Kobo WiFi Hacking

From MobileRead
Jump to: navigation, search
Kobo Wifi weather forecast display

Much of the information here was gathered from Craig Ringer's blog.

Contents


[edit] How the Kobo Wifi does firmware updates

The Kobo Wifi has a very simple method of updating: if there is a file named KoboRoot.tgz in the .kobo folder of the public partition (the one you see when you connect your Kobo to your computer), the Wifi will extract everything from the KoboRoot.tgz to the root directory and then reboot.

This means that we can very easily create our own updates for the Kobo Wifi. The Aura HD is similar.


[edit] Disassembling the Kobo Wifi

The Kobo Wifi's case is held together by plastic clips all around the edge of the device. It can be pried open fairly easily with a plastic tool.

After popping the case off, there are four screws to loosen, and then you can ease the main board out of the case. The internal micro SD card can be found on the back of the board, in the lower-right corner.


[edit] Creating a backup of the internal SD card

The Kobo Wifi boots from a 2GB micro SD card found inside the device. If you are going to do any hacking, it is HIGHLY RECOMMENDED to create a copy of that internal SD card, so that in the event something goes wrong and your Kobo won't boot you can simply take the micro SD card out and restore it using your backup.

If you have an extra 2GB micro SD card lying around, you can go the extra mile and be even safer. Take the internal micro SD card from your Kobo Wifi, create a full backup of it, and copy that backup onto your spare micro SD. You can then place the internal micro SD from your Kobo in a safe place, and boot from your spare micro SD.

[edit] Copying the micro SD card on Linux

If you already have telnet access to your Kobo, you can create a full backup without ever opening your device (though you WILL have to open the case if anything goes wrong). Instructions on how to do this can be found at Craig Ringer's blog.

After getting the internal micro SD card out from inside your Kobo, creating a full backup is simple. Put your micro SD into your computer's card reader and run the command:

sudo fdisk -l

You should see some output like this:

...
Disk /dev/sdc: 1977 MB, 1977614336 bytes
31 heads, 61 sectors/track, 2042 cylinders, total 3862528 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
 
   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1            7564      535152      263794+  83  Linux
/dev/sdc2          535153     1586548      525698   83  Linux
/dev/sdc3         1586549     3861421     1137436+   b  W95 FAT32

The part we're interested in is the line that shows a device with approximately 2GB of space (1977 MB to be exact)

Disk /dev/sdc: 1977 MB, 1977614336 bytes

So, my micro SD card is located at /dev/sdc (although your card location may vary). To create the backup, just run

sudo dd if=YOUR_CARD_LOCATION of=kobo_internal_microsd.img

This will take a while, so go find something else to do while you wait. After it finishes, you can be secure in the knowledge that you have a full backup in the event of your Kobo failing.

[edit] Enabling Telnet & FTP

There are two ways you can get telnet and ftp access on your Kobo.

[edit] The easy method

  • Download this KoboRoot.tgz file
  • Connect your Kobo Wifi to your computer and select "Manage Library"
  • Copy the downloaded KoboRoot.tgz file to the .kobo folder on your Kobo
  • Eject your Kobo and wait for it to reboot
  • wait about 20 seconds after the home screen boots, until you see the blue LED flash a few times. (make sure you're connected to wifi. If you're not, connect now and then reboot your device.)
  • Connect your Kobo to your computer again, and now look inside the .kobo folder for a file named ip.txt. This has your Kobo's IP address.
  • You now have telnet and FTP access!
telnet YOUR_KOBO_IP_ADDRESS

Login as root, no password.

[edit] The step-by-step method

(note from external user : Method tested successfully with Kobo Glo (Firmware: 2.6.1 - 06/17/13) BUT I removed the forward slash at the end of the first line of inted.conf as advised in [KoboTouch] page, but maybe it works without removing it)


There are two files to edit in order to enable telnet/ftp. You can grab them from the internal micro SD card in your Kobo. they are:

  • /etc/inetd.conf
  • /etc/inittab

Make a folder on your computer named etc, and put inetd.conf and inittab in it.

Edit etc/inittab and add the lines:

::sysinit:/etc/init.d/rcS2
::respawn:/usr/sbin/inetd -f /etc/inetd.conf.en

Edit etc/inetd.conf and add:

21 stream  tcp     nowait  root    /bin/busybox ftpd -w -S  /
23 stream tcp nowait root /bin/busybox telnetd -i

You also need to create etc/init.d/rcS2 with the content:

#!/bin/sh
mkdir -p /dev/pts
mount -t devpts devpts /dev/pts
/usr/sbin/inetd /etc/inetd.conf

and run

chmod a+x etc/init.d/rcS2

to flag it executable. Now tar up your etc folder into a KoboRoot.tgz file

tar czf KoboRoot.tgz etc

and copy it to the .kobo folder on your Kobo.

After your Kobo reboots and connects to wifi, you can get its IP address from a computer connected to the same network with

sudo nmap -sP 192.168.1.1-254

Just look for your Kobo's MAC address, and then telnet in! Login as root, no password.

[edit] Drawing to the Wifi's framebuffer

The Kobo Wifi uses a Linux framebuffer to display graphics on-screen. The nature of e-ink, however, requires a specific call to update the display after drawing to the framebuffer. But trying to open the framebuffer with Pygame (a Python library for SDL) outputs the error Unsupported console hardware.

Kobo Wifi models have been found with framebuffer depths of 4, 8, 16 and 32 bits. You can find out which one you have with the fbset command. The bit depth is the last number of the "geometry" line, bolded here.

[root@(none) /]# fbset
mode "600x800-0"
       # D: 0.038 MHz, H: 0.063 kHz, V: 0.079 Hz
       geometry 600 800 600 800 8
       timings 26400000 0 0 0 0 0 0
       accel false
       rgba 8/0,8/0,8/0,0/0
endmode

If you have a Wifi with a 8-bit depth, the solution to draw to the screen is to change the file /sys/class/graphics/fb0/rotate. I don't know why this works, but running the command:

echo 1 > /sys/class/graphics/fb0/rotate

will make the framebuffer readable and writable. you don't have to echo 1, you can echo 2 or 0, and even echo > /sys/class/graphics/fb0/rotate works!

[edit] Drawing to a 4-bit display

It has not yet been figured out how to draw graphics directly to the framebuffer of a Kobo with a 4-bit display. The current solution is to create a raw image file that can be display with

cat image.raw | /usr/local/Kobo/pickel showpic 

An explanation of how to create a raw image for the Kobo can be found in this post.

[edit] Updating the e-ink screen on an 8-bit display

So on 8-bit displays, we can draw to the framebuffer. But it's not much good if we can't update the e-ink display to see what we've done.

Kobo has an application on the Wifi, named "Pickel", that can be found in /usr/local/Kobo. A good example of the use of this program can be found in /etc/init.d/rcS, where we find the following line:

zcat /etc/images/reboot.raw.gz | /usr/local/Kobo/pickel showpic

We can cat images into pickel with the "showpic" option, and pickel will update the e-ink screen. But how can we tell pickel to update the screen after pygame/SDL draws to the framebuffer? cat /dev/fb0 | /usr/local/Kobo/pickel showpic works for about the top 100 pixels, but the remaining 700 pixels of the screen are pure black. To fix this problem, cat /dev/fb0 to a file, and then cat that file and pipe the output into pickel.

cat /dev/fb0 > /tmp/fb
cat /tmp/fb | /usr/local/Kobo/pickel showpic

[edit] Various notes

  • The blue LED on the Wifi can be somewhat controlled with these commands
/usr/local/Kobo/pickel blinkon
/usr/local/Kobo/pickel blinkoff


  • You can restart nickel (the Kobo's GUI application) with this script:
#!/bin/sh
# Kill off the old nickel
pkill nickel
# Clear plugin cache
rm -f /mnt/onboard/.kobo/Trolltech.conf
# Restart nickel
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/lib:
export NICKEL_HOME=/mnt/onboard/.kobo
export LD_LIBRARY_PATH=/usr/local/Kobo
export QWS_KEYBOARD=netronix
export INTERFACE=eth0
export LANG=en_US.UTF-8
/usr/local/Kobo/nickel -qws -display broadsheet_ioctl >/mnt/onboard/.kobo/nickel.log &


  • Wi-fi can be turned off with
/usr/local/Kobo/pickel wifioff

And it can supposedly be turned back on (though I have not been able to get this to work) with

/usr/local/Kobo/pickel wifion


  • You can simulate adding and removing a USB cable with
echo usb plug add >> /tmp/nickel-hardware-status
echo usb plug remove >> /tmp/nickel-hardware-status


  • faking the registration
echo "insert into user values('foo', 'foo', 'foo', 'foo', 'foo');" | sqlite3 /path/to/kobo/.kobo/KoboReader.sqlite

[edit] Links to resources

Personal tools
Namespaces

Variants
Actions
Navigation
MobileRead Networks
Toolbox