toniebox-reverse-engineering · SciLor · Jan 9, 2024 · Sep 11, 2023 · Sep 11, 2023 · Nov 20, 2023
diff --git a/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json b/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/altUrl.tc.fritz.box.json
@@ -7,12 +7,10 @@
     "searchAndReplace": [{
         "_desc": "prod.de.tbs.toys to tc.fritz.box",
         "search":  ["70", "72", "6f", "64", "2e", "64", "65", "2e", "74", "62", "73", "2e", "74", "6f", "79", "73", "00"],
-
         "replace": ["74", "63", "2e", "66", "72", "69", "74", "7a", "2e", "62", "6f", "78", "00", "??", "??", "??", "??"]
     }, {
         "_desc": "rtnl.bxcl.de to tc.fritz.box",
         "search":  ["72", "74", "6e", "6c", "2e", "62", "78", "63", "6c", "2e", "64", "65", "00"],
         "replace": ["74", "63", "2e", "66", "72", "69", "74", "7a", "2e", "62", "6f", "78", "00"]
-
     }]
 }
diff --git a/wiki/Bootloader.md b/wiki/Bootloader.md
@@ -1,124 +1 @@
-# HackieboxNG SD bootloader
-
-The HackieboxNG SD bootloader consists of two bootloaders (called stages). Both stages share the same codebase and are relocated to 0x20038000 before run.
-
-## Preloader (Stage 1)
-![Start process preloader](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/graphs/HBNG-SDPreloader.png)
-
-The preloader runs a fixed file from the sd card (sd:/revvox/boot/ngbootloader.bin) without any checks. An update for shouldn't be necesarry in the future.
-It should be installed as primary bootloader for HackieboxNG to flash:/sys/mcuimg.bin.
-
-***All error codes for the preloader are in blue.***
-
-## Bootloader (Stage 2)
-![Start process bootloader](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/graphs/HBNG-SDBootloader.png)
-
-When no ear is pressed, the bootloader loads the selected standard bootslot. If you hold the big ear while booting you may select a different slot by pressing the small ear for a short moment. Only slots with a file on the sd card can be selected. You may use them in a different way and change the settings within the configuration. The selected slot is indicated by 1-3 blinks in a color assigned to each group. Following slots are available:
-
-Filepath: sd:/revvox/boot/ng-*XXXY*.bin
-
-### Green group - Original firmware
-1) **ofw1** - OFW bootloader from flash:/sys/pre-img.bin  recommended here
-2) **ofw2** - simulate OFW behaviour and load the same image like the OFW would, but with patches
-3) **ofw3** - specific OFW file with patches (optional)
-
-### Blue group - Custom firmware
-1) **cfw1** - Primary firmware (optional)
-2) **cfw2** - Backup firmware (optional)
-3) **cfw3** - (optional)
-
-### Cyan group - Additonal firmwares
-1) **add1** - (optional)
-2) **add2** - (optional)
-3) **add3** - (optional)
-
-
-***All error codes for the bootloader are in green.***
-
-### Configuration
-The configuration for the bootloader is saved within [sd:/revvox/boot/ngCfg.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/ngCfg.json). All sections or keys starting with and underscore "_" a comments and will be ignored.
-#### General Section
-| Key | Description | Values | Default |
-| - | - | - | - | 
-| activeImg | Sets the firmware slot to select at startup | ofw1, ofw2, ofw3, cfw1, cfw2, cfw3, add1, add2, add3 | ofw1 |
-| waitForPress | Waits for an earpress on startup with a blink sequence (blue, green, cyan, black)| true, false | false |
-| waitForBoot | Waits for an earpress on before firmware boot with a blink sequence (blue, green, cyan, black)| true, false | false |
-| waitTimeoutInS | Timeout in seconds for waitForPress if no earpress (hibernation) | 1-255 | 60 |
-| minBatteryLevel | Poweroff voltage to protect the battery. Divide through 2785 to get voltage (Standard 3.18V) | | 8869 |
-| ofwFixValue | Magic bytes to be placed into the OFW Image during boot (can be extracted from OFW BL data[-8:-4]) | hex array with 4 bytes | ["4C", "01", "10", "00"] |
-| ofwFixFlash| Magic bytes read from the ofw bootloader on flash | ex. /sys/pre-img.bin| |
-| serialLog | Enable log to UART (TX) @921600 baud. Only works for debug build! | true, false | true |
-| logLevel | Set Log level 0:Trace - 5:Fatal | 0-5 | DEBUG_LOG_LEVEL |
-| logColor | Enable colored log | true, false | false |
-
-#### Firmware Section
-There are nine firmware slots, named ofw1, ofw2, ofw3, cfw1, cfw2, cfw3, add1, add2 and add3.
-
-| Key | Description | Values | Default |
-| - | - | - | - | 
-| checkHash | Check hash of firmware | true, false | true |
-| hashFile | Chech hash from ng-XXX?.sha file (true) or from the last 64 byte of the firmware itself (ofw) | true, false | false |
-| watchdog | Keep watchdog enabled when booting firmware (if booting fails, box will restart) | true, false | false |
-| ofwFix | Add magic bytes to the firmware image to make ofw directly boot | true, false | false
-| ofwSimBL | Read image to boot from flash:/sys/mcubootinfo.bin and load the image from flash:/sys/mcuimgN.bin instead of reading from sd (like the ofw bootloader)| true, false | false
-| bootFlashImg | Read firmware from file on flash | true, false | false |
-| flashImg | Path to the file on flash | ex. /sys/pre-img.bin | |
-| patches | List of patches to load, see [patch directory](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/tree/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch) or [patch wiki](OFWPatches)  | ["noCerts.305", "noPass3.305"] | [] |
-
-
-
-### SHA256 check
-For each slot an SHA256 check is available. Either as a seperated ng-*XXXY*.sha file or directly appended to the binary
-
-For example all OFW binaries have a SHA256 appended to their file ending (except the ofw bootloader). A fitting ng-ofw1.sha is provided for the ofw bootloader.
-The older Hackiebox CFW doesn't have a SHA256 appened. So you may need to create ng-*cfwX*.sha yourself if you want to use it. For HackieboxNG the SHA256 hash will be directly appended to the firmware file itself.
-
-#### Windows
-Command: `Get-Filehash FILENAME.BIN -Algorithm SHA256`
-#### Linux
-Command: `shasum256 FILENAME.BIN`
-
-### Patches
-The integrated patch engine allows to apply patches to the loaded firmware in-memory. Currently just a simple dup2 patcher style *Search & Replace* engine ist implemented. You may patch up to 256 bytes per patch and apply up to 32 patches per slot. The patchname is limited to 32 characters.
-[More about available ofw patches](OFWPatches)
-
-### Error codes
-If the bootloader detects a problem, it blinks in a defined pattern. The preloader on the flash blinks blue, the bootloader on the sd blinks green.
-#### SD related codes
-If a sd related problem occurs, the box combines two patterns. The first one indicates where the problem roughly occured. The second one gives you more information about it.
-##### First pattern
-###### SD not found - 2x500ms, wait 500ms
-Please check if the sd is placed in the holder correctly and the sd is okay. The OFW will blink in red and shut off.
-###### File could not be opened - 3x500ms, wait 2000ms
-Problem opening the firmware file
-###### File could not be read - 4x500ms, wait 2000ms
-Problem reading the firmware file
-##### Second pattern (X times 1000ms)
-1. FR_DISK_ERR, /* (1) A hard error occurred in the low level disk I/O layer */
-2. FR_INT_ERR, /* (2) Assertion failed */
-3. FR_NOT_READY, /* (3) The physical drive cannot work */
-4. FR_NO_FILE, /* (4) Could not find the file */
-5. FR_NO_PATH, /* (5) Could not find the path */
-6. FR_INVALID_NAME, /* (6) The path name format is invalid */
-7. FR_DENIED, /* (7) Access denied due to prohibited access or directory full */
-8. FR_EXIST, /* (8) Access denied due to prohibited access */
-9. FR_INVALID_OBJECT, /* (9) The file/directory object is invalid */
-10. FR_WRITE_PROTECTED, /* (10) The physical drive is write protected */
-11. FR_INVALID_DRIVE, /* (11) The logical drive number is invalid */
-12. FR_NOT_ENABLED, /* (12) The volume has no work area */
-13. FR_NO_FILESYSTEM, /* (13) There is no valid FAT volume */
-14. FR_MKFS_ABORTED, /* (14) The f_mkfs() aborted due to any problem */
-15. FR_TIMEOUT, /* (15) Could not get a grant to access the volume within defined period */
-16. FR_LOCKED, /* (16) The operation is rejected according to the file sharing policy */
-17. FR_NOT_ENOUGH_CORE, /* (17) LFN working buffer could not be allocated */
-18. FR_TOO_MANY_OPEN_FILES, /* (18) Number of open files > _FS_LOCK */
-19. FR_INVALID_PARAMETER /* (19) Given parameter is invalid */
-#### Other
-##### Battery Low - 2x66ms, 2x133ms, 2x66ms
-Battery is low. Value is under the minimum defined in minBatteryLevel. Box hibernates
-##### Hash differs - 10x50ms
-The actual hash of the firmware is different from the one defined in the firmware itself or in the hashfile (depens on the config). Checking the UART-output may help.
-##### Watchdog reset - 5x33ms, 5x66ms, 5x33ms
-The watchdog reseted the box, because the box was in an unintended state or the firmware is broken.
-##### Application error - 3x33ms, 3x66ms, 3x33ms
-Application error. This shouldn't happen. 
+[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/bootloader/)
diff --git a/wiki/FAQ.md b/wiki/FAQ.md
diff --git a/wiki/Home.md b/wiki/Home.md
@@ -1,5 +1,5 @@
 # Home - Wiki HackieboxNG
-
+[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/)
 
 ***
 

diff --git a/wiki/Install.md b/wiki/Install.md
@@ -1,83 +1 @@
-# HackieboxNG Installation
-
-## Backup
-Please make a **full file based + flash backup** of your toniebox's flash with [cc3200tool](https://github.com/toniebox-reverse-engineering/cc3200tool).
-[More details on the usage of the cc3200tool and the required hardware can be found here](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Debug-Port-&-Extract-Firmware)
-*Python 3 is needed!* You may use a different COM port or the right device on linux ex. /dev/ttyUSB0.
-
-```
-python cc.py -p COM3 read_all_files targetdir/ read_flash backup.bin
-```
-Please check, if you dumped every [important file](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Firmware-Format#Important-Toniebox-firmware-files). If not, please check the [known problems wiki entry of the cc3200tool for a workaround.](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Known-Problems-and-Fixes#cc3200tool-related).
-
-## HackieboxNG Bootloader
-
-### Get the bootloader
-Download the latest version from [here](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/releases). Please unzip the release to your desired directory.
-You will find a directory called flash there for the file(s) that need to be copied to the flash and a directory called sd for the sd files.
-If you don't mind a slightly slower boot but want some log output via UART (Baud 921600, TX Pin) use the debug variant (check the ngCfg.json to enable it!).
-
-### Preface
-If you have previously installed the CFW SD Bootloader please use *1b)* otherwise for first time installation please use *1a)*.
-
-### 1a) Preloader (Stage 1) - For first time installation
-
-#### Move original bootloader
-First of all you need to copy your just backuped original mcuimg.bin (original bootloader) from your toniebox to a different location (flash:/sys/pre-img.bin) to boot it with the HackieboxNG Bootloader later on.
-Please don't confuse the mcuimg.bin (ofw bootloader) you are going to dump with the mcuimg.bin within the hackiebox zip package. (/flash/sys/mcuimg.bin)
-
-```
-python cc.py -p COM3 read_file /sys/mcuimg.bin mcuimg.bin
-python cc.py -p COM3 write_file mcuimg.bin /sys/pre-img.bin
-```
-#### Install preloader
-```
-python cc.py -p COM3 write_file flash/sys/mcuimg.bin /sys/mcuimg.bin
-```
-#### Or as oneliner
-```
-python cc.py -p COM3 read_file /sys/mcuimg.bin mcuimg.bin write_file mcuimg.bin /sys/pre-img.bin write_file flash/sys/mcuimg.bin /sys/mcuimg.bin
-```
-
-#### Dumping the original firmware
-The box saves up to 3 different versions of the OFW. It can be found flash:/sys/mcuimgN.bin (replace N with 1, 2 or 3). A command to dump all three versions would be:
-```
-python cc.py -p COM3 read_file /sys/mcuimg1.bin mcuimg1.bin read_file /sys/mcuimg2.bin mcuimg2.bin read_file /sys/mcuimg3.bin mcuimg3.bin
-```
-To check which version the dumped firmwares are you may just open it with a hex editor (quite at the end) or use our [python tool](https://github.com/toniebox-reverse-engineering/toniebox/blob/master/tools/firmware_info.py) to extract it. If you found a new firmware, let us know by opening a push request for [our known firmware listing](https://github.com/toniebox-reverse-engineering/toniebox/wiki/Known-Firmwares) in the wiki.
-
-### 1b) Preloader (Stage 1) - For updating the sd bootloader
-You may use the (old) Hackiebox CFW to upload the preloader. This way you can install it over the air without direct access to the flash if you have already installed a previous version of the cfw bootloader/preloader. Just run the Hackiebox CFW and use the webinterface to upload the new /sys/mcuimg.bin.
-
-#### Backup
-To verify that you have currently installed the ofw bootloader to */sys/pre-img.bin* you may download the file from flash
-```
-http://*.*.*.*/api/ajax?cmd=get-flash-file&filepath=/sys/pre-img.bin
-```
-
-#### Copy over preloader
-![CFW Flash upload](https://raw.githubusercontent.com/toniebox-reverse-engineering/hackiebox_cfw_ng/master/wiki/images/InstallCfwFlashUpload.png)
-
-1) Select *Target* "Flash"
-2) Select *Local file* "flash/sys/mcuimg.bin"
-3) Set *Overwrite* to "on"
-4) Set *SD/Flash path*  to "/sys/mcuimg.bin"
-5) Press *Upload*!
-
-#### Verification
-To verify that the upload was successful you can download the mcuimg.bin from flash afterwards and compare it with the *flash/sys/mcuimg.bin* you have just uploaded.
-```
-http://*.*.*.*/api/ajax?cmd=get-flash-file&filepath=/sys/mcuimg.bin
-```
-
-### 2) Bootloader (Stage 2)
-#### SD files
-Copy over all the contents of the *sd* folder the sd card of the toniebox.
-Copy over the original bootloader (mcuimg.bin from your backup) to the first ofw slot *sd:/revvox/boot/ng-ofw1.bin*.
-Now the HackieboxNG bootloader will instantly boot the original bootloader and run the original firmware.
-
-Note: The preloader will load any file placed to *sd:/revvox/boot/ngbootloader.bin*. 
-
-
-
-[More about the different firmware slots and the configuration here.](Bootloader)
+[moved](https://toniebox-reverse-engineering.github.io/docs/custom-firmware/cc3200/hackieboxng-bl/install/)