Rooting Toon (or boxx)

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TerrorSource, Toonz, TheHogNL

Re: Rooting Toon

Postby Manyakim » Wed Oct 12, 2016 8:07 pm

Hello, unfortunately no progress has been accomplished from my side yet.
Im still stuck at the booting process and i can't even do a reset to boot my Toon.

If you have any information on resetting Toon to his original setting(or better, rooting FW 2010.9-R10), please let me know.


Code: Select all

U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Configure for LCD: TDA-WVGA0700F00048
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
Display-bmp: 800 x 480  with 16777216 colors
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is  00:0f:11:07:05:8a


Enter password - autoboot in 2 sec...

NAND read: device 0 offset 0x300000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h23
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2210272 Bytes = 2.1 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h23 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Mon Dec 14 13:05:57 CET 2015
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 lcd=TDA-WVGA0700F00048
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 125596k/125596k available, 5476k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0024000   ( 112 kB)
      .text : 0xc0024000 - 0xc03dd000   (3812 kB)
      .data : 0xc03f6000 - 0xc041bec0   ( 152 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TDA-WVGA0700F00048
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 245
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       351
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1/0
UBI: image sequence number:  2044689730
UBI: background thread "ubi_bgt0d" started, PID 319
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h23 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h23 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1962 buckets, 7848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
rtc-isl1208 1-006f: setting system clock to 2011-01-01 08:20:26 UTC (1293870026)
uifh oias;
sUBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 112K
usb 2-1: new high speed USB device using mxc-ehci and address 2
INIT: version 2.86 bootingusb 2-1: New USB device found, idVendor=148f, idProduct=5370

usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0

Enter runlevel: 2-1

Enter runlevel: 2-0

Enter runlevel: 2
INIT: Entering runlevel: 2
INIT: no more processes left in this runlevel


U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Configure for LCD: TDA-WVGA0700F00048
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
Display-bmp: 800 x 480  with 16777216 colors
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is  00:0f:11:07:05:8a


Enter password - autoboot in 2 sec...

NAND read: device 0 offset 0x300000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h23
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2210272 Bytes = 2.1 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h23 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Mon Dec 14 13:05:57 CET 2015
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 lcd=TDA-WVGA0700F00048
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 125596k/125596k available, 5476k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0024000   ( 112 kB)
      .text : 0xc0024000 - 0xc03dd000   (3812 kB)
      .data : 0xc03f6000 - 0xc041bec0   ( 152 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TDA-WVGA0700F00048
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 245
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       353
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1/0
UBI: image sequence number:  2044689730
UBI: background thread "ubi_bgt0d" started, PID 319
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h23 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h23 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1962 buckets, 7848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
rtc-isl1208 1-006f: setting system clock to 2011-01-01 08:21:39 UTC (1293870099)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 112K
usb 2-1: new high speed USB device using mxc-ehci and address 2
INIT: version 2.86 bootingusb 2-1: New USB device found, idVendor=148f, idProduct=5370

usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0

Enter runlevel:
Manyakim
Starting Member
Starting Member
 
Posts: 9
Joined: October 2016

Re: Rooting Toon

Postby marcelr » Wed Oct 12, 2016 9:36 pm

Haven't seen this before.
Can you manually enter the runlevel? If so, I would try runlevel 5 (multi user, graphics interface, and the default runlevel of toon). Otherwise, runlevel 1 on many linux systems will make the machine run in single user mode and drops you to a shell. Might be useful for getting in :-). Not sure how this is implemented in toon, though.

best,

marcelr
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

Re: Rooting Toon

Postby Manyakim » Thu Oct 13, 2016 4:57 pm

It responds on digits only, and I've tried 1 till 10, and even 1-1, 1-2 , etc... but all with the same outcome :
Code: Select all
Enter runlevel: 1
INIT: Entering runlevel: 1
INIT: no more processes left in this runlevel


Unfortunately my Toon is brand new, so it's never been activated and therefore Quby is "unable" to help me further.
I'll try to get a secondhand Toon from MarktPlaats and see if i'm lucky enought to get one with U-Boot 2010.09-R6 or 2010.09-R8.
Manyakim
Starting Member
Starting Member
 
Posts: 9
Joined: October 2016

Re: Rooting Toon

Postby cvdpol01 » Fri Oct 14, 2016 7:07 am

Hi Marcel,
I want to root also my Toon. So I follow the steps you described. I use the usb serial cable of the opentherm gateway from Schelte.
I connect with putty to the serial poort with the settings you described also. The putty screen stay's black nothing happenend. When I enter or type some characters are displayed in the terminal session.
Hereby also some screenshots
Attachments
settingsPutty.PNG
PuttySettings
settingsPutty.PNG (23.15 KiB) Viewed 10779 times
puttyscreen.png
Puttyscreen
puttyscreen.png (4.15 KiB) Viewed 10779 times
cvdpol01
Starting Member
Starting Member
 
Posts: 17
Joined: October 2016

Re: Rooting Toon

Postby igmt » Sat Oct 15, 2016 11:02 pm

Hi all,

I successfully rooted my Toon a couple days ago and a friend of mine asked me to do the same with his.
His Toon was on sw version 2.9 so I first tried to update it, but the update got stuck at 28% and now when trying to boot the Toon I get a U-boot prompt right away with the following error message above: can't get kernel image
Meaning Toon won't boot anymore ....
Does anyone know how to solve this? Maybe create a copy of my working Toon somehow and deploy that on the malfunctioning Toon?
igmt
Starting Member
Starting Member
 
Posts: 2
Joined: October 2016

Re: Rooting Toon

Postby marcelr » Sun Oct 16, 2016 7:44 am

It probably means that the installation of a new kernel image failed.
AFAIK there are two ways to go about this:
You can manually flash the /dev/mtd2 partition using u-boot (never tried it myself, but according to the manuals it should be possible).
You can follow my description of the revival of a completely crashed toon, and apply it to the kernel partition only:
viewtopic.php?f=87&t=8743&start=270#p79224

Creating an image copy will, in general, not work, since the images on toon are very much fitted onto the actual hardware of each separate toon. If your flash chip has some bad sectors (many do) and your friend's also, at a different location, there's no way to copy one image to the other without loss of information. Furthermore, over the years, flash layout has changed a little, so when that's the case, you will screw up your toon completely.

good luck,

marcelr
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

Re: Rooting Toon

Postby igmt » Sun Oct 16, 2016 10:24 am

Thanks marcelr!
I will give your description of the revival of a completely crashed toon a try.
igmt
Starting Member
Starting Member
 
Posts: 2
Joined: October 2016

Re: Rooting Toon

Postby Manyakim » Thu Oct 20, 2016 7:43 am

Hello, I'm having a problem with my Toon.
I've bought it second hand on MP and it is an "already" used and activated one (so I do not have an activation code).
But I cannot get the Toon to use the OpenTherm protocol (only on/off).

So I've updated Toon to the newest FW version and the problem still exists.
After this, I've decided to Root the Toon so I can do a "Reset to Factory setting (fabrieksinstellingen)".
But as I have a (non rooted)Toon from previous "experiments" that once it's set back to the Factory settings, during the first boot, it asks for an "activation code".

So long story short, by doing a factory rest, will my rooted Toon ask for an activation code ?

Thank you all for your help.
Manyakim
Starting Member
Starting Member
 
Posts: 9
Joined: October 2016

Re: Rooting Toon

Postby eriks1805 » Thu Oct 20, 2016 8:11 am

Hi,

Newby here. I recently got a Toon without subscription and would like to root to get more functionality but my knowlegde is not that great. Is there someone that can do it for me?

Hope someone will help me on this.
eriks1805
Starting Member
Starting Member
 
Posts: 1
Joined: October 2016

Re: Rooting Toon

Postby marcelr » Thu Oct 20, 2016 11:36 am

Manyakim wrote:Hello, I'm having a problem with my Toon.
I've bought it second hand on MP and it is an "already" used and activated one (so I do not have an activation code).
But I cannot get the Toon to use the OpenTherm protocol (only on/off).

So I've updated Toon to the newest FW version and the problem still exists.
After this, I've decided to Root the Toon so I can do a "Reset to Factory setting (fabrieksinstellingen)".
But as I have a (non rooted)Toon from previous "experiments" that once it's set back to the Factory settings, during the first boot, it asks for an "activation code".

So long story short, by doing a factory rest, will my rooted Toon ask for an activation code ?

Thank you all for your help.


Once your toon is rooted, it's rooted. This means that you can still get in after a factory reset. And yes, after a factory reset, it will ask for an activation code again. To circumvent the activation code issue, you can manually edit the main customer config file of your toon, config_happ_scsync.xml. Details have been posted elsewhere in this forum.

best,

marcelr
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

Re: hack-wedstrijd: Game of Toons

Postby marcelr » Wed Oct 26, 2016 8:36 pm

Templar wrote:For those who are interested, there will be a Toon hackathon on October 11th in Rotterdam:

So you think you can hack Toon?
Toon, de slimme thermostaat, wordt gebruikt in 300.000 huishoudens. Logisch dat Eneco let op de veiligheid en die ook regelmatig test. Maar, zoals bij elk slim apparaat, kunnen er altijd nog onverwachte kwetsbaarheden zijn.
Tek Tok heeft daarom Eneco uitgedaagd voor een hack-wedstrijd: Game of Toons. Denk jij dat jij de Toon kunt kraken? Laat het zien op 11 oktober in Worm, Rotterdam.


http://tektok.nl/got


After two weeks, the results (well, small glimpses of them) have been published on the tektok site.

best,

marcelr
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

Re: Rooting Toon

Postby lmolenaar » Tue Nov 29, 2016 7:43 pm

Dear community, just got my Toon installed and I like to root it after I have build up enough courage. I wonder if I should take action to make sure the software is not automatically updated (is it?) as I assume they can patch the way in?
Last, is it possible to confirm if my Toon is rootable just by checking the productnumber and software version?

Current versions:
Product#: 6599-1500-4100
Software version: 3.2.18
lmolenaar
Starting Member
Starting Member
 
Posts: 2
Joined: November 2016
Location: Eindhoven

Re: Rooting Toon

Postby marcelr » Tue Nov 29, 2016 8:38 pm

lmolenaar wrote:Dear community, just got my Toon installed and I like to root it after I have build up enough courage. I wonder if I should take action to make sure the software is not automatically updated (is it?) as I assume they can patch the way in?


Updates are pushed to your toon (if you have a subscription at Eneco's). You will need to start the update manually. Every update, the firewall configuration is updated, so as to block ssh access to your toon. cygnusx posted a cure for that problem, somewhere in the "Toon as a domoticacontroller?" thread.

Here:

viewtopic.php?f=87&t=8743&start=210#p78584

Should put that into a manual, someday.

lmolenaar wrote:Last, is it possible to confirm if my Toon is rootable just by checking the productnumber and software version?

Current versions:
Product#: 6599-1500-4100
Software version: 3.2.18


Nope, please post the first two digits of the serial number. Not a watertight solution, but chances are that your toon is hard to root when it starts with 16.
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

Re: Rooting Toon

Postby lmolenaar » Tue Nov 29, 2016 8:52 pm

It starts with 16 :( darn
lmolenaar
Starting Member
Starting Member
 
Posts: 2
Joined: November 2016
Location: Eindhoven

Re: Rooting Toon

Postby marcelr » Tue Feb 14, 2017 9:59 pm

Made a small step towards rooting toons with the more modern u-boot versions (the ones with a proper password).
I managed to boot such a toon using a bootloader with a known password, using JTAG access with OpenOCD, through a (clone) Segger JLink interface. For those of you who are interested, the openocd config file is attached. A serial #16 toon now boots with (I patched the code a little to conveniently display the password):
Code: Select all
U-Boot 2010.09 (Feb 14 2017 - 21:26:58)                                         
                                                                               
CPU:   Freescale i.MX27 at 400.168 MHz                                         
                                                                               
Prodrive B.V. ED2.0                                                             
DRAM:  128 MiB                                                                 
NAND:  128 MiB                                                                 
LCD: Initializing LCD frambuffer at a1400000                                   
LCD: 800x480, pbb 4                                                             
LCD: Drawing the logo...                                                       
In:    serial                                                                   
Out:   serial                                                                   
Err:   serial                                                                   
Display-bmp: 800 x 480  with 16777216 colors                                   
Net:   FEC                                                                     
Warning: FEC MAC addresses don't match:                                         
Address in SROM is         00:00:20:03:00:00                                   
Address in environment is  xx:xx:xx:xx:xx:xx                               
                                                                               
                                                                               
Enter password - autoboot in 2 sec...                                           
The password is: toon                                                           
U-Boot>                                                                                                                   
U-Boot> printenv                                                               
bootdelay=2                                                                     
baudrate=115200                                                                 
loadaddr=0xA1000000                                                             
bootdelay=2                                                                     
etc ...

The only thing to find out now, is how to flash this bootloader to NAND, and we're good to go (again). Will keep you posted.

EDIT: attachment removed, you can find it in the downloads thread.
marcelr
Global Moderator
Global Moderator
 
Posts: 1138
Joined: May 2012
Location: Ehv

PreviousNext

Return to Toon Rooting

Who is online

Users browsing this forum: No registered users and 1 guest