Kobo WiFi Hacking
Much of the information here was gathered from Craig Ringer's blog.
Contents |
[edit] How the Kobo Wifi does firmware updates
The Kobo Wifi has a very simple method of updating: if there is a file named KoboRoot.tgz in the .kobo folder of the public partition (the one you see when you connect your Kobo to your computer), the Wifi will extract everything from the KoboRoot.tgz to the root directory and then reboot.
This means that we can very easily create our own updates for the Kobo Wifi. The Aura HD is similar.
[edit] Disassembling the Kobo Wifi
The Kobo Wifi's case is held together by plastic clips all around the edge of the device. It can be pried open fairly easily with a plastic tool.
After popping the case off, there are four screws to loosen, and then you can ease the main board out of the case. The internal micro SD card can be found on the back of the board, in the lower-right corner.
[edit] Creating a backup of the internal SD card
The Kobo Wifi boots from a 2GB micro SD card found inside the device. If you are going to do any hacking, it is HIGHLY RECOMMENDED to create a copy of that internal SD card, so that in the event something goes wrong and your Kobo won't boot you can simply take the micro SD card out and restore it using your backup.
If you have an extra 2GB micro SD card lying around, you can go the extra mile and be even safer. Take the internal micro SD card from your Kobo Wifi, create a full backup of it, and copy that backup onto your spare micro SD. You can then place the internal micro SD from your Kobo in a safe place, and boot from your spare micro SD.
[edit] Copying the micro SD card on Linux
If you already have telnet access to your Kobo, you can create a full backup without ever opening your device (though you WILL have to open the case if anything goes wrong). Instructions on how to do this can be found at Craig Ringer's blog.
After getting the internal micro SD card out from inside your Kobo, creating a full backup is simple. Put your micro SD into your computer's card reader and run the command:
sudo fdisk -l
You should see some output like this:
... Disk /dev/sdc: 1977 MB, 1977614336 bytes 31 heads, 61 sectors/track, 2042 cylinders, total 3862528 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sdc1 7564 535152 263794+ 83 Linux /dev/sdc2 535153 1586548 525698 83 Linux /dev/sdc3 1586549 3861421 1137436+ b W95 FAT32
The part we're interested in is the line that shows a device with approximately 2GB of space (1977 MB to be exact)
Disk /dev/sdc: 1977 MB, 1977614336 bytes
So, my micro SD card is located at /dev/sdc (although your card location may vary). To create the backup, just run
sudo dd if=YOUR_CARD_LOCATION of=kobo_internal_microsd.img
This will take a while, so go find something else to do while you wait. After it finishes, you can be secure in the knowledge that you have a full backup in the event of your Kobo failing.
[edit] Enabling Telnet & FTP
There are two ways you can get telnet and ftp access on your Kobo.
[edit] The easy method
- Download this KoboRoot.tgz file
- Connect your Kobo Wifi to your computer and select "Manage Library"
- Copy the downloaded KoboRoot.tgz file to the .kobo folder on your Kobo
- Eject your Kobo and wait for it to reboot
- wait about 20 seconds after the home screen boots, until you see the blue LED flash a few times. (make sure you're connected to wifi. If you're not, connect now and then reboot your device.)
- Connect your Kobo to your computer again, and now look inside the .kobo folder for a file named ip.txt. This has your Kobo's IP address.
- You now have telnet and FTP access!
telnet YOUR_KOBO_IP_ADDRESS
Login as root, no password.
[edit] The step-by-step method
(note from external user : Method tested successfully with Kobo Glo (Firmware: 2.6.1 - 06/17/13) BUT I removed the forward slash at the end of the first line of inted.conf as advised in [KoboTouch] page, but maybe it works without removing it)
There are two files to edit in order to enable telnet/ftp. You can grab them from the internal micro SD card in your Kobo. they are:
- /etc/inetd.conf
- /etc/inittab
Make a folder on your computer named etc, and put inetd.conf and inittab in it.
Edit etc/inittab and add the lines:
::sysinit:/etc/init.d/rcS2 ::respawn:/usr/sbin/inetd -f /etc/inetd.conf.en
Edit etc/inetd.conf and add:
21 stream tcp nowait root /bin/busybox ftpd -w -S / 23 stream tcp nowait root /bin/busybox telnetd -i
You also need to create etc/init.d/rcS2 with the content:
#!/bin/sh mkdir -p /dev/pts mount -t devpts devpts /dev/pts /usr/sbin/inetd /etc/inetd.conf
and run
chmod a+x etc/init.d/rcS2
to flag it executable. Now tar up your etc folder into a KoboRoot.tgz file
tar czf KoboRoot.tgz etc
and copy it to the .kobo folder on your Kobo.
After your Kobo reboots and connects to wifi, you can get its IP address from a computer connected to the same network with
sudo nmap -sP 192.168.1.1-254
Just look for your Kobo's MAC address, and then telnet in! Login as root, no password.
[edit] Drawing to the Wifi's framebuffer
The Kobo Wifi uses a Linux framebuffer to display graphics on-screen. The nature of e-ink, however, requires a specific call to update the display after drawing to the framebuffer. But trying to open the framebuffer with Pygame (a Python library for SDL) outputs the error Unsupported console hardware.
Kobo Wifi models have been found with framebuffer depths of 4, 8, 16 and 32 bits. You can find out which one you have with the fbset command. The bit depth is the last number of the "geometry" line, bolded here.
[root@(none) /]# fbset
mode "600x800-0"
# D: 0.038 MHz, H: 0.063 kHz, V: 0.079 Hz
geometry 600 800 600 800 8
timings 26400000 0 0 0 0 0 0
accel false
rgba 8/0,8/0,8/0,0/0
endmode
If you have a Wifi with a 8-bit depth, the solution to draw to the screen is to change the file /sys/class/graphics/fb0/rotate. I don't know why this works, but running the command:
echo 1 > /sys/class/graphics/fb0/rotate
will make the framebuffer readable and writable. you don't have to echo 1, you can echo 2 or 0, and even echo > /sys/class/graphics/fb0/rotate works!
[edit] Drawing to a 4-bit display
It has not yet been figured out how to draw graphics directly to the framebuffer of a Kobo with a 4-bit display. The current solution is to create a raw image file that can be display with
cat image.raw | /usr/local/Kobo/pickel showpic
An explanation of how to create a raw image for the Kobo can be found in this post.
[edit] Updating the e-ink screen on an 8-bit display
So on 8-bit displays, we can draw to the framebuffer. But it's not much good if we can't update the e-ink display to see what we've done.
Kobo has an application on the Wifi, named "Pickel", that can be found in /usr/local/Kobo. A good example of the use of this program can be found in /etc/init.d/rcS, where we find the following line:
zcat /etc/images/reboot.raw.gz | /usr/local/Kobo/pickel showpic
We can cat images into pickel with the "showpic" option, and pickel will update the e-ink screen. But how can we tell pickel to update the screen after pygame/SDL draws to the framebuffer? cat /dev/fb0 | /usr/local/Kobo/pickel showpic works for about the top 100 pixels, but the remaining 700 pixels of the screen are pure black. To fix this problem, cat /dev/fb0 to a file, and then cat that file and pipe the output into pickel.
cat /dev/fb0 > /tmp/fb cat /tmp/fb | /usr/local/Kobo/pickel showpic
[edit] Various notes
- The blue LED on the Wifi can be somewhat controlled with these commands
/usr/local/Kobo/pickel blinkon
/usr/local/Kobo/pickel blinkoff
- You can restart nickel (the Kobo's GUI application) with this script:
#!/bin/sh # Kill off the old nickel pkill nickel # Clear plugin cache rm -f /mnt/onboard/.kobo/Trolltech.conf # Restart nickel export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/lib: export NICKEL_HOME=/mnt/onboard/.kobo export LD_LIBRARY_PATH=/usr/local/Kobo export QWS_KEYBOARD=netronix export INTERFACE=eth0 export LANG=en_US.UTF-8 /usr/local/Kobo/nickel -qws -display broadsheet_ioctl >/mnt/onboard/.kobo/nickel.log &
- Wi-fi can be turned off with
/usr/local/Kobo/pickel wifioff
And it can supposedly be turned back on (though I have not been able to get this to work) with
/usr/local/Kobo/pickel wifion
- You can simulate adding and removing a USB cable with
echo usb plug add >> /tmp/nickel-hardware-status
echo usb plug remove >> /tmp/nickel-hardware-status
- faking the registration
echo "insert into user values('foo', 'foo', 'foo', 'foo', 'foo');" | sqlite3 /path/to/kobo/.kobo/KoboReader.sqlite
[edit] Links to resources
- MobileRead forum - on adding internal memory to a Kobo Wireless model.
- Kobo Wifi weather forecast display
- Kobo's Linux kernel sources and open source code can be found on GitHub.
- There is a freenode IRC channel for Kobo development and hacking on #kobodev
- Craig Ringer's blog has quite a few posts about Kobo hacking.
