yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] spikeeee:
Looking at the PCB, it seems that it is a depopulated board, its all marked out for the USB and everything else that is removed (see images below, sorry not my images). Though it does like its more than just the USB connection, it looks like some SM resistors and other bits are missing as well :(

ROKU LT board

NowTV Board

Close up of USB area
[Upgrading, Modifying and Unlocking] Whiterat:
Where do I start...

With regard to tricking the LT firmware onto it (which was my plan) this does appear to be a no-go.

It makes an HTTPS request out to Roku for what I imagine is some kind of manifest/xml which dictates what the latest firmware is and some kind of hash to verify it.

The box will then download the firmware over HTTP (yay I thought..) so dnsmasq to the ready I renamed the LT (aka giga/024) image, it downloads it but fails to verify (error 006).

The firmware images themselves still require a lot of investigation, uboot and a kernel are in there plain (as you would expect) but the main filesystem is still to be found - after routing through the GPL pages it would appear to still be cramfs with different magic, but even then this isn't visible in the firmware so most probably encrypted.

(#define CRAMFS_MAGIC 0x28cd3d47 /* cramfs as modified by Roku */)

Encrypted by what?

Again judging by the roku GPL source, they store a 16byte aes key within the Broadcom Videocore - I can't envisage this being easy to recover without userland access.

(static unsigned char aes_k[16];

vc_otp_read(46, 4, aes_k);)

Random Info:

Windsor does appear to be the codename for this box (makes sense for a british product I guess), other code names are giga, paolo, jackson and austin.

Mapping them out is not so straight forward though, the below is likely wrong:

ID -- Codename -- Model

024 giga Roku LT

025 ??

034 paolo ??

045 austin Roku 3

??? jackson ??

Failed Ideas:

MITM (SSL is validated - as you'd expect)

Firmware Interception/Replacement

thttpd exploits

Ideas Still to Look into:

Generate SSL certificate with "api.qa-uat.roku" as a subject alternative name, cycle channel store server to that and see what we can see.

libzip exploit (dev package upload - possibly too much hard work tbh, would need to know the target binary well)

There is a 20 pin arm jtag header exposed on the board...
[Upgrading, Modifying and Unlocking] CBers:
You can also sideload the MediaBrowser3 plugin for Roku.

See here if you're interested.
[Upgrading, Modifying and Unlocking] wozhere:
Maybe writing a Roku plugin/app that loads immediately upon start up and blocks the channel to Roku or similar constant/var place holders to stop the firmware update?
[Upgrading, Modifying and Unlocking] speculatrix:
I found the thread on HUKD where someone had managed to break updates:

http://www.hotukdeals.com/deals/now-tv-box-10-inc-1615409?page=43#post18690920
[Upgrading, Modifying and Unlocking] speculatrix:
by redirecting traffic to burpsuite I intercepted a call to download the firmware

GET /windsor/074.09E08061A HTTP/1.1

Connection: close

Host: firmware.roku.com

User-Agent: Roku/DVP-4.9 (074.09E08022A)

you too can download it here: http://firmware.roku.com/windsor/074.09E08061A

so now I have a 41M file which, using strings, begins "imgARMcC" and

has interesting things like "BCM95001" and "Starting ARM with %dMB

ARM clock speed at %dMHz **** failed to power up the USB interface" in it.
[Upgrading, Modifying and Unlocking] spants:
On my hosts file on my router I added:

127.0.0.1	windsor.sw.roku.com

That stops it updating the firmware.....
[Upgrading, Modifying and Unlocking] spants:
You can use BINWALK (https://code.google.com/p/binwalk/) on this file to get more information.... but is this the whole of the update firmware? on http://www.cs.cmu.edu/~ecc/roku-nfp.html he mentions that there are 3 files to download...

Tried running it through https://code.google.com/p/firmware-mod-kit/ but it fails.

If the box was more expensive it would be worth getting an ARM jtag cable (wiggler) and using http://openocd.sourceforge.net/ on it
[Upgrading, Modifying and Unlocking] flibblesan:
The original Roku Netflix Player is very, very different to current Roku boxes. They use entirely different chipsets that are MIPS architecture rather than the ARM architecture as used in current Roku boxes. This obviously means that firmware format will be different and any hacks for the original Roku boxes just won't do anything.

The Roku 2 - which the LT & Now TV box are based upon - was first released in 2011 and two years later not one person has managed to hack the box to install unsigned firmware, additional apps etc etc. The Roku boxes are extremely well locked down and for good reason. I doubt very much they will ever be hacked.

If you want to run Roku firmware then buy an LT. They are only £35.
[Upgrading, Modifying and Unlocking] speculatrix:
I've worked with a few people who do embedded Arm stuff, so I'll ask if anyone can loan me a jtag cable, or, wants to borrow the nowtv box to play.

---------- Post added at 11:31 AM ---------- Previous post was at 11:28 AM ----------

If I was going to do that, I'd buy a completely open system like a raspberry pi, or a beaglebone black. But where would be the fun in that?

:D
[Upgrading, Modifying and Unlocking] speculatrix:
hmm, interesting...

~/download/Roku$ binwalk windsor_firmware__074.09E08061A

DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
404064 0x62A60 U-Boot boot loader reference
36827492 0x231F164 gzip compressed data, was "Image", from Unix, last modified: Fri Jun 21 20:28:49 2013, max compression
39357391 0x2588BCF gzip compressed data, has CRC, extra field, last modified: Tue Feb 24 17:08:22 2032
41441952 0x2785AA0 GIF image data, version "87a", 18759
41441960 0x2785AA8 GIF image data, version "89a", 24944
41960112 0x28042B0 Copyright string: " (c) 2010 Broadcomrge ? y == noutput_height || y == noutput_height+1 : y == pFile"
41998628 0x280D924 PNG image, 0 x 0, 0-bit grayscale, non-interlaced
41998636 0x280D92C PNG image, 0 x 0, 0-bit grayscale, non-interlaced
42430052 0x2876E64 GIF image data, version "89a", 28515
42794144 0x28CFCA0 Copyright string: " (c) 1996-2009 Express Logic Inc. * ThreadX/SMP VideoCore Versic. * ThreadX/SMP VideoCore Version G5.3.5.2 (SP1) SN: 3009-115-"
[Upgrading, Modifying and Unlocking] tholmewood:
I agree that the best and easiest way to increase functionality would be to somehow generate a link code and to push the good apps and private channels to the box. I wonder if there is anyway to figure out what a device's link code is from the model number?
[Upgrading, Modifying and Unlocking] Bouncer5:
Anybody want to soilder a USB port onto the space? See if we can't sideload something on it?
[Upgrading, Modifying and Unlocking] tonyt3rry:
I have the now TV box its amazing with plex I love it. What kind of private channels do you all use
[Upgrading, Modifying and Unlocking] SlackR84:
I have removed the nand chip from the Now TV and took a full dump. I also bought a Roku 2 XD and will be taking a full nand dump of this too, I will then reflash the now tv nand. I went with the XD as it supports 1080p and the only hardware difference is a microsd slot and the bluetooth (which are unpopulated on the now tv board).

The lack of microsd wont be a problem - as there is nothing connected when the slot is empty anyway. Hopefully the lack of bluetooth wont stop the XD firmware booting. If it does, I will get a LT - but I figured 1080p support was a nice upgrade.

There seems to be references to ttybcm0 in uboot, which also gives serial connection settings. I have the pinout of the BCM2835 (same as the raspberry pi) with the possible pins for serial (depending on how its configured).

I will probably remove the CPU and trace out these 3 combinations and try to get serial access. Assuming uboot isnt locked down, should be easy to flash from there.

That wont work, the USB controller is missing. The higher end rokus have a chip that handles USB and Ethernet - the SMSC LAN9512-JZX. This is a "Hi-Speed USB 2.0 Hub and High-Performance 10/100 Ethernet Controller". Without that chip (and the missing supporting surface mount components) you wont get USB or ethernet, even if you do solder in the port.

That is a Roku 2 XS board, not a Roku LT. The LT board is the same as the Now TV board - i.e. a bunch of unpopulated parts.
[Upgrading, Modifying and Unlocking] SlackR84:
Ok,

So I removed the Roku 2 XD Nand and fitted it to the Now TV. It refuses to boot (dont even get the flashing LED to suggest firmware is loading). This suggests to me that uboot is either not booting or doing a check (key in OTP of the CPU vs firmware?) and refusing to boot the firmware. It could also be due to the lack of Bluetooth hardware (might work if I get an LT....)

Looks like next step is to get serial output and see whats actually happening (if possible).

I am now removing the CPU to trace out the above possible serial pins.

Edit:

I have removed the CPU and have a bunch of pictures to post - but I cant do that until I hit 10 posts apparently.
[Upgrading, Modifying and Unlocking] Whiterat:
SlackR84's Pictures:

https://www.dropbox.com/sh/j0dcht8u6unghi7/14F6NdQq7c

Nice work!
[Upgrading, Modifying and Unlocking] spants:
[MENTION=3001877]SlackR84[/MENTION]: In [MENTION=315582]Whiterat[/MENTION]s earlier post he mentioned that there is the possibility of a key stored in the broadcom chip. I wonder if the broadcom chip key is linked to the firmware partner - ie a key for Nowtv, a key for netflix - so that the firmware has to match the key?

btw - great job, I wonder how to get a copy of the nand dump? ;)
[Upgrading, Modifying and Unlocking] SlackR84:
We have been speaking in PM about the key, it seems to be per device and based upon the serial of the unit. If true, that means another nowtv dump wouldnt work on a different nowtv.

To make any more progress, I need to get into the serial connection really - uboot seems to be fully featured, including flashing files via serial (aka ymodem). Which is fortunate as TFTP would likely be a no go, as I doubt it has wifi drivers at that stage.... and we have no ethernet on these lower end devices.

Regarding nand dump, it might contain usernames/passwords/wifi password - so I would rather not share it publicly... I dont remember if I hooked this one up to the internet before it gave its life to science.
[Upgrading, Modifying and Unlocking] HOMEBOYCRUSOE:
Do any of you clever dudes know what IP address is used for the 'talkback' feature on this box or even a Roku LT box? I would like to block it as I have read the Privacy settings and certainly seems to do a lot of sniffing and recording about what you play and do on the box. Maybe I'm being overly paranoid adn it doesnt go as far as inspecting/recording content played?
[Upgrading, Modifying and Unlocking] Whiterat:
Educated guess of 72.3.235.75 for NowTV and 72.32.45.19 for the LT.
[Upgrading, Modifying and Unlocking] terracotta4:
Where's the CPU?

These pics don't include the Broadcom CPU, has work to reveal this been completed? Looking forward to it!
[Upgrading, Modifying and Unlocking] Whiterat:
^

The last 4 pics are of the SoC (CPU) - BCM2835
[Upgrading, Modifying and Unlocking] SlackR84:
As mentioned above, CPU is in the pictures. Ram is mounted on top of the CPU (which is quite an annoying configuration).

Whiterat has made some good progress with the raw nand dump (ECC, remapped blocks etc make working with nand images a little more complex than NOR!).

I have a week off next week, so I will hopefully trace out the serial port and make some more progress. I will keep this thread updated of anything discovered.
[Upgrading, Modifying and Unlocking] terracotta4:
Well I certainly wasn't expecting that! Well done indeed! I've done a little bit of work at m4rkh dot co dot vu but not got very far. Looking forward to finding the serial port!
[Upgrading, Modifying and Unlocking] SlackR84:
Probably worth checking your twitter now and again! :)
[Upgrading, Modifying and Unlocking] HOMEBOYCRUSOE:
Or is it windsor.sw.roku.com (72.3.235.78)? Gets firmware updates from IP 72.3.235.78, so is it likely to be same for talkback or is it a different one, i.e. 72.3.235.75? I know I can block this range but I just want to be double sure.

Cheers

PS Hope no-one is ignored and thinks me thread hijacking
[Upgrading, Modifying and Unlocking] Whiterat:
72.3.235.75 = windsor.logs.roku.com

72.32.45.19 = giga.logs.roku.com

As I said, just an educated guess :)
[Upgrading, Modifying and Unlocking] pickup9785:
Just wondering, is this dead or are people still working on it ?
[Upgrading, Modifying and Unlocking] wembley66:
I'm still looking (albeit time is quite tight). Mainly for the intellectual exercise rather than anything exotic. For example on attaching (a very low resolution) logic analyser to the serial tx, those sixes above are still sixes. Maybe the kernel uses the other on chip UART on different pins for its messages, I'll investigate further.

If I discover more, I'll post here.
[Upgrading, Modifying and Unlocking] tonyt3rry:
Im happy with the device I'd love Netflix shame the roku costs so much for 1080p
[Upgrading, Modifying and Unlocking] Whiterat:
Not given up, discovered plenty about the platform - It's fantastically designed, they certainly didn't just get a broadcom reference board and bang some code on.

Yep, uboot uses tty0 for output and the kernel outputs to ttyAMA0 which I believe is actually pl011 rather than uart - although I'm a little surprised there is any output seen on uart once the kernel starts booting.

I doubt a prompt is spawned on ttyAMA0, buy you never know ;)

Would still be fantastic to find rx for uart - just to see if uboot will interrupt on catching ctrl+c.

I'm afraid that is one thing you are very unlikely to see no matter how far we progress, all roku devices undergo an Individualization process at the factory during which time a per-device binary is loaded - one part of this binary is a unique netflix key. This is then burnt into the broadcom cpu using OTP (one-time-programmable) polyfuses.

There are a great many challenges with this platform - It is secure. Breaking the chain of trust is going to be next to impossible, even if we gain the 16byte HMAC key from the SoC allowing us to sign a patched bootloader - There is still no way of getting that on the device easily.

I never say never, but don't expect miracles ;)
[Upgrading, Modifying and Unlocking] tonyt3rry:
I'm happy with my plex I'd love new features etc that's why I'm subbed
[Upgrading, Modifying and Unlocking] SSThing:
Sorry for the slight hijack, I ask here because you guys obviously know what you are doing.

I too have one of these NowTv boxes running Plex and am very pleased, especially for the cost. My only real problem is my connection and buffering which means (movies especially) my resolution can increase/decrease during playback. So is there a device that does the same as this box but has the option to either set perhaps a 15 minute buffer or even download the whole film for playback later?

Thanks
[Upgrading, Modifying and Unlocking] pickup9785:
Thanks for the replies and good luck !
[Upgrading, Modifying and Unlocking] Bouncer5:
There is no internal storage for it to store that information unlike a Sky HD box.
[Upgrading, Modifying and Unlocking] SSThing:
Yes, I am aware of that, hence the question:)
[Upgrading, Modifying and Unlocking] tonyt3rry:
I have no buffering issue I have mines on 720p 4mb I think or higher my network is 11mb on average
[Upgrading, Modifying and Unlocking] cyberbaggage:
Hi whiterat, I was wondering if you could take the trouble of posting details (more details) about your discovery.

I am not a hardware guy and hence I have been working on the update images. I was able to analyze all the update images till date and could clearly find the boot, kernel and the RAM disk. I have quite extensively analyzed the image for any encryption, but the statistical analysis is pretty inconclusive.

If you could provide any more details or Mabbe a mini guide of your hardware based approach it could help my analysis.

Thank you.
[Upgrading, Modifying and Unlocking] akufu:
I did manage to modify Roku's YouTube App to get it working on the NowTV box if anybody is interested.

You can see here: akufu.com/youtube-channel-nowtv-sky/
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
I just dump the NAND flash on my ROKU. According to the datasheet ( "B: Included Bad Block" ) my NAND contain bad block. I try to remap those bad blocks to the correct block but I can't find the bad block table anywhere. Can someone help me remap those bad block? Here is my RAW dump with OOB.

https : // www . dropbox . com / s / 1hyqee52a569ksr / nand_dump_oob.bin

**remove the spaces because it don't let me post links. I'm less than 10 post.

I also did a binwalk. It seen that both filesystems is encrypted :mad:

DECIMAL	HEX	DESCRIPTION
-------------------------------------------------------------------------------------------------------
2621440	0x280000	Roku aimage SB, Release ID: 153.1-2391 (0x99010957), Platform ID: Default, Type: initfs_cramfs, Image Size: 38203428 bytes, Encryption: cbc_4kblocks, Build Date: "Sat Aug 10 12:46:57 2013"
52428800	0x3200000	Roku aimage SB, Release ID: 152.8-6687 (0x98081a1f), Platform ID: Default, Type: uboot, Image Size: 475684 bytes, Encryption: None, Build Date: "Wed Sep 5 17:02:03 2012", Build Host: "neteng-build02.roku"
52953088	0x3280000	Roku aimage SB, Release ID: 152.8-6687 (0x98081a1f), Platform ID: Default, Type: initfs_cramfs, Image Size: 36802596 bytes, Encryption: cbc_4kblocks, Build Date: "Wed Sep 5 17:02:02 2012", Build Host: "neteng-build02.roku"
89755684	0x5599024	Roku aimage SB, Release ID: 152.8-6687 (0x98081a1f), Platform ID: Default, Type: uimage, Image Size: 2923908 bytes, Build Date: "Wed Sep 5 17:02:05 2012", Build Host: "neteng-build02.roku"
92679592	0x5862DA8	Roku aimage SB, Release ID: 152.8-6687 (0x98081a1f), Platform ID: Default, Type: firmware_blob, Image Size: 3208324 bytes, Build Date: "Wed Sep 5 17:02:05 2012", Build Host: "neteng-build02.roku"
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Also looking at the dump I see that 2nd bootloader is block 0 and another identical copy at block 12. This is the GPU boot code + firmware blob for the BCM2835 VideoCore.

I think what if we replace the 2bl with our code we could dump the 1bl bootrom inside the chip ultimately extract the keys that encrypt the filesystem. There is an UART TX and RX on the 20 pins custom header on the ROKU we could feed data through.

Not sure if I could do it but it worth a try. :fingers-crossed:
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Failed.:crying: I try to edit the 2bl but there is a 32 byte checksum in front of it. I flash the modded one it and it refuse to boot. Anyone got any idea what kind of checksum is this?

00000000 01 00 21 00 55 AA A5 5A 00 00 55 6C 24 C0 C9 28 56 3D E1 75 ..!.U..Z..Ul$..(V=.u
00000020 FA D5 3D A0 D5 F4 75 1E 47 BF EF 11 ..=...u.G...

And here is the 2bl: https://www.dropbox.com/s/ui2pzepdtvzflxp/2bl_bytefix2.bin

If you need anything tell me.

I'm out of idea now. I tried edit the channel zip file but it doesn't seen like a zip package at all. I did an statistic analyze on the file and it turn out that it's encrypted. I tried to command injection on everything I can find and all failed. I also try to poke around the SDK too but i haven't found anything yet.

Anyone got any idea what I should try next?
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
This could be due the the checksum before the 2BL. Exact what happen when I try to remove the checksum or modifies the data inside it.
[Upgrading, Modifying and Unlocking] corsasri:
Hi guys. My now tv just landed and got it working. Installed plex, then wanted to add youtube but find when i install youtube from above link it removes plex. so how do i install both apps onto the now tv.
[Upgrading, Modifying and Unlocking] DualTachyon:
The developer mode only allows one app at a time, if that's what you're using.
[Upgrading, Modifying and Unlocking] ArcticFox:
Is there no way of grabbing Roku apps using a PC to sideload using secret Dev menu, there are a few streaming apps but they all require you to login to Roku website to install.

Using latest Plex I haven't successfully streamed anything.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Nope all Roku app is encrypted nonstandard zip file. I already try that :(
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Found some interesting strings from the kernel image

mtdblock_open: %s, count: %d
%s: %s, erasesize: %d, sizeof(struct mtdblk_dev): %d
%s: badpos: 0x%08lx (count %d)
%s: increase in bad block count since first pass !?!
%s: Encrypted FS detected, iv[16] : %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
Updating Img Info
Img Info Valid
Failed to write img_info!
Encrypted Key: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
decrypt_img_key: aes operation failed !!

Here is the Kernel image: https://www.dropbox.com/s/7k3zl1jamm6uz8i/Image if anyone want to take a look at it.
[Upgrading, Modifying and Unlocking] tonyv2:
Hi

I have been looking at uboot source code for roku http://www.roku.com/uk/opensource (version 4.9 roku LT etc) which isn't complete (license on now tv mentions the above link for source code).The two files in the 4.9 roku are the same as the roku 3 uboot on same page.In /Roku3/u-boot/include/aimage.h describes the header structure which has a RSA signature (magic number's appears in 074.09E08061A a few times but in reverse byte order ).This is checked for the uimage in /Roku3/u-boot/common/cmd_bootm.c line 1314 however the cramfs is not checked

see line 1305. I have not fully followed the code but maybe we could load a fake cramfs over the stack space of uboot and use this to run code, another uboot? see http://xdaforums.com/showthread.php?t=2468659. I can't download xXhighpowerXx nand dump https : // www . dropbox . com / s / 1hyqee52a569ksr / nand_dump_oob.bin maybe you could reupload it .Another angle of attack is to find a vulnerability of the libraries listed on source code page

to create a png jpeg etc that we can load using a brightscript app see http://sdkdocs.roku.com/display/sdkdoc/BrightScript+Language+Reference

.

libzip-0.9.3.tar.bz2 http://www.securityfocus.com/archive/1/517065 has patch on roku source code page haven't looked at it

libpng-1.4.11.tar.bz2 http://www.libpng.org/pub/png/libpng.html

Will continue to search for vulnerability.

on page 5 of this thread wembley66 has uart boot log

UART initialized.

Jun 30 2011 11:27:29

Attempting NAND Load.

Attempting SDCard_Load.

SDCard_Load: 1

then in uboot section

MMC: bcm2708_mci: 0

http://www.raspberrypi.org/phpBB3/viewtopic.php?f=7&t=2540

whats going on here it seems to be loading from sdcard which it doesn't have.

videocore info (gpu of bcm2835)

https://github.com/hermanhermitage/videocoreiv/wiki/VideoCore-IV-Programmers-Manual

ps latest firmware available from http://firmware.roku.com/windsor/074.09E08067A prob should not updated but wanted to play with device.

Cheers

Tonyv
[Upgrading, Modifying and Unlocking] SlackR84:
The roku xd has an sdcard. The nowtv has the footprint on the board and could likely take one - if the method to boot from sd was worked out.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Check your PM :)

In the bootlog I see that it does check for the cramfs partition "Partition 1: Verify cramfs: Success"

I look at the kernel and seen nothing interested going on there

They used (AESCMD_DECRYPT | AESCMD_MODE_CBC | AESCMD_KEY_USER) mode which is the decypt using the user key. The key was loaded through R0 of the mtdblock_robbs_cache_load(C02A1ACC) function. mtdblock_robbs_open pass R0 to mtdblock_robbs_cache_load(C02A1ACC) then call AES decrypt. Trace back to mtdblock_robbs_open(C02A1D20) then I can't find anything referent it. :confused: Maybe someone can verify it.

Here is my nand dumper/flasher tool lol:
[Upgrading, Modifying and Unlocking] Whiterat:
Sorry all; not been on the forum for a while.

Replied to all outstanding PMs - good progress!