Got my Chromecast 4K with Google TV (codenamed sabrina) dongle rooted and bootloader unlocked!
Thanks to deepseek! because codex and claude were throwing a fit :)
Not sure if to post poc but in a nutshell:
- Customized GhostLock CVE from https://github.com/k-o-n-t-o-r/ghostlock-sabrina to get temporary root. I tried to use the original but setting SELinux to permissive mode live seems to make the temproot unreliable.
- Stealing init's SID worked though. Also needed to dirty up the heap with by churning the buddy allocator to make the temproot less temperamental
- Once temp root was up and creds were saved, i got to dump the NAND and tested R/W, seems to have worked somehow!
- Then reviewed the prior work at https://github.com/oddsolutions/sabrina-unlock and it seems that you can set uBoot's configuration without much fuss, just need to recalculate the checksum!
- Major gotcha/scare was when i first rewrote uboot's env from temproot, the stock recovery asked for a data reset (fair enough) but when it did, it reset the uboot env! Luckily it still booted to stock image, redid the uboot env write, but this time, i made deepseek write a script to send the device to fastboot mode, and do the factory reset immediately after, and not let recovery touch anything.
That finally enabled bootloader unlock, disabled dm-verity, et voila!
(Confirmed working with October 2025 security patch update, I dont have the August 2026 one on my device so can't confirm. Best if you keep your dongle's fw version as low as possible to enable the entrypoint).
Thanks to @log4j and tons of folks that cracked open their smart TV's for the inspiration! :D
Now this thing will live out its life free of adware junk!
Can probably port it to mainline linux if i got more time, tokens and headspace to do so 😅