Rooting the new Toon

Everything about rooting Toon 1 (and 2, at some point).

Moderator: marcelr

Re: Rooting the new Toon

Postby TheHogNL » Mon Jun 25, 2018 5:55 pm

Ierlandfan wrote:Cannot find one on Marktplaats.


There was one on MP about a week ago. He was asking 175 for it.
But I think we won't see a lot of them on MP any time soon. And they are not available on the retail market yet (wehkamp, bol.com still have too many old toons on stock).

The only option to get a new Toon is through Eneco which will set you back 275 euro's or a 3 or 4 year subscription.
TheHogNL
Member
Member
 
Posts: 329
Joined: August 2017

Re: Rooting the new Toon

Postby Toonz » Mon Jun 25, 2018 6:50 pm

or find a friendly Eneco engineer on the road to make a deal with.....
Toonz
Advanced Member
Advanced Member
 
Posts: 625
Joined: December 2016

Re: Rooting the new Toon

Postby Ierlandfan » Mon Jun 25, 2018 7:09 pm

Something that crossed my mind: We have a guy who rooted Toon2 and sells this service. His customerbase is not very big sine Toon2 is not widely available. The customer who knows what rooting is and what you can do with it and wants to root Toon2 and goes to Markplaats to find a guy who can root Toon2 is even smaller, the fact that he is not known here (Or is but we don't know about it) is strange sort of speak. He doesn't want the "I was the first" credits and he is not posting here to say that he can. That's sounds a little fishy.

I do believe he can though, it's just there's something strange about the whole setup.
Ierlandfan
Member
Member
 
Posts: 124
Joined: October 2013

Re: Rooting the new Toon

Postby TheHogNL » Mon Jun 25, 2018 7:29 pm

Ierlandfan wrote:I do believe he can though, it's just there's something strange about the whole setup.


Ok you got me there Ierlandfan. It is indeed strange, because it is fake :D

The Toon2 can not be rooted yet...

I had setup this trap to hope to get some information about how to root a Toon 2. I hoped Quby would contact me and try to get that message from MP.
Two things happened.

1) I got a message from MP 3 days later that the advertisement was removed due to complaints. Probably Quby initiated that. However after my response the advertisement was put back again by MP.

2) A user, who's name I will not publish, who is in close contact with Quby/Eneco as being a field tester, was so curious in asking how I was able to root the Toon2. He ultimatly told me that "I probably rooted the same way as Quby does, using the USB port". Not sure if this is just him trying to impress me with bogus information. But it could be that this is the entry which we need to look into further.

So far, I hoped to get more info. But for now it is enough. And, no real response from any customer who wants a rooted Toon2 :lol:
TheHogNL
Member
Member
 
Posts: 329
Joined: August 2017

Re: Rooting the new Toon

Postby Ierlandfan » Mon Jun 25, 2018 10:42 pm

Social engineering crossed my mind while profiling but it seemed the least obvious. Nice! Sorry for messing around, eventhough I deliberately played an open game using the same nickname om MP. Great job fooling everybody!

"Probably rooted the same way as Quby does, using the USB port".

I don't think Quby need that. They have an open VPN connection to the device and are fully in control of the device so they can remotely push/install whatever package they can. Still, that info is usefull! Without having touched the new Toon2, let alone seeing it, I can pretty much guess how it (in theory) can be rooted.
Let's say it depends on commercial decisions which affect technical implementation. We''ll see.
Ierlandfan
Member
Member
 
Posts: 124
Joined: October 2013

Re: Rooting the new Toon

Postby TheHogNL » Tue Jun 26, 2018 6:56 am

Ierlandfan wrote:I don't think Quby need that. They have an open VPN connection to the device and are fully in control of the device so they can remotely push/install whatever package they can. Still, that info is usefull! Without having touched the new Toon2, let alone seeing it, I can pretty much guess how it (in theory) can be rooted.
Let's say it depends on commercial decisions which affect technical implementation. We''ll see.


If they use the live openvpn connection they would never ask Toon1 users to send in their Toon for a official rooting. And as far as I have studied the Toon1 code and BXT binaries I haven't found some command which they can run to run native shell command's on the Toon which are needed to root a Toon.

Can you enlighten me on your theories?
TheHogNL
Member
Member
 
Posts: 329
Joined: August 2017

Re: Rooting the new Toon

Postby marcelr » Thu Aug 16, 2018 3:47 pm

The race is on.

Because I have yet to find a serial port on toon2, I decided to embark on a low-level approach to open up this toon, through JTAG.
As I already wrote in the Toon 2 hardware thread, the new toon has a set of non-populated pads which might fit a 10-pin header, even though we were told they were for some homekit chipset:

Image

I switched on my opened toon2 and started measuring things on these pads. Two observations have emerged so far:

1: The ground connections match the pinout of a JTAG connector for the IMX6 SABRESD board.

Image

2: Voltages measured on these pads correlate with what is to be expected from the rest of the same JTAG port.

Yesterday, the first half of my order of matching connectors for these pads arrived:

Image

Tiny receptacles (Samtec MLE-105-02-G-DV-A), but they fit the pads and alignment holes like a glove. Connections for a homekit chipset indeed ... sure, if you say so ...
When the corresponding headers (Samtec FTMH-105-02-G-DV-A ) arrive, I'll solder these onto this toon, and get going with some JTAG sniffing. Not dissimilar from the approach I took a few years ago for the first model Toon.

Will keep you updated on any progress.
marcelr
Advanced Member
Advanced Member
 
Posts: 868
Joined: May 2012
Location: Ehv

Re: Rooting the new Toon

Postby Ierlandfan » Thu Aug 16, 2018 9:23 pm

I was told this 6 years ago. "If our digitally signed Toon1 is software-wise tampered with we will revoke the VPN certificate (automatically) from the certificate list" Well, don't believe everything they say. Good luck!
Ierlandfan
Member
Member
 
Posts: 124
Joined: October 2013

Re: Rooting the new Toon

Postby marcelr » Fri Aug 17, 2018 1:50 pm

Ierlandfan wrote:... Well, don't believe everything they say. ...

I don't.
And I don't blame them for trying to throw us off the scent. It's all part of the game :-)
marcelr
Advanced Member
Advanced Member
 
Posts: 868
Joined: May 2012
Location: Ehv

Previous

Return to Toon Rooting

Who is online

Users browsing this forum: No registered users and 0 guests