Rooting Toon (or boxx)

[TheHogNL]

You are not doing what I asked you to do.
try:

Code: Select all

sudo python . --jtag-available --jtag-hardware rpi3

[hans3103]

Hello,

When i type

> load_image u-boot.bin 0xa1f00000

I get this all the time, for the rest everything looks the same as the manual. Any clues? what do i wrong?

couldn't open u-boot.bin

[TheHogNL]

Hello,

When i type

> load_image u-boot.bin 0xa1f00000

I get this all the time, for the rest everything looks the same as the manual. Any clues? what do i wrong?

couldn't open u-boot.bin

That means that u-boot.bin isn't in the current directory from where you have started openocd. Did you download it? You need the u-boot.bin made for the Toon ofcourse. Why not use the toonrooter script?

[knug2]

You are not doing what I asked you to do.
try:

Code: Select all

sudo python . --jtag-available --jtag-hardware rpi3

Thanks for your reply!

Just tried it, getting a bit further but with following result:

Code: Select all

pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available --jtag-hardware rpi3
INFO:__main__:Starting up...
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
INFO:rooter:Halting CPU
INFO:rooter:Loading new image to RAM
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
ERROR:rooter:Unable to log in using password (need JTAG, but it's disabled)

Found a post with same error, but not with a clear solution : domoticaforum.eu/viewtopic.php?f=101&am ... p;start=30. Any feedback on this error?

[TheHogNL]

try again and add --output-level DEBUG

Your output shows that it tries to use the jtag and also seems to patch the toon boot code using openocd but after rebooting it doesn't come up with the expected patched u-boot version. So the DEBUG output hopefully tells a bit more why.

[knug2]

try again and add --output-level DEBUG

Your output shows that it tries to use the jtag and also seems to patch the toon boot code using openocd but after rebooting it doesn't come up with the expected patched u-boot version. So the DEBUG output hopefully tells a bit more why.

Thanks for your reply.

As requested the additional debug info :

Code: Select all

pi@raspberrypi:~/ToonRooter $ sudo python . --jtag-available --jtag-hardware rpi                                                                                                                     3 --output-level DEBUG
INFO:__main__:Starting up...
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
DEBUG:__main__:{"uboot_only": false, "has_jtag": true, "check_uboot": true, "boot_only": false, "reboot_after": true, "cleanup_payload": true, "port": "/dev/serial0", "jtag_hardware": "rpi3", "ssh_pubkey_data": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDr//1NPqhHvbxaGB5vW4h41Noq+uZQhaZbsE6oVZgd7f82o1+7038QDG96q5a0z7G7Yi380fpNe8DRe6wgvYE6v0goIl8UDJ58bF/PW7BzZ92Z0rwHhos4lfDbFo+MueTloagoXEPSHOoV/0xUp794P9MARIUJu0o/jotuXmFGFNrKl4NZ1fLqIdbRdr6/4iHIhCUmMgpFOiFDeitsq7OjqaI/WkrhEHAhEErhpKwvUZ4KR6krDXUT+hmgg8J2ueSIVUpUG3Mb+15m4uYkVSb9Zh8GC8mgGrloJQqAWTPuGthjTgN5nOlrrSQ4jtbO6oA212DQAl1/+x/sFNaLNbT9"}
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
INFO:rooter:Loading new bootloader
INFO:rooter:Starting openocd
INFO:rooter:Waiting for 10 seconds
DEBUG:rooter:Open On-Chip Debugger
>
INFO:rooter:Halting CPU
DEBUG:rooter:soft_reset_halt
requesting target halt and executing a soft reset
Failed to halt CPU after 1 sec
>
DEBUG:rooter:reset halt
JTAG scan chain interrogation failed: all zeroes
Check JTAG interface, timings, target power, etc.
Trying to use configured scan chain anyway...
imx27.etb: IR capture error; saw 0x00 not 0x01
Bypassing JTAG setup events due to errors
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
timed out while waiting for target halted
TARGET: imx27.cpu - Not halted
>
INFO:rooter:Loading new image to RAM
DEBUG:rooter:load_image assets/u-boot.bin 0xa1f00000
Target not halted
no working area available, falling back to memory writes
target not halted

>
INFO:rooter:Starting up new image
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R10
ERROR:rooter:Unable to log in using password (need JTAG, but it's disabled)

Looks like something is wrong with the JTAG settings?

[TheHogNL]

Looks like something is wrong with the JTAG settings?

Yes maybe the pi4 isn't jtag pin compatible with the pi3. Or the jtag cables are connected wrong.
Someone with a pi4 need to do some testing to make this work on a pi4.

[knug2]

Looks like something is wrong with the JTAG settings?

Yes maybe the pi4 isn't jtag pin compatible with the pi3. Or the jtag cables are connected wrong.
Someone with a pi4 need to do some testing to make this work on a pi4.

OK, managed to root my Toon using a RPi4, created a rpi4.cfg based on rpi3.cfg with some different JTAG settings :

Working code for a rpi4:
( btw i've informed MartenJacobs, and he will add the cfg file to the rooter script )

Code: Select all

#
# Config for using Raspberry Pi's expansion header
#
# This is best used with a fast enough buffer but also
# is suitable for direct connection if the target voltage
# matches RPi's 3.3V and the cable is short enough.
#
# Do not forget the GND connection, pin 6 of the expansion header.
#

interface bcm2835gpio

bcm2835gpio_peripheral_base 0xFE000000

# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
# These depend on system clock, calibrated for stock
# Raspi3 BCM2837 (1200Mhz):
# bcm2835gpio_speed SPEED_COEFF SPEED_OFFSET
bcm2835gpio_speed_coeffs 236181 60

# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
# Header pin numbers: 23 22 19 21
 bcm2835gpio_jtag_nums 11 25 10 9

# or if you have both connected,
# reset_config trst_and_srst srst_push_pull

# Each of the SWD lines need a gpio number set: swclk swdio
# Header pin numbers: 22 18
#bcm2835gpio_swd_nums 25 24

# If you define trst or srst, use appropriate reset_config
# Header pin numbers: TRST - 26, SRST - 18

bcm2835gpio_trst_num 8
# reset_config trst_only

bcm2835gpio_srst_num 24
#reset_config srst_only srst_push_pull
#reset_config trst_and_srst separate

# or if you have both connected,
# reset_config trst_and_srst srst_push_pull
adapter_khz 500
adapter_nsrst_delay 400
reset_config none

Update script has installed al the necessary stuff. Happy with everything so far

[TheHogNL]

Great!
Will pull the change from MartenJacobs github to TSC github when adds it or if it takes to long I will add it myself

[elmex]

heren,

hopelijk kunnen jullie mij verder helpen, ik heb pas een 2e hands toon gekocht met firmware R10. Nu probeer ik 'm te rooten.. wat heb ik geprobeerd:
- https://github.com/martenjacobs/ToonRooter, waarbij het installeren van opencd van rboers heb gevolgd. via pi3 met de aangegeven aansluitingen gemaakt.
Nu lijkt het downgraden goed te gaan (sudo python . --jtag-available --output-level DEBUG), zie bijlage log. Maar nadat ik de toon via usb to ttl benader dan zie ik nog steeds vrolijk nog de oude r10 firmware en de wachtwoord werkt niet. Zie ook bijlage..

Toen geprobeerd via de walkthrough van rboers gevolgd (viewtopic.php?f=87&t=11230&start=210#p83745), via pi3 met de aangegeven aansluitingen gemaakt. ik heb de uboot bin van ToonRooter gebruikt , ook hier na een reboot weer r10..


wat doe ik fout ??, ik zit hier al drie dagen mee te klooien

[TheHogNL]

De R10 uboot blijft gewoon. Hij wordt alleen 1 malig overschreven (in het geheugen geladen) door openocd zodat je bij de eerste volgende boot zonder wachtwoord in uboot komt.
Je kan dan wel de password overschrijven, zie hiervoor viewtopic.php?f=101&t=12480&p=91456&hil ... ord#p91456, zodat je de volgende keer je eigen password kan gebruiken. Maar hij bljift gewoon R10 dus (met als default het onbekende wachtwoord).

En belangrijskte, eind van je toonrooter log: INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH
Dus hij is gewoon geroot.

[elmex]

De R10 uboot blijft gewoon. Hij wordt alleen 1 malig overschreven (in het geheugen geladen) door openocd zodat je bij de eerste volgende boot zonder wachtwoord in uboot komt.
Je kan dan wel de password overschrijven, zie hiervoor viewtopic.php?f=101&t=12480&p=91456&hil ... ord#p91456, zodat je de volgende keer je eigen password kan gebruiken. Maar hij bljift gewoon R10 dus (met als default het onbekende wachtwoord).

En belangrijskte, eind van je toonrooter log: INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH
Dus hij is gewoon geroot.

maar als ik via usb-ttl herstart dan kan ik niet inloggen met de opgegeven wachtwoord (in mijn geval A01OO5SG) bij de melding 'enter password' of moet ik de Toon aansluiten op mijn netwerk (via kabel) en dan via ssh benaderen?
want als ik 'm nadat geroot heb zie ik usb-ttl
"
U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18)

CPU: Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM: 128 MiB
NAND: 128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In: serial
Out: serial
Err: serial
Configure for LCD: TDA-WVGA0700F00048
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
Display-bmp: 800 x 480 with 16777216 colors
Net: FEC
Warning: FEC MAC addresses don't match:
Address in SROM is 00:00:20:03:00:00
Address in environment is 00:0f:11:07:b0:fd


Enter password - autoboot in 2 sec...

NAND read: device 0 offset 0x300000, size 0x300000
3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
Image Name: Linux-2.6.36-R10-h28
"

[TheHogNL]

Ja via SSH.
Om via console (na het booten in linux, dus niet de uboot) in te loggen met root moet je de aangepaste busybox installeren maar dat is niet nodig als je gewoon met SSH wilt werken.
Om je uboot wachtwoord aan te passen volg je dus de post die ik hier boven quote.

[elmex]

Ja via SSH.
Om via console (na het booten in linux, dus niet de uboot) in te loggen met root moet je de aangepaste busybox installeren maar dat is niet nodig als je gewoon met SSH wilt werken.
Om je uboot wachtwoord aan te passen volg je dus de post die ik hier boven quote.

oh man.. harstikke bedankt.
dus gebruik toonrooter,wachten totdat 'INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH' wordt weergegeven.
Vanaf dat moment moet ik de toon via ssh benaderen en dan de opgegeven wachtwoord hiervoor gebruiken.
..

[TheHogNL]

oh man.. harstikke bedankt.
dus gebruik toonrooter,wachten totdat 'INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH' wordt weergegeven.
Vanaf dat moment moet ik de toon via ssh benaderen en dan de opgegeven wachtwoord hiervoor gebruiken.
..

Ja precies Zo makkelijk is het dus eigenlijk. Maar je hebt vast in die drie dagen veel geleerd