Hacking on the PRS-600 - can you run arbitrary code?

[Auger]

Porkupan hi, I realized that after I had posted the main thing is to hang onto the buttons until it loads, I stole the file from a 505 app as to begin with I couldnt get the diags to load ( hold the buttons dummy) lol. Has anyone managed to load stuff i.e js script yet from an SD card. I am a complete novice to this, just wanted to prove to myself that it did work.

Regards Auger

[Cormier]

Hello everyone. I registered just for the sake of bumping this thread, as I am very interested if any progress has been made in hacking this device.

[jayupark]

BUMP... Me too

[kartu]

Expect folder support in foreseeable future.

[Xaphiosis]

If you're interested in arbitrary code execution, please check out my threads in the sony reader dev section, especially this one, which has explanations of how to get it all to work inside the attachment, as well as a silly video:
https://www.mobileread.com/forums/showthread.php?t=82714

I've also got another way of doing it. I modified the cramfs image provided with the boroda firmware to check if /reader/main_boot.sh exists on an SD card and run that before trying to run the default sony interface. I have implemented and tested it today, and it works fine. I've also put in the EXT2 kernel module, so if you format your SD card to be EXT2 rather than FAT, it'll still work.

Also today, I managed to get QEMU going, emulating an ARM board running debian, because I got sick of unpacking .deb files manually. I have a silly dream of putting python on the device.

I'm at the stage where I'm wondering if anyone is interested in an openinkpot port to the 600.

I think most stuff should work except for DRM / sony book store (I have the feeling I could break it, but I have no time for it nor do I really care a lot about it), audio (simply because I haven't looked at it at all) and AC power (possibly in the future). Charging via USB will definitely work for 100mA trickle charging, and though I currently can't detect whether the host supports 500mA charging, I can still force it manually.

As usual, if you have questions, ask. The more specific they are, the faster I'll answer :P

Actually, here is a list of stuff I've figured out vs what I wanted to figure out:

Components:
USB
  + detect being plugged in
  + loading g_serial and pretending to be a serial port
  + loading g_file_storage and pretending to be a storage device
    (only works when /proc/usbtg were cleanly removed, i.e. nothing was using
     it at the time the last module that provided it (e.g. g_file_storage) was
     removed)
SD card
  + detecting insertion
  + detecting removal
  - suspending scan/power if possible (I think not possible directly)
MS card
  + detecting insertion
  + detecting removal
  - suspending scan/power if possible (I think not possible directly)
Buttons
  + detecting button press/release
  + deactivating button scanning if possible
Touchscreen
  + turn scanning on/off
  . set sampling rate (figured out, code not written yet)
  . set break threshold whatever it is (investigating what it is)
  . calibration (easy, simple linear interpolation, just have to do it)
  + getting raw x/y
  - figuring out junk whatever it is
  - figuring out pressure if necessary
  - pressure -> what is it, what does "caliculate[sic] pressure" do?
LED
  - red (set automatically from arcotg driver I think)
  + amber: fading, pulsing, on
Audio
  - play audio
  - adjust volume
  - check if audio is playing / busy
  - stop audio
  - power down audio system if possible
EInk
  + drawing to the framebuffer
  + changing orientation (set, changing at drawing time doesn't work so great)
  + figuring out the difference between flip modes 0,1,2,3
  + checking if device is busy drawing (/proc/e-ink, fb ioctl GET_DISP_STATUS)
  + does it block or queue (it blocks)
  + checking temperature
Battery
  + checking battery level
  . interpreting battery level to something useful 
    (levels defined in config.xml in /opt/sony/.../application, use those)
  ? telling device to charge from USB (/proc/usbtg/usbcharge should do it?)
    (doesn't work when g_serial is installed since I haven't fully hacked in
     sony's modifications to the usbtg interface)
    (I can do it by talking to the wm8350 chip, but I'm not sure how to do it
     safely)
Misc
  + power off (poweroff, or subcpu power off signal)
  . get and set the time from RTC (via wm8350, just not done yet)
  - alarms/timers for waking up 
    (wm8350 alarm, I know how to set it, just don't know what it's used for)
  - checking plugged into AC
  - charging from AC? (wm8350 will do it, but does it do it automatically
    or does it have to be told?)
  + suspend usb via /proc/usbtg/suspend (not when g_serial installed)
   
Maybe
  - being able to flash by modifying the mtd blocks directly

[sherman]

I've been watching what both you and Kartu have been doing lately.

My personal opinion is instead of trying to port a brand new firmware (like OI), see if you developers can port apps like FBreader and (perhaps more importantly) launch them from within the current firmware.

Just my thoughts on the matter.

BTW, just out of interest, how similar/different are the underlying firmware between the 505 and 600?

[Xaphiosis]

Could you elaborate on your vision or provide an example use case for what you mean by "launch them within the current firmware"? I understand how my approach doesn't do what you want, as I started with completely different goals, but how doesn't kartu's do it for you?

As for the difference between the 505 and 600: I don't know. I only have a 600, and even that I only got it last month. I can't afford many gadgets, so I tend to be behind the times. I know from the 600 firmware that the 600/700 firmware are nearly identical.

[sherman]

Kartu and co. have done amazing work (I finally got around to installing PRS+ today and loving it to bits), but from what I can make out, PRS+ is basically just making full use of the Javascript abilities already present. He can't, for example, let us use a different ebook renderer from the ones that Sony provide.

Basically, what I'm saying is that it would be awsome if some day we could select a book from the menu, and have a choice of what renderer we want to use (eg: ADE/other).
To do this, I assume compatible binaries need to be created, and then somehow be able to be launched from within the current framework.

Of course, an alternative renderer is is just one possibility if programs can be gotten to run on our readers...

[kartu]

sherman

use a different ebook renderer from the ones that Sony provide.

If you harness this:
https://www.mobileread.com/forums/showthread.php?t=11280

It's a matter of minutes to integrate new viewer into PRS+ (well, actually into any custom firmware). And it would also work with all Sony's bells and whistles (goto, bookmark etc) out of the box. All that viewers do is render the actual text page, links, status bar etc is done in ECMAScript.

programs can be gotten to run on our readers...

PRS+ already integrates igorsk's hack, that allows launching external executables. DicitonaryCL starts "grep" every time you perform search. "Browse Folders" calls "mount /umount" etc.

[sherman]

In other words, all that's really needed is for someone willing and able to create/port a renderer or program to the platform.

I'd do it myself, but I'm no programmer/developer.

[kartu]

sherman

In other words, all that's really needed is for someone willing and able to create/port a renderer or program to the platform.

No, afaik igorsk's SDK doesn't work with 505/latest library. So some hacking/disassembling/figuring out what was changed is needed as well.

[sherman]

Ah yeah, I'd forgotton about that.

Still, it doesn't seem impossible task for someone to undertake in the future.

In the meantime, I continue to use ADE, and play with all of the cool new stuff that PRS+ installed on my 505

[luma]

Originally Posted by Xaphiosis

If you're interested in arbitrary code execution, please check out my threads in the sony reader dev section, especially this one, which has explanations of how to get it all to work inside the attachment, as well as a silly video:
https://www.mobileread.com/forums/showthread.php?t=82714

I've also got another way of doing it. I modified the cramfs image provided with the boroda firmware to check if /reader/main_boot.sh exists on an SD card and run that before trying to run the default sony interface. I have implemented and tested it today, and it works fine. I've also put in the EXT2 kernel module, so if you format your SD card to be EXT2 rather than FAT, it'll still work.

Also today, I managed to get QEMU going, emulating an ARM board running debian, because I got sick of unpacking .deb files manually. I have a silly dream of putting python on the device.

I'm at the stage where I'm wondering if anyone is interested in an openinkpot port to the 600.

I think most stuff should work except for DRM / sony book store (I have the feeling I could break it, but I have no time for it nor do I really care a lot about it), audio (simply because I haven't looked at it at all) and AC power (possibly in the future). Charging via USB will definitely work for 100mA trickle charging, and though I currently can't detect whether the host supports 500mA charging, I can still force it manually.

As usual, if you have questions, ask. The more specific they are, the faster I'll answer :P

Actually, here is a list of stuff I've figured out vs what I wanted to figure out:

Components:
USB
  + detect being plugged in
  + loading g_serial and pretending to be a serial port
  + loading g_file_storage and pretending to be a storage device
    (only works when /proc/usbtg were cleanly removed, i.e. nothing was using
     it at the time the last module that provided it (e.g. g_file_storage) was
     removed)
SD card
  + detecting insertion
  + detecting removal
  - suspending scan/power if possible (I think not possible directly)
MS card
  + detecting insertion
  + detecting removal
  - suspending scan/power if possible (I think not possible directly)
Buttons
  + detecting button press/release
  + deactivating button scanning if possible
Touchscreen
  + turn scanning on/off
  . set sampling rate (figured out, code not written yet)
  . set break threshold whatever it is (investigating what it is)
  . calibration (easy, simple linear interpolation, just have to do it)
  + getting raw x/y
  - figuring out junk whatever it is
  - figuring out pressure if necessary
  - pressure -> what is it, what does "caliculate[sic] pressure" do?
LED
  - red (set automatically from arcotg driver I think)
  + amber: fading, pulsing, on
Audio
  - play audio
  - adjust volume
  - check if audio is playing / busy
  - stop audio
  - power down audio system if possible
EInk
  + drawing to the framebuffer
  + changing orientation (set, changing at drawing time doesn't work so great)
  + figuring out the difference between flip modes 0,1,2,3
  + checking if device is busy drawing (/proc/e-ink, fb ioctl GET_DISP_STATUS)
  + does it block or queue (it blocks)
  + checking temperature
Battery
  + checking battery level
  . interpreting battery level to something useful 
    (levels defined in config.xml in /opt/sony/.../application, use those)
  ? telling device to charge from USB (/proc/usbtg/usbcharge should do it?)
    (doesn't work when g_serial is installed since I haven't fully hacked in
     sony's modifications to the usbtg interface)
    (I can do it by talking to the wm8350 chip, but I'm not sure how to do it
     safely)
Misc
  + power off (poweroff, or subcpu power off signal)
  . get and set the time from RTC (via wm8350, just not done yet)
  - alarms/timers for waking up 
    (wm8350 alarm, I know how to set it, just don't know what it's used for)
  - checking plugged into AC
  - charging from AC? (wm8350 will do it, but does it do it automatically
    or does it have to be told?)
  + suspend usb via /proc/usbtg/suspend (not when g_serial installed)
   
Maybe
  - being able to flash by modifying the mtd blocks directly

how did getting the python interpreter on there go?

Check out my thread, https://www.mobileread.com/forums/sho...45#post1023445

what do you think? How can I write javascript apps for the Sony PRS 600?