Fully automated rooting script

[TerrorSource]

I've just merged the latest changes from the dev branch into master, thanks to legalr for testing.

Support has been added for all types of Pi's, and its now easier to add support for other JTAG debuggers by adding the correct config to the assets/adapters/ directory (if you've added support for one, please send me a PR).

Im not using the latest version but i noticed this issue:

sudo python . --jtag-available
INFO:__main__:Starting up...
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
INFO:rooter:Halting CPU
INFO:rooter:Loading new image to RAM
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart

Nothing happens after that. Toon boots up normally but the script is still paused.

Tried again with the latest version from github, problem still exists.

Code: Select all

pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi3'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
INFO:rooter:Halting CPU
INFO:rooter:Loading new image to RAM
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart

Nothing happens, manual restart does not help as it does not picks up the edited u-boot img.

Any other way i can use the ToonRooter to open the u-boot?

sudo python . --jtag-available --dont-check-uboot
does not wait for the Toon to boot up btw.

DEBUG LOG:

Code: Select all

sudo python . --jtag-available --output-level DEBUG
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi3'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
DEBUG:__main__:{"has_jtag": true, "check_uboot": true, "boot_only": false, "reboot_after": true, "cleanup_payload": true, "port": "/dev/serial0", "jtag_hardware": "rpi3", "ssh_pubkey_data": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZpcv54a9LNl6jszYhcFfPLT86Ja1O4htYmeysEmcFvzDWmb0y3lIxzV8zrm8s9+PzarnCL3h6Pa4hKivT2uD7QdXdrl2ADO9lxuYrNMtufxalUV3JDbgXIR3cDfb+r9NwRopttiSyugCPQZzJKabxzyvF4hI++zAlnjakCc2orZUEb3E2D/Vz5BGMzpccChJ8FnGC2tF0hQTvkjvOP7TvHdRjmBw9StUrZDAWubHQwVVDmrZyDWzEOUC8QUPTHaG+UuSmKcpuKQ7Ptmi44oM2C8TIeH/YSnbIGAOlzXm38GDZ82Wa7oL2+P0zJuhpPYqrN+jpQfhEgHspUwOGGA9n"}
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
DEBUG:rooter:Open On-Chip Debugger
> 
INFO:rooter:Halting CPU
DEBUG:rooter:soft_reset_halt
requesting target halt and executing a soft reset
Jazelle state handling is BROKEN!
target halted in Jazelle state due to debug-request, current mode: Supervisor
cpsr: 0xffffffd3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> 
DEBUG:rooter:reset halt
JTAG scan chain interrogation failed: all ones
Check JTAG interface, timings, target power, etc.
Trying to use configured scan chain anyway...
imx27.etb: IR capture error; saw 0x0f not 0x01
Bypassing JTAG setup events due to errors
WARNING: unknown debug reason: 0xf
ThumbEE -- incomplete support
target halted in ThumbEE state due to debug-request, current mode: System
cpsr: 0xffffffff pc: 0xfffffff9
MMU: enabled, D-Cache: enabled, I-Cache: enabled
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
> 
INFO:rooter:Loading new image to RAM
DEBUG:rooter:load_image assets/u-boot.bin 0xa1f00000
WARNING: unknown debug reason: 0xf
ThumbEE -- incomplete support
timed out while waiting for target debug-running
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 7.407528s (21.951 KiB/s)
> 
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart

EXIT: Problem was re-doing all the wires. as the error "imx27.etb: IR capture error; saw 0x0f not 0x01" is a wiring issue.

[martenjacobs]

(...)
EXIT: Problem was re-doing all the wires. as the error "imx27.etb: IR capture error; saw 0x0f not 0x01" is a wiring issue.

Yes, that's a common problem. As the script does no checking on the output from OpenOCD at all, wiring issues like these cause it to wait indefinitely. The trick is to manually check the output from OpenOCD by using the --debug flag

[aabre]

Hi guys,
I'm stuck in the rooting script, checked and double checked al my connections but I can't find a connection problem,
I have a fresh started debian Pi and a get the next error

pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi3'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
ERROR:rooter:
Traceback (most recent call last):
File "./rooter.py", line 206, in start_bootloader
client = telnetlib.Telnet('localhost', 4444)
File "/usr/lib/python2.7/telnetlib.py", line 211, in __init__
self.open(host, port, timeout)
File "/usr/lib/python2.7/telnetlib.py", line 227, in open
self.sock = socket.create_connection((host, port), timeout)
File "/usr/lib/python2.7/socket.py", line 575, in create_connection
raise err
error: [Errno 111] Connection refused
CRITICAL:__main__:[Errno 3] No such process


Can anybody give me a little push

[TheHogNL]

Openocd doesn't seem to start. Did you forgot to install that? https://github.com/martenjacobs/ToonRoo ... ll-openocd

[aabre]

Openocd doesn't seem to start. Did you forgot to install that? https://github.com/martenjacobs/ToonRoo ... ll-openocd

Yes I have installed it as mentioned in the readme from Marten Jacob and there was no problems or error during installation

What I had to install was telnet and when I use telnet as a command I get:

pi@raspberrypi:/etc $ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

Is this a normal error (Connection refused) ? and it gives this error on any port number you want.

Only when I use telnet localhost <Enter> (without port number) it seems to work:

pi@raspberrypi:/etc $ telnet localhost
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Raspbian GNU/Linux 9
raspberrypi login:

Maybe Telnet gives the problem?

[TheHogNL]

telnet localhost 4444 only works when openocd is started ofcourse
See the part in the python code:

log.info("Starting openocd")

proc = subprocess.Popen([
'openocd',
'-s', '/usr/share/openocd',
'-f', 'assets/adapters/{}.cfg'.format(self._jtag_hardware),
'-f', 'assets/boards/ed20.cfg'
], stdout=subprocess.PIPE, stderr=subprocess.PIPE)

try:

After this the telnet localhost 4444 is done. So check why openocd can't start with those paramters.

[aabre]

Started over again with a clean Rpi3 Debian OS
Install Openocd according Git (Oke)
Install basic telnet client (Oke)

Start python:


pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi3'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
INFO:rooter:Halting CPU
INFO:rooter:Loading new image to RAM
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot

Nothing happends after "Logging in to U-Boot"

[aabre]

Found broken wire
Rooting works great Yehhhhhhh
Many thanks TheHogNl

[Kingnl]

If i use this script on firmware 4.22.7 do i still need to install dropbrear?

[TheHogNL]

No this script will do that for you.

[WilcoSnel]

After struggling with some wires I finally managed to root the Toon using this awesome script.
I re-assembled and booted the thing as it was getting quite chilly.
After booting and connecting to wifi it is now asking for the activation key, so I wanna run the update-rooted-toon script with -f parameter remotely so I don't have to take it apart again.

However I can't connect remotely to it.
My computer can ping the Toon, but when I try to connect with putty using the ip address, port 22 and SSH selected, it just times out.
I should be able to connect remotely after ToonRooter has completed right?
Or should I have done something else before re-assembling it?

[frank-pda]

I tried to root my toon with an rapsberry-2 but get stuck.

I made the connection with the raspberry as JTAG and in booting i do get an
error and the script return waiting for boot up.

ERROR:rooter:Could not find value for addmisc environment variable
Please can you help me or point me in the direction i must seek??

=============
pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi2'
INFO:__main__:Written private and public key pair to ./id_rsa and
/id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R8
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot
INFO:rooter:Patching U-Boot
ERROR:rooter:Could not find value for addmisc environment variable
INFO:rooter:Waiting for boot up

Groetjes Frank uit Arnhem.

[TheHogNL]

please run again with the added option "--output-level DEBUG" and post the result

[frank-pda]

The result of the first run with the --jtag-available --output-level DEBUG was:
======================================
sudo python . --jtag-available --output-level DEBUG
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi2'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub,respectively
DEBUG:__main__:{"has_jtag": true, "check_uboot": true, "boot_only": false, "reboot_after": true, "cleanup_payload": true, "port": "/dev/serial0", "jtag_hardware": "rpi2", "ssh_pubkey_data"
: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDObtOboIgxWA0gqmh6W72rBAg4SGFy1IeRaHLkgo8WIIP9XIdNSDMZngXcGZgTdl/ByD3JAmtGGVeCeWSBjDyabAaCS 56Sbpqi78AEWsHpbRdKAALMo9y4sKeHWchBYxhZ1yYSlagg8NT+VsHZ+gj25eNJjV2YymT9HGgsIVWj7vG7NFeyq+R3sLdEbT/jyj0C6ZDWpAvfGcK1hikaaBOJwzALVQ/kHxOgMrxts7F6qYA6OrEOK8YxXXXMKeYuQXl6EUIKW0maOjXZMA5xH6NMV4dpwQ8/l60l/EyUlA7nMNA0G6XFrqPOJp55JsP319GRkoP+i3avuqYYh0l8SXGL"}
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R8
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot
DEBUG:rooter:
CPU: Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM: 128 MiB
N
LCD: 800x480, pbb 4

LCD: Drawing the logo...

In: serial

Out: serial

Err: serial

Display-bmp: 800 x 480 with 16777216 colors

Net: FEC

Warning: FEC MAC addresses don't match:

Address in SROM is 00:00:20:03:00:00

Address in environment is 00:0f:11:03:28:af

Enter password - autoboot in 2 sec...

U-Boot>
DEBUG:rooter:Logged in to U-Boot
INFO:rooter:Patching U-Boot
Traceback (most recent call last):
File "/usr/lib/python2.7/runpy.py", line 174, in _run_module_as_main
"__main__", fname, loader, pkg_name)
File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
File "/home/pi/ToonRooter/__main__.py", line 172, in <module>
main()
File "/home/pi/ToonRooter/__main__.py", line 168, in main
rooter.Rooter(**params).run()
File "./rooter.py", line 57, in run
self.patch_uboot()
File "./rooter.py", line 108, in patch_uboot
lines = port.read_until("U-Boot>")
File "/usr/lib/python2.7/dist-packages/serial/serialutil.py", line 640, in read_until
c = self.read(1)
File "/usr/lib/python2.7/dist-packages/serial/serialposix.py", line 490, in read
'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
pi@raspberrypi:~/ToonRooter $

==================

[frank-pda]

Reading, reading a manual is so dificult

I made some progress but stuck here.

DEBUG:rooter:sh payload/patch_toon.sh "5RHEM20F"
INFO:rooter:>>> Enabling root user. Your root password is: 5RHEM20F
INFO:rooter:>>> Opening ports 22, 80 and 10080 on firewall
INFO:rooter:>>> Installing dropbear
DEBUG:rooter:UBIFS error (pid 371): ubifs_read_node: bad node type (255 but expected 0)
DEBUG:rooter:UBIFS error (pid 371): ubifs_read_node: bad node at LEB 388:24000
DEBUG:rooter:UBIFS error (pid 371): ubifs_iget: failed to read inode 12188, error -22
DEBUG:rooter:UBIFS error (pid 371): ubifs_lookup: dead directory entry 'jansson.list', error -22
DEBUG:rooter:UBIFS warning (pid 371): ubifs_ro_mode: switched to read-only mode, error -22
DEBUG:rooter:Installing dropbear (2015.71-r0) to root...
DEBUG:rooter:Collected errors:
DEBUG:rooter:* pkg_get_installed_files: Failed to open //usr/lib/opkg/info/jansson.list: Invalid argument.
DEBUG:rooter:* unpack_pkg_control_files: Failed to create temporary directory '(null)': Read-only file system.
DEBUG:rooter:* opkg_install_pkg: Failed to unpack control files from dropbear_2015.71-r0_qb2.ipk.
DEBUG:rooter:* opkg_install_cmd: Cannot install package dropbear.
DEBUG:rooter:* opkg_prep_intercepts: Failed to make temp dir /tmp/opkg-34rjJo/opkg-intercept-WP3MyS: Read-only file system.
DEBUG:rooter:* rm_r: Failed to remove dir /tmp/opkg-34rjJo: Read-only file system.
DEBUG:rooter:* opkg_conf_deinit: Couldn't unlink /usr/lib/opkg/lock: Read-only file system.
DEBUG:rooter:sh: can't open '/usr/lib/opkg/info/dropbear.postinst'
INFO:rooter:Cleaning up
^CTraceback (most recent call last):
File "/usr/lib/python2.7/runpy.py", line 174, in _run_module_as_main
"__main__", fname, loader, pkg_name)
File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
File "/home/pi/ToonRooter/__main__.py", line 172, in <module>
main()
File "/home/pi/ToonRooter/__main__.py", line 168, in main
rooter.Rooter(**params).run()
File "./rooter.py", line 63, in run
self.patch_toon()
File "./rooter.py", line 186, in patch_toon
log.debug(port.read_until("/ # "))
File "/usr/lib/python2.7/dist-packages/serial/serialutil.py", line 640, in read_until
c = self.read(1)
File "/usr/lib/python2.7/dist-packages/serial/serialposix.py", line 472, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [], timeout.time_left())
KeyboardInterrupt
root@raspberrypi:/home/pi/ToonRooter#


The files ar in /home/pi/ToonRooter/payload/ on the raspberry