Difference between revisions of "Logitech Revue Technical"

From Exploitee.rs
(Usage: removed resistance)
Line 2: Line 2:
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU   
*Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU   
*Gigabyte GA-SBKAN2 motherboard
*Gigabyte GA-SBKAN2 motherboard
*Samsung K9F8G08U0M 1 GB NAND Flash (RAM) [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Samsung K9F8G08U0M 1 GB NAND Flash [http://www.samsung.com/global/system/business/semiconductor/product/2007/6/11/NANDFlash/SLC_LargeBlock/8Gbit/K9F8G08U0M/ds_k9f8g08x0m_rev10.pdf Datasheet] [http://zenosec.com/gtv/revue/ds_k9f8g08x0m_rev10.pdf Mirror]
*Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)
*Hynix H27UBG8T2ATR 4 GB NAND Flash
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf  Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Silicon Image Sil9135 HDMI 1.3 Receiver [http://dl.dropbox.com/u/217678/Silicon%20Image%20Sil9135%20Info.pdf  Chip Information] [http://focus.tij.co.jp/jp/lit/an/spraav4/spraav4.pdf Datasheet from TI]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]
*Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) [http://dl.dropbox.com/u/217678/NTC-DDR3-1G-C-V58B-12-12-5.pdf Datasheet]

Revision as of 06:19, 29 December 2010


  • Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
  • Gigabyte GA-SBKAN2 motherboard
  • Samsung K9F8G08U0M 1 GB NAND Flash Datasheet Mirror
  • Hynix H27UBG8T2ATR 4 GB NAND Flash
  • Silicon Image Sil9135 HDMI 1.3 Receiver Chip Information Datasheet from TI
  • Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) Datasheet
  • Realtek Semiconductor RTL8201N 10/100M PHYceiver Datasheet
  • Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller Datasheet
  • Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
  • IDT ICS9LPRS525AGLF Clock for CPU Datasheet

The Logitech Revue was recently torndown and its inners revealed.

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/


Samsung K9F8G08U0M 1 GB NAND Flash

  • Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)

  • Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller

  • Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
  • System reboot/powerdown
  • Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver

  • Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
  • Supports DTS even though the Revue does not (An update can probably enable this feature)


  • Provides a clock for the Intel Atom CPU

Update Procedure

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

  1. Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
  2. Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
  3. You can then update the box, with a newer update. Downgrading fails however due to a date check.

Firmware Links




(Add update history?)

Flash Layout

via: http://googletv.pastebin.com/233dZqZx

Creating 13 MTD partitions on "intel_ce_nand":

  • 0x00000000-0x00200000 : "mbr"
  • 0x00200000-0x00a00000 : "cefdk"
  • 0x00a00000-0x00c00000 : "redboot"
  • 0x00c00000-0x00e00000 : "cefdk-config"
  • 0x01000000-0x01800000 : "splash"
  • 0x01800000-0x01900000 : "fts"
  • 0x01900000-0x02d00000 : "recovery"
  • 0x02d00000-0x03200000 : "kernel"
  • 0x03200000-0x07200000 : "boot"
  • 0x07200000-0x1f200000 : "system"
  • 0x1f200000-0x3fa00000 : "data"
  • 0x3fa00000-0x3ff00000 : "keystore"
  • 0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

Serial Output

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

UART Pinout

Serial output

via: http://googletv.pastebin.com/233dZqZx Pasted Locally

PIC Access

  • There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.
  • The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. PIC Pinout

PIC Hex Dump Local PIC Hex Dump


The updates contain a subset of update files, a boot.img and a recovery.img

boot.img & recovery.img

The thread at xda-developer has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

Odex files

The .odex files can be extracted by using the following guide Deodex Instructions

Available Pinouts

  • UART1 --> Uart Pinout
  • J3 --> PIC Chip Access
  • SW1 --> Push Button Switch (Use is unknown)
  • J20 --> Unknown (May be JTAG)
  • J69 --> USB Pinout
  • SATA1 --> SATA pinout (may have power included, needs verification)
  • J24 --> Unknown (may be power for SATA)
  • J13 --> Power for another fan probably
  • XDP1 --> Possibly a Intel XDP Debug Adapter Information on XDP Debugging