Sony Unsigned Kernels (SW Root)

About

The methods we use are completely reversible by entering the recovery menu and performing a USB update as described on the Exploitee.rs wiki page for each device. Below is a link to a more detailed guide on how the recovery downgrade and loading of the new jail broken kernel works. About Sony Downgrade + Rebooter (Root)

A video of the rooting process can be found here. Thanks alch3mist

Warnings

• This will definitely void your warranty with Sony, if you want to keep your warranty please do not do any of the steps in this guide.
• This will wipe your data partition removing all apps, personal settings and resetting the GTV to factory settings.
• This may brick your GTV. It shouldn't, but it still might!
• This will erase all data on the USB drive(s) used.
• You must be at the 2012.01.26 GTV 3.2 OTA (Over The Air) before proceeding!
• This is an advanced procedure and is far outside of normal computer use and designed function for the GTV. Typos and other mistakes can and will irreversibly destroy your Google TV, USB drives, computer, data, and other hardware. Nobody will make it through this process on intuition, because this procedure plays tricks on the software, so read the instructions very carefully. If you find yourself having trouble, you may want to think long and hard before taking these risks. If you have questions, the GTV Hacker community of volunteer individuals may be glad to welcome you and answer them; but we aren't a company or organization and can't perform miracles if you break something.

Tools Needed

• 4 (512MB+) USB drives total
• Sony NSZ-GT1 (Eagle) or Sony 24",32",40",46" GoogleTV (Asura)

Pre-Pre-setup

Disconnect your GTV from the internet!

1. There are newer software versions that the procedure below won't work on. If you want to use this procedure, play it safe and make sure your Google TV cannot connect to the internet until after you have completed all of the instructions below.
2. Tell your family, roommates, spouse, etc not to reconnect it.

Check your software version to make sure you are on a version that can use this procedure

1. Go to Settings -> About on your Google TV
2. Look for version 20120126 or earlier. Version 20120222 and later have been patched and will not work.
3. If your version is earlier than 20120126 download the correct 20120126 (Android 3.2 - Exploitable) version from Sony Update Downloads and use a USB drive to install it before proceeding with this procedure. (Eagle is the BluRay player, Asura is the TV)

Windows Pre-setup

1. Label 4 thumb drives with the numbers 1 2 3 and 4.
2. Open the a Windows command prompt (Windows key+R) or Start->Run->cmd then press enter.
3. Navigate to the directory that the files in this archive are placed. (A small tutorial can be found at Tutorial)
4. Rename the USB1-Asura.img or USB1-Eagle.img file depending on which device you have (Eagle = Blu-ray Player & Asura = Sony GoogleTV Panel) to USB1.img.
5. Navigate into the Tools/ directory.
6. Plug USB drive #1 in and then enter the following command into the command line:

   dd.exe --list

7. Find the matching volume information for the inserted USB drive. This can be done easiest by matching the drive letter for the USB drive in "My Computer" to the corresponding "\\.\e:" (assuming the drive letter is e:). You will want to get this right, since the following steps will destroy any data on the drive you point it at. The format of the list should have the same syntax as the following:

   \\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\

   link to \\?\Device\Harddisk1\DP(1)0-0+11

   removeable media

   Mounted on \\.\e:

8. Using the above example the information we are looking for is the top line "\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00}\", we will want to remove the ending backslash and enter it into the following command syntax:

   Syntax: dd if=USB#.img of=<volumeinfofromabove> bs=4096

   Eagle Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096

   Asura Example: dd if=../USB1.img of=\\.\Volume{046ee4df-3db8-11e1-836e-000c29b70b00} bs=4096

9. A successful completion would look as follows:

   rawwrite dd for windows version 0.5.

   Written by John Newbigin <[email protected]>

   This program is covered by the GPL. See copying.txt for details

   10240+0 records in

   10240+0 records out

10. Repeat steps 6-9 substituting the correct volume info (of=) and USB#.img (if) until you have 4 usb's flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.
11. Optionally, consider verifying that these steps worked by following the "USB Drive Validation" steps below.
12. You are ready to start the downgrage + root.

Mac Pre-Setup

1. Connect your USB Stick and open "Disk Utility" app.
2. Open a terminal window and type the following command:

   diskutil list

3. Make note of which disk corresponds to your USB stick.

   ex: dev/disk1

4. View previously opened "Disk Utility" app and and select/highlight your thumb drives partition.
5. Click the "unmount" button at the top of the "Disk Utility" window.
6. In the terminal window type the following command replacing the "/dev/disk1" with the disk name obtained from step 3 and the USB#.img with the location of the .img file you are going to flash:

   Syntax: dd if=USB#.img of=/dev/disk1 bs=4096

   Example: dd if=/Users/usernamehere/Desktop/USB1.img of=/dev/disk1 bs=4096

7. Press enter, when command is complete, repeat steps 2-6 until you have created all 4 USB drives.
8. Optionally, consider verifying that these steps worked by following the "USB Drive Validation" steps below.
9. You are ready to start the downgrage + root.

Linux Pre-Setup

1. Label 4 thumb drives with the numbers 1 2 3 and 4.
2. Open a linux terminal.
3. Plug in USB 1.
4. Navigate to the directory the .img files are stored and rename the USB1-Asura.img or USB1-Eagle.img file depending on the device you have (Eagle = Blu-ray Player & Asura = Sony GoogleTV Panel) to USB1.img.
5. Determine which device is your USB thumbdrive by using the command "dmesg" and looking for the last set of output with sdc/sdb/sdd/etc.
6. Verify that the device is correct by matching the device name to the appropriate mount point in the following command:

   "cat /proc/mounts"

7. If you believe you have the correct device then use the following command syntax for dd:

   Syntax: dd if=USB#.img of=<volumeinfofromabove> bs=4096

   Eagle Example: dd if=../USB1.img of=/dev/sdc bs=4096

   Asura Example: dd if=../USB1.img of=/dev/sdc bs=4096

8. Repeat steps 3-7 until you have 4 USBs flashed with the corresponding USB1.img USB2.img USB3.img and USB4.img.
9. Optionally, consider verifying that these steps worked by following the "USB Drive Validation" steps below.
10. You are ready to start the downgrage + root.

USB Drive Validation

To validate data written to the USB drives, and verify that it will read back off the drive correctly, follow these instructions. We think they may reduce the chance that your Google TV won't work at all after the Downgrader/Reboot process.

1. Read data off each of your USB drives by running the same dd/dd.exe command but swap the "if" and "of" and change USB1.img/USB2.img/USB3.img/USB4.img to test1.img/test2.img/test3.img/test4.img. Also, make sure "bs=4096" is still there, and add "count=1280" for USB1/USB2 or "count=19200" for USB3/USB4.
2. Calculate the MD5 hash (md5sum) of each of test1.img through test4.img. (It looks like here's one for Windows, but we haven't tested it: http://www.pc-tools.net/win32/md5sums/)
3. MD5 hash values should be as listed here (upper or lower case letters are fine):

   USB1 (Eagle): d6a82c60d70b3ecdb8e436ef44043e4c

   USB1 (Asura): f34e34f4d6bed978ed3d0e1afe596b99

   USB2: 4a491d61d836fdcd1f60dc6451f90965

   USB3: ff71d6432a0076a7b818713f3a60eb09

   USB4: 139ba91d8c01e927caced3eefa9fbd55

Downgrade/Rebooter Process

1. Boot Sony in recovery (hold power when plugging in).
2. When the menu is displayed, insert "USB 1" and press 3 on the Sony keyboard.
3. The device will ask if you want to continue. Remove "USB 1" and insert "USB 2". (Note: If the device does not ask you to continue, and instead displays "Update Data Error", try using a different brand of USB stick.)
4. Wait 20 seconds for it to settle (no more blinking from USB) and then press 1.
5. Wait another 20 seconds, The device should display an error. Now press 0.
6. The device should be showing the main recovery menu again, remove "USB 2" and then reinsert "USB 1".
7. Press 3 again. The device will ask if you want to continue, remove "USB 1" and insert "USB 3".
8. Danger! Danger! Danger! USB3 is really important, and we have no way of checking that you wrote it right and won't brick your GTV. Consider using the "USB Drive Validation" steps above to make sure you aren't dumping garbage all over your GTV.
9. Wait 20 seconds and then press 1. This will take longer (nearly a minute) but once done, it will error.
10. Press 0.
11. Now unplug the box, and plug it back in while holding power. You should see the Exploitee.rs Sony splash, and you will now be in the old recovery.
12. Insert "USB 4" and then press 3. The rebooter install will begin and will take 3-5 minutes. The Screen will read "System Update with USB checking for USB media mount status."
13. When the update is complete the screen will change to show "Install Complete - Press 0 and then 0!". Press 0, and then 0 again.
14. The update is now complete, reboot your box and you will be booted into a modified unsigned kernel!

Known Issues

• Wifi may be slow to come up when initially starting the system, give it a few moments and it should come up.
• 3.2 disables "Install from unknown sources" setting option, for instructions on manually setting this option visit [Here]
• dd.exe may not write properly under Windows 7.
• Blu-Ray eject light may continue to blink after disc is ejected. This can be remedied via the Eject Bug Hack; by removing power, and reboot; or just reset the device by pressing Ctrl-Alt-Del on the remote.

Troubleshooting

• You can get help from us or other users at:

Exploitee.rs Forums

Exploitee.rs Wiki

• or you can chat with us on IRC at:

irc.freenode.net #Exploiteers

Freenode Webchat

(Someone may not be around right away to help, make sure to be willing to wait for a response)

Download

• Download Mirror 1
• Download Mirror 2
• Download Mirror 3
• Download Mirror 4
• Download Mirror 5
• Download Mirror 6