Rooting Toon (or boxx)

[marcelr]

It's getting a bit off topic, but this seems to work:

Install x11vnc, and run it manually, to set the password.

Then add the following to inittab (only the part after the getty line)

Code: Select all

# added tty for direct serial access
gett:235:respawn:/sbin/getty -L 115200 ttymxc0 vt102
# added MR!, 20170513:
x11v:5:respawn:/usr/bin/x11vnc

This starts x11vnc, only in runlevel 5 (which is the default runlevel).

Make sure to open port 5900 in /etc/defaults/iptables.conf.

Reboot. Inittab then gets a partial rewrite (why? search me).

Reboot again and it should work.

[marcelr]

Should I follow the installation wizard first and connect to the wireless network or is it better start to the rooting process directly without configuring it first?

It depends. If you have an Eneco subscription, I would start up and configure first (activation code stuff etc).
If not, you can start rooting straight away. You will need to patch the config_happ_scsync.xml file manually to circumvent the activation step.

On a brand new toon (serial # >= 16-xxx-xxxx), a serial cable won't be enough to get in. You will need JTAG hardware as well.

[odelay99]

Should I follow the installation wizard first and connect to the wireless network or is it better start to the rooting process directly without configuring it first?

It depends. If you have an Eneco subscription, I would start up and configure first (activation code stuff etc).
If not, you can start rooting straight away. You will need to patch the config_happ_scsync.xml file manually to circumvent the activation step.

On a brand new toon (serial # >= 16-xxx-xxxx), a serial cable won't be enough to get in. You will need JTAG hardware as well.

Ok thanks, don't have a subscription, luckely having a 15-xxx-xxxx serial so hopefully the serial cable alone will do the job.

[odelay99]

I'm in the U-Boot but when I run:

setenv addmisc setenv bootargs \$\{bootargs\} mem=\$\{mem\} lpj=999424 init=/bin/sh
and
run boot_nand

It ends with:
/bin/sh: can't access tty; job control turned off

Any idea why this is happening?

[marcelr]

Please reproduce the error, while still in u-boot, issue the command

printenv

and post the output of that command

[odelay99]

Here is the output, I copy/paste password, run printenv, then the setenv addmisc command and run boot_nand
Don't know how to run printenv afterwards...

U-Boot 2010.09-R8 (Dec 03 2012 - 12:50:30)

CPU: Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM: 128 MiB
NAND: 128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In: serial
Out: serial
Err: serial
Display-bmp: 800 x 480 with 16777216 colors
Net: FEC
Warning: FEC MAC addresses don't match:
Address in SROM is 00:00:20:03:00:00
Address in environment is 00:0f:11:05:7d:0a


Enter password - autoboot in 2 sec...
U-Boot> printenv
bootdelay=2
baudrate=115200
loadaddr=0xA1000000
bootdelay=2
mtdids=nand0=mxc_nand
mtdparts=mtdparts=mxc_nand:1M(u-boot)ro,512K(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mtdparts_kernel=mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mem=128M
autoload=no
backlight_brightness=50
baudrate=115200
console=ttymxc0
addtty=setenv bootargs ${bootargs} console=${console},${baudrate}
addmtd=setenv bootargs ${bootargs} ${mtdparts_kernel}
nandargs=setenv bootargs ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs
boot_nand=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel; bootm ${loadaddr}
boot_nand_backup=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel-backup; bootm ${loadaddr}
bootcmd=run boot_nand
splashimage=0x180000
ethact=FEC
sn=15-37-051-085
pn=6599-1500-0100
software_compatibility=0
manufacture_date=2015/09
ethaddr=00:0F:11:05:7D:0A
addmisc=setenv bootargs ${bootargs} mem=${mem} lpj=999424

Environment size: 1023/131068 bytes
U-Boot> setenv addmisc setenv bootargs \$\{bootargs\} mem=\$\{mem\} lpj=999424 init=/bin/sh
U-Boot> run boot_nand

NAND read: device 0 offset 0x300000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
Image Name: Linux-2.6.36-R07-h21
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2210324 Bytes = 2.1 MiB
Load Address: a0008000
Entry Point: a0008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R07-h21 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Thu Jul 9 11:02:37 CEST 2015
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 init=/bin/sh
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 125596k/125596k available, 5476k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffa00000 - 0xffe00000 ( 4 MB)
vmalloc : 0xc8800000 - 0xf4000000 ( 696 MB)
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0024000 ( 112 kB)
.text : 0xc0024000 - 0xc03dd000 (3812 kB)
.data : 0xc03f6000 - 0xc041be80 ( 152 kB)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 245
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: max. sequence number: 113
UBI: attached mtd4 to ubi0
UBI: MTD device name: "rootfs"
UBI: MTD device size: 119 MiB
UBI: number of good PEBs: 952
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 1/0
UBI: image sequence number: 688630600
UBI: background thread "ubi_bgt0d" started, PID 318
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R07-h21 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R07-h21 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1962 buckets, 7848 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
rtc-isl1208 1-006f: setting system clock to 2017-05-14 09:11:23 UTC (1494753083)
UBIFS: recovery needed
usb 2-1: new high speed USB device using mxc-ehci and address 2
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size: 117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root: 0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 112K
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ #

[marcelr]

Looks like you get a command prompt at the end nonetheless:

/ #

The initial /bin/sh is not a full-fledged shell, did you try typing anything there?

[odelay99]

Yes I did, I get the following:

/bin/sh: can't access tty; job control turned off
/ # printenv
/bin/sh: printenv: not found
/ # printenv
/bin/sh: printenv: not found
/ #

Probably my linux/shell knowledge..

[marcelr]

OK, seems like your setup is working.

I just did a quick check on an open toon:
This is what I get after setting addmisc (at the far end, never mind the first zillion lines)

Code: Select all

 ...
usb 2-1: Manufacturer: Manufacturer Realtek                                                                                        
usb 2-1: SerialNumber: 00e04c000001                                                                                                
/bin/sh: can't access tty; job control turned off                                                                                  
/ #   

Looks similar
I will add a remark about this message to the rooting manual.
Then you can type away inside this shell and do what needs to be done. As an example, ask for a directory listing:

Code: Select all

/ # ls                                                                                                                             
HCBv2       configured  lib         mnt         sbin        usr                                                                    
bin         dev         linuxrc     proc        sys         var                                                                    
boot        etc         media       root        tmp                                                                                
/ # 

etc.

BTW, printenv is a u-boot command. doesn't work in the initial shell.
Good luck with the second leg of the rooting process.

[odelay99]

Damn, your right, thought it was an error!
Thanks for helping me out on this..

[dennis071nl]

Hi guys,

Finally i managed to get in my Toon, halfway the rooting process (struggeling with VI, i'm more of a nano guy )

After editing the initaab file i should reboot and login as root...

I tried several times now, don't kno what i'm doin wrong...

Please help...!

Thanks in advance, Dennis


# WARNING: auto-managed by '/etc/init.d/HCBv2 inittabwrap' with '/HCBv2/etc/start.d/*'
# lines containing 'inittabwrap' will be removed automagically.
netc:235:respawn:/etc/init.d/HCBv2 inittabwrap hcb_netcon
comm:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_comm
/ # reboot
WARNING: could not determine runlevel - doing soft reboot
(it's better to use shutdown instead of reboot from the command line)
shutdown: timeout opening/writing control channel /dev/initctl
init: timeout opening/writing control channel /dev/initctl
/ # root
/bin/sh: root: not found
/ #

[marcelr]

...
# WARNING: auto-managed by '/etc/init.d/HCBv2 inittabwrap' with '/HCBv2/etc/start.d/*'
# lines containing 'inittabwrap' will be removed automagically.
netc:235:respawn:/etc/init.d/HCBv2 inittabwrap hcb_netcon
comm:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_comm
/ # reboot
WARNING: could not determine runlevel - doing soft reboot
(it's better to use shutdown instead of reboot from the command line)
shutdown: timeout opening/writing control channel /dev/initctl
init: timeout opening/writing control channel /dev/initctl
/ # root
/bin/sh: root: not found
/ #

It looks like you try to reboot from the initial shell that was opened through u-boot. This shell has very limited functionality, it's not a login shell. After editing inittab, try to reboot by hitting the reset button of toon. This reboots effectively, and drops you to a proper login shell.

[dennis071nl]

...
# WARNING: auto-managed by '/etc/init.d/HCBv2 inittabwrap' with '/HCBv2/etc/start.d/*'
# lines containing 'inittabwrap' will be removed automagically.
netc:235:respawn:/etc/init.d/HCBv2 inittabwrap hcb_netcon
comm:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_comm
/ # reboot
WARNING: could not determine runlevel - doing soft reboot
(it's better to use shutdown instead of reboot from the command line)
shutdown: timeout opening/writing control channel /dev/initctl
init: timeout opening/writing control channel /dev/initctl
/ # root
/bin/sh: root: not found
/ #

It looks like you try to reboot from the initial shell that was opened through u-boot. This shell has very limited functionality, it's not a login shell. After editing inittab, try to reboot by hitting the reset button of toon. This reboots effectively, and drops you to a proper login shell.

And what if it doesn't come up with a login shell?? i let it boot and no posibility for me to login as root...?

[marcelr]

Then I would check my edits of /etc/inittab. Typo's can be quite devastating there. Can you post your /etc/inittab?

[dennis071nl]

OK, i stumbled through... got the root access, only issue right now is that my setup was set back to factory defaults, and now my energiemeter isn't recognized. even when i hold it next to the toon...

Could there be some service that's blocked in the rooting process??

my etc/iniitab:

# /etc/inittab: init(8) configuration.
# $Id: inittab,v 1.91 2002/01/25 13:35:21 miquels Exp $

# The default runlevel.
id:5:initdefault:

# Boot-time system configuration/initialization script.
# This is run first except when booting in emergency (-b) mode.
si::sysinit:/etc/init.d/rcS

# What to do in single-user mode.

# /etc/init.d executes the S and K scripts upon change
# of runlevel.
#
# Runlevel 0 is halt.
# Runlevel 1 is single-user.
# Runlevels 2-5 are multi-user.
# Runlevel 6 is reboot.

l0:0:wait:/etc/init.d/rc 0
l1:1:wait:/etc/init.d/rc 1
l2:2:wait:/etc/init.d/rc 2
l3:3:wait:/etc/init.d/rc 3
l4:4:wait:/etc/init.d/rc 4
l5:5:wait:/etc/init.d/rc 5
l6:6:wait:/etc/init.d/rc 6
# Normally not reached, but fallthrough in case of emergency.
z6:6:respawn:/sbin/sulogin

# HCBv2 static stuff
ovpn:235:respawn:/usr/sbin/openvpn --config /etc/openvpn/vpn.conf --verb 0 >/dev/null 2>&1
qtqt:245:respawn:/usr/bin/startqt >/dev/null 2>&1
#id serial console access: (added, MR!):
gett:235:respawn:/sbin/getty -L 115200 ttymxc0 vt102

# WARNING: auto-managed by '/etc/init.d/HCBv2 inittabwrap' with '/HCBv2/etc/start.d/*'
# lines containing 'inittabwrap' will be removed automagically.
netc:235:respawn:/etc/init.d/HCBv2 inittabwrap hcb_netcon
comm:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_comm
even:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_eventmgr
kpik:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_kpi
pwru:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_pwrusage
scsy:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_scsync
smar:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_smartplug
ther:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_thermstat
user:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_usermsg
weat:345:respawn:/etc/init.d/HCBv2 inittabwrap happ_weather
bxtp:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_bxtproxy
conf:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_config
logl:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_log
rrdr:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_rrd
upnp:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_upnp
watc:345:respawn:/etc/init.d/HCBv2 inittabwrap hcb_watchdog
hueh:345:respawn:/etc/init.d/HCBv2 inittabwrap hdrv_hue
p1p1:345:respawn:/etc/init.d/HCBv2 inittabwrap hdrv_p1
zwav:345:respawn:/etc/init.d/HCBv2 inittabwrap hdrv_zwave
ligh:345:respawn:/etc/init.d/HCBv2 inittabwrap lighttpd
# end of 'inittabwrap' section.