Hacking the Google Nest Hub - Google Home

So, i hope someone can help me with my project, or else i can kiss my plans goodbye...
A while ago i bought a Google Nest Hub (1st gen) to run my own software/dashboard. At first i tried to 'Cast' it as webpage to the device, but that is not fully stable. Especially now that they updated the Hub to run Fuchsia OS.
So, my plan is to OR alter the Google firmware to run my own stuff on top of Fuchsia. Maybe create my own Flutter app or something. OR build linux from source, which is available for the S905D2 u200, which is the CPU of the Nest Hub. The latter gives me more control but i would have to get all hardware running in linux.
Both options give me some problems though:
The hub has a USB port under the foot. If you press both volume buttons while booting, you get the Amlogic Worldcup device where you can talk to it with the Amlogic burn tool. You can flash firmware here or even dump firmware from it. Problem is: Google password protected this so you first have to upload a password.bin file before you can use the tool. Something that i presume is not possible to bruteforce...
When you push one of the volume buttons while booting, you boot to Fastboot mode. Hey, that's familliar. So i tried some commands. fastboot unlock, does not work. flashing an own rom, not allowed. Flashing my own recovery image is allowed and completes succesfully. But, while trying to boot to recovery it sais: "Hash of data does not match digest in descriptor.". So it verifies the image which it cannot do.
The other volume button boots to the recovery image, which is a google's own thing where you can reset the device to factory defaults if you want..
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The pcb viewed from the backside of the device.Notice the two wires next to the pink heat gum stuff. That's my RX and TX(?). Two pins next to each other seemed like a logical attempt.
So i teared the device down, got to the PCB and found a RX/TX port. At least, i noticed that i got uart data when connecting to it. But, i can only read, it does not respond to keyboard presses. I don't know if the other pin is just no TX pin or that there is no software that will respond to keypresses.
My question, what else can i try, or did Google just lock it's hard-/software very well? Of course i could chip-off the NAND chip, but then reflowing it on the device after altering the NAND is almost impossible, especially if you have to do it a lot of times... What else can i do?

What did you connect the UART cables to to capture the signal?

They connected it to see if they could get a root console.
Sometimes they don't have logins, sometimes they do, sometimes they are just a dmesg output.
Even that can be very helpful in hacking a device.
In the (very) old days, most of these test point were "TTL", that is nominally 5V levels (usually didn't swing beyond 4V).
In the (only) old days, most of them were 3.3V logic, swinging from 0V to 3.3V
In these days, many are 1.8V logic.
So if you care about your device, make sure that the USB UART you are using to interface uses the right voltage level.

Renate said:
In the (very) old days, most of these test point were "TTL", that is nominally 5V levels (usually didn't swing beyond 4V).
In the (only) old days, most of them were 3.3V logic, swinging from 0V to 3.3V
In these days, many are 1.8V logic.
So if you care about your device, make sure that the USB UART you are using to interface uses the right voltage level.
Click to expand...
Click to collapse
Putting a meter on tx/rx will show the logic voltage level?

Yup, idle on the TX will always measure high. RX might measure high or low.

Related

Kaiser problem...

Hi! Some weeks ago my kaiser stop playing sounds like music and the ringtones.I dont know if it happened when i dropped it on the floor... So i opened my kaiser (bought on ebay and has no warranty) to see if there was something changed. The speaker looks well but i bought a new one from ebay (received it broken ). I just opened it a little but i saw something that i dont know if is right and i would like you to tell me. I dont know if it's a little battery but it looks like it's covered with a strange substance.Now is it supposed to be there or could it be caused by huminity for instance?
Here are some pics:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Hi. It Is "golden cap" which is back up source. The P/N is in the service manual. The replacement part could be found on digikey...The substance sould not be there. Cheers!
you should replace that battery, its fully corroded, which may lead to rust in your kaiser... take it out and wait for the new one to arrive!
Yup that's one leaky battery. You'll need to replace that and clean up the contacts extremely carefully, being careful not to get acid on yourself or anything else.
use of golden capacitor
Hi
I face some trouble with my Kaiser (sometimes don't charge battery, sometimes reboot...)
Since it did not charge battery at all, I opened it and remouted it : it work properly again.. then it started not working again
I'm asking myself : if this capacitor is old (about 3 years) what could be the symptoms of its failure ?
Thank you for your help
Yes, Good question!!
My kaiser stopped charging. The PC would recognise it and it would (usually) boot fine but would not charge. I found another one that i bought cheap.
I had the other one laying around and thought i'd have a play with it.
I tried:
--Other USB cables.
--Other chargers.
--Other battries.
--Charging with an external battery charger.
Turns out that it all works fine but the phone will not work as a charger. I read somewhere that the fuse may have blown that is why the PC still recognises it. However, i'm not sure i can rule out the golden cap. Anyone changed a fuse? anyone had the same problem and a change of the golden cap solved it?
There is not much chatter about these problems either. I may start a new thread...
Hi
I guessed that my problem came form the internal battery connector.
I soldered directly a battery on the connector, and the battery charged OK.
But this fix seems more to be a "lucky strike" then a real patch to the problem.
Tell me if you open a new thread about golden cap.
I have a guess why the phone stopped playing music: I think the slot of the volume button is loose. On your first picture next to the main battery pins there is a small slot into which the volume control connects. When you put it back, make sure it is well pushed into the slot, I had this problem previously.

Odd screen on captivate.

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
My wife's phone wont boot and all that comes up is this screen. I've tried the 3 button combos to reach recovery or download. the phone wont load at all. Can someone please point me in the direction so I can remedy this?
Thank you
Sent from my SAMSUNG-SGH-I897 using XDA App
Try the various combinations of 3-button combos.
If that doesnt work, make a usb jig
just search for it on xda
OR
use youtube for a step by step approach.
The best way is to solder in the correct set of resistors (I think its ~ 300K ohms) onto a mirco usb male adapter and insert into the usb port on the captivate. The phone (provided the batttery is charged) should enter download mode.
Again instructions are everywhere, just look up 'usb jig'
I got mine into download mode by buying a 300K resistor and just bending the pins and placing tape between the ends .... easy fix but may take some time to get it right. THe idea is to press down on usb pins 4 and 5 in the phone which are the two right-most pins when facing the phone. I used this vid to unbrick mine:
http://www.youtube.com/watch?v=D0aoabVtPJ8
Also, if youre not keen, have time and money on your hands, just search for it on ebay, theres plenty of ready made ones too.
ozy944 said:
Try the various combinations of 3-button combos.
If that doesnt work, make a usb jig
just search for it on xda
OR
use youtube for a step by step approach.
The best way is to solder in the correct set of resistors (I think its ~ 300K ohms) onto a mirco usb male adapter and insert into the usb port on the captivate. The phone (provided the batttery is charged) should enter download mode.
Again instructions are everywhere, just look up 'usb jig'
I got mine into download mode by buying a 300K resistor and just bending the pins and placing tape between the ends .... easy fix but may take some time to get it right.
Click to expand...
Click to collapse
Thank you!
Sent from my SAMSUNG-SGH-I897 using XDA App

[Q] Can I recover this LG G2 ? Snow on screen(see pic)

I got this phone the other day, It's just got snow all over the screen (it's out of warranty) so I opened the cover, pulled off all connectors and re-seated them (didn't remove any boards, just what was accessible once the back covers were off.
I am new to Android but, this model I have replaced 2 Displays on (not this phone), seems I get one for cheap with a broken display, I fix it and someone offers me more than triple what I paid for, so I keep selling them :-/ (a man cant turn down a big profit). So I know how to pull this phone apart and replace parts if needed. I was looking to give Android a solid shot here (I am a Windows Phone person now)and not sell this one...
Not sure if the display is toast or this is just a Bricked or something else.
Note:
-If I connect to a PC, it connects fine
-When the phone is on, If I touch the lower of the screen, I hear clicking
-Double click on the center of the screen wakes up the display.
-Verzion software tool does not detect the phone (even though a drive is mapped for it)
Also to know, I have never rooted a Android device, so no idea on how to tell if it's rooted or not from the file system. Yea, when it comes to Android devices, I am a NooB.
Any idea ?
Thanks in advance !
Ok, Still trying to trouble shoot this, figuring it was a Brick or something with a lot of effort (The touch screen seems to work but, power off was a guessing game where to push to get it into bootloader mode).
I tried to go back to Stock with it, following these directions...
http://forum.xda-developers.com/showthread.php?t=2448960
Now during the process, every once an a while, on the top of the screen, I can see about 1/2 of the ICONs, it's static so it does not update but, it's the most I have seen off this display.
After showing Successful, it's still doing the same thing. accept a hair of it, static across the top of the screen.
So, does this lead down to a hardware based issue (if so, what part should be replaced), or is this display damaged and needs a replacement ?
Has anyone gone through this and can help ?
Edit, Picked up the one of the cables for the phone that the video, power, headphones all plug into, as all my problems are resulting in something that plugs into this cable, figured I would give it a shot, The only things that are left are the Main board, or the display itself.
Maybe this will fix it ?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Does anyone have any input that might help me here ? Will this part fix it, or is this phone screwed completely ?

N910T won't fix on satellites, even though it can see them.

Hey guys, I'm pulling my hairs out on this problem I am getting with my note 4.
Long story short - I cannot get a GPS fix (to even a single sat) with my N910T.
The longer version:
This thing had a cracked screen - but worked great before that (no GPS problems) and I used it a good year before breaking it. So I bought a N910A (ATT) note 4 to use the screen to fix my trusty note.
I gutted both phones, and put my N910T motherboard in the N910A's frame, with the screen still attached to the frame. I kept the N910A's USB daughterboard (with the charging port) because in the research I did, it seemed basically identical to the one from my broken screen frame, and I knew it would be tricky to get that out and into the new one without busting the new glass or destroying the flex cables.
So after some trouble with the S pen not working initially (the cable didn't press in fully, had to stick paper behind the flex cable and it went in properly) I was able to get the phone up and running again, and all features seemed to work great again.
However - I noticed after a couple days that the GPS was super spotty, so bad it was mostly unusable. I noticed that AGPS was on and it was using wifi and mobile data to help get a fix, so I turned it to GPS only mode. In GPS only mode the phone gets not signal whatsoever, no matter where I am.
I tried the simple fixes many recommend online, one which is to try tightening the screws a bit, and in fact, as this process continued I opened and closed up the phone several times, making sure to carefully but tightly screw all the screws back into place. That didn't help. I also tried making sure the compass calibration was good - and it made no difference. And I even factory reset to make sure there were no issues with installed apps or anything like that.
I got to thinking, perhaps its a issue with the small bendable pins that press from the motherboard into the mid-frame not making good contact, so I tore the phone down a couple more times, slightly bent out - very carefully - all the pins that press into the mid-frame to make them all have a solid contact, and even tried to get any corrosion or debris from the pads on the mid-frame. I even made sure there was contact for those little ones alone the sides of the phone which seem to have something to do with the buttons rather than what I'm dealing with.
Still no luck, so I tried doing a NV rebuild, which I read might solve getting 0 sat fixes, and discovered my phone wouldn't let me into that menu of the service options, so I had to install root and then do it through shortcut master instead. Once I finally was able to get to the menu and run the NV rebuild.... nothing changed.
So I am fresh outta ideas, and I'm thinking that A) that ATT USB daughterboard actually plays a part in GPS somehow and I need to take my TMO one out of the old phone and put it in the new frame and screen.... or B) Something is damaged on my motherboard.... or C) Somebody out there has a better solution
Any ideas, experiences of what worked are all appreciated!
BUMP --------
Still having this issue. Tried opening it up, and realllllly making sure those antenna springs are making contact, and I made sure the contacts on the mid frame are clean.
I tried TopNTP and that made no difference. Here is an image of whats going on when I run GPS Test:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Bump?
Losing hope for my old phone here
Anybody happen to know if the daughter board that has the USB charging port plays any role in gps?

Pixel 4XL Hard Reset Message: "e: cant send spi message try again" need to worry?

Is this normal or do i need to worry?
Device runs fine otherwise...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
SPI is a protocol/wiring method where multiple chips can be tied together and timeshare the IO bus. Only one device can communicate at a time and the master(the phone) says who can talk when by using a signal line. I'm not sure why it's common for TPMs to use SPI, but x86 motherboards do it too.
The E prefix means it's an error? It sort of doesn't indicate whether the SPI bus is busy doing something else, or the TitanM chip isn't responding to SPI commands. I'd say if the error messages all happened in the same second, it might not be a big problem. If it took a long time, that's a bit more concerning.
Anyways, as long as you can set up face unlock properly and PIN unlock on reboots every time, I wouldn't worry too much. If it ever acts funny or fails to PIN unlock... you might consider that the TitanM chip is defective and one day you may be unable to unencrypt your phone on a reboot because the decryption keys are lost on the unresponsive chip.
:
jljtgr said:
SPI is a protocol/wiring method where multiple chips can be tied together and timeshare the IO bus. Only one device can communicate at a time and the master(the phone) says who can talk when by using a signal line. I'm not sure why it's common for TPMs to use SPI, but x86 motherboards do it too.
The E prefix means it's an error? It sort of doesn't indicate whether the SPI bus is busy doing something else, or the TitanM chip isn't responding to SPI commands. I'd say if the error messages all happened in the same second, it might not be a big problem. If it took a long time, that's a bit more concerning.
Anyways, as long as you can set up face unlock properly and PIN unlock on reboots every time, I wouldn't worry too much. If it ever acts funny or fails to PIN unlock... you might consider that the TitanM chip is defective and one day you may be unable to unencrypt your phone on a reboot because the decryption keys are lost on the unresponsive chip.
Click to expand...
Click to collapse
Thank you so much for the first relevant answer regarding this Problem!
So you say i'd notice when something went wrong with the TitanM and so i should use the Device?
PIN/Face Unloc Reboot works as fast as indented
But the Error Messages doesn't appear all at once, its more like trying 30x times before finishing the Wipe
I can understand the TPM taking time to perform the wipe... but if it was normal for it to be unresponsive on SPI, I would have hoped Google would suppress the errors while it was trying to check the status.
So I would say that what you saw is not normal. But it thinks that it eventually succeeded.
So just look out for any problems with PIN entry on reboots. If you never see any problems, then you probably don't have to worry too much.
jljtgr said:
I can understand the TPM taking time to perform the wipe... but if it was normal for it to be unresponsive on SPI, I would have hoped Google would suppress the errors while it was trying to check the status.
So I would say that what you saw is not normal. But it thinks that it eventually succeeded.
So just look out for any problems with PIN entry on reboots. If you never see any problems, then you probably don't have to worry too much.
Click to expand...
Click to collapse
Interesting.... i flashed back to the first Factory Image back when the Phone got released and now i dont see any SPI Message during Reset. Looks like a Software Thing, i'll use the Device
falcrumL said:
Is this normal or do i need to worry?
Device runs fine otherwise...
View attachment 5246543
Click to expand...
Click to collapse
can your problem be solved? tell me how to solve it .. pixel 3XL I also experienced the same thing after installing OS 12 beta 1

Categories

Resources