Installing Custom Recovery (Gen 2 Only)

From Exploitee.rs
Jump to navigationJump to search

About

This custom recovery currently exploits a secure boot flaw in the second generation of Google TV devices to allow booting an unsigned kernel on the Google TV. Below we allow users to install a custom recovery on the Google TV which allows full read write access to the device as well as an automated process for installing updates (of which we do not check the signature.)

Devices

  • ASUS Cube
  • Hisense Pulse
  • NSZ-GS7/GS8

Warnings

  • This will definitely void your warranty, if you want to keep your warranty please do not do any of the steps in this guide.
  • This may brick your GTV. It shouldn't, but it still might!

Tools Needed

  • Linux Live CD or Linux Installed
  • A vulnerable Google TV device.
  • 1 USB Drive (to be formatted)

Pre-Setup

  1. Boot Linux (Live CD or Install)
  2. Download Custom Recovery Package for Device
  3. Unzip Custom Recovery Package

Custom Recovery Steps (Cube and Pulse)

  1. Format a drive NTFS, and mount it.
  2. cd to the drive, and issue the following commands:
    The major and minor hash for these commands is pulled from an "ls -l" on /dev/mtd for the recovery mtd.
    mknod gtvhacker-recovery c 90 32
  3. Then, copy over our files for your specific box, to the root of your NTFS flash drive
    nandwrite
    flash_erase
    CustomRecovery-VENDOR-MODEL-GTVHACKER.bin
  4. Unmount the drive, and insert it into your Google TV.
  5. Connect via adb, and issue the shell command.
  6. To find out what USB drive you plugged in, issue this command:
    ls /mnt/media/
    cd /mnt/media/usb.LABEL (where label = the rest from above)
  7. Now, issue these commands:
    cp flash_erase /data/local/tmp
    cp nandwrite /data/local/tmp
    chmod 755 /data/local/tmp/flash_erase
    chmod 755 /data/local/tmp/nandwrite
    cd /data/local/tmp
  8. Finally, to install the recovery (where usb.LABEL is the name of your usb drive from above):
    ./flash_erase /mnt/media/usb.LABEL/gtvhacker-recovery 0 0
    ./nandwrite -p /mnt/media/usb.LABEL/gtvhacker-recovery /mnt/media/usb.LABEL/CustomRecovery-VENDOR-MODEL-GTVHACKER.bin
  9. Issue an adb reboot, and you have a custom recovery.

Developers Only (UART console required)

We are preparing a update package to be installed from the recovery GUI which will automate the custom bootloader install. To install the uboot custom bootloader (developers only, UART console required):

  1. Format a drive NTFS, and mount it.
  2. cd to the drive, and issue the following commands:
    The major and minor hash for these commands is pulled from an "ls -l" on /dev/mtd for the kernel mtd.
    mknod gtvhacker-kernel c 90 16
  3. Then, copy over our files for your specific box, to the root of your NTFS flash drive
    nandwrite
    flash_erase
    uboot-VENDOR-MODEL-GTVHACKER.bin
  4. Unmount the drive, and insert it into your Google TV.
  5. Connect via adb, and issue the shell command.
  6. To find out what USB drive you plugged in, issue this command:
    ls /mnt/media/
    cd /mnt/media/usb.LABEL (where label = the rest from above)
  7. Now, issue these commands:
    cp flash_erase /data/local/tmp
    cp nandwrite /data/local/tmp
    chmod 755 /data/local/tmp/flash_erase
    chmod 755 /data/local/tmp/nandwrite
    cd /data/local/tmp
  8. Finally, to install the custom bootloader (where usb.LABEL is the name of your usb drive from above):
    ./flash_erase /mnt/media/usb.LABEL/gtvhacker-kernel 0 0
    ./nandwrite -p /mnt/media/usb.LABEL/gtvhacker-mtd8 /mnt/media/usb-LABEL/uboot-VENDOR-MODEL-GTVHACKER.bin
  9. Issue an adb reboot, and you have a custom DEVELOPER ONLY bootloader.


Custom Recovery Steps (Sony)

  1. Format a drive NTFS, and mount it.
  2. cd to the drive, and issue the following commands:
    The major and minor hash for these commands is pulled from an "ls -l" on /dev/block for the recovery block.
    mknod gtvhacker-recovery c 179 10
  3. Then, copy over our files for your specific box, to the root of your NTFS flash drive
    CustomRecovery-VENDOR-MODEL-GTVHACKER.bin
  4. Unmount the drive, and insert it into your Google TV.
  5. Connect via adb, and issue the shell command.
  6. To find out what USB drive you plugged in, issue this command:
    ls /mnt/media/
    cd /mnt/media/usb.LABEL (where label = the rest from above)
  7. Install the recovery (where usb.LABEL is the name of your usb drive from above):
    cd /data/local/tmp
    dd of=/mnt/media/usb.LABEL/gtvhacker-recovery if=/mnt/media/usb.LABEL/CustomRecovery-VENDOR-MODEL-GTVHACKER.bin bs=2048
  8. Issue an adb reboot, and you have a custom recovery.

Troubleshooting

  • You can get help from us or other users at:

GTVHacker Forums

GTVHacker Wiki

  • or you can chat with us on IRC at:

irc.freenode.net #gtvhacker

Freenode Webchat

(Someone may not be around right away to help, make sure to be willing to wait for a response)

Download

Custom Recovery:

Retrieved from "http://www.Exploitee.rs/index.php?title=Installing_Custom_Recovery_(Gen_2_Only)&oldid=1195"