Google Home Autopsy

I had a google home die the other week.  The internet claimed it could have been a bad OTA flash and that I should get support to replace it even out of warranty.  I called and found out that (at least my rep) would extend the warranty out to two years, but not three which I would need.  I also found out that there aren’t any warranty void stickers inside  or anything so I would have taken one of my google homes that was in warranty and swapped out the misbehaving motherboard but that seemed overly complicated and I thought I maybe had a solution anyway.

20200218_192702

One thing I did remember was that the google home has a ‘hidden’ usb micro port that is for ‘service’.  After some research it seems that no one has hacked this thing using that port, but there are reports that you can use a chromecast ultra power supply on it and give it a wired network connection (which means it’s a usb on the go port).   I took a look about the chip inside and saw that it runs uboot for a bootloader and that I might be able to dump the onboard flash via that rather than desoldering a bga.  Looking at the ifixit teardown there’s two pads right next to the processor, those are probably serial so off I go.

20200218_192706

This is a useful page explaining how to determine the baud rate of an rs232 connection from the shortest pulse, I have duplicated the table here.

Time Baud Rate
3333µs (3.3ms) 300
833µs 1200
416µs 2400
208µs 4800
104µs 9600
69µs 14400
52µs 19200
34µs 28800
26µs 38400
17.3µs 57600
8µs 115200
4.34µs 230400

We were running at 115200, a very common baud rate.  I hooked up to the pins and found that the one closer to the center of the board transmits (the other one presumably is supposed to receive but it wouldn’t listen to me) and they’re a full 5v serial port (I was expecting something dumb like 1.8v).

The first boot capture saved is here.  it all seems to be going well until:

{line: 1131} tz_en_start: 0x120000 tz_en_end: 0x360000 tz_en_size: 0x240000
Uncorrectable error @ 0x00260000
Read failed @ 0x00260000
verify 0k:0x402c0de, 1k:0xd6749664, 2k:0xccd3d16e
verify image 0, size=1237488, waitcount=49
tz_loader: image4 verified.
tz_en image load verify success
verify 0k:0x201c237, 1k:0xf01c0de, 2k:0x0
verify image e0000301, size=0, waitcount=1
{line: 1158} bl_en_start: 0x5a0000 bl_en_end: 0x640000
Uncorrectable error @ 0x005c0000
Read failed @ 0x005c0000
verify 0k:0x400c0de, 1k:0xe16f5f14, 2k:0xe92d43f8
verify image 0, size=120408, waitcount=4

What’s a few uncorrectable errors between friends? There was also a problem with:

[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
block 1021: !!! UNRANDOMIZED !!! (page=0)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
block 1022: !!! UNRANDOMIZED !!! (page=0)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)
[is_chunk_blank:455] not blank! data_len=2080, ecc=48, zero_bits=49
[mv_nand_read_large_page:2232] ECC uncorrectable error (page=0xlx)

I’m not sure if this is normal because I’ve only opened a broken one but I assume it’s not.  I also tried to boot it while holding the mute button, that ended the boot cycle with :

Detected button press — booting from USB
USB: Register 10011 NbrPorts 1
USB EHCI 1.00
scanning bus for devices… 1 USB Device(s) found
0 Storage Device(s) found
ERROR: No USB storage device detected
Booting from NAND failed, booting from USB….!
USB: Register 10011 NbrPorts 1
USB EHCI 1.00
scanning bus for devices… 1 USB Device(s) found
0 Storage Device(s) found
ERROR: No USB storage device detected
FATAL ERROR! There is no bootable image on this machine!
tbdzz—- Img_Ld_And_Start error! Spinning now!

So it looks like you can boot this from a flash drive which is cool.  if I were more skilled I could probably dump a good one and make a bootable image out of it to boot the bad one but alas I’m not.  this is where I box it up and wait until someone else comes up with a solution for this.

3 Responses to “Google Home Autopsy”

  1. dmesg Says:

    Hey there, I also have a broken Google Home, in this case a GHome Mini.

    I found this Google Drive https://drive.google.com/drive/folders/1dSQB86KaWMggf0ngg6aFxnZdhHhuDv1L contains source codes for stuff running on Google Home, including u-boot.

  2. dmesg Says:

    My Google Home also died, there’s a thread on Reddit which I explore the available ota images, kernel and stuff

    Please let me know if you can flash any of these to Google home :))))

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s


%d bloggers like this: