Page 23 of 30

Re: Fully automated rooting script

Posted: Mon Jun 10, 2019 10:40 pm
by Darkje
@martenjacobs, Just bought a seconden hand toon. Rooted IT wit tour script with a raspberry pi. Worked really awesome. Made my own cable set 11 pin cables. Pulled them out of a old pc. great work.

Re: Fully automated rooting script

Posted: Wed Jul 03, 2019 9:50 pm
by romeo
Hi all,

I have a toon and raspberry and now i want to use the fully automated rooting script.
I have the cables and neccessary software but i am not sure how to connect.

Of course the dupont wires go from raspberry to toon, but should the toon also needs power from the cv?
Or are these 11 dupont wires enough?

Hope to hear?

Re: Fully automated rooting script

Posted: Thu Jul 04, 2019 9:02 am
by marcelr
You will need to hook-up toon to its own power supply. The dupont wires will not deliver the required 24V/0.5A to your toon ;-) .

Re: Fully automated rooting script

Posted: Thu Jul 04, 2019 6:47 pm
by alfred8383
I've just run the fully automatic root script with a raspberry pi. It ens with: Your Toon is now rooted. Please wait for it to boot up and try to log in using SSH

I've connected the display again and boot the toon but I don't see anything different. It's still the same as far i can see. I

'm looking for the manual of the autoroot script but i can only find this page: https://github.com/martenjacobs/ToonRooter/

Actually i'm looking for a manual what the next steps are after rooting the Toon and how I will figure out that my toon is really rooted.


Sorry probably i'm not looking at the right place, but o=i've been searching for hours already :-(

Thank you!

Re: Fully automated rooting script

Posted: Thu Jul 04, 2019 7:10 pm
by TheHogNL
So, your toon is now rooted.
See also https://nl.wikipedia.org/wiki/Rooting

It only means that you can login to the Toon now using the password provided by the rooter script and a proper SSH client.

Next step would probably be installing some custom software and update the toon software. But that is your own choice :)

Re: Fully automated rooting script

Posted: Tue Jul 09, 2019 4:58 pm
by alfred8383
TheHogNL wrote:So, your toon is now rooted.
See also https://nl.wikipedia.org/wiki/Rooting

It only means that you can login to the Toon now using the password provided by the rooter script and a proper SSH client.

Next step would probably be installing some custom software and update the toon software. But that is your own choice :)
Thanks. Its working now.

Re: Fully automated rooting script

Posted: Sun Jul 14, 2019 2:33 pm
by Flarrestein
mAiden wrote:If Toon ask you for runlevl. Then you're inittab is broken. Will look if i can post a inittab for Toon1 today.
After using the auto rooting script is used the update script and did a reset.
So I have gotten into the same situation with the runlevl prompt.

When I try to use the U-boot password 'toon' I don't get the U-boot prompt so I am unable to repair the innittab file.
Anybody have an idea how to fix this?

Code: Select all

U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18)

CPU:   Freescale i.MX27 at 400.168 MHz

Prodrive B.V. ED2.0
DRAM:  128 MiB
NAND:  128 MiB
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
In:    serial
Out:   serial
Err:   serial
Configure for LCD: TDA-WVGA0700F00048
LCD: Initializing LCD frambuffer at a1400000
LCD: 800x480, pbb 4
LCD: Drawing the logo...
Display-bmp: 800 x 480  with 16777216 colors
Net:   FEC
Warning: FEC MAC addresses don't match:
Address in SROM is         00:00:20:03:00:00
Address in environment is  00:0f:11:08:1a:53


Enter password - autoboot in 2 sec...
toon

NAND read: device 0 offset 0x300000, size 0x300000
 3145728 bytes read: OK
## Booting kernel from Legacy Image at a1000000 ...
   Image Name:   Linux-2.6.36-R10-h28
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1944236 Bytes = 1.9 MiB
   Load Address: a0008000
   Entry Point:  a0008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.36-R10-h28 (jbraam@dvl) (gcc version 4.5.3 20110223 (prerelease) (GCC) ) #1 PREEMPT Fri Sep 28 15:51:09 CEST 2018
CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Prodrive B.V ED2.0
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: ubi.mtd=4 root=ubi0:rootfs rw rootfstype=ubifs mtdparts=mxc_nand:512K@0x00100000(u-boot-env)ro,1536K(splash-image),3M(kernel),3M(kernel-backup),119M(rootfs) console=ttymxc0,115200 mem=128M lpj=999424 lcd=TDA-WVGA0700F00048
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB = 128MB total
Memory: 126092k/126092k available, 4980k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    DMA     : 0xffa00000 - 0xffe00000   (   4 MB)
    vmalloc : 0xc8800000 - 0xf4000000   ( 696 MB)
    lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .init : 0xc0008000 - 0xc0022000   ( 104 kB)
      .text : 0xc0022000 - 0xc0367000   (3348 kB)
      .data : 0xc037e000 - 0xc03a17a0   ( 142 kB)
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:272
MXC IRQ initialized
MXC GPIO hardware
Console: colour dummy device 80x30
Calibrating delay loop (skipped) preset value.. 199.88 BogoMIPS (lpj=999424)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Configured for LCD: TDA-WVGA0700F00048
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource mxc_timer1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
msgmni has been set to 246
io scheduler noop registered (default)
imx-fb imx-fb.0: PreserveUBootFramebuffer(1): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: PreserveUBootFramebuffer(2): xres=800, yres=480 [skip _update_lcdc]
Console: switching to colour frame buffer device 100x30
imx-fb imx-fb.0: fb0: DISP0 BG fb device registered successfully.
imx-fb imx-fb.0: PreserveUBootFramebuffer(3): xres=800, yres=480 [skip _update_lcdc]
imx-fb imx-fb.0: fb1: DISP0 FG fb device registered successfully.
Serial: IMX driver
imx-uart.0: ttymxc0 at MMIO 0x1000a000 (irq = 20) is a IMX
console [ttymxc0] enabled
imx-uart.1: ttymxc1 at MMIO 0x1000b000 (irq = 19) is a IMX
imx-uart.2: ttymxc2 at MMIO 0x1000c000 (irq = 18) is a IMX
NAND device: K9F1G08U0E detected, disabling sub-page writes
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks
RedBoot partition parsing not available
5 cmdlinepart partitions found on MTD device mxc_nand
Creating 5 MTD partitions on "mxc_nand":
0x000000100000-0x000000180000 : "u-boot-env"
0x000000180000-0x000000300000 : "splash-image"
0x000000300000-0x000000600000 : "kernel"
0x000000600000-0x000000900000 : "kernel-backup"
0x000000900000-0x000008000000 : "rootfs"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       221182
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            119 MiB
UBI: number of good PEBs:        952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 952
UBI: number of PEBs reserved for bad PEB handling: 9
UBI: max/mean erase counter: 682/231
UBI: image sequence number:  1998888627
UBI: background thread "ubi_bgt0d" started, PID 309
at25 spi0.0: 32 KByte at25640B eeprom, pagesize 64
spi_imx spi_imx.0: probed
FEC Ethernet Driver
fec_enet_mii_bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
mxc-ehci mxc-ehci.0: initializing i.MX USB Controller
mxc-ehci mxc-ehci.0: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.0: Work around for USB enabled
ULPI transceiver vendor/product ID 0x0424/0x000d
mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 1
mxc-ehci mxc-ehci.0: irq 56, io mem 0x10024000
mxc-ehci mxc-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: Freescale On-Chip EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb1: SerialNumber: mxc-ehci.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mxc-ehci mxc-ehci.2: initializing i.MX USB Controller
mxc-ehci mxc-ehci.2: portsc setup 1: 0x80000000
mxc-ehci mxc-ehci.2: Work around for USB enabled
mxc-ehci mxc-ehci.2: Freescale On-Chip EHCI Host Controller
mxc-ehci mxc-ehci.2: new USB bus registered, assigned bus number 2
mxc-ehci mxc-ehci.2: irq 55, io mem 0x10024400
mxc-ehci mxc-ehci.2: USB 2.0 started, EHCI 1.00
usb usb2: New USB device found, idVendor=1d6b, idProduct=0002
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: Freescale On-Chip EHCI Host Controller
usb usb2: Manufacturer: Linux 2.6.36-R10-h28 ehci_hcd
usb usb2: SerialNumber: mxc-ehci.2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
input: TSC2007 Touchscreen as /devices/virtual/input/input0
rtc-isl1208 1-006f: chip found, driver version 0.3
rtc-isl1208 1-006f: rtc core: registered rtc-isl1208 as rtc0
i2c /dev entries driver
tmp431 0-004c: Could not read configuration register (-5)
imx2-wdt imx2-wdt.0: IMX2+ Watchdog Timer enabled. timeout=60s (nowayout=0)
adt7410 0-0048: adt7410 temperature sensor registered.
adt7410 0-0049: adt7410 temperature sensor registered.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
rtc-isl1208 1-006f: setting system clock to 2019-07-14 12:10:18 UTC (1563106218)
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   117833728 bytes (115072 KiB, 112 MiB, 928 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:13.
Freeing init memory: 104K
usb 2-1: new high speed USB device using mxc-ehci and address 2
INIT: usb 2-1: New USB device found, idVendor=148f, idProduct=5370
version 2.86 bootingusb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: 802.11 n WLAN
usb 2-1: Manufacturer: Ralink
usb 2-1: SerialNumber: 1.0


Enter runlevel:

Re: Fully automated rooting script

Posted: Sun Jul 14, 2019 5:37 pm
by TheHogNL
Start the toonrooter with the --uboot-only option to get into the uboot environment (and restore from there).
Every time you reboot a R10 uboot version the original uboot with the unknown password is restored. Only after the toonrooter script (or manual openocd) the uboot password is 'toon' for the next boot.

Btw, can you tell me how you restarted your toon after updating? Also I still don't understand how this sometimes happens. An empty inittab file should not happen as update isn't touching inittab.

Re: Fully automated rooting script

Posted: Tue Jul 16, 2019 6:35 pm
by Flarrestein
TheHogNL wrote:Start the toonrooter with the --uboot-only option to get into the uboot environment (and restore from there).
Every time you reboot a R10 uboot version the original uboot with the unknown password is restored. Only after the toonrooter script (or manual openocd) the uboot password is 'toon' for the next boot.

Btw, can you tell me how you restarted your toon after updating? Also I still don't understand how this sometimes happens. An empty inittab file should not happen as update isn't touching inittab.
How can I use the serial connection if the Toonrooter script is using it?
The script won't start without the serial connection.

Re: Fully automated rooting script

Posted: Tue Jul 16, 2019 8:06 pm
by TheHogNL
Flarrestein wrote: How can I use the serial connection if the Toonrooter script is using it?
The script won't start without the serial connection.
If you start with --uboot-only the script will finish when the Toon reaches uboot. After that you open your serial console and see the Toon in the uboot waiting for your commands.

Re: Fully automated rooting script

Posted: Wed Jul 24, 2019 7:56 pm
by eightonegulf
I've been trying to use ToonRooter to root my fully updated Toon device. U-Boot version 2010.09-R10.

When running the script using only the --jtag-available flag, it manages to write the provided U-boot version to RAM, reboots and then fails giving the following error message

Code: Select all

ERROR:rooter:Could not find value for addmisc environment variable
After running the script using the --jtag-available --uboot-only flags, it will say Toon is waiting in u-boot.
When connecting to Toon using the terminal, it will output something along the lines of

Code: Select all

BOOTP broadcast 2
BOOTP broadcast 5
Retry count exceeded; starting again
(I do see the occasional mis-spelling, like OOTP and bradcast. I initially thought I was losing bits over the serial port, but since the mis-spellings are consistent this does not seem the case.

It does not respond to anything send trough the terminal. After a while the connection is terminated and I get kicked out.. when reconnecting I get the same results.
So my guess is that is why the script also failed :roll:
I was expecting to see the console of Toon. Can anyone make a guess as to why it seems to be stuck in a 'BOOTP broadcast' loop?

Re: Fully automated rooting script

Posted: Wed Jul 24, 2019 8:34 pm
by TheHogNL
can you post with --output-level DEBUG ?

Re: Fully automated rooting script

Posted: Wed Jul 24, 2019 8:42 pm
by TheHogNL
And did you disable the serial port on console in raspi-config?
Then make sure the serial port on the Pi is enabled and the serial console is disabled using raspi_config and reboot if necessary. I

Re: Fully automated rooting script

Posted: Sat Jul 27, 2019 2:15 pm
by eightonegulf
I did enable the serial interface on the RPi in /boot/config.txt, but did indeed not disable the console.. bad reading on my part..
This then should be what caused the problem. But still I do not understand why I got the output I did.

In the meantime I did manage to root Toon the manual way. Used the RPi as the JTAG interface, and hooked the serial port up to my PC.
This worked like a charm. So it was not a problem with Toon, but with my RPi/config.

Thank you TheHogNL.

Re: Fully automated rooting script

Posted: Sat Jul 27, 2019 5:10 pm
by TheHogNL
Because the Pi console is then mixing up with the output from the Toon and the script. All three are writing to the serial port. A bad thing :-)