• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[RELEASE] Chromecast with Google TV Bootloader Unlock

Search This thread

fixsony

Member
Apr 27, 2008
29
2
Follow the instructions and install LineageOS? Or go to bootloader and flash stock.
This problem for Walmart Onn UHD Box and recovery boot loop for both, stock and Lineage recovery.
How fix this error:
Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory
emulated Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory
 
Last edited:

npjohnson

Recognized Developer
This problem for Walmart Onn UHD Box and recovery boot loop for both, stock and Lineage recovery.
How fix this error:
Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory
emulated Failed to bind mount /mnt/staging/emulated/media/0 to storage/emulated: No such file or directory

That's not an error. It's a notice, and totally expected. Follow the wiki, all will work fine.
 

npjohnson

Recognized Developer
Thanks. But I am try so many time with same result. One more question when send fastboot reboot-bootloader box reboot to recovery mode.
Then you're doing something massively wrong. That's not what it should do.

And I just realized, the device you're talking about has nothing to do with the thread you're in.

Please go to the g12 devices thread for support.
 

fixsony

Member
Apr 27, 2008
29
2
Then you're doing something massively wrong. That's not what it should do.

And I just realized, the device you're talking about has nothing to do with the thread you're in.

Please go to the g12 devices thread for support.
 

p0werpl

Member
Aug 30, 2021
46
3
Again, how is my post worthless?
It's not that your post is worthless, but you made a blanket comment that the WM device is unequivocally better than this given its price. Is it? How is the stock software on that device? Have you looked at the list of bugs in the LineageOS flavor for the device?

For many users, the device in this thread is fine on Google's software. They just want to unlock the bootloader and root it.
 

vandyman

Senior Member
Jul 30, 2012
436
134
S.Jersey
Google Pixel 5
Google Pixel 6
It's not that your post is worthless, but you made a blanket comment that the WM device is unequivocally better than this given its price. Is it? How is the stock software on that device? Have you looked at the list of bugs in the LineageOS flavor for the device?

For many users, the device in this thread is fine on Google's software. They just want to unlock the bootloader and root it.
I understand, but I was pointing out that there are alternatives.
And it is less than the price of trying to buy one on Ebay for an original 2019 GTV.
Some people are here to learn something new.

There is nothing wrong with the information that I posted.

Yes, I have 2 GTVs, and would like to be able to root them. That is why I have read this whole thread and following it.

The spoon feeding in the G12 thread makes for a long read......

Edit: Never installed LinageOS on any of my devices. I do not need it. Root and I can handle the rest.
 
Last edited:

elliwigy

Forum Moderator / Recognized Dev / Dev Relations
Staff member
XDA App Taskforce
I understand, but I was pointing out that there are alternatives.
And it is less than the price of trying to buy one on Ebay for an original 2019 GTV.
Some people are here to learn something new.

There is nothing wrong with the information that I posted.

Yes, I have 2 GTVs, and would like to be able to root them. That is why I have read this whole thread and following it.

The spoon feeding in the G12 thread makes for a long read......

Edit: Never installed LinageOS on any of my devices. I do not need it. Root and I can handle the rest.
if u want alternatives nothing compares to 2019 nstv pro
 
  • Like
Reactions: vandyman

retyre

Senior Member
Jan 14, 2011
284
304
Central FL
The partition layout on this device leaves a lot to be desired. There's almost 1G less for /data on this device compared to the Onn device (that has a smaller super partition). And losing 800M to cache is wrong (I'm sure OTA can be downloaded to a location in /data instead).

Reclaiming the space from /cache to expand /data might offer two advantages: more storage (obviously) and the inability to OTA because there's no space to save the update.zip?

BTW, you can block updates by blocking android.googleapis.com on the router or adding it manually to AdAway's hosts list. Keep in mind that that will block Play Store and some other Google services as well.
 

npjohnson

Recognized Developer
The partition layout on this device leaves a lot to be desired. There's almost 1G less for /data on this device compared to the Onn device (that has a smaller super partition). And losing 800M to cache is wrong (I'm sure OTA can be downloaded to a location in /data instead).

Reclaiming the space from /cache to expand /data might offer two advantages: more storage (obviously) and the inability to OTA because there's no space to save the update.zip?

BTW, you can block updates by blocking android.googleapis.com on the router or adding it manually to AdAway's hosts list. Keep in mind that that will block Play Store and some other Google services as well.
AOSP still requires /cache on non-A/B - not sure why - but it's a thing.

And that's not how it works - we can't reclaim space from super to data without repartitioning which will break a lot and would be super dangerous (you'd lose all the keys in hidden partitions).


And yeah, that blocks it, but it wouldn't proceed, that's why the modified firmware solution is way better - you can actually use it now.
 

rocker0

Member
Nov 7, 2019
31
3
Can someone else confirm that on stock DISNEY+ is limited to HD, netflix/amazon prime isn't playing at all?
My chromecast is not rooted, just bootloader unlocked
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    I understand, but I was pointing out that there are alternatives.
    And it is less than the price of trying to buy one on Ebay for an original 2019 GTV.
    Some people are here to learn something new.

    There is nothing wrong with the information that I posted.

    Yes, I have 2 GTVs, and would like to be able to root them. That is why I have read this whole thread and following it.

    The spoon feeding in the G12 thread makes for a long read......

    Edit: Never installed LinageOS on any of my devices. I do not need it. Root and I can handle the rest.
    if u want alternatives nothing compares to 2019 nstv pro
  • 9
    Introduction:

    This is an exploit chain intended to allow one to run a custom OS/unsigned code on the Chromecast with Google TV (CCwGTV).

    This uses a bootROM bug in the SoC by security researcher Frederic Basse (frederic).

    Frederic also did a great amount of work to temporarily boot a custom OS from USB here.

    Security researchers Jan Altensen (Stricted) and Nolen Johnson (npjohnson) took the vulnerability and provided tools and customized a u-boot image to take advantage of the provided secure-execution environment to fully bootloader unlock the device.

    Disclaimer:

    You are solely responsible for any potential damage(s) caused to your device by this exploit.

    FAQ:

    - Does unlocking the bootloader void my warranty on this device?
    Probably, assume so. Or just flash stock and lock your bootloader before RMA. The exploit itself leaves no traces.

    - Does unlocking the bootloader break DRM in any way?
    Nope, just like unlocking a Pixel device officially.

    - Can I OTA afterwards?
    NO - It will re-lock your bootloader, and if you've made any modifications, brick you pretty hard. If you manage to do this, re-running the exploit won't be possible either, as a BootROM password is set on any update newer than

    - Can I use stock?
    Yes, but only if you flashed the newer patched factory image offered up in the script.

    - Can I go back to stock after installing custom OS's?
    Yeah, totally, here's a "Factory Image" I made in the style of Pixel Factory Images. The patch level of this build is 2020-06-05. The tool offers to put you on a newer firmware, it's highly recommended to do so.

    - Can I re-lock the bootloader?
    If you flashed the factory image above, sure, but you run the risk of not being able to unlock again.

    - I've run the exploit 10 times and it isn't working yet!
    Swap USB ports/cables, and keep trying, for some people it takes one attempt, for some it takes a lot of attempts.

    Requirements:
    • Chromecast With Google TV (sabrina) without USB password mitigation¹
    • Either a USB A to C, or a C to C cable
    • A PC running some flavor of 64-bit GNU Linux
    • `libusb-dev` installed
    • `fastboot` & `mke2fs` installed from the SDK Platform tools
    ¹: The USB password mitigation has been enabled on units manufactured in December 2020 and after. For units manufactured before, the mitigation was enabled by software update in February 2021. To discern this, look at the MFP date on the bar-code sticker on the bottom of your device's box. If you've powered it on and OTA'd, your firmware version needs to be below the February 2021 patch level. It's not possible to disable/change the password since it's burnt into the chip (efuses).

    Instructions:

    Follow the detailed and up-to-date instructions over at our Github repo, and maybe give the writeup a read/share on social media!

    Post-unlock:
    • The script asks if you want to flash LineageOS Recovery, or a Magisk patched boot image, so enjoy those!
    • At the moment, there are no ROMs for the device, but Android builds in the form of LineageOS are coming soon™. Builds of that will be posted in this forum once ready, and I'll link them here.

    Credits:
    • Nolen Johnson (npjohnson): The writeup, helping debug/develop/theorize the unlock method
    • Jan Altensen (Stricted): The initial concept, u-boot side unlock implementation, debugging/developing the unlock method, and being a wealth of information when it comes to Amlogic devices
    • Frederic Basse (frederic): The initial exploit and the AES key tip
    Special Thanks:
    • Ryan Grachek (oscardagrach): Being an awesome mentor, teaching me a fair chunk of what I know about hardware security, and being a massive wealth of knowledge about most random things.
    • Chris Dibona: Being an awesome advocate of OSS software and helping ensure that we got all the source-code pertinent to the device.
    • Pierre-Hugues Husson (phh): For pointing me down the Amlogic road to begin with by letting me know Google had decided to make the ADT-3 bootloader unlockable.
    • XDA users @p0werpl & @JJ2017, who both helped experiment and find a combination of images that allowed us to skip the forced OTA in SUW.
    2
    wow im glad i left mine unplugged
    2
    I've updated the g12 thread to support sabrina - the beta LineageOS builds for it are live!

    If you want to come back from them, just re-run unlock.sh and select to flash the factory image.
    2
    Thanks OP - script worked a treat on an (unused) unit, MFG: 07/2020.
    Any advice on blocking / disabling the OTA updates? Can't see any instructions searching around (and not much use it until that hurdle cleared!)
    1
    I understand, but I was pointing out that there are alternatives.
    And it is less than the price of trying to buy one on Ebay for an original 2019 GTV.
    Some people are here to learn something new.

    There is nothing wrong with the information that I posted.

    Yes, I have 2 GTVs, and would like to be able to root them. That is why I have read this whole thread and following it.

    The spoon feeding in the G12 thread makes for a long read......

    Edit: Never installed LinageOS on any of my devices. I do not need it. Root and I can handle the rest.
    if u want alternatives nothing compares to 2019 nstv pro