yashsingh1/xdaforums huggingface dataset:
[Google Chromecast] BurnOmatic:
correct and its not till you put the eureka_image.zip back on the flashdrive and flash that, to the Chromecast is when things change.
[Google Chromecast] ahecht:
Is there a mirror? When I try to download, it says "Temporarily Unavailable"
[Google Chromecast] Bajanman:
Here ya go... hope it helps:D

https://db.tt/clInAbwW
[Google Chromecast] ahecht:
Thanks, that works!
[Google Chromecast] Bajanman:
Your welcome!!

Glad I could help...O0
[Google Chromecast] iandroo888:
since it says 13300 OTA rooted/adb enabled, does that mean build 13300 can be changed to flashcast now? if yes, im gonna consider buying that OTG cable
[Google Chromecast] tchebb:
Unfortunately, stock 12072 is still the only build which can be rooted. This mod lets people who have already rooted their devices to update to 13300 without losing root.
[Google Chromecast] iandroo888:
sad yet again =[
[Google Chromecast] morchu:
Folks,

It seems like the update_engine is doing more than just updating bootloader/system/boot images on local chromecast device. It appears to be used by google for its logs, some of which are needed for whitelisted chromast devices (I have no proof, but it seems logical). I had issues with my whitelisted developer chromecast to recognize its developer receiver application, with the disabled update_engine shell file. And after reading somewhere about the need to enable sending device serial number along with update request, I figured, it probably need the original update_engine. I replaced the original update_engine and used the below method to disable updates and my developer chromecast started fetching develiper receiver applications perfectly. By the way this may not be much of a concern for most folks, since currently it affects only developer apps and whitelisted devices. But I could see this being used more for other device specific cast services.

Now to the point. Because of the above reason, I think it is probably better to make the update fail, rather than removing the capability of update request completely. One of the best ways I can think of is remount /cache partition to tmpfs and to be very small.

For example from the updated clear_crash_counter script...doing the below will do the trick.

=========================

/bin/busybox umount /cache

/bin/busybox mount -t tmpfs tmpfs -o size=1M /cache

=========================

Since the cache partition is so small, if there is any update it will just fail completing download. Even if the download succeeded you wont have it updated, since on a reboot (which is needed for actual update), you will just loose all the download.

I can still see some risk for the above method. But we can improve the above idea a bit more to make it more robust (like catching failure of umount/mount commands and having backup commands etc). But would to get thought process from other folks, who had been digging with this little device for a lot longer than me.

-morchu
[Google Chromecast] tchebb:
Would you mind PMing me the serial number of your whitelisted device? I have a Chromecast image set up to debug and reverse-engineer update_engine, and if I can spoof its serial number to one which is whitelisted, I can see what it is that update_engine does to signal content_shell that the device is whitelisted. Then it should be fairly simple to write a program which does the same thing without having to have update_engine there at all.
[Google Chromecast] drawde40599:
THANK U

I just bought another Ccast because my first one was already updated months ago , and new one had Vulnerable software :) your "Hack" worked fantastic. Thanks to everyone involved much appreciated !
[Google Chromecast] paracha3:
May I ask where did you buy from? Amazon?
[Google Chromecast] drawde40599:
Yep , last week
[Google Chromecast] paracha3:
Great I bought couple days ago too from Amazon so hopefully it will be hackable like yours.
[Google Chromecast] drawde40599:
When u plug it in it will try to update as soon as it has a WiFi connection , so u can't see if its the right software version, just unplug and start the "hack" if its right it will work flawless if its not then "hack" fails, pretty easy . good luck:). Dev added a new boot animation so ull no if it worked
[Google Chromecast] SubaruCop:
I updated mine without plugging it in the tv first.. It was nice to see the "Pwned" icon when I fired it up for the first time.
[Google Chromecast] bhiga:
Yes, best bet is to update with Flashcast before you even set up its wireless - that way it has no way to auto-update.

Of course you probably should boot it once normally to make sure it is working before you go voiding the warranty, just don't go through the setup. :)
[Google Chromecast] morchu:
I think it is already discussed here "http://xdaforums.com/showthread.php?t=2450120"

And the change should be happening at server side (at google side), for device specific servicess. So I dont thik you will find anything more on client side. Means it should be same for a whitelisted or nonwhitelisted chromecast device.

https://developers.google.com/cast/whitelisting

Even on the above link read the step 3 "Under Privacy, check the box to Send this Chromecast's serial number when checking for updates. You must enable this option in order to whitelist your receiver device". So this makes me think the server side update for whitelisting happens only on an update request with the specific serial number.

Similarly (similar to white listing) there could be other device specific services which are affected by update request.

By the way, I am hesistant to share my serial number, since my receiver side app is published at a qa page with not much security, and the only security in place is the device serial number. But it is pretty easy, and FREE to get your own chromecast whitelisted by folowing https://developers.google.com/cast/whitelisting.

-morchu
[Google Chromecast] tchebb:
I understand your concern. I've applied to have my own device whitelisted, so hopefully I'll be able to make some progress in this area soon.
[Google Chromecast] hidroela:
just bought one of this litter bad boy from amazon two days ago (10/16/2013) followed the instructions and make my own cable and boom "Pwned"

thanks a lot for this hack

best regards

HP;)
[Google Chromecast] Lpuboy87:
I am trying to do the setup as its mentioned. The problem I am having is when I try to boot, on my tv I just get the 3-4 dots on the screen when trying to flash flashcast the first time before I can put the eureka file. I read in other threads other people had the same issue. Any ideas ? :confused: checked my CC its on 12072 firmware out of the box
[Google Chromecast] ddggttff3:
How did you install the flashcast.bin file? are you on windows or linux? have you tried a different jump drive? what OTG cable do you use?
[Google Chromecast] Lpuboy87:
followed the same method as other people used in Windows using the win32diskimager program. Should I try through Linux? setup I am using is chromecast - to a 4 port hub flash drive in other of the port on the hub....hub has its own power supply that it comes with that I plug in.
[Google Chromecast] ddggttff3:
some people have not had success with using the USB hub, so you may want to look into getting a USB OTG cable with separate power. Also, try using a different microUSB cable that plugs the chromecast into the hub.
[Google Chromecast] msalloum26:
Hello , i'm not sure what went wrong, but i damaged 3 USB drives till now. I'm extracting the .bin file into the c:\temp\ folder then using Win32DiskImager.exe to write the file into the USB while choosing c:\temp\flashcast-1.0.bin for "image file" and E:\ for the device.

However when trying to flashcast (using the method mentioned), chromecast boots with white led for few seconds then stay red and never changes.

am i doing anything wrong ?

thanks for the help.
[Google Chromecast] tchebb:
I'm not sure what you mean by "damaged." It's impossible to permanently break a USB drive using WinDiskImager. If your drive becomes unreadable and you can't get FlashCast to work, you can simply reformat the drive from within Windows to restore it to its original state (albeit without any files).

Do you see the FlashCast instructions screen on your TV? If you do and the LED is red, the drive should be readable from within Windows and you should be able to copy mods to it. If you don't see the instructions screen, you may not be connecting your Chromecast to the USB drive correctly. Re-read the FlashCast instructions and make sure you're using a suggested configuration.
[Google Chromecast] msalloum26:
Hello, thanks for your reply.

i tried reformating the USB after failing to flashcast, without any luck. Windows 7 says :

You need to format the disk in drive E: before you can use it.

if i choose to format, it ends up with :

Windows was unable to complete the format.

Note that capacity is always 4.00 KB (i thought this behavior is strange)

As for flashcasting, i'm doing everything as per the instructions. I have My OTG cable connected to the chromecast and pressing the button on it and finally plugging the power. Hence the led led stays as is and never changes.
[Google Chromecast] drkaosdk:
Same here... Anyone that can make a YouTube video maybe? Showing How it works? 12072 ver. Here aswell, but still didnt get it workin..
[Google Chromecast] ddggttff3:
re-read the flashcast thread. That is normal. After flashing the flashcast image, unplug the jumpdrive from the PC, and boot it on the chromecast. When the chromecast reboots, then you can plug the flashcast jumpdrive into the PC to add files to it to flash.

the first boot of flashcast is used to expand and format the fat32 partition to the full size of the jump drive, that is why you must boot it before you can use it.
[Google Chromecast] msalloum26:
It worked with me, turned out I was on 13300. I had to flash my other CC without connecting it to the Internet.

Working great now!
[Google Chromecast] YellaHayes:
ive read and re-read these posts but i just do not get the point of flashing anything on Chromecast.

I'm all for a custom rom, which i also cant find, but what will it allow us to do.

I would think the obvious would be to playback local media but i dont see anyone saying anything about that.

help....
[Google Chromecast] ddggttff3:
Right now, the main reason to flash your chromecast with an image like this is to keep the exploitable bootloader for future development. Trust me when I say there is quite a bit of work being done behind the scenes.

For custom ROMS, I have something in the works, but I don't want to say too much yet. ;)

Until then, or until other users start making custom images, the best thing you can do is flash an image like this which keeps you rooted, and prevents googles OTA updates.

As for the local media playback, as mentioned in multiple threads, the issue is it was blocked on google's side, and until they allow it, there really is not too much we can do.
[Google Chromecast] msalloum26:
Personally i was interested in Flashing because CC uses google's DNS by default hence i can't use netflix from outside the US; therefore i had to change the DNS to make use of it.
[Google Chromecast] YellaHayes:
Thanks for the insight. I am still going to hold off until local media playback is official. Or Koush can finally release his.
[Google Chromecast] trock62:
I am having the same problem, what did you do to fix this. :confused::confused:
[Google Chromecast] ddggttff3:
Try another jump drive device, some have mount issues. This issue should be fixed when the next version of FlashCast is released. I am guessing this is the issue you are having.
[Google Chromecast] byt3b0mb:
wondering if any progress has been made to mod a recently purchased chromecast - i suppose im three otas from the vulnerable bootloader build.
[Google Chromecast] Kyonz:
I had a question around this, I understand that it's blocked on googles side but aren't applications just allowed through a chromecast lookup of https://clients3.google.com/cast/chromecast/device/config

Would it then be possible to just redirect the query to pass a device access to applications coded outside of googles whitelist? (or I'm guessing this wouldn't work due to certificate issues on https? and if that is the case surely there will be somewhere we can hack in a dodgy cert on rooted builds?)

Couldn't I just throw a cert for my own CA into \system\etc\ssl\certs on the image and then start serving my own list of approved apps to it?
[Google Chromecast] ddggttff3:
Yep, the issue is with certs and the fact it uses https, so right now thats not possible, unless we can force the chromecast to accept an unofficial certificate.
[Google Chromecast] Kyonz:
Alright,

I've injected a cert into the chromecast and have run it through a man in the middle server - I'll see what I can do with this thing. :)
[Google Chromecast] tchebb:
Unfortunately, although adding a new CA to the OpenSSL cert store allows you to sniff update_engine's requests, content_shell uses NSS which has its own cert store so it will still reject any MITM attempts. I've attempted to modify the NSS certificate store, but it appears to be password-protected and there is no documentation I can find on how Chrome determines the password. I'm sure you could find it if you put enough time into it; I just haven't had the chance yet. If you make any progress, I'd love to hear about it.
[Google Chromecast] pcspecialistpdx:
Darn, I did an OTA update when I first got my Chromcast
[Google Chromecast] tvall:
Maybe try hex editing content_shell and changing the URL it fetches the config from? Or recompiling it if we have the source? (I have not looked at anything but bootloader and kernel. Not sure what else there is)

Just an idea. Hope its that simple, but who knows.
[Google Chromecast] ddggttff3:
I tried hex_editing the URL, and it caused content_shell not to run. As for source, it is out there, but there are some files that are not in the source due to license issues.

https://code.google.com/p/chromecas...um&r=5c247cae16db647f5c9699964df39248464bbdb2
[Google Chromecast] Kyonz:
The NSS certificate store is password protected (you're correct), however you can just replace it entirely with one you create and the chromecast device appears to use the new NSS store. I replaced it and was able to MITM the google traffic perfectly!

Also the NSS cert store currently included only holds a single cert which is the google one, so replacing it you can give it your own and the google one if you wanted with no issues.

I'm happy to assist with getting this working, or can provide a dump of flows if needed (however I don't want to upload those for all as they may contain identifying information of myself or my device).

---------- Post added at 08:00 PM ---------- Previous post was at 07:38 PM ----------

Sorry just to help with the above bit, I've dumped out the nssdb I created and the certs (including private key) if you wanted to use them.

https://mega.co.nz/#!05wmDR4T!OMkBXwfO9D1wktt2bQpSwjNZ_Y9PB8q_Ryk3zSx4k1c

and an image of what I'm seeing http://i.imgur.com/gpLormX.png .

And traffic being intercepted going to youtube for casting [Removed as I realised it had my IP and such in it]
[Google Chromecast] morchu:
This is excellent. This will eventually make a totally open chromecast possible.
[Google Chromecast] tchebb:
Wow, this is great. I guess the next step is to get an HTTPS MITM proxy running on the device itself so Fling can work and non-whitelisted devices can use unofficial apps. I'm not sure how hard it'd be to get Python running on the stock OS for mitmdump, but I'll work on it.
[Google Chromecast] ddggttff3:
Just posted my new ROM over at http://xdaforums.com/showthread.php?t=2515799, so consider this one "outdated".
[Google Chromecast] TenderloinShadow:
ok, so I just got a chromecast, set it up, downloaded the update, and then learned about this root method. Is there anything I can do now that I'm up to date firmware with a locked bootloader, or am I SOL?
[Google Chromecast] bhiga:
Sorry you're SOL until another root method is released.
[Google Chromecast] wptski:
What build did it update to? I read that there was an update being pushed out now.
[Google Chromecast] oxknife:
Flashcast1.1.1 was installed successfully(Step 1). Then I formatted the usb drive and copied eureka_image.zip to it. I just realized I was wrong. Can I do the step 1 again? Will re-install Flashcast1.1.1 brick the chromecast?

Or is there any other way to build Flashcast jump drive?
[Google Chromecast] bhiga:
Write the FlashCast .bin file to USB stick via dd (Mac/Linux) or win32diskimager (Win)

Unplug power from Chromecast

Plug powered USB OTG cable into Chromecast without power connected (don't connect power to OTG cable yet!)

Plug FlashCast USB stick into USB OTG socket

Connect power to OTG cable while holding down the button on Chromecast until you see the FlashCast screen (in some cases it may be necessary to hold it down the entire time until reboot).

Wait until Chromecast reboots

Remove the USB stick

Plug USB stick back into your computer

Copy your desired firmware or mod to the USB stick (it should be labelled FLASHCAST) as eureka_image.zip (rename as necessary, and for Win make sure file extensions are not hidden)

Unplug power from Chromecast

Plug USB OTG cable into Chromecast

Plug FlashCast USB stick into USB OTG socket

Apply power while holding down the button on Chromecast until you see the FlashCast screen (in some cases it may be necessary to hold it down the entire time until reboot).

Wait until Chromecast reboots

Video for above is here.

Steps 1-6 only need to be done once until a new FlashCast update is released.

Steps 7-14 must be performed to flash a rooted firmware with stock OTA updates disabled such as PwnedCast to Chromecast, or you will still be auto-updated and lose root.

After you have a rooted firmware that doesn't get stock OTA updates you are safe from being un-rooted by any stock OTA updates, now you are safe to add any additional mods or new firmware (PwnedCast auto-updates itself so you shouldn't need to worry about updating PwnedCast unless you're the impatient type and want an update as soon as it's released).

Steps 7-14 need to be done for each firmware or mod you want to flash to your rooted Chromecast.
[Google Chromecast] oxknife:
biosuage capitu

Thank you bhiga! Everything is great!
[Google Chromecast] androidjes:
Quick Question, since I read all 12 pages and didn't see my answer..

I just rooted the CC and when I first hook it up to the TV I get the Pwnd Logo.. Woohoo..

Then it jumps to a "set me up" screen and to go to google.com/chromecast/setup and lists my setup name, do i follow these steps as requested?
[Google Chromecast] bhiga:
Yes, setup in PwnedCast is the same as for stock.

Sent from a device with no keyboard. Please forgive typos, they may not be my own.
[Google Chromecast] zippeurfou:
not working :(

Hey,

So I just bought a chromecast with SN 3920 which is supposed to be good.

I put flashcast 1.1.1 with win32 on my usb stick.

Then I plug my cable to power, to my usb stick and I hold the button and I put the chromecast.

When it first start it is kinda pink and 1 second after it become red.

I can see the usb stick booting and reading. Then it stays idle.

The chromecast light stays red and nothing happen.

If I redo it without formating the usb drive. It'll have the same start except it'll read the usb drive, become idle and then the usb drive start reading again and stay idle forever. No matter what the LED light stays red.

Is this normal or do I have a non rootable chromecast ?

Best,
[Google Chromecast] bhiga:
If you have another USB stick, I would try that. The behavior sounds like what happened when one of my USB sticks went bad.

Also...

How long did you hold the button?

Do you see the FlashCast screen appear on the TV?

If you plug the USB stick into your computer, does it mount as a volume named FLASHCAST?
[Google Chromecast] zippeurfou:
Thank you for your very fast reply. I do hold the button during like 5 min and nothing happen. When I put the USB stick to the computer (not chrome cast) the name is not flashcast. I removed the volume and reformated the USB stick. Still same thing when I try to transfer flashcast.bin. I tried with another and still same issue I'll try with a third one and let you know.

EDIT: I don't have the flashcast name on my usb stick when i mount it. It asks me to format it as if nothing happen. Tried it on 2 usb drive doing exactly the same thing as the video. not working at all so far :(

EDIT2: tryied with a third usb stick still same thing. I put the flashcast1.1.1.bin in the usb key (write), eject it, plug the usb,the chromecast hold the button while plugin the power, keep holding the button, the chrome cast led blink from pink to red and the usb key start reading then the usb key stop reading/writting and become idle and the chromecast led stay red. I wait two more minutes holding the button but nothing happen. When I plug the usb key it asks me to format it. :(

Edit3: Here is exactly what I am doing I might do something wrong.

1) plug in usb key to computer running windows 7

2) do a quick format to fat32

3) run win32diskimg to write into the usb key the flashcast1.1.1.bin from github

4) right click on the usb volume and eject it

5) plug the usb stick and the chromecast

6)hold the button on chromecast while plug in the power supply

7)keep holding the button during at least 2 minutes (in fact till the usb key stop blinking and I wait 1 to 5 more minutes)

8) the led on the chromecast didn't change (still red) but I got tired of waiting (and bored it doesn't work :() so I unplug the power supply (or chromecast) and plug into the computer

9) the computer ask me to format it as if nothing happened

10) I go to 1 and try again and again.. (except I use gparted first to delete everything)
[Google Chromecast] bhiga:
It looks like you are going through the procedure correctly.

Two possibilities remain...

Either this Chromecast has already updated its bootloader (if it has been set up and connected to the Internet already, this is probably the case), or your USB OTG cable is not functioning properly (please describe your connections and cable).
[Google Chromecast] zippeurfou:
I'm using the cable you advise on amazon to buy.

I don't have a tv right here to read my chromcast version but it was sealed correctly, never connected to anything before (not setted up) therefore no chance to have downloaded another ota and the SN was supposed to be good. I guess I got unlucky :(
[Google Chromecast] Dirty Engineer:
zippeurfou - You might try using several different usb sticks. I had to try a couple before I got one to work.
[Google Chromecast] bhiga:
I bought all mine from eBay.

What is your Chromecast's serial number?
[Google Chromecast] zippeurfou:
Bought the chromecast from one bestbuy store in nyc.

SN is 3920101Z2...

Edit: anyone know a cheap usb stick that work for sure ? Therefore, I can test it knowing it is not the usb stick that is at fault.
[Google Chromecast] bhiga:
3920 should be OK...

I have this old Patriot one.

This even older Emprex one worked great too, until it died.

I recently used a Sandisk 2GB cruzer micro and it worked fine too.

Do you have a link for your OTG cable?

Also, when you hold down the button and power Chromecast, do you see these dots on the TV?
[Google Chromecast] zippeurfou:
This is the otg cable.

I didn't find your usb stick on amazon :(.

One of the usb stick I used is this one.

I don't have a TV here (don't laugh :D), so I can't tell you about these dots but I'll be able to tell you that in 4 days if the problem persist.
[Google Chromecast] bhiga:
OTG cable looks fine (exactly like the ones I have). That USB stick should too too.

If the Chromecast app sees your Chromecast, you may be able to get its build number. If the build number is anything other than 12072, it is not rootable.
[Google Chromecast] fatalfuryy:
If you were able to root the device. do you mind sharing which location you found the good serial number from? all the stores i have gone to in nyc have the new 3B serial numbers which are unrootable