[Alexander Turcic]

Aside the obvious E Ink technology, what makes the iLiad and the Reader similar is the fact that both devices run on Linux. While we are still waiting for iRex and Sony to release SDKs, clever MobileReaders have found their own ways to gain shell access to both devices.

Here is a current round-up of all hacking attempts:

Sony Reader

• Remote read/write access via USB
  Igorsk reverse-engineered the USB communication to the Sony Reader to enable remote read/write access to the device, including making full dumps of flash partitions.
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8051
  
  
• Executing arbitary shell scripts
  Igorsk (he is our man!) wrote a tool to reflash the Sony Reader with a modified firmware that allows you to run arbitary shell scripts stored on external media.
  
  Discussion:
  https://www.mobileread.com/forums/sho...?threadid=8179

iRex iLiad

• WEP configuration input validation vulnerability (Firmware 2.7)
  Arivero discovered how you can execute arbitrary script code on the iLiad leading to full shell access (I leave the rest to your imagination).
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8144
  
  
• Open X server port vulnerability (Firmware 2.7)
  Design256 discovered how you can remotely access the X server on the iLiad and do all kinds of interesting things (such as running KDE's Kicker panel).
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=8125
  
  Screenshots:
  Running KDE's Kicker panel
  Browsing the Web
  
  
• Undocumented access to the iRex Delivery Server
  TadW reverse-engineered some of the XML commands to communicate with the iRex Delivery Server (iDS), and I wrote a small PHP script as proof of concept.
  
  Discussion:
  https://www.mobileread.com/forums/showthread.php?t=7812
  
  Screenshot:
  Accessing iDS with PHP