These guys seem to have answers:
http://www.androidtablets.net/forum/...ed/index2.html
Custom Roms, disassembly, all.
And no custom recovery. But since we can mount the recovery partition, we could just replace Kobos wiper with the Aosp recovery. There we might get full adb access. If that works, no custom recovery needed.
http://www.androidtablets.net/forum/...very-mode.html
Flashing:
http://www.androidtablets.net/forum/...n-process.html
Will try tomorrow.