z

AgentHH: /* Updates */ reworking

The Google TV File System is similar to most other Android Operating Systems.

== Updates ==
Updates to the Google TV, unlike most the incremental updates that most Android phones receive, come as a complete file system meant to replace the previous. It is assumed that since Google TV devices are meant to be connected to high speed internet connections, downloading a full File System is more palatable than on a limited-bandwidth mobile device.

Updates are retrieved without user intervention from the Google Servers. You can use the device version number to check your current file system implementation (See [GoogleTV - Version Numbers] for more information). Updates are distributed as signed zip files including a recovery, system, and userdata image. The current update packages are:

[http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip Logitech Revue b42449]

List of all updates for:
*[LogitechRevueUpdates Logitech Revue]

== How to access the File System contained within an image ==
The Zip File is a simple matter to extract, however the images within them tack some massaging in order to explore. While they are a typical SquashFS File System, they have some padding bytes that prevented a simple "Unsquashing."

*It would be great if we could create a way to use dd to truncate the image instead of using a hex editor. You should be able ot somehow grep for the start and then dd the proper bits into a new file that could be explored correctly.*

Some data on the process is available here:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

== GTV Recovery Mode vs GTV(System) Mode ==

== GTV Boot Loader ==
The Boot Loader is included on the File System, currently in the X directory. The Boot Loader is based off of the Y Loader (More information can be found at Z).
For the Sony BlueRay player, the Boot Loader is ABC.

== Files of interest within the File System ==

== So, why can't I just edit a File System and use it to update my review? ==

Logitech Revue UART root

2011-01-06T05:06:54Z

AgentHH: /* Software Portion */ fix formatting

[[File:Revue-advert.gif|250px|right|thumb]]
{{Revue toc Inline}}
== Updates ==
=== 2011 January 5: ===
You '''ABSOLUTELY''' need a "virgin" Logitech Revue with ''NO'' updates in order to do this hack!!

'''Any previous device updates will disable the UART1 pins necessary for this hack!'''

== Demonstration video.==
Shows Filesystem access, Apps and the Market, as well as previously blocked websites.
Check it out http://www.youtube.com/user/gtvhacker

== GTVHACKER'S Guide to installing applications and rooting your Logitech Revue ==

This is being brought to you right before CES, we all worked hard and here it is.

===Features===

ADBD Running for adb access.
Custom boot logo.
Flash Plugin Update to allow previously blocked content providers.

Experimental method to block automatic updates (We would appreciate feedback on this as we we've been unable to confirm its success so far.)

===About the Hack===

The reason this is possible is due to the "out of factory" state of the Logitech Revue boxes not disabling the UART port on the board and allowing access to a root shell in recovery mode. After discovering this we were able to reverse the update files and manually upgrade the Revue to the most recent update. The attached files are our output of all the effort put forward by our team. Also as a notice to anyone performing the update, we are not responsible for any harm that may come of your box as an outcome of running our scripts. We will attempt to help you with any issues you may experience and have tried to make the process as safe as possible. Also if you have any suggestions or ideas on how we can make this process better please feel free to drop by our IRC channel and tell us.

===About Manual Update===

The manual-update.sh script is our attempt at duplicating the process done by the GTV scripts that update the box in recovery mode. There are also a few miscellaneous tweaks done to assure applications load correctly, backups are made, and that the box doesn't auto-update. Some portions of the script do things such as flash parts of the NAND so make sure you do not short circuit your box or accidentally remove power during the manual-update process.

===Required Tools===

Soldering Iron

USB->TTL or similar board/setup (An Arduino in tristate mode works great)

4 wires to attach board to TTL board

Terminal program (Minicom for Linux or Putty for Windows)
A USB Drive (At least 1gb, 2+gb Recommended)

===Hardware Portion===

In order to complete the root you will need an un-updated box, it seems as if the first or second update to the box closed the serial access hole. If you have a "virgin" box then you are ready to proceed.

1.) Open your box, there are 4 screws (1 under each of the soft legs on the bottom of the box), the rest of the box un-clips very easily. A better explanation is available at http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1

2.) After opening your box you will need to remove the led bar and look at the top front of the board. Locate the pins labeled UART1. These are the pins you will be sodering to.

3.) Solder 4 wires to your board. The appropriate pins can be view here: http://gtvhacker.com/index.php/File:XJHay.jpg . You MAY only need to solder to TX, RX, and GND.

4.) Attach wires to appropriate pins on your USB->TTL device

5.) Connect to the USB->TTL device on your computer using a program like Minicom or Putty. The appropriate settings are speed is 9600 baud with 8n1, make sure flow control is set to none.

6.) Reboot Revue into recovery mode by holding the pair button on the back of the board until the box shuts down and comes back up. Then press Alt+L until "FORMATING DATA:" shows and stays, a menu should appear shortly after system is done clearing partitions. (More info: [[Logitech_Revue_Technical]])

7.) If setup is correct so far you should be seeing logcat output through your terminal program (Putty/Minicom). Shortly after you will be presented with a # sign which is your console.

8.) Proceed to software portion.

===Software Portion===

1.) Place all files in manual update on USB (preferably to ext3) device keeping all the files inside of the "updatec99" folder for easiest installation.

2.) Insert the USB and run the following command for an ext3 USB device "mount -rw -t ext3 /dev/sdb1 /sdcard" substitute ext3 for vfat for a fat32 device (Also remove quotes)

3.) In minicom/putty browse to the /sdcard directory with "cd /sdcard/updatec99".

4.) Execute the update with the following command "sh manual-update.sh"

5.) If the process ends prompting "Complete" you are finished and may restart. You will then have adbd running on your Revue and can connect using "./adb connect LogitechRevue". If the process does not prompt you with "Complete" but some other error you will need to make sure you do not reboot your Revue or it may be bricked.

You are now complete and free to install applications on your box remotely through adb.

Note: when booting in normal mode, ''you will not see any console output''. If you want a serial console again, go into recovery.

===Building the code===

The GTVHacker team has a [http://dl.dropbox.com/u/1886948/gtvhacker-NDK-installer.zip script] to simplify the download/configuration/installation of unofficial NDK/toolchain support which is documented in the Logitech Revue technical section.

===Troubleshooting===

If you experience '''any''' issues, please check wiki as we will be updating it with the most common problems then visit our IRC if the wiki does not assist you.

===About Us===
This package is brought to you by the GTVHacker team over at irc.freenode.net #gtvhacker.

GTVHacker Team Members:

* Zenofex
* CJ_000
* Craigdroid
* Tdweng
* DcPlaya

Thanks to everyone in the community who made this all possible.
The GTVHacker Team

== Related Files: ==
Google TV O/S modifications to achieve root are available at: http://www.multiupload.com/REVEQS6HII

Script to simplify tool chain and sdk building : http://dl.dropbox.com/u/1886948/gtvhacker-NDK-installer.zip

[[Category:Logitech Revue]]

Logitech Revue UART root

2011-01-06T05:06:30Z

AgentHH: /* Software Portion */

[[File:Revue-advert.gif|250px|right|thumb]]
{{Revue toc Inline}}
== Updates ==
=== 2011 January 5: ===
You '''ABSOLUTELY''' need a "virgin" Logitech Revue with ''NO'' updates in order to do this hack!!

'''Any previous device updates will disable the UART1 pins necessary for this hack!'''

== Demonstration video.==
Shows Filesystem access, Apps and the Market, as well as previously blocked websites.
Check it out http://www.youtube.com/user/gtvhacker

== GTVHACKER'S Guide to installing applications and rooting your Logitech Revue ==

This is being brought to you right before CES, we all worked hard and here it is.

===Features===

ADBD Running for adb access.
Custom boot logo.
Flash Plugin Update to allow previously blocked content providers.

Experimental method to block automatic updates (We would appreciate feedback on this as we we've been unable to confirm its success so far.)

===About the Hack===

The reason this is possible is due to the "out of factory" state of the Logitech Revue boxes not disabling the UART port on the board and allowing access to a root shell in recovery mode. After discovering this we were able to reverse the update files and manually upgrade the Revue to the most recent update. The attached files are our output of all the effort put forward by our team. Also as a notice to anyone performing the update, we are not responsible for any harm that may come of your box as an outcome of running our scripts. We will attempt to help you with any issues you may experience and have tried to make the process as safe as possible. Also if you have any suggestions or ideas on how we can make this process better please feel free to drop by our IRC channel and tell us.

===About Manual Update===

The manual-update.sh script is our attempt at duplicating the process done by the GTV scripts that update the box in recovery mode. There are also a few miscellaneous tweaks done to assure applications load correctly, backups are made, and that the box doesn't auto-update. Some portions of the script do things such as flash parts of the NAND so make sure you do not short circuit your box or accidentally remove power during the manual-update process.

===Required Tools===

Soldering Iron

USB->TTL or similar board/setup (An Arduino in tristate mode works great)

4 wires to attach board to TTL board

Terminal program (Minicom for Linux or Putty for Windows)
A USB Drive (At least 1gb, 2+gb Recommended)

===Hardware Portion===

In order to complete the root you will need an un-updated box, it seems as if the first or second update to the box closed the serial access hole. If you have a "virgin" box then you are ready to proceed.

1.) Open your box, there are 4 screws (1 under each of the soft legs on the bottom of the box), the rest of the box un-clips very easily. A better explanation is available at http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1

2.) After opening your box you will need to remove the led bar and look at the top front of the board. Locate the pins labeled UART1. These are the pins you will be sodering to.

3.) Solder 4 wires to your board. The appropriate pins can be view here: http://gtvhacker.com/index.php/File:XJHay.jpg . You MAY only need to solder to TX, RX, and GND.

4.) Attach wires to appropriate pins on your USB->TTL device

5.) Connect to the USB->TTL device on your computer using a program like Minicom or Putty. The appropriate settings are speed is 9600 baud with 8n1, make sure flow control is set to none.

6.) Reboot Revue into recovery mode by holding the pair button on the back of the board until the box shuts down and comes back up. Then press Alt+L until "FORMATING DATA:" shows and stays, a menu should appear shortly after system is done clearing partitions. (More info: [[Logitech_Revue_Technical]])

7.) If setup is correct so far you should be seeing logcat output through your terminal program (Putty/Minicom). Shortly after you will be presented with a # sign which is your console.

8.) Proceed to software portion.

===Software Portion===

1.) Place all files in manual update on USB (preferably to ext3) device keeping all the files inside of the "updatec99" folder for easiest installation.

2.) Insert the USB and run the following command for an ext3 USB device "mount -rw -t ext3 /dev/sdb1 /sdcard" substitute ext3 for vfat for a fat32 device (Also remove quotes)

3.) In minicom/putty browse to the /sdcard directory with "cd /sdcard/updatec99".

4.) Execute the update with the following command "sh manual-update.sh"

5.) If the process ends prompting "Complete" you are finished and may restart. You will then have adbd running on your Revue and can connect using "./adb connect LogitechRevue". If the process does not prompt you with "Complete" but some other error you will need to make sure you do not reboot your Revue or it may be bricked.

You are now complete and free to install applications on your box remotely through adb.

Note: when booting in normal mode, /you will not see any console output/. If you want a serial console again, go into recovery.

===Building the code===

The GTVHacker team has a [http://dl.dropbox.com/u/1886948/gtvhacker-NDK-installer.zip script] to simplify the download/configuration/installation of unofficial NDK/toolchain support which is documented in the Logitech Revue technical section.

===Troubleshooting===

If you experience '''any''' issues, please check wiki as we will be updating it with the most common problems then visit our IRC if the wiki does not assist you.

===About Us===
This package is brought to you by the GTVHacker team over at irc.freenode.net #gtvhacker.

GTVHacker Team Members:

* Zenofex
* CJ_000
* Craigdroid
* Tdweng
* DcPlaya

Thanks to everyone in the community who made this all possible.
The GTVHacker Team

== Related Files: ==
Google TV O/S modifications to achieve root are available at: http://www.multiupload.com/REVEQS6HII

Script to simplify tool chain and sdk building : http://dl.dropbox.com/u/1886948/gtvhacker-NDK-installer.zip

[[Category:Logitech Revue]]

Logitech Revue Hardware

2011-01-05T06:14:25Z

AgentHH: /* Specs */ Added 4GB NAND Flash datasheet

[[File:Revue-advert.gif|250px|left|thumb]]
{{Revue toc Inline}}
This page will be dedicated to the hardware specifications, descriptions, and information related to the Logitech Revue.

The Revue was initially released October 21st 2010 (with official availability on the 25th) in the United States. The Revue was released initially as a pass-through device meant to augment your initial set top box connection to your display device. For customers using the "DISH Network" Satellite subscription television service, integration was available that allowed the Revue to communicate directly with the satellite receiver/set top box. For all other devices, an IR blaster was used to simulate remote control commands as a means to communicate between the Revue and the STB hardware.

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell) [http://www.szyuda88.com/uploadfile/cfile/201061714220663.pdf Datasheet]
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and had its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU
[[Category:Logitech Revue]]

Logitech Revue Technical

2010-12-29T06:52:28Z

AgentHH: /* Updates */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

''' recovery.img

system/boot/recovery.img is a standard Android boot image with some extra garbage (0x580 bytes) at the front. Remove it like so:
dd if=system/boot/recovery.img bs=1408 skip=1 > recovery-ungarbaged.img
Unpack that like a normal Android boot image. Something like [http://android-dls.com/files/linux/split_bootimg.zip this Perl script] works well.

The kernel (system/boot/kernel) is also a boot image with the same extra garbage at the front.

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:52:15Z

AgentHH: /* Updates */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

''' recovery.img
system/boot/recovery.img is a standard Android boot image with some extra garbage (0x580 bytes) at the front. Remove it like so:
dd if=system/boot/recovery.img bs=1408 skip=1 > recovery-ungarbaged.img
Unpack that like a normal Android boot image. Something like [http://android-dls.com/files/linux/split_bootimg.zip this Perl script] works well.

The kernel (system/boot/kernel) is also a boot image with the same extra garbage at the front.

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:42:31Z

AgentHH: /* Updates */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

system/boot/recovery.img is a standard Android boot image with some extra garbage at the front.

dd if=system/boot/recovery.img bs=1408 skip=1 > recovery-ungarbaged.img

Unpack that like a normal Android boot image. Something like [http://android-dls.com/files/linux/split_bootimg.zip this Perl script] works well.

The kernel (system/boot/kernel) is also a boot image with the same extra garbage at the front.

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T02:27:13Z

AgentHH: /* Specs */ Added SemiAccurate board shots

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM)
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8)
*Realtek Semiconductor RTL8201N 10/100M PHYceiver
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://dl.dropbox.com/u/217678/pic_dump.hex.txt PIC Hex Dump]