Rooting Toon (or boxx)

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TheHogNL, Toonz

CarlvO
Starting Member
Starting Member
Posts: 2
Joined: Sat Jan 06, 2018 11:28 pm

Re: Rooting Toon (or boxx)

Post by CarlvO »

iMars wrote:Ok, done everything till the moment you have to reboot...

Instead of that, I've read that you can also use the reset button...
I get this:

Code: Select all

usb 2-1: SerialNumber: 00e04c000001
 (print_boot_msg)
Please wait: booting... (print_boot_msg)
* Kernel            2.6.36-R10-h27 (print_boot_msg)
* Firmware          qb2/ene/4.10.6-1196-0 (print_boot_msg)
* Hostname          eneco-001-016676 (print_boot_msg)
==DriverVersion: v2.6.6.0.20120405==
MAC Address from efuse= 6c-71-d9-3c-42-48
usbcore: registered new interface driver r871x_usb_drv
usbcore: registered new interface driver rt2870
Loading iptables settings: iptables.
 (print_boot_msg)
Configuring network interfaces...  (print_boot_msg)
Configuring network interfaces... 
Running 'ifup -a' in the foreground (ifup-fg)
ifup: interface lo already configured
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
udhcpc: started, v1.27.2
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending discover
Lease failing, starting in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-016676
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.27.2
udhcpc: no lease, failing
udhcpc: sending discover
Successfully initialized wpa_supplicant
rfkill: Cannot get wiphy information
ioctl[SIOCSIWAP]: Operation not permitted
udhcpc: sending discover
udhcpc: started, v1.27.2
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending discover
Lease failing, already running in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-016676
udhcpc: no lease, forking to background
Lease failing, starting in bg: udhcpc -b -R -i wlan0 -A 5 -p /var/run/udhcpc.wlan0.pid -H eneco-001-016676
udhcpc: no lease, failing
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.27.2
* Wired (eth0)      00:0f:11:01:f6:0f  [No IP from DHCP Server] (print_boot_msg)
udhcpc: sending discover
* Wireless (wlan0)  6c:71:d9:3c:42:48  [No IP from DHCP Server] (print_boot_msg)
Setting up IP spoofing protection: rp_filter.
udhcpc: sending select for 10.0.0.110
udhcpc: lease of 10.0.0.110 obtained, lease time 600
/etc/udhcpc.d/50default: Adding DNS 10.0.0.1
/etc/udhcpc.d/50default: Adding DNS 84.116.46.21
INIT: Entering runlevel: 5dding 
/etc/udhcpc.d/70prepend-google-pub-dns: Prepending DNS 8.8.8.8 (skip with /mnt/persist/udhcpc-skip-prepend-google-pub-dns)
Starting syslogd/klogd: done
HCBv2 apps started via runlevels, performing 'addstartables && reload && init 5 or 5'.
HCBv2 adding: comm eventmgr kpi pwrusage scsync smartplug thermstat usermsg weather bxtproxy config log rrd watchdog hue p1 zwave lighttpd.
HCBv2 startables unchanged, not writing /etc/inittab.
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
imx-fb imx-fb.0: PreserveUBootFramebuffer(4): xres=800, yres=480 [do _update_lcdc]
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
INIT: Id "gett" respawning too fast: disabled for 5 minutes
r8711_wx_set_scan: IW_SCAN_THIS_ESSID, ssid=iRouter, len=7
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
INIT: Id "gett" respawning too fast: disabled for 5 minutes
I've got bootloader: U-Boot 2010.09-R8, so that works fine...
I'm getting the same "getty: applet not found" error when the Toon is booting. Looks like i've done something wrong with adding the line to /etc/inittab.

But now I can only get into U-Boot and not in any shell-environment to edit the /etc/initab again. Any suggestions? Read something about single mode, but not sure what to do.
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

It's in the rooting manual, near dropbear installation. You may want to download a copy of a getty-enabled busybox as well:
viewtopic.php?f=87&t=11230&start=315#p84518
iMars
Starting Member
Starting Member
Posts: 17
Joined: Tue Nov 17, 2015 10:47 pm

Re: Rooting Toon (or boxx)

Post by iMars »

CarlvO wrote:
iMars wrote:Ok, done everything till the moment you have to reboot...

Instead of that, I've read that you can also use the reset button...
I get this:

Code: Select all

usb 2-1: SerialNumber: 00e04c000001
 (print_boot_msg)
Please wait: booting... (print_boot_msg)
* Kernel            2.6.36-R10-h27 (print_boot_msg)
* Firmware          qb2/ene/4.10.6-1196-0 (print_boot_msg)
* Hostname          eneco-001-016676 (print_boot_msg)
==DriverVersion: v2.6.6.0.20120405==
MAC Address from efuse= 6c-71-d9-3c-42-48
usbcore: registered new interface driver r871x_usb_drv
usbcore: registered new interface driver rt2870
Loading iptables settings: iptables.
 (print_boot_msg)
Configuring network interfaces...  (print_boot_msg)
Configuring network interfaces... 
Running 'ifup -a' in the foreground (ifup-fg)
ifup: interface lo already configured
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
udhcpc: started, v1.27.2
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending discover
Lease failing, starting in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-016676
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.27.2
udhcpc: no lease, failing
udhcpc: sending discover
Successfully initialized wpa_supplicant
rfkill: Cannot get wiphy information
ioctl[SIOCSIWAP]: Operation not permitted
udhcpc: sending discover
udhcpc: started, v1.27.2
udhcpc: sending discover
udhcpc: sending discover
udhcpc: sending discover
Lease failing, already running in bg: udhcpc -b -R -i eth0 -A 5 -p /var/run/udhcpc.eth0.pid -H eneco-001-016676
udhcpc: no lease, forking to background
Lease failing, starting in bg: udhcpc -b -R -i wlan0 -A 5 -p /var/run/udhcpc.wlan0.pid -H eneco-001-016676
udhcpc: no lease, failing
udhcpc: option -h NAME is deprecated, use -x hostname:NAME
udhcpc: started, v1.27.2
* Wired (eth0)      00:0f:11:01:f6:0f  [No IP from DHCP Server] (print_boot_msg)
udhcpc: sending discover
* Wireless (wlan0)  6c:71:d9:3c:42:48  [No IP from DHCP Server] (print_boot_msg)
Setting up IP spoofing protection: rp_filter.
udhcpc: sending select for 10.0.0.110
udhcpc: lease of 10.0.0.110 obtained, lease time 600
/etc/udhcpc.d/50default: Adding DNS 10.0.0.1
/etc/udhcpc.d/50default: Adding DNS 84.116.46.21
INIT: Entering runlevel: 5dding 
/etc/udhcpc.d/70prepend-google-pub-dns: Prepending DNS 8.8.8.8 (skip with /mnt/persist/udhcpc-skip-prepend-google-pub-dns)
Starting syslogd/klogd: done
HCBv2 apps started via runlevels, performing 'addstartables && reload && init 5 or 5'.
HCBv2 adding: comm eventmgr kpi pwrusage scsync smartplug thermstat usermsg weather bxtproxy config log rrd watchdog hue p1 zwave lighttpd.
HCBv2 startables unchanged, not writing /etc/inittab.
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
imx-fb imx-fb.0: PreserveUBootFramebuffer(4): xres=800, yres=480 [do _update_lcdc]
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
INIT: Id "gett" respawning too fast: disabled for 5 minutes
r8711_wx_set_scan: IW_SCAN_THIS_ESSID, ssid=iRouter, len=7
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
getty: applet not found
INIT: Id "gett" respawning too fast: disabled for 5 minutes
I've got bootloader: U-Boot 2010.09-R8, so that works fine...
I'm getting the same "getty: applet not found" error when the Toon is booting. Looks like i've done something wrong with adding the line to /etc/inittab.

But now I can only get into U-Boot and not in any shell-environment to edit the /etc/initab again. Any suggestions? Read something about single mode, but not sure what to do.
In u-boot you have to type the command

Code: Select all

setenv addmisc setenv bootargs \$\{bootargs\} mem=\$\{mem\} lpj=999424 init=/bin/sh
and than

Code: Select all

run boot_nand
... that'll boot you into linux where you can edit the inittab and passwd
iMars
Starting Member
Starting Member
Posts: 17
Joined: Tue Nov 17, 2015 10:47 pm

Re: Rooting Toon (or boxx)

Post by iMars »

iMars wrote:Ok, Toon root'ed... and now further. How can I control the temperature setpoint? What are the next steps? (I'm feeling like a n00b :shock: :lol: :wink: )
Quoting myself :D There is a lot of information, and probably many ways to do it, also many ways because of the different software versions.
I got it working by this solution: viewtopic.php?f=87&t=11449&p=84780#p84780
msv
Starting Member
Starting Member
Posts: 13
Joined: Mon Mar 15, 2010 12:58 pm

Re: Rooting Toon (or boxx)

Post by msv »

Hi all, I got myself a 2nd hand Toon with; kernel 2.6.36-R10-h27, firmware qb2/ene/4.8.25-1157-0

successfully rooted my Toon. But the problem is taht the toon with an installation wizzard starts, and get stuck on by step 2 "Activeren" the error is "Toon heeft geen verbinding met het Service Center kunnen maken". there is an internet connection end i can acces the Toon via an terminal.

What goes here wrong?
msv
Starting Member
Starting Member
Posts: 13
Joined: Mon Mar 15, 2010 12:58 pm

Re: Rooting Toon (or boxx)

Post by msv »

msv wrote:Hi all, I got myself a 2nd hand Toon with; kernel 2.6.36-R10-h27, firmware qb2/ene/4.8.25-1157-0

successfully rooted my Toon. But the problem is taht the toon with an installation wizzard starts, and get stuck on by step 2 "Activeren" the error is "Toon heeft geen verbinding met het Service Center kunnen maken". there is an internet connection end i can acces the Toon via an terminal.

What goes here wrong?
Problem solved...

I set the parameters <wizardDone> and <Activated> to 1 in file /HCBv2/config/config_flash_gui.xml
TerrorSource
Administrator
Administrator
Posts: 494
Joined: Thu May 04, 2017 9:28 pm

Re: Rooting Toon (or boxx)

Post by TerrorSource »

msv wrote:
msv wrote:Hi all, I got myself a 2nd hand Toon with; kernel 2.6.36-R10-h27, firmware qb2/ene/4.8.25-1157-0

successfully rooted my Toon. But the problem is taht the toon with an installation wizzard starts, and get stuck on by step 2 "Activeren" the error is "Toon heeft geen verbinding met het Service Center kunnen maken". there is an internet connection end i can acces the Toon via an terminal.

What goes here wrong?
Problem solved...

I set the parameters <wizardDone> and <Activated> to 1 in file /HCBv2/config/config_flash_gui.xml
It's mentioned in the Manual, see viewtopic.php?f=87&t=11235&sid=1c5af002 ... 971#p83254
hafeez
Starting Member
Starting Member
Posts: 10
Joined: Thu Dec 21, 2017 10:26 am

Re: Rooting Toon (or boxx)

Post by hafeez »

I messed up my Toon by writing a 256 color bmp to mtd1 instead of a 32bit one.

It hangs at:

Code: Select all

U-Boot 2010.09-R8 (Dec 03 2012 - 12:50:30)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Display-bmp: 800 x 480  with 256 colors
As you can see it shows 256 colors bitmap instead of 16777216 colors and therefore stops the boot process.

I have contacted my Pi3 with JTAG and I am able to halt and send a hacked u-boot and boot but it still stops at the splash screen because that one is still corrupted.

Anybody an idea how I can load the original splash (I have a backup) in mtd1 via JTAG and resume the boot?
Rudolf
Member
Member
Posts: 136
Joined: Mon Dec 04, 2017 8:50 pm

Re: Rooting Toon (or boxx)

Post by Rudolf »

Rudolf wrote:Huh, I don't know what happened, I was perfectly able to login to Toon using my public-key but today the key is refused.
(I was unable to set a password before, due to limitations of 4.9.23 busybox)

The putty-key is still valid for other machines, so maybe Toon has wiped my authorized_keys file....
Looks like I need to connect it to serial again and remind myself to set a proper password this time. :cry:
I looked into this issue again and found the solution with 'logread'
authpriv.info dropbear[10943]: /root must be owned by user or root, and not writable by others
Apparently the permissions for the /root-folder were to permissive. Changed that and pubkey-access works as before.
hafeez
Starting Member
Starting Member
Posts: 10
Joined: Thu Dec 21, 2017 10:26 am

Re: Rooting Toon (or boxx)

Post by hafeez »

I managed to fix my broken Toon due to wrong splash image flash to /dev/mtd1
If the image is not a 32 bit BMP Toon won't even continue with the u-boot
If the image is invalid Toon will continue to boot with message: NAND read from offset 180000 failed -74

I'll post later my fix, still testing.
hafeez
Starting Member
Starting Member
Posts: 10
Joined: Thu Dec 21, 2017 10:26 am

Re: Rooting Toon (or boxx)

Post by hafeez »

Below my method to get my rooted Toon working after a bad MTD1 (boot logo) flash.
Boot stopped at:

Code: Select all

U-Boot 2010.09-R8 (Dec 03 2012 - 12:50:30)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Display-bmp: 800 x 480  with 256 colors
Accidently flashed a 256 colors BMP instead of 32bit one
Connected my Pi3 & serial to Toon (see rooting Toon with Pi guide)
Perform the halt:

Code: Select all

soft_reset_halt
reset halt
show list of involved nand banks:

Code: Select all

> nand info 0 1 24
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8, erasesize: 131072
	#1: 0x00020000 (128kB) erase state unknown (block condition unknown)
	#2: 0x00040000 (128kB) erase state unknown (block condition unknown)
	#3: 0x00060000 (128kB) erase state unknown (block condition unknown)
	#4: 0x00080000 (128kB) erase state unknown (block condition unknown)
	#5: 0x000a0000 (128kB) erase state unknown (block condition unknown)
	#6: 0x000c0000 (128kB) erase state unknown (block condition unknown)
	#7: 0x000e0000 (128kB) erase state unknown (block condition unknown)
	#8: 0x00100000 (128kB) erase state unknown (block condition unknown)
	#9: 0x00120000 (128kB) erase state unknown (block condition unknown)
	#10: 0x00140000 (128kB) erase state unknown (block condition unknown)
	#11: 0x00160000 (128kB) erase state unknown (block condition unknown)
	#12: 0x00180000 (128kB) erase state unknown (block condition unknown)
	#13: 0x001a0000 (128kB) erase state unknown (block condition unknown)
	#14: 0x001c0000 (128kB) erase state unknown (block condition unknown)
	#15: 0x001e0000 (128kB) erase state unknown (block condition unknown)
	#16: 0x00200000 (128kB) erase state unknown (block condition unknown)
	#17: 0x00220000 (128kB) erase state unknown (block condition unknown)
	#18: 0x00240000 (128kB) erase state unknown (block condition unknown)
	#19: 0x00260000 (128kB) erase state unknown (block condition unknown)
	#20: 0x00280000 (128kB) erase state unknown (block condition unknown)
	#21: 0x002a0000 (128kB) erase state unknown (block condition unknown)
	#22: 0x002c0000 (128kB) erase state unknown (block condition unknown)
	#23: 0x002e0000 (128kB) erase state unknown (block condition unknown)
	#24: 0x00300000 (128kB) erase state unknown (block condition unknown)
1st block of MTD1 is #12
last block of MTD1 is #23

Extracted current MTD1:

Code: Select all

> nand dump 0 mtd1_extracted 0x00180000 0x00180000
memory write caused data abort (address: 0xd8000e04, size: 0x2, count: 0x1)
cp15 write operation timed out
cp15 write operation timed out
cp15 write operation timed out
cp15 write operation timed out
cp15 write operation timed out
dumped 1572864 bytes in 109.990173s (13.965 KiB/s)
This succeeded but with errors, the resulting BMP is readable but has some glitches.

Write the original MTD1:

Code: Select all

> nand write 0 mtd1_original 0x00180000
cp15 write operation timed out
cp15 read operation timed out
cp15 write operation timed out
memory read caused data abort (address: 0xd8000e1c, size: 0x2, count: 0x1)
cp15 write operation timed out
memory write caused data abort (address: 0xd8000e06, size: 0x2, count: 0x1)
memory write caused data abort (address: 0xd8000e1c, size: 0x2, count: 0x1)
memory write caused data abort (address: 0xd8000e04, size: 0x2, count: 0x1)
memory read caused data abort (address: 0xd8000e1c, size: 0x2, count: 0x1)
wrote file mtd1_original to NAND flash 0 up to offset 0x00300000 in 90.907005s (16.896 KiB/s)
Again even with writing errors

Reset Toon by halting & resuming again (optionaly load hacked u-boot.bin):

Code: Select all

soft_reset_halt
reset halt

load_image u-boot.bin 0xa1f00000
resume 0xa1f00000
Luckily the Toon boots but image load from MTD1 fails:

Code: Select all

U-Boot 2010.09 (Feb 15 2017 - 18:17:02)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
NAND read from offset 180000 failed -74
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is xxx

Autoboot in 2 sec...
Enter the password to interrupt.
The password is: toon

NAND read: device 0 offset 0x300000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h27
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1944336 Bytes = 1.9 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h27 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Tue Oct 25 20:03:05 CEST 2016
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Flash correct MTD1 again but without errors:

Code: Select all

flash_eraseall /dev/mtd1
nandwrite -a -p /dev/mtd1 splash-image_mtd1
Another reboot and all is back to normal.

The u-boot is also stored somewhere in these nand banks but due to the errors during write & read it's probably not a good idea to mess with the u-boot or else your Toon become unusable at all.
yudb
Starting Member
Starting Member
Posts: 1
Joined: Sun Jan 07, 2018 11:52 pm

Re: Rooting Toon (or boxx)

Post by yudb »

Hello,

I want to root my TOON but it is still running software 2.9.26.
I cannot update if i don't get a subscription to Eneco.
Is it possible to update my toon after rooting? It now simply shows no update available, toon is up to date.

Yannick
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

Rooting as such does not change your options with Eneco.
Peebee01
Starting Member
Starting Member
Posts: 4
Joined: Sun Jan 28, 2018 9:35 am

Re: Rooting Toon (or boxx)

Post by Peebee01 »

New to this forum, so surely a noob question.
After reading through most of the manuals and searching through the posts, Im still uncertain what cable is needed to connect to the serial interface of a toon. I’d use a Mac, so would need a USB to serial interface, but I get confused by the 3.3V (USB is 5V) and JTAG references, do I need an active adapter instead of a passive cable?

Would something like this be suitable:
nl.aliexpress.com/item/Free-Shipping-6P ... autifyAB=1

If not could someone provide a link where to get one that is suitable?
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

Peebee01 wrote:New to this forum, so surely a noob question.
After reading through most of the manuals and searching through the posts, Im still uncertain what cable is needed to connect to the serial interface of a toon. I’d use a Mac, so would need a USB to serial interface, but I get confused by the 3.3V (USB is 5V) and JTAG references, do I need an active adapter instead of a passive cable?
It's not what goes in that matters, it's what comes out at the other end. USB is 5V, but TTL-level UARTs (serial controllers) come in two flavours; 5V and 3.3V. You will need a USB-to-serial adapter with a signal level of 3.3V. The USB end will still have 5V input, but the RxD and TxD signals at the other end will be 3.3Vpp. Depending on the version of the bootloader of your toon, you may also need a JTAG adapter to get in.
Peebee01 wrote: Would something like this be suitable:
nl.aliexpress.com/item/Free-Shipping-6P ... 41607.html

If not could someone provide a link where to get one that is suitable?
This one will do nicely.
Post Reply

Return to “Toon Rooting”