4

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing OpenWrt/DD-WRT

I have a Japanese digital media player from NTT called HB-1000 光BOX＋ I want to install OSMC (https://osmc.tv/) or something...anything that's not what is on there now.

The media player is running Android 4.2.2, I think. I can access the GUI and open some preinstalled apps but in the settings some options aren't available (like developer options). I connected the device to my router and did a port scan. I couldn't find the SSH/FTP/Telnet ports open.

NTT's website indicates that the firmware can be upgraded when the player is connected to the internet. Maybe I can use Wireshark to help me figure out what's going on during a firmware update. NTT's website states that downloaded files can't be saved to SD card or USB.

lk is used during the boot process https://github.com/littlekernel/lk

Specs:

  • Telechips TCC8930 Dual ARM Cortex A9 @ 1.2GHz ARMv7-A
  • 4GB NAND flash
  • 1GB DDR3-800Mhz RAM
  • LAN 1000Base-T
  • HDMI
  • USB 2.0 (x2)
  • SD card slot
  • Wi-Fi 802.11n
  • Bluetooth 4.0
  • A reset and WPS button
  • Green blinky LED lights (very important)

The circuit board is manufactured by OKI.

I found some software from the chip manufacturer (I'll add link)

I also found a website talking about a leaked Android SDK (I'll add link)

I've managed to connect a (UART/TTY to USB) device to some debug or serial connector ports. There are 14 "holes" and I managed to connect to the correct ones to see something when I use Minicom on my Ubuntu 14.04 computer. I don't see any sort of command line. If I hit a key on my keyboard, the media player reboots.

I can provide some pics of the circuit board and my terminal screen upon request.

Can anyone help or guide me to a better place for my question or somewhere I can learn about what's going on inside when I turn the power on?

enter image description here enter image description here

Improve this question
1

2 Answers 2

Reset to default
1

I don't know about this particular device, so I'll answer with generalities.

Since the device is running Android, it's unlikely you'll be able to use the software update mechanism to upload your own version on it (the update image is very likely signed by the manufacturer, though the Android OTA system should be documented enough for you to be able to wipe up your own server that will serve it your Android update image).

Going from there, there are several ways to achieve what you want, but first, you will have to find a way to flash the device with a new image.

You said you found a Serial line. What does the line display on boot? Is it using Uboot or another bootloader? Is there a way to interrupt the boot, and if so there may be a way to flash a new image.

The connector you found may be a JTAG connector.

Also, recto/verso picture of the board always help!

As for the image itself, the SDK that was leaked may be a good starting point. Try to download it and compile the version for the correspond processor in your machine. See if it works or where it fails, and go from there to debug.

Try to check if this processor is supported by the Linux mainline kernel. It looks like the manufacturer allows you to download the kernel sources used. This also would be a starting point to create your own image.

I'm not sure this helps, but I hope it does a bit!

Improve this answer
4
0

There's a guy which is reversing Mele X1000 Android TV box, which is Telechips TCC8935, he might have some information https://www.cnx-software.com/tag/telechips

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.