Hacking the Google Nest Hub

1st Official Post

    So, i hope someone can help me with my project, and that it belongs here enough, or else i can kiss my plans goodbye...

    A while ago i bought a Google Nest Hub (1st gen) to run my own software/dashboard. At first i tried to 'Cast' it as webpage to the device, but that is not fully stable. Especially now that they updated the Hub to run Fuchsia OS.

    So, my plan is to OR alter the Google firmware to run my own stuff on top of Fuchsia. Maybe create my own Flutter app or something. OR build linux from source, which is available for the S905D2 u200, which is the CPU of the Nest Hub. The latter gives me more control but i would have to get all hardware running in linux.

    Both options give me some problems though:

    • The hub has a USB port under the foot. If you press both volume buttons while booting, you get the Amlogic Worldcup device where you can talk to it with the Amlogic burn tool. You can flash firmware here or even dump firmware from it. Problem is: Google password protected this so you first have to upload a password.bin file before you can use the tool. Something that i presume is not possible to bruteforce...
    • When you push one of the volume buttons while booting, you boot to Fastboot mode. Hey, that's familliar. So i tried some commands. fastboot unlock, does not work. flashing an own rom, not allowed. Flashing my own recovery image is allowed and completes succesfully. But, while trying to boot to recovery it sais: "Hash of data does not match digest in descriptor.". So it verifies the image which it cannot do.
    • The other volume button boots to the recovery image, which is a google's own thing where you can reset the device to factory defaults if you want..

    The pcb viewed from the backside of the device. Notice the two wires next to the pink heat gum stuff. That's my RX and TX(?). Two pins next to each other seemed like a logical attempt.

    So i teared the device down, got to the PCB and found a RX/TX port. At least, i noticed that i got uart data when connecting to it. But, i can only read, it does not respond to keyboard presses. I don't know if the other pin is just no TX pin or that there is no software that will respond to keypresses.

    My question, what else can i try, or did Google just lock it's hard-/software very well? Of course i could chip-off the NAND chip, but then reflowing it on the device after altering the NAND is almost impossible, especially if you have to do it a lot of times... What else can i do?

    • Official Post

    The Nest requires signed firmware and you don't have Google's signing keys, so you can build kernel, u-boot and everything needed, but you will not be able to reimage it to run what you built. There are lots of cheap S905X2 devices with better connectivity and factory boot firmware that is easily persuaded to run modern Linux. If you also want to run upstream u-boot (on Amlogic hardware) you need the signing FIPs for Amlogic boot firmware. This is simple with SBC devices which will provide full sources. It is less simple with tvbox devices which often use cheap bottom bin (lower quality) RAM chips which need tweaked RAM timing data to work; which means you typically need the specific boot FIPs (tweaked for the batch of RAM used) to get successful boot.