Home Automation Domotica Forum Europe, Bwired Forum

Ierlandfan wrote:Cannot find one on Marktplaats.

There was one on MP about a week ago. He was asking 175 for it.
But I think we won't see a lot of them on MP any time soon. And they are not available on the retail market yet (wehkamp, bol.com still have too many old toons on stock).

The only option to get a new Toon is through Eneco which will set you back 275 euro's or a 3 or 4 year subscription.

or find a friendly Eneco engineer on the road to make a deal with.....

Something that crossed my mind: We have a guy who rooted Toon2 and sells this service. His customerbase is not very big sine Toon2 is not widely available. The customer who knows what rooting is and what you can do with it and wants to root Toon2 and goes to Markplaats to find a guy who can root Toon2 is even smaller, the fact that he is not known here (Or is but we don't know about it) is strange sort of speak. He doesn't want the "I was the first" credits and he is not posting here to say that he can. That's sounds a little fishy.

I do believe he can though, it's just there's something strange about the whole setup.

Ierlandfan wrote: I do believe he can though, it's just there's something strange about the whole setup.

Ok you got me there Ierlandfan. It is indeed strange, because it is fake

The Toon2 can not be rooted yet...

I had setup this trap to hope to get some information about how to root a Toon 2. I hoped Quby would contact me and try to get that message from MP.
Two things happened.

1) I got a message from MP 3 days later that the advertisement was removed due to complaints. Probably Quby initiated that. However after my response the advertisement was put back again by MP.

2) A user, who's name I will not publish, who is in close contact with Quby/Eneco as being a field tester, was so curious in asking how I was able to root the Toon2. He ultimatly told me that "I probably rooted the same way as Quby does, using the USB port". Not sure if this is just him trying to impress me with bogus information. But it could be that this is the entry which we need to look into further.

So far, I hoped to get more info. But for now it is enough. And, no real response from any customer who wants a rooted Toon2

Social engineering crossed my mind while profiling but it seemed the least obvious. Nice! Sorry for messing around, eventhough I deliberately played an open game using the same nickname om MP. Great job fooling everybody!

"Probably rooted the same way as Quby does, using the USB port".

I don't think Quby need that. They have an open VPN connection to the device and are fully in control of the device so they can remotely push/install whatever package they can. Still, that info is usefull! Without having touched the new Toon2, let alone seeing it, I can pretty much guess how it (in theory) can be rooted.
Let's say it depends on commercial decisions which affect technical implementation. We''ll see.

Ierlandfan wrote: I don't think Quby need that. They have an open VPN connection to the device and are fully in control of the device so they can remotely push/install whatever package they can. Still, that info is usefull! Without having touched the new Toon2, let alone seeing it, I can pretty much guess how it (in theory) can be rooted.
Let's say it depends on commercial decisions which affect technical implementation. We''ll see.

If they use the live openvpn connection they would never ask Toon1 users to send in their Toon for a official rooting. And as far as I have studied the Toon1 code and BXT binaries I haven't found some command which they can run to run native shell command's on the Toon which are needed to root a Toon.

Can you enlighten me on your theories?

The race is on.

Because I have yet to find a serial port on toon2, I decided to embark on a low-level approach to open up this toon, through JTAG.
As I already wrote in the Toon 2 hardware thread, the new toon has a set of non-populated pads which might fit a 10-pin header, even though we were told they were for some homekit chipset:



I switched on my opened toon2 and started measuring things on these pads. Two observations have emerged so far:

1: The ground connections match the pinout of a JTAG connector for the IMX6 SABRESD board.



2: Voltages measured on these pads correlate with what is to be expected from the rest of the same JTAG port.

Yesterday, the first half of my order of matching connectors for these pads arrived:



Tiny receptacles (Samtec MLE-105-02-G-DV-A), but they fit the pads and alignment holes like a glove. Connections for a homekit chipset indeed ... sure, if you say so ...
When the corresponding headers (Samtec FTMH-105-02-G-DV-A ) arrive, I'll solder these onto this toon, and get going with some JTAG sniffing. Not dissimilar from the approach I took a few years ago for the first model Toon.

Will keep you updated on any progress.

I was told this 6 years ago. "If our digitally signed Toon1 is software-wise tampered with we will revoke the VPN certificate (automatically) from the certificate list" Well, don't believe everything they say. Good luck!

Ierlandfan wrote:... Well, don't believe everything they say. ...

I don't.
And I don't blame them for trying to throw us off the scent. It's all part of the game

The headers have arrived. They fit even better than the receptacles. Will do some soldering tomorrow.

marcelr wrote:The headers have arrived. They fit even better than the receptacles. Will do some soldering tomorrow.

And? You did it?

Not so fast, lads and lassies, not so fast. The first attempt will be later this week. Other stuff to do first.

marcelr wrote:Not so fast, lads and lassies, not so fast. The first attempt will be later this week. Other stuff to do first.

OK.
Take it easy Marcel, i was only equally curious

Well, I think it takes an awful lot of time

Maybe join the game with marcel instead of waiting for him to do it alone? mAiden, can you put in some knowledge you might have from your meetings with Quby which could help him?