Fully automated rooting script

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TheHogNL, Toonz

TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

aabre wrote: Zou ik nu met dd een binaire backup terug kunnen zetten voor bv mtd2 (kernel)?
en nee dat werkt niet.. je moet je files overzetten (van een donor toon oid) zodra je gemount bent
Member of the Toon Software Collective
aabre
Starting Member
Starting Member
Posts: 42
Joined: Sun Nov 05, 2017 1:26 pm
Location: Schiedam

Re: Fully automated rooting script

Post by aabre »

Yes Igor, you are a genius, unbelievable wat a operation !

ubiattach -p /dev/mtd4

Code: Select all

UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       515858
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        950
UBI: number of bad PEBs:         2
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 950
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1487/543
UBI: image sequence number:  128556687
UBI: background thread "ubi_bgt0d" started, PID 426
UBI device number 0, total 950 LEBs (122572800 bytes, 116.9 MiB), available 0 LEBs (0 bytes), LEB size 129024 bytes (126.0 KiB)
/ # df -a
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 29794332 5030192 23488224 18% /
proc 0 0 0 0% /proc
none 0 0 0 0% /sys
ubi0:rootfs 109028 52956 56072 49% /mnt/rootfs

Oke another step closer, perfect, now I have to figure out what and how I can restore from a working Toon
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

You need to fix the lib files in /lib (or actually /mnt/rootfs/lib now). They are missing.
You could also just copy ALL files from a working toon to the /mnt/rootfs of your broken toon. But before that, make a copy of (/mnt/rootfs)/etc/openvpn/eneco-xxx.tar.gz (which contains your vpn key, they only thing what is uniq per toon).
Member of the Toon Software Collective
aabre
Starting Member
Starting Member
Posts: 42
Joined: Sun Nov 05, 2017 1:26 pm
Location: Schiedam

Re: Fully automated rooting script

Post by aabre »

Great !!! I tar my /lib and now my Toon is back from the Death!!!!!!
Many tks Igor, this is just great, I must put everything in documentation, this is fantastic.

I feel like Frankenstein !!! great help from you Igor.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

Frankenstein also had an Igor ;)
Member of the Toon Software Collective
WilcoSnel
Starting Member
Starting Member
Posts: 11
Joined: Fri Jan 25, 2019 2:43 pm

Re: Fully automated rooting script

Post by WilcoSnel »

Your U-boot isn't patched yet. R10 is the one which requires patching by openocd or using the toon rooter python script. After being patched the boot version would be 2010.09 (without R10) and then the password is toon.

So rerun the python rooter again.
Noticed that too, bu since the debuglog showed the ToonRooter logging on just fine everytime I ignored it where I apparently shouldn't have. Apologies for that.
Anyway, ran the ToonRooter again with debug log. See the output below.
I checked the output, but can't really find anything weird on it.

After running the ToonRooter again I reset the Toon with the reset button after ToonRooter was done, but unfortunately minicom still showed R10 as U-Boot version.
Hopefully you can find antything wrong with it.

Code: Select all

pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available --output-level DEBUG                                                                                                                                                            
INFO:__main__:Starting up...
INFO:__main__:Detected JTAG hardware 'rpi3'
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
DEBUG:__main__:{"has_jtag": true, "check_uboot": true, "boot_only": false, "reboot_after": true, "cleanup_payload": true, "port": "/dev/serial0", "jtag_hardware": "rpi3", "ssh_pubkey_data": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjbXDSHRyCBjGmy4tutpHqJ14makqEyaBChF0JmmDjX7f/E4UUJlx92How2Nm0EpfzLRGa4eoPkMgjkfhDefi8EB3pzegQ4KRcz/PpZPMQ0yh/sUgeCG3GpkvGDswyDqG44B3EUR02u4ZRfH7rmMf0FwdJJQa3y7SHo2cMfZNMoAFf4CydMVlj7bHR5tH2h3QAgAEaUcZZ0yIx/RGvgZQ0vY7ZtJj1IxZPZ3ThcK01+aIoNo4ylgiDUoYSeh0t4+3Cnn3I+pR9PEu0ZFhRmR4USzfFMpNoruJVSRpFTxCCk1+5/JfXbRUtq5wvLPd+hJs6Vyn2AULuxMXfuI2s6RiX"}
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
DEBUG:rooter:Open On-Chip Debugger
>
INFO:rooter:Halting CPU
DEBUG:rooter:soft_reset_halt
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
>
DEBUG:rooter:reset halt
JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
>
INFO:rooter:Loading new image to RAM
DEBUG:rooter:load_image assets/u-boot.bin 0xa1f00000
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 2.108246s (77.126 KiB/s)
>
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot
DEBUG:rooter:
CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Display-bmp: 800 x 480  with 16777216 colors
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is  00:0f:11:08:9b:9a


Autoboot in 2 sec...
Enter the password to interrupt.
The password is: toon
U-Boot>
DEBUG:rooter:Logged in to U-Boot
INFO:rooter:Patching U-Boot
DEBUG:rooter:printenv
bootdelay=2
baudrate=115200
loadaddr=0xA1000000
bootdelay=2
mtdids=nand0=mxc_nand
mtdparts=mtdparts=mxc_nand:1M(u-boot)ro,512K(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mtdparts_kernel=mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mem=128M
autoload=no
backlight_brightness=50
baudrate=115200
console=ttymxc0
addtty=setenv bootargs ${bootargs} console=${console},${baudrate}
addmtd=setenv bootargs ${bootargs} ${mtdparts_kernel}
addlcd=setenv bootargs ${bootargs} lcd=${lcd}
nandargs=setenv bootargs ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs
boot_nand=run nandargs addmtd addtty addmisc addlcd; nand read ${loadaddr} kernel; bootm ${loadaddr}
boot_nand_backup=run nandargs addmtd addtty addmisc addlcd; nand read ${loadaddr} kernel-backup; bootm ${loadaddr}
bootcmd=run boot_nand
splashimage=0x180000
ethact=FEC
sn=16-39-013-828
pn=6599-1500-4100
software_compatibility=0
manufacture_date=2016/10
ethaddr=00:0F:11:08:9B:9A
addmisc=setenv bootargs ${bootargs} mem=${mem} lpj=999424
lcd=TDA-WVGA0700F00048

Environment size: 1106/131068 bytes
U-Boot>
DEBUG:rooter:printenv
DEBUG:rooter:bootdelay=2
DEBUG:rooter:baudrate=115200
DEBUG:rooter:loadaddr=0xA1000000
DEBUG:rooter:bootdelay=2
DEBUG:rooter:mtdids=nand0=mxc_nand
DEBUG:rooter:mtdparts=mtdparts=mxc_nand:1M(u-boot)ro,512K(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
DEBUG:rooter:mtdparts_kernel=mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
DEBUG:rooter:mem=128M
DEBUG:rooter:autoload=no
DEBUG:rooter:backlight_brightness=50
DEBUG:rooter:baudrate=115200
DEBUG:rooter:console=ttymxc0
DEBUG:rooter:addtty=setenv bootargs ${bootargs} console=${console},${baudrate}
DEBUG:rooter:addmtd=setenv bootargs ${bootargs} ${mtdparts_kernel}
DEBUG:rooter:addlcd=setenv bootargs ${bootargs} lcd=${lcd}
DEBUG:rooter:nandargs=setenv bootargs ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs
DEBUG:rooter:boot_nand=run nandargs addmtd addtty addmisc addlcd; nand read ${loadaddr} kernel; bootm ${loadaddr}
DEBUG:rooter:boot_nand_backup=run nandargs addmtd addtty addmisc addlcd; nand read ${loadaddr} kernel-backup; bootm ${loadaddr}
DEBUG:rooter:bootcmd=run boot_nand
DEBUG:rooter:splashimage=0x180000
DEBUG:rooter:ethact=FEC
DEBUG:rooter:sn=16-39-013-828
DEBUG:rooter:pn=6599-1500-4100
DEBUG:rooter:software_compatibility=0
DEBUG:rooter:manufacture_date=2016/10
DEBUG:rooter:ethaddr=00:0F:11:08:9B:9A
DEBUG:rooter:addmisc=setenv bootargs ${bootargs} mem=${mem} lpj=999424
DEBUG:rooter:lcd=TDA-WVGA0700F00048
DEBUG:rooter:
DEBUG:rooter:Environment size: 1106/131068 bytes
DEBUG:rooter:U-Boot>
DEBUG:rooter: setenv addmisc setenv bootargs \${bootargs} mem=\${mem} lpj=999424 init=/bin/sh
U-Boot>
INFO:rooter:Waiting for boot up
DEBUG:rooter: run boot_nand

NAND read: device 0 offset 0x300000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h27
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1944336 Bytes = 1.9 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h27 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Tue Oct 25 20:03:05 CEST 2016
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 init=/bin/sh lcd=TDA-WVGA0700F00048
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TDA-WVGA0700F00048
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       169999
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 492/178
UBI: image sequence number:  1701871061
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2019-01-29 17:18:52 UTC (1548782332)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
usb 2-1: new high speed USB device using mxc-ehci and address 2
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ #
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon
DEBUG:rooter:/ #
DEBUG:rooter:sh payload/patch_toon.sh "DIMPGRD2"
INFO:rooter:>>> Enabling root user. Your root password is: DIMPGRD2
INFO:rooter:>>> Opening ports 22, 80 and 10080 on firewall
INFO:rooter:>>> Installing dropbear
DEBUG:rooter:Installing dropbear (2015.71-r0) to root...
DEBUG:rooter:Installing libc6 (2.21-r0) to root...
DEBUG:rooter:Downloading http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk.
DEBUG:rooter:Collected errors:
DEBUG:rooter:* opkg_download: Failed to download http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk: Couldn't connect to server.
DEBUG:rooter:* opkg_install_pkg: Failed to download libc6. Perhaps you need to run 'opkg update'?
DEBUG:rooter:* opkg_install_cmd: Cannot install package dropbear.
DEBUG:rooter:sh: can't open '/usr/lib/opkg/info/dropbear.postinst'
INFO:rooter:Cleaning up
DEBUG:rooter:rm -r payload
/ #
INFO:rooter:Rebooting
INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

Yes it my bad. I assumed that the toon rooter updated the uboot image but it only does this in RAM so after a normal reboot the old uboot (R10) is back again.

But where is goes wrong:

Code: Select all

INFO:rooter:>>> Installing dropbear
DEBUG:rooter:Installing dropbear (2015.71-r0) to root...
DEBUG:rooter:Installing libc6 (2.21-r0) to root...
DEBUG:rooter:Downloading http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk.
DEBUG:rooter:Collected errors:
DEBUG:rooter:* opkg_download: Failed to download http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk: Couldn't connect to server.
DEBUG:rooter:* opkg_install_pkg: Failed to download libc6. Perhaps you need to run 'opkg update'?
DEBUG:rooter:* opkg_install_cmd: Cannot install package dropbear.
Dropbear is not being installed because OPKG is trying to install some dependencies (from 5.0.4 firmware).
What firmware is your toon running now? And does the menu say that 5.0.4 is ready to be installed?
My assumption is that 5.0.4 is already downloaded and waiting to be installed. It looks like this conflicts with the install of dropbear.
Try to update to 5.0.4 first on the not-yet-rooted-toon.
Member of the Toon Software Collective
WilcoSnel
Starting Member
Starting Member
Posts: 11
Joined: Fri Jan 25, 2019 2:43 pm

Re: Fully automated rooting script

Post by WilcoSnel »

TheHogNL wrote:Yes it my bad. I assumed that the toon rooter updated the uboot image but it only does this in RAM so after a normal reboot the old uboot (R10) is back again.

But where is goes wrong:

Code: Select all

INFO:rooter:>>> Installing dropbear
DEBUG:rooter:Installing dropbear (2015.71-r0) to root...
DEBUG:rooter:Installing libc6 (2.21-r0) to root...
DEBUG:rooter:Downloading http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk.
DEBUG:rooter:Collected errors:
DEBUG:rooter:* opkg_download: Failed to download http://feed.hae.int/feeds/qb2/oe/angelica-1.4.0-master-qt5112-ssl102-aws/armv5e/libc6_2.21-r0_armv5e.ipk: Couldn't connect to server.
DEBUG:rooter:* opkg_install_pkg: Failed to download libc6. Perhaps you need to run 'opkg update'?
DEBUG:rooter:* opkg_install_cmd: Cannot install package dropbear.
Dropbear is not being installed because OPKG is trying to install some dependencies (from 5.0.4 firmware).
What firmware is your toon running now? And does the menu say that 5.0.4 is ready to be installed?
My assumption is that 5.0.4 is already downloaded and waiting to be installed. It looks like this conflicts with the install of dropbear.
Try to update to 5.0.4 first on the not-yet-rooted-toon.
I think your assumption is correct.
The current firmware version is 4.22.7-1273-0.
And when Toon has booted, it's showing an update icon after a while. But because it's in activation mode, I'm not able to start the update.
Just pressing the update icon does not result in it starting the update or anything really. The normal settings menu is not displayed either, because of it being in activation mode.
Does a factory reset flush the downloaded update files?

If so, my plan is as follows.
- Disconnect my LAN from the internet
- Factory reset Toon
- Run ToonRooter, but don't reset and try to connect through a seperate SSH connection directly to Toon right after

But when I'm disconnected from the internet with both my Pi and Toon it will not be able to download the libc6 package right?
Is there a way around this?

Tnx again.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

WilcoSnel wrote: If so, my plan is as follows.
- Disconnect my LAN from the internet
- Factory reset Toon
- Run ToonRooter, but don't reset and try to connect through a seperate SSH connection directly to Toon right after

But when I'm disconnected from the internet with both my Pi and Toon it will not be able to download the libc6 package right?
Is there a way around this?
You could try this indeed. I'm not sure if factory reset removes the download but no problem to try it as you are already in the activation screen (previous factory reset).

You don't need network as the dropbear is part of the payload/assets in the toonrooter. Libc6 package is the one which you DON'T want to download (this is what is bugging you now, part of the update to 5.0.4)
Member of the Toon Software Collective
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

And could you try this dropbear package (has the same filename etc, but removes the depency to glibc) so the install should work better.
dropbear_2015.71-r0_qb2.zip
(122.74 KiB) Downloaded 300 times
Member of the Toon Software Collective
WilcoSnel
Starting Member
Starting Member
Posts: 11
Joined: Fri Jan 25, 2019 2:43 pm

Re: Fully automated rooting script

Post by WilcoSnel »

TheHogNL wrote:And could you try this dropbear package (has the same filename etc, but removes the depency to glibc) so the install should work better.
dropbear_2015.71-r0_qb2.zip
Ok, I think I got a lot further. So thanks for that!

Replaced the file in the payload folder of the ToonRooter with the one you provided.
Disconnected LAN from internet, did a factory reset on Toon and then started the ToonRooter.
Log showed a successfull install of Dropbear, so followed up by NOT resetting the Toon and was able to get putty to show me a username/password prompt.
Even after a reset/reboot this still worked :)

So then tried to get in by filling in "root" as username and pasted the password that was provided by ToonRooter, but got an access denied on that, so filled it in manually, but no luck on that either.
Fortunately I was also able to connect to remotely via my Pi3B+ using "ssh -i id_rsa root@192.168.178.128".
Is that the same as U-Boot?

I thought it was, so tried to run "sed -i 's/root:[^:]*/root:FTR0zlZvsHEF2/' /etc/passwd" to change the password to "toon" and it does seem to accept that, but still not able log on with putty using that password either, reboot did not change that.
So then tried running "passwd root" to change the password, but then get this notification "passwd: applet not found"
Adding sudo did not work either, it just reports "-sh: sudo: not found".
I think I saw something on the forum about that being related to busybox? Is that the case? And if so, how can we fix that?
martenjacobs
Member
Member
Posts: 53
Joined: Fri Mar 09, 2018 4:13 pm

Re: Fully automated rooting script

Post by martenjacobs »

I just merged a pull request from TheHogNL that includes the new dropbear package, so that TOONs with 5.0.4 installed should now be able to root as well.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Fully automated rooting script

Post by TheHogNL »

WilcoSnel wrote: I thought it was, so tried to run "sed -i 's/root:[^:]*/root:FTR0zlZvsHEF2/' /etc/passwd" to change the password to "toon" and it does seem to accept that, but still not able log on with putty using that password either, reboot did not change that.
So then tried running "passwd root" to change the password, but then get this notification "passwd: applet not found"
Adding sudo did not work either, it just reports "-sh: sudo: not found".
I think I saw something on the forum about that being related to busybox? Is that the case? And if so, how can we fix that?
This is still a bug in ToonRooter. It can only set the root password once and even when it failed installing dropbear it already dropped the password.
The default 'passwd' command is not available (poor attempt from quby to block rooters).

However that 'sed' routinge should have changed it to toon indeed. Could you paste your current passwd file?
Member of the Toon Software Collective
martenjacobs
Member
Member
Posts: 53
Joined: Fri Mar 09, 2018 4:13 pm

Re: Fully automated rooting script

Post by martenjacobs »

TheHogNL wrote: This is still a bug in ToonRooter. It can only set the root password once and even when it failed installing dropbear it already dropped the password.
The default 'passwd' command is not available (poor attempt from quby to block rooters).

However that 'sed' routinge should have changed it to toon indeed. Could you paste your current passwd file?
Right, I can make some time to debug it when we have that passwd file.
WilcoSnel
Starting Member
Starting Member
Posts: 11
Joined: Fri Jan 25, 2019 2:43 pm

Re: Fully automated rooting script

Post by WilcoSnel »

martenjacobs wrote:
TheHogNL wrote: This is still a bug in ToonRooter. It can only set the root password once and even when it failed installing dropbear it already dropped the password.
The default 'passwd' command is not available (poor attempt from quby to block rooters).

However that 'sed' routinge should have changed it to toon indeed. Could you paste your current passwd file?
Right, I can make some time to debug it when we have that passwd file.
I think I make a typo somewhere, because the sed command worked fine just now. so I can get into Toon without the Pi.
I attached the passwd file from my Toon. Hopefully this helps you guys figuring this out.
I did see it showed the encrypted "toon" password now, so hopefully I did not screw up your debug plans.

Thanks for all the help
Attachments
passwd.zip
(484 Bytes) Downloaded 303 times
Post Reply

Return to “Toon Rooting”