FORUMS
Remove All Ads from XDA

HOWTO: Force Chromecast to Boot from USB (Possible Brick Recovery Method)

796 posts
Thanks Meter: 1,520
 
By ddggttff3, Inactive Recognized Developer on 10th September 2013, 12:04 AM
Post Reply Email Thread
WARNING: This should be the VERY VERY VERY VERY (Am I clear enough about this?) LAST thing you do to try and fix a chromecast. This can possibly fry a chromecast for good, so know going into this that it may not work!
Because of this, Me, XDA, and all other users are NOT RESPONSIBLE for any damage, problems, or issues that may arise from using this method. By using this tutorial, you agree and understand the above warning.




So, I had a Chromecast that I got stuck in "backupsys" boot mode, where it would try to boot the backupsys partition. Issue is, it would not boot, and you can't force it to boot from jumpdrive while it is in "recovery" or "backupsys" mode.
Well after tearing the thing down and getting UART setup, I started messing around, and found a way to FORCE the device to read from USB, regardless to the bootmode.

How this works is during the boot process, you jump 2 select pins on the PCB by the CPU, which causes the device to have a block read error while reading the system flash. When this happens, the device falls back into USB read mode.

Because this causes a read interrupt, it "MAY" have unknown effects on the longevity of your device, so like I said before, this should be a LAST RESORT OPTION ONLY.

What You Need:
  1. Chromecast with Rootable Bootloader
  2. Paper Clip/Needle to jump some TINY pins
  3. UART hooked up to your computer
  4. Jump Drive with the Root Image & USB OTG Cable

Process:

Step 1: Tear down your device, and have it hooked up to UART on your computer.

Step 2: Have the USB OTG Cable and Jump Drive with the root image plugged into the chromecast. Do not have it plugged into power yet.

Step 3: On the top side of the chromecast (Not the side with the UART Pins), carefully remove the RF shield to reveal the WiFi Chip and CPU.


Step 4: Have putty open and connected to your UART COM port. Also have "reboot recovery" in your clipboard. (Copy that command so you can right-click in putty to send it quick)

Step 5: Now, prepare to jump pin #26 (shown in photo below, marked with red square on right side of CPU) when you plug in the chromecast to power it.


Step 6: Plug in the chromecast power, and watch the UART output. Once the Chromecast LED turns read, use the paper clip to short pin #26 and you should get the following outout:
Code:
sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0

PG868: leakage=208 vcore=10 sysctl=59

Customer key found, loading customer key...

Loading Secure Customer Key Store is finished

Loading Secure Customer Key Store is finished

Finish loading Customer Key store

bootloader image verified, start...



eureka-b3 BG2CD [Jun  6 2013 12:07:51] ver:9086b04-dirty

OTP status=0x000000FF lkg curr=208 mA

nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!

[FASTLOGO] init.

[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start

showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0


[FASTLOGO] done.

fts: v155 loaded from 0x00268000

Read failed @ 0x7814c000

ERROR: Failed to read CPU image ret -1

Booting from NAND failed, booting from USB....!

timer_clk_freq = 0x47868c0 

USB:   Register 10011 NbrPorts 1

USB EHCI 1.00

scanning bus for devices... 2 USB Device(s) found

       scanning bus for storage devices... 1 Storage Device(s) found
If you do not see "Booting from NAND failed, booting from USB....!", unplug the chromecast, and try again.

Step 7: The chromecast will now try and boot the Jump Drive image. During this, there will be a root shell hiding under all the output. You need to QUICKLY and repeatedly press Enter until you see "/ # " flash on the screen. Once you see that flash, QUICKLY press right-click so putty pastes your clipboard, and then press enter. If you do this fast enough, the kernel will run "reboot recovery" and restart.

Step 8: The device will now try to boot the normal recovery partition. This is fine, because even if it fails, the bootloader will detect this and reset the device to normal boot mode after a few power cycles. After a few power cycles, the chromecast should eventually show the following over UART:
Code:
sys_init start. boot_strap=0x00000080 (source=NAND), boot_state=0x0

PG868: leakage=208 vcore=10 sysctl=59

Customer key found, loading customer key...

Loading Secure Customer Key Store is finished

Loading Secure Customer Key Store is finished

Finish loading Customer Key store

bootloader image verified, start...



eureka-b3 BG2CD [Jun  6 2013 12:07:51] ver:9086b04-dirty

OTP status=0x000000FF lkg curr=208 mA

nand_randomizer_init_by_flash_type(chip_id = 0x2C48044AA500): !!! RANDOMIZED !!!

[FASTLOGO] init.

[FASTLOGO] Set CPCB1 output reso 8.[SHOWLOGO] start

showlogo_init_irq, Enable IRQ_dHubIntrAvio0(0x20) for cpu 0


[FASTLOGO] done.

fts: v168 loaded from 0x0029c000

[SHOWLOGO] stopped

Boot normal GTV image

fts: record v169 commited @ 0x002a0000

Uncompressing Linux... done, booting the kernel.
And congrats, the device is now back to Normal Boot Mode! You can now hold the power button during power on to properly flash the rooted image, and your device should be good to go!

DEVS: If you want to help make this easier, can you make a USB image that just boots the kernel and stops at command line? Would make this process easier.

FAQ:
Q: Why do I need this? I can just hold down the button to boot from a Jump Drive.
A: This is true, but if a Chromecast is in any other boot mode besides normal, then it will be unable to boot from USB. This is just how the bootloader is coded. (I submitted a patch to google regarding this, even though it would never help us out thanks to the updated locked bootloader).

Q: Will this allow be to Downgrade/Root my device?
A: Answer is Probably not, even though this is untested. This is because the bootloader is still loading from the device, so it will still probably check the USB Drives image for a valid signature.

Q: I tried this, but my device still won't boot.
A: Well then there is probably not much else you can do, besides looking for a fix yourself. Remember, its a $35 dollar device so it may just be best to buy a new one.
The Following 12 Users Say Thank You to ddggttff3 For This Useful Post: [ View ] Gift ddggttff3 Ad-Free
 
 
10th September 2013, 12:27 AM |#2  
ddggttff3's Avatar
OP Inactive Recognized Developer
Flag Minnesota
Thanks Meter: 1,520
 
More
Reserved
10th September 2013, 02:58 AM |#3  
jamcar's Avatar
Senior Member
Flag Orlando
Thanks Meter: 400
 
More
This reminds me of what people did for the xbox 360 with the dual nand chips, or what Adam Outler did with the galaxy camera. He had a switch that would choose whether to boot the default eMMC or a SD card.

Aaron Swartz, Rest in Pixels.
10th September 2013, 05:18 AM |#4  
zackoch's Avatar
Member
Flag Maple Grove, MN
Thanks Meter: 93
 
More
Quote:
Originally Posted by ddggttff3

Reserved


Can you explain why you chose pin 26?

Thanks
The Following User Says Thank You to zackoch For This Useful Post: [ View ] Gift zackoch Ad-Free
10th September 2013, 05:25 AM |#5  
ddggttff3's Avatar
OP Inactive Recognized Developer
Flag Minnesota
Thanks Meter: 1,520
 
More
Quote:
Originally Posted by zackoch

Can you explain why you chose pin 26?

Thanks

In all honesty, trial and error with a device I didn't think would ever work again.

EDIT: Also, getting very very lucky.
The Following 2 Users Say Thank You to ddggttff3 For This Useful Post: [ View ] Gift ddggttff3 Ad-Free
10th September 2013, 06:30 PM |#6  
jamcar's Avatar
Senior Member
Flag Orlando
Thanks Meter: 400
 
More
Quote:
Originally Posted by jamcar

This reminds me of what people did for the xbox 360 with the dual nand chips, or what Adam Outler did with the galaxy camera. He had a switch that would choose whether to boot the default eMMC or a SD card.

Aaron Swartz, Rest in Pixels.

In case anyone didn't pick on my meaning, it would be cool if we could use a switch to boot from USB or eMMC.

Aaron Swartz, Rest in Pixels.
12th September 2013, 01:25 AM |#7  
ddggttff3's Avatar
OP Inactive Recognized Developer
Flag Minnesota
Thanks Meter: 1,520
 
More
Quote:
Originally Posted by jamcar

In case anyone didn't pick on my meaning, it would be cool if we could use a switch to boot from USB or eMMC.

Aaron Swartz, Rest in Pixels.

technically this may be possible, but I am not a developer but don't quote me. The fact that we can load a kernel off a jump drive though should mean we have the ability to load and run a system image off of a jump drive.
The Following 2 Users Say Thank You to ddggttff3 For This Useful Post: [ View ] Gift ddggttff3 Ad-Free
14th September 2013, 04:20 PM |#8  
jamcar's Avatar
Senior Member
Flag Orlando
Thanks Meter: 400
 
More
I just got a second chromecast and am awaiting my USB OTG power cable, I do plan to root this one and work on seeing if my idea is possible.

Aaron Swartz, Rest in Pixels.
15th September 2013, 09:06 PM |#9  
jamcar's Avatar
Senior Member
Flag Orlando
Thanks Meter: 400
 
More
How did you get the remainder of the shield off? I got the covers off but I can't get the shield off.

EDIT: I got it. Another question: do you leave your chromecast "naked" or?
16th September 2013, 12:28 AM |#10  
ddggttff3's Avatar
OP Inactive Recognized Developer
Flag Minnesota
Thanks Meter: 1,520
 
More
Quote:
Originally Posted by jamcar

How did you get the remainder of the shield off? I got the covers off but I can't get the shield off.

EDIT: I got it. Another question: do you leave your chromecast "naked" or?

You should put the RF shields back on after you do this modification, as they prevent interference and issues. During the dissection of my device though, I fully removed the shields (including the sides), so I have no choice but to run that one naked, but it is sitting on the side as I have another rooted chromecast I use for day to day usage.
The Following 2 Users Say Thank You to ddggttff3 For This Useful Post: [ View ] Gift ddggttff3 Ad-Free
8th October 2013, 12:42 PM |#11  
rbeavers's Avatar
Senior Member
Flag Columbus Ohio
Thanks Meter: 251
 
More
Short pin 26 to Ground?

Sent from my XT897 using XDA Premium 4 mobile app
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes