[Google TV General] npjohnson:
Introduction:

This is an exploit chain intended to allow one to run a custom OS/unsigned code on the Chromecast with Google TV (CCwGTV) 1080P (boreal).

This uses chain of 3 vulnerabilities developed by Nolen Johnson (@npjohnson), Jan Altensen (@Stricted), and Ray Volpe (@Functioner).

This is not as simple as it's sabrina-unlock counterpart, and largely is for three classes of people:

Hardware researchers who want to do further research on this device but need a research platform

Hardcore power users with some hardware knowledge who know what they want out of the hardware and are willing to put some time into performing the exploit chain (more on why I say "perform" in the writeup linked below)

People who want to follow along a very easy-to-follow (hopefully!) exploit chain and learn some things about hardware hacking along the way

People this is likely not for:

Typical users who simply want to run a custom ROM or install Magisk (see the FAQ for why)

Disclaimer:

You are solely responsible for any potential damage(s) caused to your device by this exploit.

I know I post this on all of my writeups/exploit releases but seriously, this one is built different - take you hardware into your own hands, shorting the wrong component can fry your adapter/port/device - be careful.

FAQ:

- Does this process void my warranty on this device?

Probably, assume so. Or just flash stock and lock your bootloader before RMA. The exploit itself only leaves traces in the `misc` partition.

- Does unlocking the bootloader break DRM in any way?

Nope, just like unlocking a Pixel device officially.

- Does this unlock my bootloader?

No, but it also lets you run custom OSes unless you do something that rewrites the BCB (e.g. reboot recovery, bootloader, etc.) - if you do this you must re-perform the full chain of exploits once more.

- Should I use this then? That last comment confuses me?

Probably not - this is very much for the die hards, who want custom code at any cost. Running something like LineageOS wouldn't be very advisable (even if/when we finish up the port), as it would depend on performing the eMMC fault injection bug if you ever reboot for OTA - not exactly ideal.

- Can I OTA afterwards?

Sort of... - If you update to the December 2023 update, none of the 3 vulnerabilities will work, meaning if you've made any modifications, OTA updates will brick you pretty hard. Plus OTA will reset BCB, which means you will need to perform the chain once more.

- Can I use stock?

Yes, but only if you don't update the device - more on that may come in the near future with patched factory images like we do for sabrina.

- Can I go back to stock after installing custom OS's?

Yes, we have full OTA packages you can install from the stock recovery (which is also contained in said OTA package).

- I've run the exploit 10 times and it isn't working yet!

Keep trying, it's not an easy process unfortunately.

Instructions:

Follow the detailed and up-to-date instructions over on our writeup and maybe give the writeup a read/share on social media!

We will likely be posting a GitHub resources repository with scripts, etc. very soon.

Post-exploit:

At the moment, there are no ROMs for the device, but Android building instructions for LineageOS may be shared at some point in the future.

You can root by patching the vendor_boot image on the active slot using the latest canary Magisk release.

We will be releasing a repository soon that has scripts, pre-built images, and other helpful resources for this exploit chain.

Credits:

Nolen Johnson (npjohnson), Jan Altensen (Stricted), and Ray Volpe (Functioner): Theorizing, developing, and chaining together these vulnerabilities into an exploit chain.

Philip Valvo Schnotalla: QA on this post and listening to me rant for hours.

Special Thanks:

Angelina Sosa and the VRP team: Seriously, the best team in Google hands down, all are responsive, helpful, and enable security researchers to keep doing the things we love! Can't thank Google enough for the opportunity to attend hardwear.io.

Thomas Roth of [hextree.io ](https://hextree.io) - I have watched his [videos](https://www.youtube.com/channel/UC3S8vxwRfqLBdIhgRlDRVzw) for many years, and learned a lot about hardware hacking from his channel! Super stoked, and honored to find similar vulnerabilities to them! stacksmashing, lennert, and rqu all contributed to their version of the finding.

Chris Dibona: Being an awesome advocate of OSS software and helping ensure that we got all the source-code pertinent to the device. Sad to see you depart Google, best of luck in your future endeavors!