My guess is that this will need a uBoot exploit. The hardware is very similar to the original ChromeCast (the main difference seems to be the use of the 88W8897 for WiFi/Bluetooth) so it's possible they're using the same Marvell fork of uBoot and the exploit that was used to root the ChromeCast could still work... Some links: https://fail0verflow.com/blog/2014/hubcap-chromecast-roby moyix - Off-Topic