No description, website, or topics provided.
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
datasheets Add RTL8188CTV datasheet Jun 26, 2018
imgs Add images Jun 26, 2018
rom
stock Add stock firmware update Jul 2, 2018
README.md Update README Jul 2, 2018

README.md

Rockcast

We're playing with cheap hardware again. This time it's this magnificent piece of DLNA/Miracast dongle which looks like a Chinesium clone of the Wecast C2.

Since the RK3036 SoC in this device seems to have relatively good open source kernel and toolchain support, it might be a nice target for custom firmware.

Hardware

PCB Images

front.jpg back.jpg

Dump

Use Flashrom from latest git master to enjoy significant speedup.

Dumping the flash via Bus Pirate:

$ flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=8M -c MX25L12835F/MX25L12845E/MX25L12865E -o log.txt -r rom.bin

The specific dump in this repo is no good for some off reasonm, see next section for a better image.

Stock Firmware

On boot device attemps to access http://120.25.100.187:2300/3036/anycast/ksctv/update.img to download a firmware update.

Update metadata and signature is fetched from http://120.25.100.187:2300/3036/anycast/ksctv/config.txt

Binwalking the image provides:

$ binwalk update.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
269948        0x41E7C         LZO compressed data
270273        0x41FC1         LZO compressed data
2999896       0x2DC658        xz compressed data
3461646       0x34D20E        Unix path: /proc/sys/kernel/domainname0l
3476206       0x350AEE        SHA256 hash constants, little endian
3692204       0x3856AC        SHA256 hash constants, little endian
4456448       0x440000        JFFS2 filesystem, little endian
5242880       0x500000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 11323710 bytes, 344 inodes, blocksize: 131072 bytes, created: 2018-01-14 00:50:49

DLNA

The device publishes a DLNA MediaRenderer profile at the following URL http://192.168.49.1:38400/deviceDescription/MediaRenderer

Notes

  • Booting with button pressed -> mask rom mode
  • Booting with SPI out pin 8 shorted to ground -> mask rom mode

Open Questions

  • What the fuck is going on with the storage? Why is the ROM dump so sparse?
  • Where are the UART pads / pins hiding?