[ROOT] HubCap Chromecast Root Release!

Search This thread

reiteravi

Senior Member
Feb 14, 2007
373
36
updated to 17977
guess google didn't blocked the hole just yet
wonder if they're gonna purchase a teensy or 2 or the whole company....
 

TTGZDOG

Senior Member
Jul 27, 2011
59
3
Winston-Salem
I'm looking to purchase the stuff to root my chrome cast but i cant seem to figure out what benefits there are for chrome cast root?
Could anyone tell me? PLZZZ
 

tech3475

Senior Member
Nov 4, 2013
93
10
With this, is it possible to stream locally without an internet connection? I mean completely, not like now where you have to connect even just temporarily before you can go offline.

Right now that's probably the main reason I'd root mine.

Also, is it possible to undo the hack and restore a stock ROM?
 
Last edited:

krumbs

Senior Member
Jan 12, 2010
445
73
Navi Mumbai
www.krumbs.in
Will this work on older firmware?

Plugged in the Chromecast after two months. The Android Chromecast app reports the firmware as 17250.
The problem is, the device is refusing to update! Have left it plugged in for over two hours, rebooted and factory reset. But there still is no sign of the 17977 update!
So, two questions:
- Will this exploit work on 17250?
- Alternatively, is there a way to force the Chromecast to update to 17977?
Thanks!
 

reiteravi

Senior Member
Feb 14, 2007
373
36
from op:

Instructions

Install the appropriate Teensy Root Package on your device.
If New In Box device, use 12940 otherwise use 16664.
 

explorer-10

Senior Member
Dec 28, 2010
1,245
63
L.A.
What CAN you do with a rooted CC anyway vs a non-rooted one? I mean, I know the benefits of a rooted smartphone, but how do I benefit from a rooted streaming device?
 

equity

Member
Jun 28, 2008
22
1
Thanks! I've got to wait until tomorrow for my Teensy, but I'm definitely going to buy another Chromecast for my Bedroom today :laugh:
 

TamCore

Senior Member
Jul 8, 2010
665
649
31
Düsseldorf
tamcore.eu
My Chromecast's serial begins with 38** and it's running build 17977. I've tried regular_16664.hex on a normal Teensy 2. But after ~15 seconds my Teensy's LED stops flashing, Chromecast's LED is still red and ChromeCast displays the chromecast.com/startup-issues link. Even when I wait a minute more I don't get the solid orange LED on the Teensy and the solide white LED on the ChromeCast. Any advice?
 

X3r0X

Senior Member
Sep 29, 2007
88
3
finalgaming.de
Tried to use my old device I used for the PS3 Jailbreak with an AT90USB162 on it, like the teensy. Not working for me.

How is a "new in box device" looking? Can a 3C08 device be one?

Isn't it working with an original teensy (1) ?
 
Last edited:

fabi280

Senior Member
Oct 20, 2010
347
365
Karlsruhe
Tried to use my old device I used for the PS3 Jailbreak with an AT90USB162 on it, like the teensy. Not working for me.

How is a "new in box device" looking? Can a 3C08 device be one?

Isn't it working with an original teensy (1) ?

Teensy has a MEGA32U4, did you try the files for the Teensy++? But even the ++ has a different Processor (AT90USB1286)
 

Lizard

Senior Member
Mar 12, 2006
320
402
Yes, my Chromecast is now rooted. I missed out on the first exploit. Thanks to everybody who made this possible!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 113
    Dear XDA Users,

    We’re happy to announce that fail0verflow, GTVHacker, and Team-Eureka have jointly discovered and exploited a new vulnerability in the Chromecast which allows root access on the current software build (17977) as well as new in box devices (proof).

    Requirements


    Instructions

    1. Install the appropriate Teensy Root Package on your device.
      • If New In Box device, use 12940 otherwise use 16664.
      • Use plusplus_*.hex for 2++ model, regular_*.hex for 2 model
    2. Using Win32DiskImager or dd, install the Flashcast Image to the 1G+ Flashdrive.
    3. Plug in the Teensy to a USB OTG Cable, and plug it into the Chromecast while holding down the reset button.
      • The Teensy light should start flashing. If not, try the process again. After 30 seconds, it should go solid orange and the Chromecast LED sould turn white.
    4. Unplug the Teensy, then plug in the flashdrive loaded with Flashcast into the OTG cable, and then press the Chromecast button again.
      • If you used the 12940 image, the LED should turn white. If you used the 16664 image, the LED should stay dim red.
    5. After about 5 minutes, the Chromecast should reboot and your device should now be rooted!

    Having Problems?

    • “I am using a USB hub with a OTG cable, why is it not working?”
      • This root method requires a powered OTG cable and will not work over a USB hub. This is because the teensy needs to be directly connected to the Chromecast to work and can not go over a USB hub.
    • “How can I tell if the root is running?”
      • If the Chromecast is plugged into a TV, you should see a Flashcast message telling you your device is being rooted. If you do not see this message, unplug the Chromecast and try again.

    Created By

    @fail0verflow
    @gtvhacker
    @Dev_Team_Eureka

    Shoutouts

    Google Inc. - Thanks for the awesome device, now add fastboot support
    XDA-Developers - For being the home of Chromecast Development

    Download

    Exploit Demo: https://www.youtube.com/watch?v=S2K72qNv1_Q
    Download: http://download.gtvhacker.com/file/chromecast/HubCap.zip


    Source:
    GitHub: https://github.com/axoltl/HubCap
    10
    HEADS UP: Seems that google HAS PATCHED the HubCap exploit in the latest OTA (19084), but did not post the source for it (to keep us guessing?). Please avoid this OTA if you want root!
    9
    8
    I am running 17977 firmware. The micro is verified as a usb hub and has been flashed with the correct file.

    So you're past step 2:
    1. Get all the needed hardware (compatible board & USB OTG cable with power).
    2. Get it flashed correctly with the right version hex file.
    3. Get the Chromecast to load the exploit payload.
    4. Load Eureka to the Chromecast from your flash drive.

    Here's a hex file compiled for the Leonardo/Micro, firmware >= 16664. Give this a try. It shouldn't magically make things work, but it should let you know that you've got the timing right for step 3. The only tricky part I noted was getting the timing right on when to release the CC button. Too early, and it goes to blinking white. For me, what worked was releasing it just after the CC turned red, but it took a few minutes of trial & error.
    7
    Brilliant -- working through the steps now!

    One bit of missing hardware that may seem obvious: you'll need a USB-to-MiniUSB cable to program the Teensy. It doesn't ship with one and it wasn't shown in the video. I had a spare, so I'm in business and will edit my post once I'm able to successfully flash my Chromecast, but it may need to be put down on the required parts list. :D

    UPDATE: worked like a charm!
    rooted.jpg


    The rooted device was purchased from Amazon two days ago with Prime shipping. It's S/N begins 3C24***. I couldn't tell you how happy I am to have not missed root this time around. ;)

    Thanks again for all your work, guys!