Digging into Revolv

I got my hands on a red round brick and started tinkering.
First thing I did was use the info from DEF CON 23: Internet of Things: Hacking 14 Devices

Connected a USB to Serial converter I got with an Arduino Ethernet. The pins matched right up.
Using Putty opened the COM and set the baud to 115200

U-Boot 2011.09-00043-gdc52533-dirty (May 10 2014 - 07:22:00)

I2C:   ready
DRAM:  256 MiB
WARNING: Caches not enabled
Could not probe the EEPROM; something fundamentally wrong on the I2C bus.
NAND:  HW ECC Hamming Code selected
No NAND device found!!!
0 MiB
MMC:   OMAP SD/MMC: 0
Net:   cpsw
Hit any key to stop autoboot:  0
U-Boot# setenv optargs init=/bin/sh
U-Boot# boot
---------------------
sh-4.2# mount -t proc p /proc
sh-4.2# mount / -o remount,rw
[   76.961608] EXT4-fs (mmcblk0p5): re-mounted. Opts: discard
sh-4.2# passwd
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
sh-4.2# mount / -o remount,ro
[  263.693511] EXT4-fs (mmcblk0p5): re-mounted. Opts: discard
sh-4.2# sync

then restart
now before I get too far and brick the thing I am trying to figure out how to back up all the files from the eMMC that is soldered to the board to the thumb drive.
OLD Update Script: https://s3.amazonaws.com/firmware.revolv.com/hub-v3.0/1.4.17/upgrade.sh
OLD Firmware: https://s3.amazonaws.com/firmware.revolv.com/hub-v3.0/1.4.17/firmware.tar.gz
NEW Update Script: https://s3.amazonaws.com/firmware.revolv.com/hub-v3.0/1.4.20/upgrade.sh
NEW Firmware: https://s3.amazonaws.com/firmware.revolv.com/hub-v3.0/1.4.20/firmware.tar.gz

next im going to see if I can accomplish this, because thatw essentially what the revolv hub is a BBB with alot of radios.

U-Boot 2011.09-00043-gdc52533-dirty (May 10 2014 - 07:22:00)

I2C:   ready
DRAM:  256 MiB
WARNING: Caches not enabled
Could not probe the EEPROM; something fundamentally wrong on the I2C bus.
NAND:  HW ECC Hamming Code selected
No NAND device found!!!
0 MiB
MMC:   OMAP SD/MMC: 0
Net:   cpsw
Hit any key to stop autoboot:  0
mmc0(part 0) is current device
SD/MMC found on device 0
reading uEnv.txt

** Unable to read "uEnv.txt" from mmc 0:1 **
gpio: pin 59 (gpio 59) value is 1
Loading file "/boot/uImage" from mmc device 0:6 xxa6
3504256 bytes read
Loaded kernel from partition 6
## Booting kernel from Legacy Image at 80007fc0 ...
   Image Name:   Angstrom/3.2.42/beaglebone
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3504192 Bytes = 3.3 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

It already has java

root@revolvhub-002B55:~# java -version
java version "1.7.0_21"
Java(TM) SE Embedded Runtime Environment (build 1.7.0_21-b11, headless)
Java HotSpot(TM) Embedded Client VM (build 23.21-b01, mixed mode)
root@revolvhub-002B55:~#
1 Like

and I bricked it :frowning:

U-Boot 2011.09-00043-gdc52533-dirty (May 10 2014 - 07:22:00)

I2C:   ready
DRAM:  256 MiB
WARNING: Caches not enabled
Could not probe the EEPROM; something fundamentally wrong on the I2C bus.
NAND:  HW ECC Hamming Code selected
No NAND device found!!!
0 MiB
MMC:   OMAP SD/MMC: 0
Net:   cpsw
Hit any key to stop autoboot:  0
mmc0(part 0) is current device
SD/MMC found on device 0
reading uEnv.txt

** Unable to read "uEnv.txt" from mmc 0:1 **
gpio: pin 59 (gpio 59) value is 1
Loading file "/boot/uImage" from mmc device 0:5 xxa5
3504256 bytes read
Loaded kernel from partition 5
## Booting kernel from Legacy Image at 80007fc0 ...
   Image Name:   Angstrom/3.2.42/beaglebone
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3504192 Bytes = 3.3 MiB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.2.42 (qatest@builder) (gcc version 4.5.4 20120305 (prerelease) (GCC) ) #1 Sat May 10 04:32:54 UTC 2014
[    0.000000] CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=50c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: am335xevm
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] AM335X ES1.0 (neon )
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyO0,115200n8 init=/bin/sh root=/dev/mmcblk0p5 ro rootfstype=ext4 rootwait ip=none
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 256MB = 256MB total
[    0.000000] Memory: 253968k/253968k available, 8176k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xd0800000 - 0xff000000   ( 744 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     modules : 0xbf800000 - 0xc0000000   (   8 MB)
[    0.000000]       .text : 0xc0008000 - 0xc04c3de0   (4848 kB)
[    0.000000]       .init : 0xc04c4000 - 0xc04fd000   ( 228 kB)
[    0.000000]       .data : 0xc04fe000 - 0xc0555128   ( 349 kB)
[    0.000000]        .bss : 0xc055514c - 0xc05bfcdc   ( 427 kB)
[    0.000000] NR_IRQS:410 nr_irqs:410 410
[    0.000000] IRQ: Found an INTC at 0xfa200000 (revision 5.0) with 128 interrupts
[    0.000000] Total of 128 interrupts on 1 active controller
[    0.000000] OMAP clockevent source: GPTIMER2 at 24000000 Hz
[    0.000000] OMAP clocksource: GPTIMER1 at 32768 Hz
[    0.000000] sched_clock: 32 bits at 32kHz, resolution 30517ns, wraps every 131071999ms
[    0.000000] Console: colour dummy device 80x30
[    0.000183] Calibrating delay loop... 498.89 BogoMIPS (lpj=2494464)
[    0.058166] pid_max: default: 32768 minimum: 301
[    0.058349] Security Framework initialized
[    0.058410] Mount-cache hash table entries: 512
[    0.058837] Initializing cgroup subsys cpuacct
[    0.058898] Initializing cgroup subsys devices
[    0.058898] Initializing cgroup subsys freezer
[    0.058959] CPU: Testing write buffer coherency: ok
[    0.060119] devtmpfs: initialized
[    0.080505] omap_hwmod: gfx: failed to hardreset
[    0.097198] omap_hwmod: pruss: failed to hardreset
[    0.097808] print_constraints: dummy:
[    0.098083] NET: Registered protocol family 16
[    0.099395] OMAP GPIO hardware version 0.1
[    0.100677] omap_mux_init: Add partition: #1: core, flags: 0
[    0.102294]  omap_i2c.1: alias fck already exists
[    0.102722] hw-breakpoint: debug architecture 0x4 unsupported.
[    0.102905]  omap2_mcspi.1: alias fck already exists
[    0.103057]  omap2_mcspi.2: alias fck already exists
[    0.103240]  edma.0: alias fck already exists
[    0.103271]  edma.0: alias fck already exists
[    0.103302]  edma.0: alias fck already exists
[    0.103393] cape: pcm register
[    0.114166] bio: create slab <bio-0> at 0
[    0.115478] SCSI subsystem initialized
[    0.116485] usbcore: registered new interface driver usbfs
[    0.116638] usbcore: registered new interface driver hub
[    0.116821] usbcore: registered new device driver usb
[    0.116973] musb-ti81xx musb-ti81xx: musb0, board_mode=0x13, plat_mode=0x3
[    0.117126] musb-ti81xx musb-ti81xx: musb1, board_mode=0x13, plat_mode=0x1
[    0.128234] omap_i2c omap_i2c.1: bus 1 rev2.4.0 at 100 kHz
[    0.129516] Advanced Linux Sound Architecture Driver Version 1.0.24.
[    0.130157] Switching to clocksource gp timer
[    0.157714] musb-hdrc: version 6.0, ?dma?, otg (peripheral+host)
[    0.157928] musb-hdrc musb-hdrc.0: dma type: pio
[    0.158111] MUSB0 controller USBSS revision = 4ea20800
[    0.158630] musb-hdrc musb-hdrc.0: USB OTG mode controller at d081c000 using PIO, IRQ 18
[    0.158935] musb-hdrc musb-hdrc.1: dma type: pio
[    0.159118] MUSB1 controller USBSS revision = 4ea20800
[    0.159271] musb-hdrc musb-hdrc.1: MUSB HDRC host driver
[    0.159362] musb-hdrc musb-hdrc.1: new USB bus registered, assigned bus number 1
[    0.159515] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    0.159545] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    0.159576] usb usb1: Product: MUSB HDRC host driver
[    0.159576] usb usb1: Manufacturer: Linux 3.2.42 musb-hcd
[    0.159606] usb usb1: SerialNumber: musb-hdrc.1
[    0.160491] hub 1-0:1.0: USB hub found
[    0.160522] hub 1-0:1.0: 1 port detected
[    0.161071] musb-hdrc musb-hdrc.1: USB Host mode controller at d081e800 using PIO, IRQ 19
[    0.161529] NET: Registered protocol family 2
[    0.161743] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.162231] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[    0.162445] TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
[    0.162597] TCP: Hash tables configured (established 8192 bind 8192)
[    0.162597] TCP reno registered
[    0.162628] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.162658] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.162963] NET: Registered protocol family 1
[    0.163360] RPC: Registered named UNIX socket transport module.
[    0.163391] RPC: Registered udp transport module.
[    0.163391] RPC: Registered tcp transport module.
[    0.163421] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    0.165374] audit: initializing netlink socket (disabled)
[    0.165435] type=2000 audit(0.160:1): initialized
[    0.167022] VFS: Disk quotas dquot_6.5.2
[    0.167083] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[    0.168304] msgmni has been set to 496
[    0.169616] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.169616] io scheduler noop registered
[    0.169647] io scheduler deadline registered
[    0.169708] io scheduler cfq registered (default)
[    0.170959] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    0.172515] omap_uart.0: ttyO0 at MMIO 0x44e09000 (irq = 72) is a OMAP UART0
[    0.768707] console [ttyO0] enabled
[    0.773010] omap_uart.1: ttyO1 at MMIO 0x48022000 (irq = 73) is a OMAP UART1
[    0.780944] omap_uart.2: ttyO2 at MMIO 0x48024000 (irq = 74) is a OMAP UART2
[    0.788787] omap_uart.3: ttyO3 at MMIO 0x481a6000 (irq = 44) is a OMAP UART3
[    0.796691] omap_uart.4: ttyO4 at MMIO 0x481a8000 (irq = 45) is a OMAP UART4
[    0.804565] omap_uart.5: ttyO5 at MMIO 0x481aa000 (irq = 46) is a OMAP UART5
[    0.813781] brd: module loaded
[    0.821624] loop: module loaded
[    0.825012] at24 1-0051: 32768 byte 24c256 EEPROM, writable, 64 bytes/write
[    0.890716] No daughter card found
[    0.894348] at24 1-0050: 32768 byte 24c256 EEPROM, writable, 64 bytes/write
[    0.960723] AM335X: Setting up Mobiplug config
[    0.965209] The board is a AM335x Beaglebone.
[    0.969970] cape: emmc_bone_init
[    0.973724]  omap_hsmmc.0: alias fck already exists
[    0.979125]  omap_hsmmc.1: alias fck already exists
[    0.984497] AM335X: Reversing USB1 data polarity ----------->
[    0.990478] AM335X: Reverse USB1 data polarity DONE ----------->
[    0.996917] AM335X: initializing spi0
[    1.001129] AM335X: initializing spi1
[    1.008453] AM335X: Mobiplug config complete
[    1.013763] SCSI Media Changer driver v0.25
[    1.019195] usb 1-1: new high-speed USB device number 2 using musb-hdrc
[    1.026702] omap2-nand driver initializing
[    1.031127] OneNAND driver initializing
[    1.036132] CAN device driver interface
[    1.040191] CAN bus driver for Bosch D_CAN controller 1.0
[    1.046508] usbcore: registered new interface driver cdc_acm
[    1.052459] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[    1.060943] usbcore: registered new interface driver usblp
[    1.066772] usbcore: registered new interface driver cdc_wdm
[    1.072692] Initializing USB Mass Storage driver...
[    1.077941] usbcore: registered new interface driver usb-storage
[    1.084259] USB Mass Storage support registered.
[    1.089202] usbcore: registered new interface driver libusual
[    1.095916] mousedev: PS/2 mouse device common for all mice
[    1.102966] omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0
[    1.109710] omap_rtc: already running
[    1.113677] i2c /dev entries driver
[    1.117614] Linux media interface: v0.10
[    1.121856] Linux video capture interface: v2.00
[    1.127014] Driver for 1-wire Dallas network protocol.
[    1.133483] OMAP Watchdog Timer Rev 0x01: initial timeout 60 sec
[    1.140167] cpuidle: using governor ladder
[    1.144714] cpuidle: using governor menu
[    1.152526] usbcore: registered new interface driver usbhid
[    1.158416] usbhid: USB HID core driver
[    1.163421] usbcore: registered new interface driver snd-usb-audio
[    1.170928] ALSA device list:
[    1.174041]   No soundcards found.
[    1.178009] TCP cubic registered
[    1.181457] Initializing XFRM netlink socket
[    1.186004] NET: Registered protocol family 17
[    1.190734] NET: Registered protocol family 15
[    1.195434] can: controller area network core (rev 20090105 abi 8)
[    1.202056] NET: Registered protocol family 29
[    1.206726] can: raw protocol (rev 20090105)
[    1.211303] Registering the dns_resolver key type
[    1.216308] VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
[    1.224395] ThumbEE CPU extension supported.
[    1.228973] mux: Failed to setup hwmod io irq -22
[    1.234741] Power Management for AM33XX family
[    1.239624] Trying to load am335x-pm-firmware.bin (60 secs timeout)
[    1.246368] Copied the M3 firmware to UMEM
[    1.256134] registered taskstats version 1
[    1.261627] omap_rtc omap_rtc: setting system clock to 2000-01-01 00:08:38 UTC (946685318)
[    1.271331] Waiting for root device /dev/mmcblk0p5...
[    1.283355] usb 1-1: New USB device found, idVendor=058f, idProduct=6387
[    1.290435] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[    1.297973] usb 1-1: Product: Mass Storage
[    1.302307] usb 1-1: Manufacturer: Generic
[    1.306640] usb 1-1: SerialNumber: A5FECE8C
[    1.312316] scsi0 : usb-storage 1-1:1.0
[    1.321014] mmc0: queuing unknown CIS tuple 0x01 (3 bytes)
[    1.333984] mmc0: queuing unknown CIS tuple 0x1a (5 bytes)
[    1.342895] mmc0: queuing unknown CIS tuple 0x1b (8 bytes)
[    1.349304] mmc0: queuing unknown CIS tuple 0x14 (0 bytes)
[    1.357055] mmc0: queuing unknown CIS tuple 0x80 (1 bytes)
[    1.362915] mmc0: queuing unknown CIS tuple 0x81 (1 bytes)
[    1.368743] mmc0: queuing unknown CIS tuple 0x82 (1 bytes)
[    1.374572] mmc0: new high speed SDIO card at address 0001
[    1.459381] mmc1: new high speed MMC card at address 0001
[    1.465637] mmcblk0: mmc1:0001 MMC04G 3.57 GiB
[    1.470581] mmcblk0boot0: mmc1:0001 MMC04G partition 1 2.00 MiB
[    1.477081] mmcblk0boot1: mmc1:0001 MMC04G partition 2 2.00 MiB
[    1.491394]  mmcblk0: p1 p2 p3 p4 < p5 p6 p7 p8 >
[    1.500518]  mmcblk0boot1: unknown partition table
[    1.507507]  mmcblk0boot0: unknown partition table
[    1.615875] EXT4-fs (mmcblk0p5): mounted filesystem with ordered data mode. Opts: (null)
[    1.624542] VFS: Mounted root (ext4 filesystem) readonly on device 179:5.
[    1.632904] devtmpfs: mounted
[    1.636474] Freeing init memory: 228K
 `sh: cannot set terminal process group (-1): Inappropriate ioctl for device
sh: no job control in this shell
sh-4.2#`  [    2.312438] scsi 0:0:0:0: Direct-Access     Generic  Flash Disk       8.07 PQ: 0 ANSI: 2
[    2.323455] sd 0:0:0:0: Attached scsi generic sg0 type 0
[    2.330261] sd 0:0:0:0: [sda] 1978368 512-byte logical blocks: (1.01 GB/966 MiB)
[    2.338317] sd 0:0:0:0: [sda] Write Protect is off
[    2.343658] sd 0:0:0:0: [sda] No Caching mode page present
[    2.349426] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    2.357971] sd 0:0:0:0: [sda] No Caching mode page present
[    2.363800] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    2.454071]  sda: sda1
[    2.458465] sd 0:0:0:0: [sda] No Caching mode page present
[    2.464294] sd 0:0:0:0: [sda] Assuming drive cache: write through
[    2.470733] sd 0:0:0:0: [sda] Attached SCSI removable disk

Or at least I don’t know how to recover from this…

Too bad. I hope it didn’t cost you too much.

No I think it was 34 on amazon. I can prolly recover I didn’t lose any data I just don’t know Linux well enough yet.

Wow, I didn’t know they still sold them. That would be a bargain if OH would be possible then. Board plus radios for $35.

They are used by 3rd party people but still a deal. http://a.co/hD5bvWk