Rooting Toon (or boxx)

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TheHogNL, Toonz

TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

Daniel wrote: Is there a description how to change the password?
The seller could have 'rooted' it with an empty password, true. But for SSH you need a password to be set. Only if you logon via serial console you could login without password.

Now you need to go to the serial login, or just run the auto rooting script again which will set a password for you.
Member of the Toon Software Collective
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

Hey guys,

I am trying to root my Toon U-Boot 2010.09-R8 (Dec 03 2012 - 12:50:30) Toon SN 15xxx. When I boot Toon I can see console output but I cannot enter any commands. They simply do not show up.

I have managed to short pin 8/9 of the nand chip wich gives me acces to uboot, but I still cannot typ. I use putty over serial 115200 8N1.

I have not checked the TX wire for continuity yet, will do that this evening.

Any other tips or suggestions on what to check?

btw great resource on hacken Toon!
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

Are you sure you are using a 3.3V TTL/serial port? And yes test for continunity.

Your R8 boot password is never shown. But if you also don't see any output when already in uboot (using the pin shortining) it is pretty sure that your TX is not good.
Member of the Toon Software Collective
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

I am using this one https://www.tinytronics.nl/shop/nl/comm ... rt-adapter

Continuity checked and OK.

Really weird, must be somthing simple and stupid, like me :-)
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

And you are sure you are using the correct pins?
Also another user had the same problems some weeks ago. Haven't seen him back with an answer: memberlist.php?mode=viewprofile&u=13156

Also your adapter has 3.3v 5v selection: 3.3V of 5V TTL spanningen (kan men instellen met een jumper)
Make sure you are on 3.3v
Member of the Toon Software Collective
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

Yep, it is set to 3.3V

I have 3 wires connected. GND-GND TX-RX and RX-TX.

Serial side pins 2-3-6 connected to 11-13-14 @ Toon. When pressing a key the tx led lights up on the adapter. So that works I guess. I added the console output. I now disconnected pin 11 to see if it makes any difference in the console output, but no change as expected.


U-Boot 2010.09-R8 (Dec 03 2012 - 12:50:30)

CPU: Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM: 128 MiB
NAND: 128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In: serial
Out: serial
Err: serial
Display-bmp: 800 x 480 with 16777216 colors
Net: FEC
Warning: FEC MAC addresses don't match:
Address in SROM is 00:00:20:03:00:00
Address in environment is 00:0f:11:04:c3:09


Enter password - autoboot in 2 sec...

NAND read: device 0 offset 0x300000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
Image Name: Linux-2.6.36-R10-h28
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1944236 Bytes = 1.9 MiB
Load Address: a0008000
Entry Point: a0008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h28 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Fri Sep 28 15:51:09 CEST 2018
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffa00000 - 0xffe00000 ( 4 MB)
vmalloc : 0xc8800000 - 0xf4000000 ( 696 MB)
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0022000 ( 104 kB)
.text : 0xc0022000 - 0xc0367000 (3348 kB)
.data : 0xc037e000 - 0xc03a17a0 ( 142 kB)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TM070RDH11
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: max. sequence number: 335678
UBI: attached mtd4 to ubi0
UBI: MTD device name: "rootfs"
UBI: MTD device size: 119 MiB
UBI: number of good PEBs: 952
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1151/352
UBI: image sequence number: 671300328
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2019-04-03 18:14:07 UTC (1554315247)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size: 117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root: 0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
INIT: version 2.86 booting
imx-fb imx-fb.0: PreserveUBootFramebuffer(4): xres=800, yres=480 [do _update_lcdc]
(print_boot_msg)
Please wait: booting... (print_boot_msg)
* Kernel 2.6.36-R10-h28 (print_boot_msg)
* Firmware qb2/uni/5.0.4-1286-0 (print_boot_msg)
* Hostname eneco-001-145229 (print_boot_msg)
usbcore: registered new interface driver r871x_usb_drv
usbcore: registered new interface driver rt2870
Loading iptables settings: iptables.
(print_boot_msg)
Configuring network interfaces... (print_boot_msg)
Configuring network interfaces...
Running 'ifup -a' in the foreground (ifup-fg)
ifup: interface lo already configured
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
udhcpc: started, v1.27.2
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending discover
Lease failing, starting in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-145229
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.27.2
udhcpc: no lease, failing
* Wired (eth0) 00:0f:11:04:c3:09 [No IP from DHCP Server] (print_boot_msg)
udhcpc: sending discover
Setting up IP spoofing protection: rp_filter.
INIT: Entering runlevel: 5
Starting syslogd/klogd: done
HCBv2 apps started via runlevels, performing 'addstartables && reload && init 5 or 5'.
HCBv2 adding: comm eventmgr kpi pwrusage scsync smartplug thermstat usermsg weather bxtproxy config log rrd watchdog hue p1 zwave lighttpd.
HCBv2 startables unchanged, not writing /etc/inittab.
udhcpc: sending discover
udhcpc: sending discover
Lease failing, already running in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-145229
udhcpc: no lease, forking to background
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

Weird. That other user also had a ftdi chip. But can't understand why this should be any problem.
You didn't buy this toon from him by any chance? :D :D
Member of the Toon Software Collective
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

TheHogNL wrote:Weird. That other user also had a ftdi chip. But can't understand why this should be any problem.
You didn't buy this toon from him by any chance? :D :D
Hahaha, I don't know. Not from this forum anyway.

I measured 3.3V on Tx and Rx so that's working fine.

added picture of the "setup" there are no shorts, I made sure of that.

https://imgur.com/x01s2Ny
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

Your boot message: Address in environment is 00:0f:11:04:c3:09

Check the boot message from his toon: viewtopic.php?f=101&t=11999&start=270#p90088

Also check his picture: viewtopic.php?f=101&t=11999&start=270#p90089
Looks the same maybe? MAC address is the same :-)
Member of the Toon Software Collective
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

Potverdorie ja!

Bought it from marktplaats picked it up locally. I think the previous owner screwed up, than sold it to me. Without mentioning this offcourse.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Rooting Toon (or boxx)

Post by TheHogNL »

Yes that is clear. MAC address of the builtin LAN interface is like a thumbprint.

I'll send you an email to see if there is another way I can help you.
Member of the Toon Software Collective
Daniel
Member
Member
Posts: 70
Joined: Fri Mar 15, 2019 4:50 pm

Re: Rooting Toon (or boxx)

Post by Daniel »

I just reroot the toon and set my one password, I set the time chrony to other server and now time is sinc.
Instal the toonstore ,only when I press green + at the app and bijwerken nothing happened only got back to home screen.
It’s on firmware 4.9.23
Dit I miss some things?
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

My Toon is back. And it is working! Many thanks to TheHogNL.

Still have a question about it though. I am trying to enable z-wave to explore the Toons possibilities.

Basically I run in the the same problem as Plumifrons on
viewtopic.php?t=11999&p=90319

Password has already been set and I enabled the required options in Toon: Local access is enabled and so is the additional z-wave option.

But I get a 404 when accessing http://192.168.188.73/qmf/www/
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

/qmf/www is the webroot. No need to state it in the URL bar of your browser, the IP address should do, possibly extended with a port number (10080 or 7080 for older firmwares).
rgrs
Starting Member
Starting Member
Posts: 10
Joined: Wed Apr 03, 2019 1:57 pm

Re: Rooting Toon (or boxx)

Post by rgrs »

marcelr wrote:/qmf/www is the webroot. No need to state it in the URL bar of your browser, the IP address should do, possibly extended with a port number (10080 or 7080 for older firmwares).
I found the correct URL http://192.168.188.73/hdrv_zwave/index.html

Inclusion of Toon to my z-wave network is not working, but I can add the P1 meter.

I am running a raspberry pi3 with razberry and IP Symcon as domotica software. I do not have razberry software installed. I can add any z-wave device (9 including the P1 smartmeter)
But not Toon. It should be possible to ad it as a z-wave node not as a controller.

When I push sendnodeinfo on the zwave page I receive nothing.
Post Reply

Return to “Toon Rooting”