Revue software root - Revision history

Martiniturbide at 20:23, 3 January 2017

2017-01-03T20:23:43Z

← Older revision		Revision as of 20:23, 3 January 2017
Line 55:		Line 55:

	[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <-- Allows writing to RO partitions (Beware most partitions are signed, modifications will cause a brick)		[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <-- Allows writing to RO partitions (Beware most partitions are signed, modifications will cause a brick)


			[[Category:Logitech]]

Zenofex at 10:18, 31 December 2014

2014-12-31T10:18:24Z

← Older revision		Revision as of 10:18, 31 December 2014
Line 4:		Line 4:
	==About==		==About==
	[[File:Nandpwn.png\|350px\|left\|border]]<br style="clear: both" />		[[File:Nandpwn.png\|350px\|left\|border]]<br style="clear: both" />
	The Nandpwn package was created by Dan Rosenberg (@djrbliss) with remote testing on ~~GTVHacker~~ team member boxes (Dan doesn't actually own a revue). The exploit is highly complex and leverages a world readable device driver left open by Logitech.		The Nandpwn package was created by Dan Rosenberg (@djrbliss) with remote testing on Exploitee.rs team member boxes (Dan doesn't actually own a revue). The exploit is highly complex and leverages a world readable device driver left open by Logitech.

	===About nandpwn===		===About nandpwn===
Line 36:		Line 36:

	===Support===		===Support===
	Due to the complexity of the bug and the agreement that this shouldn't currently be used by the public for general purpose use, neither us nor Dan Rosenberg will be offering support for this package until we have a public release which offers persistence. Even when we do have a package released, Dan will still be too busy to field questions and any help will need to come from our forums or the #~~GTVHacker~~ channel on freenode. But just an early warning, if you brick your box you will either need to purchase and attach a NAND programmer, donate the box to one of us, or accept the fact that you now have an expensive paperweight.		Due to the complexity of the bug and the agreement that this shouldn't currently be used by the public for general purpose use, neither us nor Dan Rosenberg will be offering support for this package until we have a public release which offers persistence. Even when we do have a package released, Dan will still be too busy to field questions and any help will need to come from our forums or the #Exploiteers channel on freenode. But just an early warning, if you brick your box you will either need to purchase and attach a NAND programmer, donate the box to one of us, or accept the fact that you now have an expensive paperweight.

	==Exploiting==		==Exploiting==

Zenofex at 12:16, 4 August 2012

2012-08-04T12:16:15Z

← Older revision		Revision as of 12:16, 4 August 2012
Line 45:		Line 45:
	===Building the code===		===Building the code===
	We are not posting how to build the code as if you are unable to build an x86 binary you probably shouldn't be attempting this root in the first place.		We are not posting how to build the code as if you are unable to build an x86 binary you probably shouldn't be attempting this root in the first place.

			===Video===
			[http://www.youtube.com/watch?v=mo3IlbpfoFk Video of NandPwn in action]

	===Download===		===Download===

Zenofex at 09:00, 4 August 2012

2012-08-04T09:00:08Z

← Older revision		Revision as of 09:00, 4 August 2012
Line 34:		Line 34:
	===Bugs===		===Bugs===
	*'''Persistence''' - This is unstable and should be seen as more of a POC (Proof of concept) than a public release. This exploit is not persistent between boots (which means you will have to run this each time you start the device). We are working on fixing this but are having to jump through quite a few hurdles because of the signed partitions. We will update this page with progress when/if we come up with a work around.		*'''Persistence''' - This is unstable and should be seen as more of a POC (Proof of concept) than a public release. This exploit is not persistent between boots (which means you will have to run this each time you start the device). We are working on fixing this but are having to jump through quite a few hurdles because of the signed partitions. We will update this page with progress when/if we come up with a work around.

			===Support===
			Due to the complexity of the bug and the agreement that this shouldn't currently be used by the public for general purpose use, neither us nor Dan Rosenberg will be offering support for this package until we have a public release which offers persistence. Even when we do have a package released, Dan will still be too busy to field questions and any help will need to come from our forums or the #GTVHacker channel on freenode. But just an early warning, if you brick your box you will either need to purchase and attach a NAND programmer, donate the box to one of us, or accept the fact that you now have an expensive paperweight.

	==Exploiting==		==Exploiting==

Zenofex: /* Download */

2012-08-04T08:54:14Z

Download

← Older revision		Revision as of 08:54, 4 August 2012
Line 44:		Line 44:

	===Download===		===Download===
	[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn] <--Root Exploit		[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn] <-- Root Exploit

	[https://github.com/djrbliss/revue/tree/master/codesign Codesign] <-- Enables code Signing		[https://github.com/djrbliss/revue/tree/master/codesign Codesign] <-- Enables code Signing

	[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <--Allows writing to RO partitions (Beware most partitions are signed, modifications will cause a brick)		[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <-- Allows writing to RO partitions (Beware most partitions are signed, modifications will cause a brick)

Zenofex: /* Download */

2012-08-04T08:53:49Z

Download

← Older revision		Revision as of 08:53, 4 August 2012
Line 45:		Line 45:
	===Download===		===Download===
	[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn] <--Root Exploit		[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn] <--Root Exploit

	[https://github.com/djrbliss/revue/tree/master/codesign Codesign] <-- Enables code Signing		[https://github.com/djrbliss/revue/tree/master/codesign Codesign] <-- Enables code Signing
	[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <--Allows writing to RO partitions (Beware most partitions are signed, ~~any~~ modifications will cause a brick)
			[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <--Allows writing to RO partitions (Beware most partitions are signed, modifications will cause a brick)

Zenofex: /* Download */

2012-08-04T08:53:23Z

Download

← Older revision		Revision as of 08:53, 4 August 2012
Line 44:		Line 44:

	===Download===		===Download===
	[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn]		[https://github.com/djrbliss/revue/tree/master/nandpwn NandPwn] <--Root Exploit
			[https://github.com/djrbliss/revue/tree/master/codesign Codesign] <-- Enables code Signing
			[https://github.com/djrbliss/revue/tree/master/blockwrite BlockWrite] <--Allows writing to RO partitions (Beware most partitions are signed, any modifications will cause a brick)

Zenofex: /* About */

2012-08-04T08:49:05Z

About

← Older revision		Revision as of 08:49, 4 August 2012
Line 4:		Line 4:
	==About==		==About==
	[[File:Nandpwn.png\|350px\|left\|border]]<br style="clear: both" />		[[File:Nandpwn.png\|350px\|left\|border]]<br style="clear: both" />
			The Nandpwn package was created by Dan Rosenberg (@djrbliss) with remote testing on GTVHacker team member boxes (Dan doesn't actually own a revue). The exploit is highly complex and leverages a world readable device driver left open by Logitech.

	===About nandpwn===		===About nandpwn===
	A local privilege escalation exploit for the Logitech Revue that leverages the ability to map the hardware registers of the NAND flash controller in conjunction with a Linux kernel information leak to clobber kernel memory in a way that allows gaining privileges.		A local privilege escalation exploit for the Logitech Revue that leverages the ability to map the hardware registers of the NAND flash controller in conjunction with a Linux kernel information leak to clobber kernel memory in a way that allows gaining privileges.

Zenofex: /* About codesign */

2012-08-04T08:44:16Z

About codesign

← Older revision		Revision as of 08:44, 4 August 2012
Line 21:		Line 21:

	===About blockwrite===		===About blockwrite===
	~~Coming Soon~~.		'''NOVICES DO NOT USE!''' Remaps a specified block device as writable at both the MTD and block layers, to allow flashing a replacement. No known issues were observed during testing.

	==Work In Progress==		==Work In Progress==

Zenofex: /* About codesign */

2012-08-04T08:42:28Z

About codesign

← Older revision		Revision as of 08:42, 4 August 2012
Line 18:		Line 18:

	===About codesign===		===About codesign===
	~~Coming Soon~~.		Once you have root, this can be run to disable code signing enforcement so custom kernel modules can be run. No known issues were observed during testing.

	===About blockwrite===		===About blockwrite===