Rooting The Google OnHub - Revision history

Zenofex: /* Enabling "Developer Mode" on the OnHub */

2015-10-27T06:46:47Z

Enabling "Developer Mode" on the OnHub

← Older revision		Revision as of 06:46, 27 October 2015
Line 35:		Line 35:
	#* [[File:Google_OnHub_Hidden_Switch.jpg\|150px]]		#* [[File:Google_OnHub_Hidden_Switch.jpg\|150px]]
	#Plug a USB keyboard into the router's USB		#Plug a USB keyboard into the router's USB
	#Hold down the reset switch on the router (near the power jack plug)		#Hold down the reset switch on the router (near the power jack plug, '''be careful as it's extremely delicate'''.)
	#Plug the power cable back in		#Plug the power cable back in
	#The LED ring on the device should turn white, then blink orange, then red		#The LED ring on the device should turn white, then blink orange, then red

Zenofex: /* Creating a bootable OnHub USB */

2015-10-14T04:04:21Z

Creating a bootable OnHub USB

← Older revision		Revision as of 04:04, 14 October 2015
Line 25:		Line 25:
	=== Creating a bootable OnHub USB ===		=== Creating a bootable OnHub USB ===
	#Download the Google OnHub USB image		#Download the Google OnHub USB image
	##[https://download.exploitee.rs/file/google/onhub/google_onhub_telnet_and_ssh_shell.zip Google OnHub Telnet and Shell Image]		#*[https://download.exploitee.rs/file/google/onhub/google_onhub_telnet_and_ssh_shell.zip Google OnHub Telnet and Shell Image]
	#Unzip the downloaded file so that you are left with a .img file		#Unzip the downloaded file so that you are left with a .img file
	#Write the image to your 4GB+ USB drive using your favorite tool (dd or win32diskimager for win)		#Write the image to your 4GB+ USB drive using your favorite tool (dd or win32diskimager for win)
	## dd example: dd if=<PATH-TO-USB-IMG> of=<PATH-TO-USB-Device> bs=64K		#* dd example: dd if=<PATH-TO-USB-IMG> of=<PATH-TO-USB-Device> bs=64K

	=== Enabling "Developer Mode" on the OnHub ===		=== Enabling "Developer Mode" on the OnHub ===

Zenofex at 04:01, 14 October 2015

2015-10-14T04:01:45Z

← Older revision		Revision as of 04:01, 14 October 2015
Line 25:		Line 25:
	=== Creating a bootable OnHub USB ===		=== Creating a bootable OnHub USB ===
	#Download the Google OnHub USB image		#Download the Google OnHub USB image
	##[https://download.exploitee.rs/file/google/onhub/google_onhub_telnet_and_ssh_shell.~~img~~ Google OnHub Telnet and Shell Image]		##[https://download.exploitee.rs/file/google/onhub/google_onhub_telnet_and_ssh_shell.zip Google OnHub Telnet and Shell Image]
			#Unzip the downloaded file so that you are left with a .img file
	#Write the image to your 4GB+ USB drive using your favorite tool (dd or win32diskimager for win)		#Write the image to your 4GB+ USB drive using your favorite tool (dd or win32diskimager for win)
	## dd example: dd if=<PATH-TO-USB-IMG> of=<PATH-TO-USB-Device> bs=64K		## dd example: dd if=<PATH-TO-USB-IMG> of=<PATH-TO-USB-Device> bs=64K

Zenofex: /* Enabling "Developer Mode" on the OnHub */

2015-10-08T10:57:22Z

Enabling "Developer Mode" on the OnHub

← Older revision		Revision as of 10:57, 8 October 2015
Line 32:		Line 32:
	#Make sure your Google OnHub is unplugged		#Make sure your Google OnHub is unplugged
	#Remove the hidden screw under your OnHub to access the hidden "Developer Mode" switch		#Remove the hidden screw under your OnHub to access the hidden "Developer Mode" switch
	#* ~~<PIC HERE OF WHERE SCREW IS!>~~		#* [[File:Google_OnHub_Hidden_Switch.jpg\|150px]]
	#Plug a USB keyboard into the router's USB		#Plug a USB keyboard into the router's USB
	#Hold down the reset switch on the router (near the power jack plug)		#Hold down the reset switch on the router (near the power jack plug)

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Routers == OnHub Root Instructions == The following process will allow a user to connect t..."

2015-10-08T02:00:23Z

Created page with "__FORCETOC__ {{Disclaimer}} 150px|left|thumb Category:Routers == OnHub Root Instructions == The following process will allow a user to connect t..."

New page

__FORCETOC__
{{Disclaimer}}
[[File:Google_OnHub.jpg|150px|left|thumb]]
[[Category:Routers]]

== OnHub Root Instructions ==
The following process will allow a user to connect to a root shell on the Google OnHub.

===Rooting the Google OnHub===
Rooting the Google OnHub is a multi step process and involves the following.
# [[#Creating a bootable OnHub USB|Creating a bootable OnHub USB]]
# [[#Enabling "Developer Mode" on the OnHub|Enabling "Developer Mode" on the OnHub]]
# [[#Insert USB to boot into intermediary shell enabled kernel|Insert USB to boot into intermediary shell enabled kernel]]
#* You can choose to stop following the guide at this point if you just want to experiment with the OnHub without making any changes to the OnHub's normal boot method
# [[#Resigning the kernel and disabling rootfs verification|Resigning the kernel and disabling rootfs verification]]
# [[#Running commands to modify the normal boot environment|Running commands to modify the normal boot environment]]
# [[#Rebooting and Exiting Developer Mode|Rebooting and Exiting Developer Mode]]
# [[#Enjoy!|Enjoy!]]

=== Requirements:===
* Google OnHub
* 4GB+ USB flash drive

== Root Steps ==
=== Creating a bootable OnHub USB ===
#Download the Google OnHub USB image
##[https://download.exploitee.rs/file/google/onhub/google_onhub_telnet_and_ssh_shell.img Google OnHub Telnet and Shell Image]
#Write the image to your 4GB+ USB drive using your favorite tool (dd or win32diskimager for win)
## dd example: dd if=<PATH-TO-USB-IMG> of=<PATH-TO-USB-Device> bs=64K

=== Enabling "Developer Mode" on the OnHub ===
#Make sure your Google OnHub is unplugged
#Remove the hidden screw under your OnHub to access the hidden "Developer Mode" switch
#* <PIC HERE OF WHERE SCREW IS!>
#Plug a USB keyboard into the router's USB
#Hold down the reset switch on the router (near the power jack plug)
#Plug the power cable back in
#The LED ring on the device should turn white, then blink orange, then red
#After the LED starts blinking red, Press CTRL + D on your keyboard and the LED should now start blinking purple.
#Now press the hidden "developer mode" switch under the OnHub
#The OnHub should then reboot and the LED should start blinking purple again
#* This indicates that we have successfully entered the Google OnHub's "Developer Mode".

=== Insert USB to boot into intermediary shell enabled kernel ===
#Insert the USB drive (we made in previous step) into your OnHub
#Press the hidden switch under the router to boot to USB
#Now, you should see your USB flash drive status light start blinking
#Plug in your Ethernet cable or connect to the OnHub over WiFi using the password under the base of the hub
#Telnet or ssh to your router
#* IP: 192.168.86.1 by default
#* User: root
#* Password: onhub
# You should now be connected to a root account on the Google OnHub

=== Modifying the OnHub Boot Environment ===
Flashing developer firmware + Resigning kernel + adding telnetd and busybox
#To reprogram firmware image with devkeys, run the following command:
#* /usr/share/vboot/bin/make_dev_firmware.sh
''Output:''
<pre>Disabling system software write protection status...
Reading system live firmware...

Using keyblocks (normal, normal)...
Preparing new firmware image...

Backup of current firmware image is stored in:
/mnt/stateful_partition/backups/firmware_WHIRLWIND_D3A-Q2Q-Q8B_20150623_223857.fd
Please copy the backup file to a safe place ASAP.

To stop using devkeys and restore original firmware, execute command:
flashrom -w [PATH_TO_BACKUP_IMAGE]
Ex: flashrom -w /mnt/stateful_partition/backups/firmware_WHIRLWIND_D3A-Q2Q-Q8B_20150623_223857.fd

Writing system live firmware...

Successfully changed firmware to Developer Keys. New HWID: WHIRLWIND D3A-Q2Q-Q8B DEV
</pre>

The backup of the firmware will be stored on your USB drive, keep it safe so you can go back to original.

=== Resigning the kernel and disabling rootfs verification===
# To disable rootfs verification and resign the kernel, run the following command:
#* /usr/share/vboot/bin/make_dev_ssd.sh --remove_rootfs_verification --image /dev/mmcblk0

''Output:''
<pre>
Kernel A: Disabled rootfs verification.
Backup of Kernel A is stored in: /mnt/stateful_partition/backups/kernel_A_20150623_223724.bin
Kernel A: Re-signed with developer keys successfully.
Kernel B: Disabled rootfs verification.
Backup of Kernel B is stored in: /mnt/stateful_partition/backups/kernel_B_20150623_223733.bin
Kernel B: Re-signed with developer keys successfully.
Successfully re-signed 2 of 2 kernel(s) on device /dev/mmcblk0.
</pre>

=== Running commands to modify the normal boot environment ===
#Enter the following commands into the ssh/telnetd root shell to add busybox and a telnetd shell to the normal boot environment:
#* mkdir /tmp/roota
#* mount /dev/mmcblk0p3 /tmp/roota/
#* mkdir /tmp/rootb
#* mount /dev/mmcblk0p5 /tmp/rootb/
#* cp /bin/busybox /tmp/roota/bin/busybox
#* cp /bin/busybox /tmp/rootb/bin/busybox
#* cp /etc/init/telnetd.conf /tmp/roota/etc/init/telnetd.conf
#* cp /etc/init/telnetd.conf /tmp/rootb/etc/init/telnetd.conf
#* chmod 755 /tmp/roota/bin/busybox
#* chmod 755 /tmp/rootb/bin/busybox
#* cp /etc/shadow /tmp/roota/etc/shadow
#* cp /etc/shadow /tmp/rootb/etc/shadow
#* sync
#* umount /dev/mmcblk0p3
#* umount /dev/mmcblk0p5
#Now the kernel has been signed with the dev keys and telnetd has been added to the rootfs

=== Rebooting and Exiting Developer Mode ===
# Reboot the router and unplug the USB drive
#* After the OnHub reboots, it will still be in Developer Mode and will be waiting for a USB device to boot. We need to exit this mode and boot to the internal flash.
# Plug in your USB keyboard
# Repeatedly tap spacebar and enter until the status LED is not blinking purple (If you find the exact key sequence hop on IRC and let us know.)
#* It might take a couple of tries but you can unplug your OnHub and try again
#* Note: First boot up may take up to 5 minutes
# Now the Google OnHub should begin to boot from the internal flash again

=== Enjoy! ===
# Telnet to your rooted OnHub and enjoy :)
#* IP: 192.168.86.1 (default)
#* User: root
#* Password: onhub (You should change this ASAP!)

Rooting The Google OnHub - Revision history

Zenofex: /* Enabling "Developer Mode" on the OnHub */

Zenofex: /* Creating a bootable OnHub USB */

Zenofex at 04:01, 14 October 2015

Zenofex: /* Enabling "Developer Mode" on the OnHub */

Zenofex: Created page with "__FORCETOC__ {{Disclaimer}} thumb Category:Routers == OnHub Root Instructions == The following process will allow a user to connect t..."

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Routers == OnHub Root Instructions == The following process will allow a user to connect t..."