Netgear NeoTV Prime - Revision history

Resno: Text replacement - "gtvcom-20" to "exploiteers-20"

2016-02-07T01:22:40Z

Text replacement - "gtvcom-20" to "exploiteers-20"

← Older revision		Revision as of 01:22, 7 February 2016
Line 8:		Line 8:
	Buying Google TV devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next Google TV.		Buying Google TV devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next Google TV.

	[http://www.amazon.com/gp/product/B00AM0ESC4/ref=as_li_ss_tl?ie=UTF8&tag=~~gtvcom~~-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=B00AM0ESC4 Purchase the Netgear NeoTV Prime at Amazon]		[http://www.amazon.com/gp/product/B00AM0ESC4/ref=as_li_ss_tl?ie=UTF8&tag=exploiteers-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=B00AM0ESC4 Purchase the Netgear NeoTV Prime at Amazon]

	== Specs ==		== Specs ==

Martiniturbide at 21:36, 24 February 2015

2015-02-24T21:36:21Z

← Older revision		Revision as of 21:36, 24 February 2015
Line 70:		Line 70:

	'''Download:''' [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]		'''Download:''' [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]

			[[Category:Google TV]]

Zenofex: /* PrimePwn (Root) */

2013-07-22T16:29:45Z

PrimePwn (Root)

← Older revision		Revision as of 16:29, 22 July 2013
Line 60:		Line 60:

	'''Neo TV "PrimePwn" Root Process:'''		'''Neo TV "PrimePwn" Root Process:'''
			*This process is outdated and should only be used on newly purchased devices which haven't received updates.

	# Download [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]		# Download [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]

CJ: /* Update History */

2013-01-20T22:48:22Z

Update History

← Older revision		Revision as of 22:48, 20 January 2013
Line 27:		Line 27:

	== Update History ==		== Update History ==
	GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version		*GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version
	GTV-1.0.9.r0127-SDK1065.HC15848.PV01.09-PVT_SIGNK - First OTA release, dated Dec 13 2012. Exploits still exist in this version. [http://android.clients.google.com/packages/ota/netgear_gtv100/48a52f02f44a.NeoTVPrime-ota.v1.0.9.zip Download]		*GTV-1.0.9.r0127-SDK1065.HC15848.PV01.09-PVT_SIGNK - First OTA release, dated Dec 13 2012. Exploits still exist in this version. [http://android.clients.google.com/packages/ota/netgear_gtv100/48a52f02f44a.NeoTVPrime-ota.v1.0.9.zip Download]

	== Connections / Connectors / Switches ==		== Connections / Connectors / Switches ==

CJ: /* Update History */

2013-01-20T22:48:12Z

Update History

← Older revision		Revision as of 22:48, 20 January 2013
Line 28:		Line 28:
	== Update History ==		== Update History ==
	GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version		GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version
			GTV-1.0.9.r0127-SDK1065.HC15848.PV01.09-PVT_SIGNK - First OTA release, dated Dec 13 2012. Exploits still exist in this version. [http://android.clients.google.com/packages/ota/netgear_gtv100/48a52f02f44a.NeoTVPrime-ota.v1.0.9.zip Download]

	== Connections / Connectors / Switches ==		== Connections / Connectors / Switches ==

Zenofex at 09:18, 17 January 2013

2013-01-17T09:18:48Z

← Older revision		Revision as of 09:18, 17 January 2013
Line 44:		Line 44:

	{\|		{\|
	\|[[File:NeoTV Prime UART.jpg\|200px\|left\|thumb\|~~Hisense Pulse~~ UART pinout]]		\|[[File:NeoTV Prime UART.jpg\|200px\|left\|thumb\|Netgear NeoTV UART pinout]]
	\|}		\|}

Zenofex: Added UART Pinout

2013-01-17T09:11:38Z

Added UART Pinout

← Older revision		Revision as of 09:11, 17 January 2013
Line 25:		Line 25:
	File:Mobo-neotvprime.jpg		File:Mobo-neotvprime.jpg
	</gallery>		</gallery>

			== Update History ==
			GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version

	== Connections / Connectors / Switches ==		== Connections / Connectors / Switches ==
Line 33:		Line 36:
	*SW2 - Factory Restore		*SW2 - Factory Restore

	== ~~Update History~~ ==		== UART Pinout ==
	~~GTV-1~~.0.3.~~r0098-SDK1065~~.~~HC15848~~.~~PV01~~.~~09-RC1 - Initial Factory Version~~		The NeoTV features a serial output that can be accessed. In the initial software version, this dropped directly into a root shell.

			Using a UART/TTL Adapter (3.3v), connect wire for wire to the pinout below.

			Settings are 115200 8n1, no login or password. You will be dropped to a root shell after bootup

			{\|
			\|[[File:NeoTV Prime UART.jpg\|200px\|left\|thumb\|Hisense Pulse UART pinout]]
			\|}

	== PrimePwn (Root) ==		== PrimePwn (Root) ==

CJ: /* PrimePwn */

2013-01-17T08:38:28Z

PrimePwn

← Older revision		Revision as of 08:38, 17 January 2013
Line 36:		Line 36:
	GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version		GTV-1.0.3.r0098-SDK1065.HC15848.PV01.09-RC1 - Initial Factory Version

	== PrimePwn ==		== PrimePwn (Root) ==
	PrimePwn is the name of our automated root process. It works by leveraging a debug service that is called "testmode", which checks for a USB drive with a file named “.testmode” containing the magic string “testmodemark”. The system then checks to see if the file contains the magic string “testmodemark”. If the system finds the file, it sets the “persist.radio.testmode.enabled” property to 1 and reboots. Then, if the device detects this property as 1 upon boot, it attempts to copy and then extract a file named “test_mode.tgz” from the USB drive to /tmp/. After extracting, the system tries to run a sh file named “/tmp/test_mode/test_mode.sh”. Assuming we set the permissions correctly this file will allow us to run the payload of our choosing as root.		PrimePwn is the name of our automated root process. It works by leveraging a debug service that is called "testmode", which checks for a USB drive with a file named “.testmode” containing the magic string “testmodemark”. The system then checks to see if the file contains the magic string “testmodemark”. If the system finds the file, it sets the “persist.radio.testmode.enabled” property to 1 and reboots. Then, if the device detects this property as 1 upon boot, it attempts to copy and then extract a file named “test_mode.tgz” from the USB drive to /tmp/. After extracting, the system tries to run a sh file named “/tmp/test_mode/test_mode.sh”. Assuming we set the permissions correctly this file will allow us to run the payload of our choosing as root.

CJ: /* PrimePwn */

2013-01-17T08:38:13Z

PrimePwn

← Older revision		Revision as of 08:38, 17 January 2013
Line 50:		Line 50:

	# Download [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]		# Download [http://download.gtvhacker.com/file/neotv-prime/PrimePwn.zip PrimePwn.zip]
	# Extract the PrimePwn.zip to a Fat32 formatted USB drive. (test_mode.tgz, .testmode, README)		# Extract the PrimePwn.zip to the root of a Fat32 formatted USB drive. (test_mode.tgz, .testmode, README)
	# Put the USB drive into your NeoTV Prime and reboot.		# Put the USB drive into your NeoTV Prime and reboot.
	# Let the process run, it will reboot a few times and then will end at the home screen. (Approximately 3 minutes later)		# Let the process run, it will reboot a few times and then will end at the home screen. (Approximately 3 minutes later)

CJ: /* PrimePwn */

2013-01-17T08:37:11Z

PrimePwn

← Older revision		Revision as of 08:37, 17 January 2013
Line 37:		Line 37:

	== PrimePwn ==		== PrimePwn ==
	PrimePwn is our automated root process. It works by leveraging a debug service that is called "testmode", which checks for a USB drive with a file named “.testmode” containing the magic string “testmodemark”. The system then checks to see if the file contains the magic string “testmodemark”. If the system finds the file, it sets the “persist.radio.testmode.enabled” property to 1 and reboots. Then, if the device detects this property as 1 upon boot, it attempts to copy and then extract a file named “test_mode.tgz” from the USB drive to /tmp/. After extracting, the system tries to run a sh file named “/tmp/test_mode/test_mode.sh”. Assuming we set the permissions correctly this file will allow us to run the payload of our choosing as root.		PrimePwn is the name of our automated root process. It works by leveraging a debug service that is called "testmode", which checks for a USB drive with a file named “.testmode” containing the magic string “testmodemark”. The system then checks to see if the file contains the magic string “testmodemark”. If the system finds the file, it sets the “persist.radio.testmode.enabled” property to 1 and reboots. Then, if the device detects this property as 1 upon boot, it attempts to copy and then extract a file named “test_mode.tgz” from the USB drive to /tmp/. After extracting, the system tries to run a sh file named “/tmp/test_mode/test_mode.sh”. Assuming we set the permissions correctly this file will allow us to run the payload of our choosing as root.

	[[File:Netgear-NeoTV-Prime-testmode-Root-Process.jpg\|500px\|center]]		[[File:Netgear-NeoTV-Prime-testmode-Root-Process.jpg\|500px\|center]]