Exploitee.rs - User contributions [en]

Logitech Revue Technical

2011-01-04T06:09:12Z

Dcplaya: /* PIC Access */ added link to the pic disassembly

{{Revue toc Inline}}

== Update Procedure ==

Place new update labelled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode:

#Plug in the box, once the fan goes low, hold the sync button. Box should reboot, keep the sync button held until image on screen.
#Once you see the Arrow on your screen, using your keyboard press Alt+L - usually once or twice until Formatting DATA: shows on the screen, and does not go away
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

*http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip
*http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip
*http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

== Kernel Revisions ==

*Initial kernel observed on the Revue (?): 2.6.23.18-gc0a9a5fb (richard@sayan) (gcc version 4.1.2) #3 PREEMPT Sat Jul 31 15:32:56 PDT 2010
*439c26f6af05.mp-signed-ota_update-b39389: 2.6.23.18-g5fd8f46f (richard@mtdoom) #249 PREEMPT Tue Oct 5 09:55:20 BST 2010
*52057d168e2b.mp-signed-ota_update-b39953: 2.6.23.18-g5fd8f46f (richard@mtdoom) #249 PREEMPT Tue Oct 5 09:55:20 BST 2010
*c9914396d183.mp-signed-ota_update-b42449: 2.6.23.18-g5bba1a13 (sameer@sayan) #24 PREEMPT Fri Nov 19 11:13:31 PST 2010

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

redboot - ?

cefdk-config - ?

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

fts - Flash transactional key/value storage

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

system - [http://en.wikipedia.org/wiki/YAFFS YAFFS]

data - [http://en.wikipedia.org/wiki/YAFFS YAFFS]

keystore - [http://en.wikipedia.org/wiki/YAFFS YAFFS]

bbt - Bad block table

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

[http://dl.dropbox.com/u/217678/Bootloader%20from%20PIC.TXT PIC Disassembly]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

''' recovery.img

system/boot/recovery.img is a standard Android boot image with some extra garbage (0x580 bytes) at the front. Remove it like so:
dd if=system/boot/recovery.img bs=1408 skip=1 > recovery-ungarbaged.img
Unpack that like a normal Android boot image. Something like [http://android-dls.com/files/linux/split_bootimg.zip this Perl script] works well.

The kernel (system/boot/kernel) is also a boot image with the same extra garbage at the front.

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Open Ports ==
List nmap ports

Normal Mode, hooked to a Dish Network DVR (622) via WiFi:

*Nmap scan report for LogitechRevue (192.168.1.142)
*Host is up (0.060s latency).
*Not shown: 65528 closed ports
*PORT STATE SERVICE
*53/tcp open domain
*1100/tcp open unknown
*5222/tcp open unknown -- [http://xmpp.org/ Extensible Messaging and Presence Protocol (XMPP) Service (http://xmpp.org/)]
*5223/tcp open unknown -- SSL port for [http://xmpp.org/ XMPP]
*9551/tcp open unknown -- [[AnyMote]] Pairing Service through IpRemoteControlService -- SSL handshake requests cert and logs show errors from [[AnyMote]]
*9552/tcp open unknown -- [[AnyMote]] Connection Port
*35832/tcp open unknown

== Available Pinouts ==
*UART1 --> [http://i.imgur.com/xJHay.jpg UART Pinout]
*J3 --> PIC Chip Access (Pin 1 = VPP/MCLR, Pin 2 = VDD, Pin 3 = VSS, Pin 4 = ICSPDAT/PGD, Pin 5 = ICSPCLK/PGC, Pin 6 = Auxiliary)
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> I2C (Top left - GND Top right - ? Bottom left - SDA Bottom right - SCL)
*J69 --> USB Pinout
*SATA1 --> SATA Pinout (Pin 1 = GND, Pin 2 = TXP / A+ , Pin 3 = TXN / A-, Pin 4 = GND , Pin 5 = RXN / B-, Pin 6 = RXP / B+ , Pin 7 = GND)
*J24 --> Unknown (Pin 1 = 3.3, Pin 2 = ?, Pin 3 = ?, Pin 4 = GND)
*J13 --> Unknown (Power for SATA?) - (Pin 1 = ?, Pin 2 = GND, Pin 3 = GND, Pin 4 = 5v)
*XDP1 --> Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging] [ftp://download.intel.com/design/Pentium4/guides/31337301.pdf Page 23 Pinout]
[[Category:Logitech Revue]]

== Volume Management Configuration ==
Similar to other android based products, external storage can be attached and the device will attempt to mount it to /sdcard as per the following vold.conf:
<pre>
volume_sdcard {
# NOTE: This path is overbroad and will capture any device on the
# tatung3/tatung4 external PCI bus. This needs to be fixed, in conjunction
# with vold changes to handle logical device names (DEVPATH names are not
# static, unfortunately.)
media_path /devices/pci0000:00/0000:00:01.0/0000:01:0d.1/usb2/
media_type scsi
mount_point /sdcard
read_only true
}
</pre>

Note the interesting comment about the media_path as well as the read_only=true attribute.

Root Progress

2011-01-04T04:53:28Z

Dcplaya: Made the page just so its not blank

No information available at this moment.

Check back later

Exploitee.rs:About

2011-01-03T23:54:13Z

Dcplaya:

We are a group of people who are interested in getting full access to the GoogleTV environment.

There is an IRC channel on irc.freenode.net #googletv or visit on your gtv at [http://webchat.freenode.net freenode webchat]

People working on the project include but not limited to
*AgentHH
*cj_000
*craigdroid
*[http://www.twitter.com/dcplaya dcplaya]
*tdweng
*zenofex

''If I am missing anyone, please add them''

We would also like to thank [http://www.resnodesigns.com resno] for providing webhosting.

Logitech Revue Technical

2010-12-29T06:29:20Z

Dcplaya: /* Specs */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:27:35Z

Dcplaya: /* Specs */ added direct link to higher res link of motherboard

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge Motherboard].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:22:36Z

Dcplaya: /* Specs */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:19:54Z

Dcplaya: /* Specs */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:16:56Z

Dcplaya: /* Usage */ removed resistance

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T06:10:33Z

Dcplaya: /* Flash Layout */ formatting

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T05:56:38Z

Dcplaya: /* Usage */ added info to the pic usage

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
*System reboot/powerdown
*Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Exploitee.rs:About

2010-12-29T05:53:32Z

Dcplaya: added current contributors in alphabetical order

We are a group of people who are interested in getting full access to the GoogleTV environment.

There is an IRC channel on Freenode, #googletv

People working on the project include but not limited to
*AgentHH
*cj_000
*craigdroid
*dcplaya
*tdweng
*zenofex

''If I am missing anyone, please add them''

Logitech Revue Technical

2010-12-29T05:44:08Z

Dcplaya: /* PIC Access */ added pic pinout

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T05:40:23Z

Dcplaya: /* Available Pinouts */ added a pdf for info on XDP

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]

Logitech Revue Technical

2010-12-29T05:34:18Z

Dcplaya: /* Available Pinouts */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably
*XDP1 --> Possibly a Intel XDP Debug Adapter

Logitech Revue Technical

2010-12-29T05:33:13Z

Dcplaya: /* Available Pinouts */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Push Button Switch (Use is unknown)
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably

Logitech Revue Technical

2010-12-29T05:32:18Z

Dcplaya: /* Available Pinouts */

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Unknown
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)
*J13 --> Power for another fan probably

Logitech Revue Technical

2010-12-29T05:30:16Z

Dcplaya: Added pinout info

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

== Available Pinouts ==
*UART1 --> Uart Pinout
*J3 --> PIC Chip Access
*SW1 --> Unknown
*J20 --> Unknown (May be JTAG)
*J69 --> USB Pinout
*SATA1 --> SATA pinout (may have power included, needs verification)
*J24 --> Unknown (may be power for SATA)

Logitech Revue Technical

2010-12-29T05:24:09Z

Dcplaya: /* Usage */ Added what I think the IDT ICS chip does

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU
*Provides a clock and resistance for the Intel Atom CPU

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

Logitech Revue Technical

2010-12-29T05:22:04Z

Dcplaya: /* Specs */ Added the IDT ICS chip

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

Silicon Image Sil9135 HDMI 1.3 Receiver
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
*Supports DTS even though the Revue does not (An update can probably enable this feature)

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx
[[Pasted Locally]]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]

== Updates ==
The updates contain a subset of update files, a boot.img and a recovery.img

'''boot.img & recovery.img'''

The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

'''Odex files'''

The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]

Logitech Revue Technical

2010-12-29T05:15:33Z

Dcplaya: /* Usage */

Logitech Revue Technical

2010-12-29T05:11:57Z

Dcplaya: /* Specs */ Realtek datasheet added

Logitech Revue Technical

2010-12-29T05:09:53Z

Dcplaya: /* Specs */ added the Phison chip

Logitech Revue Technical

2010-12-29T05:07:46Z

Dcplaya: /* Specs */ Added a bunch of datasheet links

Logitech Revue Technical

2010-12-29T04:44:43Z

Dcplaya: /* Specs */ added datsheet for the samsung chip

Logitech Revue Technical

2010-12-29T02:30:05Z

Dcplaya: /* PIC Access */ updated the hex dump so it points to the googletv pastebin

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM)
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8)
*Realtek Semiconductor RTL8201N 10/100M PHYceiver
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
#You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

Serial output

via: http://googletv.pastebin.com/233dZqZx

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump]

Exploitee.rs:About

2010-12-29T02:23:21Z

Dcplaya: Created page with "We are a group of people who are interested in getting full access to the GoogleTV environment. There is an IRC channel on Freenode, #googletv"

We are a group of people who are interested in getting full access to the GoogleTV environment.

There is an IRC channel on Freenode, #googletv

Logitech Revue Technical

2010-12-29T01:59:11Z

Dcplaya: Added info about PIC pinout/access

== Specs ==
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM)
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Silicon Image Sil9135 HDMI 1.3 Receiver
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8)
*Realtek Semiconductor RTL8201N 10/100M PHYceiver
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller

The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].

== Usage ==
Samsung K9F8G08U0M 1 GB NAND Flash
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard

== Update Procedure ==

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.

Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.

You can then update the box, with a newer update. Downgrading fails however due to a date check.

== Firmware Links ==

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

== Flash Layout ==

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":
*0x00000000-0x00200000 : "mbr"
*0x00200000-0x00a00000 : "cefdk"
*0x00a00000-0x00c00000 : "redboot"
*0x00c00000-0x00e00000 : "cefdk-config"
*0x01000000-0x01800000 : "splash"
*0x01800000-0x01900000 : "fts"
*0x01900000-0x02d00000 : "recovery"
*0x02d00000-0x03200000 : "kernel"
*0x03200000-0x07200000 : "boot"
*0x07200000-0x1f200000 : "system"
*0x1f200000-0x3fa00000 : "data"
*0x3fa00000-0x3ff00000 : "keystore"
*0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format

== Serial Output ==

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

[http://i.imgur.com/xJHay.jpg UART Pinout]

== PIC Access ==
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.

[http://dl.dropbox.com/u/217678/pic_dump.hex.txt PIC Hex Dump]