Skip to content
master
Switch branches/tags
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
rom
 
 
 
 
 
 

Rockcast

We're playing with cheap hardware again. This time it's this magnificent piece of DLNA/Miracast dongle which looks like a Chinesium clone of the Wecast C2.

Since the RK3036 SoC in this device seems to have relatively good open source kernel and toolchain support, it might be a nice target for custom firmware.

Hardware

PCB Images

front.jpg back.jpg

Dump

Use Flashrom from latest git master to enjoy significant speedup.

Dumping the flash via Bus Pirate:

$ flashrom -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=8M -c MX25L12835F/MX25L12845E/MX25L12865E -o log.txt -r rom.bin

The specific dump in this repo is no good for some off reasonm, see next section for a better image.

Stock Firmware

On boot device attemps to access http://120.25.100.187:2300/3036/anycast/ksctv/update.img to download a firmware update.

Update metadata and signature is fetched from http://120.25.100.187:2300/3036/anycast/ksctv/config.txt

Binwalking the image provides:

$ binwalk update.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
269948        0x41E7C         LZO compressed data
270273        0x41FC1         LZO compressed data
2999896       0x2DC658        xz compressed data
3461646       0x34D20E        Unix path: /proc/sys/kernel/domainname0l
3476206       0x350AEE        SHA256 hash constants, little endian
3692204       0x3856AC        SHA256 hash constants, little endian
4456448       0x440000        JFFS2 filesystem, little endian
5242880       0x500000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 11323710 bytes, 344 inodes, blocksize: 131072 bytes, created: 2018-01-14 00:50:49

DLNA

The device publishes a DLNA MediaRenderer profile at the following URL http://192.168.49.1:38400/deviceDescription/MediaRenderer

Notes

  • Booting with button pressed -> mask rom mode
  • Booting with SPI out pin 8 shorted to ground -> mask rom mode

Open Questions

  • What the fuck is going on with the storage? Why is the ROM dump so sparse?
  • Where are the UART pads / pins hiding?

About

Rockcast HDMI Teardown

Resources

Releases

No releases published

Packages

No packages published