Rooting the new Toon

[marcelr]

Prior to the presentation of Toon 2, today at Eneco, TerrorSource, TheHogNL and I had a short hack-a-toon at Quby.
The hardware and software developers did a good job at sealing the new toon against intrusion, so far we haven't got in.
(It would have been a bit disappointing if we had managed to open and root it in a single short session). But the game is on .

To assist us in our quest, at departure, Quby handed us a few tools that may help us achieving our goal:

[Ierlandfan]

Ahh wel, maybe need some bigger screwdriver this time
I was expecting a pizza-slicer but I do like those!

[TheHogNL]

Ahh wel, maybe need some bigger screwdriver this time
I was expecting a pizza-slicer but I do like those!

Just opening the new toon is possible. However the glass screen is easily broken so it must be done very carefully.
Once you have opened a new toon before, you become more experienced and will probably open it the next time without breaking things anymore.

On our visit we managed to open a new toon within 10 minutes. However I did have some experience on my broken Toon before and we did have a opened toon as an example next to it.

If rooting the new toon is possible just like the old one using cables inside the toon, I expect some broken screens if unexperienced users try to do it themselves. Therefore, rooting new toons on the hardware side will probably be a service for a few people to do for the rest of the community.

It would be nice if we can figure out a way to root a Toon using software only. The new toon uses exactly the same software as the old one (same protection levels). So this game is on also. I challange all forum users to figure out a software side rooting on your own old Toons. This then would probably be possible on the new Toon also. One thing, the dhcp client on the toons is already patched to a new version so the earlier mentioned remote execution possibility on the dhcp client is not possible anymore (this was never succesfully done, but the dhcp client is now patched).

[TerrorSource]

Ahh wel, maybe need some bigger screwdriver this time
I was expecting a pizza-slicer but I do like those!

Screwdrivers a no-go for opening the new Toon. special sizes prying-tools are required to distribute the force onto the plastic clips.
The digitizer and screen are in different layers to scratching the digitizer/plastic inside is almost guaranteed.
It is almost always visible when the new Toon was opened by hand so i expect not only some broken screens but also stratches on the edge of the digitizer and scratches on the inside's plastic holders. So Eneco/Quby will find out if a returned Toon 2 was opened or not.

[bwbboot]

Marcelr, TheHogNL and others.. smart move from Eneco to invite you guys. Hopefully you did not sign any NDA or other agreement that limits you from posting and sharing details about Toon2... Can you confirm?

[Toonz]

I was not asked to sign anything

[marcelr]

We signed an agreement pertaining only to the meeting itself. It boiled down to us not trying to break into quby's systems, and to not disseminate information that had been announced as being confidential. Not that they gave us any information of that sort, these guys aren't stupid .

So, there will be more information to come, it still needs some processing (by me, among others).

[Rudolf]

Please don't disclose any rooting methods (yet). We don't want Quby to fix these exploits before we can get our hands on one.

[Toonz]

Please don't disclose any rooting methods (yet). We don't want Quby to fix these exploits before we can get our hands on one.

Absolutely, if we find an entry point we will disclose it only when it makes sense to do so.
Rooting is one thing, but being able to complile modules, create ipk's, rebuild the ToonStore etc for Toon 2 will take quite some time.
In my view all of this should be ready before we go public with anything should we find it.

[marcelr]

Apparently, the new toon has been rooted:

https://www.marktplaats.nl/a/doe-het-ze ... ousPage=lr

The seller is (AFAIK) not related to this forum. Nevertheless, if you are ready to pay the price, tell us about your experience .

[Toonz]

Nice. Looking forward to learn how he did it

[TerrorSource]

Me too! Mostly because Quby mentioned that the Toon2 is really hard to root or not even possible to root.
The front glass will break easily when opened so i hope that he has a way to avoid that to happen.

Far most interesting is that it looks that this person is not related to this forum...

[Rudolf]

Sinds kort mogelijk; het rooten van de nieuwe toon 2 van Eneco. Wat anderen niet kunnen kan ik wel! Gegarandeerd succes! Uiteraard root ik ook de oude toon voor je als je dat wil voor het helft van het geld. Opsturen en retourzenden van je Toon is voor jouw rekening. In overleg mag je ook langskomen maar het rooten zelf laat ik je niet zien omdat ik dit liever geheim wil houden.

Too bad he states that he intends to keep his method a secret.
Good to know that it's doable; that means you guys should keep trying.

[marcelr]

Good to know that it's doable; that means you guys should keep trying.

Why wait for someone else to do it? Don't let anything hold you back

[Ierlandfan]

Anybody already has a Toon2? Cannot find one on Marktplaats.