Steam Link

"Although the information we release has been verified and shown to work to the best our knowledge, we cant be held accountable for bricked devices or roots gone wrong."

About

Steam Link is an in-home streaming appliance made by Valve.

Purchase

Support the Exploitee.rs network by using the following link to buy a Steam Link

Steam Link at Amazon

Specs

• CPU: Marvell ARMv7 Processor (Can't find exact model) (Just now realized the hardware ID "MV88DE3108" is one number off from the Google Chromecast "MV88DE3100")
• RAM: 512MB (~256MB available after boot)
• Dimensions: 123.19 x 14.73 x 89.66 mm
• WiFi: Marvell 88W8897
• Ports: 3 USB 2.0, HDMI 2.0, 10/100 Ethernet, Power

Photos

Information & Root Method

Note: As of the latest beta software for the Link, pulseaudio is no longer used. ALSA is used for everything including USB headsets and has a volume control option under Settings.

Steam Link is running a custom Linux build by Valve. An SDK is provided to develop applications to run on the device itself. https://github.com/ValveSoftware/steamlink-sdk

Various functions can be enabled by putting a file in a certain location on a FAT32 USB drive and booting the Link with it plugged in. Create directories as needed.

• /steamlink/config/system/enable_ssh.txt (Just create a blank file) - Enables SSH until next factory reset or removing /mnt/config/system/enable_ssh.txt
• /steamlink/config/system/display_resolution.txt - Putting "720P" in that file will limit the Link to that resolution
• /steamlink/config/system/update_branch.txt - Creating that file with one of their build numbers as the contents will make the Link download and install that particular version

The best part? With SSH you get a root shell! Username: root password: steamlink (or steamlink123). (Change with passwd after first login)

It comes with a surprising amount of regular utilities

# uname -a
Linux steamlink-87F1 3.8.13-mrvl #60 PREEMPT Mon Dec 12 11:24:32 PST 2016 armv7l GNU/Linux
# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 0 (v7l)
BogoMIPS        : 995.32
Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x3
CPU part        : 0xc09
CPU revision    : 0

Hardware        : MV88DE3108
Revision        : 0000
Serial          : 0000000000000000\
# pulseaudio --version
pulseaudio 8.0
# bluetoothctl --version
5.43
# bluetoothctl
[NEW] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
[bluetooth]# exit
[DEL] Controller E0:31:9E:0C:BA:0B BlueZ 5.35 [default]
# connmand --version
1.29
# connmanctl state
  State = online
  OfflineMode = False
  SessionMode = False
# connmanctl services
*AO ASUS_5G              wifi_e0319e0cba0a_415355535f3547_managed_psk

Valve's frontend actually interfaces with connman/bluetoothd for WiFi/Bluetooth connections.

# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/mtdblock9            1.0G    246.2M    777.8M  24% /
none                    131.4M      8.0K    131.4M   0% /dev
devtmpfs                131.4M      8.0K    131.4M   0% /dev
tmpfs                   131.4M     20.0K    131.4M   0% /tmp
tmpfs                   131.4M         0    131.4M   0% /mnt
/dev/block/mtdblock4     32.0M      6.1M     25.9M  19% /mnt/factory_setting
/dev/block/mtdblock10
                          1.9G    785.5M      1.1G  41% /mnt/scratch
/dev/block/mtdblock3    512.0M     26.5M    485.5M   5% /mnt/config
unionfs                 512.0M     26.5M    485.5M   5% /etc
unionfs                 512.0M     26.5M    485.5M   5% /var
unionfs                 512.0M     26.5M    485.5M   5% /home/steam
unionfs                 512.0M     26.5M    485.5M   5% /usr/local
tmpfs                   131.4M     20.0K    131.4M   0% /var/run
/dev/loop0              975.9M    207.6M    717.1M  22% /home/apps
# mount
rootfs on / type rootfs (rw)
/dev/mtdblock9 on / type yaffs2 (ro,relatime)
none on /dev type tmpfs (rw,relatime)
sys on /sys type sysfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devtmpfs on /dev type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
tmpfs on /tmp type tmpfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,relatime)
/dev/block/mtdblock4 on /mnt/factory_setting type yaffs2 (ro,relatime)
/dev/block/mtdblock10 on /mnt/scratch type yaffs2 (rw,relatime)
/dev/block/mtdblock3 on /mnt/config type yaffs2 (rw,relatime)
unionfs on /etc type unionfs (rw,relatime,dirs=/mnt/config/overlay/etc=rw:/etc=ro)
unionfs on /var type unionfs (rw,relatime,dirs=/mnt/config/overlay/var=rw:/var=ro)
unionfs on /home/steam type unionfs (rw,relatime,dirs=/mnt/config/overlay/home/steam=rw:/home/steam=ro)
unionfs on /usr/local type unionfs (rw,relatime,dirs=/mnt/config/overlay/usr/local=rw:/usr/local=ro)
tmpfs on /var/run type tmpfs (rw,relatime)
/dev/loop0 on /home/apps type ext4 (rw,relatime,data=ordered)
# busybox --help
BusyBox v1.24.1 (2016-01-19 12:54:10 PST) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2015.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
   or: busybox --list[-full]
   or: busybox --install [-s] [DIR]
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        [, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash, awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl, bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod, chown, chpasswd, chpst,
        chroot, chrt, chvt, cksum, clear, cmp, comm, conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd, deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff, dirname, dmesg, dnsd, dnsdomainname,
        dos2unix, du, dumpkmap, dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake, expand, expr, fakeidentd, false, fatattr, fbset, fbsplash, fdflush, fdformat, fdisk, fgconsole, fgrep, find, findfs, flock, fold,
        free, freeramdisk, fsck, fsck.minix, fstrim, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty, grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid, hostname, httpd, hush, hwclock, id, ifconfig, ifdown,
        ifenslave, ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip, ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel, kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64, linuxrc, ln,
        loadfont, loadkmap, logger, login, logname, logread, losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat, lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg, microcom, mkdir, mkdosfs, mke2fs,
        mkfifo, mkfs.ext2, mkfs.minix, mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more, mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite, nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd,
        od, openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress, pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv, printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev, readahead, readlink,
        readprofile, realpath, reboot, reformime, remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm, rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script, scriptreplay, sed, sendmail, seq, setarch,
        setconsole, setfont, setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum, sha256sum, sha3sum, sha512sum, showkey, shuf, slattach, sleep, smemcap, softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
        sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl, syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp, tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true, truncate, tty,
        ttysize, tunctl, ubiattach, ubidetach, ubimkvol, ubirmvol, ubirsvol, ubiupdatevol, udhcpc, udhcpd, udpsvd, uevent, umount, uname, unexpand, uniq, unix2dos, unlink, unlzma, unlzop, unxz, unzip, uptime, users, usleep, uudecode,
        uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog, wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip
# free -m
             total       used       free     shared    buffers     cached
Mem:           262        119        143          0          0         71
-/+ buffers/cache:         47        215
Swap:            0          0          0

You only have sh/ash from Busybox BUT you can grab a static Bash binary and it works great. http://ftp.us.debian.org/debian/pool/main/b/bash/bash-static_4.4-1_armhf.deb (I just extracted the binary from this and placed it in /usr/local/bin on the Link)

And since we have Busybox we also have chroot! Extract http://os.archlinuxarm.org/os/ArchLinuxARM-armv7-latest.tar.gz to an EXT3 formatted flash drive and plug it into the Link.

# mount /dev/block/sda1 /mnt/usb
# mount -t proc proc /mnt/usb/proc/
# mount -t sysfs sys /mnt/usb/sys/
# mount -o bind /dev /mnt/usb/dev/
# mount -t devpts devpts /mnt/usb/dev/pts/
# chroot /mnt/usb /bin/bash
[root@steamlink-87F1 /]# 
[root@steamlink-87F1 /]# uname -a
Linux steamlink-87F1 3.8.13-mrvl #52 PREEMPT Thu Sep 1 11:23:18 PDT 2016 armv7l GNU/Linux
[root@steamlink-87F1 /]# useradd -m parker   
[root@steamlink-87F1 /]# passwd parker
New password: 
Retype new password: 
passwd: password updated successfully
[root@steamlink-87F1 /]# ls -a /home/parker/
.  ..  .bash_logout  .bash_profile  .bashrc
[root@steamlink-87F1 /]# pacman -Syu
:: Synchronizing package databases...
 core                                                                                                                211.8 KiB   963K/s 00:00 [######################################################################################] 100%
 extra                                                                                                                 2.3 MiB  4.85M/s 00:00 [######################################################################################] 100%
 community                                                                                                             3.8 MiB  4.73M/s 00:01 [######################################################################################] 100%
 alarm                                                                                                               110.2 KiB   648K/s 00:00 [######################################################################################] 100%
 aur                                                                                                                  29.3 KiB  7.15M/s 00:00 [######################################################################################] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for conflicting packages...

Packages (8) curl-7.50.2-1  gawk-4.1.4-1  gcc-libs-6.2.1-1  gnutls-3.4.15-1  libutil-linux-2.28.2-1  linux-armv7-4.7.3-1  mkinitcpio-21-1  util-linux-2.28.2-1

Total Download Size:    56.39 MiB
Total Installed Size:  138.24 MiB
Net Upgrade Size:        0.18 MiB

:: Proceed with installation? [Y/n] 
:: Retrieving packages...
 gcc-libs-6.2.1-1-armv7h                                                                                              10.2 MiB  4.71M/s 00:02 [######################################################################################] 100%
 libutil-linux-2.28.2-1-armv7h                                                                                       252.0 KiB  1105K/s 00:00 [######################################################################################] 100%
 curl-7.50.2-1-armv7h                                                                                                776.2 KiB  4.62M/s 00:00 [######################################################################################] 100%
 gawk-4.1.4-1-armv7h                                                                                                 926.3 KiB  6.96M/s 00:00 [######################################################################################] 100%
 gnutls-3.4.15-1-armv7h                                                                                                2.0 MiB  2.38M/s 00:01 [######################################################################################] 100%
 util-linux-2.28.2-1-armv7h                                                                                         1687.2 KiB  4.25M/s 00:00 [######################################################################################] 100%
 mkinitcpio-21-1-any                                                                                                  38.0 KiB  3.71M/s 00:00 [######################################################################################] 100%
 linux-armv7-4.7.3-1-armv7h                                                                                           40.6 MiB  3.33M/s 00:12 [######################################################################################] 100%
(8/8) checking keys in keyring                                                                                                                [######################################################################################] 100%
(8/8) checking package integrity                                                                                                              [######################################################################################] 100%
(8/8) loading package files                                                                                                                   [######################################################################################] 100%
(8/8) checking for file conflicts                                                                                                             [######################################################################################] 100%
(8/8) checking available disk space                                                                                                           [######################################################################################] 100%
:: Processing package changes...
(1/8) upgrading gcc-libs                                                                                                                      [######################################################################################] 100%
(2/8) upgrading libutil-linux                                                                                                                 [######################################################################################] 100%
(3/8) upgrading curl                                                                                                                          [######################################################################################] 100%
(4/8) upgrading gawk                                                                                                                          [######################################################################################] 100%
(5/8) upgrading gnutls                                                                                                                        [######################################################################################] 100%
(6/8) upgrading util-linux                                                                                                                    [######################################################################################] 100%
(7/8) upgrading mkinitcpio                                                                                                                    [######################################################################################] 100%
(8/8) upgrading linux-armv7                                                                                                                   [######################################################################################] 100%
>>> Updating module dependencies. Please wait ...
:: Running post-transaction hooks...
(1/1) Updating the info directory file...

Compiling native applications

This can be a little tricky at times but is very fun when you get something running.

For best results look for a program using pure SDL2 for video/input handling (Bonus points if it uses the CMake compiling system). External libs are possible (you have to compile them, copy over the include files to the rootfs directory, and then when you package up a program include the .so files to use in an LD_PRELOAD)

Starting out is fairly straight forward

git clone https://github.com/ValveSoftware/steamlink-sdk
cd steamlink-sdk/examples

From here you can check out the included example applications and their respective build scripts. If we want to experiment with our own:

git clone somesource
cd somesource

First I'll cover a CMake project because these provide the best results (because of the included toolchain definition file)

source ../../setenv.sh
mkdir build
cd build
cmake -DCMAKE_TOOLCHAIN_FILE=../../../toolchain/steamlink-toolchain.cmake ../

If all goes well it should find any needed libraries and create the Makefile for you. (If it needs any other external libraries a quick rundown is to repeat the same steps as above to grab the source, hope it compiles, and copy over the include files to the rootfs/usr/include directory in the steamlink-sdk repo folder. This isn't guaranteed to work so your mileage may vary.)

Then you just compile it.

make -j4

For regular source installations (typical automake/Makefile) it can be a hit or miss whether compilation will work or not. The gist of it is:

./automake #If needed
./configure --host=armv7a-cros-linux-gnueabi #and any other needed arguments
make -j4 #and pray...

Once you end up with a compiled binary, you can scp it over to the Link and try to run it. If you had to compile any external libs (.so) be sure to include them in the transfer and use LD_PRELOAD=./ ./binaryname to test.

If everything went ok and the binary runs as expected and you are happy with the results, packaging it up for a USB install is dead simple

Create a folder named whatever you want (I typically use the program name all lowercase), and create these files in said folder as follows.

toc.txt
    name=Whatever # This is what shows in the launcher
    icon=whatever-icon.png 
    run=binary # Or a script name if you need to LD_PRELOAD. Just make sure the binary/script are executable for this line to work

whatever-icon.png # I haven't found exact specifications for this but I typically do a 128x128 icon

binary # Main program

binary-launch.sh # Only needed if you want to preload/pass special arguments
    #!/bin/sh
    LD_PRELOAD=./ ./binary

And any data files needed for it to run

Next just back up a directory and tar up the folder

tar zcvf programname.tgz foldername 

Now if you want to install this on the Link just copy that tgz to a flash drive at USB:/steamlink/apps/ and boot the Link with the drive plugged in. It will extract it and then boot to the launcher.