exploiteers / nestdfuattack

Packages to attack the Google Nest's DFU mode.

Nest DFU Attack

██████ ████████╗██╗ ██╗██╗ ██╗ █████╗ ██████╗██╗ ██╗███████╗██████╗ ██╔════╝╚══██╔══╝██║ ██║██║ ██║██╔══██╗██╔════╝██║ ██╔╝██╔════╝██╔══██╗ ██║ ███╗ ██║ ██║ ██║███████║███████║██║ █████╔╝ █████╗ ██████╔╝ ██║ ██║ ██║ ╚██╗ ██╔╝██╔══██║██╔══██║██║ ██╔═██╗ ██╔══╝ ██╔══██╗ ╚██████╔╝ ██║ ╚████╔╝ ██║ ██║██║ ██║╚██████╗██║ ██╗███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝

This package contains everything needed to build the Nest DFU Attack.

Build Instructions

Downloading the proper toolchain and building the kernel, x-loader and u-boot images have been simplified to a simple bash script.

• ./build.sh

Build environment up to date has been (x86) Ubuntu 12.04

Attack Instructions

Attack can be trigger from the "Release" directory by calling the appropriate attack script.

• For Linux:

  ./NestAttack-Linux.sh

Troubleshooting

A log of your build process can be found in GTVHacker-build.log and a log of the attack can be found in GTVHacker-attack.log. You can receive assistance by us at one of the following places

• Wiki - GTVHacker Wiki
• Forums - GTVHacker Forum
• Blog - GTVHacker Blog

You can also chat with us on IRC at irc.Freenode.net #GTVHacker

nestdfuattack's Issues

Build Script Issues

Good news first. I am able to successfully build on Ubuntu 13.04.

I did, however, run into a few issues with the build script.

echoing out the wget progress for the Nest toolchain might be a good idea perhaps?
On my rather slow connection it takes a while and gives the impression that the script is hanging. Something like:
wget http://files.chumby.com/toolchain/arm-2008q3-72-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2 2>&3
would do the trick, I think, though the output could be cleaned up with some grep or awk. curl also makes this easier but wget is nice too : )

It might also be worth doing a
if [ ! -f arm-2008q3-72-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2]
as the script might have a bit of trouble recovering from incomplete wgets on subsequent runs and this would prevent the need to download an 80.5M file every time we try to build, assuming the rm gets commented out. Either way is cool really, just a thought.

Setting of the PATH environmental variable failed for me, though adding an export resolved the issue.
Even though the path to the toolchain was in $PATH, I kept getting arm-none-linux-gnueabi-gcc (or whatever) not found errors.
I solved this by storing the path to the toolchain in a local variable and passing it to the relevant make commands. i.e. -
toolchain_path=$(pwd)/arm-2008q3/bin/arm-none-linux-gnueabi-
make ARCH=arm CROSS_COMPILE=$toolchain_path distclean

Finally, I had buckets of permissions issues. sudo fixed my problems but I understand that it might not be a good idea or even possible to use sudo make on many systems.
Perhaps running a permissions check or chown recursively over the directory structure would be beneficial?

Admittedly, there are probably better ways to solve some of these issues than the ones I mentioned, but the quick and dirty fixes got the job done for me.

Fantastic work guys.

Will it work on nest g3 with latest firmware?

Just got my new NEST theromstat g3 with latest firmware several days ago.
I would like to know if this tool works ? and is it possible for me to revert back to the original firmware after root ?

Thanks,

Shawn

root file system not getting updated

Hi,

Tried once and it worked. I made some modification on the device (etc/init.d). After that device is not booting up as well as tried to run NestAttachLinux.sh again. But it looks like it only flash bootloaders and linux not file system.

could you please let us know how to update filesystem as well?

omap3_usbload program fails.

Ran NestAttact-linux.sh. It fails to upload the binaries.

Not able to run omap3_usbload program. It fails in usb_set_configuration or usb_write calls. My linux version is 64bit. compiled omap3_usbload for 64bit machine. Even tried with 32 bit libraries.

Any pointer would be great.

Nest 3rd Gen Support

Any word on whether or now this exploit works on the 3rd generation Nest Thermostats? Thanks.

Nest Protect (2nd gen)

Hiya - Nice work. Any idea if this will work with the second generation Nest Protect? Thanks!