Rooting Toon (or boxx)

[TheHogNL]

You don't need to backup your NAND anymore.. you now have completly restored your toon with an empty NAND. The rootfs tar gz is enough
(owh and yes the eneco-xxx.tar.gz in the openvpn folder which indeed contains your toon's identity files, vpn keys etc)

[TheHogNL]

And you don't need to walk all rooting toon steps. Just run update-script.sh with option -f and all recommended things are fixed for you.

[imdos]

okay; first attempt to root failed. I have version 4.22.x if I remember correctly.

I have double checked the wires before I connect Toon to the power and launch ToonRooter.
The python program that boots up and stalls at "waiting for toon to restart".

I can see that the Toon reboots after I push the reset; since I can't ping it anymore; but the magic doesn't happen. I will try it again tomorrow.

Do I need to connect a RS232 serial or use minicom? I have used dupont wires (could these be faulty?) and the cabling according to the ToonRooter guide on github.

[TheHogNL]

No you don't need minicom or something like that. The pins on the Pi are serial port 0 (/dev/serial0).
Did you follow the readme correctly? You need to enable this internal serial port and disable the serial console on it using raspi_config

[imdos]

I thought so. However today it worked flawless! I have taken the other end of the 30 dupont wires and did the wiring again and checked the settings in raspi_config.
Those were correct and it didn't ask for a reboot!

Now I'm working on a backup and other stuff. Great work on the project guys

The only thing to mention might be the slight conflicting information from raspi-config. Or maybe an addition to the guide.

In stretch lite with all updates I choose this options:
raspi-config => 5 => P6

Code: Select all

Would you like a login shell to be accessible over       │
          │ serial? 
[X] => No
Would you like the serial port hardware to be enabled? 
[X] => Yes

The serial login shell is disabled                       │
          │ The serial interface is enabled  

Or is it more appropriate to make a incident or something on github itself?

[Erik007]

I have or i had a toon with R10
I rooted it with the rooting-script
wanted to change password, but this was not supported by busybox
So i tryed to replace it with an other version
Did get stock with an error 255 and no busybox

Tryed with manual to get into u-boot
did:
telnet localhost 4444
soft_reset_halt
reset halt
load_image u-boot.bin 0xa1f00000
resume 0xa1f00000

Logged-in with password toon
Get u-boot prompt
did (try to mount nfs):

dhcp
setenv serverip 192.168.1.14
tftpboot 0xa1000000 192.168.1.14:/uImage-nfs

setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:/tftpboot/toon/rootfs,nfsvers=3,nolock,tcp console=ttymxc0,115200 loglevel=8 mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:toon::off panic=0
bootm

This worked for my other toon to reset the filesystem

But ...
this is the output:
Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R07-h21 (marcelr@laptop46.wfw.wtb.tue.nl) (gcc version 4.56
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 32768
free_area_init_node: node 0, pgdat c04b2a14, node_mem_map c04da000
Normal zone: 256 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 32512 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: root=/dev/nfs rw nfsroot=192.168.1.14:/tftpboot/toon/rootf0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 124984k/124984k available, 6088k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffa00000 - 0xffe00000 ( 4 MB)
vmalloc : 0xc8800000 - 0xf4000000 ( 696 MB)
lowmem : 0xc0000000 - 0xc8000000 ( 128 MB)
modules : 0xbf000000 - 0xc0000000 ( 16 MB)
.init : 0xc0008000 - 0xc0025000 ( 116 kB)
.text : 0xc0025000 - 0xc044d000 (4256 kB)
.data : 0xc046a000 - 0xc04b3020 ( 293 kB)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop... 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 244
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-b)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
ULPI ID does not match any known transceiver.
mxc-ehci mxc-ehci.0: unable to init transceiver, probably missing
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R07-h21 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.2
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
USB Serial support registered for cp210x
usbcore: registered new interface driver cp210x
cp210x: v0.09:Silicon Labs CP210x RS232 serial adaptor driver
USB Serial support registered for FTDI USB Serial Device
usbcore: registered new interface driver ftdi_sio
ftdi_sio: v1.6.0:USB FTDI Serial Converters Driver
USB Serial support registered for pl2303
usbcore: registered new interface driver pl2303
pl2303: Prolific PL2303 USB to serial adaptor driver
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208: dev (254:0)
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
Registered led device: led0
Registered led device: led1
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
usbcore: registered new interface driver r871x_usb_drv
nf_conntrack version 0.5.0 (1952 buckets, 7808 max)
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Registering the dns_resolver key type
rtc-isl1208 1-006f: setting system clock to 2019-02-21 12:38:35 UTC (1550752715)
usb 1-1: new high speed USB device using mxc-ehci and address 2
usb 1-1: New USB device found, idVendor=148f, idProduct=5370
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11 n WLAN
usb 1-1: Manufacturer: Ralink
usb 1-1: SerialNumber: 1.0
eth0: Freescale FEC PHY driver [Generic PHY] (mii_bus:phy_addr=1:10, irq=-1)
ADDRCONF(NETDEV_UP): eth0: link is not ready
IP-Config: Gateway not on directly connected network.
Looking up port of RPC 100003/3 on 192.168.1.14
PHY: 1:10 - Link is Up - 100/Full
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Looking up port of RPC 100005/3 on 192.168.1.14
Root-NFS: Server returned error -13 while mounting /tftpboot/toon/rootfs
VFS: Unable to mount root fs via NFS, trying floppy.
List of all partitions:
1f00 512 mtdblock0 (driver?)
1f01 1536 mtdblock1 (driver?)
1f02 3072 mtdblock2 (driver?)
1f03 3072 mtdblock3 (driver?)
1f04 121856 mtdblock4 (driver?)
No filesystem could mount root, tried:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(2,0)
[<c002a3e4>] (unwind_backtrace+0x0/0xf0) from [<c0360dc4>] (panic+0x60/0x190)
[<c0360dc4>] (panic+0x60/0x190) from [<c0008f14>] (mount_block_root+0x1cc/0x20c)
[<c0008f14>] (mount_block_root+0x1cc/0x20c) from [<c0009168>] (prepare_namespac)
[<c0009168>] (prepare_namespace+0x120/0x178) from [<c0008b54>] (kernel_init+0x1)
[<c0008b54>] (kernel_init+0x10c/0x14c) from [<c00268ec>] (kernel_thread_exit+0x)
eth0: no IPv6 routers present

I don't understand:
nfs-image is the same// nfs-fileshare is the same
nothing changed on nfs server - nfsd is in processes
only toon is different

Any idee's
Or do i have to burn u-boot first to toon?

Thanks

[marcelr]

Looks like a server-side problem. NFS server configured properly?
No need to flash the bootloader to flash. That will brick your toon definetly.

[TheHogNL]

Root-NFS: Server returned error -13 while mounting /tftpboot/toon/rootfs

Means permission denied. So check your NFS settings/logs.

[Erik007]

Thanks

After a lot off time and looking on the internet.
Re-installing nfs-server - checking settings ed.
I found out what i had done wrong

I had given my previous toon a prefered ip-address by mac-address
That was 192.168.1.10
I used that address in my exports

When i had to use the nfs server again - a week or so after the first installation,
i didnot exactly remember what the ip address was.
By looking into it; i thought it went well
The ip address from the dhcp-server for toon2 was 192.168.1.100
I did not see the difference -- <Please don't laugh> -- to busy with looking at other things that could have been going wrong...

After a while i changed the exports-file from a reserved ip-address into * <all ip addresses>
And it worked... (Maybe a remark for a change in the manual ???)

I have the other toon now working again ....

So thanks and sorry for the trouble.

[TheHogNL]

(sorry for that smile)

Nice that you managed to get your toon working again. True, the recovery manual needs some improvement. But then again, recovery of the toon should be done with care and therefore some learning curve isn't that bad as you will learn to know your toon better after that.
We could create a recovery script just like the ToonRooter from MartenJacobs which almost automatically will recover your Toon. But that would stop people to learn to do it themselves. Don't know what is better.

[Erik007]

Hi,

I get an message on my Toon: Er is een nieuwe Toon firmware (5.0.4) beschikbaar!

I have looked in the manual, and did look in the directory's for update files:
ls -al /mnt/data/update
drwxr-xr-x 2 root root 160 Feb 18 16:39 .
drwxr-xr-x 4 root root 288 Feb 19 17:39 ..

and
ls /HCBv2/tmp/opkg-cache
ls: /HCBv2/tmp/opkg-cache: No such file or directory

any suggestions where to find the files. (my version is 4.20.7)
Is it possible to lock out /etc/default/iptables.conf by changing filerights to read (chmod 444 iptables.conf)
Or do i get an update error then

[richardklasens]

Hi guys.
I tried today to root my toon as following MarcelR's description.
Everything worked fine, bin/sh, changed passwd, ip tables, but can't install dropbear.
I used the ascii mode to transfer Dropbear to it but, changed the filename to dropbear.ipk >> dropbear.b64 and finaly back to dropbear.ipk with b64 command.
That all worked fine.
When i type in the command opkg install dropbear.ipk it gave some errors with the postinstalls.
Also tried to install the Busybox package from this website but, when i tried, it starts en then tried to install a package from feed.hae.int but then it hangs for a while and tells me that the package can't be installed.\
Any ideas?

Bootloader 2010R8
SW 4.5.3
s/n 15.xx.xx.xx.xx.xx.xx or so

Always post the logs if you say 'postintstall gives errors'
Why are you still using the manual rooting guide? The auto rooter fixes this dropbear postinstall thing.
If you really want to do it manually, check here how the auto rooter installs dropbear: https://github.com/martenjacobs/ToonRoo ... oon.sh#L37

But try "opkg --nodeps install packagename.ipk' so it will not download the file from feed.hae.int.

Fixed it...used the ToonRooter Script with a Rpi3b... WONDERFULL! Thanks for all the coding/programming...
Herooo's!

[TheHogNL]

Hi,

I get an message on my Toon: Er is een nieuwe Toon firmware (5.0.4) beschikbaar!

I have looked in the manual, and did look in the directory's for update files:
ls -al /mnt/data/update
drwxr-xr-x 2 root root 160 Feb 18 16:39 .
drwxr-xr-x 4 root root 288 Feb 19 17:39 ..

and
ls /HCBv2/tmp/opkg-cache
ls: /HCBv2/tmp/opkg-cache: No such file or directory

any suggestions where to find the files. (my version is 4.20.7)
Is it possible to lock out /etc/default/iptables.conf by changing filerights to read (chmod 444 iptables.conf)
Or do i get an update error then

Why? That message is from the TSC menu (our modification). This is the safe way to update a rooted toon. It will protect your iptables.conf

[mAiden]

Would like to thanks marcelr and rboers for the manual. Yesterday I succeeded in rooting my DEV Toon (U-Boot R10) totally manually.
Was stuck on dropbear installation, this gave a 255 error when installing. Well this topic searched through, that gave the solution.

[Toonz]

Would like to thanks marcelr and rboers for the manual. Yesterday I succeeded in rooting my DEV Toon (U-Boot R10) totally manually.
Was stuck on dropbear installation, this gave a 255 error when installing. Well this topic searched through, that gave the solution.

welcome to the club