https://www.Exploitee.rs/api.php?action=feedcontributions&user=Dcplaya&feedformat=atomExploitee.rs - User contributions [en]2024-03-29T08:06:31ZUser contributionsMediaWiki 1.37.2https://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=192Logitech Revue Technical2011-01-04T06:09:12Z<p>Dcplaya: /* PIC Access */ added link to the pic disassembly</p>
<hr />
<div>{{Revue toc Inline}}<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labelled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode:<br />
<br />
#Plug in the box, once the fan goes low, hold the sync button. Box should reboot, keep the sync button held until image on screen.<br />
#Once you see the Arrow on your screen, using your keyboard press Alt+L - usually once or twice until Formatting DATA: shows on the screen, and does not go away<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
*http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
*http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
*http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
== Kernel Revisions ==<br />
<br />
*Initial kernel observed on the Revue (?): 2.6.23.18-gc0a9a5fb (richard@sayan) (gcc version 4.1.2) #3 PREEMPT Sat Jul 31 15:32:56 PDT 2010<br />
*439c26f6af05.mp-signed-ota_update-b39389: 2.6.23.18-g5fd8f46f (richard@mtdoom) #249 PREEMPT Tue Oct 5 09:55:20 BST 2010<br />
*52057d168e2b.mp-signed-ota_update-b39953: 2.6.23.18-g5fd8f46f (richard@mtdoom) #249 PREEMPT Tue Oct 5 09:55:20 BST 2010<br />
*c9914396d183.mp-signed-ota_update-b42449: 2.6.23.18-g5bba1a13 (sameer@sayan) #24 PREEMPT Fri Nov 19 11:13:31 PST 2010<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
redboot - ?<br />
<br />
cefdk-config - ?<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
fts - Flash transactional key/value storage <br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
system - [http://en.wikipedia.org/wiki/YAFFS YAFFS]<br />
<br />
data - [http://en.wikipedia.org/wiki/YAFFS YAFFS]<br />
<br />
keystore - [http://en.wikipedia.org/wiki/YAFFS YAFFS]<br />
<br />
bbt - Bad block table<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
[http://dl.dropbox.com/u/217678/Bootloader%20from%20PIC.TXT PIC Disassembly]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
''' recovery.img<br />
<br />
system/boot/recovery.img is a standard Android boot image with some extra garbage (0x580 bytes) at the front. Remove it like so:<br />
dd if=system/boot/recovery.img bs=1408 skip=1 > recovery-ungarbaged.img<br />
Unpack that like a normal Android boot image. Something like [http://android-dls.com/files/linux/split_bootimg.zip this Perl script] works well.<br />
<br />
The kernel (system/boot/kernel) is also a boot image with the same extra garbage at the front.<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Open Ports ==<br />
List nmap ports<br />
<br />
Normal Mode, hooked to a Dish Network DVR (622) via WiFi:<br />
<br />
*Nmap scan report for LogitechRevue (192.168.1.142)<br />
*Host is up (0.060s latency).<br />
*Not shown: 65528 closed ports<br />
*PORT STATE SERVICE<br />
*53/tcp open domain<br />
*1100/tcp open unknown<br />
*5222/tcp open unknown -- [http://xmpp.org/ Extensible Messaging and Presence Protocol (XMPP) Service (http://xmpp.org/)]<br />
*5223/tcp open unknown -- SSL port for [http://xmpp.org/ XMPP]<br />
*9551/tcp open unknown -- [[AnyMote]] Pairing Service through IpRemoteControlService -- SSL handshake requests cert and logs show errors from [[AnyMote]]<br />
*9552/tcp open unknown -- [[AnyMote]] Connection Port<br />
*35832/tcp open unknown<br />
<br />
== Available Pinouts ==<br />
*UART1 --> [http://i.imgur.com/xJHay.jpg UART Pinout]<br />
*J3 --> PIC Chip Access (Pin 1 = VPP/MCLR, Pin 2 = VDD, Pin 3 = VSS, Pin 4 = ICSPDAT/PGD, Pin 5 = ICSPCLK/PGC, Pin 6 = Auxiliary)<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> I2C (Top left - GND Top right - ? Bottom left - SDA Bottom right - SCL)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA Pinout (Pin 1 = GND, Pin 2 = TXP / A+ , Pin 3 = TXN / A-, Pin 4 = GND , Pin 5 = RXN / B-, Pin 6 = RXP / B+ , Pin 7 = GND)<br />
*J24 --> Unknown (Pin 1 = 3.3, Pin 2 = ?, Pin 3 = ?, Pin 4 = GND)<br />
*J13 --> Unknown (Power for SATA?) - (Pin 1 = ?, Pin 2 = GND, Pin 3 = GND, Pin 4 = 5v)<br />
*XDP1 --> Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging] [ftp://download.intel.com/design/Pentium4/guides/31337301.pdf Page 23 Pinout]<br />
[[Category:Logitech Revue]]<br />
<br />
== Volume Management Configuration ==<br />
Similar to other android based products, external storage can be attached and the device will attempt to mount it to /sdcard as per the following vold.conf:<br />
<pre><br />
volume_sdcard {<br />
# NOTE: This path is overbroad and will capture any device on the<br />
# tatung3/tatung4 external PCI bus. This needs to be fixed, in conjunction<br />
# with vold changes to handle logical device names (DEVPATH names are not<br />
# static, unfortunately.)<br />
media_path /devices/pci0000:00/0000:00:01.0/0000:01:0d.1/usb2/<br />
media_type scsi<br />
mount_point /sdcard<br />
read_only true<br />
}<br />
</pre><br />
<br />
Note the interesting comment about the media_path as well as the read_only=true attribute.</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Root_Progress&diff=191Root Progress2011-01-04T04:53:28Z<p>Dcplaya: Made the page just so its not blank</p>
<hr />
<div>No information available at this moment.<br />
<br />
Check back later</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Exploitee.rs:About&diff=186Exploitee.rs:About2011-01-03T23:54:13Z<p>Dcplaya: </p>
<hr />
<div>We are a group of people who are interested in getting full access to the GoogleTV environment. <br />
<br />
There is an IRC channel on irc.freenode.net #googletv or visit on your gtv at [http://webchat.freenode.net freenode webchat]<br />
<br />
People working on the project include but not limited to<br />
*AgentHH<br />
*cj_000<br />
*craigdroid<br />
*[http://www.twitter.com/dcplaya dcplaya]<br />
*tdweng<br />
*zenofex<br />
<br />
''If I am missing anyone, please add them''<br />
<br />
We would also like to thank [http://www.resnodesigns.com resno] for providing webhosting.</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=88Logitech Revue Technical2010-12-29T06:29:20Z<p>Dcplaya: /* Specs */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge motherboard].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=87Logitech Revue Technical2010-12-29T06:27:35Z<p>Dcplaya: /* Specs */ added direct link to higher res link of motherboard</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
Direct link to the higher resolution picture of the [http://guide-images.ifixit.net/igi/5jWUcNNOrDvXZqEy.huge Motherboard].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=86Logitech Revue Technical2010-12-29T06:22:36Z<p>Dcplaya: /* Specs */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=85Logitech Revue Technical2010-12-29T06:19:54Z<p>Dcplaya: /* Specs */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=84Logitech Revue Technical2010-12-29T06:16:56Z<p>Dcplaya: /* Usage */ removed resistance</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=83Logitech Revue Technical2010-12-29T06:10:33Z<p>Dcplaya: /* Flash Layout */ formatting</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=82Logitech Revue Technical2010-12-29T05:56:38Z<p>Dcplaya: /* Usage */ added info to the pic usage</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
*System reboot/powerdown<br />
*Possibly HDMI CEC <br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - root partition, goes in hand with the kernel image, also in squashfs format<br />
<br />
fts - Flash transactional key/value storage<br />
<br />
bbt - Bad block table<br />
<br />
system - yaffs<br />
<br />
data - yaffs<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Exploitee.rs:About&diff=78Exploitee.rs:About2010-12-29T05:53:32Z<p>Dcplaya: added current contributors in alphabetical order</p>
<hr />
<div>We are a group of people who are interested in getting full access to the GoogleTV environment. <br />
<br />
There is an IRC channel on Freenode, #googletv<br />
<br />
People working on the project include but not limited to<br />
*AgentHH<br />
*cj_000<br />
*craigdroid<br />
*dcplaya<br />
*tdweng<br />
*zenofex<br />
<br />
<br />
''If I am missing anyone, please add them''</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=72Logitech Revue Technical2010-12-29T05:44:08Z<p>Dcplaya: /* PIC Access */ added pic pinout</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
*There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
*The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. [http://www.ianstedman.co.uk/Projects/TK3_PICKit2_adaptor/Pickit2_pinout.png PIC Pinout]<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=71Logitech Revue Technical2010-12-29T05:40:23Z<p>Dcplaya: /* Available Pinouts */ added a pdf for info on XDP</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter [http://software.intel.com/sites/products/documentation/hpc/atom/application/device_driver_debugging.pdf Information on XDP Debugging]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=68Logitech Revue Technical2010-12-29T05:34:18Z<p>Dcplaya: /* Available Pinouts */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably<br />
*XDP1 --> Possibly a Intel XDP Debug Adapter</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=67Logitech Revue Technical2010-12-29T05:33:13Z<p>Dcplaya: /* Available Pinouts */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Push Button Switch (Use is unknown)<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=66Logitech Revue Technical2010-12-29T05:32:18Z<p>Dcplaya: /* Available Pinouts */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Unknown<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)<br />
*J13 --> Power for another fan probably</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=65Logitech Revue Technical2010-12-29T05:30:16Z<p>Dcplaya: Added pinout info</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]<br />
<br />
== Available Pinouts ==<br />
*UART1 --> Uart Pinout<br />
*J3 --> PIC Chip Access<br />
*SW1 --> Unknown<br />
*J20 --> Unknown (May be JTAG)<br />
*J69 --> USB Pinout<br />
*SATA1 --> SATA pinout (may have power included, needs verification)<br />
*J24 --> Unknown (may be power for SATA)</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=63Logitech Revue Technical2010-12-29T05:24:09Z<p>Dcplaya: /* Usage */ Added what I think the IDT ICS chip does</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
IDT ICS9LPRS525AGLF Clock for CPU<br />
*Provides a clock and resistance for the Intel Atom CPU<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=62Logitech Revue Technical2010-12-29T05:22:04Z<p>Dcplaya: /* Specs */ Added the IDT ICS chip</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf Datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
*IDT ICS9LPRS525AGLF Clock for CPU [http://dl.dropbox.com/u/217678/9LPRS525.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]<br />
<br />
== Updates ==<br />
The updates contain a subset of update files, a boot.img and a recovery.img<br />
<br />
'''boot.img & recovery.img'''<br />
<br />
The thread at [http://forum.xda-developers.com/showpost.php?p=8844074&postcount=80 xda-developer] has the process to extract from the .img files (thx bftb0):<br />
<br />
"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."<br />
<br />
" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".<br />
<br />
You can search for the occurence of the beginning of the squashfs archive with the command<br />
<br />
hexdump -C system/boot/recovery.img | grep hsqs<br />
<br />
and then do a little math to figure out how to dump that portion of the recovery image, e.g.:<br />
<br />
dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img<br />
<br />
and then unpack that file using unsquashfs."<br />
<br />
'''Odex files'''<br />
<br />
The .odex files can be extracted by using the following guide [http://code.google.com/p/smali/wiki/DeodexInstructions Deodex Instructions]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=59Logitech Revue Technical2010-12-29T05:15:33Z<p>Dcplaya: /* Usage */</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
Silicon Image Sil9135 HDMI 1.3 Receiver<br />
*Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF<br />
*Supports DTS even though the Revue does not (An update can probably enable this feature)<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=58Logitech Revue Technical2010-12-29T05:11:57Z<p>Dcplaya: /* Specs */ Realtek datasheet added</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver [http://realtek.info/pdf/RTL8201N_1-1.pdf datasheet]<br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=57Logitech Revue Technical2010-12-29T05:09:53Z<p>Dcplaya: /* Specs */ added the Phison chip</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver <br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
*Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=56Logitech Revue Technical2010-12-29T05:07:46Z<p>Dcplaya: /* Specs */ Added a bunch of datasheet links</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]<br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]<br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver <br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller [http://ww1.microchip.com/downloads/en/DeviceDoc/39881c.pdf Datasheet]<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=54Logitech Revue Technical2010-12-29T04:44:43Z<p>Dcplaya: /* Specs */ added datsheet for the samsung chip</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet]<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver <br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) <br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver <br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
[[Pasted Locally]]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump] [[Local PIC Hex Dump]]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=45Logitech Revue Technical2010-12-29T02:30:05Z<p>Dcplaya: /* PIC Access */ updated the hex dump so it points to the googletv pastebin</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM)<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver <br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) <br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver <br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
#Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
#Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
#You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
Serial output<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
[http://googletv.pastebin.com/PBWRCAqB PIC Hex Dump]</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Exploitee.rs:About&diff=43Exploitee.rs:About2010-12-29T02:23:21Z<p>Dcplaya: Created page with "We are a group of people who are interested in getting full access to the GoogleTV environment. There is an IRC channel on Freenode, #googletv"</p>
<hr />
<div>We are a group of people who are interested in getting full access to the GoogleTV environment. <br />
<br />
There is an IRC channel on Freenode, #googletv</div>Dcplayahttps://www.Exploitee.rs/index.php?title=Logitech_Revue_Technical&diff=37Logitech Revue Technical2010-12-29T01:59:11Z<p>Dcplaya: Added info about PIC pinout/access</p>
<hr />
<div>== Specs ==<br />
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU <br />
*Gigabyte GA-SBKAN2 motherboard<br />
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM)<br />
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Silicon Image Sil9135 HDMI 1.3 Receiver <br />
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) <br />
*Realtek Semiconductor RTL8201N 10/100M PHYceiver <br />
*Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller<br />
<br />
The Logitech Revue was recently torndown and its [http://www.ifixit.com/Teardown/Logitech-Revue-Teardown/3788/1 inners revealed].<br />
<br />
== Usage ==<br />
Samsung K9F8G08U0M 1 GB NAND Flash<br />
*Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..<br />
<br />
Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)<br />
*Used for persistent storage, device is /dev/sda - possible to override with an external USB drive<br />
<br />
Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller <br />
*Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard<br />
<br />
== Update Procedure ==<br />
<br />
Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1") <br />
<br />
Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)<br />
<br />
Boot into recovery mode: (confirm?)<br />
<br />
Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.<br />
<br />
Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.<br />
<br />
You can then update the box, with a newer update. Downgrading fails however due to a date check.<br />
<br />
<br />
== Firmware Links ==<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip<br />
<br />
http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip<br />
<br />
(Add update history?)<br />
<br />
== Flash Layout ==<br />
<br />
via: http://googletv.pastebin.com/233dZqZx<br />
<br />
Creating 13 MTD partitions on "intel_ce_nand":<br />
*0x00000000-0x00200000 : "mbr"<br />
*0x00200000-0x00a00000 : "cefdk"<br />
*0x00a00000-0x00c00000 : "redboot"<br />
*0x00c00000-0x00e00000 : "cefdk-config"<br />
*0x01000000-0x01800000 : "splash"<br />
*0x01800000-0x01900000 : "fts"<br />
*0x01900000-0x02d00000 : "recovery"<br />
*0x02d00000-0x03200000 : "kernel"<br />
*0x03200000-0x07200000 : "boot"<br />
*0x07200000-0x1f200000 : "system"<br />
*0x1f200000-0x3fa00000 : "data"<br />
*0x3fa00000-0x3ff00000 : "keystore"<br />
*0x3ff00000-0x40000000 : "bbt"<br />
<br />
mbr - Master Boot Record<br />
<br />
cefdk - Boot loader, may or may not have a shell<br />
<br />
Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )<br />
<br />
Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu<br />
<br />
Kernel - The kernel image<br />
<br />
Boot - Ramdisk for the actual box, goes in hand with the kernel image, also in squashfs format<br />
<br />
== Serial Output ==<br />
<br />
The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion). <br />
<br />
The pins operate at 3.3v and the port at 9600 baud with the following pinout:<br />
<br />
[http://i.imgur.com/xJHay.jpg UART Pinout]<br />
<br />
== PIC Access ==<br />
There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.<br />
<br />
[http://dl.dropbox.com/u/217678/pic_dump.hex.txt PIC Hex Dump]</div>Dcplaya