Google TV hack!

Search This thread

Apeman42

Member
Jun 29, 2010
31
19
Cambridge MA
trsohmers.com
Greetings Programs!
I have found the recovery menu for Sony's Google TV/BluRay player!

Here are the details on how to access it (from my original post here: androidforums.[COM]/google-tv/201827-sony-google-tv-hack.html)
OK... so I found out how to get into recovery mode on the Sony Google TV/BluRay player that was released yesterday.

1.Have everything plugged into the unit except the power coord. Have the power coord in your hand.
2.Press and hold the power button and plug the unit in.
3.Continue to hold down the power button for 3 seconds after plugging it in, then release the power button.
4.Wait a couple of seconds and it will say Sony, then you will see the recovery screen.
5.After it loads, press and hold the connect button on the unit. Then follow the directions at the bottom of the screen (Press and hold ALT+ENTER) for 8 seconds/until the bottom message changes. It will change back to it saying that you have to press the CONNECT button, but your remote IS connected.
6.You can now press the numbers assigned to the commands!

WARNING: This could possibly brick your unit and could possibly void your warranty. I am not responsible for anything that happens to your device.

I am going to work on trying to find working drivers and I am going to try to use the Android SDK Tools to install some applications, or at the least try to execute some shell commands. Hopefully we can root it!

Lets start hacking!
 

TimSykes

Senior Member
Jul 24, 2007
414
1
awesome, I will have to keep my eye on this. google TV plus angry birds would be awesome.
 

SimplyGoogleTV

New member
Oct 19, 2010
2
0
simplygoogletv.com
Looking forward to seeing this thing cracked! I'm hoping someone will be able to get a USB tuner to work on one, so those without cable or satellite will be able to get TV content without the hassle of another set-top box.
 

hharte

Senior Member
Nov 3, 2009
82
55
www.magicandroidapps.com
Thanks for the information about recovery, I tried it, and was able to get into recovery. I tried writing the logfile to USB, and it "seemed" to work, but after mounting the USB stick on my linux machine, I didn't see any files there.

I bought the Sony NSZ-GT1 so I could port my Android app Better Terminal Emulator Pro onto Google TV. I already ported it to Android-x86 in preparation for this, but seems like I could not ADB into the Google TV over Ethernet. Frustrated, I decided to take a screwdriver to my Google TV, and did a "teardown" as a result. You can see what the guts look like here:

http://www.magicandroidapps.com/wiki//index.php?title=Main_Page#Sony_NSZ-GT1_Google_TV_Teardown

Sorry the pictures are not that great, I used my Moto Droid to take them, and the lighting was terrible.

-Howard
 
Last edited:

rogerlemmon

Member
Sep 3, 2010
20
2
Seattle
Thanks for the information about recovery, I tried it, and was able to get into recovery. I tried writing the logfile to USB, and it "seemed" to work, but after mounting the USB stick on my linux machine, I didn't see any files there.

I bought the Sony NSZ-GT1 so I could port my Android app Better Terminal Emulator Pro onto Google TV. I already ported it to Android-x86 in preparation for this, but seems like I could not ADB into the Google TV over Ethernet. Frustrated, I decided to take a screwdriver to my Google TV, and did a "teardown" as a result. You can see what the guts look like here:

magicandroidapps.com

Sorry the pictures are not that great, I used my Moto Droid to take them, and the lighting was terrible.

-Howard
ETHERNET? Hasnt anyone tried USB A to USB A cable? I've been busy all day. Gonna go get one tomorrow and figure it out for myself I guess. Can't stand that they have ALREADY corrected the hulu fix for the thing. Why shouldn't I be able to access my paid July plus account? Oh well.
Try USB a to USB a!!!!!
 

hharte

Senior Member
Nov 3, 2009
82
55
www.magicandroidapps.com
USB A to A will definitely not work. All of the USB ports are connected through internal SMSC 4-port hubs. There are two hubs in the unit, one in the back with 3 ports going to external connectors, and one going to the WLAN module. Up front there is another 4-port hub going to the front USB connector, and presumably to a BT module, but I didn't take mine far enough apart to be sure.

There is one large connector over near the CPU that might have some debug stuff on it.There are also about three 4-pin connectors populated, one of which might be a UART. There is also a footprint for another. Tomorrow I'll get my oscilloscope out and see if any of those pins wiggle on boot.

-Howard
 

rogerlemmon

Member
Sep 3, 2010
20
2
Seattle
USB A to A will definitely not work. All of the USB ports are connected through internal SMSC 4-port hubs. There are two hubs in the unit, one in the back with 3 ports going to external connectors, and one going to the WLAN module. Up front there is another 4-port hub going to the front USB connector, and presumably to a BT module, but I didn't take mine far enough apart to be sure.

There is one large connector over near the CPU that might have some debug stuff on it.There are also about three 4-pin connectors populated, one of which might be a UART. There is also a footprint for another. Tomorrow I'll get my oscilloscope out and see if any of those pins wiggle on boot.

-Howard

Yeah, the big long/wide plug. I was looking at the inside of my box too. First day jitters. Anyway, I was also going to start looking for a serial port connection through one of those ports. Good luck and post right away if you find something!
 

hharte

Senior Member
Nov 3, 2009
82
55
www.magicandroidapps.com
If somene with an ethernet sniffer who has not booted their box yet can catch a sniff of the update download, it might be possible to get the update.zip URL, then we could try hacking the update and install it via recovery. This method was very popular with Android devices... but there you could get the update URL from the logcat

-Howard.
 

Apeman42

Member
Jun 29, 2010
31
19
Cambridge MA
trsohmers.com
Great job guys! My friend is going to be getting a GTV later this week, and I will try to get it from him before he boots it up. Guess I will stop trying USB A to USB A.

Will post results later tonight.
 

hharte

Senior Member
Nov 3, 2009
82
55
www.magicandroidapps.com
Another possibility is to try and find the kernel source. If you look in Settings, system Information, Open Source Licenses, there is a site on Google Code that is supposed to contain the GPL'd components:

http://code.google.com/p/googletv-mirrored-source/

Going there doesn't show much except one user space component, and a link to a Sony mirror site:

http://products.sel.sony.com/opensource/

I couldn't find anything useful on the Sony site, but maybe someone else will have better luck.

I'll also try plugging in a USB Serial adapter, but my expectations are pretty low that I'd be able to get a console from that. It's interesting that there are so many USB ports on the Google TV. I wonder what other USB peripherals might be supported? I can see the front port being used for a USB memory stick, and maybe one on the back for a camera, but that still leaves two unused ports. Any idea what Sony/Google might have intended them for?

-Howard
http://www.magicandroidapps.com - Home of Better Terminal Emulator Pro
 
Last edited:

majortom1981

Member
Dec 17, 2008
14
2
hmm

I have this unit and usb keyboards and mice do work . Also iremember a rep saying the logitech cam would work with the sony blu-ray also. I think you would need to wait for the android store to open though for an app that uses it.
 

twobit

Member
Jan 8, 2010
27
5
Not sure if this helps anyone or not, but i ran a port scan on my box and there are 2 ports 9551 and 9552 that are accepting TCP connections.

nmap -p - <IP address of NSZ-GT1>

result :

PORT STATE SERVICE
9551/tcp open unknown
9552/tcp open unknown


I tried to get ADB to connect to those ports but did not work.

Steps that I tried :

1) export ADBHOST=<IP address of my PC>
2) adb kill-server
3) adb devices

No ADB devices were returned

4) adb connect <IP address of Sony NSZ-GT1>:9551
5) adb shell

Got error "error: device offline"

6) repeat steps 4 and 5 except with port 9552 and got same result


I am no expert in any of this stuff so the above might just be sending someone down a rabbit hole but I figured I might share in case it might be helpful to some of the smarter people on here.
 

hharte

Senior Member
Nov 3, 2009
82
55
www.magicandroidapps.com
Try "adb devices" and see if it show anything.

I looked at the kernel from the Sony site:
http://www.sony.net/Products/Linux/TV/NSZ-GT1.html

Here are some findings:
Linux kernel version: 2.6.23.18_nl-btv

Kernel config:
arch/i386/configs/btv_defconfig

CONFIG_USB_SMSC9500=m
Note the SMSC 9500 USB/Ethernet is one of only two loadable modules in the kernel config. Maybe this has some significance, like maybe they use a second Ethernet port for development.

-Howard
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Google tv rooted!

    We finally got root on the revue box and have released a package to manual update the box to the most recent revision, the current hack requires an un-updated box but we have already made a lot of progress on a unofficial sdk and toolchain.

    Here are some videos of it all:
    http://www.youtube.com/watch?v=m6wOqV0UzMo
    http://www.youtube.com/watch?v=Wvw4K0az2hU
    http://www.youtube.com/watch?v=fWaA6VRP0v0
    http://www.youtube.com/watch?v=-ysG0SF2m5Q

    Here is the README for the hack and a little bit about all the files and the process.
    http://www.gtvhacker.com/index.php/Steps_to_get_root

    Toolchain and SDK Info can be found at:
    http://www.gtvhacker.com/index.php/GTv-OS_(AndroidTV)

    You can also find a link for the install package above, I didn't want to post it on here in case it violates any xda rules.

    We all idle on IRC at irc.freenode.net #gtvhacker . If you have any questions, comments, or ideas to better the package please stop by and chat.

    Thanks
    Zenofex
    GTVHacker Team
    2
    NSZ-GS7 can now be rooted with custom recovery: http://www.youtube.com/watch?feature=player_embedded&v=Qe6pPiJFV5k

    Don't know about the release date though...
    1
    I know this is an old thread, but if somebody still has his Google TV, can somebody upload the launcher .apk to an XDA reply? (Im pretty sure is less than 20MB)
    I want to see how it looks. I've just heard of Google TV.

    Old thread all right. I still have my GT1 in a closet somewhere. I might try to root it eventually and if I do I'll upload that.
    1
    I'm starting to think the easiest way to make this platform open (apps, root, etc) is to make a bootable USB stick, and boot it using the bootloader, not even disturbing the on-board FLASH.Searching the web shows that this bootloader has been used on other Atom CExxxx platforms, anyone know of other platforms that use it, or have any experience with it?

    Looking at the boot.img and recovery.img in the update.zip, they don't seem to follow the same pattern as the Android .img files. It would be great if someone can decipher them as they appear to be compressed (and not gzip as far as I can tell.) The boot.img is around 18MB, so we definitely need to figure out how to extract the contents. Extracting the recovery may shed some clues on what can be done with the recovery.

    It will be great to get the Sony update.zip as well to compare with the Logitech.
    1
    OK GUYS...

    I've tried everything that I can think of to get into recovery...played with reset button for an hour, tried ADB'ing in over network and USB, and tried update.zip over USB. Any ideas because I am all out. We may have to go inside to get access to this thing...