Exploitee.rs - User contributions [en]

Steam Link

2019-06-11T21:36:22Z

Parkerlreed: WiFi

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''WiFi:''' Marvell 88W8897
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Photos ==

[[File:Link PCB top.jpg|700px|frameless]]

[[File:Link PCB bottom.jpg|700px|frameless]]

== Information & Root Method ==

'''Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.
'''

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #60 PREEMPT Mon Dec 12 11:24:32 PST 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.43
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 246.2M 777.8M 24% /
none 131.4M 8.0K 131.4M 0% /dev
devtmpfs 131.4M 8.0K 131.4M 0% /dev
tmpfs 131.4M 20.0K 131.4M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 785.5M 1.1G 41% /mnt/scratch
/dev/block/mtdblock3 512.0M 26.5M 485.5M 5% /mnt/config
unionfs 512.0M 26.5M 485.5M 5% /etc
unionfs 512.0M 26.5M 485.5M 5% /var
unionfs 512.0M 26.5M 485.5M 5% /home/steam
unionfs 512.0M 26.5M 485.5M 5% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
/dev/loop0 975.9M 207.6M 717.1M 22% /home/apps
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home/steam type unionfs (rw,relatime,dirs=/mnt/config/overlay/home/steam=rw:/home/steam=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
/dev/loop0 on /home/apps type ext4 (rw,relatime,data=ordered)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

== Compiling native applications ==

This can be a little tricky at times but is very fun when you get something running.

For best results look for a program using pure SDL2 for video/input handling (Bonus points if it uses the CMake compiling system). External libs are possible (you have to compile them, copy over the include files to the rootfs directory, and then when you package up a program include the .so files to use in an LD_PRELOAD)

Starting out is fairly straight forward

<nowiki>
git clone https://github.com/ValveSoftware/steamlink-sdk
cd steamlink-sdk/examples
</nowiki>

From here you can check out the included example applications and their respective build scripts. If we want to experiment with our own:

<nowiki>
git clone somesource
cd somesource
</nowiki>

First I'll cover a CMake project because these provide the best results (because of the included toolchain definition file)

<nowiki>
source ../../setenv.sh
mkdir build
cd build
cmake -DCMAKE_TOOLCHAIN_FILE=../../../toolchain/steamlink-toolchain.cmake ../
</nowiki>

If all goes well it should find any needed libraries and create the Makefile for you. (If it needs any other external libraries a quick rundown is to repeat the same steps as above to grab the source, hope it compiles, and copy over the include files to the rootfs/usr/include directory in the steamlink-sdk repo folder. This isn't guaranteed to work so your mileage may vary.)

Then you just compile it.

<nowiki>
make -j4
</nowiki>

For regular source installations (typical automake/Makefile) it can be a hit or miss whether compilation will work or not. The gist of it is:

<nowiki>
./automake #If needed
./configure --host=armv7a-cros-linux-gnueabi #and any other needed arguments
make -j4 #and pray...
</nowiki>

Once you end up with a compiled binary, you can scp it over to the Link and try to run it. If you had to compile any external libs (.so) be sure to include them in the transfer and use LD_PRELOAD=./ ./binaryname to test.

If everything went ok and the binary runs as expected and you are happy with the results, packaging it up for a USB install is dead simple

Create a folder named whatever you want (I typically use the program name all lowercase), and create these files in said folder as follows.

<nowiki>
toc.txt
name=Whatever # This is what shows in the launcher
icon=whatever-icon.png
run=binary # Or a script name if you need to LD_PRELOAD. Just make sure the binary/script are executable for this line to work

whatever-icon.png # I haven't found exact specifications for this but I typically do a 128x128 icon

binary # Main program

binary-launch.sh # Only needed if you want to preload/pass special arguments
#!/bin/sh
LD_PRELOAD=./ ./binary

And any data files needed for it to run
</nowiki>

Next just back up a directory and tar up the folder

<nowiki>
tar zcvf programname.tgz foldername
</nowiki>

Now if you want to install this on the Link just copy that tgz to a flash drive at USB:/steamlink/apps/ and boot the Link with the drive plugged in. It will extract it and then boot to the launcher.

Steam Link

2017-11-27T19:35:08Z

Parkerlreed: PCB photos

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Photos ==

[[File:Link PCB top.jpg|700px|frameless]]

[[File:Link PCB bottom.jpg|700px|frameless]]

== Information & Root Method ==

'''Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.
'''

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #60 PREEMPT Mon Dec 12 11:24:32 PST 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.43
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 246.2M 777.8M 24% /
none 131.4M 8.0K 131.4M 0% /dev
devtmpfs 131.4M 8.0K 131.4M 0% /dev
tmpfs 131.4M 20.0K 131.4M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 785.5M 1.1G 41% /mnt/scratch
/dev/block/mtdblock3 512.0M 26.5M 485.5M 5% /mnt/config
unionfs 512.0M 26.5M 485.5M 5% /etc
unionfs 512.0M 26.5M 485.5M 5% /var
unionfs 512.0M 26.5M 485.5M 5% /home/steam
unionfs 512.0M 26.5M 485.5M 5% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
/dev/loop0 975.9M 207.6M 717.1M 22% /home/apps
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home/steam type unionfs (rw,relatime,dirs=/mnt/config/overlay/home/steam=rw:/home/steam=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
/dev/loop0 on /home/apps type ext4 (rw,relatime,data=ordered)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

== Compiling native applications ==

This can be a little tricky at times but is very fun when you get something running.

For best results look for a program using pure SDL2 for video/input handling (Bonus points if it uses the CMake compiling system). External libs are possible (you have to compile them, copy over the include files to the rootfs directory, and then when you package up a program include the .so files to use in an LD_PRELOAD)

Starting out is fairly straight forward

<nowiki>
git clone https://github.com/ValveSoftware/steamlink-sdk
cd steamlink-sdk/examples
</nowiki>

From here you can check out the included example applications and their respective build scripts. If we want to experiment with our own:

<nowiki>
git clone somesource
cd somesource
</nowiki>

First I'll cover a CMake project because these provide the best results (because of the included toolchain definition file)

<nowiki>
source ../../setenv.sh
mkdir build
cd build
cmake -DCMAKE_TOOLCHAIN_FILE=../../../toolchain/steamlink-toolchain.cmake ../
</nowiki>

If all goes well it should find any needed libraries and create the Makefile for you. (If it needs any other external libraries a quick rundown is to repeat the same steps as above to grab the source, hope it compiles, and copy over the include files to the rootfs/usr/include directory in the steamlink-sdk repo folder. This isn't guaranteed to work so your mileage may vary.)

Then you just compile it.

<nowiki>
make -j4
</nowiki>

For regular source installations (typical automake/Makefile) it can be a hit or miss whether compilation will work or not. The gist of it is:

<nowiki>
./automake #If needed
./configure --host=armv7a-cros-linux-gnueabi #and any other needed arguments
make -j4 #and pray...
</nowiki>

Once you end up with a compiled binary, you can scp it over to the Link and try to run it. If you had to compile any external libs (.so) be sure to include them in the transfer and use LD_PRELOAD=./ ./binaryname to test.

If everything went ok and the binary runs as expected and you are happy with the results, packaging it up for a USB install is dead simple

Create a folder named whatever you want (I typically use the program name all lowercase), and create these files in said folder as follows.

<nowiki>
toc.txt
name=Whatever # This is what shows in the launcher
icon=whatever-icon.png
run=binary # Or a script name if you need to LD_PRELOAD. Just make sure the binary/script are executable for this line to work

whatever-icon.png # I haven't found exact specifications for this but I typically do a 128x128 icon

binary # Main program

binary-launch.sh # Only needed if you want to preload/pass special arguments
#!/bin/sh
LD_PRELOAD=./ ./binary

And any data files needed for it to run
</nowiki>

Next just back up a directory and tar up the folder

<nowiki>
tar zcvf programname.tgz foldername
</nowiki>

Now if you want to install this on the Link just copy that tgz to a flash drive at USB:/steamlink/apps/ and boot the Link with the drive plugged in. It will extract it and then boot to the launcher.

File:Link PCB top.jpg

2017-11-27T19:30:05Z

Parkerlreed:

File:Link PCB bottom.jpg

2017-11-27T19:28:46Z

Parkerlreed:

Asus OnHub

2017-05-02T21:10:46Z

Parkerlreed: /* Videos */ New videos

__FORCETOC__
{{Disclaimer}}
[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 19V/1.75A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Videos==

{{#ev:youtube|7AigwDG2ZnU}}
{{#ev:youtube|KtFOhOX0Qjw}}
{{#ev:youtube|q4ReZbn1eaQ}}
{{#ev:youtube|W3z7ZrDOfjw}}
{{#ev:youtube|sFbH24gQWVs}}
{{#ev:youtube|k09NHiPKgD0}}
{{#ev:youtube|0aaXVDRhiVk}}
{{#ev:youtube|CuxuIJbSsz8}}

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

Asus OnHub

2017-01-12T06:22:27Z

Parkerlreed: New video

__FORCETOC__
{{Disclaimer}}
[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 19V/1.75A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Videos==

{{#ev:youtube|7AigwDG2ZnU}}
{{#ev:youtube|KtFOhOX0Qjw}}
{{#ev:youtube|q4ReZbn1eaQ}}
{{#ev:youtube|W3z7ZrDOfjw}}
{{#ev:youtube|sFbH24gQWVs}}
{{#ev:youtube|k09NHiPKgD0}}

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

Asus OnHub

2017-01-12T04:16:34Z

Parkerlreed: Voltage

__FORCETOC__
{{Disclaimer}}
[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 19V/1.75A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Videos==

{{#ev:youtube|KtFOhOX0Qjw}}
{{#ev:youtube|q4ReZbn1eaQ}}
{{#ev:youtube|W3z7ZrDOfjw}}
{{#ev:youtube|sFbH24gQWVs}}
{{#ev:youtube|k09NHiPKgD0}}

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

Asus OnHub

2017-01-12T04:14:22Z

Parkerlreed: Videos

__FORCETOC__
{{Disclaimer}}
[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 12V/3A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Videos==

{{#ev:youtube|KtFOhOX0Qjw}}
{{#ev:youtube|q4ReZbn1eaQ}}
{{#ev:youtube|W3z7ZrDOfjw}}
{{#ev:youtube|sFbH24gQWVs}}
{{#ev:youtube|k09NHiPKgD0}}

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

Asus OnHub

2017-01-12T04:11:27Z

Parkerlreed:

__FORCETOC__
{{Disclaimer}}
[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 12V/3A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

Asus OnHub

2017-01-12T03:54:46Z

Parkerlreed: Initial page. Many things need to be cleaned up but should be a good starting point.

[[File:ASUS-Google-OnHub.jpg|200px|thumb]]

==Information==
* '''Name:''' Asus OnHub
* '''Manufacturer:''' Asus
* '''Firmware Version:''' 8872.40.14
* '''Project code name:''' Arkham
* '''Board name:''' arkham
* '''Base board:''' storm

The router runs a version of ChromeOS.

==Hardware Specs==

These are the specs from the TP-Link and as far as I'm aware most if not all of the hardware is the same. Will update as I learn more.

* WiSoC – Qualcomm Atheros IPQ8064 dual core Krait processor @ 1.4 GHz
* System Memory – 1GB DDR3L
* Storage – 4GB eMMC, 8MB NOR flash
* Connectivity
** 802.11 b/g/n 3×3 with smart antenna
** 802.11 a/n/ac 3×3 with smart antenna
** AUX wireless (802.11 a/b/g/n/ac 1×1)
** 10/100/1000M Mbps WAN and LAN port (QCA9337 Gigabit switch)
** Compatible with Zigbee/Thread , Bluetooth 4.0
** Wireless Security – WPA2-PSK
** 13 antennas in total
** Supports up to 128 devices over WiFi
* USB – 1x USB 3.0
* Audio – 3W Speaker
* Security – Infineon SLB 9615 Trusted Platform Module
* Misc – 6x tri-color array LEDs, ambient light sensor
* Power Supply – 12V/3A DC, 100-240V 50-60Hz AC
* Dimensions – 19.05 cm (H) x 11.68 cm (⌀)
* Weight – 860 grams

===Board Chipset===
* Qualcomm Atheros IPQ8064 Internet Processor with 2 Krait 300 CPUs clocked at 1.4 GHz
* Micron MT41K256M16HA 4 Gb DDR3L SDRAM
* Qualcomm Atheros QCA8337
* Qualcomm Atheros QCA9882
* Qualcomm Atheros QCA9880
* Silicon Labs EM3581 SOC network co-processor for ZigBee
* Skyworks 66109 2.4 GHz ZigBee/Smart Energy front-end module
* Skyworks SKY2623L 2.4 GHz WLAN power amplifier
* Skyworks SKY85405 802.11ac 5 GHz WLAN power amplifier
* Atheros 3012-BL3D Bluetooth radio
* Bluetooth antenna
* Micron MTFC4GACAAAM 4 GB NAND flash
* Micron 25Q064A 64 Mb SPI flash
* Infineon SLB9615 Trusted Platform Module

==Configuration==
For the moment it is reported that this router can only be configured from the Android or iOS "Google OnHub" application.

==Pictures==
[[File:ASUS-Google-OnHub-front.jpg|200px]] [[File:HwaUtYb.jpg|200px]]

===Disassembly===

[[File:ASUS-Google-OnHub-bottom.jpg|200px]] [[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

==Root Access==
* [[Rooting The Google OnHub]]

Link above is for the TP-Link. Most of this guide is borrowed from there with a few changes.

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the bottom cover of the router (four screws under the feet)
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (above the USB port)
#Plug the power cable back in
#The LED strip on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" button next to the speaker connection
#The OnHub should then reboot and the LED should start blinking purple
#* This indicates that we have successfully entered the Asus OnHub's "Developer Mode"

At this point make sure to undo the screw here

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

This disables the hardware write protect so we can generate new dev keys.

=== Getting serial access ===

This is the only method I have tried and used for now. I'm sure a USB image could be created but I do no yet fully understand the working there.

Right below the speaker connection and button you just used there is a header with 3 pins. Good news, it's serial! The adapter I used is a generic FTDI board. To make this easier on yourself, get a serial converter with barrel leads already on the wire.

[[File:ASUS-Google-OnHub-screw-and-serial.jpg|200px]]

Top is GND then RX then TX. Wire appropriately. Using your favorite console, set the baud rate to 115200. Power up (if not already) the OnHub and wait for it to boot. If you are already booted just press enter a few times to get the login shell. Default login is root:onhub (I personally used chronos:<no password> as I could then just sudo when needed)

First disable software protection (rest of these commands are in a root shell) and proceed to sign the new dev firmware along with disabling the rootfs verification.

<pre>
# flashrom --wp-disable
# /usr/share/vboot/bin/make_dev_firmware.sh
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 2
# /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0 --partition 4
</pre>

Now here's where it get's slightly tricky but not too bad. Since we are booted into one of the live partitions we have to first modify the unused one, set the unused to to used on next boot, reboot the router, and proceed to modify the one we were in before.

Also you need to grab the following archive and put it on a flash drive https://drive.google.com/open?id=0B2cSlWc2yl7EUW14WXFkWlhfZ1E

Put flash drive in OnHub and run these commands

<pre>
# cd /home/chronos
# mkdir usb roota rootb
# mount /dev/sda1 usb/
</pre>

Now one of these next command will fail. Make note of the partition.

<pre>
# mount /dev/mmcblk0p3 roota/
# mount /dev/mmcblk0p5 rootb/
</pre>

Whichever one didn't fail extract that archive to it

<pre>
# tar xvf usb/files.tar.gz -C rootX/
# chmod 755 rootX/bin/busybox
</pre>

Now we need to reboot into what we just modified (X being that partition number) If this fails it only tries one time so it will boot back if something goes wrong.

<pre>
# cgpt add -i X -P 5 -T 1 -S 0 /dev/mmcblk0
</pre>

Pull the power and make sure to remove the USB drive. Let it boot back up and remount the flash drive and partition you were just in. X here is NOT the one you just used above.

<pre>
# cd /home/chronos
# mount /dev/sda1 usb/
# mount /dev/mmcblk0pX rootX/
# tar xvf usb/files.tar.gz -C rootX/
</pre>

As a final check make sure both partitions contain /bin/busybox and the other files that got extracted.

The TP-Link guide now says to take it out of dev mode but I've just left mine in in case I need to do anything. No harm really. Reboot once more for safe keeping and you should now have a system you can access either via telnet or ssh (Be sure to edit the dropbear.conf file as it hardcodes credentials. There's a fix by using a different binary but I don't have it handy at the moment)

==Links==

===Official Links===
* [https://on.google.com/hub/ Official WebPage]

===Community Links===
* [http://forum.xda-developers.com/onhub Google OnHub at XDADevelopers Forum]
* [https://plus.google.com/communities/105738065696386405857 Google OnHub Google+ Unofficial Community]

===Articles===
* [https://www.ifixit.com/Teardown/OnHub+Teardown/48129 iFixit OnHub Teardown (TP-Link)]

[[Category:Wifi Router]]

File:ASUS-Google-OnHub-screw-and-serial.jpg

2017-01-12T03:14:27Z

Parkerlreed:

File:ASUS-Google-OnHub-bottom.jpg

2017-01-12T03:13:03Z

Parkerlreed:

File:HwaUtYb.jpg

2017-01-12T03:09:51Z

Parkerlreed:

File:ASUS-Google-OnHub-front.jpg

2017-01-12T03:08:47Z

Parkerlreed:

File:ASUS-Google-OnHub.jpg

2017-01-12T03:01:44Z

Parkerlreed:

Steam Link

2017-01-04T01:00:47Z

Parkerlreed: Native applications instructions. Rough cut.

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

'''Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.
'''

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #60 PREEMPT Mon Dec 12 11:24:32 PST 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.43
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 246.2M 777.8M 24% /
none 131.4M 8.0K 131.4M 0% /dev
devtmpfs 131.4M 8.0K 131.4M 0% /dev
tmpfs 131.4M 20.0K 131.4M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 785.5M 1.1G 41% /mnt/scratch
/dev/block/mtdblock3 512.0M 26.5M 485.5M 5% /mnt/config
unionfs 512.0M 26.5M 485.5M 5% /etc
unionfs 512.0M 26.5M 485.5M 5% /var
unionfs 512.0M 26.5M 485.5M 5% /home/steam
unionfs 512.0M 26.5M 485.5M 5% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
/dev/loop0 975.9M 207.6M 717.1M 22% /home/apps
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home/steam type unionfs (rw,relatime,dirs=/mnt/config/overlay/home/steam=rw:/home/steam=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
/dev/loop0 on /home/apps type ext4 (rw,relatime,data=ordered)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

== Compiling native applications ==

This can be a little tricky at times but is very fun when you get something running.

For best results look for a program using pure SDL2 for video/input handling (Bonus points if it uses the CMake compiling system). External libs are possible (you have to compile them, copy over the include files to the rootfs directory, and then when you package up a program include the .so files to use in an LD_PRELOAD)

Starting out is fairly straight forward

<nowiki>
git clone https://github.com/ValveSoftware/steamlink-sdk
cd steamlink-sdk/examples
</nowiki>

From here you can check out the included example applications and their respective build scripts. If we want to experiment with our own:

<nowiki>
git clone somesource
cd somesource
</nowiki>

First I'll cover a CMake project because these provide the best results (because of the included toolchain definition file)

<nowiki>
source ../../setenv.sh
mkdir build
cd build
cmake -DCMAKE_TOOLCHAIN_FILE=../../../toolchain/steamlink-toolchain.cmake ../
</nowiki>

If all goes well it should find any needed libraries and create the Makefile for you. (If it needs any other external libraries a quick rundown is to repeat the same steps as above to grab the source, hope it compiles, and copy over the include files to the rootfs/usr/include directory in the steamlink-sdk repo folder. This isn't guaranteed to work so your mileage may vary.)

Then you just compile it.

<nowiki>
make -j4
</nowiki>

For regular source installations (typical automake/Makefile) it can be a hit or miss whether compilation will work or not. The gist of it is:

<nowiki>
./automake #If needed
./configure --host=armv7a-cros-linux-gnueabi #and any other needed arguments
make -j4 #and pray...
</nowiki>

Once you end up with a compiled binary, you can scp it over to the Link and try to run it. If you had to compile any external libs (.so) be sure to include them in the transfer and use LD_PRELOAD=./ ./binaryname to test.

If everything went ok and the binary runs as expected and you are happy with the results, packaging it up for a USB install is dead simple

Create a folder named whatever you want (I typically use the program name all lowercase), and create these files in said folder as follows.

<nowiki>
toc.txt
name=Whatever # This is what shows in the launcher
icon=whatever-icon.png
run=binary # Or a script name if you need to LD_PRELOAD. Just make sure the binary/script are executable for this line to work

whatever-icon.png # I haven't found exact specifications for this but I typically do a 128x128 icon

binary # Main program

binary-launch.sh # Only needed if you want to preload/pass special arguments
#!/bin/sh
LD_PRELOAD=./ ./binary

And any data files needed for it to run
</nowiki>

Next just back up a directory and tar up the folder

<nowiki>
tar zcvf programname.tgz foldername
</nowiki>

Now if you want to install this on the Link just copy that tgz to a flash drive at USB:/steamlink/apps/ and boot the Link with the drive plugged in. It will extract it and then boot to the launcher.

Steam Link

2017-01-04T00:28:09Z

Parkerlreed: Updated version information as of beta build 576

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

'''Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.
'''

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #60 PREEMPT Mon Dec 12 11:24:32 PST 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.43
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 246.2M 777.8M 24% /
none 131.4M 8.0K 131.4M 0% /dev
devtmpfs 131.4M 8.0K 131.4M 0% /dev
tmpfs 131.4M 20.0K 131.4M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 785.5M 1.1G 41% /mnt/scratch
/dev/block/mtdblock3 512.0M 26.5M 485.5M 5% /mnt/config
unionfs 512.0M 26.5M 485.5M 5% /etc
unionfs 512.0M 26.5M 485.5M 5% /var
unionfs 512.0M 26.5M 485.5M 5% /home/steam
unionfs 512.0M 26.5M 485.5M 5% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
/dev/loop0 975.9M 207.6M 717.1M 22% /home/apps
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home/steam type unionfs (rw,relatime,dirs=/mnt/config/overlay/home/steam=rw:/home/steam=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
/dev/loop0 on /home/apps type ext4 (rw,relatime,data=ordered)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-11-12T21:20:32Z

Parkerlreed: /* Information & Root Method */ Updated info regarding sound handling

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

'''Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.
'''

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-28T17:44:18Z

Parkerlreed:

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the [[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-28T17:44:07Z

Parkerlreed:

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the *[[Google Chromecast]] "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-28T17:42:40Z

Parkerlreed:

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the original Chromecast "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-28T17:26:17Z

Parkerlreed: Seems to share about the same CPU as the OG Chromecast

__FORCETOC__
{{Disclaimer}}
[[File:Steam_Link_back.jpg|300px|thumb]]
[[Category:Steam]]

== About ==
Steam Link is an in-home streaming appliance made by Valve.

== Purchase ==
Support the Exploitee.rs network by using the following link to buy a Steam Link

[https://www.amazon.com/Steam-Link-Pc/dp/B016XBGWAQ/ref=as_li_ss_tl?ie=UTF8&qid=1474479405&sr=8-3&linkCode=ll1&tag=exploiteers-20&linkId=eb981e4052637db63a0770e57e070a74 Steam Link at Amazon]

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the original Chroemcast "MV88DE3100")
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information & Root Method ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-21T14:46:01Z

Parkerlreed:

[[File:Steam_Link_back.jpg|300px|thumb]]

Steam Link is an in-home streaming appliance made by Valve.

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model)
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

File:Steam Link back.jpg

2016-09-21T14:45:09Z

Parkerlreed:

Steam Link

2016-09-21T14:29:58Z

Parkerlreed:

Steam Link is an in-home streaming appliance made by Valve.

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model)
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-21T13:29:42Z

Parkerlreed:

Steam Link is an in-home streaming appliance made by Valve.

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model)
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop application to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>

Steam Link

2016-09-21T13:29:13Z

Parkerlreed: Initial info

Steam Link is an in-home streaming appliance made by Valve.

== Specs ==

* '''CPU:''' Marvell ARMv7 Processor (Can't find exact model)
* '''RAM:''' 512MB (~256MB available after boot)
* '''Dimensions:''' 123.19 x 14.73 x 89.66 mm
* '''Ports:''' 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

== Information ==

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop application to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

* /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
* /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
* /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (Change with passwd after first login)

It comes with a surprising amount of regular utilities

<nowiki>
# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor : 0
model name : ARMv7 Processor rev 0 (v7l)
BogoMIPS : 995.32
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc09
CPU revision : 0

Hardware : MV88DE3108
Revision : 0000
Serial : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.35
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
State = online
OfflineMode = False
SessionMode = False
# connmanctl services
*AO ASUS_5G wifi_e0319e0cba0a_415355535f3547_managed_psk
</nowiki>

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

<nowiki>
# df -h
Filesystem Size Used Available Use% Mounted on
/dev/mtdblock9 1.0G 239.0M 785.0M 23% /
none 131.4M 292.0K 131.1M 0% /dev
devtmpfs 131.4M 292.0K 131.1M 0% /dev
tmpfs 131.4M 48.0K 131.3M 0% /tmp
tmpfs 131.4M 0 131.4M 0% /mnt
/dev/block/mtdblock4 32.0M 6.1M 25.9M 19% /mnt/factory_setting
/dev/block/mtdblock10
1.9G 32.2M 1.8G 2% /mnt/scratch
/dev/block/mtdblock3 512.0M 158.0M 354.0M 31% /mnt/config
unionfs 512.0M 158.0M 354.0M 31% /etc
unionfs 512.0M 158.0M 354.0M 31% /var
unionfs 512.0M 158.0M 354.0M 31% /home
unionfs 512.0M 158.0M 354.0M 31% /usr/local
tmpfs 131.4M 20.0K 131.4M 0% /var/run
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home type unionfs (rw,relatime,dirs=/mnt/config/overlay/home=rw:/home=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
total used free shared buffers cached
Mem: 262 119 143 0 0 71
-/+ buffers/cache: 47 215
Swap: 0 0 0
</nowiki>

You only have sh/ash from Busybox BUT you can grab a static Bash bonary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.
<nowiki>
# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]#
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker
[root@steamlink-87F1 /]# passwd parker
New password:
Retype new password:
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
. .. .bash_logout .bash_profile .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
core 211.8 KiB 963K/s 00:00 [######################################################################################] 100%
extra 2.3 MiB 4.85M/s 00:00 [######################################################################################] 100%
community 3.8 MiB 4.73M/s 00:01 [######################################################################################] 100%
alarm 110.2 KiB 648K/s 00:00 [######################################################################################] 100%
aur 29.3 KiB 7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1 gawk-4.1.4-1 gcc-libs-6.2.1-1 gnutls-3.4.15-1 libutil-linux-2.28.2-1 linux-armv7-4.7.3-1 mkinitcpio-21-1 util-linux-2.28.2-1

Total Download Size: 56.39 MiB
Total Installed Size: 138.24 MiB
Net Upgrade Size: 0.18 MiB

:: Proceed with installation? [Y/n]
:: Retrieving packages...
gcc-libs-6.2.1-1-armv7h 10.2 MiB 4.71M/s 00:02 [######################################################################################] 100%
libutil-linux-2.28.2-1-armv7h 252.0 KiB 1105K/s 00:00 [######################################################################################] 100%
curl-7.50.2-1-armv7h 776.2 KiB 4.62M/s 00:00 [######################################################################################] 100%
gawk-4.1.4-1-armv7h 926.3 KiB 6.96M/s 00:00 [######################################################################################] 100%
gnutls-3.4.15-1-armv7h 2.0 MiB 2.38M/s 00:01 [######################################################################################] 100%
util-linux-2.28.2-1-armv7h 1687.2 KiB 4.25M/s 00:00 [######################################################################################] 100%
mkinitcpio-21-1-any 38.0 KiB 3.71M/s 00:00 [######################################################################################] 100%
linux-armv7-4.7.3-1-armv7h 40.6 MiB 3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring [######################################################################################] 100%
(8/8) checking package integrity [######################################################################################] 100%
(8/8) loading package files [######################################################################################] 100%
(8/8) checking for file conflicts [######################################################################################] 100%
(8/8) checking available disk space [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs [######################################################################################] 100%
(2/8) upgrading libutil-linux [######################################################################################] 100%
(3/8) upgrading curl [######################################################################################] 100%
(4/8) upgrading gawk [######################################################################################] 100%
(5/8) upgrading gnutls [######################################################################################] 100%
(6/8) upgrading util-linux [######################################################################################] 100%
(7/8) upgrading mkinitcpio [######################################################################################] 100%
(8/8) upgrading linux-armv7 [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...
</nowiki>