Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,812,579 Members 43,803 Now Online
XDA Developers Android and Mobile Development Forum

Flash Now TV Box with Roku LT firmware?

Tip us?
 
speculatrix
Old
(Last edited by speculatrix; 12th August 2013 at 09:52 PM.)
#21  
speculatrix's Avatar
Senior Member
Thanks Meter 49
Posts: 297
Join Date: Mar 2006
Location: Cambridge

 
DONATE TO ME
by redirecting traffic to burpsuite I intercepted a call to download the firmware

GET /windsor/074.09E08061A HTTP/1.1
Connection: close
Host: firmware.roku.com
User-Agent: Roku/DVP-4.9 (074.09E08022A)

you too can download it here: http://firmware.roku.com/windsor/074.09E08061A

so now I have a 41M file which, using strings, begins "imgARMcC" and
has interesting things like "BCM95001" and "Starting ARM with %dMB
ARM clock speed at %dMHz **** failed to power up the USB interface" in it.
Newest to oldest...
Android phones: Xperia Z Ultra, Galaxy Note 2 N7105, HTC Doubleshot, HTC Vision.
Previous phones: Nokia E71, E65, 6310i, 2110.
Previous PDAs: Sharp Zaurus C3100, Zaurus 6000L, Zaurus C860, Palm T3, Sony Clie N770, Handspring Visor.
Mobile operator: Three (latest), Vodafone, Three, O2, Orange (oldest).

/___ if I helped you, please click thanks to encourage me
The Following 5 Users Say Thank You to speculatrix For This Useful Post: [ Click to Expand ]
 
spants
Old
#22  
Junior Member
Thanks Meter 2
Posts: 27
Join Date: Mar 2005
Quote:
Originally Posted by speculatrix View Post
I found the thread on HUKD where someone had managed to break updates:

http://www.hotukdeals.com/deals/now-...3#post18690920
On my hosts file on my router I added:

127.0.0.1 windsor.sw.roku.com

That stops it updating the firmware.....
 
spants
Old
(Last edited by spants; 13th August 2013 at 11:04 PM.)
#23  
Junior Member
Thanks Meter 2
Posts: 27
Join Date: Mar 2005
Quote:
Originally Posted by speculatrix View Post
by redirecting traffic to burpsuite I intercepted a call to download the firmware

GET /windsor/074.09E08061A HTTP/1.1
Connection: close
Host: firmware.roku.com
User-Agent: Roku/DVP-4.9 (074.09E08022A)

you too can download it here: http://firmware.roku.com/windsor/074.09E08061A

so now I have a 41M file which, using strings, begins "imgARMcC" and
has interesting things like "BCM95001" and "Starting ARM with %dMB
ARM clock speed at %dMHz **** failed to power up the USB interface" in it.
You can use BINWALK (https://code.google.com/p/binwalk/) on this file to get more information.... but is this the whole of the update firmware? on http://www.cs.cmu.edu/~ecc/roku-nfp.html he mentions that there are 3 files to download...

Tried running it through https://code.google.com/p/firmware-mod-kit/ but it fails.

If the box was more expensive it would be worth getting an ARM jtag cable (wiggler) and using http://openocd.sourceforge.net/ on it
 
flibblesan
Old
#24  
Senior Member
Thanks Meter 91
Posts: 287
Join Date: Feb 2008
Location: Nottingham
Quote:
Originally Posted by spants View Post
You can use BINWALK (https://code.google.com/p/binwalk/) on this file to get more information.... but is this the whole of the update firmware? on http://www.cs.cmu.edu/~ecc/roku-nfp.html he mentions that there are 3 files to download...
The original Roku Netflix Player is very, very different to current Roku boxes. They use entirely different chipsets that are MIPS architecture rather than the ARM architecture as used in current Roku boxes. This obviously means that firmware format will be different and any hacks for the original Roku boxes just won't do anything.

The Roku 2 - which the LT & Now TV box are based upon - was first released in 2011 and two years later not one person has managed to hack the box to install unsigned firmware, additional apps etc etc. The Roku boxes are extremely well locked down and for good reason. I doubt very much they will ever be hacked.

If you want to run Roku firmware then buy an LT. They are only 35.
The Following User Says Thank You to flibblesan For This Useful Post: [ Click to Expand ]
 
speculatrix
Old
#25  
speculatrix's Avatar
Senior Member
Thanks Meter 49
Posts: 297
Join Date: Mar 2006
Location: Cambridge

 
DONATE TO ME
Quote:
Originally Posted by spants View Post
You can use BINWALK (https://code.google.com/p/binwalk/) on this file to get more information.... but is this the whole of the update firmware? on http://www.cs.cmu.edu/~ecc/roku-nfp.html he mentions that there are 3 files to download...

Tried running it through https://code.google.com/p/firmware-mod-kit/ but it fails.

If the box was more expensive it would be worth getting an ARM jtag cable (wiggler) and using http://openocd.sourceforge.net/ on it
I've worked with a few people who do embedded Arm stuff, so I'll ask if anyone can loan me a jtag cable, or, wants to borrow the nowtv box to play.

---------- Post added at 11:31 AM ---------- Previous post was at 11:28 AM ----------

Quote:
Originally Posted by flibblesan View Post
The Roku boxes are extremely well locked down and for good reason. I doubt very much they will ever be hacked.

If you want to run Roku firmware then buy an LT. They are only 35.
If I was going to do that, I'd buy a completely open system like a raspberry pi, or a beaglebone black. But where would be the fun in that?

Newest to oldest...
Android phones: Xperia Z Ultra, Galaxy Note 2 N7105, HTC Doubleshot, HTC Vision.
Previous phones: Nokia E71, E65, 6310i, 2110.
Previous PDAs: Sharp Zaurus C3100, Zaurus 6000L, Zaurus C860, Palm T3, Sony Clie N770, Handspring Visor.
Mobile operator: Three (latest), Vodafone, Three, O2, Orange (oldest).

/___ if I helped you, please click thanks to encourage me
 
speculatrix
Old
#26  
speculatrix's Avatar
Senior Member
Thanks Meter 49
Posts: 297
Join Date: Mar 2006
Location: Cambridge

 
DONATE TO ME
Quote:
Originally Posted by spants View Post
You can use BINWALK (https://code.google.com/p/binwalk/) on this file to get more information
If the box was more expensive it would be worth getting an ARM jtag cable (wiggler) and using http://openocd.sourceforge.net/ on it
hmm, interesting...

Code:
~/download/Roku$ binwalk windsor_firmware__074.09E08061A 

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
404064          0x62A60         U-Boot boot loader reference
36827492        0x231F164       gzip compressed data, was "Image", from Unix, last modified: Fri Jun 21 20:28:49 2013, max compression
39357391        0x2588BCF       gzip compressed data, has CRC, extra field, last modified: Tue Feb 24 17:08:22 2032
41441952        0x2785AA0       GIF image data, version "87a", 18759
41441960        0x2785AA8       GIF image data, version "89a", 24944
41960112        0x28042B0       Copyright string: " (c) 2010 Broadcomrge ? y == noutput_height || y == noutput_height+1 : y == pFile"
41998628        0x280D924       PNG image, 0 x 0, 0-bit grayscale, non-interlaced
41998636        0x280D92C       PNG image, 0 x 0, 0-bit grayscale, non-interlaced
42430052        0x2876E64       GIF image data, version "89a", 28515
42794144        0x28CFCA0       Copyright string: " (c) 1996-2009 Express Logic Inc. * ThreadX/SMP VideoCore Versic. * ThreadX/SMP VideoCore Version G5.3.5.2 (SP1) SN: 3009-115-"
Newest to oldest...
Android phones: Xperia Z Ultra, Galaxy Note 2 N7105, HTC Doubleshot, HTC Vision.
Previous phones: Nokia E71, E65, 6310i, 2110.
Previous PDAs: Sharp Zaurus C3100, Zaurus 6000L, Zaurus C860, Palm T3, Sony Clie N770, Handspring Visor.
Mobile operator: Three (latest), Vodafone, Three, O2, Orange (oldest).

/___ if I helped you, please click thanks to encourage me
 
tholmewood
Old
#27  
Member
Thanks Meter 4
Posts: 36
Join Date: Mar 2008
I agree that the best and easiest way to increase functionality would be to somehow generate a link code and to push the good apps and private channels to the box. I wonder if there is anyway to figure out what a device's link code is from the model number?
 
Bouncer5
Old
#28  
Senior Member
Thanks Meter 11
Posts: 411
Join Date: Jun 2010
Location: Glasgow
Anybody want to soilder a USB port onto the space? See if we can't sideload something on it?
 
tonyt3rry
Old
#29  
tonyt3rry's Avatar
Senior Member
Thanks Meter 13
Posts: 439
Join Date: Dec 2010
Location: Liverpool
I have the now TV box its amazing with plex I love it. What kind of private channels do you all use

Sent from my GT-I9300 using xda app-developers app
Nexus 5 4.4.4 (Stock No Root) / Galaxy Tab 2 7.0 4.4 (Omnirom)
 
SlackR84
Old
(Last edited by SlackR84; 17th August 2013 at 05:46 PM.)
#30  
Junior Member
Thanks Meter 13
Posts: 11
Join Date: Sep 2010
I have removed the nand chip from the Now TV and took a full dump. I also bought a Roku 2 XD and will be taking a full nand dump of this too, I will then reflash the now tv nand. I went with the XD as it supports 1080p and the only hardware difference is a microsd slot and the bluetooth (which are unpopulated on the now tv board).

The lack of microsd wont be a problem - as there is nothing connected when the slot is empty anyway. Hopefully the lack of bluetooth wont stop the XD firmware booting. If it does, I will get a LT - but I figured 1080p support was a nice upgrade.

There seems to be references to ttybcm0 in uboot, which also gives serial connection settings. I have the pinout of the BCM2835 (same as the raspberry pi) with the possible pins for serial (depending on how its configured).



I will probably remove the CPU and trace out these 3 combinations and try to get serial access. Assuming uboot isnt locked down, should be easy to flash from there.

Quote:
Originally Posted by Bouncer5 View Post
Anybody want to soilder a USB port onto the space? See if we can't sideload something on it?
That wont work, the USB controller is missing. The higher end rokus have a chip that handles USB and Ethernet - the SMSC LAN9512-JZX. This is a "Hi-Speed USB 2.0 Hub and High-Performance 10/100 Ethernet Controller". Without that chip (and the missing supporting surface mount components) you wont get USB or ethernet, even if you do solder in the port.

Quote:
Originally Posted by spikeeee View Post
ROKU LT board
That is a Roku 2 XS board, not a Roku LT. The LT board is the same as the Now TV board - i.e. a bunch of unpopulated parts.

The Following 2 Users Say Thank You to SlackR84 For This Useful Post: [ Click to Expand ]
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes