[ROOT] HubCap Chromecast Root Release!

Search This thread

unknown89

Senior Member
Apr 18, 2011
56
1
Hi guys sorry if it seems like stupid question. I got replacement chromecast from google and I did update via net but it says firmware version is 1.17.46278 , so this is rootbale?
 

bhiga

Inactive Recognized Contributor
Oct 13, 2010
2,501
1,017
Hi guys sorry if it seems like stupid question. I got replacement chromecast from google and I did update via net but it says firmware version is 1.17.46278 , so this is rootbale?
Sorry, no. That's build 46278, way past 19084, so not rootable by any current means.
 

CyberMario

Member
Sep 30, 2007
5
0
43
can't use teensy, i programmed and no led blinking, when i put in powered otg cable, it don't blink and recieve an error in chromecast... any idea? thanks
 

CyberMario

Member
Sep 30, 2007
5
0
43
Are you sure you used the Hubcap image?

thanks for reply

yes, i downloaded it from this post, and try the steps as shown in this video:

https://www.youtube.com/watch?v=S2K72qNv1_Q&index=5&list=PLE_cofdon1WvP1M1GiHnXp3nwm_Pr7Vu8

i uplopad the image using teensy uploader from the manufacturer page, app upload and reboot correct in manual and automatic mode correctly, but when is the chromecast thru the powered otg cable, teensy dont blink as in the video

and connected to tv, chromecast show an startup error

any ideas? thanks
 

Asphyx

Senior Member
Dec 19, 2007
2,151
376
Android Wear
thanks for reply

yes, i downloaded it from this post, and try the steps as shown in this video:

https://www.youtube.com/watch?v=S2K72qNv1_Q&index=5&list=PLE_cofdon1WvP1M1GiHnXp3nwm_Pr7Vu8

i uplopad the image using teensy uploader from the manufacturer page, app upload and reboot correct in manual and automatic mode correctly, but when is the chromecast thru the powered otg cable, teensy dont blink as in the video

and connected to tv, chromecast show an startup error

any ideas? thanks

Don't worry if the Teensy blinks or not...
But you should have done the Teensy part, then used a USB thumbdrive with the proper image for Eureka before you reset the CCast.
 

ritz3770

New member
Apr 9, 2016
2
0
Hi i want to root the chrome cast having the current updated firmware is it possible?
Can i use Veerobot Crux Development board instead of Teensy?
 

bhiga

Inactive Recognized Contributor
Oct 13, 2010
2,501
1,017
Hi i want to root the chrome cast having the current updated firmware is it possible?
Can i use Veerobot Crux Development board instead of Teensy?
No. Root is not possible on firmware build 19084 and newer, the Flashcast and HubCap vulnerabilities have been patched.
 

ritz3770

New member
Apr 9, 2016
2
0
No. Root is not possible on firmware build 19084 and newer, the Flashcast and HubCap vulnerabilities have been patched.

Thanks,

But is there any other way of using chrome cast for casting media only without Wifi router or internet connectivity?

Also in future please inform me if there is new developments in rooting this new firmware.
 

bhiga

Inactive Recognized Contributor
Oct 13, 2010
2,501
1,017
Thanks,

But is there any other way of using chrome cast for casting media only without Wifi router or internet connectivity?

Also in future please inform me if there is new developments in rooting this new firmware.
It needs an Internet connection to determine what to do and what to run.

There is a thread on using Chromecast without a router, but it still requires a device with Internet connectivity functioning as a hotspot.

Subscribe to the forum/topic or just check back in the future.

IMO I doubt there will be a new exploit found soon. It took over a year between Flashcast and HubCap and there's limited interest in Chromecast.
 

TechMod

Senior Member
Aug 4, 2014
163
44
Berlin
Hi everybody!

Would you be so kind and post or pm me the item number for the powered usb cable at amazon? I can't find it there (I just find the ones with a male and a female micro usb, but no mini/micro usb). I tried with another cable, but it didn't work out for me.

Thanks in advance.
 

bhiga

Inactive Recognized Contributor
Oct 13, 2010
2,501
1,017
Would you be so kind and post or pm me the item number for the powered usb cable at amazon? I can't find it there (I just find the ones with a male and a female micro usb, but no mini/micro usb). I tried with another cable, but it didn't work out for me.
It would be helpful if you could point us to the one that you tried that didn't work, in case it was something other than the cable (you're certain your Chromecast has a vulnerable build?). I'm not aware of anything special or specific cable/wise, I've used a couple different ones from eBay, and searching "powered microusb cable" on Amazon turns up a number of candidates.
 

TechMod

Senior Member
Aug 4, 2014
163
44
Berlin
It would be helpful if you could point us to the one that you tried that didn't work, in case it was something other than the cable (you're certain your Chromecast has a vulnerable build?). I'm not aware of anything special or specific cable/wise, I've used a couple different ones from eBay, and searching "powered microusb cable" on Amazon turns up a number of candidates.
The one I have tried is a generic external HDD USB Y-cable with the desired connections together with the original teensy 2++ USB and an USB OTG from Xperia z3+/Z4. Writing the Image to an USB Device worked well and programming the teensy also ( I used Ubuntu 16.04 and Win10 to cross check). I assume that the vulnerability of the ROM is not very important, because of the following:

Dear XDA Users,

We’re happy to announce that fail0verflow, GTVHacker, and Team-Eureka have jointly discovered and exploited a new vulnerability in the Chromecast which allows root access on the current software build (17977) as well as new in box devices (proof).

Which leads me to believe that every version is rootable (I have an old CC stick). I believe the problem is the HDD connector, because it either is not capable of connecting because there is a resistor inside of it or it is one way as it is normally used for connecting the HDD to a hub with two USB ports so it can start properly.

I would like to have the item number, because my amazon search brings up OTG's with MICRO connections only, but the video shows an OTG cable which uses a female micro USB and a male mini USb, which is slightly bigger.
 

bhiga

Inactive Recognized Contributor
Oct 13, 2010
2,501
1,017
I assume that the vulnerability of the ROM is not very important, because of the following:
...quote from opening post...
Which leads me to believe that every version is rootable (I have an old CC stick). I believe the problem is the HDD connector, because it either is not capable of connecting because there is a resistor inside of it or it is one way as it is normally used for connecting the HDD to a hub with two USB ports so it can start properly.
Sorry, the issue is almost certainly not the cable but your firmware build. The Hubcap exploit was patched in build 19084 and the current build is far, far beyond that.

So check the Chromecast app to see what build your Chromecast has. If it is 19084 or greater, it cannot be rooted nor can it be downgraded since flashing requires exploitable bootloader (such it's also what root requires).

See my signature for more info.
 
  • Like
Reactions: TechMod and jocarog

tocheskey

New member
Jul 4, 2007
3
2
I'm having a problem when connecting the chromecast and the teensy ++ together. I followed all of the instructions to the letter but when I hold down the reset button on the chromecast and plug in the usb the light on the teensy just stays solid and never starts to blink. I cant figure out what I'm doing wrong...any help?

nevermind...just saw the post about the HubCap exploit being patched. :(
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 113
    Dear XDA Users,

    We’re happy to announce that fail0verflow, GTVHacker, and Team-Eureka have jointly discovered and exploited a new vulnerability in the Chromecast which allows root access on the current software build (17977) as well as new in box devices (proof).

    Requirements


    Instructions

    1. Install the appropriate Teensy Root Package on your device.
      • If New In Box device, use 12940 otherwise use 16664.
      • Use plusplus_*.hex for 2++ model, regular_*.hex for 2 model
    2. Using Win32DiskImager or dd, install the Flashcast Image to the 1G+ Flashdrive.
    3. Plug in the Teensy to a USB OTG Cable, and plug it into the Chromecast while holding down the reset button.
      • The Teensy light should start flashing. If not, try the process again. After 30 seconds, it should go solid orange and the Chromecast LED sould turn white.
    4. Unplug the Teensy, then plug in the flashdrive loaded with Flashcast into the OTG cable, and then press the Chromecast button again.
      • If you used the 12940 image, the LED should turn white. If you used the 16664 image, the LED should stay dim red.
    5. After about 5 minutes, the Chromecast should reboot and your device should now be rooted!

    Having Problems?

    • “I am using a USB hub with a OTG cable, why is it not working?”
      • This root method requires a powered OTG cable and will not work over a USB hub. This is because the teensy needs to be directly connected to the Chromecast to work and can not go over a USB hub.
    • “How can I tell if the root is running?”
      • If the Chromecast is plugged into a TV, you should see a Flashcast message telling you your device is being rooted. If you do not see this message, unplug the Chromecast and try again.

    Created By

    @fail0verflow
    @gtvhacker
    @Dev_Team_Eureka

    Shoutouts

    Google Inc. - Thanks for the awesome device, now add fastboot support
    XDA-Developers - For being the home of Chromecast Development

    Download

    Exploit Demo: https://www.youtube.com/watch?v=S2K72qNv1_Q
    Download: http://download.gtvhacker.com/file/chromecast/HubCap.zip


    Source:
    GitHub: https://github.com/axoltl/HubCap
    10
    HEADS UP: Seems that google HAS PATCHED the HubCap exploit in the latest OTA (19084), but did not post the source for it (to keep us guessing?). Please avoid this OTA if you want root!
    9
    8
    I am running 17977 firmware. The micro is verified as a usb hub and has been flashed with the correct file.

    So you're past step 2:
    1. Get all the needed hardware (compatible board & USB OTG cable with power).
    2. Get it flashed correctly with the right version hex file.
    3. Get the Chromecast to load the exploit payload.
    4. Load Eureka to the Chromecast from your flash drive.

    Here's a hex file compiled for the Leonardo/Micro, firmware >= 16664. Give this a try. It shouldn't magically make things work, but it should let you know that you've got the timing right for step 3. The only tricky part I noted was getting the timing right on when to release the CC button. Too early, and it goes to blinking white. For me, what worked was releasing it just after the CC turned red, but it took a few minutes of trial & error.
    7
    Brilliant -- working through the steps now!

    One bit of missing hardware that may seem obvious: you'll need a USB-to-MiniUSB cable to program the Teensy. It doesn't ship with one and it wasn't shown in the video. I had a spare, so I'm in business and will edit my post once I'm able to successfully flash my Chromecast, but it may need to be put down on the required parts list. :D

    UPDATE: worked like a charm!
    rooted.jpg


    The rooted device was purchased from Amazon two days ago with Prime shipping. It's S/N begins 3C24***. I couldn't tell you how happy I am to have not missed root this time around. ;)

    Thanks again for all your work, guys!