yashsingh1/xdaforums huggingface dataset:
[Google TV General] npjohnson:
I need to update the modified factory image to Android 12 - I just don't have time at the moment.
[Google TV General] Aapat:
No problem, thank you for the quick reply! Do you foresee any issues using the process outlined in this thread to create a modified factory image using Android 12 instead of Android 10?
[Google TV General] npjohnson:
Really just a case of "does it work" - I hope it does but yeah if you extract, replace teetz files, then flash, hopefully it would work.
[Google TV General] Aapat:
I discovered a really simple way to bypass setup and its forced update without having to create a modified Android 12 factory image.

I found SetupWraithPrebuiltChromecast.apk within product.img from the zip the unlock script downloads and decided to decompile it. The apk contains a class called DebuggingKeySequence which opens a debugging menu with an option to skip setup when a key sequence is entered. After digging into the class some more, I found an integer array representing the needed key sequence. The integers correspond to UP UP LEFT LEFT on the remote. I tried that sequence during setup immediately after the remote pairing stage, was able to open the debug menu, and skip the rest of setup.

In short, to skip the set-up process, you can press UP UP LEFT LEFT after the remote pairing screen to open a debug menu. Once you have the debug menu opened, select the SKIP_SETUP option. After, sign-in with your google account when forced to (If you select manage accounts at the sign-in screen, you can get to settings to connect to a Wi-Fi network). Immediately after sign-in, I blocked android.googleapis.com on my router to be completely safe from updates, but that may not be necessary.
[Google TV General] npjohnson:
I will post this in the OP!!! Nice find. Super useful.
[Google TV General] BigEmpty:
Attempting this now. Aside from the four files:

93a424e2-5608-4413-84a858b16a064dce.ta

af1ae3a4-888b-4e11-b4ab1c2b972d1c11.ta

d83c3c4a-9e8d-4e4e-ad309d40e137f689.ta

ff2a4bea-ef6d-11e6-89ccd4ae52a7b3b3.ta

which have the same filename in both versions, the other five files in the android 12 version have similar filenames, but with an extra character (dash or hyphen). For example,

12:

2c1a33c0-44cc-11e5-bc3b-0002a5d5c51b.ta

10:

2c1a33c0-44cc-11e5-bc3b0002a5d5c51b.ta

Should the android 10 filenames be kept in android 12?
[Google TV General] npjohnson:
Delete the Android 12 versions, put the Android 10 versions
[Google TV General] BigEmpty:
Using stock 12 vendor, system won't boot at all

Teetz patched 12 vendor, system boots fine, drminfo app reports L1 same as working device would, but no drm video of any kind will play
[Google TV General] npjohnson:
Sad. So we finally hit the teetz incompatibility day.

But it boots which is nice. Mind Google driving that package and I'll mirror/put in OP?

If not I can do it next week.
[Google TV General] bloxycola:
Yes it’s official frimware
[Google TV General] BigEmpty:
Do you have a complete zip of one of those old userdebug builds? The stuff on tadiphone is missing stuff, like the recovery image. I don't care that the bootloader is too old to be run or that the avb keys are different.
[Google TV General] npjohnson:
No, those were dumped randomly, and I'm not sure of their original source.

I've wondered this myself.
[Google TV General] bloxycola:
Yes, I downloaded from XDA and Reddit tomorrow I will upload them.

Search up on XDA Lineage OS for the Google Sabrina in that thread you should find stock ROMS.
[Google TV General] GroundControl2MT:
Hi, so I've figured out that my ccwgtv is getting in to fastboot and I had a udev issue. I was able to get the unlock and repair scripts to work. The repair script ran and I reflash the stock with modded setup wizzard. When booting after the repair script, it is still stuck on the 'G' logo. I ran the unlock script, and that worked and booted the modded setup wizzard, however it still atempts to download and update my device. It downloads the update, reboots the device but it is not able to update. The modded setup wizzard still tries to update the system. Any ideas why or anything I can do to bypass this?
[Google TV General] bloxycola:
What Android version?
[Google TV General] GroundControl2MT:
sabrina-qts1.210311.036-7814738-factory, or the one provided by the unlock script
[Google TV General] BigEmpty:
Why did you twice quote those two old posts? I've given up looking for a userdebug version of recovery for sabrina. I'm not using the device anymore.
[Google TV General] bloxycola:
I sened that post over a month ago.

I dont know why it just appeared.
[Google TV General] bloxycola:
I got mine to reboot into recovery mode, Fastboot, and bootloader mode. Any chance I can downgrade?
[Google TV General] bloxycola:
Is there anyway I can perform surgery on the CCwGTV to replace that blown efuse.
[Google TV General] npjohnson:
No lol they're microscopic and on the actual CPU.
[Google TV General] bloxycola:
I got a microscope for soldering
[Google TV General] npjohnson:
Lol, I do too - what I'm saying is - you'd need a full internal X-Ray of the SoC, you'd need to have someone that knows how physical fuse mapping relates to fuse labels/address spaces, you'd need to scrap the CPU down in just the right area (we're talking milimeters), then you'd be able to potentially _see_ them but you cannot replace them - these are too small to solder, we're talking 1/1000'th the size of the CPU itself, likely smaller.
[Google TV General] bloxycola:
Replace the CPU?
[Google TV General] npjohnson:
Have fun with that - but sure, maybe - You'd need to replace the EMMC with one with an older bootloader too to prevent blowing the fuse again on first boot.

It just makes no sense price wise - even if you could.
[Google TV General] bloxycola:
I think I'm better off finding one in eBay, that was manufactured before that date plus having a older version of the OS.

Although thank you for the info.
[Google TV General] supermansaga:
We need to root this thing in order to use Movies Anywhere app in unsupported countries. It appears the app doesn't reject VPN outright like Vudu does, but it relies on your device's location.
[Google TV General] onion4:
Hi, has there been any progress with unlocking the FHD version of this chromecast? (boreal)
[Google TV General] npjohnson:
Not publicly available, no.
[Google TV General] Functioner:
Have confirmed that all of the variables work the same in the last versions of the android 10 bootloaders and in the new android 12 bootloaders.
[Google TV General] npjohnson:
https://download.ods.ninja/Android/...er-12-STTE.230319.008.R1-10015454-factory.zip

Android 12 factory image is now live, linked in OP, and pulled by the unlock tool.
[Google TV General] SiViS:
I can't download using this link. Can you please check it?
[Google TV General] npjohnson:
site is down rn, will be back tonight
[Google TV General] SiViS:
Thank you, npjohnson!

I've followed the script but now my device is in a bootloop. What can I do?
[Google TV General] npjohnson:
does it get to the bootlogo of stock? Or does it just hang at the splash screen?
[Google TV General] SiViS:
It shows the G, hangs for a few seconds and then resets.

When I go through the unlock process again - it suceeds, and I can even see the lineageOS recovery. I tried flashing stock boot.img through it but it did not help.
[Google TV General] npjohnson:
Meh, ****. I'll look into it.

Assuming you flashed the factory image?
[Google TV General] SiViS:
Yep, script downloaded and flashed the 12-stte.230319.008.r1
[Google TV General] npjohnson:
Meh, I rolled back the 12 image for now. You can return the script and flash the 10 one for now.

Will fix soon.
[Google TV General] SiViS:
It worked, thank you.

But it forces OTA during setup =(
[Google TV General] npjohnson:
Yeah hence why we needed 12 :/

I'll work on it.
[Google TV General] SiViS:
Ah, I see. I thought I am being stupid. Thank you so much for you help!
[Google TV General] dante_ov:
It's quite sad that @Functioner removed pinout post, it's annoying how many good stuff get removed these days.

And I don't think that sabrina is in her last days, there is still nothing from Google to replace it. Regardless, it's a solid streaming device and will be supported for a long time.
[Google TV General] Functioner:
Feel free to repost any images you like.
[Google TV General] sergiodbx:
Hello everyone. I have a pair of Chromecast Google TV with MFQ 08/2020. I could not find the update file from 02/2021 anywhere, after which a password is activated on the device that blocks the operation of the amlogic-usbdl exploit. And I had the idea to try to "catch" this update. I think that after connecting Sabrina to the power supply and the Internet, you can track the time when the 02/2021 update files are downloaded to it and turn off the power supply and the Internet before the update begins. Then remove the EMMC from the board and read the dump from it . Then, comparing the factory backup of sabrina and the backup copy after downloading the update, make a dump of update 02/2021 and try to find the password.bin value in it. Do you think it makes sense to try it? Maybe someone has already done it or tried? Maybe someone knows in which sections of EMMC the OTA update from Sabrina is recorded? Only in the cache section or partially in the data? What do you think about this idea ?
[Google TV General] npjohnson:
Not possible, the password is not accessible anywhere in the firmware.

We already have the firmware that sets the password dumped, it is not accessible.
[Google TV General] dante_ov:
Interesting thinking, however update does not reveal password rather than password hash but according to @npjohnson it was probably already burned just not enabled.

I was looking for sabrina eMMC dump 2 years ago and no one answered, so it will be very nice to have it, especially from exploitable device.
[Google TV General] npjohnson:
You just want a full 8 GB EMMC dump?

I can give you one. It's not hard to get from an unlocked device.

Just not sure what you're looking for.
[Google TV General] dante_ov:
Yeah, including eMMC hardware boot partitions (mmcblk0boot0 and mmcblk0boot1).

CID, CSD and EXT_CSD would be nice but not mandatory.
[Google TV General] sergiodbx:
On Sabrina, Security Boot is used to protect data. Soic Amlogic functions in two worlds simultaneously - in Secure World and Normal World. The interaction between SW and NW occurs by transmitting

ARM SMC# (calling a protected monitor). In order to set a password in Sabrina on the fly, you need to pass the Soic command from NW to SW - put the "letter" with the data for the EFUSE in the "mailbox" and call SMC. Secure Monitor will read this email, check the signatures, and if everything is normal, execute the command - burn Efuse and/or enable the flag to verify the password. Such an SMC call may be in the recovery.img kernel of update 02/2021 for sabrina c MFQ 11/2020 and earlier. It remains to find this place in kernel recovery.img and decrypt the message. That's why I'm looking for an update for sabrina (with MFQ 11/2020 and earlier) from 02/2021, after which access to the Soic is blocked by a password.

If you have files of such an update, could you send me a link to a place where I can download it or send it to
[Google TV General] dante_ov:
I have several sabrina updates, the oldest is from May 2021 which is also posted here by @npjohnson.

Does anyone have an OTA older than that?
[Google TV General] Functioner:
You guys are barking up a dead horse. What you're looking for is not there.

The actual private key password (that would be needed in order to use DFU on a password protected device) is never exposed anywhere. Not in the SoC efuse pattern(s), not in any ota, not in the emmc. It's just not there.

I don't what to discourage anyone from doing research, because a lot can be learned while looking for stuff that is not there. A wild goose chase might not yield any wild goose, but maybe something else instead.
[Google TV General] dante_ov:
I'm aware of that, but not even aml password hash is available in sabrina OTA update (unlike other devices), correct me if I'm wrong, a lot of my statements are actually information obtained from @npjohnson.

He also never dumped complete eFuse memory which probably contains password hash, maybe some day he will or someone else with exploitable device.

I'm not looking anything password related on OTA nor eMMC dump, @sergiodbx mentioned something like that.
[Google TV General] sergiodbx:
In the case when the bootROM USB boot protocol is disabled/(password protected) at the factory, there really is no password information in either the dump or the OTA update.

In this case, disabling/blocking access to the bootROM USB boot protocol occurs after the chromecast update from 02/2021. Hence the interest in the files of this particular OTA update.

In the efuse dump amlogic S905X3 usb/jtag the password is located at 0x60 0x80.
[Google TV General] Functioner:
Not sure that I understand what you're saying.

If a sabrina device that was manufactured in 8/2020, 9/2020, 10/2020, or 11/2020 was sealed in the box until today, and then connected to the internet and setup, the newest (most recent) ota update would enable the usb dfu password on that old sabrina device just the same as the very first ota update (from 02/2021) that would enable the usb dfu password.

So, what's special about the ota update from 02/2021?
[Google TV General] sergiodbx:
According to information from users on various forums including XDA, chromecast with unlocked USB bootROM will not be able to upgrade to newer firmware skipping the 02/2021 update. I have one Sabrina with an unlocked USB so far; the second one with a

09/2020 DFU I bought on ebay, but it is still in transit. Once I get it and verify it works, I'll try downloading firmware from the net without the optional Chromecast update, and then read a dump of that firmware with the eMMc.

After analyzing the firmware, we can see which one of us is right. I got Chromecast by accident and relatively recently - just a couple months ago, and I haven't used it for its intended purpose yet. I didn't connect it to the network to save free usb.

Before that I had experience of using tvboxes from other manufacturers. For example TOX-1 Ugoos. In this set-top box firmware up to version 1.3 was not encrypted. Starting with version 1.4, the firmware

the firmware became encrypted. There was a transitional OTA-version 1.3-1.4, which after installation turned the console from unencrypted to encrypted with all the attributes - enabling secure booting, writing encryption keys in efuse. And all this was done on the fly, using the Arm SiP Services platform. That's why I'm interested to see the 02/2021 update
[Google TV General] Functioner:
I had a sabrina device that was MFG 09/2020. I kept it factory sealed until September 2022.

When I opened it in September 2022, I dumped the factory firmware. It came from the factory with this version:

google/sabrina_prod_stable/sabrina:10/QTS1.200625.002.A5/6686931:user/release-keys

The very first GOTA update check (in September 2022) done with this device, the update that it would have downloaded (I stopped the update), was to this version:

google/sabrina_prod_stable/sabrina:10/QTS1.220504.008/8726984:user/release-keys

The update it found was to a full (not an incremental) update to QTS1.220504.008/8726984.

Today, if a factory sealed sabrina device that was MFG 09/2020 was connected to the internet & setup, it would download a full ota update to a recent (probably the newest) android 12 version.

The efuse pattern payload is in the bootloader. Every bootloader since the 02/2021 ota has the payload. So any bootloader since then can enable the usb dfu password directly.

Yes, I'm aware that some devices that have changed from a non-encrypted bootloader to an encrypted bootloader must install some particular transitional ota.

This is not the case for sabrina.
[Google TV General] sergiodbx:
I compared efuse dumps from several unlocked Chromecasts and came to the conclusion that each box has its own password.

Password is written to efuse most likely at the stage before mounting on PCB. Also efuse contains secure level, password enable/disable config set. So since FOTA

02/2021 the firmware contains a place from which the password enable command is sent to the CPU during the update. I have compared in winhex the bootloader sections - fip and uboot

from the available OTA QTS1.200625.002.A5 and QTS1.210311.036_7814738 and made sure that they are absolutely identical. The other sections of bootloaders have some differences and need to be examined in more detail using IDA.
[Google TV General] dante_ov:
No, password salt is randomly generated, that's why every password hash is unique.
[Google TV General] dante_ov:
Do you still have it? I could use some memory dumps from it.
[Google TV General] Functioner:
I have two sabrina devices that were manufactured 11/2020 or earlier. Both are still in the factory original state, with the original factory firmware and full usb dfu functionality. The only changes are to a couple of env variable values in the env partition.

What do you hope to learn from memory dumps? I dumped the memory awhile back, except for the secure monitor memory areas. As I've said before, the efuse pattern for sabrina disables usb dfu, and sdc/spi dfu, as well as jtag, but all of the env variables work the same (such as bootdelay, lock, etc.).
[Google TV General] dante_ov:
Which memory regions did you read and which ones didn't?
[Google TV General] npjohnson:
Hey all, I am moving and therefore some of the links in the OP may be down for a few days. Likely Wednesday, Friday at the worst.

Don’t panic when the script can't fetch the firmwares/images it needs. It is planned outage.

Thanks, see you on the other side!
[Google TV General] npjohnson:
Hey y'all - Unofficial download portal is back up.

Unlock and factory image flash scripts should work now.

It may be hit and miss tomorrow as I rewire everything, but everything /should/ be functional for now.

Thanks!
[Google TV General] sergiodbx:
Hi. Today I discovered that the repository https://github.com/npjohnson/sabrina-unlock stopped working. Can anyone tell me where I can download the Download Zip code from this repository? Maybe someone can share this code with me?
[Google TV General] SourPower:
Hello,

Sorry if this was asked but I just got this chromecast with google tv 4k, brand new and i was going to start setting it up but it automatically starts downloading an update for it. is there anyway to stop it?

my unit shows to be mfg in Oct 2022, am I able to root it?

Thank you
[Google TV General] BTK19:
Your firmware version needs to be below the February 2021 patch level.
[Google TV General] Functioner:
A sabrina device that was MFG: 10/2022 will contain this build:

google/sabrina_prod_stable/sabrina:10/QTS1.210311.017.A2/7686849:user/release-keys
ro.build.date=Mon Aug 30 13:43:54 UTC 2021

which is an android 10 build. If updated during the setup wizard today, it will get this android 12 build:

google/sabrina_prod_stable/sabrina:12/STTK.230808.004/10714782:user/release-keys

Practically speaking, no. The update can't be stopped w/o hardware intervention or a u-boot exploit. Rooting requires either hardware intervention or a userspace/u-boot exploit.
[Google TV General] npjohnson:
December 6th.

Mark your calendars: oddsolutions.github.io
[Google TV General] Functioner:
Color me surprised! Was convinced you had given up, or would never be able to find enough time.
[Google TV General] npjohnson:
We have had this in the works since December of last year. Reported to Google in April-ish - 3 vulnerabilities that are remediated in the December patch, so don't update if you care to unlock.
[Google TV General] Functioner:
Yeah, I know.

Since they fired dibona, they don't post source updates as often.
[Google TV General] npjohnson:
yeah I w as sad to see Dibona go but they aren't doing bad.

They actually set up a manifest you can sync with the repo tool and cersioened releases with proper history... Kuch better than the old days of no history tarballs for CC devices.
[Google TV General] supermansaga:
Do you now when will the December patch arrive and what will be included? Would like to update it while I am still in the free world. Thx
[Google TV General] npjohnson:
Any December update.

It's supposed to be Dec 4 but who knows.
[Google TV General] Functioner:
Not necessary to rush, you could download the full ota zip and install it whenever.
[Google TV General] npjohnson:
Nolen J. on LinkedIn: #security #vulnerability #vrp #cve #google #securityresearch

Just released a full secure-boot exploit chain for the Chromecast with Google TV 1080P with Jan Altensen and Ray Volpe! Three high to severe vulnerabilities…

www.linkedin.com

https://x.com/nolenjohnson/status/1732407584038998023?s=20

The boreal exploits are live!

Massive callouts to @Functioner and @Stricted for working together with me on this chain!
[Google TV General] volkodav1975:
I ordered the HD version, is there any firmware for it?
[Google TV General] npjohnson:
Yeah dumped it on dumps.tadiphone.dev/dumps

I could give you a full OTA image as well.
[Google TV General] nervdg:
Would you mind to share the emmc backup with me?I have a CCwGTV with new bootloader which could not be unlocked,I want to replace emmc to downgrade it,Thanks.
[Google TV General] npjohnson:
I don't have a copy, like I said my Sabrina is currently on 12
[Google TV General] n00tfeuer:
What is the benefit of this?
[Google TV General] npjohnson:
Unlocking your bootloader to run a custom OS or root your device.
[Google TV General] rrtheempire:
Hello everyone,

I just got the Chromecast 4K (Sabrina) and would like to root it.

So, I haven't turned it on yet because I know there will be the initial setup and the mandatory update. What can I do to be able to use the script? Can I do the mandatory update first and then use the script to root?
[Google TV General] volkodav1975:
You cannot connect to the Internet.

I doubt that your console was released in 2020 Only they can be unlocked.
[Google TV General] rrtheempire:
Mine is made in October 2022. So I can't use it?

Is there any hope for Chromecast 1080p? Or is it too late to root it?
[Google TV General] volkodav1975:
You can use it, you can't unlock it.
[Google TV General] npjohnson:
1080p Chromecast has a hardware exploit that is very difficult to perform. And even then only through December 2023 OTA.
[Google TV General] npjohnson:
Sabrina LineageOS builds are now official, first build goes up on Saturday.

L1 is fixed.

I will update this repo with those images once they're up!
[Google TV General] CAPSITUP:
hopefully one day a new way will happen, great work
[Google TV General] npjohnson:
There is a WIP way, but it requires some ridiculous hardware mods, really only good for research.
[Google TV General] CAPSITUP:
ill keep my eye on this then as i can do some mods .. thanks for your hard work
[Google TV General] volkodav1975:
Did I understand correctly that you can somehow unlock if you make hardware changes?
[Google TV General] npjohnson:
It's not feasible for most people.

Requires lab and some equipment.
[Google TV General] CAPSITUP:
aaaaa ok let's hope there is a software bypass in the next update ... i see in the Dev settings a unlock bootloader, wish there was a way of activating it
[Google TV General] npjohnson:
Even if you activate it it doesn't matter, the bootloader ignores that value
[Google TV General] MiniBlu:
I'd love to know more about this. Just for the fun of it i set up an rp2040 micro controller to automate your glitch attack and unlock on a 1080p chromecast, it worked most of the time. I love hardware hacking.
[Google TV General] npjohnson:
Maybe I'll detail at some point
[Google TV General] volkodav1975:
If it is not difficult, can you name the required equipment?
[Google TV General] npjohnson:
the userdebug ones... no. Not sure where they came from, but there are zips of them too, just not installable due to rollback/signing.