Firmware Reads FF FF and Toniebox is not starting anymore

Toniebox Hardware ESP32 (V4)
1

Hi all,

I have already asked quite a bit in the Telegram channel, but wanted to follow up here in the forum as well.

I have 2 Tonieboxes for my kids. I started with one and that was the ESP32 Toniebox and wanted to get Teddiecloud working. Here are the steps I did:

  1. Backup of the SD card. – successful
  2. Getting the docker running – successful
  3. Dumping the flash – issues more below
  4. Backup of the flash – I thought successful, but due to 3 not.
  5. Patching the image

Details to 3:
I soldered the RX,TX and GND to the PCB.
I used a bread board wire to jump the J 100 and dump the flash.

This was done on my Workbench PC: At my first try I connected RX To RX and TX to TX. Had to swap that and started getting a reading. The connection was instable and I never got a full dump over the web interface. I first thought this was an issue with the web interface and used esptool to dump the firmware. Same issue, connection not stable.

I switched to my Laptop which is much newer and used an USB C converter between the adapter and the box. Same issue, connection not stable, never got a good reading out of the box. I noticed the reading was sometimes really really slow.

Finally I switched to my office PC and the connection was stable and I had no issue to dump the firmware. At least what I thought.

Details to 4:
After I dumped the firmware I connected to the docker container and made a copy of the firmware fill I just downloaded. Just to be save and always been able to jump back to the original firmware.

Long story short, I clicked on patch and it reported an error. I repeated step 3 -5 a few times. So I have multiple, but identical bin files.

I also tried to extract the certs from the firmware as described in the wiki but received some errors.

After some chats in telegram I found another similar issue here in the forum. ESP32-box not starting, only flashing red - #6 by g3gg0

This made me look into my firmware files and I found that the firmware is filled only with FF.

The difference to the post above in my case: My Toniesbox was for sure working fine. My son used the box all the time.

What is the best way of moving forward?

Any help is appreciated. Haven’t told my son yet that i broke his box.

2

Weird.
I really played a lot with the esptool-js and never ever faced an issue like that.
Just swapping rx/tx will not do anything odd, so this cannot be the reason imho.

The only solution I can think of, is flashing a firmware and using teddycloud standalone.
But then you don’t have Tonies cloud anymore.

3

Yes, I agree. This is also not the first time that I flashed a chip. I know decently what I am doing. After the telegram chat, I think for whatever reason the firmware was read with only FF. Then I clicked on patch and it flashed the wrong firmware. Even it never really showed progress or anything after I clicked patch.

Running it with teddycloud alone is no problem. The issue I have right now: I broke already one box and don’t want to touch the other for obvious reasons. I have the certs from teddycloud available if someone can build a firmware.

4

you need the certificates from the box to access the cloud.
those from teddycloud wont help.

i would have to doublecheck - but i was quite confident that any error in the firmware images
would cause an empty response from the server and give nothing to flash.

grafik
grafik536×785 55.8 KB

can you upload the empty firmware image to https://upload.g3gg0.de/ ?
tell me when uploaded, I will find the file myself.

5

I uploaded a zip file with all firmwares I pulled.

in the firmware sub folder was also a folder certs_MacID. In this folder is ca.der. That file and folder is not included in the uploaded zip file. Let me know if you need that too.

I don’t necessarily need the cloud access, if the box works with Teddycloud. For traveling I will just use the other box and at home I am fine with one box being able to download new content.

I also found a toniebox on ebay in California, that thing looks like out of a burned house, but its supposed to be ok. I made an offer. Maybe I get that and can use the certs from that box and throw the housing away.

Most important is that my son has a box that makes some soft of sound again. Doesn’t even need to be related to Tonies at all.

6

I think the issue is that for whatever reason it downloaded 8MB flash which only had FF inside.

7

The certs are bound to the chip of the box, as an esp32 certificate is offered esp32 OTA firmware images. Mixing it isn’t a good idea. But you can use it for teddyCloud and filter the OTA out. Or you can rescue the full pcb of the burned box.

8

Rescuing the pcb is the plan, but first I need to get the box. The guy is asking a ridiculous amount for it.

Any luck with the uploaded files?

I think I may try to download the flash from my daughter’s box, but will do that with esptool. I’m just super scared to brick the next box.

9

the next days i will prepare you a firmware image with a teddycloud certificate

1 Like
10

Awesome, thank you!

11

Ok, so here is an update. I recieved a new “used” box as a replacement for the damaged box.

I manually downloaded the firmware a couple of days ago, before I even connected and actived the box with the tonies app.

Checked the file and it looked good. Restarted the box and the box continued to be in set up mode.

Next step: I activated the box and connected to my wifi. All worked as expected. I tested a toni figure and it downloaded the content from the could. Perfect.

Next step: I manually downloaded the flash again. I looked in the bin file for my wifi password and found that as well.

Next step: I patched the firmware and flashed the new firmware. Seems to work as well.

Now my next question is, How can I get the damaged box back up and running?

12

If both boxes are ESP32 based, you can just copy over the complete firmware, including the certs.
Technically, you cloned the box then. As long as those stay behind teddyCloud or are offline, this shouldn’t be a problem. I don’t know what happens if you start using both boxes with the original cloud at the same time.

Just cross-check again if the flash of the bricked box is really empty before overwriting it with the donor box flash.

1 Like
13

Ok, that is what I thought to do, but wasn’t sure.

My thinking was, that the box have the mac saved somewhere in the flash. Will flash it later today and see if it works as expected.

14

This thread can be closed. I have both boxes up and running and now also an untouched 3rd one as a backup. Thank you!