[Google Chromecast] ddggttff3:
WARNING: This should be the VERY VERY VERY VERY (Am I clear enough about this?) LAST thing you do to try and fix a chromecast. This can possibly fry a chromecast for good, so know going into this that it may not work!

Because of this, Me, XDA, and all other users are NOT RESPONSIBLE for any damage, problems, or issues that may arise from using this method. By using this tutorial, you agree and understand the above warning.

So, I had a Chromecast that I got stuck in "backupsys" boot mode, where it would try to boot the backupsys partition. Issue is, it would not boot, and you can't force it to boot from jumpdrive while it is in "recovery" or "backupsys" mode.

Well after tearing the thing down and getting UART setup, I started messing around, and found a way to FORCE the device to read from USB, regardless to the bootmode.

How this works is during the boot process, you jump 2 select pins on the PCB by the CPU, which causes the device to have a block read error while reading the system flash. When this happens, the device falls back into USB read mode.

Because this causes a read interrupt, it "MAY" have unknown effects on the longevity of your device, so like I said before, this should be a LAST RESORT OPTION ONLY.

What You Need:

Chromecast with Rootable Bootloader

Paper Clip/Needle to jump some TINY pins

UART hooked up to your computer

Jump Drive with the Root Image & USB OTG Cable

Process:

Step 1: Tear down your device, and have it hooked up to UART on your computer.

Step 2: Have the USB OTG Cable and Jump Drive with the root image plugged into the chromecast. Do not have it plugged into power yet.

Step 3: On the top side of the chromecast (Not the side with the UART Pins), carefully remove the RF shield to reveal the WiFi Chip and CPU.

Step 4: Have putty open and connected to your UART COM port. Also have "reboot recovery" in your clipboard. (Copy that command so you can right-click in putty to send it quick)

Step 5: Now, prepare to jump pin #26 (shown in photo below, marked with red square on right side of CPU) when you plug in the chromecast to power it.

Step 6: Plug in the chromecast power, and watch the UART output. Once the Chromecast LED turns read, use the paper clip to short pin #26 and you should get the following outout:

sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0

PG868: leakage=208 vcore=10 sysctl=59

Customer key found, loading customer key...

Loading Secure Customer Key Store is finished

Loading Secure Customer Key Store is finished

Finish loading Customer Key store

bootloader image verified, start...

eureka-b3 BG2CD [Jun 6 2013 12:07:51] ver:9086b04-dirty

OTP status=0x000000FF lkg curr=208 mA

nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!

[FASTLOGO] init.

[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start

showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0

[FASTLOGO] done.

fts: v155 loaded from 0x00268000

Read failed @ 0x7814c000

ERROR: Failed to read CPU image ret -1

Booting from NAND failed, booting from USB....!

timer_clk_freq = 0x47868c0

USB: Register 10011 NbrPorts 1

USB EHCI 1.00

scanning bus for devices... 2 USB Device(s) found

scanning bus for storage devices... 1 Storage Device(s) found

If you do not see "Booting from NAND failed, booting from USB....!", unplug the chromecast, and try again.

Step 7: The chromecast will now try and boot the Jump Drive image. During this, there will be a root shell hiding under all the output. You need to QUICKLY and repeatedly press Enter until you see "/ # " flash on the screen. Once you see that flash, QUICKLY press right-click so putty pastes your clipboard, and then press enter. If you do this fast enough, the kernel will run "reboot recovery" and restart.

Step 8: The device will now try to boot the normal recovery partition. This is fine, because even if it fails, the bootloader will detect this and reset the device to normal boot mode after a few power cycles. After a few power cycles, the chromecast should eventually show the following over UART:

sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0

PG868: leakage=208 vcore=10 sysctl=59

Customer key found, loading customer key...

Loading Secure Customer Key Store is finished

Loading Secure Customer Key Store is finished

Finish loading Customer Key store

bootloader image verified, start...

eureka-b3 BG2CD [Jun 6 2013 12:07:51] ver:9086b04-dirty

OTP status=0x000000FF lkg curr=208 mA

nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!

[FASTLOGO] init.

[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start

showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0

[FASTLOGO] done.

fts: v168 loaded from 0x0029c000

[SHOWLOGO] stopped

Boot normal GTV image

fts: record v169 commited @ 0x002a0000

Uncompressing Linux... done, booting the kernel.

And congrats, the device is now back to Normal Boot Mode! You can now hold the power button during power on to properly flash the rooted image, and your device should be good to go!

DEVS: If you want to help make this easier, can you make a USB image that just boots the kernel and stops at command line? Would make this process easier.

FAQ:

Q: Why do I need this? I can just hold down the button to boot from a Jump Drive.

A: This is true, but if a Chromecast is in any other boot mode besides normal, then it will be unable to boot from USB. This is just how the bootloader is coded. (I submitted a patch to google regarding this, even though it would never help us out thanks to the updated locked bootloader).

Q: Will this allow be to Downgrade/Root my device?

A: Answer is Probably not, even though this is untested. This is because the bootloader is still loading from the device, so it will still probably check the USB Drives image for a valid signature.

Q: I tried this, but my device still won't boot.

A: Well then there is probably not much else you can do, besides looking for a fix yourself. Remember, its a $35 dollar device so it may just be best to buy a new one.