yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] twobit:
The remote debugging info is good....Are you trying to connect when using ADB on windows or linux ? If linux, can you do a lsusb and make sure you have added the the USB vendor ID to the rules.d file (see http://developer.android.com/guide/developing/device.html#setting-up for info on what you need to do). You will probably have to modify the adb src code as well to add the same vendor ID to adb and then do a "make sdk".

I got a unit at work on Friday, but got too busy to do anything. Will look into this first thing on Monday.
[Android Software/Hacking General [Developers Only]] kaze00:
Tried on OSX. How would lsusb work if I'm trying to connect remotely? I assumed remote debugging meant over the network, since most android devices just say USB debugging there.
[Android Software/Hacking General [Developers Only]] andyju:
Very interesting. Keep working on!

If games supported, I really want to buy one!
[Android Software/Hacking General [Developers Only]] kaze00:
It did do an OTA update when I first booted, didn't appear ot be anyway to skip it.
[Android Software/Hacking General [Developers Only]] zonyl:
It would be nice to get the rom and see if the Amazon VOD and Netflix apps are bytecode for other Android devices.
[Android Software/Hacking General [Developers Only]] hharte:
iFixIt Teardown of Revue reveals UART connector

In the upper right corner of the Revue motherboard shown in iFixIt's teardown, there is a four pin connector marked UART1, near J4. We can hope it's a serial console... I'll take mine apart tonight (assuming UPS drops it off today) and find out :D.

http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1?revisionid=HEAD

There is also a footprint for a SATA connector, which could open up some possibilities for a DVR.
[Android Software/Hacking General [Developers Only]] Googa:
I bought a Revue yesterday, and absolutely love it. There certainly are current limitations, but I'm sure all will be overcome soon enough, given the Android OS. Perhaps I'm most excited about the potential!

I'll be doing a lot of tinkering, and will see what I can get into with ADB later tonight.
[Android Software/Hacking General [Developers Only]] twobit:
I managed to capture the OTA link for the revue unit. Unlike the Sony device, the Revue does not ask you for permission to d/l the link (mandatory update maybe ?)

http://android.clients.google.com/p.../439c26f6af05.mp-signed-ota_update-b39389.zip

I have not had time to poke into yet....have fun
[Android Software/Hacking General [Developers Only]] jmlott:
Awesome! Thank you for grabbing this. It would have been nice if the flash apk was in there so the person who modded the android version could do the same here and give us Hulu, etc back. That said, we would still need to figure out how to get into recovery on the Revue and manually apply the update.zip. Anyway, we are one step closer now. Thank you again.
[Android Software/Hacking General [Developers Only]] zonyl:
Tada!

Netflix refuses to install, however, the Amazon VOD app installed fine. Apparently it doesnt register to the Launcher intent, so Ill have to do some digging tonight to see how to get it working.
[Android Software/Hacking General [Developers Only]] twobit:
How are you installing the APK's ? ADB or through the browser ?

NVM...I thought you were installing those APK's on the GTV box, not on other Android device.
[Android Software/Hacking General [Developers Only]] twobit:
Did you deodex netflix ?
[Android Software/Hacking General [Developers Only]] nagmier:
Anyone try getting the Revue into recovery with the power button trick? I'm going to give it a shot shortly
[Android Software/Hacking General [Developers Only]] twobit:
I tried to find the power button but couldnt, so I didnt try this out :D
[Android Software/Hacking General [Developers Only]] zonyl:
Its just a shell. There is a whole directory already installed on the ROM with x86 libs that it needs to run, so this likely wont run on any ARM devices.
[Android Software/Hacking General [Developers Only]] hharte:
You might try copying the update to update.zip on a USB stick and try booting the box to see if it installs. Seems like the Sony attempts to update from USB stick if one is plugged in before going to Recovery, but I'm not sure if it always does that or only if you press and hold the power button while plugging the unit in.
[Android Software/Hacking General [Developers Only]] Apeman42:
Great job everyone.... I am trying to get a Revue by the end of the week.

I have had no success in getting ADB through Ethernet or USB on the Sony... hopefully I can get my hands on another Sony GTV and use a ethernet sniffer to find the update.zip. Would Ethereal work? Or could you show me what I should get?
[Android Software/Hacking General [Developers Only]] hharte:
Wireshark is the new name for Ethereal, and should work fine.

I looked quickly though the update.zip for the Revue, and haven't seen the ADB daemon. I was thinking that this might be an incremental update, but looking at the dates in the files, I think it is a full update, so I think the bad news is that ADB is not included in the system.

If it is possible to repack and update with this ZIP, then we should be able to compile ADB for x86 and include it in a new "ROM."
[Android Software/Hacking General [Developers Only]] hharte:
If you unpack the update.zip, there is a file in system/boot/cefdk-logitech_ka3.bin which looks like the bootloader:

Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK)

Copyright (C) 1999-2009 Intel Corporation. All rights reserved.

Build Time (%s).

03/12/10 12:25:24

There are stings in there like:

F1: Save & Exit Setup

F2: Upgrade Firmware

So, maybe it is worth plugging in a USB keyboard, and pressing ESC, F1, F2, F10, etc, like you do on a PC to get into the BIOS.

And here is some hope:

Boot kernel from USB stick.

************************************************************

* *

* CEFDK IS NOT SECURE! *

* DEVELOPMENT BUILD ONLY *

************************************************************

ERROR: kernel size (%ld) invalid

ERROR: ramdisk size (%ld) invalid

ERROR: second size (%ld) invalid

ERROR: bootimg checksum mismatch

Boot Normal kernel from NAND flash.

Boot Recovery kernel from NAND flash.

boot_android_usb

get_bootimg_size

There is also a kernel and a recovery.img in that directory. I was unable to unpack the kernel using the normal Android boot image unpacking method, but it definitely looks like the recovery image contains a header followed by two separate chunks of data, presumably a kernel and a ramdisk.img.
[Android Software/Hacking General [Developers Only]] subyfan:
Come on PEOPLE!!!

I'm not of the skill or knowledge to dive into this sort of thing (Engineering Major, no programming...lol). Let's get to work! This platform has absolutely AMAZING potential. I'm sitting on a REVUE right now and it is AWESOME (only better if it was rooted)!!! Let's get to it!!!
[Android Software/Hacking General [Developers Only]] hharte:
I'm starting to think the easiest way to make this platform open (apps, root, etc) is to make a bootable USB stick, and boot it using the bootloader, not even disturbing the on-board FLASH.Searching the web shows that this bootloader has been used on other Atom CExxxx platforms, anyone know of other platforms that use it, or have any experience with it?

Looking at the boot.img and recovery.img in the update.zip, they don't seem to follow the same pattern as the Android .img files. It would be great if someone can decipher them as they appear to be compressed (and not gzip as far as I can tell.) The boot.img is around 18MB, so we definitely need to figure out how to extract the contents. Extracting the recovery may shed some clues on what can be done with the recovery.

It will be great to get the Sony update.zip as well to compare with the Logitech.
[Android Software/Hacking General [Developers Only]] subyfan:
OK GUYS...

I've tried everything that I can think of to get into recovery...played with reset button for an hour, tried ADB'ing in over network and USB, and tried update.zip over USB. Any ideas because I am all out. We may have to go inside to get access to this thing...
[Android Software/Hacking General [Developers Only]] deficitism:
Nice job grabbing the OTA!
[Android Software/Hacking General [Developers Only]] twobit:
I managed to find something that looks like a update screen on the Revue. Press and Hold the little button on the back of the unit while powering up and you will eventually see a screen with a Google TV Logo with a Download arrow / progress bar. I cant figure out how to actually see the recovery menu but I will keep try.

Nevermind - it looks like the above is doing a factory reset operation.

Some other things I found -

CTRL-ALT-DELETE & CTRL-ALT-BKSPC both reboot the device
[Android Software/Hacking General [Developers Only]] hharte:
Yes, I saw this in the kernel source, but it is not enabled in the Sony.

drivers/char/cad.c:

/*
* Ctrl-Alt-Del input handler
*
* Copyright (C) 2010 Google, Inc.
* Author: Eugene Surovegin <es@google.com>
*
* based on keyboard.c
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
* may be copied, distributed, and modified under those terms.
*
*/

config CAD_HANDLER
bool "Ctrl-Alt-Del input handler"
depends !VT
default y
---help---
Say Y here if you want Ctrl-Alt-Del to work without full
"Virtual Terminal" support.
config CAD_HANDLER_BACKSPACE
bool "Allow the use of Backspace key instead of Delete"
depends CAD_HANDLER
---help---
Say Y if you want to use Backspace key instead of Delete.
This is required for keyboards lacking Delete key.

I'm investigating the serial console angle on the UART1 header, but so far no luck.
[Android Software/Hacking General [Developers Only]] fazzmanic:
watching this thread, i have the Logitech Revue and am willing to lend a hand!
[Android Software/Hacking General [Developers Only]] hharte:
There's lots of stuff you can try without too much risk. I've noticed based on the CTRL-ALT-DEL using both a USB and the wireless keyboard, that the keyboard becomes "active" and can reboot the system while the Logitech screen from the bootloader is still active. I guess that means that the kernel has booted.

Anyway, been trying holding down keys during boot to see if I can get into recovery that way. No luck yet, tried all the phone tricks like holding Vol-Up and DPAD-UP, but nothing seems to work yet.

I also tried holding down F-keys, ESC, DEL, etc. to see if I can get into the bootloader but no success on that either.
[Android Software/Hacking General [Developers Only]] soner607:
I have the Sony blu-ray Google TV unit and just tried the Ctrl, Alt, backspace and it rebooted my device!

Anyone with a Sony know how to power on/off the cable box? I can control all

other cable/DVR functions and can power on/off my TV, AMP, and Google TV. Just not my cable box. Please tell me Sony didn't over look this and I still need to use my cable remote...
[Android Software/Hacking General [Developers Only]] Apeman42:
Yep, CTRL+ALT+BACKSPACE also reboots my Sony...and I have been having the same issue with FiOS and turning off my cable box.

I am saving up some money to buy another Sony GTV box to capture the update.zip
[Android Software/Hacking General [Developers Only]] subyfan:
Wow...

Does nobody follow XDA anymore??? This thread is moving mighty slow! I know the Android/XDA community is HUGE! What is the problem? LOL. Get to it!!! :cool:

If anyone has any bright ideas or even GUESSES, let me know and I will look into it!!!
[Android Software/Hacking General [Developers Only]] twobit:
:D patience man...

If someone figured out how to get ADB working, I have already re-compiled rageagainstthecage for the atom. However, as hharte said already, it seems like there is no adbd running and possibly entirely missing from the system. I have a feeling this was done on purpose because it becomes that much more difficult to install stuff on the device. If adb was enabled, even without root, we could possibly start working toward app installs, etc on the device, and obviously Google does not think that app install is ready for prime time even through a backdoor mechanism.
[Android Software/Hacking General [Developers Only]] hharte:
Sony GTV getting another OTA

I plugged my Sony box back in tonight, and it says another OTA has been downloaded and is ready to install (206MB). I hit "later" on the install dialog, but since the OTA is already saved on the unit, I'll do a factory reset from Recovery and hopefully it will download again. Unfortunately, I dont have my laptop with me tonight, so will try the Wireshark sniffer capture tomorrow, unless someone beats me to it.
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
[edit]Based on the 206MB number noted by hharte, the NSZ-GT1 (Bluray box) and the NSX-46GT1 get different updates.[/edit]

2nd Sony OTA for NSX-46GT1 (Sony Google TV 46"):

http://android.clients.google.com/p...1.package_list_ogm_2.1_2010102101ON_asura.zip

Settings > System Updates says

The quality of operations on Google Chrome has been improved

The quality of operation on Sony Recommends and Qriocity has been improved

223MB hopefully has something more interesting in there.

Also it seems the Bluray box doesn't have one of the ports that the TV has (or at least the 46" has)

Ports:

Closeup of interesting port (You have to pop off a plastic cover)
[Android Software/Hacking General [Developers Only]] bftb0:
FYI

I dl'ed the (Revue) .zip from the URL twobit posted - the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package.

No adbd in sbin/ even though the service is defined - but disabled - in init.rc :(

Not sure if you folks already knew this - I couldn't intuit that from reading between the lines.

cheers

bftb0

[ Edit ] It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs.

Sort of a mystery why "boot.img" would be in a different format from "recovery.img", though.
[Android Software/Hacking General [Developers Only]] gtv-fan:
Why do you think that hack would work? Google TV was released *after* it was made public...
[Android Software/Hacking General [Developers Only]] hharte:
Great work on figuring out the boot.img and recovery.img formats. That should be very helpful in figuring out more parts of the system, and eventually, to create custom ROMs.

Also, nice work on grabbing the OTA update link for the 46" Sony GTV. I guess we should compare that update with the one for the DVD player when we get it to see what the differences are.

Hopefully since GTV uses an old Linux Kernel, there will be some unpatched exploits to gain root access once we can execute native code.
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
I looked at the 46" TV update and it's a bit different than Android updates I've dissected before:

META-INF/ package_list_ogm_2.1_2010102101ON.txt
history/ system/

system has build.prop which is a normal text file, however "history" seems to be binary diffs or something:

$ cat history/board_conf.sh
`??MCK???Z???o]|2?->,?4'wƍ?}?հM???H??=ڥC??pL???????^S?MG?	,?^?VD???_ ???WtW????8bD???Մ? `QKa??X	Vf?&?j‹?
???-??!??'7&-痐I??}?)f???4?B ?ԼZ"Ei׈?:??
??&3??????c?|c?;?U?˅????C??roS?̞....

Similarly I can't extract the tgz files and "file" just reports them as "data".

Anyone seen this kind of setup before? META-INF doesn't have any update script, it's just the certs and manifest.
[Android Software/Hacking General [Developers Only]] hharte:
OTA update.zip for Sony NSZ-GT1 DVD Player

Ok, here's the DL link for the Sony NSZ-GT1 DVD Player:

http://android.clients.google.com/p...1.package_list_ogm_2.1_2010102101ON_asura.zip

Looks exactly the same as the 46" Sony Google TV version posted previously, so that is good news.
[Android Software/Hacking General [Developers Only]] bftb0:
The "magic number" that you would expect to find in the header of a gzip'ed file did not appear anywhere in a few of the .tgz files, which leads me to think that almost all the files are purposefully obfuscated.

Note that the lead-off bytes in all the .tgz files are identical, suggesting a primitive method of obfuscation (e.g. byte substitution or a fixed XOR stream.

But yeah, the lack of an update-script suggests that Sony is not using the standard Android "/sbin/recovery"

bftb0
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
Good thinking.

$ xxd format_sda_20100514.sh | head -n 2
0000000: 1bee 60c8 13e4 014d 434b 88dc e978 ba97 ..`....MCK...x..
0000010: b00f 6e58 6e29 2ab9 6279 60d1 747c 4dd2 ..nXn)*.by`.t|M.

0000000: 1bee 60c8 13e4 014d 434b 88b9 801c c4f1 ..`....MCK......
0000010: c26a 0226 0b5b 3fd3 7276 75cc 3d35 50cb .j.&.[?.rvu.=5P.

so it seems likely that:

1b ee 60 c8 13 e4 01 4d 43 4b
# ! / b i n / s h \n

Which suggests it's not simply byte substitution as the / are different.

Similarly for gzips:

$ xxd netflix_20101008.tgz | head -n 2
0000000: 2744 47aa 219a 8172 2b42 6ec6 a44d bd09 'DG.!..r+Bn..M..
0000010: 56d8 4e98 2add a037 f9cc 48c0 3251 1b74 V.N.*..7..H.2Q.t
$ xxd releasekey_20100915.tgz | head -n 2
0000000: 2744 47aa c1e1 be72 2b42 c9b7 e4e7 8e7c 'DG....r+B.....|
0000010: de77 2f09 5525 41ce 525f b0d5 8875 158e .w/.U%A.R_...u..

We'd expect the gzip to start with 1f8b 0808

$ gzip -c /dev/null | xxd | head -n 1
0000000: 1f8b 0808 b064 c84c 0003 6e75 6c6c 0003 .....d.L..null..

So 2744 47aa in this case means 1f8b 0808
[Android Software/Hacking General [Developers Only]] hharte:
I don't know what that connector is, but notice the USB connector footprint below it: power and ground on pins 1,4 and a differential pair on 2,3.
[Android Software/Hacking General [Developers Only]] bftb0:
Agreed - although by "byte substitution" I just meant that it did not appear to be a block cipher, but something which proceeds byte by byte.

Doesn't mean that it would be easy to figure out, though. Any number of substitution ciphers would do this, but the first three bytes make it look like a XOR pad:

.tgz

plaintext: 1f 8b 08 00

ciphertext: 27 44 47 aa

xor: 38 CF 4F AA

.sh

plaintext: 23 21 2f 6a 69 6E 2F 73 68( #!/bin/sh )

ciphertext: 1b ee 60 c8 13 e4 01 4d 43

xor: 38 CF 4F AA 7A 8A 2E 3E 2B

.zip

plaintext: 50 4b 03 04 14 00 00 00

ciphertext: 68 84 4c ae 6e 8a 2e 3e

xor: 38 CF 4F AA 7A 8A 2E 3E

Comparisons of the computed XOR pad for these three different (known plaintext) samples shows identical results for the first eight or nine bytes.

First 9 bytes of XOR stream are: 38CF4FAA 7A8A2E3E 2B

HTH

bftb0
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
I asked my friend who has more experience than I with this kind of thing, his thoughts:

It's tempting to connect something there. I wish I had an oscilloscope.
[Android Software/Hacking General [Developers Only]] twobit:
Just a hunch...no real proof. There have been quite a few devices released after the hack was made public...none of them fixed the exploit.
[Android Software/Hacking General [Developers Only]] twobit:
If you have a sound card, you can use that as a oscilloscope. There are many freeware apps that you can use for that purpose...all you need to do is fashion some wires.

http://www.google.com/search?q=sound+card+oscilloscope
[Android Software/Hacking General [Developers Only]] Kermode:
Btw, if you reformat your website, perhaps Google would give you a free Google TV ;)

Google TV is coming to 10,000 lucky developers
[Android Software/Hacking General [Developers Only]] hharte:
I don't know much about cryptography or stream cyphers, but does this mean that if we get enough known plaintext, we can derive the key?

BTW, I tried renaming the OTA to update.zip and put it on a USB stick, and was not able to get it to install from the recovery menu, so that's another hurdle to overcome...
[Android Software/Hacking General [Developers Only]] kevin@TeslaCoil:
Great work.

The shebang will actually be "#!/bin/sh\n" or "#!/bin/sh\r\n".

All the shell files have the same two bytes after the sh, so I imagine it's \r\n, however it could be \n\n or \n#.

Assuming \r\n:

.sh
plaintext: 23 21 2f 6a 69 6E 2F 73 68 0D 0A ( #!/bin/sh\r\n )
ciphertext: 1b ee 60 c8 13 e4 01 4d 43 4B 88
xor: 38 CF 4F AA 7A 8A 2E 3E 2B 46 82

First 11 bytes of XOR stream are: 38CF4FAA 7A8A2E3E 2B4682 (ASSUMING \r\n after #!/bin/sh)
[Android Software/Hacking General [Developers Only]] hharte:
So assuming they didn't use a one-time pad the same size as the original file, then the pad must be repeated eventually. It might be interesting to try and repeat it every 16 bytes, 32-bytes, 64-bytes, etc, and see if any of the shell script makes sense. Based on what is uncovered (if anything) we might be able to guess more characters in the cleartext, to get more characers of the pad...
[Android Software/Hacking General [Developers Only]] bftb0:
There are a lot of stream ciphers; problem is, we don't know which one - or if any of them - are being used here. A file of random bytes could even be used, in which case there might not be any "algorithm" involved at all.

I wouldn't be optimistic about this case. While it is certainly true that if you can inject plaintext into an XOR-padding system and observe the output, then you can recover the XOR (padding) bytestream; and if the same bytestream is re-used for other cleartexts, then you can trivially obtain those cleartexts with a replay attack. But - I don't know how you would do that in this case, unless someone were to get their hands on the plaintext version of the (longest) obscured file (in this case, a 123 MB file: history/gtv/asura-rel_img_odex_02_gm_ota1-r9645_gm_ota1-r1221_system.tar.gz )

Probably there are better uses of our time than brute-guessing this.

bftb0
[Android Software/Hacking General [Developers Only]] hharte:
Looking at the bin/recovery program from the Logitech recovery.img, there are some interesting things. Once in recovery, the menu should look like this:

Use arrow keys to highlight, enter to select.
Apply update from USB (update.zip) [Alt+S]
Wipe data/factory reset [Alt+W]
Reboot system now [Alt+R]
Wipe cache partition

Also, I found several strings related to Obfuscation:

I:Unobfuscate complete.
E:Unobfuscate: Could not open input file.
E:Unobfuscate: could not open output file.
E:Unobfuscate: Error reading input file.
E:Could not unobfuscate package.
I:Copying package from %s to %s
E:Could not open output file.
E:Could not copy package from disk.
E:key length (%d) does not match expected size
E:unexpected character between keys

And some funny stuff obviously left from a phone build:

HTC_RIL
CDMA
PHONE

Since we still don't know how to get into recovery mode on the Logitech, there may be one possibility, looking at sbin/init:

init: critical process '%s' exited %d times in %d minutes; rebooting into recovery mode

...if we can find out how to kill a critical process repeatedly...