Skip to content

Commit 845b79d

Browse files
SciLorSciLor
committed
add wiki section
1 parent 40d1075 commit 845b79d

29 files changed

Lines changed: 1299 additions & 0 deletions

‎content/docs/wiki/_index.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
title: "Wiki"
3+
description: ""
4+
---
5+
Welcome to the toniebox wiki!
6+
7+
This wiki contains all toniebox related information we gathered.
8+
9+
Attention, do not edit the wiki directly. It is generated automatically from the master branch!
10+
11+
[The wiki of the custom firmware is found here.](https://github.com/toniebox-reverse-engineering/hackiebox_cfw/wiki)

‎content/docs/wiki/cc3200/_index.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
title: "CC3200"
3+
description: ""
4+
bookCollapseSection: true
5+
---

‎content/docs/wiki/cc3200/boot-process.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Boot Process"
3+
description: ""
4+
---
5+
# Boot Process
6+
7+
## Introduction
8+
When the CC3200 is started the integrated bootloader is loading /sys/mcuimg.bin from flash to the memory address 0x20004000. The SRAM is located at 0x20000000 to 0x2003FFFF. If you want to implement a second stage bootloader you would usally implement a relocator that moves your bootloader to 0x2000000. If it bootloader smaller than 16kB (0x4000) you then may load your desired firmware from SD or Flash to 0x20004000 as the integrated bootloader would do. The toniebox's (seconds stage) bootloader is bigger than 16kB. So loading it to 0x20000000 wouldn't work.
9+
10+
## Relocator
11+
The original firmware bootloader has a relocator which loads the bootloader to memory address 0x20038000, which 32kB before the very end of the memory.
12+
13+
## OFW bootloader
14+
The bootloader loads a file called "/sys/mcubootinfo.bin" that contains the id of the firmware to load.
15+
16+
To verify the integrity of the firmware, a sha256 hash is appended to the end of each firmware file. The bootloader checks it.

‎content/docs/wiki/cc3200/debug-port.md‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
---
2+
title: "Debug port"
3+
description: ""
4+
---
5+
# Debug Port
6+
## Position of debug port on Toniebox-PCB
7+
8+
![/img/toniebox_pcb_debug_port.png](/img/toniebox_pcb_debug_port.png)
9+
10+
The debug port runs on `3.3 V`
11+
12+
## Layout debug port
13+
```
14+
10 9 8 7 6
15+
1 2 3 4 5
16+
```
17+
18+
![/img/debug_port_pin_out.png](/img/debug_port_pin_out.png)
19+
20+
21+
| Pin | Function | Comment |
22+
| --- | -------- | --------------------- |
23+
| 1 | TX | 55 |
24+
| 2 | RX | 57 |
25+
| 3 | VCC | 3.3V |
26+
| 4 | RST | 32 |
27+
| 5 | GND | |
28+
| 6 | ? | 45 |
29+
| 7 | TCK | 19 |
30+
| 8 | TMS | 20 |
31+
| 9 | SOP2 | 21 (indirect SOP0 35) |
32+
| 10 | ? | U3 |
33+
34+
# Tag-Connector for debug port
35+
36+
To connect to the debug port a Tag-Connector can be used.
37+
38+
Datasheet: [Tag Connect TC2050-IDC-NL](https://www.tag-connect.com/wp-content/uploads/bsk-pdf-manager/TC2050-IDC-NL_Datasheet_8.pdf)
39+
40+
Available at: [Tag Connect TC2050-IDC-NL](https://www.tag-connect.com/product/tc2050-idc-nl-10-pin-no-legs-cable-with-ribbon-connector)
41+
42+
Alternative (cheaper): [PCB Clip 1.27mm 5 Pin Double Row](https://a.aliexpress.com/_BSuEeo)
43+
44+
# Boot Mode
45+
The CC3200 device implements a sense-on-power (SoP) scheme to switch between two modes that are available within the Tonie project. (To switch between the boot modes a restart of the device is needed.) [CC3200 datasheet 5.9.3](http://www.ti.com/lit/ds/symlink/cc3200.pdf)
46+
## SWD Mode
47+
SOP2 (pin 9) low (standard) will activate the functional mode with a 2-wire SWD mapped to TCK (pin 7) and TMS (pin 8) of the debug port.
48+
## UART mode
49+
SOP2 (pin 9) high will activate the UART load mode to flash the system during development and in OEM assembly line
50+
51+
# Extract Firmware
52+
## Introduction
53+
Grab your favourite USB-UART **3.3V** interface, recommending those with DTR or RTS port to automate board reset. You may also use a CC3200 Launchpad, but then you will need to reset it by hand. SOP2 need to be pulled high while reset to set the cc3200 into UART-Mode.
54+
55+
## Toolset
56+
Use [cc3200tool](https://github.com/toniebox-reverse-engineering/cc3200tool) to extract the firmware. Just download it to your favorite location.
57+
You will need to install python3 (including pip3). The [cc3200tool](https://github.com/toniebox-reverse-engineering/cc3200tool) needs the package pyserial (which can be automatically installed via the setup.py). You may install it manually via `pip3 install pyserial`. To make the process easier, we just call the cc.py within the `cc3200tool/` directory.
58+
59+
## Connection
60+
Please connect the toniebox to your power supply and/or battery. Please double check your UART that its VCC is 3.3V and not 5.0V. If your UART is missing DTR you will need to connect the Toniebox RST to GND for a moment before each command to reset the box. If you reset the box it should glow green all the time without booting and playing its startup jingle.
61+
62+
| Toniebox | Toniebox | UART |
63+
| -------- | ------- | ---- |
64+
| GND | | GND |
65+
| TX | | RX |
66+
| RX | | TX |
67+
| RST | | DTR |
68+
| VCC | SOP2* | |
69+
| SOP2 | VCC* | |
70+
71+
*Pin SOP2 of the Toniebox should be bridged with the VCC of the Toniebox.
72+
73+
If you have got problems [check out the known problems and fixes](Known-Problems-and-Fixes#cc3200tool-related).
74+
75+
## Example commands
76+
You may replace COM3 with the right port on your computer (linux ex. /dev/ttyUSB0). Please add `--reset dtr` to each command (see 6.) if you have RST connected to DTR for auto reset. In addition, if you got connection issues, you may try to connect SOP2 to the RTS pin directly and add `--sop2 ~rts` to each command.
77+
78+
| | Descriptiion | Command |
79+
| - | - | - |
80+
| 1 | List files in FatFS (useful to check the connection) | `python cc.py -p COM3 list_filesystem` |
81+
| 2 | Extract full firmware | `python cc.py -p COM3 read_flash firmware.dmp` |
82+
| 3 | Extract all files | `python cc.py -p COM3 read_all_files ./target_dir` |
83+
| 4 | Extract singe files | `python cc.py -p COM3 read_file /sys/mcuimg.bin ./sys/mcuimg.bin` |
84+
| 5 | Extract firmware and files | `python cc.py -p COM3 read_flash firmware.dmp read_all_files ./target_dir` |
85+
| 6 | List files in FatFS with DTR auto reset | `python cc.py -p COM3 --reset dtr list_filesystem` |
86+
| 7 | List files in FatFS with DTR/RTS auto reset/sop2 | `python cc.py -p COM3 --reset dtr --sop2 ~rts list_filesystem` |
87+
88+
If you are done, either disconnect the box from the charger and battery or remove SOP2 from VCC and connect the Toniebox RST to GND for a moment to reset the box.
89+
90+
# Log output
91+
The original bootloader and the original firmware do some logging to the serial port with baudrate 921600
92+
ex. Linux: "screen /dev/ttyUSB0 921600" or under Windows with PuTTY.
93+
94+
## bootloader
95+
```
96+
CC3200 bootloader v1472818501 (09c6374) build: Fri Sep 2 14:15:01 CEST 2016 dl:1.2.0 sl:1.0.1.6 hw:tb-smt-16:1:13
97+
loaded battery critical level = 3600
98+
battery_level = 4823
99+
```
100+
## original firmware
101+
```
102+
QO (�72-�3�]FWc041b2f13 Nov 17:47E�3�]Jc041b2f0. (�2EU_V3.0.5-0E�3�]Jc041b2f<: (�2EU_V3.0.5_stable_branchE�3�]Jc041b2f+) (�92E�3�]& (#2E�3�]]Jc041b (2SPE�3�]%#E�3�� 2�
103+
SP���E�3�]#! �
104+
(�/�E�3�]20 �
105+
(<2�E�3�]20 � (=2�
106+
2%�80USDS�(�5\E�3�]#!E�3� (�9-�z[E�3�] � (�72E�3�]@> � (�
107+
94E36D679CD9E�3�]#! � (�/��E�3�]#!E�� (�/��E�3�]/�E�� (�02�E�3�]2�3�� #(�02-E�3�]#! � (�/�E�3�]#! � (�/�E�3�]#! � (�/��E�3�]#! �! !(�0E�3�]#! �" !(�0E�3�] �# (�2E�3�] �$ (�02E�3�] �% (�&2�E�3�] �& (�&2;E�3�] �' (�&2�)E�3�]! �( (�&2�)NE�3�] �) (�&2�E�3�] �* (�&E�3�]#! �+ (�&@'|E�3�] �, #(�02-E�3�] �- (�72E�3�]#! �. (�5`E�3�] �/ (�2E�3�];9 �0 (�
108+
1 (�22"content/00000001/00000000\���E�3�]#! 2 (�u��WE�3�]#! 3 (�9\�E�3�]'% 4 (�52E�3�] 5 (�52E�3�]#!2 E6 (�5u��WE�3�] ;7 (�62�E�3�] �8 (�%2E�3�]<: 9 (�2!prod.de.tbs.toys49�E�3�];9 �: (�
109+
2 E�3�] �; (�2E�3�] �< (�52E�3�] = (�22\
110+
E�3�] ]> (�22E�3�]#! ]? (�/�E�3�]/- ]@ (�/2�E�3�] ^A (�2E�3�]#! ^B (�/��E�3�] �C (�%2E�3�]20 �D (Z2E�3�]20 �E (<2�
111+
/E�3�]20 �F (=2�
112+
E�3�]MK (G (�22SPGETprod.de.tbs.toys�/v1/ota/4?cv=33545114E�3�]86 �H %(�2rtnl.bxcl.de�L8�E�3�]EC �I (h2+prod.de.tbs.toys�/v1/ota/4?cv=33545114E�3�] �J (�82�E�3�]#! 0K (�8�JE�3�]53 L (�>2Fritz!Box 75905037E1B7F880����E�3�]'% "-M %(�:2QE�3�]QO #-N(�72-�3�]FWc041b2f13 Nov 17:47E�3�]Jc041b2f0. $-O(�2EU_V3.0.5-0E�3�]Jc041b2f<: %-P(�2EU_V3.0.5_stable_branchE�3�]Jc041b2f+) &-Q �� 8�E�3�].,(�02/qT (�02_B$ 8�E�3�].,�020qU (�02_�� 8�E�3�]0. 1qV (�
113+
2D8�E�3�]
114+
```

0 commit comments

Comments
 (0)