Sony Bootloader HW Root

From Exploitee.rs
Jump to navigationJump to search


caption


About

Coming Soon!


Warnings

  • This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.
  • This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.
  • This may brick your GTV. It shouldn't, but it still might!
  • This will erase all data on the USB drive(s) used.
  • You must be at the 2012.05.20 GTV 3.2 OTA (Over The Air) before proceeding!
  • This is an advanced procedure and is far outside of normal computer use and designed function for the GTV. Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware. Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully. If you find yourself having trouble, you may want to think long and hard before taking these risks. If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren't a company or organization and can't perform miracles if you break something.

Tools Needed

  • 1-2 USB Drives
  • UART Adapter
  • Nano-JST 4-pin connector with wires (Links to purchase can be found at bottom of page)
    • OR
  • Soldering Iron w/solder and wires.
  • Sony NSZ-GT1 on the most recent update (20120520)

Pre-Pre-setup

Disconnect your GTV from the internet!

  1. There are newer software versions that the procedure below won't work on. If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.
  2. Tell your family, roommates, spouse, etc not to reconnect it.

Check your software version to make sure you are on a version that can use this procedure

  1. Go to Settings -> About on your Google TV
  2. Look for version 20120520
  3. If your version is earlier than 20120520 download the correct 20120520 (Android 3.2 - BL Exploitable) version from Sony Update Downloads and use a USB drive to install it before proceeding with this procedure. (Eagle is the BluRay player, Asura is the TV)

Writing images in Windows

  1. Open the a Windows command prompt (Windows key+R) or Start->Run->cmd then press enter.
  2. Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at http://www.sophos.com/support/knowledgebase/article/13195.html)
  3. Navigate into the Tools/ directory.
  4. Plug USB drive #1 in and then enter the following command into the command line:
    dd.exe --list
  5. Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in "My Computer" to the corresponding "\\.\e:" (assuming the drive letter is e:). The format of the list should have the same syntax as the following:
    \\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\
    link to \\?\Device\Harddisk1\DP(1)0-0+11
    removeable media
    Mounted on \\.\e:
  6. Using the above example the information we are looking for is the top line "\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\", we will want to remove the ending backslash and enter it into the following command syntax:
    Syntax: dd if=USB#.img of=<volumeinfofromabove> bs=4096
    Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096
  7. A successful completion would look as follows:
    rawwrite dd for windows version 0.5.
    Written by John Newbigin <[email protected]>
    This program is covered by the GPL. See copying.txt for details
    10240+0 records in
    10240+0 records out
  8. Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 2 usb's flashed with the corresponding USB1.img and USB2.img. If you are choosing to use one usb drive, create each directly before use.
  9. You are ready to start the downgrage + root.


Writing images on MacOSx

  1. Connect your USB Stick and open "Disk Utility" app.
  2. Open a terminal window and type the following command:
    diskutil list
  3. Make note of which disk corresponds to your USB stick.
    ex: dev/disk1
  4. View previously opened "Disk Utility" app and and select/highlight your thumb drives partition.
  5. Click the "unmount" button at the top of the "Disk Utility" window.
  6. In the terminal window type the following command replacing the "/dev/disk1" with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:
    Syntax: dd if=USB#.img of=/dev/disk1 bs=4096
    Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096
  7. Press enter, when command is complete you will need to repeat steps 2-6 until you have created both USB drives. If you are planning on only using 1 USB, repeat steps on each drive before its use in the guide.
  8. Optionally, consider verifying that these steps worked by following the "USB Drive Validation" steps below.
  9. You are ready to start the downgrage + root.

Writing images in Linux

  1. Open a linux terminal.
  2. Plug in USB
  3. Navigate to the directory the .img files are stored.
  4. Determine which device is your USB thumbdrive by using the command "dmesg" and looking for the last set of output with sdc/sdb/sdd/etc.
  5. Verify that the device is correct by matching the device name to the appropriate mount point in the following command:
    "cat /proc/mounts"
  6. If you believe you have the correct device then use the following command syntax for dd:
    Syntax: dd if=USB#.img of=<volumeinfofromabove> bs=4096
    Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096
  7. Repeat steps 3-7 until you have 2 usb's flashed with the corresponding USB1.img and USB2.img. If you are choosing to use one usb drive, create each directly before use.

USB Drive Validation

To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions. We think they may reduce the chance that your Google TV won't work at all after the Downgrader/Reboot process.

  1. Read data off each of your USB drives by running the same dd/dd.exe command but swap the "if" and "of" and change USB1.img/USB2.img to test1.img/test2.img. Also, make sure "bs=4096" is still there, and add "count=1280" for USB1/USB2.
  2. Calculate the MD5 hash (md5sum) of each of of the test#.img files created above. (It looks like here's one for Windows, but we haven't tested it: http://www.pc-tools.net/win32/md5sums/)
  3. MD5 hash values should be as listed here (upper or lower case letters are fine):
    USB1: be941a3d7b103da5f3e8533ca5949fff
    USB2: 9d3636ed20d881787c29e9d7008123e8

UART Bootloader Root/Rebooter Process

  1. Follow instructions for writing images based on your operating system to create USB1. (The same drive can be used for USB1 and USB2 but will need to be imaged between each use)
  2. Connect to UART with the following settings, 115200 8N1
    A.) You can use putty with Windows or minicom with Linux
    B.) The UART pinout can be seen at http://Exploitee.rs/index.php/File:Sony-NSZ-GT1-UART.jpg
  3. Plug the Sony in and quickly begin to Mash escape in the UART terminal.
  4. If done quickly enough (If not restart box and try again), you will get a "Password:" prompt.
  5. Type "console_ON" as the password and click enter (no quotes).
  6. At NBL> prompt copy and paste the text below, and hit enter. Make sure to ONLY run the below command, others can do dangerous things.
    boot -f spectraa2:uvfat:/vmlinux_recovery.trf -c "root=/dev/ram0 console=ttyS0,115200 factory" -initrd spectraa2:uvfat:/initrd.trf
  7. Over UART, the box should say soemthing along the lines of "Please press Enter to activate this console." - hit enter a few times, you should drop to a shell.
  8. Insert your USB drive. We are assuming that it has a single FAT partition.
  9. You need to be quick, as the box will automatically reboot on you in a few minutes (2-3) So:
  10. Note: If using this on a Sony TV (Asura), please run this command first, and then continue onward: /bin/sony/gpio 2 1
    insmod /lib/modules/spectra.ko
    mkdir /spe2
    mkdir /usb
    mount -t vfat -rw /dev/Glob_Spectraa2 /spe2
    mount -t vfat -rw /dev/sdb1 /usb
    cp /usb/initrd.trf /spe2/initrd.trf
    cd /
    umount /spe2
    reboot
  11. Box will reboot.
  12. Once the box comes up, boot to recovery by pulling power, holding the Connect button on the box, and reapplying power. Let go of the connect button after a few seconds.
  13. Verify your recovery version. In the menu, hit System Information, it should show 20100806r699 for the "Recovery mode"
  14. Follow instructions for writing images based on your operating system to create USB2.
  15. Insert "USB 2" and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read "System Update with USB checking for USB media mount status."
  16. When the update is complete the screen will change to show "Install Complete - Press 0 and then 0!". Press 0, and then 0 again.
  17. The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!

Known Issues

  • Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.
  • 3.2 disables "Install from unknown sources" setting option, for instructions on manually setting this option visit [Here]
  • dd.exe may not write properly under Windows 7.
  • Blu-Ray eject light may continue to blink after disc is ejected. This can be remedied via the Eject Bug Hack; by removing power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.

Troubleshooting

  • You can get help from us or other users at:

Exploitee.rs Forums

Exploitee.rs Wiki

  • or you can chat with us on IRC at:

irc.freenode.net #Exploiteers

Freenode Webchat

(Someone may not be around right away to help, make sure to be willing to wait for a response)

Links to purchase Nano-JST 4-pin connector

RC-Connectors.com

Download

Mirror 1

Retrieved from "http://www.Exploitee.rs/index.php?title=Sony_Bootloader_HW_Root&oldid=2366"