Rooting Toon (or boxx)

Post by **atlantica** » Sat Mar 03, 2018 8:51 am

marcelr wrote:Looks like you screwed up your busybox. Just copying the uploaded file to /bin/busybox is a no-go, you have to install it using the installer.
Anyway, it can be fixed, but this will require booting from an uploaded kernel through tftp, and configured for a rootfs on nfs, which in turn needs to be in place and working. A minimal image will do. Then you can mount the original rootfs, chroot to that and reinstall busybox. I've done it before, this method works. But it takes quite some effort.

Is there someone who can help me with correcting the busybox file this or is it better to do a fresh install of an older version of toon to also get it rooted?

Post by **atlantica** » Sat Mar 03, 2018 9:44 am

Code: Select all

When trying to root my toon by changing the version of busybox in /bin toon boot correctly

After running:
setenv addmisc setenv bootargs \$\{bootargs\} mem=\$\{mem\} lpj=999424 init=/bin/sh
run boot_nand

I created the following log:

Code: Select all

[list]Linux version 2.6.36-R10-h27 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMP6
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x0010000h
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TM070RDH11
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       155084
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 542/162
UBI: image sequence number:  1695361719
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2018-03-03 06:30:06 UTC (1520058606)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
Failed to execute /bin/sh.  Attempting defaults...
usb 2-1: new high speed USB device using mxc-ehci and address 2
Kernel panic - not syncing: No init found.  Try passing init= option to kernel. See Linux Documentat.
[<c00273d0>] (unwind_backtrace+0x0/0xf0) from [<c029e720>] (panic+0x60/0x190)
[<c029e720>] (panic+0x60/0x190) from [<c00223dc>] (init_post+0x78/0xc4)
[<c00223dc>] (init_post+0x78/0xc4) from [<c0008b54>] (kernel_init+0x110/0x14c)
[<c0008b54>] (kernel_init+0x110/0x14c) from [<c00238ec>] (kernel_thread_exit+0x0/0x8)[/list]

Howto fix this?

Post by **TheHogNL** » Sat Mar 03, 2018 10:52 am

You have seem to screw up busybox also, just like the one a few posts ago. Please look there how to fix this.

Post by **atlantica** » Sat Mar 03, 2018 4:51 pm

djxfma wrote:Update
Ok I did it xD, it was because of the NFS version was not given with the mounting options true the bootargs.
I changed the commands below to the right ones.

Commands I used to get boot to work, and trying to mount rootfs:
Code: Select all
dhcp
setenv serverip 192.168.5.199
setenv autoload no
setenv bootfile toon/uImage-nfs
setenv bootargs console=${console},${baudrate} rootwait root=/dev/nfs nfsroot=192.168.5.199:/srv/tftpboot/toon/rootfs,v3,tcp,nolock rw ip=dhcp

tftpboot 0xA1000000 toon/uImage-nfs
run bootargs; nand read ${loadaddr} kernel; bootm ${loadaddr}
Exports list of the NFS server:
Code: Select all
/srv/tftpboot/toon/rootfs    *(rw,sync,no_root_squash,no_subtree_check)
/srv/tftpboot/toon           *(rw,sync,no_root_squash,no_subtree_check)

I have no data for /srv/tftpboot/toon/rootfs in the tar.gz file.
where can i download/find these files?

Post by **marcelr** » Sun Mar 04, 2018 1:10 pm

I just uploaded a detailed manual for these issues to the manuals/tutorials thread. Please check it out.

Post by **atlantica** » Sun Mar 04, 2018 3:02 pm

marcelr wrote:I just uploaded a detailed manual for these issues to the manuals/tutorials thread. Please check it out.

Thanks for updating the manual, I have one part that i've not figured out yet:

######################################################################
#
# 6: Preparing the root file system
#
######################################################################

If you have not made a back-up of your rootfs, you can use the
barebones rootfs that's made when the quby openembedded tree is built
according to the README file in that tree. This rootfs resides in
~/oe/qb2/tmp/rootfs/image-base-qb2. Copy the full contents of this
directory to /tftpboot/toon/rootfs, including links etc.

Where can i find this download?
(I didn't build the kernel because it's working correctly...)

Post by **marcelr** » Sun Mar 04, 2018 5:22 pm

Try this bit of the manual

######################################################################
#
# 10: Repairing stuff on a bricked toon.
#
######################################################################

Since the update of busybox to 1.27.2-r1, some people have tried to
upgrade to 1.27.2-r4, and failed, for various reasons. This resulted
in a non-available /bin/sh, which is quite lethal for a unix-style OS.

To fix this, the following is required:

1: Set up an NFS server and TFTP server as described in sections 1-4
of this manual. There's no need to build the kernel image and
rootfs from scratch, instead you can download them from:

http://files.domoticaforum.eu/uploads/T ... ge-nfs.zip
http://files.domoticaforum.eu/uploads/T ... qb2.tar.gz

Post by **atlantica** » Sun Mar 04, 2018 6:25 pm

Thanks again for replying. I was already this far with that image:

Code: Select all

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h27 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMP6
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttymxc0,115200 rootwait root=/dev/nfs nfsroot=192.168.xx.xx:/export/toop
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TM070RDH11
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
Registering mxc_nand as whole device
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h27 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2018-03-04 16:17:04 UTC (1520180224)
usb 2-1: new high speed USB device using mxc-ehci and address 2
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
Sending DHCP requests .
PHY: 1:10 - Link is Up - 100/Full
., OK
IP-Config: Got DHCP answer from 0.0.0.0, my address is 192.168.xx.xx
IP-Config: Complete:
     device=eth0, addr=192.168.xx.xx, mask=255.255.255.0, gw=192.168.xx.xx,
     host=192.168.xx.xx, domain=xx.local, nis-domain=(none),
     bootserver=0.0.0.0, rootserver=192.168.xx.xx, rootpath=
Looking up port of RPC 100003/3 on 192.168.xx.xx
Looking up port of RPC 100005/3 on 192.168.xx.xx
VFS: Mounted root (nfs filesystem) on device 0:13.22
Freeing init memory: 104K
/bin/sh: can't access tty; job control turned off
/ # ls
bin      dev      lib      mnt      root     sys      usr
boot     etc      linuxrc  proc     sbin     tmp      var
/ # cd boot
/boot # ls
uImage-2.6.36-R07-h11
/boot # cd ..
/ # cd root/
~ # ls
~ # ubiattach -p /dev/mtd4 -O 2048
ubiattach: error!: UBI is not present in the system

the command: ubiattach -p /dev/mtd4 -O 2048 gives the following error:
ubiattach: error!: UBI is not present in the system

Post by **marcelr** » Sun Mar 04, 2018 7:21 pm

Please try again with the uImage-nfs kernel.

Post by **atlantica** » Mon Mar 05, 2018 12:14 pm

Yes, Toon is working again! Tanks!

These are the commands I used to get it working:

Code: Select all

[password]
dhcp
setenv serverip [ip of nfs server]
tftpboot 0xa1000000 toon/uImage-nfs
setenv bootargs ubi.mtd=4,2048
setenv bootargs ${bootargs} root=/dev/nfs rw nfsroot=[ip of nfs server]:/tftpboot/toon/rootfs,v3,nolock,tcp console=ttymxc0,115200 loglevel=8
setenv bootargs ${bootargs} mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
setenv bootargs ${bootargs} ip=[ip of toon client]:[ip of nfs server]:[ip of router/GW]:255.255.255.0:toon::off
bootm


cat /proc/devices | grep ubi0
mknod /dev/ubi0 c 252 0
mkdir /mnt/rootfs
mount -t ubifs ubi0:rootfs /mnt/rootfs
chmod +x /mnt/rootfs/bin/busybox

Now figuring out the rooting part....

Post by **marcelr** » Mon Mar 05, 2018 4:20 pm

atlantica wrote:Now figuring out the rooting part....

That's the easy bit. Good luck.

Post by **atlantica** » Mon Mar 05, 2018 4:34 pm

All working now! Thanks Marcel and others with this support!

Post by **TheHogNL** » Tue Mar 06, 2018 2:08 pm

Ierlandfan wrote:If you're looking for a "simple" attack vector that doesn't involves breaking encryption (Now whe are in it makes more sense to try this again)
Try this one:

The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.
(CVE-2011-2716 20)

Installed on Toon: busybox-udhcpd - 1.18.3-r42.1

This sounds quite easy, set up a dhcp server and insert a command in one of the options. (Have to look for one, it' s been done before but not on Toon)
Hostname is fixed (In Toon) so that's not an option. The other options can be played with. SInce we have full control over Toon we can try to probe and see how Toon responds on Toon itself.

Responding to this old post.. tried to put some shell metachars in the domain_name option but was suprised to see that Toon install the name 'bad' when doing this. At the moment when udhcpc installs the env variables (for the script to pick it up for resolv.conf) it is already changed to the name 'bad'.
So somewhere there is a check in place which detect the false name. I think they already changed the openembedded busybox udhcpc just for this. Too bad

Post by **TheHogNL** » Tue Mar 06, 2018 3:16 pm

TheHogNL wrote: Responding to this old post.. tried to put some shell metachars in the domain_name option but was suprised to see that Toon install the name 'bad' when doing this. At the moment when udhcpc installs the env variables (for the script to pick it up for resolv.conf) it is already changed to the name 'bad'.
So somewhere there is a check in place which detect the false name. I think they already changed the openembedded busybox udhcpc just for this. Too bad

Aha, I noticed that the busybox udhcp is builtin into busybox and since Toon firmware 4.9 contains the new busybox (1.27), which also contains the udhcpc vulnerability fix which changes the bad domain name with 'bad'.

So, if anyone with an older version can try to put this into his dhcp servers domain name and check if works we have a possibility into Toon firmware before 4.9.

DHCP domain name should be "yourdomainname$(touch /tmp/hello)" (without the quotes)

If after booting the file /tmp/hello is created, we have a go!

Post by **TheHogNL** » Tue Mar 06, 2018 4:46 pm

Just tried in on an older version (downgraded busybox) but it didn't work. The dhcp scripts (to configure resolv.conf etc) are not started when a invalid domain name is sent. To bad...

Home Automation Domotica Forum Europe, Bwired Forum

Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)

Re: Rooting Toon (or boxx)