yashsingh1/xdaforums huggingface dataset:
[Google TV General] elliwigy:
gotcha.. so not what I was looking for lol.. seems they somehow dumped them from the device maybe then uploaded to gitlab.. i was looking for more official ota zips that can be flashed in stock recovery.. cant use fastboot while device is locked.
[Google TV General] npjohnson:
nah they're full userdebug firmware zips.

Not sure where they came from, but I saw them dumped.
[Google TV General] elliwigy:
Yea, but I was looking for OTA zips that are officially signed that could be used to adb sideload in stock recovery.. the full zips usually require using fastboot which is not allowed on bootloader locked devices.. similar to how google posts the ota zips for pixel devices that can be flashed in stock recovery (they also provide full firmware for those with unlocked bootloaders to flash using fastboot).. basically the dumps cannot be flashed on locked bl devices as far as I can tell.
[Google TV General] npjohnson:
The zips exist, but again, they are too old to install. They are older than the oldest firmware available. Even tho they're full OTAs, can't be installed unless your BL is unlocked, and even then they're signed with diff keys.
[Google TV General] elliwigy:
I agree lol.. so based on your statement then it is still not what I was looking for if they are in fact signed with different keys.. if they are not able to be flashed in stock recovery due to being signed differently then that is not what I was looking for.. I dont see how they could be official ota's if they are signed differently since they wouldnt work and couldnt be installed ota due to signature check failure.. i understand you cannot downgrade to older firmware but what I was looking for was official ota zips that can be installed using stock recovery which if the ota zips are signed with different keys then they cannot be flashed using stock recovery at all.. as far as i can see, google doesnt provide any ota updates/zips at all for chromecast with google tv.. i went on support chat (of course they usually arent very reliable with techy/dev support) but after an hour and them reaching out to some technicians they also stated that google doesnt provide them at this time.. I used the argument that my device messed up during an ota update and now isnt booting so wanted the update.zip to flash in stock recovery at which time they said they dont provide them at this time so would have to send the device in for repair/replacement lol..

its no biggie, i just wanted to tinker with it but the site u posted gives me some firmware to look at.. just would be nice if i mess something up id have a way to recover given i could still access stock recovery.

either way, every store ive been to including walmart, best buy, staples etc. all have devices manufactured in 07/2021 so still no luck lol.. i am weary ordering online since nothing is what it seems a lot of the time.

Have you messed with the tivo 4k streamer at all?
[Google TV General] npjohnson:
Ebay is your best bet. Took 4 days to get a new one here.

No I haven't.
[Google TV General] JJ2017:
Thanks OP - script worked a treat on an (unused) unit, MFG: 07/2020.

Any advice on blocking / disabling the OTA updates? Can't see any instructions searching around (and not much use it until that hurdle cleared!)
[Google TV General] retyre:
These appear to fit the bill:

Factory Sealed Google Chromecast with Google TV Bundle Youtube,Disney,Netflix | eBay

Find many great new & used options and get the best deals for Factory Sealed Google Chromecast with Google TV Bundle Youtube,Disney,Netflix at the best online prices at eBay! Free shipping for many products!

www.ebay.com

Google Chromecast with Google TV 4К Media Streamer with Google Assistant - Snow for sale online | eBay

Find many great new & used options and get the best deals for Google Chromecast with Google TV 4К Media Streamer with Google Assistant - Snow at the best online prices at eBay! Free shipping for many products!

www.ebay.com

Google CHROMECAST with Google TV REMOTE 4K 60fps HDR Streaming Snow *NEW IN BOX* | eBay

Find many great new & used options and get the best deals for Google CHROMECAST with Google TV REMOTE 4K 60fps HDR Streaming Snow *NEW IN BOX* at the best online prices at eBay! Free shipping for many products!

www.ebay.com
[Google TV General] p0werpl:
I made the mistake of flashing the deadpool recovery image to sabrina from fastboot (after unlocking it). How do I write back sabrina's recovery? The device is not entering fastboot mode after unlock. Thank you.
[Google TV General] npjohnson:
You'll need to use UART to interrupt boot and reflash. Requires hardware access and some soldering.

Not sure why you'd flash the Deadpool image...
[Google TV General] kennkanniff:
I build Lineageos for sabrina. I booted into the recovery.img and was able to connect to ADB but was unable to remove SetupWraith because the pm command was not working. I then flashed recovery and sideloaded the lineageos zip which I knew was risky. Now the device does not start and LED keeps blinking. I am also unable to enter fasbootd with the exploit. Any advice?
[Google TV General] npjohnson:
I have no clue why you'd do that.

There are very good reasons we haven't released builds.

Of course PM isn't going to work in recovery, its an Android command. You'd have to mount the partition and remove it, but you can't because the partitions are dynamic, and build with ext4_dup_blocks, forcing it to be read only.

As long as lineage recovery booted before you started, keep running the exploit, if you're lucky it will boot. Unless you flashed a bad DTB, in which case you may be out of luck.
[Google TV General] kennkanniff:
Thank you. I know it is stupid and I blame only myself but recovery worked perfectly so I could not help myself. Anyway, I have tried exploiting many times now and still blinking LED, the exploit always worked at first try. How do I know if I flashed a bad DTR?
[Google TV General] npjohnson:
I you flashed a full unmodified lineageos package, you 99% did. And it's probably not recoverable easily sadly.
[Google TV General] kennkanniff:
I did. That sucks to here. Will definitely order a new one though. Thanks for all the amazing work your doing.
[Google TV General] JJ2017:
OK - regarding removing SetupWraith to stop OTA: is there any way we can 'zero out' the relevant parts of super.img (taken from OP's 'Factory Image' linked in post) using a hex editor / then re-zip and flash 'adjusted' super.img from fastboot?!

See screenshot of extracted super.img in HxD to illustrate my point.

This is probably really naive and won't work but rather than ruin the device by trying perhaps someone could (politely) explain why not?
[Google TV General] npjohnson:
No sadly - the images are ext4_shared_dup_block, so you wouldn't be able to edit them without breaking things - there inlies the challenge. You'd need a disabled vbmeta image as well.
[Google TV General] bydo:
Finally found an old new in box unit from August 2020. This one came bundled with 6 months of free Netflix. Looks like I need to go through the regular setup steps to redeem the Netflix offer. What's the best way to proceed without them locking or updating the device during initial setup? Anyone know what servers I need to block on my router? Thanks.
[Google TV General] npjohnson:
Yeah, you'd need to update it to claim it sadly.

And no, we don't have a good way to stock automatic updates at the moment.
[Google TV General] p0werpl:
Is the damage done only when the device restarts to install the update? In other words, if I let it complete the check for update at initial setup and unplug the device as soon as it restarts, will the device still be exploitable?
[Google TV General] npjohnson:
yup, you need to fully install the update for it to patch.

Meaning it needs to reboot to recovery, install, then reboot again.
[Google TV General] p0werpl:
Thank you. Any idea where the update is stored? If it's in /cache, I should be able to delete it by booting the lineage recovery and using adb.

If I were to overwrite the stock recovery with lineage recovery, I'm guessing the stock recovery will be automatically reinstated on the next boot? Or would that be one way to prevent the update from installing?
[Google TV General] npjohnson:
yeah, cache. /cache/recovery to be exact. /cache/recovery/command is the bit that tells it to install in recovery.

To your second question, yes stock recovery would replace it.

We could totally unlock, boot up, "apply" the update, and on reboot use the exploit to get into fastboot, wipe cache, and it would boot to recovery, but on reboot to the OS it's _still_ going to try to update again.
[Google TV General] elliwigy:
I assume it uses a/b or seamless updates so even if he was to reboot and unplug it, when it starts back up will automatically start updating again before fully booting right?
[Google TV General] elliwigy:
yes, its very annoying.. theres usually this "recovery-from-boot.p file on system that restores the stock recovery when device boots.. unless you can find a way to remove that then not possible to retain custom recovery which from the sounds of it cant modify it. Sounds like a pain to say the least lol
[Google TV General] p0werpl:
Yes. Even if /system could somehow be modified without tripping verity, the issue is that it's dynamically generated from /super. I'm sure there are tools that can edit super.img, but who wants to try?

The unplugging idea will work only if one deletes the update from /cache/recovery (either by wiping cache in fastboot or booting lineage recovery and deleting it via adb shell).

Regarding removing the auto flashing of stock recovery on boot, perhaps that line in init.rc (in boot.img) can be commented out?
[Google TV General] p0werpl:
Since the exploit boots into fastbootd (instead of fastboot), won't it depend on recovery? That is, if it's essentially booting into recovery to call fastbootd, will recovery prioritize fastbootd over the update command?
[Google TV General] npjohnson:
Nope - old style A only dynamic partitions.

Yep - you're seeing the reason I haven't come up with something thus far lol.

Don't worry about verity, we can disable it with a disabled vbmeta, already did it locally.

The issue here is we can't modify any of those partitions, ext4_shared_dup_blocks makes all the images RO forcibly.

fastbood is in recovery - it should stop the update but again it doesn't matter - when you reboot to SUW it will try to update again.
[Google TV General] npjohnson:
Idea: Flash Magisk (I think it should work now), boot up to SUW, adb root && adb shell, then use PM to disable SUW? Or maybe to just kill the process.

Will probably have provisioning issues but it could be a start.
[Google TV General] p0werpl:
Which Magisk? Latest canary?

Will adb root work in this build? How does one enable usb debugging without the ability to navigate to settings? Wireless adb?
[Google TV General] npjohnson:
Magisk should just allow either SU or adb root?

And idk what version. Maybe try stable first?
[Google TV General] p0werpl:
To allow su access, Magisk needs Magisk Manager installed. I can patch boot.img on another device and flash it in fastboot, but how do I install Magisk Manager on the exploitable device while SUW is running? SUW has to be disabled before anything can be done. It's a Catch-22.
[Google TV General] npjohnson:
you sure Manager is needed to run adb root?
[Google TV General] p0werpl:
Even if adb root is enabled on this build and Magisk Manager is not needed, how do I enable adb on the device while SUW is running?
[Google TV General] npjohnson:
Fair point.
[Google TV General] p0werpl:
Do you have a generic data partition (as a raw image that I can dd in lineage recovery's adb shell) from an exploited device that has already gone through initial setup?

What are some partitions from the latest update (March/April 2021 patch) that are safe to dd into an old (June 2020 patch) exploited device to see whether the update check passes because the device is already on the latest patch level?
[Google TV General] npjohnson:
No, the pre-setup data wouldn't work I think.

you'd need to update everything but bootloader. which might be possible? Not sure.
[Google TV General] p0werpl:
The dumps you referenced earlier do not contain super.img. I doubt much can be done without it.

The OP says flashing a magisk-patched boot.img will result in a soft brick. Up above, you wrote that it should now work. What has changed to make it work?
[Google TV General] npjohnson:
That note was from very early testing of magisk see time ago.

I've heard from someone it works now. I'm still not sure tbh.

I have super.img from the newer builds, I'll get it to you to try tmrw.
[Google TV General] p0werpl:
Magisk-patched boot.img boots fine.
[Google TV General] npjohnson:
OP updated, I'll get you a newer version to flash sans bootloader.img today sometime.
[Google TV General] npjohnson:
Unpack this https://android.googleapis.com/packages/ota-api/package/1e09bc180c7183461e21cf31f1347dd6ad1410c4.zip, and follow the lineageos wiki guide to unpack it. then unpack super.img using the WIP instructions here https://review.lineageos.org/c/LineageOS/lineage_wiki/+/313040 and then flash system, vendor, product, dtbo, and boot.

See if that's enough to sidestep the OTA. Just don't flash bootloader.img
[Google TV General] p0werpl:
I let the device check for and download the system update. The downloaded update.zip in /cache was incremental (same as the one you linked above). Is there no full update?
[Google TV General] npjohnson:
the one I linked isn't incremental though? Should be a full image.
[Google TV General] p0werpl:
Yes, that looks like a full image.

super.img has four images: odm.img, product.img, system.img, vendor.img. I have to repack all four into super.img?

What's the (relatively) safer way to flash: fastboot or dd in lineage recovery?
[Google TV General] npjohnson:
no, unlock bootloader, flash lineage recovery, then fastboot flash each partition.

Or I mean, you can just boot to bootloader and flash super.img as a whole. That would probably work as well. You need to do boot and dtbo as well tho
[Google TV General] p0werpl:
There are other raw images in the zip (dt, logo, vbmeta). You wrote earlier about disabling verity with a vbmeta.img. Is that needed?
[Google TV General] npjohnson:
flash dtb, dtbo, boot, product, vendor, system, and this vbmeta (disabled) https://androidfilehost.com/?fid=2188818919693795292
[Google TV General] p0werpl:
I don't think the individual partitions in super can be flashed. fastboot reported a resizing error. The individual partitions (odm, product, vendor, system) have to be repacked into a flashable super.img.

I haven't been able to find a way to do that. There are numerous posts on unpacking super.img, but nothing reliable (that I have been able to find) about repacking it.
[Google TV General] npjohnson:
you can't flash them from fastboot, but you can from fastbootd, which the exploit boots you into.
[Google TV General] p0werpl:
I was able to flash the partitions but the device did not boot. It was stuck at the G logo right before the boot animation.
[Google TV General] npjohnson:
what all did you flash?
[Google TV General] p0werpl:
boot, dtbo, system, vendor, product, vbmeta

I flashed back the originals (from June 2020) and was able to boot back up again.

You did not mention odm. It's part of /super. Should that be flashed as well?

As long as I do not flash bootloader.img, everything else will result in a recoverable and exploitable device. Correct?
[Google TV General] npjohnson:
pretty much, yes, avoid flashing tee, and bootloader and you're fine.
[Google TV General] npjohnson:
As an important additional note, you can flash everything in fastbootd except DTB which you _will_ need to flash. To flash dtbo you need to reboot to bootloader, not fastbootd.
[Google TV General] p0werpl:
Still no luck. Hard to find out what's causing this because uart stops logging at that point.
[Google TV General] npjohnson:
Yeah, it sucks, but sounds about right.

I tried some stuff before release, but eh. I gave up when it didn't work.
[Google TV General] JJ2017:
Following this progress with interest:

When I try to flash product (or system) I'm getting:

>fastboot flash product product.img

target reported max download size of 536870912 bytes

Invalid sparse file format at header magic

sending sparse 'product' 1/2 (523956 KB)...

OKAY [ 20.366s]

writing 'product' 1/2...

OKAY [ 10.326s]

sending sparse 'product' 2/2 (89356 KB)...

OKAY [ 3.501s]

writing 'product' 2/2...

FAILED (remote: Operation not permitted)

finished. total time: 35.216s

=====================================

Also, in the file shared by @npjohnson #63 above - when unpacked there's dt.img - I assume that's dtb?
[Google TV General] p0werpl:
Is it possible to apply the update.zip in recovery (after editing the update script to remove references to bootloader and tee)?
[Google TV General] p0werpl:
No issues here.

$ fastboot flash product product.img

Invalid sparse file format at header magic

Resizing 'product' OKAY [ 0.005s]

Sending sparse 'product' 1/2 (523956 KB) OKAY [ 31.294s]

Writing 'product' OKAY [ 10.311s]

Sending sparse 'product' 2/2 (89356 KB) OKAY [ 5.547s]

Writing 'product' OKAY [ 2.173s]

Finished. Total time: 49.480s

Are you using an old fastboot binary?
[Google TV General] npjohnson:
maybe, but it won't have a different outcome.
[Google TV General] npjohnson:
yes
[Google TV General] p0werpl:
Is it possible to wipe data and disable data encryption?

Where is SUW located? What if that partition's image can be mounted and SUW renamed?
[Google TV General] npjohnson:
If you repack the bootimage yeah you can disable it - or just use the forceencrypt disabler zips - this might work actually.

You can't remount the images or the block devices, both are forcibly RO.
[Google TV General] p0werpl:
Struck out once more. Sideloaded the zip (it had to be edited to remove the wait for volume-button presses) and it installed without any issues, but /data was encrypted on reboot.

At this point, this is just a war of attrition with google. How many of us are willing to hold on to a device that's pretty much a vegetable if it's not updated?
[Google TV General] JJ2017:
@p0werpl & @npjohnson - I have some good news regarding the 'war of attrition' as I believe (with some trial and error) I've cracked it (with your guide, of course!)

Now because I only have limited experience in these matters I'll describe what I've done and let you decide how it worked:

- Following np's instructions yesterday I also ended stuck on fastboot 'G' logo so I re-did the unlock script and got back to June stock by flashing 'original' super.img at bootloader (along with the original partitions I had written over)

- Now device restored, so next , return to fastbootd, flash disabled Vbmeta and 'new' System partition (as described by np in post# 63 above) - try rebooting and get someway in boot-up before android error flags up.

- return to bootloader to re-flash 'new' dtb & dtbo img's - again boot-up attempts but get same 'corruption' error

- return to fastbootd flash 'new' odm.img - no change. However, returning to fastbootd to flash new product.img gets boot through to start-up screen : pair remote, connect to internet.... But something is buggy - no keyboard will come up to input data (and no option to sign-in using Home app)

- After lots of faffing and re-boots went to Recovery (via fastbootd menu) and did data wipe / cache -- this got me to normal start-up proecure - connect to intenet / google login / success!

- Enable ADB in Dev Options - install Magisk app - patch boot.img - THIS IS THE JUNE boot.img NOT the 'new' one - re-flash patched boot, restart / get root through ADB shell: PM disable "com.google.android.tungsten.setupwraith"

I assume that's what we need to disable OTA updates?- list of packages attached to check (please!)

Photo showing Android security patch level: 5th April '21 - but still able to run unlock script and access fastbootd.

I think sticking with the original boot.img was the critical step here / I also never flashed the 'new' Vendor partition (I don't know if that's relevant)

Hopefully someone can replicate what I've done? And potentially improve this method?!

What do people think?

​
[Google TV General] p0werpl:
Thank you. I can confirm it works! It's probably the new vendor partition that should not be flashed. In any case, I will make a backup of all the partitions with this working system.
[Google TV General] npjohnson:
can you come up with a concise process and I'll try it/package it up for others?

So just flash everything from that package I linked except vendor, wipe data, call it a day?
[Google TV General] p0werpl:
Yes. I flashed everything (including boot) except vendor. Did it work for you?
[Google TV General] npjohnson:
Okay, global thread update, the repo has new changes:

* The script now asks you if you want to flash a newer, custom factory image to allow you to avoid forced OTA updates.

* The script now asks you if you want to flash LineageOS Recovery.

* The script now asks you if you want to flash a functional Magisk patched boot image.
[Google TV General] npjohnson:
Thanks for your immense help and experimentation on this.

Added you to the Special Thanks on the thread and the GitHub repo.

The script now incorporates all of this and more!
[Google TV General] bydo:
Great work everyone. So does that mean we can now take an unlocked device online to complete initial activation without fear of it getting relocked or updated? If so, I'll give this a shot and see if I can redeem the free Netflix offer that came bundled with my old device. Wonder how they know which devices are eligible for the offer and whether this information is preserved after the unlock script is run.
[Google TV General] kennkanniff:
Thanks everybody.

Initially I got this error which left me with an unbootable device:

/tmp/TemporaryFile-r1sI6B: Unimplemented ext2 library function while setting up superblock
/usr/lib/android-sdk/platform-tools/mke2fs failed with status 1
mke2fs failed: 1
error: Cannot generate image for userdata

After updating android-tools to latest and reruning the exploit it works fine.
[Google TV General] npjohnson:
Yes you can, but only after running the exploit and flashing the recommended images the script throws at you.
[Google TV General] npjohnson:
Yeah they split out mke2fs, you'll need that as well.
[Google TV General] npjohnson:
I've updated the g12 thread to support sabrina - the beta LineageOS builds for it are live!

If you want to come back from them, just re-run unlock.sh and select to flash the factory image.
[Google TV General] Kalentia:
For some reason, even after installing the patched Magisk image the app says that the installed state is N/A... should I manually patch the image from the factory .zip or have I missed something?
[Google TV General] npjohnson:
You can try, I definitely patched that, however
[Google TV General] Kalentia:
I patched the image on my CCwGTV and got something with a different checksum, from what I can tell it looks like Magisk gathers device-specific info during the patching process so making a pre-patched image may not be possible. At least it works to do it manually!
[Google TV General] npjohnson:
Follow the instructions and install LineageOS? Or go to bootloader and flash stock.
[Google TV General] vandyman:
I have been following this thread. And to me, it doesn't seem like it is worth modding this device.

The New Onn TV device has the same specs and is $20 cheaper. And I am sure there will be plenty of mods for it to come.
[Google TV General] fixsony:
This problem for Walmart Onn UHD Box and recovery boot loop for both, stock and Lineage recovery.

How fix this error:

Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory

emulated Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory
[Google TV General] npjohnson:
That's not an error. It's a notice, and totally expected. Follow the wiki, all will work fine.
[Google TV General] fixsony:
Thanks. But I am try so many time with same result. One more question when send fastboot reboot-bootloader box reboot to recovery mode.