Fully automated rooting script

[TheHogNL]

And doubleposting.. what a shame

But again (and for others who don't read..): https://github.com/ToonSoftwareCollecti ... t-what-now

[Jasper]

Yeah I thought after making a own thread I'd just ask in the right thread. And since all my posts need to be checked by a mod I couldn't edit or delete it.

[yuzocitrus92]

Hi all,

This is my first post here and so far I am loving this forum! Thank you to all who contributed.
I know this question has been raised before, but after numerous tries, it still does not work.

Some basic information:
I'm running a Raspbian stretch inside a virtual machine (VirtualBox)
I've managed to get everything working up to the point where I start the rooter script.
I am using a external Jtag interface, as far I can judge recognized by the rooter.

EDIT: It seemed that it is NOT recognized. Seems I have a incorrect config file.

I start the rooter script with this command:

Code: Select all

sudo python . --serial-port /dev/serial/by-id/usb-FTDI_Dual_RS232-if01-port0 --jtag-hardware ed20 --jtag-available

The problem is with starting openocd, I guess, as I get the following error message:

Code: Select all

INFO:__main__: Starting up...
INFO:__main__: Written private and public key pair to ./id_rsa and ./id.pub, respectively
INFO: rooter: Waiting for Toon to restart
INFO: rooter: Toon has U-boot version 2010.09-R10
INFO: rooter: Loading new bootloader
INFO: rooter: Starting openocd
INFO: rooter: Waiting for 10 seconds
ERROR: Rooter:
Traceback (most recent call last):
 File "./rooter.py", line 211, in start bootloader
   client = telnetlib.Telnet('localhost', 4444)
 File "usr/lib/python2.7/telnetlib.py", line 211, in __init__
   self.open(host, port, timeout)
 File "usr/lib/python2.7/telnetlib.py", line 227, in open
   self.sock = socket.create_connection((host, port), timeout)
 File "usr/lib/python2.7/telnetlib.py", line 575, in create_connection
   raise err
error: [Errno 111] Connection refused
CRITICAL: __main__:[Errno 3] No such process

I've tried reinstalling openocd as mentioned on martens github.. First deleting the old directory.

Could someone have any idea what is going on, or what I can do to resolve? I'm sorry if I'm somewhat unclear.
Regards,

Mike

[TheHogNL]

Just check a few posts ago where another user had openocd issue's. Read them and try them first. For example, what does openocd say when you start it manually (so without toonrooter script).

[yuzocitrus92]

I did, thank you! I guess there was a problem with openocd. When openocd was started in a separate terminal (with sipeed-jtag.cfg and ed20.cfg) it started fine.

EDIT: it did not start fine. I am using a ft2232d based debugger, from sipeed.
distrelec.nl/nl/sipeed-usb-jtag-ttl-ris ... /30163018#

Does anyone know how to get this device working with openocd?

-----


The toonrooter-script whent on, but halted at the second "Waiting for Toon to restart". As i've read before in this thread, this might be a wiring issue and checked that.
The wiring is correct, but the only thing I noticed is that the Sipeed USB-Jtag interface only has a RST pin out, instead of the SRST and TRST pins mentioned in the manual..

Slowly but steadily we advance.... Anyone an idea how to overcome this?

Thanks!!

[jant90]

Hey guys!

How long should "Patching Toon" take? The script is is hanging on that part for at least 20 minutes now.

Some background info on what I did exactly:

1. Using PuTTY I checked the bootloader version: 2010.09-R8. So if I understand correctly I don't need a JTAG connection, just a serial connection is enough to root Toon.
2. I already have Manjaro installed so I decided to try the script there (instead of buying an RPi). I installed the dependencies python2-cryptography and python2-pyserial (I believe that is the correct one for Manjaro).
3. The script won't start without specifying some JTAG hardware so I run the following command (even though I don't have JTAG hardware):
   sudo python2 . --jtag-available --jtag-hardware rpi1 --serial-port /dev/ttyUSB0
4. I reset the Toon when asked and now the script stopped on "Patching Toon".

What do you recommend me to do now?

Here is the full output of the script:

Code: Select all

sudo python2 . --jtag-available --jtag-hardware rpi1 --serial-port /dev/ttyUSB0
INFO:__main__:Starting up...
./sshkeys.py:2: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release.
  from cryptography.hazmat.backends import default_backend
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R8
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot
INFO:rooter:Patching U-Boot
INFO:rooter:Waiting for boot up
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon

[jant90]

I tried to run the script a few more times, also on Ubuntu 18.04 (which is Debian based like the recommended Raspbian), but the script still hangs on "Patching Toon". I'm running the latest version on my Toon and it still boots fine.

Using this command, the last few lines of debug output look like:

Code: Select all

sudo python . --jtag-hardware x --serial-port /dev/ttyUSB0 --output-level DEBUG
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: new high speed USB device using mxc-ehci and address 2
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ # 
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon

[TheHogNL]

I tried to run the script a few more times, also on Ubuntu 18.04 (which is Debian based like the recommended Raspbian), but the script still hangs on "Patching Toon". I'm running the latest version on my Toon and it still boots fine.

Using this command, the last few lines of debug output look like:

Code: Select all

sudo python . --jtag-hardware x --serial-port /dev/ttyUSB0 --output-level DEBUG
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: new high speed USB device using mxc-ehci and address 2
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ # 
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon

Somehow running the patching toon script seems to hang.
Break at that point and start a serial on the /dev/ttyUSB0 manually (I prefer using screen as a serial terminal) and run the script manually

Code: Select all

sh payload/patch_toon.sh

and show us what that is doing

[jant90]

I tried to run the script a few more times, also on Ubuntu 18.04 (which is Debian based like the recommended Raspbian), but the script still hangs on "Patching Toon". I'm running the latest version on my Toon and it still boots fine.

Using this command, the last few lines of debug output look like:

Code: Select all

sudo python . --jtag-hardware x --serial-port /dev/ttyUSB0 --output-level DEBUG
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: new high speed USB device using mxc-ehci and address 2
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ # 
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon

Somehow running the patching toon script seems to hang.
Break at that point and start a serial on the /dev/ttyUSB0 manually (I prefer using screen as a serial terminal) and run the script manually

Code: Select all

sh payload/patch_toon.sh

and show us what that is doing

Thanks for your reply.

It seems screen is not taking any input. I can connect to the serial console but I just see a pointer. If I type anything not appears, the screen stays blank. I tried rebooting my system to Windows and launched PuTTY: same thing, just a pointer in the top left corner and it won't take any input.

Maybe I can manually run the commands the script runs up until that point and see why it hangs. But what are the right commands? I know how to enter the U-Boot password to enter the U-Boot environment but not what to do after that. I keep reading that the manual instructions are outdated so that's why I hoped ToonRooter would do the trick for me .

Btw, Toon software is at version 5.35.100.

[TheHogNL]

I tried to run the script a few more times, also on Ubuntu 18.04 (which is Debian based like the recommended Raspbian), but the script still hangs on "Patching Toon". I'm running the latest version on my Toon and it still boots fine.

Using this command, the last few lines of debug output look like:

Code: Select all

sudo python . --jtag-hardware x --serial-port /dev/ttyUSB0 --output-level DEBUG
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: new high speed USB device using mxc-ehci and address 2
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ # 
INFO:rooter:Transferring payload
INFO:rooter:Patching Toon

Somehow running the patching toon script seems to hang.
Break at that point and start a serial on the /dev/ttyUSB0 manually (I prefer using screen as a serial terminal) and run the script manually

Code: Select all

sh payload/patch_toon.sh

and show us what that is doing

Thanks for your reply.

It seems screen is not taking any input. I can connect to the serial console but I just see a pointer. If I type anything not appears, the screen stays blank. I tried rebooting my system to Windows and launched PuTTY: same thing, just a pointer in the top left corner and it won't take any input.

Maybe I can manually run the commands the script runs up until that point and see why it hangs. But what are the right commands? I know how to enter the U-Boot password to enter the U-Boot environment but not what to do after that. I keep reading that the manual instructions are outdated so that's why I hoped ToonRooter would do the trick for me .

Btw, Toon software is at version 5.35.100.

The reason why you can't type anything is probably because the payload script is still running.
You can start toonrooter with option --boot-only
I believe that the payload (the script etc) should be still there from the last attempt. After the boot-only attempt you should be able to perform actions.

[jant90]

The reason why you can't type anything is probably because the payload script is still running.
You can start toonrooter with option --boot-only
I believe that the payload (the script etc) should be still there from the last attempt. After the boot-only attempt you should be able to perform actions.

Thanks again, here is some output. Looks like the payload was never written even though I see the TX light flashing for some seconds while ToonRooter is "Transferring payload".

Code: Select all

/ # sh payload/patch_toon.sh
sh: can't open 'payload/patch_toon.sh'

/ # ls
HCBv2       configured  lib         proc        sbin        usr
bin         dev         linuxrc     qmf         sys         var
boot        etc         mnt         root        tmp

/ # dmesg
Linux version 2.6.36-R10-h28 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Fri Sep 28 15:51:09 CEST 2018
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 32768
free_area_init_node: node 0, pgdat c03a119c, node_mem_map c03c5000
  Normal zone: 256 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 32512 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 init=/bin/sh
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TM070RDH11
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       285714
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 836/299
UBI: image sequence number:  720367929
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208: dev (254:0)
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
Registered led device: led0
Registered led device: led1
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2020-10-14 15:46:27 UTC (1602690387)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
usb 2-1: new high speed USB device using mxc-ehci and address 2
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: New USB device found, idVendor=148f, idProduct=5370
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0

[TheHogNL]

The reason why you can't type anything is probably because the payload script is still running.
You can start toonrooter with option --boot-only
I believe that the payload (the script etc) should be still there from the last attempt. After the boot-only attempt you should be able to perform actions.

Thanks again, here is some output. Looks like the payload was never written even though I see the TX light flashing for some seconds while ToonRooter is "Transferring payload".

That sounds impossible. The first reason why you got here is because the payload script hangs. If it was not there the debug would show it.

Run the script again, only with --dont-cleanup-payload and when that hangs again, start the script again then with --boot-only. The payload should be there then.
Maybe it is in /root/ and not in / itself?

[TheHogNL]

I have reason to believe something is going wrong with the payload transfer.
I have updated the script (on https://github.com/ToonSoftwareCollective/ToonRooter) to add some extra checks and debug info. Could you run that one and show me the output?

[jant90]

I have reason to believe something is going wrong with the payload transfer.
I have updated the script (on https://github.com/ToonSoftwareCollective/ToonRooter) to add some extra checks and debug info. Could you run that one and show me the output?

Of course, thank you. I really appreciate all you support!

Here is the full debug output. I think there are some useful debug messages there. Also the Toon doesn't reboot when ToonRooter mentions it btw.

Code: Select all

sudo python2 . --jtag-hardware x --serial-port /dev/ttyUSB0 --output-level DEBUG
INFO:__main__:Starting up...
./sshkeys.py:2: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in a future release.
  from cryptography.hazmat.backends import default_backend
INFO:__main__:Written private and public key pair to ./id_rsa and ./id_rsa.pub, respectively
DEBUG:__main__:{"uboot_only": false, "has_jtag": false, "check_uboot": true, "boot_only": false, "reboot_after": true, "cleanup_payload": true, "port": "/dev/ttyUSB0", "jtag_hardware": "x", "ssh_pubkey_data": "ssh-rsa X"}
INFO:rooter:Waiting for Toon to restart
INFO:rooter:Toon has U-Boot version 2010.09-R8
INFO:rooter:Using password to log in
INFO:rooter:Logging in to U-Boot
DEBUG:rooter:
CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Display-bmp: 800 x 480  with 16777216 colors
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is  00:0f:11:06:9c:f4


Enter password - autoboot in 2 sec...
U-Boot>
DEBUG:rooter:Logged in to U-Boot
INFO:rooter:Patching U-Boot
DEBUG:rooter:printenv
bootdelay=2
baudrate=115200
loadaddr=0xA1000000
bootdelay=2
mtdids=nand0=mxc_nand
mtdparts=mtdparts=mxc_nand:1M(u-boot)ro,512K(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mtdparts_kernel=mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
mem=128M
autoload=no
backlight_brightness=50
baudrate=115200
console=ttymxc0
addtty=setenv bootargs ${bootargs} console=${console},${baudrate}
addmtd=setenv bootargs ${bootargs} ${mtdparts_kernel}
nandargs=setenv bootargs ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs
boot_nand=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel; bootm ${loadaddr}
boot_nand_backup=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel-backup; bootm ${loadaddr}
bootcmd=run boot_nand
splashimage=0x180000
ethact=FEC
sn=15-49-034-594
pn=6599-1500-0100
software_compatibility=0
manufacture_date=2015/12
ethaddr=00:0F:11:06:9C:F4
addmisc=setenv bootargs ${bootargs} mem=${mem} lpj=999424

Environment size: 1023/131068 bytes
U-Boot>
DEBUG:rooter:printenv
DEBUG:rooter:bootdelay=2
DEBUG:rooter:baudrate=115200
DEBUG:rooter:loadaddr=0xA1000000
DEBUG:rooter:bootdelay=2
DEBUG:rooter:mtdids=nand0=mxc_nand
DEBUG:rooter:mtdparts=mtdparts=mxc_nand:1M(u-boot)ro,512K(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
DEBUG:rooter:mtdparts_kernel=mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs)
DEBUG:rooter:mem=128M
DEBUG:rooter:autoload=no
DEBUG:rooter:backlight_brightness=50
DEBUG:rooter:baudrate=115200
DEBUG:rooter:console=ttymxc0
DEBUG:rooter:addtty=setenv bootargs ${bootargs} console=${console},${baudrate}
DEBUG:rooter:addmtd=setenv bootargs ${bootargs} ${mtdparts_kernel}
DEBUG:rooter:nandargs=setenv bootargs ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs
DEBUG:rooter:boot_nand=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel; bootm ${loadaddr}
DEBUG:rooter:boot_nand_backup=run nandargs addmtd addtty addmisc; nand read ${loadaddr} kernel-backup; bootm ${loadaddr}
DEBUG:rooter:bootcmd=run boot_nand
DEBUG:rooter:splashimage=0x180000
DEBUG:rooter:ethact=FEC
DEBUG:rooter:sn=15-49-034-594
DEBUG:rooter:pn=6599-1500-0100
DEBUG:rooter:software_compatibility=0
DEBUG:rooter:manufacture_date=2015/12
DEBUG:rooter:ethaddr=00:0F:11:06:9C:F4
DEBUG:rooter:addmisc=setenv bootargs ${bootargs} mem=${mem} lpj=999424
DEBUG:rooter:
DEBUG:rooter:Environment size: 1023/131068 bytes
DEBUG:rooter:U-Boot>
DEBUG:rooter: setenv addmisc setenv bootargs \${bootargs} mem=\${mem} lpj=999424 init=/bin/sh
U-Boot>
INFO:rooter:Waiting for boot up
DEBUG:rooter: run boot_nand

NAND read: device 0 offset 0x300000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h28
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1944236 Bytes = 1.9 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h28 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Fri Sep 28 15:51:09 CEST 2018
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 init=/bin/sh
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
	RCU-based detection of stalled CPUs is disabled.
	Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TM070RDH11
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       285720
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 836/299
UBI: image sequence number:  720367929
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
timeout polling for ULPI device
mxc-ehci mxc-ehci.0: unable to init transceiver, probably missing
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.2
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2020-10-15 10:16:26 UTC (1602756986)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 1-1: new high speed USB device using mxc-ehci and address 2
usb 1-1: New USB device found, idVendor=148f, idProduct=5370
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11 n WLAN
usb 1-1: Manufacturer: Ralink
usb 1-1: SerialNumber: 1.0
/bin/sh: can't access tty; job control turned off
/ # 
INFO:rooter:Transferring payload
INFO:rooter:Transferring payload done. Waiting for toon to finish.
DEBUG:rooter:tar: invalid magic
tar: short read
Terminated
/ # 
INFO:rooter:Transferring payload finished
INFO:rooter:Patching Toon
DEBUG:rooter:H4sICHMhiF8C/3RtcEZOemI1US50YXIA7LZ1TFzR9y+KFdcCxb1Fi7sNLVqKFShW3N3dBlrcoUhx
DEBUG:rooter:/bin/sh: H4sICHMhiF8C/3RtcEZOemI1US50YXIA7LZ1TFzR9y+KFdcCxb1Fi7sNLVqKFShW3N3dBlrcoUhx: not found
INFO:rooter:Cleaning up
DEBUG:rooter:L5Ti7u46OBQbfHCHGWSYyzfv/pKXl5d3/7n3JTe5K+ez18lnLz0r2We7mPo6OJtacCP9LxSeFxEW
/bin/sh: L5Ti7u46OBQbfHCHGWSYyzfv/pKXl5d3/7n3JTe5K+ez18lnLz0r2We7mPo6OJtacCP9LxSeFxEW: not found
/ # 
INFO:rooter:Rebooting
INFO:rooter:Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH

[TheHogNL]

So yes it seems that the tranfering fails. It now has a timeout of 60 seconds and before that it should already have been finished.
Could you check the wiring for bad connections (they seem to be wired ok, but give too much errors i think)?