(semi)automatic dump of Kobo firmware on a SD card

[met67]

Hi,

waiting for my Aura to come, I put together a simple hack to automatically dump the internal firmware of a Mark 4 Kobo (i.e. Mini, Glo, Aura and recent Touch) on an SD card. This should work on any recent version of the firmware...

As usual I assume no responsibility for any damage on your device, I have tested it on a Glo and it works for me…

You will need a SD card with enough free space to hold the whole firmware (i.e, 2/4GB for Glo, 4 for Aura, and so on). I used a 16GB SD, just to be sure
You should also start with a fully charged Kobo.

The trick uses a modified upgrade-wifi.sh script in /etc/init.d; this script is started during a firmware upgrade when there is a upgrade folder in .kobo, and I modified it to dump the internal card to folder KoboDump in the SD.

In order to dump the firmware, insert an SD with at least 2GB free (I suggest using a larger card…) in your Kobo, connect it to the PC and create an empty folder named KoboDump on the root of the SD. Then extract the contents of DumpScript zip and copy KoboRoot.tgz and upgrade folder in folder .kobo within the internal memory (be careful that KoboRoot.tgz and upgrade should be right within .kobo folder and not in a subfolder).

Now eject your Kobo and disconnect it from the PC: you should see the usual upgrade screens. If everything goes as expected, you should wait for a long time while the script dumps the firmware: on a Glo I waited more than 25 minutes for a 2GB dump.

After a (possibly quite) long time, your Kobo will restart. Connect it again to the PC and you should find that the KoboDump folder has been renamed to KoboDumpDone. Inside it you should find a dump.img file: this is your dump.
Copy it on your PC and you should be able to open it (under Windows) with DiskInternal’s Linux Reader, which gives you access to all the partitions: rootfs, recoveryfs and FAT.

To restore the original upgrade-wifi.sh, extract the KoboRoot.tgz from OriginalScript zip to the .kobo folder, disconnect and wait a couple of minutes until the script is copied back.

Let me know if this works for you, and which model you dumped with this.

[tshering]

Thank you for your work. This is something I was thinking of a long time, but did not dare to try myself because of missing knowledge of linux and bash.

[met67]

For the sake of completeness I am posting the code that I added to upgrade-wifi.sh and wich is responsible for the backup:

#
# Dump internal firmware on uSD
#
if [ -e /dev/mmcblk1p1 ]; then
  # mount uSD (umount first just in case udevd has already mounted it in readonly)
  umount /mnt/sd
	dosfsck -a -w /dev/mmcblk1p1
  mount -t vfat -o iocharset=utf8 /dev/mmcblk1p1 /mnt/sd

  if [ -e /mnt/sd/KoboDump ]; then
    # mount / as readonly and unmount internal FAT
    mount -o remount,noatime,nodiratime,ro /dev/mmcblk0p1 /
    umount /mnt/onboard

    # test uSD: if mount failed, /mnt/sd/.123sdcheck123 can't be created since / is readonly
    touch /mnt/sd/KoboDump/.123sdcheck123
    if [ -e /mnt/sd/KoboDump/.123sdcheck123 ]; then
      rm -rf /mnt/sd/KoboDump/.123sdcheck123
      # dump...
      dd if=/dev/mmcblk0 of=/mnt/sd/KoboDump/dump.img bs=512
      # rename KoboDump to avoid (improbable) loops
      mv /mnt/sd/KoboDump /mnt/sd/KoboDumpDone
    fi
    # restore mounted devices as expected
    mount -o remount,noatime,nodiratime,rw /dev/mmcblk0p1 /
    mount -t vfat -o iocharset=utf8 /dev/mmcblk0p3 /mnt/onboard
  fi
  umount /mnt/sd
fi

[KevinShort]

Very nice, should be very useful for those who don't want to open their device.

[met67]

I have checked the new 2.5.2 fw and the didn't change the stuff that I use so my zips should work fine with the upgraded version.

I have also checked the so called mark 3 firmware (the one for N905s) and the backup procedure should work fine also on thos Kobos.

[parkher]

Any news?

What about 2.6.1 on Aura?

[Ken Maltby]

Does this copy the 10mg Unallocated partition at the start of the SD? Kobo is using some of that space as well. In other words is it a true clone of the internal SD card?

Luck;
Ken

[met67]

Originally Posted by Ken Maltby

Does this copy the 10mg Unallocated partition at the start of the SD? Kobo is using some of that space as well. In other words is it a true clone of the internal SD card?

Luck;
Ken

Yes, it does a full dump of the internal SD (or a true clone, as you call it).
Recently I took a dump of a friend's Glo and found that the size of the dump was that of a 4GB SD, so I enabled telnet on it and enlarged the user FAT partition without opening it, by using fdisk, a bit of tar and mkfs.vfat (please note that this is a bit dangerous...)

[met67]

Originally Posted by parkher

Any news?

What about 2.6.1 on Aura?

Yes, this should work also on 2.6.1 (on every kind of Kobo).

[parkher]

So, my dump.img size of the internal card of Aura HD is 3,965,190,144 bytes.
Can somebody confirm that the size is correct?

[Ken Maltby]

The image of my new pristine AuraHD is 3,872,256 KB

The image of my lightly used AuraHD is the same.

But that is just how Win7 Windows Explorer is reporting its size.

On Its Property page it's: 3.69 GB (3,965,190,144 bytes)

Looks the same to me.

Oh and the image came from the uSD card removed from my AuraHDs, not the dump described here.

Luck;
Ken

[met67]

Originally Posted by parkher

So, my dump.img size of the internal card of Aura HD is 3,965,190,144 bytes.
Can somebody confirm that the size is correct?

This is also the size of my dump.img.

[Anak]

Dump works fine with a Mach 3 (old) Touch N905. But placing it back is probably not possible.

[Ken Maltby]

Originally Posted by Anak

Dump works fine with a Mach 3 (old) Touch N905. But placing it back is probably not possible.

Why not? It would not likely be a problem in windows, as long as Windows sees the internal memory, just sees it, even if it says it wants to format it. You wouldn't of course. Then programs that write .img files will be able to put your image onto the internal memory. There are a number of free tools like that for Windows, I would expect the same for Linux.

Luck;
Ken

[PeterT]

The original N905 touches did NOT have an SD card in them....