Rooting Toon (or boxx)

Everything about rooting Toons 1 and 2.

Moderators: marcelr, Toonz, TheHogNL, TerrorSource

Re: Rooting Toon (or boxx)

Postby Toonz » Mon Oct 09, 2017 8:06 pm

makkie2002 wrote:
Toonz wrote:
fkruis wrote:@toonz
You can also use telnet (putty) with esp-link. there you can use CTRL> and <ESC> characters.
fkruis


wasn't aware of this, much easier than the web interface. Thanks
However, submitting control characters still doesn't work here. Somehow lost in translation at the ESP card.
What ESP link software version do you use?


Hi guys, please have a look here: hackaday.io/page/1304-virtual-serial-po ... h-esp-link.
This creates a virtual COM port on your PC which which is connected over IP to your ESPlink.
This should solve some of your "lost in translation" issues :D.


Kudo's. This solution works !! A fully functional terminal connection :-) via the ESP8266 card. I'm happy!
Never ever need to open the Toon again.
member of the Toon Software Collective
User avatar
Toonz
Forum Moderator
Forum Moderator
 
Posts: 1486
Joined: December 2016

Re: Rooting Toon (or boxx)

Postby makkie2002 » Mon Oct 09, 2017 8:36 pm

Toonz wrote:Kudo's. This solution works !! A fully functional terminal connection :-) via the ESP8266 card. I'm happy!
Never ever need to open the Toon again.

8)
makkie2002
Member
Member
 
Posts: 66
Joined: August 2017

Re: Rooting Toon (or boxx)

Postby madz » Thu Oct 12, 2017 7:32 pm

Thanks for all the info. I had an old U-Boot, with the password it was really easy :)

For remote access you all use a VNC client on the mobile phones?
Would be nice to develop an own app for that instead.
madz
Starting Member
Starting Member
 
Posts: 1
Joined: October 2017

Re: Rooting Toon (or boxx)

Postby Ierlandfan » Thu Oct 12, 2017 10:26 pm

For about 15 euro (esp8266/esp32 + TFT) you have a small (3.5 inch) and cheap vnc client. 7 inch is about 25 euro. (Or use phone)
For 30 you can have a Nextion TFT and a ESP32. The Nextion has an editor for easy GUI based display.
For about 22 Euro you have a full blown (Jessie) Linux based Raspberry Zero W (Wifi) and TFT. Python, php , C#, or insert-language.
Imagine the posibilities. We only need to interface with Boxtalk.

Throw in the mix a few z-wave thermostat controlled radiator valves and some coding and we 're done. (Some physical adjustments to the HVAC system is manditory in any case) but coding is the easiest part. The whole system flow (in any case, Toon or other) is the hardest. How it's been handled? I don't know.
I know there's a intake temperature (Controlled by the CV/Toon) and "set" temperature (for the room) and some bypass plumbing so you can set the temperature to some (higher/lower) value in any room and the "return temperature" (These are values your CV is modulating on). That's the mechanical. Coding will be easy.
Ierlandfan
Member
Member
 
Posts: 150
Joined: October 2013

Re: Rooting Toon (or boxx)

Postby glsf91 » Fri Oct 13, 2017 2:26 pm

glsf91 wrote:
Ierlandfan wrote:Basically we can recreate all or almost all the functionality of Toon without subscription (and sometimes even better) so only thing you really loose is the Toon app. (And there's a workaround for that)


Can you tell what the workaround is ?
And will all functions of the app work?


@Ierlandfan: can you tell more about this?
glsf91
Member
Member
 
Posts: 143
Joined: September 2017

Rooting Toon U-Boot R10 using a Raspberry Pi 3

Postby rboers » Sun Oct 22, 2017 11:08 am

!!!!!!! Rooting your Toon is at your own risk! !!!!!!!
!!!!!!! This guide is for education purposes only. If you use this information and damage your Toon, Raspberry Pi or anything else I’m not responsible. !!!!!!!


EDIT: we recommend to use the ToonRooter script: https://github.com/ToonSoftwareCollective/ToonRooter but if you still want to now how we used to do this by hand,.. read below:


=========================================================================================================================

Yesterday I tried to hack a Toon with U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18).
I found that some of the information was incomplete or I could not compare the output of the commands because the output of the commands was not in the articles I found.

This guide describes how you can use the JTAG interface to root your Toon R10 bootloader.

If you have R6 or R8 u-boot image in your Toon you don’t need to use the JTAG method and skip directly to marcelr’s guide on domoticaforum.eu.
https://www.domoticaforum.eu/viewtopic. ... 235#p82533


I cloud not do it without all the work that was put into it from the authors of several forum posts and websites. Thanks guys!!
These are the pages I used:

https://github.com/synthetos/PiOCD/wiki ... TAG-Dongle
https://learn.adafruit.com/programming- ... spberry-pi
https://www.domoticaforum.eu/viewtopic. ... 235#p82533

Here is how I did it. Maybe it can help someone to root their Toon using JTAG.

I had a Raspberry Pi 3 lying around which I turned into a JTAG debugger.

What you need:
- Toon thermostat
- Raspberry Pi 3 (version 2 should also work) with power adapter.
- 11 Dupont wires (2.54mm female-female, 20cm)
- USB to TTL Serial adapter (3.3v)


Step 1: Prepare your Raspberry Pi

First of all you have to install Raspbian on the Pi3.
I used Raspbian Stretch (9.1).
See for instructions:
https://www.raspberrypi.org/documentati ... ng-images/

To configure Wi-Fi for your Pi3 see instructions at:
https://www.raspberrypi.org/documentati ... ess-cli.md

If you want to login to your Pi3 from another PC you have to enable SSH:
https://www.raspberrypi.org/documentati ... ccess/ssh/

Update your Raspbian to the latest version.
Check out: https://www.raspberrypi.org/documentati ... pdating.md


Step 2: Install OpenOCD

Login to your Raspberry Pi.
We will install OpenOCD using the latest version from git repository.

All commands in this guide are executed as user root.

Code: Select all
root@raspberrypi:apt-get install git autoconf libtool make pkg-config libusb-1.0-0-dev libftdi-dev build-essential cmake minicom pkg-config

root@raspberrypi:mkdir ~/rootToon
root@raspberrypi:git clone --recursive git://git.code.sf.net/p/openocd/code openocd
root@raspberrypi:cd openocd
root@raspberrypi:{
./bootstrap &&\
./configure --enable-sysfsgpio\
     --enable-bcm2835gpio \
     --enable-maintainer-mode \
     --disable-werror \
     --enable-ft2232_libftdi \
     --enable-ep93xx \
     --enable-at91rm9200 \
     --enable-usbprog \
     --enable-presto_libftdi \
     --enable-jlink \
     --enable-vsllink \
     --enable-rlink \
     --enable-arm-jtag-ew \
     --enable-dummy \
     --enable-buspirate \
     --enable-ulink \
     --enable-presto_libftdi \
     --enable-usb_blaster_libftdi \
     --enable-ft2232_libftdi\
     --prefix=/usr\
&&\
make -j4
} 2>&1 | tee openocd_build.log



Step 4: Connecting Toon

Open the Toon thermostat and connect the Pi3 JTAG pins and the USB-Serial pins to the Toon JTAG connector.
I used 20cm female-female 2.54mm Dupont wires.
Plug the USB-Serial adapter into a USB-port on your Pi or your computer.

Code: Select all
Connect the JTAG wires
   Toon    wire color   Pi header pin
      2     -white->     24 (TRST)
      3     -gray->      20 (GND)
      4     -darkred->   23 (TCK)
      5     -blue->      25 (GND)
      6     -green->     22 (TMS)
      7     -yellow->    18 (SRST)
      8     -orange->    19 (TDI)
      10    -red->       21 (TDO)


Code: Select all
Connect the serial console
   Toon        wire color   USB-Serial
      11 (TxD)   -white->    RxD (receive)
      13 (RxD)   -gray->     TxD (transmit)
      14 (GND)   -green->    GND (ground)


You can download the zipfile with pictures from this URL: https://1drv.ms/u/s!AqSP1w9Vx6O1htsKtWXctSN2_aBnBg .

Open a serial console application (I used Minicom) and select the USB port where your USB-Serial converter is connected (in my case /dev/ttyUSB0).
The Toon thermostat uses 115200 baud, 8 data-bits, no parity, 1 stop-bit for communication.

Now you have to connect your boiler module (ketel module) to the Toon thermostat and plug-in the poweradapter of the boiler module.

You should now see the bootlog of your Toon in your serial console application.


Step 5: Changing the bootloader

Download the config.zip file which is attached to this post and extract it into ~/rootToon/.
The zip file contains 2 files: raspberrypi.cfg and ed20.cfg.

Start OpenOCD:

Code: Select all
root@raspberrypi:cd ~/rootToon/
root@raspberrypi:openocd -s /usr/share/openocd -f ~/rootToon/raspberrypi.cfg -f ~/rootToon/ed20.cfg
Open On-Chip Debugger 0.10.0+dev-00200-g16625089 (2017-10-21-08:59)
Licensed under GNU GPL v2
For bug reports, read
   http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: tck = 11, tms = 25, tdi = 10, tdo = 9
BCM2835 GPIO config: trst = 8
BCM2835 GPIO config: srst = 24
adapter speed: 500 kHz
adapter_nsrst_delay: 400
none separate
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
dcc downloads are enabled
ed20_init
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG only mode enabled (specify swclk and swdio gpio to add SWD mode)
Info : clock speed 500 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Info : accepting 'telnet' connection on tcp/4444


Open another terminal on the Pi3 and start a telnet session to OpenOCD:

Code: Select all
root@raspberrypi:cd ~/rootToon
root@raspberrypi:telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>


Execute the following commands in the telnet session:

Code: Select all
> soft_reset_halt
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> reset halt                     
JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
> load_image u-boot.bin 0xa1f00000
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)
> resume 0xa1f00000               
>


The logging on the OpenOCD screen should be like this:

Code: Select all
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
Warn : NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)


Now the Toon loads the “hacked” u-boot loader which has the password “toon”.

Right after the bootloader starts you get the password prompt in your serial console:

Code: Select all
Autoboot in 2 sec...

Enter the password to interrupt.

The password is: toon


Type in the word toon and press <enter>.

You can now root your Toon with the same procedure as the R6 or R8 U-Boot bootloaders as described in the next section.

If you made it this far, please continue reading on: https://www.domoticaforum.eu/viewtopic. ... 235#p82533

Start at the “##### Entering (and editing) the boot loader: #####” section.
Attachments
config.zip
OpenOCD config files
(2.25 KiB) Downloaded 499 times
rboers
Starting Member
Starting Member
 
Posts: 3
Joined: September 2017

Re: Rooting Toon (or boxx)

Postby marcelr » Sun Oct 22, 2017 6:28 pm

To what extent is this different from the stuff I wrote in the rooting manual? I see quite a lot of repetition.
marcelr
Global Moderator
Global Moderator
 
Posts: 1149
Joined: May 2012
Location: Ehv

Re: Rooting Toon (or boxx)

Postby rboers » Sun Oct 22, 2017 9:07 pm

There is a LOT of information in your post, but there is not much information on compiling with the right options for OpenOCD and using it on the Raspberry Pi 3.
I was struggling to get OpenOCD working on the Pi3 so I could use it as JTAG debugger for Toon.
I tried to put everything together so other people who want to use the Pi3 don't have to search the internet like I had to do.

Like I said in my post: I couldn't have done it without your post. So, thank you again.
rboers
Starting Member
Starting Member
 
Posts: 3
Joined: September 2017

Re: Rooting Toon (or boxx)

Postby marcelr » Sun Oct 22, 2017 9:19 pm

Thanks for your explanation and addition. Will compile your info into the rooting manual, so that single document still holds all the info required (individual posts are much harder to find after some time).
marcelr
Global Moderator
Global Moderator
 
Posts: 1149
Joined: May 2012
Location: Ehv

Re: Rooting Toon (or boxx)

Postby rboers » Mon Oct 23, 2017 7:37 am

Thanks, that would be great.
marcelr wrote:Thanks for your explanation and addition. Will compile your info into the rooting manual, so that single document still holds all the info required (individual posts are much harder to find after some time).
rboers
Starting Member
Starting Member
 
Posts: 3
Joined: September 2017

Re: Rooting Toon (or boxx)

Postby VonFlaffenhausen » Mon Oct 23, 2017 7:46 am

Thank you Rboers!
Your guide helped me out tremendously.
VonFlaffenhausen
Starting Member
Starting Member
 
Posts: 7
Joined: October 2017

Re: Rooting Toon (or boxx)

Postby ronalddehaan » Tue Oct 24, 2017 6:48 am

michel30 wrote:
I have the same problem :-) I played last weekend with it, but no success at all and it sound so easy :-) if you have a manual for dummy's than please share it ;-)


Will do 8)
ronalddehaan
Starting Member
Starting Member
 
Posts: 29
Joined: August 2017

Re: Rooting Toon (or boxx)

Postby robgeerts » Tue Oct 31, 2017 1:30 pm

I also need a manual for dummies... Or is someone willing to do it for me? I'm living close to Eindhoven ;)
robgeerts
Starting Member
Starting Member
 
Posts: 38
Joined: August 2017

Re: Rooting Toon (or boxx)

Postby marcelr » Tue Oct 31, 2017 6:29 pm

The published manual IS the manual for dummies ;-).
The process can't be done any simpler (unless someone finds a way in through the VPN port, which is highly unlikely).
marcelr
Global Moderator
Global Moderator
 
Posts: 1149
Joined: May 2012
Location: Ehv

Re: Rooting Toon (or boxx)

Postby gielie » Thu Nov 02, 2017 10:14 am

Hi All,
I've been following this tread for a long time and now its time to root my own Toon.
I have one of the first Toons available, i was a tester.
So because i have an early Toon i think i can root my Toon with the password method, without a Jtag.
I only have one question, the combination of wires i have to connect to my Toon is not clear to me.
I read the tutorial and it this is what i see
Code: Select all
pin 11: RxD <-> TxD
pin 12: ??
pin 13: TxD <-> RxD
pin 14: GND <-> GND


Does this mean i don't connect the 3.3 v cable or does this cable goes into pin 12?
gielie
Member
Member
 
Posts: 55
Joined: November 2017

PreviousNext

Return to Toon Rooting

Who is online

Users browsing this forum: No registered users and 0 guests