Exploitee.rs - User contributions [en]

GTV FileSystem

2011-01-22T22:26:51Z

Jbjonesjr:

The Google TV File System is similar to most other Android Operating Systems.

== Still Needs ==
* Finishing merging update information from the [[ Logitech_Revue_Technical]] page including proper truncation and hex editting steps. also mentions odex.
* Description of how the Update Signing process works and how it works (And why we can't just copy an edited zip to a usb key and root the box). This is a common noob question.
* Description of the seperation between the boot loader steps, recovery kernel, and the actual "device" file system/kernel. This can be key for explaining how the UART1 console was used and when it was used. There is often discussion on "I was looking for output during X boot stage" that this data could provide a definition for.

== File System Layout ==

The File System is created by the mounting of 13 partitions into a *nix-based file system.

Below is a list of the paritions, their contents, and their mount points:
{| border="1"
| Identifier?
| Partition Name
| Description
| Mount Point
|-
|0x00000000-0x00200000
| "mbr"
| Mostly blank, repeats "01c0000 b00b dead 000f a901 0000 0000 0000 0000"
|
|-
| 0x00200000-0x00a00000
| "cefdk"
| Boot loader. It's Data - Wouldn't say it is encrypted, but no strings visible. It may contain a console
|
|-
| 0x00a00000-0x00c00000
| "redboot"
| All FF's
|
|-
| 0x00c00000-0x00e00000
| "cefdk-config"
| Holds Box SN, repeats (like MBR)
|
|-
| 0x01000000-0x01800000
| "splash"
| Splash image, [ http://img413.imageshack.us/img413/3144/splashc.png visible here] . It reports itself as a BMP even though it is a PNG
|
|-
| 0x01800000-0x01900000
| "fts"
| Flash Transaction Key/Value Storage. (Contents seem to be just seems to be just: "F*TS..e.L.......bootloader.command=boot-recovery.bootloader.recovery=recovery.--wipe_data.")
|
|-
| 0x01900000-0x02d00000
| "recovery"
| Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu
|
|-
| 0x02d00000-0x03200000
| "kernel"
| The kernel image
|
|-
| 0x03200000-0x07200000
| "boot"
| Root partition, goes in hand with the kernel image, also in squashfs format
|
|-
| 0x07200000-0x1f200000
| "system"
| Holds most of the crucial system files (including the Kernel). It's YAFFS
| /system
|-
| 0x1f200000-0x3fa00000
| "data"
| Where user data is stored. YAFFS
|
|-
| 0x3fa00000-0x3ff00000
| "keystore"
| Don't delete this . Has Keys for communication w/ Google & Logitech YAFFS
|
|-
| 0x3ff00000-0x40000000
| "bbt"
| Bad Block Table
|
|}
Sources:
* MTD Parition listing came from [http://googletv.pastebin.com/233dZqZx Revue Boot Output]. ([http://my.safaribooksonline.com/book/operating-systems-and-server-administration/embedded-linux/0136130550/mtd-subsystem/ch10lev1sec3 What's an MTD partition?])<br/>
* Partition mount points came from /init.rc & init.<board>.rc
== Kernel ==
Information on the Kernel can be found at [[Logitech Revue Kernel]]. Important to note that the Revue Kernel has been modified from what is available in the Google Open Sourced GTV Source.
== Updates ==
Updates to the Google TV, unlike the incremental updates that most Android phones receive, come as a complete file system meant to replace the previous. It is assumed that since Google TV devices are meant to be connected to high speed internet connections, downloading a full File System is more palatable than on a limited-bandwidth mobile device.

The Google TV software uses the [[com.google.android.systemupdater]] activity to periodically query Google's servers looking for available updates based on the devices serial number. Under normal circumstances, during initial setup of a device (i.e. configuring from a wiped or factory default state), the [[com.google.android.systemupdater]] activity will prevent completion of first time setup until any available updates have been downloaded and applied. This can be bypassed by removing the files /system/app/SystemUpdater.{apk,odex} from the file system. If a previously configured device finds an available update at boot, it will display a prompt asking the user if they wish to install or defer the update. If the system is not in use at this time, the update will be applied without user interaction. Based on network traffic it appears that the Logitech Revue is configured to check for updates in the early AM hours. The currently installed build number can be checked through '''Applications > Settings > About'''. (See [[GoogleTV - Version Numbers]] for more information). Updates are distributed as signed zip files including [[boot.img]], [[kernel.img]], [[ota.prop]], updated content, and meta-information (signing data, install scripts, etc).

Until a new recovery image with is prepared for Google TV devices, it is unlikely that anyone will be able to prepare homebrew updates since it is computationally infeasible to produce signatures matching Google's private key. This same logic applies when considering modification of a properly signed update.

List of all updates for:
*[[LogitechRevueUpdates|Logitech Revue]]

The Updates each include:
* boot.img: A file system including the root file system for the device.<
* The "system" folder: This is the guts of the Google TV and it's applications. These files are copied into the system folder on update.
* META-INF directory: Includes the manifest and other certificates shipped with the device for authentication.

== File System Obfusication ==

== How to access the File System contained within an image ==
The Zip File is a simple matter to extract, however the images within them tack some massaging in order to explore. While they are a typical SquashFS File System, they have some padding bytes that prevented a simple "Unsquashing."

*It would be great if we could create a way to use dd to truncate the image instead of using a hex editor. You should be able ot somehow grep for the start and then dd the proper bits into a new file that could be explored correctly.*

Some data on the process is available here:
http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack,_Edit,_and_Re-Pack_Boot_Images

== GTV Recovery Mode vs GTV(System) Mode ==

== GTV Boot Loader ==
The Boot Loader is included on the File System, currently in the X directory. The Boot Loader is based off of the Y Loader (More information can be found at Z).
For the Sony BlueRay player, the Boot Loader is ABC.

== Files of interest within the File System ==

[[Category:Contribute]]

Revue Update b42732

2011-01-14T09:19:09Z

Jbjonesjr:

This page describes update b42732 for the Logitech Revue, first appearing on 1/12/2010.

===Update Official Release Notes ===
Purpose: Security Updates per [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-January-11-2011/td-p/557792 Logitech Release]

=== Build Properties Diff ===
<pre>
3,5c3,5
< ro.build.id=KA1X-20101208.224639
< ro.build.display.id=KA1X-20101208.224639.user-b42449
< ro.build.version.incremental=user-b42449
---
> ro.build.id=KA1X-20101215.164651
> ro.build.display.id=KA1X-20101215.164651.user-b42732
> ro.build.version.incremental=user-b42732
9,10c9,10
< ro.build.date=Wed Dec 8 22:47:18 MST 2010
< ro.build.date.utc=1291873638
---
> ro.build.date=Wed Dec 15 16:47:55 MST 2010
> ro.build.date.utc=1292456875
29,30c29,30
< ro.build.description=ka-user 2.1-update1 KA1X-20101208.224639 user-b42449 release-keys
< ro.build.fingerprint=logitech/ka/ka/:2.1-update1/KA1X-20101208.224639/user-b42449:user/release-keys
---
> ro.build.description=ka-user 2.1-update1 KA1X-20101215.164651 user-b42732 release-keys
> ro.build.fingerprint=logitech/ka/ka/:2.1-update1/KA1X-20101215.164651/user-b42732:user/release-keys
</pre>

===Update Changeset===

*Plaintext Files:*
META-INF/CERT.SF

META-INF/MANIFEST.MF

Binary (or JAR) files:

=== Differences of note ===

system/bin/create_fses
<pre>
11,12c11,12
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2
16,17c16,17
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2
21,22c21,22
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2
</pre>

===Libraries to inspect ===

===How to dump libraries ===
objdump -Sdl libname.so > libname.so.dumpc99'
'objdump -Sdl libname.so.dump950
then start diffing the dumps for internal library changes

=== Inspection Results ===
*keep in mind however that checksums can change without a functional change just due to a different build system being used*
libprotobuf.so - Changes: [ http://dl.dropbox.com/u/1886948/updates.diff ]

[[Category:Logitech Revue]]
[[Category:Contribute]]

Revue Update b42732

2011-01-14T08:59:37Z

Jbjonesjr:

This page describes update b42732 for the Logitech Revue, first appearing on 1/12/2010.

===Update Official Release Notes ===
Purpose: Security Updates per [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-January-11-2011/td-p/557792 Logitech Release]

=== Build Properties Diff ===
3,5c3,5
< ro.build.id=KA1X-20101208.224639
< ro.build.display.id=KA1X-20101208.224639.user-b42449
< ro.build.version.incremental=user-b42449
---
> ro.build.id=KA1X-20101215.164651
> ro.build.display.id=KA1X-20101215.164651.user-b42732
> ro.build.version.incremental=user-b42732
9,10c9,10
< ro.build.date=Wed Dec 8 22:47:18 MST 2010
< ro.build.date.utc=1291873638
---
> ro.build.date=Wed Dec 15 16:47:55 MST 2010
> ro.build.date.utc=1292456875
29,30c29,30
< ro.build.description=ka-user 2.1-update1 KA1X-20101208.224639 user-b42449 release-keys
< ro.build.fingerprint=logitech/ka/ka/:2.1-update1/KA1X-20101208.224639/user-b42449:user/release-keys
---
> ro.build.description=ka-user 2.1-update1 KA1X-20101215.164651 user-b42732 release-keys
> ro.build.fingerprint=logitech/ka/ka/:2.1-update1/KA1X-20101215.164651/user-b42732:user/release-keys

===Update Changeset===

Plaintext Files:
META-INF/CERT.SF
META-INF/MANIFEST.MF

system/bin/create_fses
11,12c11,12
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2
16,17c16,17
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2
21,22c21,22
< CACHE_PARTITION=/dev/sda1
< CHROME_PARTITION=/dev/sda2
---
> CACHE_PARTITION=/dev/disk/by-topology/internal-usb0-part1
> CHROME_PARTITION=/dev/disk/by-topology/internal-usb0-part2

Binary (or JAR) files:

=== Differences ===

===Libraries to inspect ===

===How to dump libraries ===
objdump -Sdl libname.so > libname.so.dumpc99'
'objdump -Sdl libname.so.dump950
then start diffing the dumps for internal library changes

=== Inspection Results ===
*keep in mind however that checksums can change without a functional change just due to a different build system being used*
libprotobuf.so - Changes: [ http://dl.dropbox.com/u/1886948/updates.diff ]

[[Category:Logitech Revue]]
[[Category:Contribute]]

Want to Help?

2011-01-13T18:57:21Z

Jbjonesjr:

While root access to the Revue was gained by the BreakVue hack, the gtvhacker team is not done. Below are a list of information that we are trying to enhance in our quest for a pure software-only access. As always, check into the irc room (channel #gtvhacker) if you have questions or need assitance.

===General Information===
We are still looking for documentation support on all things Google TV.
* From the file system layout (See [[GTV_FileSystem]])
* To user interactions (Commands & Buttons & Controls)

Anything you've found out about GoogleTV, feel free to include as well.
===Updates===
Catalog as much info about the updates as possible. Information about the specific updates can be provided on the appropriate version-specific pages. These pages and more can be found at [[GoogleTV_-_Version_Numbers]].
* What are the differences in files from update to update (which are new, which are missing)
* What changed in the files that were present before.
* List changed APKS and their use.
* work on decrypting the sony updates (afaik qualis doesn't have a box)

===Binaries===
Better annotate the binaries and information they provide.
* debug/analysis certain binaries
* A public analysis of all the binaries in each update could be useful

[[Category:Logitech Revue]]

Revue Update b42732

2011-01-13T18:48:26Z

Jbjonesjr:

GoogleTV - Version Numbers

2011-01-13T18:47:07Z

Jbjonesjr:

Google TV Version numbers are unique per device.

== How to determine my Version Number ==

== Known Released Version Numbers ==
=== Logitech Revue ===
{| border="1" cellspacing="0"
! Version number
! ID
! Date first seen
! Update link
! Announcement
|-
| [[ Revue Update b39389 | b39389 ]]
|
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip
|
|-
| [[ Revue Update b39953| b39953]]
|
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip
|
|-
| [[ Revue Update b42449| b42449]]
| 2.1-Update1
| 12-15-10
| http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-December-15-2010/td-p/537980 Logitech Forums]
|-
| [[ Revue Update b42732 | b42732]]
| 2.1-Update1
| 01-12-11
| http://android.clients.google.com/packages/ota/logitech_ka/9504d579bade.mp-signed-ota_update-b42732.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-January-11-2011/td-p/557792 Logitech Forums]
|}

=== Sony Blue Ray Player X ===
{| border="1" cellspacing="0"
! Version number
! ID
! Date first seen
! Update link
! Announcement
|-
| [[ Sony Update 164108| 164108]]
| 2.1-update1
| 01-10-11
| ogm_2.1_2010121503ON.164108
|
|}

=== Sony GoogleTV X===
== Known Development/Beta Vesion Numbers ==

== Core GoogleTV Versions ==
These Version Numbers relate to GoogleTV Versions, which may or may not see release to the individual devices. Think of the difference between ASOP releases and device-specific releases.

[[Category:Logitech Revue]]

LogitechRevueUpdates

2011-01-13T18:44:15Z

Jbjonesjr: Removed version information and left a pointer to the full version page

Logitech Revue Version information and Update information has been moved to the [[GoogleTV_-_Version_Numbers | Google TV Version page]].
{{Revue toc Inline}}

[[Category:Logitech Revue]]

Want to Help?

2011-01-13T18:42:39Z

Jbjonesjr: Major cleanup including some priorities and pointers

While root access to the Revue was gained by the BreakVue hack, the gtvhacker team is not done. Below are a list of information that we are trying to enhance in our quest for a pure software-only access. As always, check into the irc room (channel #gtvhacker) if you have questions or need assitance.

===Updates===
Catalog as much info about the updates as possible. Information about the specific updates can be provided on the appropriate version-specific pages. These pages and more can be found at [[GoogleTV_-_Version_Numbers]].
* What are the differences in files from update to update (which are new, which are missing)
* What changed in the files that were present before.
* List changed APKS and their use.
* work on decrypting the sony updates (afaik qualis doesn't have a box)

===Binaries===
Better annotate the binaries and information they provide.
* debug/analysis certain binaries
* A public analysis of all the binaries in each update could be useful

GoogleTV - Version Numbers

2011-01-13T18:38:43Z

Jbjonesjr:

Google TV Version numbers are unique per device.

== How to determine my Version Number ==

== Known Released Version Numbers ==
=== Logitech Revue ===
{| border="1" cellspacing="0"
! Version number
! Date first seen
! Update link
! Announcement
|-
| [[ Revue Update b39389 | b39389 ]]
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip
|
|-
| [[ Revue Update b39953| b39953]]
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip
|
|-
| [[ Revue Update b42449| b42449]]
| 12-15-10
| http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-December-15-2010/td-p/537980 Logitech Forums]
|-
| [[ Revue Update b42732 | b42732]]
| 01-12-11
| http://android.clients.google.com/packages/ota/logitech_ka/9504d579bade.mp-signed-ota_update-b42732.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-January-11-2011/td-p/557792 Logitech Forums]
|}

=== Sony Blue Ray Player X ===
{| border="1" cellspacing="0"
! Version number
! Date first seen
! Update link
! Announcement
|-
| [[ Sony Update 164108| 2.1-update1 : 164108]]
| 01-10-11
| ogm_2.1_2010121503ON.164108
|
|}

=== Sony GoogleTV X===
== Known Development/Beta Vesion Numbers ==

== Core GoogleTV Versions ==
These Version Numbers relate to GoogleTV Versions, which may or may not see release to the individual devices. Think of the difference between ASOP releases and device-specific releases.

[[Category:Logitech Revue]]

Revue Update b42732

2011-01-13T17:42:47Z

Jbjonesjr: Created page with "This page describes update b42732 for the Logitech Revue, first appearing on 1/12/2010. ===Update Official Release Notes === Purpose: Security Updates per [http://forums.logitec..."

LogitechRevueUpdates

2011-01-13T17:31:45Z

Jbjonesjr:

List of current Logitech Revue updates
{{Revue toc Inline}}
{| border="1" cellspacing="0"
! Version number
! Date first seen
! Update link
! Announcement
|-
| [[ Revue Update b42732 | b39389 ]]
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip
|
|-
| [[ Revue Update b42732 | b39953]]
| unknown
| http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip
|
|-
| [[ Revue Update b42732 | b42449]]
| 12-15-10
| http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-December-15-2010/td-p/537980 Logitech Forums]
|-
| [[ Revue Update b42732 | b42732]]
| 01-12-11
| http://android.clients.google.com/packages/ota/logitech_ka/9504d579bade.mp-signed-ota_update-b42732.zip
| [http://forums.logitech.com/t5/Revue-Product-Updates-Release/Revue-amp-Google-TV-Update-January-11-2011/td-p/557792 Logitech Forums]
|}

[[Category:Logitech Revue]]

Talk:LogitechRevueUpdates

2011-01-13T17:27:28Z

Jbjonesjr:

Might be nice to create a wiki page for an individual update if it contained useful information worth talking about. I know last night when people in the irc channel were working to dissect the update and see if it could harm the rooted boxes, a good amount of research and learning was done about it that could be of use to the community. My goal is that when one person spends time figuring something out or learning, everyone else should have a shortcut from doing that work... -01/13/2010 jbjonesjr

yep, sounds like a good idea. discussed in irc on 1/13 am and agreed upon

2011-01-07T19:13:58Z

Jbjonesjr: Created page with "While the root was gained by the BreakVue hack on the Logitech Revue, the gtvhacker team is not done. If you want to help, you can try your hand at any of the outstanding issues..."

Main Page/Devices

2011-01-05T20:51:38Z

Jbjonesjr:

<p style="font-size:150%; padding:10px;">Rooted Devices </p>
''Logitech Revue has root. [[Steps to get root ]]''
<div>

<p style="font-size:140%; padding:10px;">Current Google Devices </p>
<div id="logitech_section">
[[File:Revue-advert.gif|180px]]
[[Logitech Revue Hardware]] -- [[Logitech Revue Technical]]
</div>
<div id="sony_section">
[[File:Sony_NSX-40GT1.jpg|180px]]
[[Sony NSX-40GT1 (Internet TV)]]

[[Sony NSZ-GT1 (Bluray Player)]]
</div>
<p style="font-size:140%; padding:10px;">Upcoming Google Devices </p>
<div id="vizio_section">
''Vizio''
</div>

Main Page/Devices

2011-01-05T20:44:09Z

Jbjonesjr:

<p style="font-size:150%; padding:10px;">Rooted Devices </p>
''Logitech Revue has root. [[Steps to get root ]]''
<div>

<p style="font-size:140%; padding:10px;">Current Google Devices </p>
<div id="logitech_section">
[[File:Revue-advert.gif|180px]]
[[Logitech Revue Hardware]] -- [[Logitech Revue Technical]]
</div>
<div id="sony_section">
[[Sony NSX-40GT1 (Internet TV)]]

[[Sony NSZ-GT1 (Bluray Player)]]
</div>
<p style="font-size:140%; padding:10px;">Upcoming Google Devices </p>
<div id="vizio_section">
''Vizio''
</div>

Main Page/Devices

2011-01-05T20:43:41Z

Jbjonesjr:

<p style="font-size:150%; padding:10px;">Rooted Devices </p>
''Logitech Revue has root. [[Steps to get root ]]''
<div>

<p style="font-size:140%; padding:10px;">Current Google Devices </p>
<div id="logitech_section">
[[File:Revue-advert.gif|180px]]
[[Logitech Revue Hardware]] -- [[Logitech Revue Technical]]
</div>
<div id="sony_section">
[[Sony NSX-40GT1 (Internet TV)]]

[[Sony NSZ-GT1 (Bluray Player)]]
</div>
<p style="font-size:140%; padding:10px;">Upcoming Google Devices </p>
<div id="vizio_section">
''Vizio''
</div>