Rooting Toon (or boxx)

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TheHogNL, Toonz

Toonz
Forum Moderator
Forum Moderator
Posts: 1873
Joined: Mon Dec 19, 2016 1:58 pm

Re: Rooting Toon (or boxx)

Post by Toonz »

makkie2002 wrote:
Toonz wrote:
fkruis wrote:@toonz
You can also use telnet (putty) with esp-link. there you can use CTRL> and <ESC> characters.
fkruis
wasn't aware of this, much easier than the web interface. Thanks
However, submitting control characters still doesn't work here. Somehow lost in translation at the ESP card.
What ESP link software version do you use?
Hi guys, please have a look here: hackaday.io/page/1304-virtual-serial-po ... h-esp-link.
This creates a virtual COM port on your PC which which is connected over IP to your ESPlink.
This should solve some of your "lost in translation" issues :D.
Kudo's. This solution works !! A fully functional terminal connection :-) via the ESP8266 card. I'm happy!
Never ever need to open the Toon again.
member of the Toon Software Collective
makkie2002
Member
Member
Posts: 66
Joined: Fri Aug 18, 2017 3:28 pm

Re: Rooting Toon (or boxx)

Post by makkie2002 »

Toonz wrote: Kudo's. This solution works !! A fully functional terminal connection :-) via the ESP8266 card. I'm happy!
Never ever need to open the Toon again.
8)
madz
Starting Member
Starting Member
Posts: 1
Joined: Wed Oct 11, 2017 8:03 pm

Re: Rooting Toon (or boxx)

Post by madz »

Thanks for all the info. I had an old U-Boot, with the password it was really easy :)

For remote access you all use a VNC client on the mobile phones?
Would be nice to develop an own app for that instead.
Ierlandfan
Member
Member
Posts: 151
Joined: Thu Oct 03, 2013 7:53 pm

Re: Rooting Toon (or boxx)

Post by Ierlandfan »

For about 15 euro (esp8266/esp32 + TFT) you have a small (3.5 inch) and cheap vnc client. 7 inch is about 25 euro. (Or use phone)
For 30 you can have a Nextion TFT and a ESP32. The Nextion has an editor for easy GUI based display.
For about 22 Euro you have a full blown (Jessie) Linux based Raspberry Zero W (Wifi) and TFT. Python, php , C#, or insert-language.
Imagine the posibilities. We only need to interface with Boxtalk.

Throw in the mix a few z-wave thermostat controlled radiator valves and some coding and we 're done. (Some physical adjustments to the HVAC system is manditory in any case) but coding is the easiest part. The whole system flow (in any case, Toon or other) is the hardest. How it's been handled? I don't know.
I know there's a intake temperature (Controlled by the CV/Toon) and "set" temperature (for the room) and some bypass plumbing so you can set the temperature to some (higher/lower) value in any room and the "return temperature" (These are values your CV is modulating on). That's the mechanical. Coding will be easy.
glsf91
Member
Member
Posts: 184
Joined: Fri Sep 15, 2017 9:25 pm

Re: Rooting Toon (or boxx)

Post by glsf91 »

glsf91 wrote:
Ierlandfan wrote: Basically we can recreate all or almost all the functionality of Toon without subscription (and sometimes even better) so only thing you really loose is the Toon app. (And there's a workaround for that)
Can you tell what the workaround is ?
And will all functions of the app work?
@Ierlandfan: can you tell more about this?
rboers
Starting Member
Starting Member
Posts: 3
Joined: Mon Sep 25, 2017 11:50 am

Rooting Toon U-Boot R10 using a Raspberry Pi 3

Post by rboers »

!!!!!!! Rooting your Toon is at your own risk! !!!!!!!
!!!!!!! This guide is for education purposes only. If you use this information and damage your Toon, Raspberry Pi or anything else I’m not responsible. !!!!!!!


EDIT: we recommend to use the ToonRooter script: https://github.com/ToonSoftwareCollective/ToonRooter but if you still want to now how we used to do this by hand,.. read below:


=========================================================================================================================

Yesterday I tried to hack a Toon with U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18).
I found that some of the information was incomplete or I could not compare the output of the commands because the output of the commands was not in the articles I found.

This guide describes how you can use the JTAG interface to root your Toon R10 bootloader.

If you have R6 or R8 u-boot image in your Toon you don’t need to use the JTAG method and skip directly to marcelr’s guide on domoticaforum.eu.
viewtopic.php?f=87&t=11235#p82533


I cloud not do it without all the work that was put into it from the authors of several forum posts and websites. Thanks guys!!
These are the pages I used:

https://github.com/synthetos/PiOCD/wiki ... TAG-Dongle
https://learn.adafruit.com/programming- ... spberry-pi
viewtopic.php?f=87&t=11235#p82533

Here is how I did it. Maybe it can help someone to root their Toon using JTAG.

I had a Raspberry Pi 3 lying around which I turned into a JTAG debugger.

What you need:
- Toon thermostat
- Raspberry Pi 3 (version 2 should also work) with power adapter.
- 11 Dupont wires (2.54mm female-female, 20cm)
- USB to TTL Serial adapter (3.3v)


Step 1: Prepare your Raspberry Pi

First of all you have to install Raspbian on the Pi3.
I used Raspbian Stretch (9.1).
See for instructions:
https://www.raspberrypi.org/documentati ... ng-images/

To configure Wi-Fi for your Pi3 see instructions at:
https://www.raspberrypi.org/documentati ... ess-cli.md

If you want to login to your Pi3 from another PC you have to enable SSH:
https://www.raspberrypi.org/documentati ... ccess/ssh/

Update your Raspbian to the latest version.
Check out: https://www.raspberrypi.org/documentati ... pdating.md


Step 2: Install OpenOCD

Login to your Raspberry Pi.
We will install OpenOCD using the latest version from git repository.

All commands in this guide are executed as user root.

Code: Select all

root@raspberrypi:apt-get install git autoconf libtool make pkg-config libusb-1.0-0-dev libftdi-dev build-essential cmake minicom pkg-config

root@raspberrypi:mkdir ~/rootToon
root@raspberrypi:git clone --recursive git://git.code.sf.net/p/openocd/code openocd
root@raspberrypi:cd openocd
root@raspberrypi:{
./bootstrap &&\
./configure --enable-sysfsgpio\
     --enable-bcm2835gpio \
     --enable-maintainer-mode \
     --disable-werror \
     --enable-ft2232_libftdi \
     --enable-ep93xx \
     --enable-at91rm9200 \
     --enable-usbprog \
     --enable-presto_libftdi \
     --enable-jlink \
     --enable-vsllink \
     --enable-rlink \
     --enable-arm-jtag-ew \
     --enable-dummy \
     --enable-buspirate \
     --enable-ulink \
     --enable-presto_libftdi \
     --enable-usb_blaster_libftdi \
     --enable-ft2232_libftdi\
     --prefix=/usr\
&&\
make -j4
} 2>&1 | tee openocd_build.log

Step 4: Connecting Toon

Open the Toon thermostat and connect the Pi3 JTAG pins and the USB-Serial pins to the Toon JTAG connector.
I used 20cm female-female 2.54mm Dupont wires.
Plug the USB-Serial adapter into a USB-port on your Pi or your computer.

Code: Select all

Connect the JTAG wires
	Toon	 wire color   Pi header pin
      2     -white->     24 (TRST)
      3     -gray->      20 (GND)
      4     -darkred->   23 (TCK)
      5     -blue->      25 (GND)
      6     -green->     22 (TMS)
      7     -yellow->    18 (SRST)
      8     -orange->    19 (TDI)
      10    -red->       21 (TDO)

Code: Select all

Connect the serial console
	Toon	     wire color   USB-Serial
      11 (TxD)   -white->    RxD (receive)
      13 (RxD)   -gray->     TxD (transmit)
      14 (GND)   -green->    GND (ground)
You can download the zipfile with pictures from this URL: https://1drv.ms/u/s!AqSP1w9Vx6O1htsKtWXctSN2_aBnBg .

Open a serial console application (I used Minicom) and select the USB port where your USB-Serial converter is connected (in my case /dev/ttyUSB0).
The Toon thermostat uses 115200 baud, 8 data-bits, no parity, 1 stop-bit for communication.

Now you have to connect your boiler module (ketel module) to the Toon thermostat and plug-in the poweradapter of the boiler module.

You should now see the bootlog of your Toon in your serial console application.


Step 5: Changing the bootloader

Download the config.zip file which is attached to this post and extract it into ~/rootToon/.
The zip file contains 2 files: raspberrypi.cfg and ed20.cfg.

Start OpenOCD:

Code: Select all

root@raspberrypi:cd ~/rootToon/
root@raspberrypi:openocd -s /usr/share/openocd -f ~/rootToon/raspberrypi.cfg -f ~/rootToon/ed20.cfg
Open On-Chip Debugger 0.10.0+dev-00200-g16625089 (2017-10-21-08:59)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: tck = 11, tms = 25, tdi = 10, tdo = 9
BCM2835 GPIO config: trst = 8
BCM2835 GPIO config: srst = 24
adapter speed: 500 kHz
adapter_nsrst_delay: 400
none separate
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
dcc downloads are enabled
ed20_init
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG only mode enabled (specify swclk and swdio gpio to add SWD mode)
Info : clock speed 500 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Info : accepting 'telnet' connection on tcp/4444
Open another terminal on the Pi3 and start a telnet session to OpenOCD:

Code: Select all

root@raspberrypi:cd ~/rootToon
root@raspberrypi:telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>
Execute the following commands in the telnet session:

Code: Select all

> soft_reset_halt 
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> reset halt                      
JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
> load_image u-boot.bin 0xa1f00000
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)
> resume 0xa1f00000               
>
The logging on the OpenOCD screen should be like this:

Code: Select all

requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
Warn : NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)
Now the Toon loads the “hacked” u-boot loader which has the password “toon”.

Right after the bootloader starts you get the password prompt in your serial console:

Code: Select all

Autoboot in 2 sec...

Enter the password to interrupt.

The password is: toon
Type in the word toon and press <enter>.

You can now root your Toon with the same procedure as the R6 or R8 U-Boot bootloaders as described in the next section.

If you made it this far, please continue reading on: viewtopic.php?f=87&t=11235#p82533

Start at the “##### Entering (and editing) the boot loader: #####” section.
Attachments
config.zip
OpenOCD config files
(2.25 KiB) Downloaded 972 times
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

To what extent is this different from the stuff I wrote in the rooting manual? I see quite a lot of repetition.
rboers
Starting Member
Starting Member
Posts: 3
Joined: Mon Sep 25, 2017 11:50 am

Re: Rooting Toon (or boxx)

Post by rboers »

There is a LOT of information in your post, but there is not much information on compiling with the right options for OpenOCD and using it on the Raspberry Pi 3.
I was struggling to get OpenOCD working on the Pi3 so I could use it as JTAG debugger for Toon.
I tried to put everything together so other people who want to use the Pi3 don't have to search the internet like I had to do.

Like I said in my post: I couldn't have done it without your post. So, thank you again.
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

Thanks for your explanation and addition. Will compile your info into the rooting manual, so that single document still holds all the info required (individual posts are much harder to find after some time).
rboers
Starting Member
Starting Member
Posts: 3
Joined: Mon Sep 25, 2017 11:50 am

Re: Rooting Toon (or boxx)

Post by rboers »

Thanks, that would be great.
marcelr wrote:Thanks for your explanation and addition. Will compile your info into the rooting manual, so that single document still holds all the info required (individual posts are much harder to find after some time).
VonFlaffenhausen
Starting Member
Starting Member
Posts: 7
Joined: Mon Oct 23, 2017 8:40 am

Re: Rooting Toon (or boxx)

Post by VonFlaffenhausen »

Thank you Rboers!
Your guide helped me out tremendously.
ronalddehaan
Starting Member
Starting Member
Posts: 29
Joined: Mon Aug 21, 2017 8:58 am

Re: Rooting Toon (or boxx)

Post by ronalddehaan »

michel30 wrote:
I have the same problem :-) I played last weekend with it, but no success at all and it sound so easy :-) if you have a manual for dummy's than please share it ;-)
Will do 8)
robgeerts
Starting Member
Starting Member
Posts: 38
Joined: Tue Aug 08, 2017 10:30 pm

Re: Rooting Toon (or boxx)

Post by robgeerts »

I also need a manual for dummies... Or is someone willing to do it for me? I'm living close to Eindhoven ;)
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Rooting Toon (or boxx)

Post by marcelr »

The published manual IS the manual for dummies ;-).
The process can't be done any simpler (unless someone finds a way in through the VPN port, which is highly unlikely).
gielie
Member
Member
Posts: 70
Joined: Thu Nov 02, 2017 11:06 am

Re: Rooting Toon (or boxx)

Post by gielie »

Hi All,
I've been following this tread for a long time and now its time to root my own Toon.
I have one of the first Toons available, i was a tester.
So because i have an early Toon i think i can root my Toon with the password method, without a Jtag.
I only have one question, the combination of wires i have to connect to my Toon is not clear to me.
I read the tutorial and it this is what i see

Code: Select all

pin 11: RxD <-> TxD
pin 12: ??
pin 13: TxD <-> RxD
pin 14: GND <-> GND
Does this mean i don't connect the 3.3 v cable or does this cable goes into pin 12?
Post Reply

Return to “Toon Rooting”