Root via NAND short

Rooting your Hub

Credit: https://www.exploitee.rs/index.php/Wink_Hub

• Take apart the wink hub and solder in a header for the UART.
• Connect the UART pins to a 3.3V Serial to USB adapter (I used a FDTI adapter).
• Plug in the adapter to your computer and bring up a terminal.
• Ground pin 29 of the NAND flash chip to GND once UBOOT starts to load the kernel
• Booting the kernel will fail and you will be left at a prompt =>
• Enter the following commands

setenv bootdelay 1
saveenv
setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh';
nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

• You will be left at a root shell prompt / #
• Edit /etc/inittab and uncomment the line ttyAM0::respawn:/sbin/getty -L ttyAM0 115200 vt100 #GENERIC_SERIAL
• Run passwd and set a new root password
• Run sync
• Reboot your wink, a login prompt should come up automatically

Enabling ssh

• Run touch /database/ENABLE_SSH
• Edit /etc/default/dropbear and change DROPBEAR_ARGS=-sg to DROPBEAR_ARGS=
• Start ssh with /etc/init.d/S50dropbear restart

Disabling automatic updates and cloud API

Add the following to /etc/hosts:

127.0.0.1        hub-api.winkapp.com
127.0.0.1        hub-updates.winkapp.com
127.0.0.1        wink-hub-images.s3.amazonaws.com