Gaining root on FLSun Speederpad with (v1.40) stock firmware

flsun-speeder-pad-root.md

FLSun Speeder Pad Root via Serial TTY

This guide allows you to root a stock FLSun Speeder Pad without erasing anything. You only need a Phillips Screw driver, a plastic wedge tool, a USB to Serial USB Adapter (that supports 3v3) and 3 dupont female-female wires.

2024/03 - I noticed a typo in this guide on the setenv init lines which I corrected

2024/03 - Tested with clean FLSun v400 speeder-pad firmware at v1.4

Alternatively you can root the device by flashing a recovery image and overwriting the FLSun Klipper build: https://github.com/Guilouz/Klipper-Flsun-Speeder-Pad

1) Open the case Speeder Pad case: There are 2 Phillips screws and multiple snaps. Use a plastic thin wedge to unclip the snaps and separate the back cover from the device.

There is a 3 pin connector on the motherboard that has the labels RX,TX and GND

Connect a serial to USB adapter, set to 3v3

• RX->TX
• TX->RX
• GND-GND

2) Connect to the device with a serial console app like Putty or screen, the baud rate is 115200

To get a u-boot console you have to quickly press a key on your keyboard to interrupt bootup sequence, immediately after powering the device on with the 24vdc+ barrel connector coming from the printer

Once you are in the u-boot console:

=> setenv bootdelay 5
=> setenv init /bin/sh -m
=> saveenv
Saving Environment to SUNXI_FLASH... Writing to redundant env... OK
=> boot

After boot-up you should be presented with a logged in root session where you can add the pi user to the "sudo" group and change it's password:

/bin/sh: 0: can't access tty; job control turned off
 #  [    7.159243] 
 [    7.159243] insmod_device_driver
 [    7.159243] 
 # bash
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
root@(none):/# usermod -a -G sudo pi
root@(none):/# id pi
uid=1000(pi) gid=1000(pi) groups=1000(pi),4(adm),5(tty),20(dialout),27(sudo),44(video)
root@(none):/# passwd pi 

Reboot and interrupt boot again

In u-boot console:

=> setenv init /sbin/init
=> saveenv
Saving Environment to SUNXI_FLASH... Writing to redundant env... OK
=> boot

Once the device boots, you can now connect to it via SSH with the pi / whatever_password_you_set

IMG20230122202702.jpg

IMG20230122222639.jpg

Hello everyone, I gained root access to the V400 speeder-pad version V1.4. Here is how I did it:

Gain U-Boot access described above

=> setenv bootdelay 5
=> setenv init /bin/sh -m
Do not use "saveenv" at this point, so the environment variable will only be used for this boot. The next cycle your speeder pad will boot normal.
=> boot

After that you get a sh prompt.
sh-5.0#
sh-5.0# passwd pi
after typing the password 2 times just
=> exit

try ssh connect with the pi user and the set password.

For changing the root password just type "sudo passwd root" in the ssh connection and reenter the new root password 2 times.

Regards
Timo

Hello everyone, I gained root access to the V400 speeder-pad version V1.4. Here is how I did it:

Gain U-Boot access described above

=> setenv bootdelay 5 => setenv init /bin/sh -m Do not use "saveenv" at this point, so the environment variable will only be used for this boot. The next cycle your speeder pad will boot normal. => boot

After that you get a sh prompt. sh-5.0# sh-5.0# passwd pi after typing the password 2 times just => exit

try ssh connect with the pi user and the set password.

For changing the root password just type "sudo passwd root" in the ssh connection and reenter the new root password 2 times.

Regards Timo

Thanks, I made the correction to the init lines. Sorry it took so long, I did not get notifications of the comments for some reason.

I have used this How To ...
Perfect, it is OK

Now I am lookin for to fix the MAC address under U Boot