diff --git a/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json b/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json index e63f832..d976b8f 100644 --- a/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json +++ b/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json @@ -7,12 +7,10 @@ "searchAndReplace": [{ "_desc": "prod.de.tbs.toys to tc.fritz.box", "search": ["70", "72", "6f", "64", "2e", "64", "65", "2e", "74", "62", "73", "2e", "74", "6f", "79", "73", "00"], - "replace": ["74", "63", "2e", "66", "72", "69", "74", "7a", "2e", "62", "6f", "78", "00", "??", "??", "??", "??"] }, { "_desc": "rtnl.bxcl.de to tc.fritz.box", "search": ["72", "74", "6e", "6c", "2e", "62", "78", "63", "6c", "2e", "64", "65", "00"], "replace": ["74", "63", "2e", "66", "72", "69", "74", "7a", "2e", "62", "6f", "78", "00"] - }] } diff --git a/wiki/Bootloader.md b/wiki/Bootloader.md index 40235be..d49eb0e 100644 --- a/wiki/Bootloader.md +++ b/wiki/Bootloader.md @@ -1,124 +1 @@ -# HackieboxNG SD bootloader - -The HackieboxNG SD bootloader consists of two bootloaders (called stages). Both stages share the same codebase and are relocated to 0x20038000 before run. - -## Preloader (Stage 1) -![Start process preloader](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/graphs/HBNG-SDPreloader.png) - -The preloader runs a fixed file from the sd card (sd:/revvox/boot/ngbootloader.bin) without any checks. An update for shouldn't be necesarry in the future. -It should be installed as primary bootloader for HackieboxNG to flash:/sys/mcuimg.bin. - -***All error codes for the preloader are in blue.*** - -## Bootloader (Stage 2) -![Start process bootloader](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/graphs/HBNG-SDBootloader.png) - -When no ear is pressed, the bootloader loads the selected standard bootslot. If you hold the big ear while booting you may select a different slot by pressing the small ear for a short moment. Only slots with a file on the sd card can be selected. You may use them in a different way and change the settings within the configuration. The selected slot is indicated by 1-3 blinks in a color assigned to each group. Following slots are available: - -Filepath: sd:/revvox/boot/ng-*XXXY*.bin - -### Green group - Original firmware -1) **ofw1** - OFW bootloader from flash:/sys/pre-img.bin recommended here -2) **ofw2** - simulate OFW behaviour and load the same image like the OFW would, but with patches -3) **ofw3** - specific OFW file with patches (optional) - -### Blue group - Custom firmware -1) **cfw1** - Primary firmware (optional) -2) **cfw2** - Backup firmware (optional) -3) **cfw3** - (optional) - -### Cyan group - Additonal firmwares -1) **add1** - (optional) -2) **add2** - (optional) -3) **add3** - (optional) - - -***All error codes for the bootloader are in green.*** - -### Configuration -The configuration for the bootloader is saved within [sd:/revvox/boot/ngCfg.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/ngCfg.json). All sections or keys starting with and underscore "_" a comments and will be ignored. -#### General Section -| Key | Description | Values | Default | -| - | - | - | - | -| activeImg | Sets the firmware slot to select at startup | ofw1, ofw2, ofw3, cfw1, cfw2, cfw3, add1, add2, add3 | ofw1 | -| waitForPress | Waits for an earpress on startup with a blink sequence (blue, green, cyan, black)| true, false | false | -| waitForBoot | Waits for an earpress on before firmware boot with a blink sequence (blue, green, cyan, black)| true, false | false | -| waitTimeoutInS | Timeout in seconds for waitForPress if no earpress (hibernation) | 1-255 | 60 | -| minBatteryLevel | Poweroff voltage to protect the battery. Divide through 2785 to get voltage (Standard 3.18V) | | 8869 | -| ofwFixValue | Magic bytes to be placed into the OFW Image during boot (can be extracted from OFW BL data[-8:-4]) | hex array with 4 bytes | ["4C", "01", "10", "00"] | -| ofwFixFlash| Magic bytes read from the ofw bootloader on flash | ex. /sys/pre-img.bin| | -| serialLog | Enable log to UART (TX) @921600 baud. Only works for debug build! | true, false | true | -| logLevel | Set Log level 0:Trace - 5:Fatal | 0-5 | DEBUG_LOG_LEVEL | -| logColor | Enable colored log | true, false | false | - -#### Firmware Section -There are nine firmware slots, named ofw1, ofw2, ofw3, cfw1, cfw2, cfw3, add1, add2 and add3. - -| Key | Description | Values | Default | -| - | - | - | - | -| checkHash | Check hash of firmware | true, false | true | -| hashFile | Chech hash from ng-XXX?.sha file (true) or from the last 64 byte of the firmware itself (ofw) | true, false | false | -| watchdog | Keep watchdog enabled when booting firmware (if booting fails, box will restart) | true, false | false | -| ofwFix | Add magic bytes to the firmware image to make ofw directly boot | true, false | false -| ofwSimBL | Read image to boot from flash:/sys/mcubootinfo.bin and load the image from flash:/sys/mcuimgN.bin instead of reading from sd (like the ofw bootloader)| true, false | false -| bootFlashImg | Read firmware from file on flash | true, false | false | -| flashImg | Path to the file on flash | ex. /sys/pre-img.bin | | -| patches | List of patches to load, see [patch directory](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/tree/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch) or [patch wiki](OFWPatches) | ["noCerts.305", "noPass3.305"] | [] | - - - -### SHA256 check -For each slot an SHA256 check is available. Either as a seperated ng-*XXXY*.sha file or directly appended to the binary - -For example all OFW binaries have a SHA256 appended to their file ending (except the ofw bootloader). A fitting ng-ofw1.sha is provided for the ofw bootloader. -The older Hackiebox CFW doesn't have a SHA256 appened. So you may need to create ng-*cfwX*.sha yourself if you want to use it. For HackieboxNG the SHA256 hash will be directly appended to the firmware file itself. - -#### Windows -Command: `Get-Filehash FILENAME.BIN -Algorithm SHA256` -#### Linux -Command: `shasum256 FILENAME.BIN` - -### Patches -The integrated patch engine allows to apply patches to the loaded firmware in-memory. Currently just a simple dup2 patcher style *Search & Replace* engine ist implemented. You may patch up to 256 bytes per patch and apply up to 32 patches per slot. The patchname is limited to 32 characters. -[More about available ofw patches](OFWPatches) - -### Error codes -If the bootloader detects a problem, it blinks in a defined pattern. The preloader on the flash blinks blue, the bootloader on the sd blinks green. -#### SD related codes -If a sd related problem occurs, the box combines two patterns. The first one indicates where the problem roughly occured. The second one gives you more information about it. -##### First pattern -###### SD not found - 2x500ms, wait 500ms -Please check if the sd is placed in the holder correctly and the sd is okay. The OFW will blink in red and shut off. -###### File could not be opened - 3x500ms, wait 2000ms -Problem opening the firmware file -###### File could not be read - 4x500ms, wait 2000ms -Problem reading the firmware file -##### Second pattern (X times 1000ms) -1. FR_DISK_ERR, /* (1) A hard error occurred in the low level disk I/O layer */ -2. FR_INT_ERR, /* (2) Assertion failed */ -3. FR_NOT_READY, /* (3) The physical drive cannot work */ -4. FR_NO_FILE, /* (4) Could not find the file */ -5. FR_NO_PATH, /* (5) Could not find the path */ -6. FR_INVALID_NAME, /* (6) The path name format is invalid */ -7. FR_DENIED, /* (7) Access denied due to prohibited access or directory full */ -8. FR_EXIST, /* (8) Access denied due to prohibited access */ -9. FR_INVALID_OBJECT, /* (9) The file/directory object is invalid */ -10. FR_WRITE_PROTECTED, /* (10) The physical drive is write protected */ -11. FR_INVALID_DRIVE, /* (11) The logical drive number is invalid */ -12. FR_NOT_ENABLED, /* (12) The volume has no work area */ -13. FR_NO_FILESYSTEM, /* (13) There is no valid FAT volume */ -14. FR_MKFS_ABORTED, /* (14) The f_mkfs() aborted due to any problem */ -15. FR_TIMEOUT, /* (15) Could not get a grant to access the volume within defined period */ -16. FR_LOCKED, /* (16) The operation is rejected according to the file sharing policy */ -17. FR_NOT_ENOUGH_CORE, /* (17) LFN working buffer could not be allocated */ -18. FR_TOO_MANY_OPEN_FILES, /* (18) Number of open files > _FS_LOCK */ -19. FR_INVALID_PARAMETER /* (19) Given parameter is invalid */ -#### Other -##### Battery Low - 2x66ms, 2x133ms, 2x66ms -Battery is low. Value is under the minimum defined in minBatteryLevel. Box hibernates -##### Hash differs - 10x50ms -The actual hash of the firmware is different from the one defined in the firmware itself or in the hashfile (depens on the config). Checking the UART-output may help. -##### Watchdog reset - 5x33ms, 5x66ms, 5x33ms -The watchdog reseted the box, because the box was in an unintended state or the firmware is broken. -##### Application error - 3x33ms, 3x66ms, 3x33ms -Application error. This shouldn't happen. \ No newline at end of file +[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/bootloader/) \ No newline at end of file diff --git a/wiki/FAQ.md b/wiki/FAQ.md deleted file mode 100644 index 49cf668..0000000 --- a/wiki/FAQ.md +++ /dev/null @@ -1,3 +0,0 @@ -# Bootloader - -TODO \ No newline at end of file diff --git a/wiki/Home.md b/wiki/Home.md index 8923ef3..aea7e38 100644 --- a/wiki/Home.md +++ b/wiki/Home.md @@ -1,5 +1,5 @@ # Home - Wiki HackieboxNG - +[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/) *** diff --git a/wiki/Install.md b/wiki/Install.md index f5902e3..01911b8 100644 --- a/wiki/Install.md +++ b/wiki/Install.md @@ -1,83 +1 @@ -# HackieboxNG Installation - -## Backup -Please make a **full file based + flash backup** of your toniebox's flash with [cc3200tool](https://github.com/toniebox-reverse-engineering/cc3200tool). -[More details on the usage of the cc3200tool and the required hardware can be found here](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Debug-Port-&-Extract-Firmware) -*Python 3 is needed!* You may use a different COM port or the right device on linux ex. /dev/ttyUSB0. - -``` -python cc.py -p COM3 read_all_files targetdir/ read_flash backup.bin -``` -Please check, if you dumped every [important file](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Firmware-Format#Important-Toniebox-firmware-files). If not, please check the [known problems wiki entry of the cc3200tool for a workaround.](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Known-Problems-and-Fixes#cc3200tool-related). - -## HackieboxNG Bootloader - -### Get the bootloader -Download the latest version from [here](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/releases). Please unzip the release to your desired directory. -You will find a directory called flash there for the file(s) that need to be copied to the flash and a directory called sd for the sd files. -If you don't mind a slightly slower boot but want some log output via UART (Baud 921600, TX Pin) use the debug variant (check the ngCfg.json to enable it!). - -### Preface -If you have previously installed the CFW SD Bootloader please use *1b)* otherwise for first time installation please use *1a)*. - -### 1a) Preloader (Stage 1) - For first time installation - -#### Move original bootloader -First of all you need to copy your just backuped original mcuimg.bin (original bootloader) from your toniebox to a different location (flash:/sys/pre-img.bin) to boot it with the HackieboxNG Bootloader later on. -Please don't confuse the mcuimg.bin (ofw bootloader) you are going to dump with the mcuimg.bin within the hackiebox zip package. (/flash/sys/mcuimg.bin) - -``` -python cc.py -p COM3 read_file /sys/mcuimg.bin mcuimg.bin -python cc.py -p COM3 write_file mcuimg.bin /sys/pre-img.bin -``` -#### Install preloader -``` -python cc.py -p COM3 write_file flash/sys/mcuimg.bin /sys/mcuimg.bin -``` -#### Or as oneliner -``` -python cc.py -p COM3 read_file /sys/mcuimg.bin mcuimg.bin write_file mcuimg.bin /sys/pre-img.bin write_file flash/sys/mcuimg.bin /sys/mcuimg.bin -``` - -#### Dumping the original firmware -The box saves up to 3 different versions of the OFW. It can be found flash:/sys/mcuimgN.bin (replace N with 1, 2 or 3). A command to dump all three versions would be: -``` -python cc.py -p COM3 read_file /sys/mcuimg1.bin mcuimg1.bin read_file /sys/mcuimg2.bin mcuimg2.bin read_file /sys/mcuimg3.bin mcuimg3.bin -``` -To check which version the dumped firmwares are you may just open it with a hex editor (quite at the end) or use our [python tool](https://github.com/toniebox-reverse-engineering/toniebox/blob/master/tools/firmware_info.py) to extract it. If you found a new firmware, let us know by opening a push request for [our known firmware listing](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Known-Firmwares) in the wiki. - -### 1b) Preloader (Stage 1) - For updating the sd bootloader -You may use the (old) Hackiebox CFW to upload the preloader. This way you can install it over the air without direct access to the flash if you have already installed a previous version of the cfw bootloader/preloader. Just run the Hackiebox CFW and use the webinterface to upload the new /sys/mcuimg.bin. - -#### Backup -To verify that you have currently installed the ofw bootloader to */sys/pre-img.bin* you may download the file from flash -``` -http://*.*.*.*/api/ajax?cmd=get-flash-file&filepath=/sys/pre-img.bin -``` - -#### Copy over preloader -![CFW Flash upload](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/images/InstallCfwFlashUpload.png) - -1) Select *Target* "Flash" -2) Select *Local file* "flash/sys/mcuimg.bin" -3) Set *Overwrite* to "on" -4) Set *SD/Flash path* to "/sys/mcuimg.bin" -5) Press *Upload*! - -#### Verification -To verify that the upload was successful you can download the mcuimg.bin from flash afterwards and compare it with the *flash/sys/mcuimg.bin* you have just uploaded. -``` -http://*.*.*.*/api/ajax?cmd=get-flash-file&filepath=/sys/mcuimg.bin -``` - -### 2) Bootloader (Stage 2) -#### SD files -Copy over all the contents of the *sd* folder the sd card of the toniebox. -Copy over the original bootloader (mcuimg.bin from your backup) to the first ofw slot *sd:/revvox/boot/ng-ofw1.bin*. -Now the HackieboxNG bootloader will instantly boot the original bootloader and run the original firmware. - -Note: The preloader will load any file placed to *sd:/revvox/boot/ngbootloader.bin*. - - - -[More about the different firmware slots and the configuration here.](Bootloader) \ No newline at end of file +[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/install/) \ No newline at end of file diff --git a/wiki/OFWPatches.md b/wiki/OFWPatches.md index aec0090..5da396f 100644 --- a/wiki/OFWPatches.md +++ b/wiki/OFWPatches.md @@ -1,64 +1 @@ -# HackieboxNG original firmware patches -## Preface -Every patch is written for one or more specific versions of the original firmware. Currently the latest version supported for all patches is **EU_V3.1.0_BF2-0**. An overview over all known firmware versions can be found in the [toniebox wiki](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Known-Firmwares). - -## Offline / Privacy -It is recommended to keep the toniebox offline if you are using a patched firmware. Using the offline mode is recommended. In addition you should enable the Null certificate patch. - -### Null certificate Paths ([noCerts.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noCerts.305.json)) -This patch clears the paths to the certificates. This way the box will abort the https connection to boxine as it can't check if the boxine server is a valid one. - -## Alternative Tags (SLIX / SLIX2) -If you want to use alternative tags those patches will help you. Even other iso15693 tags may work. - -### Block count >8 ([blockCheck.310.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/blockCheck.310.json) / [blockCheck.307.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/blockCheck.307.json)) -Usally the toniebox checks if the tag has exactly 8 blocks. The check allows the tag to have more than that. (ex. SLIX or SLIX2) - -### Block count <=8 ([blockCheckRemove.310.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/blockCheckRemove.310.json) / [blockCheckRemove.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/blockCheckRemove.308.json)) -Usally the toniebox checks if the tag has exactly 8 blocks. The check allows the tag to have less than that. - -### No privacy password ([noPass3.310.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass3.310.json) / [noPass3.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass3.305.json)) -Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX). It disables the rf field for a moment when the second privacy password failed. This patch uses the new dynamic patching engine to generate dynamic arm asm bytecode. - -### Second privacy password to 00000000 ([secondPwZero.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/secondPwZero.305.json)) -Usally doesn't the toniebox checks for two passwords. The boxine specific and the NXP specific standard password *0f0f0f0f*. This patch changes the second password to *00000000*. - - -### No UID check ([uidCheck.307.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/uidCheck.307.json)) -Usally the toniebox checks if the UID of the tag starts with *E0:04:03*. With that patch you may use tags with other UIDs (ex SLIX or SLIX2) - -### Hide A: Do not hide files that need new content ([noHide.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noHide.308.json)) -*You just need one of the hide patches! This one is recommended* -Usally the toniebox sets the file attribute hidden of the tonie file for all live tags or tags having new content. If the toniebox is online and the tag is placed on top it will delete that file to redownload its content. This also applies to all custom tags. This patch disabled the hide function. So the files won't be deleted and redownloaded. **Attention** You won't be able to update creative tonies anymore! - -### Hide B: Unhide files that should be hidden (because they have new content) ([alwaysUnhide.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/alwaysUnhide.308.json)) -*You just need one of the hide patches!* -Usally the toniebox sets the file attribute hidden of the tonie file for all live tags or tags having new content. If the toniebox is online and the tag is placed on top it will delete that file to redownload its content. This also applies to all custom tags. This patch replaces the hide functionality with unhide. So the files won't be deleted and redownloaded. **Attention** You won't be able to update creative tonies anymore! - - -## Additional -### Disable privacy mode ([noPrivacy.310.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPrivacy.310.json) / [noPrivacy.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPrivacy.305.json)) -Usally the toniebox puts every tag into privacy mode after reading it. This patch disables that, so you can easily read the UID with any standard iso15693 reader like your phone. -### Load CA from c2.der ([altCa.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altCa.305.json)) -To use two CAs you can use this patch. It will change the CA path from flash:/certs/ca.der to flash:/certs/c2.der -### Change Boxine URLs ([altUrl.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.305.json)) -Changes the Boxine Cloud URLs from prod.de.tbs.toys to prod.revvox and rtnl.bxcl.de to rtnl.revvox. - - -## Development -### Enable SWD ([swd.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/swd.json)) -Handy patch to debug the OFW and to verify and test patches. -***Attenion, the red led won't work with that patch enabled!*** - -## Deprecated Patches - -### No privacy password ([noPass.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass.305.json)) -*Deprecated doesn't reset the RF field so some tags will fail* -Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX). - -### No privacy password ([noPass2.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass2.308.json)) -*Deprecated replaced with noPass3* -Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX). It disables the rf field for a moment when the second privacy password failed. - -### Disable charger wakeup ([noChargWake.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noChargWake.305.json)) -The toniebox won't wakeup anymore if it is put onto the charger. **noChargWake.305 Doesn't work on 3.1.0-BF2 and higher. Box won't wakeup anymore** ***Attention, this patch is only working if you disconnect the battery for a second before loading the patched ofw. If you start the unpatched ofw once, you will have to disconnect the battery again*** +[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/ofw-patches/) \ No newline at end of file