yashsingh1/xdaforums huggingface dataset:
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Testing clock gen circuit. Preparing for clock glitching setup :D

The box boot up without any problem so that mean my circuit is stable and working. Next, I will hook it to an FPGA to introduce glitch to the signal and see what happen lol
[Upgrading, Modifying and Unlocking] glossywhite:
Please refer to my teardown of Now TV, for close ups:

http://www.youtube.com/watch?v=m8uvEhnFJ_U
[Upgrading, Modifying and Unlocking] jamesb1239:
Hi Guys,

Just starting to have a poke around at a now TV box and before I try to reinvent the wheel could anybody tell me of they have attempted to populate the microSD header on the underside of the HDMI port? And has anyone also had any luck in locating the relevant JTAG pins. Current thoughts bounding around in my head, 1. Has anybody attempted to replace the UBOOT? Did it boot (the uboot not the os). 2. Is there a way to modify the BCM firmware? JTAG? Would the RPi firmware/boot loader run?

Sorry if the questions are heading in completely the wrong direction, I haven't had much time to actually look into these ideas yet.

Thanks.
[Upgrading, Modifying and Unlocking] jamesb1239:
With regards to the SD card question, the port is dead, but this appears to be due to the fact that several components are un-populated. The NOW TV box looks to me to be extremely similar to the Roku 2 XS (a lot of people say the LT). I was thinking along this path as the UART output to me seems to indicate that the bootloader is looking for a SD card early on in the boot process, so maybe it is possible to provide it with an alternate boot image via that method.
[Upgrading, Modifying and Unlocking] Whiterat:
As far as I can work out; if the uboot image on the nand is valid it will boot that regardless of an sd being present.

Below are from testing; would be nice to know what the return codes from SDCard_Load are.

The stage1 loader is signed and the BCM SoC will check this signature; It's an HMAC sig (symmetric) so potential of recovering it somehow from the SoC.

We'd need to disassemble the stage1 bootloader (linked in previous threads) to see how well it validates the uboot image - I have a feeling it's a weak chain and only checks for the imgARMcc magic and nothing else.

Unfortunately it's videocore code; so we lose the luxury of IDA - there are a couple of diassemblers out there for videocore stuff but they're fairly young projects.

We might still have some other options, I'm investigating with xXhighpowerXx at the moment.

No SD:
..
Attempting NAND Load.
No SD Card.

Blank SD:
...
Attempting NAND Load.
Attempting SDCard_Load.
SDCard_Load: 3

SD with any valid aimage:
...
Attempting NAND Load.
Attempting SDCard_Load.
SDCard_Load: 4
[Upgrading, Modifying and Unlocking] leenukes:
I'm just watching this with great interest. I got a Now TV box as for £8 (with cash back from topcashback - http://www.topcashback.co.uk/ref/leenukes ) I thought why not. Its useful with Plex loaded onto it alone and its a viable media centre. I do have a Raspberry Pi running openelec but this is cheaper then buying another Pi.
[Upgrading, Modifying and Unlocking] jamesb1239:
Thanks for the reply Whiterat,

I'm quite new to all of this, but I do get a bit obsessive when something grabs my interest.

Like I said earlier, the SD card appears to be a no-go unless I can pick up a Roku 2 XS cheaply on ebay (possibly faulty) and obtain the values of the missing resistors on the SD data lines. Currently I have my NAND lifted (was to see where the NAND traces went) the traces disappear into via's, I suspect that these re-appear on the test points on the other side of the board which will make for more reliable/robust points to solder for reading/writing the NAND rather than soldering directly to the pins. The other thing that I will also be attempting is to trace out the points from the 20 pin header to see if there are any components missing along those traces, what made me think along these lines is that if you look on the FCC website for their submission of the Roku 2 XS, on one of the images 18 of the pins in that header are soldered to or have a header installed (can see the solder on the underside of the board) so my suspicion is that this was used during testing and may also provide JTAG or another debugging interface, that is unless you have already found JTAG? It is also possible that JTAG isn't enabled in the BCM.

I could just be wasting my time, but I enjoy the challenge anyway
[Upgrading, Modifying and Unlocking] DualTachyon:
Assuming you could access the jtag port successfully, it's very likely that the SoC will disable the on-chip keys. Meaning that you could run your own software but not decrypt and run the Now TV software.

It would still be useful of course but it probably wouldn't solve people's problems.
[Upgrading, Modifying and Unlocking] jamesb1239:
Running custom software isn't necessarily a bad thing, as after all the Now TV is essentially a raspberry pi without the Ethernet/USB due to the controller chip being unpopulated.

If the SoC could be accessed and the keys disabled, is it not also possible that another method of attack would be to recover the keys from the SoC. JTAG would also allow the debugging and stepping through/interrupting code as its running wouldn't it? As I've said previously I'm kind of learning as I go here so I may be completely barking up the wrong tree.
[Upgrading, Modifying and Unlocking] slimboyxxxl:
Perhaps I am missing something.

I don’t know anything about programming, as I am just about to demonstrate!

Why can’t we load the apps we need onto the nowtv box in the same way we did with the Plex app by slipstream?
[Upgrading, Modifying and Unlocking] leenukes:
Because it only allows you to load one app at a time. I expect it also is tightly restricted so not like you can load an app which allows apps to be loaded inside it.
[Upgrading, Modifying and Unlocking] jamesb1239:
If an exploit is found it is likely that in fact that is exactly what will be done as especially on the NOW TV there is no other medium for the everyday user to install apps. But without root permissions it wouldn't be useful due to the checks that the system imposes.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Anyone know where is the UART RX line on the Roku?
[Upgrading, Modifying and Unlocking] terracotta4:
I never managed to find it, and we're pretty confident uBoot can't be interrupted. When I have time, I'm modding a cramfs driver to read the root filesystem to see if there are any clues in there.

m4rkh .co .vu
[Upgrading, Modifying and Unlocking] tonyv2:
Hi all

info dump

chips

AK4430ET

dac http://www.akm.com/akm/en/product/datasheet1/?partno=AK4430ET

BCM59002 Power Management Unit

Resistance measurement of 20 pin header counting from left to right with header at top

bunch of pins seem to be connected to common thick track hence guess vcc taking gnd from hdmi housing

1 top r23 33 ohm ,33ohm relative vcc ,0.38mega ohm r gnd : maybe voltage ref for voltage follower

2 top both high R104 33 OHM VC_TDO? following trace on SlackR84 depopulated board photo

3 top 10k pullup

4 top 10k pullup

5 top pulldown 10k

6 top gnd

7 top high ohm above range both

8 top 16mega ohm both

9 top conencted direct common ?vcc taken as vcc in in rest of measurements

10 top 1.5 mega ohm vcc 1.2 mega gnd not sure how this can be reset with no pullup pulldown see below

1 - 3 bot 10k pullup

4 bot 10k pullup r21

5 bot 10k pullup r105 10K

6 bot high rel gnd > 10mega ohm rel vcc wembley66 guessed this was gnd

7 bot > 10megaohm rel vcc high relative gnd TX

8 bot 10k pullup high r gnd

9 bot high r vcc ,high r gnd

10 bot gnd

the 10k pullups (pulldown) are likely to be inputs (stop them drifting )

bcm2835 has programmable pull (ups downs) 50k - 60k http://elinux.org/RPi_Low-level_peripherals#Internal_Pull-Ups_.26_Pull-Downs

so those high impedance pins maybe inputs after software configures them

doubt this would happen with jtag at least initial jtag (videocore jtag assuming boot is same as rpi)

SlackR84 pics https://www.dropbox.com/sh/j0dcht8u6unghi7/14F6NdQq7c

note; below different orientation

wembley66 findings

"Orientation is with this connector to one's left.

I've found the UART TX - on the 20-way header - This is what I have so far, cheap multimeter, so do not take as gospel -

Reset GND

3.19V 5V (Supply voltage)

2.3V 3.16V

0V TX

GND GND

N/C 0V 3.16V

3.16V 3.16V

3.16V 3.16V

3.03V 3.16V

VCC? 3.19V 3.16V

U-Boot speed is 115200, 8 bit, no-parity, 1 stop bit."

bcm2835 pinout

http://elinux.org/RPi_BCM2835_Pinout

BCM2835 GPIO functions

http://elinux.org/RPi_BCM2835_GPIOs#PCM_DOUT

gleaned from aabove two pages

TXD1	GPIO14 D4 GPIO32 G7 GPIO40 B9

RXD1	GPIO15 E2 GPIO33 B6 GPIO41 G6

TXD0	GPIO14 D4 GPIO32 G7 GPIO36 C7

RXD0	GPIO15 E2 GPIO33 B6 GPIO37 E6

maybe SlackR84 could check continuity / resistance between these pins and the header

there might be resistor < 400 ohm between pin and header to limit current in case of voltage missmatch

xXhighpowerXx clock glitcthing looks fun. Are you going to try and glitch the rsa part?

Have you read this paper http://eprint.iacr.org/2012/296.pdf it uses differential power analysis to find aes key of fpga in 0.01 secs .Same guy found backdoor in proasic3 used in military hardware.Not directly applicable as he can get the crypto function to use his supplied keys to perform differential analysis.

coresponding patent

http://patentscope.wipo.int/search/docservicepdf_pct/id00000017065074.pdf?download

Tony
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Thank for the information :) but I'm just try to glitch over the HMAC checking part so I can load in my code then I can run anything I want after that. I haven't finish my Verilog for the FPGA yet. Any help would be great.
[Upgrading, Modifying and Unlocking] tonyv2:
Hi what help do you need did a bit of verilog before.Whats your strategy use uart to find approx no clock cycles to insert glitch and then search.

Should start soldering myself but find small soldering difficult maybe i should build a usb microscope with my ps3 eye as latency is suppossed

to be low .Tried before with another webcam but latency was a big pain.

have more refs

this is particularly detailed

An In-depth and Black-box Characterization of the Effects of Clock Glitches on 8-bit MCUs

http://www.cosic.esat.kuleuven.be/publications/article-2059.pdf

Xbox 360 hack reset glitch with slowed down clock

http://www.free60.org/Reset_Glitch_Hack

I am not sure how easy clock glitching is going to be as there are PLL's in the bcm2835

see http://forum.hwbot.org/showthread.php?t=81294

also talks about voltage regulation done onboard bcm2835

can been seen on schematics of rasberry pi for (maybe voltage glitching?)

http://www.raspberrypi.org/wp-content/uploads/2012/10/Raspberry-Pi-R2.0-Schematics-Issue2.2_027.pdf

L5 and c16 (top right of second large bcm2835 blob on page one) could be external circuit for switch mode for vcore

Difficult to see how a glitch is going to get through to vco through the low pass filter after phase detector in PLL( though am no expert on analog electronics) .

Maybe i should run a spice model of typical pll and see if i can push the glitch through.

Though this page http://nagra3.angelfire.com/ (have not read all just read conclusion talking about PLL)

may give some hope as it talks about "loosely coupled PLLs and edge barriers against clock glitch attacks"

as countermeasure.Not sure what a loosely coupled PLL is but maybe we haven't got one.

Cheers tony
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
When the SOC boot up it start out slow 1:1 or (19.2 MHZ) then after it load the bootcode in nand flash it will switch over to high speed clock. So I think that clock glitching is possible.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
SUCCESS!!!!! Finally
[Upgrading, Modifying and Unlocking] leenukes:
Great, although it sounds like this isn't going to be a "user serviceable" method of doing it. Not if you need a whole electronics lab. Well done though.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
It's a hardware method. You will need a NAND programmer. Once I finish cleaning up the code then I will post it here :laugh:
[Upgrading, Modifying and Unlocking] ArcticFox:
Sorry for being an ignoramus, but success at what?
[Upgrading, Modifying and Unlocking] SlackR84:
Happy to test on the Now TV I have sitting here.

Good work btw
[Upgrading, Modifying and Unlocking] leenukes:
I'm guessing at loading the Roku firmware on his NowTV box.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
You can run anything on the ROKU. It can run any unsigned Image. I'm still working on cleaning the boot loader.

I will release soon :)
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
sorry
[Upgrading, Modifying and Unlocking] jamesorlakin:
Would it be possible to run OpenELEC or Raspbmc on the now modified box? These distros are designed for the Raspberry Pi which has the same chip as the Now TV box apparently has and could be used as a starting point for an XBMC port.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
I patched U-boot and got the DEV image boot. But still it still show 6666666666 on UART.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
YAY Root shell :laugh:

UART PIN:

Reset	GND

3.19V	5V (Supply voltage)

RX	3.16V

0V	TX

GND	GND

N/C 0V	3.16V

3.16V	3.16V

3.16V	3.16V

3.03V	3.16V

3.19V	3.16V
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
del
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
tonyv2,

For the NAND programmer, this might help you: http://www.psdevwiki.com/ps3/Teensy_2.0++ (will work with little code changes)

it very easy, everything you need is in the NAND datasheet. I write my own NAND programmer using Arduino. If you want it let me know. Make sure you used 3.3v logic level.

And for the AES, I tried to decrypt it but it just output garbage. I think that key is for HDCP only because they named "OTP_HDCP_AES_KEY". I'm not sure.

Also in my experience with the Roku GPL, It's not 100% correct compare to the binary in system.

Thank for the information btw. :good:
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
AES key found

Now we need to extract the cramfs :victory:
[Upgrading, Modifying and Unlocking] pickup9785:
Can somebody explain to me in simple terms where this development is up to ?

Thanks
[Upgrading, Modifying and Unlocking] SSThing:
http://www.xbmchub.com/forums/lounge/10450-now-tv.html

Someone here claiming to have done this already, but no details, so probably false.

Cheers

SST
[Upgrading, Modifying and Unlocking] ArcticFox:
Have people stopped working on this then?
[Upgrading, Modifying and Unlocking] zacy5000:
[MENTION=3597813]xXhighpowerXx[/MENTION] Could you post how you got Roku firmware on the NOW TV box please? Thanks.
[Upgrading, Modifying and Unlocking] YylowprofileyY:
Any info please?

I would also like to know however my PM's have gone unanswered so it looks like this is the end of the thread unfortunately
[Upgrading, Modifying and Unlocking] moka88:
Any update on this? It would be amazing to get rid of the limitations.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
We gonna release it soon. Join us on our irc channel at irc.freenode.net #gtvhacker or at freenode webchat

Follow us on twitter [MENTION=470600]GTV[/MENTION]hacker
[Upgrading, Modifying and Unlocking] SSThing:
I cant find any mention of the NowTv box, any chance of a pointer/link please?
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
I still waiting on the NowTV box to arrive. Not sure when it gonna arrive or never lol. But it should work on every Roku box with the same SoC BCM2835. We almost done with it. It should be out very soon. Check our twitter channel: https://twitter.com/gtvhacker
[Upgrading, Modifying and Unlocking] gtvhacker:
Roku

12/28/2013 13:37 PST #Roku goo.gl/Fva3wI
[Upgrading, Modifying and Unlocking] SSThing:
Are you saying this will work on our NowTv boxes?

And more importantly, in simple terms, what does it do? I am assuming it means our boxes can be flashed as Roku2, am I correct?

And most importantly, how does one apply this method?

I have read the webpage several times and cant figure it out?

Thanks

Ok, IE11 doesn't play nice these days! Went in through Chrome and found the Wiki and it says

THIS DOES NOT WORK ON NowTV devices (Check "Other" section of this page for details)

:(
[Upgrading, Modifying and Unlocking] akufu:
If you work for Sky's NowTV development team or Roku then we want to hear from you regarding the further rooting / hacking / jailbreaking of Sky's NowTV box.

It is CONFIRMED that the above method doesn't work on NowTv and is unlikely to work in the future.

Take a look here: akufu.com/nowtv-box-jailbreaking-rooting-hacking/
[Upgrading, Modifying and Unlocking] darren1:
Is it possible to extract Roku channels from a rooted Roku? I was wondering if channels could be extrcted in .ZIP format and sideloaded onto a Now TV box with developer mode enabled?
[Upgrading, Modifying and Unlocking] akufu:
Sadly not. Roku sends these files to your box encrypted then the Roku box compiles the software.
[Upgrading, Modifying and Unlocking] SSThing:
Looks like this is dead in the water then?
[Upgrading, Modifying and Unlocking] demonik666:
yes if you root your roku all channels is unzip on /tmp/xxxxxxxxxxx etc the `xxxxxxxxxx` is hash from zip file when install, but is there unziped(source code).:laugh: you can try, this is all you need to rezip on now tv developer mode.
[Upgrading, Modifying and Unlocking] xXhighpowerXx:
Video worth million words :)

http://youtu.be/XCVdG4al-rc
[Upgrading, Modifying and Unlocking] SSThing:
That's all well and good if I want to tear my NowTv box apart and attach a load of wires. What we are hoping for is a software based solution, otherwise, for all the effort involved I may aswell buy a Roku original.

Thank you anyway.:)
[Upgrading, Modifying and Unlocking] upandcumming:
Any chance of a software based exploit arising from this work?
[Upgrading, Modifying and Unlocking] madmidget1983:
progress ???

hi was wondering if there had been any progress on the work being done on the now tv box exploit or even a rough time scale cant wait to unlock its true potental
[Upgrading, Modifying and Unlocking] digitaly:
SlackR84! I'm following a similar project! I'm using willem programmer with tsop48 . But I have not yet lifted the NAND.

I need to ask!!! what SDK package are you using to extract the dump?

Have you tried Broadcom Studio (if know where to get it)?

Could now tv have a different bootloader ?

Have you tryed to manipulate the mac address of the unit as see if it boots?

Sorry for the noobbish questions.
[Upgrading, Modifying and Unlocking] glossywhite:
NOWTV UART boot sequence:

[YOUTUBE]w31EkrAKyec[/YOUTUBE]
[Upgrading, Modifying and Unlocking] upandcumming:
So is there any update to rooting/installing alternative software?
[Upgrading, Modifying and Unlocking] vindassius:
Hiya,

i too had an issue getting access to the nowtv developer section from my pc to install plex - i worked out that it was my virgin superhub v2 that was causing the issue..

the nowtv take the x.x.1.x prefix and virgin prefer the x.x.0.x prefix for the address ranges - there is a way to change that -

let me know if you have a superhub and i'll let you know how i did it :)

V
[Upgrading, Modifying and Unlocking] Jakey46:
linked to roku account

So after playing with the secret menu you said about i changed the channel store to "api.staging.roku.com" then went to the channel store and was greeted with a first time message then an account link code for roku site. so tried my roku account and it didnt work but then deactivated my account and went to the link it gave me "https://owner.staging.roku.com/link" and the link worked and was able to create an account and get it linked only problem was that it seemed to be some sort of test version of the site with restricted features mainly that you cant use it to install apps to the now tv box. now this might seem a little useless to me and a few others but maybe someone can find a flaw in this also i will continue playing with the secret menu and roku accounts etc hopefully we can make the nowtv box something useful for £10
[Upgrading, Modifying and Unlocking] TylerDurdenK:
How did you get on? Any advances?
[Upgrading, Modifying and Unlocking] tommy2006:
​

Hi I also have this problem with the superhub 2 can you please let me know how to get around this. Thanks
[Upgrading, Modifying and Unlocking] vindassius:
Hiya, sorry about the delay - do you still need help?

basically you have to be hard wired into the superhub on a laptop/pc - you change the ip ranges from 192.168.0.1 to 192.168.4.1 it will throw the worlds biggest paddy when it reboots - but you log back in and change the ip range again from 192.168.4.1 down to 192.168.1.1 and let it all reboot - this is the steps I took not sure if I changed the 4 for an 8 but once its set at 192.168.1.1 you will then need to add your nowtv box to the network and you can then remote in to add apps :)

Vinda
[Upgrading, Modifying and Unlocking] hudsonh411:
now tv roku lt firmware

you don't need to flash the box with the roku lt firmware as the box already runs the latest roku firmware by automatically updating from the roku store the now tv box and roku boxes are both the same thing as roku custom make the now tv boxes for sky now tv is basically running on the back of the roku service and you watch the nowtv sky channels using the now tv app the rest of the services come directly from roku the only thing stopping you is the serial number of the now tv box when your now tv box connects to the roku server the box identify's its self by the serial number that is imprinted on the box as does the roku boxes that is what separates these boxes it is like an access control list it is all to do with the syntax of the serial number of the now tv boxes start with (1MK Or 1M) and the Roku Boxes serial numbers start With (1SE Or 1S) and basically when the boxes connect the server checks the serial number of the box and if it starts with 1MK it goes to the now tv side of the network were anything on that side of the network is controlled by sky probably through some specialist software or fancy network config and any boxes that have a serial number starting with 1SE will go to the roku side of the network i came close to successfully accessing the roku side of the network with my now tv box but fell short when their server checked the serial number of my now tv box it is like the serial numbers act like some sort of fancy mac address filtering or access control list and i think once you get around the serial number authentication you will be able to use the app store on the now tv box to access the app seore for the roku boxes as they both use the same app store server address a*i.roku.com there are several different appstore server addresses but all go to the same app store servers. enough said as sky / now tv may now change things as i have just told you.........:cool:
[Upgrading, Modifying and Unlocking] TylerDurdenK:
Interesting as it is, surely that information is only useful if we can change the serial number of the Now TV box. Is that possible?