MobileRead Forums - View Single Post - Touch Document about Hacking a little more the touch

KoboTouchUser · 11-09-2012, 07:11 AM

Hi guys,

First, I need to advise you that I'm French, and I speak a bad english...

I started looking for kobo touch hacks two weeks ago. I red anything I've found on this forum and from Google. I also red the doc from freescale on i.mx 50 boards and studied the ressources from the git of KoboReader.

My Kobo Touch is an earlier one with an i.mx 508 from freescale board, I then looked in
KoboReader/hw/imx508/cls/ and found the source of the kernel and u-boot.
By exploring u-boot source I found these lines in u-boot-2009-08.tar.gz/include/configs/mx50_arm2.h :

Code:

#define	CONFIG_EXTRA_ENV_SETTINGS					\
		"uboot=u-boot.bin\0"			\
		"kernel=uImage\0"				\
		"bootargs_base=setenv bootargs console=ttymxc0,115200 rootfstype=ext4 rootwait rw video=mxcepdcfb:E60_V220 quiet lpj=3997696\0"\
		"bootargs_mmc=setenv bootargs ${bootargs} root=/dev/mmcblk0p1\0" \
		"bootcmd_mmc=run bootargs_base bootargs_mmc;mmc read 2 0x70800000 0x800 0x1800; bootm\0"   \
		"bootargs_SD=setenv bootargs ${bootargs} root=/dev/mmcblk1p1\0" \
		"bootcmd_SD=run bootargs_base bootargs_SD;mmc read 0 0x70800000 0x800 0x1800; bootm\0"   \
		"bootargs_recovery=setenv bootargs ${bootargs} root=/dev/mmcblk0p2\0" \
		"bootcmd_recovery=run bootargs_base bootargs_recovery;mmc read 2 0x70800000 0x800 0x1800; bootm\0"   \
		"bootcmd=run bootcmd_mmc\0" \
		"verify=no"

It seems it is possible to boot my Kobo touch from SDcard*!

What I tried on my Kobo Touch*:

- I copied the mmcblk0 eMMC on SD at mmcblk1 with this command that I typed in an USB telnet telnet session with my Kobo device*:

Code:

> dd if=/dev/mmcblk0 of=/dev*/mmcblk1 bs=512K

- I changed the line*:

Code:

"bootcmd=run bootcmd_mmc\0"

by

Code:

"bootcmd=run bootcmd_SD\0"

in mx50_arm2.h file.

- I compiled a new u-boot with these commands*in extracted u-boot from the KoboReader git (on Linux PC):

Code:

> make distclean
> make mx50_arm2_config
> make

- I updated the u-boot.bin of my Kobo Touch with the one I built (using well documentaded Kobo upgrade method).

The Kobo Touch then booted.

Later, As i was trying to connect by wifi, it showed a black screen and did not respond anymore, it is charged, it is not recognized by the computer. Well, it is bricked.

SO PLEASE DO NOT ISSUE THE COMMANDS I GAVE YOU UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING, IT COULD BRICK YOUR DEVICE. A SIMPLE RECOVERY WILL NOT BRING BACK NEW U-BOOT SO WON T UNBRICK THE DEVICE.
MAY BE YOU DON T HAVE A FREESCALE IMX 508 BASED KOBO TOUCH. WHAT I SHOWED IN THIS ARTICLE IS ONLY FOR THIS KIND OF DEVICE AND IT COULD EVEN BRICK IT. THIS IS PROVIDED ONLY FOR INFORMATION AND I COULD NOT BE RESPONSIVE OF WHAT YOU DID WITH IT

NOTE: I ve found the same types of u-boot lines in ntx based kobo touch, imx 507 based kobo touch, even kobo glo devices.

11-09-2012, 07:11 AM	#1
KoboTouchUser Junior Member Posts: 3 Karma: 1090 Join Date: Nov 2012 Location: France Device: Kobo Touch	Document about Hacking a little more the touch Hi guys, First, I need to advise you that I'm French, and I speak a bad english... I started looking for kobo touch hacks two weeks ago. I red anything I've found on this forum and from Google. I also red the doc from freescale on i.mx 50 boards and studied the ressources from the git of KoboReader. My Kobo Touch is an earlier one with an i.mx 508 from freescale board, I then looked in KoboReader/hw/imx508/cls/ and found the source of the kernel and u-boot. By exploring u-boot source I found these lines in u-boot-2009-08.tar.gz/include/configs/mx50_arm2.h : Code: #define CONFIG_EXTRA_ENV_SETTINGS \ "uboot=u-boot.bin\0" \ "kernel=uImage\0" \ "bootargs_base=setenv bootargs console=ttymxc0,115200 rootfstype=ext4 rootwait rw video=mxcepdcfb:E60_V220 quiet lpj=3997696\0"\ "bootargs_mmc=setenv bootargs ${bootargs} root=/dev/mmcblk0p1\0" \ "bootcmd_mmc=run bootargs_base bootargs_mmc;mmc read 2 0x70800000 0x800 0x1800; bootm\0" \ "bootargs_SD=setenv bootargs ${bootargs} root=/dev/mmcblk1p1\0" \ "bootcmd_SD=run bootargs_base bootargs_SD;mmc read 0 0x70800000 0x800 0x1800; bootm\0" \ "bootargs_recovery=setenv bootargs ${bootargs} root=/dev/mmcblk0p2\0" \ "bootcmd_recovery=run bootargs_base bootargs_recovery;mmc read 2 0x70800000 0x800 0x1800; bootm\0" \ "bootcmd=run bootcmd_mmc\0" \ "verify=no" It seems it is possible to boot my Kobo touch from SDcard! What I tried on my Kobo Touch: - I copied the mmcblk0 eMMC on SD at mmcblk1 with this command that I typed in an USB telnet telnet session with my Kobo device: Code: > dd if=/dev/mmcblk0 of=/dev/mmcblk1 bs=512K - I changed the line: Code: "bootcmd=run bootcmd_mmc\0" by Code: "bootcmd=run bootcmd_SD\0" in mx50_arm2.h file. - I compiled a new u-boot with these commandsin extracted u-boot from the KoboReader git (on Linux PC): Code: > make distclean > make mx50_arm2_config > make - I updated the u-boot.bin of my Kobo Touch with the one I built (using well documentaded Kobo upgrade method). The Kobo Touch then booted. Later, As i was trying to connect by wifi, it showed a black screen and did not respond anymore, it is charged, it is not recognized by the computer. Well, it is bricked. SO PLEASE DO NOT ISSUE THE COMMANDS I GAVE YOU UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING, IT COULD BRICK YOUR DEVICE. A SIMPLE RECOVERY WILL NOT BRING BACK NEW U-BOOT SO WON T UNBRICK THE DEVICE. MAY BE YOU DON T HAVE A FREESCALE IMX 508 BASED KOBO TOUCH. WHAT I SHOWED IN THIS ARTICLE IS ONLY FOR THIS KIND OF DEVICE AND IT COULD EVEN BRICK IT. THIS IS PROVIDED ONLY FOR INFORMATION AND I COULD NOT BE RESPONSIVE OF WHAT YOU DID WITH IT NOTE: I ve found the same types of u-boot lines in ntx based kobo touch, imx 507 based kobo touch, even kobo glo devices.