Logitech Revue Technical

From Exploitee.rs
Revision as of 06:27, 29 December 2010 by Dcplaya (talk | contribs) (→‎Specs: added direct link to higher res link of motherboard)
Jump to navigationJump to search
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Specs

  • Intel Atom CE4150 1.2 GHz processor, with a 400 MHz GPU
  • Gigabyte GA-SBKAN2 motherboard
  • Samsung K9F8G08U0M 1 GB NAND Flash (Single Level Cell) Datasheet Mirror
  • Hynix H27UBG8T2ATR 4 GB NAND Flash (Multiple Level Cell)
  • Silicon Image Sil9135 HDMI 1.3 Receiver Chip Information Datasheet from TI
  • Nanya NT5CB128M8CN-CG 1 GB DDR3 SDRAM (1 Gb X 8) Datasheet
  • Realtek Semiconductor RTL8201N 10/100M PHYceiver Datasheet
  • Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller Datasheet
  • Phison S2251-50 USB to Flash Controller (Datasheet not available to end users according to manufacture)
  • IDT ICS9LPRS525AGLF Clock for CPU Datasheet

The Logitech Revue was recently torndown and its inners revealed. Direct link to the higher resolution picture of the Motherboard.

SemiAccurate has a populated board similar to the one in the Revue: http://www.semiaccurate.com/2010/06/04/gigabyte-has-google-tv-ready-motherboard/

Usage

Samsung K9F8G08U0M 1 GB NAND Flash

  • Used for storage of bootloader, kernel, boot flash graphics, Linux OS etc..

Hynix H27UBG8T2ATR 4 GB NAND Flash (Long Term Storage)

  • Used for persistent storage, device is /dev/sda - possible to override with an external USB drive

Microchip PIC24FJ64GA004-I/PT 16-bit microcontroller

  • Used to handle IR input/output for remotes/IR blasters and possible interface with wireless keyboard
  • System reboot/powerdown
  • Possibly HDMI CEC

Silicon Image Sil9135 HDMI 1.3 Receiver

  • Used to process video to and from HDMI ports as well as audio over HDMI and SPDIF
  • Supports DTS even though the Revue does not (An update can probably enable this feature)

IDT ICS9LPRS525AGLF Clock for CPU

  • Provides a clock for the Intel Atom CPU

Update Procedure

Place new update labeled "update.zip" on a USB drive, with a single partition (ie, 1st partition on a USB disk, so say "/dev/sdc1")

Insert into Revue in the Right most USB port (if looking at the back, closest to the power jack)

Boot into recovery mode: (confirm?)

  1. Hold the Sync button while plugging in the Revue, keep it held, at the same time hold Menu+L on the keyboard.
  2. Box will reboot, continue to hold Sync button, then hold Alt+L (or mash, your choice), and it should then enter recovery mode.
  3. You can then update the box, with a newer update. Downgrading fails however due to a date check.

Firmware Links

http://android.clients.google.com/packages/ota/logitech_ka/439c26f6af05.mp-signed-ota_update-b39389.zip

http://android.clients.google.com/packages/ota/logitech_ka/52057d168e2b.mp-signed-ota_update-b39953.zip

http://android.clients.google.com/packages/ota/logitech_ka/c9914396d183.mp-signed-ota_update-b42449.zip

(Add update history?)

Flash Layout

via: http://googletv.pastebin.com/233dZqZx


Creating 13 MTD partitions on "intel_ce_nand":

  • 0x00000000-0x00200000 : "mbr"
  • 0x00200000-0x00a00000 : "cefdk"
  • 0x00a00000-0x00c00000 : "redboot"
  • 0x00c00000-0x00e00000 : "cefdk-config"
  • 0x01000000-0x01800000 : "splash"
  • 0x01800000-0x01900000 : "fts"
  • 0x01900000-0x02d00000 : "recovery"
  • 0x02d00000-0x03200000 : "kernel"
  • 0x03200000-0x07200000 : "boot"
  • 0x07200000-0x1f200000 : "system"
  • 0x1f200000-0x3fa00000 : "data"
  • 0x3fa00000-0x3ff00000 : "keystore"
  • 0x3ff00000-0x40000000 : "bbt"

mbr - Master Boot Record

cefdk - Boot loader, may or may not have a shell

Splash - Splash image, can be seen here ( http://img413.imageshack.us/img413/3144/splashc.png )

Recovery - Full image, including kernel and small ramdisk (in squashfs format), boots to recovery menu

Kernel - The kernel image

Boot - Root partition, goes in hand with the kernel image, also in squashfs format

fts - Flash transactional key/value storage

bbt - Bad block table

system - yaffs

data - yaffs

Serial Output

The logitech revue board contains a UART1 port on the front of the board which before receiving the boxes initial updates is active. In order to communicate with UART port you will need a USB to TTL adapter (or board that does a similar conversion).

The pins operate at 3.3v and the port at 9600 baud with the following pinout:

UART Pinout

Serial output

via: http://googletv.pastebin.com/233dZqZx Pasted Locally

PIC Access

  • There is a standard PIC access port to the right of the UART1 port. It can be accessed via a standard PIC Kit Debug board (Tested with version 2). The port has read/write access but the code is pulled from the chip as .hex file and is unreadable thus far.
  • The pinout starting from the left (pin with white square around it) corresponds to pin 1 or Vpp.The remaining pins follow the same layout. PIC Pinout

PIC Hex Dump Local PIC Hex Dump

Updates

The updates contain a subset of update files, a boot.img and a recovery.img

boot.img & recovery.img

The thread at xda-developer has the process to extract from the .img files (thx bftb0):

"the "boot.img" file is in (little-endian) "squashfs" format and unpacks just fine using "unsquashfs" from the (Ubuntu 8.0.04 LTS) squashfs-tools package."

" It appears that the system/boot/recovery.img is packed with the second half also being "squashfs".

You can search for the occurence of the beginning of the squashfs archive with the command

hexdump -C system/boot/recovery.img | grep hsqs

and then do a little math to figure out how to dump that portion of the recovery image, e.g.:

dd if=system/boot/recovery.img bs=128 skip=15531 > recovery-squashfs.img

and then unpack that file using unsquashfs."

Odex files

The .odex files can be extracted by using the following guide Deodex Instructions

Available Pinouts

  • UART1 --> Uart Pinout
  • J3 --> PIC Chip Access
  • SW1 --> Push Button Switch (Use is unknown)
  • J20 --> Unknown (May be JTAG)
  • J69 --> USB Pinout
  • SATA1 --> SATA pinout (may have power included, needs verification)
  • J24 --> Unknown (may be power for SATA)
  • J13 --> Power for another fan probably
  • XDP1 --> Possibly a Intel XDP Debug Adapter Information on XDP Debugging