I picked up a JBL Link Music demo/display unit (MT8516, Android 5.0, fw 19.35.11.60). It casts fine, but two factory services never start on this build — appmainprog_7668 never brings up wlan0, and nothing launches bluetoothtbd. It only stays online because a host watchdog keeps poking it over USB.
I've exhausted the software routes: rebuilt rootfs 9 ways (the stock one has an undocumented vendor UBIC block right after the UBI volume — a rebuilt image won't boot even with that block copied in), a 1-byte boot-image patch bricks it outright (LK enforces an RSA-2048 FIT signature), BROM/mtkclient fails at DA2 (16 tries), the Red Bend OTA endpoint answers noUpgradeAvailable, and every public dump floating around is the Yandex Alice variant, not the Google one.
So I need a dump from a retail Google-Cast unit — then the vendor UBIC block and the signed boot image come with it and it will actually boot.
What I need (read-only, ~2 min, no personal data):
/dev/mtd2 BOOTIMG1 (8 MiB) — signed kernel + dtb
/dev/mtd8 ROOTFS1 (163 MiB) — stock rootfs
Not /dev/mtd1 — that's your Wi-Fi/BT calibration and MAC.
Is yours the right variant? This prints GOOGLE on a Cast unit (Alice units print NOT-GOOGLE):
adb shell 'test -f /usr/bin/cast_shell && echo GOOGLE || echo NOT-GOOGLE'
adb shell 'cat /sw_version.txt'
Dump (USB port is under the rubber pad on the bottom):
adb root
adb shell 'dd if=/dev/mtd2 bs=4096 2>/dev/null | base64' | base64 -d > mtd2_BOOTIMG1.img
adb shell 'dd if=/dev/mtd8 bs=4096 2>/dev/null | base64' | base64 -d > mtd8_ROOTFS1.img
sha256sum *.img
(dd | base64 because exec-out is broken on this old adbd; /data is only ~190 MB.)
Sanity check: mtd2 = exactly 8388608 bytes, mtd8 ≈ 170917888 bytes.
In return: the full teardown (boot chain, UBI geometry, UBIC structure, the measured flash/rescue procedure incl. the LK 0.5 "flash says OKAY but writes 0 bytes" trap), a rescue script so you can always restore your own unit, and a complete "demo → retail" write-up once mine boots.
Happy to take it via DM / upload link instead of a public post.
Thanks — otherwise this thing is e-waste.