Jasper Devreker Saves an Unwanted Android TV Set-Top Box From the Scrapheap with a Linux Conversion

Jasper Devreker, of Ghent University's student association for computer science, has saved an unwanted and locked-down set-top box from the e-waste scrapheap — by reversibly converting it into a Linux desktop.

"Our mobile Internet Service Provider (ISP) has a bundle where they provide a 4G modem for internet access, and a separate TV set-top box that can be used to watch their TV content or to watch streaming services," Devreker explains. "This device was sent to us as part of the bundle, but at Zeus, we don’t really have a use for it: we don’t really watch television in our space. What we do have a need for, however, are low-power computers that can run Linux."

While the hardware inside the bundled box is, effectively, a single-board computer (SBC), its functionality is highly locked down — running a specific Android TV port created for the ISP and only capable of accessing its own services. Devreker, then, set about unlocking the hardware's true potential — but with the proviso that all experimentation and conversion had to be reversible and non-destructive, just in case the ISP asks for the box back.

Desoldering the eMMC storage chip, then, wasn't an option. Attempts to find the right traces on the PCB to access the storage also failed, but further investigation unveiled an unlabelled four-pin header — which, handily, turned out to be a debug port. "We then soldered wires (it’s not pretty or clean, but it works) to the port and used a cheap logic analyzer to see what is happening on the IO pins," Devreker explains.

"These signals look like serial, so we used the serial protocol decoder to decode the signal, and indeed, it is serial at 115200 baud. From this, it follows that the other pin is probably the RX (receive) pin: it's constantly high because we don't send anything yet. We detached the logic analyser from the device and then connected a USB to serial adapter, taking care of connecting the TX of the adapter to RX on the board and vice versa."

The result is a printout of the boot process, which could be interrupted to provide access to uBoot — allowing the eMMC storage to be dumped to a USB stick. Analysis of the dump revealed more details about the hardware, including the exact system-on-chip in use — for which, handily, a Linux distribution was already available, though one that required a chained bootloader in order to load.

A patch to the secondary bootloader later, and Devreker's set-top box was up and running as a generic Linux machine — complete with HDMI video output and Ethernet network connectivity. "We didn’t get the onboard Wi-Fi chipset to work yet, but that’s fine since this box will most probably be used with Ethernet anyway," Devreker explains. In keeping with the original goal, he adds, "the original Android install still boots when the special USB stick is not inserted."

Devreker's full write-up is available on the Zeus WPI blog.