HackoogleMini

Software-only research project to gain shell access to a Google Home Mini gen 1 (H0A) and replace its Google Assistant agent with a local LLM that can call arbitrary MCP servers — zero hardware modifications. The device runs Chrome/92.0.4515.0 (a pre-release Chromium build that never received the CVE-2021-30563 V8 patch), making the Cast receiver a live exploit surface reachable via Cast registry DNS MITM. Toolchain: REA, Ghidra 12 headless, Python BLE/Cast scripts, Claude Code.

Attack surface

┌─────────────────────────────────────────────────────────────────────────────────┐
│  Google Home Mini gen 1 (H0A)  ·  Marvell Armada 1500  ·  fw 3.78.540761       │
│                                                                                  │
│  cast_shell ── Chrome/92.0.4515.0 ── CVE-2021-30563 (V8 type confusion) ───────►│ SHELL
│      │                                                                           │
│      └── queries clients3.google.com ──► DNS MITM ──► fake Cast registry        │
│                                              │                                  │
│  YAFFS2 cache-partition exploit ─────────────┤ hardware path (NAND dump)        │
│  Magellan SQLite RCE (CVE-2018-20346) ────────┘ revisiting — mfg 2018-09-05     │
└─────────────────────────────────────────────────────────────────────────────────┘

Status

Short version: Chrome/92 on the Cast receiver is unpatched for CVE-2021-30563. The attack chain is: DNS rewrite on AdGuard → clients3.google.com resolves to our MITM server → cast_shell fetches and executes our probe page → V8 exploit → shell. NAND + YAFFS2 is the hardware fallback.

Attack chains

Chain A — Chrome n-day via Cast registry MITM (active)

1. AdGuard DNS rewrite: clients3.google.com → <mitm-ip>
2. Freebox: port-forward WAN:443 → pi:443
3. pi5 reverse tunnel: 443 → attacker:4443 (mitm_https_server.py)
4. Mini queries Cast registry → fake JSON: {"url": "<tunnel>/probe.html"}
5. cast_shell fetches probe.html (valid TLS via Cloudflare tunnel)
6. probe.html: WebSQL/Magellan probe + CVE-2021-30563 V8 shellcode
7. Exfil via POST to Cloudflare tunnel → shell callback

Scripts: reconstruction/exploit/magellan/mitm_https_server.py · scripts/mitm-attack.sh

Chain B — Magellan SQLite RCE (revisiting)

Device manufactured 2018-09-05 (evidence E3). The Magellan vulnerability affects SQLite ≤ 3.26.0 — reachable from JavaScript via WebSQL in Chrome. The firmware shipped before the December 2018 disclosure; patch status in this fw build is under re-investigation.

Scripts: reconstruction/exploit/magellan/probe.html · scripts/magellan-full.sh

Chain C — YAFFS2 cache-partition exploit (hardware)

The published YAFFS2 exploit requires a NAND dump. No UART/JTAG on gen 1 H0A — board access means desoldering the NAND chip. Full toolchain is ready; blocked only on acquiring the dump.

Scripts: scripts/nand-decode.py · scripts/fw-analyze.sh · scripts/ghidra-headless.sh

Quick start

# one-time setup
scripts/make-venv.sh

# LAN + BLE recon → evidence/
scripts/recon.sh

# join the Mini's open setup AP (while unprovisioned) + dump API
scripts/join-setup-ap.sh --api

# provision the Mini onto your network
scripts/provision-wifi.py --ssid <ssid> --pass <psk>

# set up lab AP: own the Mini's gateway (needs hostapd/dnsmasq + sudo)
scripts/lab-ap.sh up

# MITM: ARP spoof + DNS hijack + Cast LAUNCH (needs lab AP or DNS access)
scripts/mitm-attack.sh

# NAND tooling (once you have a dump)
scripts/nand-decode.py selftest
scripts/nand-decode.py layout target/<dump>.bin

. scripts/rea-env.sh first to call rea directly.

Scripts

Seven traps already solved

Do not re-learn these.

1. Rotating BLE address — the Mini rotates its random address. Resolve by device name (GoogleHome*, service 0xfea0) each run; never hard-code a MAC.
2. Stale BlueZ handles — Connected: yes on a stale handle returns empty reads. Canary-check the device-name characteristic (14 bytes) before trusting a dump.
3. busctl decimal output — ay byte arrays print in decimal, not hex. Parsing as hex corrupts every value.
4. 512-byte BLE cap — three setup payloads are hard-capped at 512 bytes, notify is unsupported, and offset reads past 512 return nothing. scripts/decode_gatt.py partial-inflates the truncated prefix. The setup AP returns the full payload over HTTPS — use that instead.
5. Silent Mini after failed attaches — after repeated failed BLE connections the device can go silent for minutes. Power-cycle rather than assuming it vanished.
6. No UART/JTAG on gen 1 H0A — pads are under BGA, micro-USB is power-only. Board access = NAND desoldering.
7. Magellan: check the ship date, not just the firmware version — the fw version doesn't tell you which SQLite it links. The mfg date (2018-09-05) and the fw build date constrain the SQLite version more reliably than the fw string.

Layout

target/         artifacts under investigation (not in git — large binaries)
evidence/       REA / firmware / recon output, one JSON file per command
notes/          findings.md · architecture.md · firmware-plan.md · ondevice-plan.md
reconstruction/ exploit code (clean-room — never copied from decompiled output)
  └── exploit/
      └── magellan/
          ├── probe.html          JavaScript probe: WebSQL/Magellan + CVE-2021-30563
          └── mitm_https_server.py  fake Cast registry + probe delivery over TLS
scripts/        recon + attack + analysis tooling (see table above)
work/           scratch: extracted regions, Ghidra projects (not in git)

Read in this order

1. notes/ondevice-plan.md — can the device run our code, what to replace, what it already speaks
2. notes/findings.md — observed evidence with links
3. notes/architecture.md — what "replace the agent" means and the three options
4. notes/firmware-plan.md — how to get firmware and what to analyze

References

• IOActive — Hacking Google Home — YAFFS2 cache-partition exploit (hardware path)
• Tencent Xuanwu — Magellan — SQLite WebSQL RCE
• CVE-2021-30563 — Chrome V8 type confusion (Chrome/92 pre-release, unpatched on this fw)
• Google Cast SDK — Cast V2 protocol / CC1AD845 Default Media Receiver

⚠️ Disclaimer — educational security research only. Do not run against devices you do not own.