I've recently got an ebook reader - I decided to take a Kobo for a number of ressons:
- pretty cheap
- easily hackable (and it seems that they understand Open Source - Most of the software for their devices is on github - https://github.com/kobolabs )
- no hard vendor lock-in (Well, they do have their kobo-store, but you are not forced to use it.)
First a Warning:
Hacking the firmware of embedded devices always includes the risk to break the device. And it may void Warranty.
If you can't live with that risk don't do it!
And always backup all your data first! If you screw something up you will need to do a factory reset - and this will wipe all data.
Why rsync? For backups - my tool of choice is
dirvish. Of course I could connect the Kobo via USB, mount it and do the backup from there, but I prefer the direct way. And I can do a full system backup, not only the data.
Step 1) Getting a root Shell
The Kobo runs on Linux with busybox, so it has a telnet server already installed but not activated. So we don't need additional software for this step, we just need to change a few config files. To do this the update system can be misused - it's pretty simple: Connect via USB and put a KoboRoot.tgz into the .kobo folder. This file will then be extracted to / - without any kind signature checks or similar. Easy to use, but also easy to break stuff.
Some tutorials I found recommend to do a factory reset first, I did not and it just worked fine.
The hardest part is to find the download Url of the firmware package. You could try to run an update on your Kobo and sniff the network or use the (Win only) setup software and have a look what it downloads. Or just trust other people who have already collected the urls - like
in this thread @ mobileread.com.
Unzip that and you will find KoboRoot.tgz besides other stuff we don't need now.
From the tar we just need a few files:
tar -xvzf ../KoboRoot.tgz ./etc/init.d/rcS ./etc/inetd.conf ./etc/inittab
In the Package for my device there is no /etc/inittab included, so I had to trust the files I found in the net.
Get inetd to listen on port 23 and run telnet - add to etc/inetd.conf:
23 stream tcp nowait root /bin/busybox telnetd -i
The standard firmware does not mount /dev/pts which is necessary for telnet. I added to etc/init.d/rcS just below the other mount-lines:
mkdir -p /dev/pts
mount -t devpts devpts /dev/pts
And finally we need to make sure inetd gets started. Add to etc/inittab:
::respawn:/usr/sbin/inetd -f /etc/inetd.conf
or like I did just create the etc/inittab
::sysinit:/etc/init.d/rcS
::respawn:/sbin/getty -L ttymxc0 115200 vt100
::ctrlaltdel:/sbin/reboot
::shutdown:/bin/umount -a -r
::restart:/sbin/init
::respawn:/usr/sbin/inetd -f /etc/inetd.conf
Tar this into a KoboRoot.tgz and put the file into .kobo on your device. After disconnecting USB it will install it and reboot. Turn on Wifi in the settings and start the Browser (it enables Wifi only on demand, starting the browser makes sure it really does) and you should be able to connect via telnet as root without password. The kobo is wide open now, do this only in a secure network.
Step 2) install the dropbear ssh server
So far I'm too lazy to set up a build environment for the Kobo, so I'm using binaries from the debian armhf port. After reading
tjms comment I started with Maemo binaries. While they do work for dropbear they fail with rsync, more about that later.
Download the deb from
https://packages.debian.org/wheezy/armhf/dropbear/download, unpack it and create a Kobo update package:
mkdir d
cd d
ar x ../dropbear*.deb data.tar.gz
tar xzf data.tar.gz
tar -cvzf ../KoboRoot.tgz usr/{bin,lib,sbin}
Copy the KoboRoot.tgz into .kobo of the reader and let it install and reboot again.
Then connect via telnet to set it up:
# add the private key(s) for the box(es) you want to connect from
mkdir -p /root/.ssh
echo "your key" >> /root/.ssh/authorized_keys
# create host key
mkdir -p /etc/dropbear
cd /etc/dropbear
test -f rsa_host_key || dropbearkey -t rsa -f rsa_host_key
test -f dss_host_key || dropbearkey -t dss -f dss_host_key
# dropbear complains if this is not present
touch /var/log/lastlog
# edit /etc/passwd
vi /etc/passwd
Here we need to disable the login without password and change root's home directory from / to /root.
root:x:0:0:root:/root:/bin/sh
You could also set a password for root, but for me it's fine to have pubkey access only.
In the passwd file there is a second root user "admin" with password "admin". I don't know yet if it's used for something and if it's safe to delete it.
Now we can try dropbear:
/usr/sbin/dropbear -d /etc/dropbear/dss_host_key -r /etc/dropbear/rsa_host_key -F -s -E
Try to login via ssh. Maybe there are some permissions to change.
If this is successful add dropbear to /etc/inittab:
::respawn:/usr/sbin/dropbear -d /etc/dropbear/dss_host_key -r /etc/dropbear/rsa_host_key -F -s
and remove the previously added line for inetd (telnet).
Step 3) rsync
This took me a while since I started with Maemo packages - rsync just did exit 1 without any further notice, strace and LD_DEBUG did not really help, finally derRichard pointed me to the right direction: The Kobo uses EABI5, Maemo EABI4, so everything that needs additional shared libraries will fail.
Download rsync and libpopt from
https://packages.debian.org/wheezy/armhf/rsync/download and
https://packages.debian.org/wheezy/armhf/libpopt0/download
This time no more need to use the Kobo updater, i just scp it to the device:
ar x rsync_*.deb data.tar.gz
mkdir rsync
cd rsync
tar -xvzf ../data.tar.gz
scp usr/bin/rsync root@kobo:/usr/bin/
cd ..
ar x libpopt0_*.deb data.tar.gz
mkdir libpopt
cd libpopt
tar -xvzf ../data.tar.gz
scp scp lib/libpopt.so.0.0.0 root@kobo:/lib/
and on the Kobo:
cd /lib
ln -s libpopt.so.0.0.0 libpopt.so.0
and rsync works:
[root@(none) ~]# rsync --version
rsync version 3.0.9 protocol version 30
Copyright (C) 1996-2011 by Andrew Tridgell, Wayne Davison, and others.
Web site: http://rsync.samba.org/
Capabilities:
64-bit files, 64-bit inums, 32-bit timestamps, 64-bit long ints,
socketpairs, hardlinks, symlinks, IPv6, batchfiles, inplace,
append, ACLs, xattrs, iconv, symtimes
rsync comes with ABSOLUTELY NO WARRANTY. This is free software, and you
are welcome to redistribute it under certain conditions. See the GNU
General Public Licence for details.
some Kobo hacking resources:
Make Love not War - frei nach dieser Devise sollen die Maschinen dafür verwendet werden Liebesbriefe zu verschicken. Allerdings erleichtert das auch einem Angreifer die Entschlüsselung der Nachrichten.
Samstag 24.05.2014 - Einlass 21:00 - Eintritt frei! - @P.M.K.
live: MILLICENT INGRAM (ibk/berlin)
djs: BADSPIN | ..EGO. | ROBELIX
Keep calm and invade the p.m.k
Innsbrucks Hackerspace legt wieder die Lötkolben beiseite, packt seine Blinkendingse, Matekisten und Aluhüte und macht sich auf in die p.m.k
Dort feiert das IT-SYNDIKAT sein 100 jähriges Bestehen. Die DJs BADSPIN, ..EGO. und ROBELIX bringen Crypto in die Party und MILLICENT
INGRAM hauen rein bis dem letzten Vogonen der Kopf platzt. Vergesst eure Handtücher nicht, denn ab Mitternacht ist Towel Day.
Hack Systems! Hack Society! Hack Spaces!
