[Fire TV General] ingrimsch:
hey guys,

i had the chance to talk to zenofex of #gtvhacker and will post the infos below before i´ll get some sleep.

!! WARNING: READ THIS, there is a solid chance to BRICK YOUR FTV if you don´t know what you do here !!

[19:51] <ingrimsch> hey guys, do you still have the FireTV with removed EMMC available? there are a few guys on xda-dev who want to recreate your work on the EMMC/SD adapter to get root access, but stumble on supplying vcc to the EMMC

[19:52] <ingrimsch> maybe you can help us out with a pin / spot to supply power to the EMMC or give us a hint how you connected EMMC--SD Sniffer--PC to power it

[19:53] <ingrimsch> here is the thread on xda: http://xdaforums.com/fire-tv/general/hardware-root-via-emmc-chip-t2885344/page2

[19:53] <ingrimsch> thanks in advance for any help you can supply :)

[20:22] <zenofex> ingrimsch: hahaha, I hated us releasing that bug based on how much of a pita it is to talk to eMMC on the Amazon FireTV

[20:22] <zenofex> well, "bug"

[20:23] <zenofex> ingrimsch: so I've been slowly working on the idea of an attacks section of the wiki

[20:24] <zenofex> had been trying to work out and document an easyish way to attack eMMC devices

[20:24] <zenofex> problem is as you guys probably know, vccq has to be at 1.8

[20:24] <zenofex> and you'll probably need a logic level shifter

[20:25] <zenofex> so of note: re: the amazon firetv. a few were bricked prior to us even getting one to work

[20:29] <zenofex> ingrimsch: I'd recommend this, get any of those guys who are trying it in here with us and we can walk through their setup with them

[20:42] <ingrimsch> I´d try it myself, but I dont have the hardware yet ;D

[20:45] <ingrimsch> I believe the guy who tried it got CMD, CLK and Data0 wired up to the sniffer, took GND from the USB shield (according to his post) and supplied 1.7V (dont know why 1.7 instead of 1.8?) from an external power supply to the UART pin

[20:47] <ingrimsch> he tried it, it didn´t work, but he seems not be be very keen on poking in the dark or finding the error ;o)

[20:50] <ingrimsch> sorry, just re-read... not one of the uart pins, but the 1.8v pin shown in the uart picture ;)

[20:51] <zenofex> ingrimsch: I have to run but I'll be back in roughly an hour

[20:51] <zenofex> we can chat more then

[20:51] <zenofex> sorry, bbiab

[20:51] <ingrimsch> np, cu later then :)

[00:35] <zenofex> ingrimsch: I got in later than expected and only have roughly an hour before I have to leave again

[00:35] <zenofex> if your around we can talk a bit now but otherwise I'll be here late this evening as well as all of tomorrow

[00:40] <ingrimsch> I´m still here and have a few minutes left before my bed calls :)

[00:41] <ingrimsch> guy who tried it wrote 1.7V by mistake... he actually used an external power supply to input 1.8V to the pin shown in the uart pictue

[00:43] <ingrimsch> can you get into detail on how you hooked up the emmc with the sniffer?

[00:44] <zenofex> so my experience with eMMC was with a different device

[00:44] <zenofex> and cj_000 / maximus64 have done far more than myself

[00:45] <zenofex> but I'll walk you through a few notes I've taken from the process

[00:45] <ingrimsch> really appreciate it, thanks for taking the time =)

[00:45] <zenofex> a.) I've been told the length of the wire can cause issues, dont make your wire between the sd sniffer and the board long

[00:46] <zenofex> b.) I believe that the logic levels on the firetv iirc are 1.8 so you'll need something to step the logic down from 3.3 for DAT0 and CMD

[00:47] <zenofex> c.) I've also been told that the eMMC adapter can have issues supporting a 1-bit mode

[00:49] <zenofex> (running SD with 1 wire), so you can test your adapter by taping over the DAT1-3 pins pins on an sdcard and verify it can still read a valid sd card with dat0

[00:49] <@cj_000> yep, everything that zenofex said is true, although i'd have a good solid emmc device on hand too as well, to test

[00:49] <@cj_000> may i suggest the nsz-g7

[00:49] <@cj_000> gs7*

[00:51] <zenofex> ingrimsch: theres also a trick of not needing to worry about powering the chip directly by GND'ing the boards clk

[00:52] <zenofex> then the firetv will supply vcc/vccq and you can just connect CMD/DAT0/CLK

[00:52] <zenofex> it might work better since the picture on the wiki is missing a valid VCCq point

[00:53] <zenofex> I'll be around late this evening if you are around drop back in and send me a PM, if I'm around I'll be happy to help/chat

[00:56] <ingrimsch> im on the other side of the world but i´ll try to reach you tomorrow morning (which might be your late evening ;))

[00:56] <zenofex> ingrimsch: I have a terrible sleep schedule

[00:57] <ingrimsch> so the logic converter DAT0 and CMD is required?

[00:57] <zenofex> its probably more likely that I'll be here in the middle of the night than early in the morning

[00:57] <ingrimsch> i see, cant fight the geek lifestyle =)

[00:58] <zenofex> ingrimsch: well, I think that cj_000 and maximus64 did it without the logic level converter

[00:58] <zenofex> but they also bricked 3/4 firetv's they were working with

[00:58] <zenofex> so its hard to say exactly where it went wrong, but to the best of my knowledge, yes. If either cj_000 or maximus64 are around they may disagree

[00:59] <ingrimsch> ouch... then i´ll better try the safe way then

[00:59] <ingrimsch> -then

[01:00] <zenofex> haha, just depends on how much risk you want to take

[01:02] <ingrimsch> any experience in possible harm putting the ftv´s board clk to gnd to power up the emmc?

[01:03] <ingrimsch> as less as possible ;)

[01:05] <zenofex> no, just do it with the box powered off

[01:05] <zenofex> then power it on attached

[01:06] <zenofex> should not run, just will provide power and keep the board idle

[01:10] <ingrimsch> okay, that solves the problem we had in finding a way to supply the emmc :)

[01:13] <ingrimsch> is it ok to take a log of this to the hread on xda-dev? I´ll provide an extra warning about the 3/4 bricks just to be sure everybody knows there is a risk ;)

[01:14] <zenofex> yeah absolutely, please also invite them to stop by and I'll do my best to help

[01:14] <zenofex> (as long as i'm not AFK)

[01:14] <ingrimsch> im off to bed in a few minutes, but i´ll check back tomorrow, maybe cj_000 and maximus64 have something to add or any experience with the firetv worth sharing

[01:15] <zenofex> possibly, if not I'll be here if you need anything

[01:15] <zenofex> godspeed, and have a good night

[01:16] <ingrimsch> thanks again for taking the time, really appreciated! :)

[01:16] <zenofex> no problem man, anytime