[Upgrading, Modifying and Unlocking] Whiterat:
Here is my "magic" for Rokus:

xx@xx-xx:[~/src/roku]$ binwalk -m roku.magic 074.09E08061A

DECIMAL	HEX	DESCRIPTION
-------------------------------------------------------------------------------------------------------
0	0x0	Roku aimage SB, Release ID: 202.9-16123 (0xca093efb), Platform ID: Default, Type: uboot, Image Size: 475684 bytes, Encryption: None, Build Date: "Fri Jun 21 21:51:55 2013", Build Host: "neteng-build01.roku"
524288	0x80000	Roku aimage SB, Release ID: 202.9-16123 (0xca093efb), Platform ID: Default, Type: initfs_cramfs, Image Size: 36302884 bytes, Encryption: cbc_4kblocks, Build Date: "Fri Jun 21 21:51:54 2013", Build Host: "neteng-build01.roku"
36827172	0x231F024	Roku aimage SB, Release ID: 202.9-16123 (0xca093efb), Platform ID: Default, Type: uimage, Image Size: 2910468 bytes, Build Date: "Fri Jun 21 21:51:57 2013", Build Host: "neteng-build01.roku"
39737640	0x25E5928	Roku aimage SB, Release ID: 202.9-16123 (0xca093efb), Platform ID: Default, Type: firmware_blob, Image Size: 3221572 bytes, Build Date: "Fri Jun 21 21:51:57 2013", Build Host: "neteng-build01.roku"

# Roku AIMAGE - Whiterat
8 string imgARMcC Roku aimage SB
>16 lelong 0 \b, Release ID: Dev
>16 lelong !0
>>16 lelong 0x585822b8 \b, Release ID: Default
>>16 lelong !0x585822b8
>>>19 byte x \b, Release ID: %d.
>>>18 ubyte x \b%d-
>>>16 leshort x \b%d
>>>16 lelong x (0x%x)
>20 lelong 0x53B22500 \b, Platform ID: Default
>20 lelong !0x53B22500
>>20 lelong x \b, Platform ID: 0x%x
>24 lelong 0x0 invalid
>24 lelong 0x1 invalid
>24 lelong 0x4 \b, Type: env
>24 lelong 0xa \b, Type: initfs_cramfs
>24 lelong 0xd \b, Type: app_cramfs
>24 lelong 0xe \b, Type: firmware_blob
>24 lelong 0x18 \b, Type: uimage
>24 lelong 0x19 \b, Type: uboot
# Ignore images <256 (minimum header size)
>28 lelong <256 invalid
>28 lelong x \b, Image Size: %d bytes
#>32 lelong x Image Size(-hdr): %d bytes
# Flags don't appear to be used for anything other than Encryption state
#>48 lelong x Flags: 0x%08x
>48 ubyte 0x0 \b, Encryption: None
>48 ubyte 0x40 \b, Encryption: cbc_onepass
>48 ubyte 0x80 \b, Encryption: cbc_4kblocks
>48 ubyte 0xC0 \b, Encryption: ctr
# Date must be after 1/1/1990
>52 ledate >631173600
>>52 ledate x \b, Build Date: "%s"
>56 lelong !0
>>(56) lelong !0
>>>(56) lelong !0xffffffff
>>>>(56) string x \b, Build Host: "%s"

The nand dump provided *some* insight into things as there is a second partition (dev image) which isn't encrypted - just a foobar'd version of cramfs

(Please, Don't bug me about getting a copy of this FS - Not going to happen, and there is nothing of use there at this stage).

http://pastebin.com/g7K9mbL7

DECIMAL	HEX	DESCRIPTION
-------------------------------------------------------------------------------------------------------
0	0x0	Roku aimage SB, Release ID: Dev, Platform ID: Default, Type: uboot, Image Size: 475684 bytes, Encryption: None, Build Date: "Wed May 1 21:45:05 2013", Build Host: "neteng-build01.roku"
524288	0x80000	Roku aimage SB, Release ID: Dev, Platform ID: Default, Type: initfs_cramfs, Image Size: 35389476 bytes, Encryption: None, Build Date: "Wed May 1 21:45:05 2013", Build Host: "neteng-build01.roku"
35913764	0x2240024	Roku aimage SB, Release ID: Dev, Platform ID: Default, Type: uimage, Image Size: 2789892 bytes, Build Date: "Wed May 1 21:45:06 2013", Build Host: "neteng-build01.roku"
38703656	0x24E9228	Roku aimage SB, Release ID: Dev, Platform ID: Default, Type: firmware_blob, Image Size: 3089444 bytes, Build Date: "Wed May 1 21:45:06 2013"

But it's lacking the main Roku application and brightscript libraries - which would be needed for a realistic attack approach.

U-boot is compiled for autoboot - so no way to interupt it, only way to get access to the units would be to have a "dev" image, signed manifest and the corresponding iblock.

oh and for this to all be returned by a server with Roku's ssl cert...

U-boot:
...
if (hdr->release_id == 0 && !config_noaccess())
prepend_to_bootargs("dev=1 console=ttyS0,115200 ");
...

Init Script:
...
if [ `awk '{print $1}' /proc/cmdline` = dev\=1 ]; then

echo -n "Starting network servers..."
# Start inetd or telnetd
if [ -x /usr/sbin/telnetd ]; then
/usr/sbin/telnetd -l /sbin/loginsh
echo -n "telnetd "
fi
fi
...

Decryption of fskey (fskey is within the iblock structure) is handled by a function called "decrypt_img_key", which in turn passes to "decrypt_16_with_private_key" which is actually a broadcom function of their "secretkey" driver.