Toon 2 hardware.

Forum about Toon hardware, both versions 1 and 2 of Toon

Moderator: marcelr

Toon 2 hardware.

Postby marcelr » Fri Aug 03, 2018 12:52 pm

Recently, I received a toon 2 from Quby, to have a look at it in terms of security. Not that I am a security expert (far from it). It was sent to me following a visit TheHogNL, TerrorSource and I paid to Quby, we were invited for a mini hackathon. With our track record on rooting toon and extending and replacing core software on Toon, we were probably good candidates for intrusion testing.

Toon 2 has been designed to be hard to open, and hard to root.

Opening toon 2 is a lot harder than opening toon 1. While for toon 1 you can do everything with your bare hands, for toon 2 you will need the right tools to open it. The reason is twofold: the touchscreen, with PCB attached at the back, is sunk into a recess of the casing, making access to the clips that hold both together hard. You cannot easily lift the screen out of the backing. If you try to open it in the wrong way, the screen is irreparably damaged. The second reason is that access to the clips is hampered by a set of bridges cast into the backing. With tools that are too wide, you cannot easily loosen the clips holding backing and screen together.

Anyway, with a bit of juggling and sweating, I got the screen out, in one piece.

The construction of the screen + PCB assembly is much cleaner than in Toon 1. Both parts (screen and PCB), are mounted back-to-back on a single frame, which clicks into the backing. No more fuss with wifi and zwave antenna wires, or screen-to-PCB flatcables.

The touchscreen is connected to the PCB by two very short flatcables. If you want to remove the PCB completely, you will need specific tools or very agile and small fingers.

The following picture shows the parts on the PCB:
Image

The numbers indicate the following parts:

Code: Select all
#      part                   manufacturer     type number   

1:     Processor              Freescale (NXP)  iMX6SX
2:     RAM                    Samsung          K4B2G1646F BCK0 (2x)
3:     z-wave chipset         Sigma designs    SD3502
4:     WiFi/Bluetooth chipset Murata           1LN
5:     Power control          Freescale        PF3000
6:     Zigbee chipset         GreenPeak        GP711
7:     Realtime clock         Ambiq micro      AM0805
8:     Ultrasonic sensor      Murata           A6Z
9:     Reset button           OEM
10:    USB A connector        OEM
11:    Buzzer                 OEM              SFM-1224B03
12:    Light sensor           Lite-on          LTR-303ALS-01
13:    Power connector        OEM
14:    Air quality sensor     CCS (now Ams)    CCS801
15:    Humidity/temp sensor   Ams              ENS210 (2x)
16:    Flash                  Samsung          KLM4G1FEPD (4GiB)


Some parts are the same as on the first toon (connector, buzzer). Processor, memory, flash are major upgrades, as is the screen (from 800*480 to 1024*600 resolution). Extensions: zigbee support, humidity detection, air quality detection, ambient light detection, and ultrasound proximity detection. The wifi/bluetooth chipset is a bit disappointing, in the sense that it only supports 2.4 GHz networks, whereas 5GHz is omnipresent today. If anyone's interested, I'll make data sheets available for each of these components on the forum file server.

Quby said during our visit that, unlike for toon 1, no development package for toon 2 will be made available to the public. Most code on toon 2 (bootloader, kernel, OS, services) are open source, and readily available from the internet. Not sure if this is entirely compliant with the (L)GPL, but without root access, these packages are quite useless anyway. During our visit, we had a peek inside, the machine runs a linux kernel version 4.9, and boots from u-boot 2014. The processor has fuse support, and this is used for signing the boot software, according to one of the hardware engineers.

I will add some more pictures later, will need to take them first :-)
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby Toonz » Fri Aug 03, 2018 9:34 pm

Any clue where the serial port and JTAG connectors are located?
Toonz
Advanced Member
Advanced Member
 
Posts: 716
Joined: December 2016

Re: Toon 2 hardware.

Postby marcelr » Sat Aug 04, 2018 10:53 am

According to the hardware engineer we discussed with, there's no JTAG access, but there is a serial port. The 10 soldering pads (just below item 6) allegedly were meant for a homekit chipset, but apparently, after the PCB design was finished they realized that homekit support can be done in software. Hmmm... I haven't been able to find a homekit chipset that fits the pads on the PCB.

This part fits the soldering pads perfectly:
Image

I think I'll order a bunch of those and solder them onto the PCB. See what's going on there ...
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby TheHogNL » Sun Aug 05, 2018 10:52 am

Just thinking .. could they have used the power connectors for the serial com port connections?
They already use this towards the ketelmodule so maybe they have added a serial com port to this depening on what device is connected to it?
TheHogNL
Member
Member
 
Posts: 436
Joined: August 2017

Re: Toon 2 hardware.

Postby marcelr » Sun Aug 05, 2018 11:13 am

Hmmm... interesting thought. RS485 is a 2-wire protocol. Not sure how this interferes with the boiler module communication (also 2-wire serial, 4800 baud IIRC).
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby michel30 » Sun Aug 05, 2018 5:51 pm

I think you need an USB stick that will boot up.
After that you can access the Toon with an special password and after that you can edit everything.
michel30
Member
Member
 
Posts: 168
Joined: August 2017

Re: Toon 2 hardware.

Postby TheHogNL » Sun Aug 05, 2018 6:53 pm

michel30 wrote:I think you need an USB stick that will boot up.
After that you can access the Toon with an special password and after that you can edit everything.


You have any information that adds to your thoughts? Or is it just a wild guess?

I did insert a USB stick into my toon2 during boot recently but no activity whatsoever on the stick itself. So if your story is true, than they also only allow one specific kind of usb stick.
TheHogNL
Member
Member
 
Posts: 436
Joined: August 2017

Re: Toon 2 hardware.

Postby michel30 » Mon Aug 06, 2018 1:33 pm

it just a wild guess.
michel30
Member
Member
 
Posts: 168
Joined: August 2017

Re: Toon 2 hardware.

Postby marcelr » Mon Aug 06, 2018 1:45 pm

Thought so, it's a bit more complicated than that I'm afraid, and BTW this topic is about hardware, not about rooting.
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby Niwla » Thu Aug 09, 2018 7:33 pm

Would love to see more pictures! :arrow: interface with new resolution, front of the screen.
Niwla
Starting Member
Starting Member
 
Posts: 2
Joined: May 2018

Re: Toon 2 hardware.

Postby marcelr » Fri Aug 10, 2018 9:02 am

Toon 2 comes in a cardboard box, sealed with PE film:

Image

The box itself looks a bit cheaper than the original one used for Toon1. Not that it matters, packaging material is discarded by most people anyway, for a good reason.
It contains three items:
Image

A brief manual, a box containing the display and mounting bracket, and a box containing peripherals.

While the outer box looks a bit basic, the inner two boxes have a much better design than the original Toon 1 box:

Image

Note that toon 2 does not come with the optical sensors for ferraris meters, and in the left box, the rim protruding over the display's edge is clearly visible. Intrusion protection number 1.
The meter adapter no longer has the Eneco logo printed on it, indicating the international aspirations of Quby.

The shape of the mounting bracket has slightly changed: It now features a slab of plastic, to reflect the ultrasound (US) coming from the US detector towards the room where toon is mounted. By having this slab of plastic, the functionality of the ultrasound sensor becomes independent of the surface features of the wall that toon is mounted on:

Image

The rear view of the new toon is not very spectacular: Essentially the same as the old one, only the backwards facing US sensor is a real novelty here:

Image

When you take this Toon (carefully) apart, the second intrusion protection shows, the bridges in each of the eight clip connectors (two on each side) really make loosening the display from the backing difficult:

Image

(but nevertheless, it can be done, as you see ;-) ).

When you switch it on, you will get the very same user interface as on the older Toon, which is not really surprising. Quby haven't rewritten their entire codebase for this device:

Image

Oh, by the way, this last picture is from a toon2 with the backing removed, I will reassemble it when my analysis of the hardware is finished, and there's still a long way to go ...
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby Niwla » Fri Aug 10, 2018 6:06 pm

Thanx for the update. Somehow I find the new display a bit more boring than the current one.

"Beschikbaar vanaf september 2018 / Available from september 2018" :D
Niwla
Starting Member
Starting Member
 
Posts: 2
Joined: May 2018

Re: Toon 2 hardware.

Postby marcelr » Fri Aug 10, 2018 6:09 pm

Niwla wrote:"Beschikbaar vanaf september 2018 / Available from september 2018" :D

Says who?
It's been on the market since last april ...
marcelr
Advanced Member
Advanced Member
 
Posts: 925
Joined: May 2012
Location: Ehv

Re: Toon 2 hardware.

Postby TerrorSource » Fri Aug 10, 2018 6:38 pm

Meteradapter is not for international use. There’s a squared shaped meter adapter for boxxx for example.

Oh. And there are no analog sensors since mid-2015 in the box. If needed, Eneco will send them afterwards.
TerrorSource
Member
Member
 
Posts: 163
Joined: May 2017

Re: Toon 2 hardware.

Postby TheHogNL » Sun Aug 26, 2018 6:49 pm

If someone else wants to join the toon2 game, there is now a toon2 on marktplaats: https://www.marktplaats.nl/a/doe-het-ze ... ousPage=lr
TheHogNL
Member
Member
 
Posts: 436
Joined: August 2017

Next

Return to Toon Hardware

Who is online

Users browsing this forum: No registered users and 1 guest