tonie hacking

https://tonies-wiki.revvox.de/docs/tools/teddycloud/setup/dump-certs/esp32/

# extract firmware
esptool.py -b 921600 read_flash 0x0 0x800000 tb.esp32.bin
# extract certficates from firmware
mkdir certs/client/esp32
mkdir certs/client/<mac>
teddycloud --esp32-extract tb.esp32.bin --destination certs/client/esp32

# Copy box certificates to teddyCloud
cp certs/client/esp32/CLIENT.DER certs/client/<mac>/client.der
cp certs/client/esp32/PRIVATE.DER certs/client/<mac>/private.der
cp certs/client/esp32/CA.DER certs/client/<mac>/ca.der

# In case of first Toniebox setup for TeddyCloud
cp certs/client/<mac>/client.der certs/client/client.der
cp certs/client/<mac>/private.der certs/client/private.der
cp certs/client/<mac>/ca.der certs/client/ca.der


# copy firmware backup
cp tb.esp32.bin tb.esp32.fakeca.bin

# inject new CA into firmware
teddycloud --esp32-inject tb.esp32.fakeca.bin --source certs/client/esp32-fakeca
# modify IP
teddycloud --esp32-hostpatch tb.esp32.fakeca.bin --hostname 10.1.0.1

# flash firmware with new CA
esptool.py -b 921600 write_flash 0x0 tb.esp32.fakeca.bin

I was finally able to get it working!!

I had to:

1. Let teddycloud generate the certs
2. dump the firmwrad
3. run the copy commands above
4. Use a macvlan in docker compose to get an isolated IP
5. Use a fresh firmware backup, then inject the CA and also set the host to the ip of the container (10.1.0.1).
6. Download yt-dlp
7. Download some music
8. Upload the music to convert to the right format
9. Select the music from a Tonie configuration screen

Here’s that docker-compose.yaml with the macvlan

services:
  teddycloud:
    container_name: teddycloud
    hostname: teddycloud
    image: ghcr.io/toniebox-reverse-engineering/teddycloud:latest
      #network_mode: host
    networks:
      teddy_macvlan:
        ipv4_address: 10.1.0.1
    ports:
      - 80:80 #optional (for the webinterface)
      - 8443:8443 #optional (for the webinterface)
      - 443:443 #Port is needed for the connection for the box, must not be changed!
    volumes:
      - ./certs:/teddycloud/certs #certificates of the server
      - config:/teddycloud/config #config file for the server and the boxes
      - content:/teddycloud/data/content #microSD representation for the boxes
      - library:/teddycloud/data/library #library to manage content
      - custom_img:/teddycloud/data/www/custom_img #location to store custom images for custom tonies json
      - firmware:/teddycloud/data/firmware #firmware backups
      - cache:/teddycloud/data/cache #img cache for content images
    restart: unless-stopped
volumes:
  certs:
  config:
  content:
  library:
  custom_img:
  firmware:
  cache:
networks:
  teddy_macvlan:
    driver: macvlan
    driver_opts:
      parent: enp1s0
    ipam:
      config:
        - subnet: 10.0.0.0/8
          gateway: 10.0.0.1

Unfortunately the NFC tags that I got don’t work, and so I had to order a custom batch. Almost there…!