Hacking on the PRS-600 - can you run arbitrary code? - Page 3

ivor · 09-21-2009, 03:45 AM

Well i got universal flasher working on the 300, and had a little play. I was wondering whether they would be using the (new) same firmware update process internally for the new models and whether there would be any interesting clues in there to see. but can't see anything obvious. I guess the 300 is really just a 505 in a different case isn't it?

RyeBrye · 09-28-2009, 11:07 PM

I'm guessing the answer is 'no' because otherwise it'd have already been done... but is there any other known way to make the phone run a binary?

We can try to exploit the kernel if we can get it to run a binary and if we know if there are any suid binaries on the phone...

Or we can wait for someone else to get a device they can rip apart

igorsk · 09-29-2009, 06:49 AM

You keep saying "the phone"... is there some hidden functionality we all missed?

RyeBrye · 10-02-2009, 12:37 AM

Ha. I didn't even notice that. Sorry...

I come from a background of phone hacking... if that wasn't made immediately obvious :P

itestl · 10-03-2009, 07:45 AM

Hi igorsk and RyeBrye
What's the news about hacking and the serial console?
Have you any new information?

booksonthemove · 10-03-2009, 08:47 AM

Does anyone know if one were to format the SD card as ext2fs, would the sony be able to read it? I presume it can, if the OS is linux-based.

dclavey · 10-03-2009, 08:59 AM

I assume you guys have seen the service manual.

And in particular Page 8.

Quote:

HOW TO MAKE THE SD MEMORY CARD FOR TEST
MODE USE ONLY
1. Ready for the SD memory card.
2. Make the new directly as “/Sony Reader/software” on the SD
memory card.
3. Make the new fi le as “/Sony Reader/software/Autorun.xml” on
the SD memory card.
4. Confi rm the method of obtaining the program data for test
mode to each service headquarters.
HOW TO ENTER THE TEST MODE
1. Insert the SD memory card with the test mode data is inserted
while pressing the [HOME] and [VOL +] buttons.
2. After a while, indicate the test mode menu, enter the test mode.
3. Press the [<]/[>] buttons, change the test mode menu page 1/
page 2.

I guess we need to find a friendly sony engineer and get a copy of the Autorun.xml format and see whats different between it and the 505/300 format?

itestl · 10-04-2009, 03:21 AM

Hi
There is a dump of prs-600 http://ifolder.ru/14310536

I found it today here http://www.the-ebook.org/forum/viewt...=290891#290891

nrg · 10-04-2009, 08:45 PM

Anyone was able to download dump from that site? I only can see the content 600-dump.zip and can't download anything even after registration.

beland · 10-05-2009, 04:32 AM

Quote:

Originally Posted by nrg

Anyone was able to download dump from that site? I only can see the content 600-dump.zip and can't download anything even after registration.

hope that's better

http://rapidshare.com/files/288884327/600-dump.zip

nrg · 10-05-2009, 05:11 AM

Thank you Beland much better

It seams to me that it is not the whole device firmware, just sony program that is executed on top of the linux.

itestl · 10-05-2009, 06:15 AM

I looked this "dump". There is really only part of the firmware. As I think, by analogy with 700, this is only opt\sony\ebook\application\resources.
Maybe igorsk have some news. But he did not write anything from 09-29-2009.

ivor · 10-05-2009, 02:29 PM

The content of the test directory looks quite interesting.

dclavey · 10-06-2009, 12:49 PM

Quote:

Originally Posted by ivor

The content of the test directory looks quite interesting.

Yes the format of the autorun.xml file in the test directory is the same as the autorun's I have seen being used successfully by the PSR-505.

Namely:

Quote:

?xml version="1.0" encoding="UTF-8"?>
<document xmlns="http://www.kinoma.com/fskin/1">
</document>

So I wonder why placing the file in Sony Reader software directory does not work?

Note the code in the Test Directory is found inside XML Tags:
<document>
<model>
<code>

Where as the 505 autorun.xml code I have seen is found in
<document>
<code>

Could this be the difference that stops autorun.xml running on a 600?

Can anyone give me a cut down "Hello World" autorun.xml and autorun.js to play with?

porkupan · 10-06-2009, 01:46 PM

It's not the autorun.xml, it's the place where this file is. In PRS-600 the only autorun allowed is the autorun from /opt/sony/application/resources/test directory. That's all...

09-28-2009, 11:07 PM	#32
RyeBrye Member Posts: 14 Karma: 10 Join Date: Sep 2009 Device: PRS-600	any other ways to run code on these things than autorun? I'm guessing the answer is 'no' because otherwise it'd have already been done... but is there any other known way to make the phone run a binary? We can try to exploit the kernel if we can get it to run a binary and if we know if there are any suid binaries on the phone... Or we can wait for someone else to get a device they can rip apart

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Hacking PRS-505...	SeNS	Sony Reader Dev Corner	25	12-20-2011 11:12 PM
PRS-600 Any news about hacking the new sony readers (600/300)??	pikoman	Sony Reader	5	10-07-2009 09:18 AM
PRS-505 Hacking Guides	SurgE	Sony Reader Dev Corner	2	08-13-2008 08:54 PM

09-21-2009, 03:45 AM	#31
ivor Junior Member Posts: 8 Karma: 10 Join Date: Sep 2009 Device: PRS-300	Well i got universal flasher working on the 300, and had a little play. I was wondering whether they would be using the (new) same firmware update process internally for the new models and whether there would be any interesting clues in there to see. but can't see anything obvious. I guess the 300 is really just a 505 in a different case isn't it?

09-29-2009, 06:49 AM	#33
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	You keep saying "the phone"... is there some hidden functionality we all missed?

10-02-2009, 12:37 AM	#34
RyeBrye Member Posts: 14 Karma: 10 Join Date: Sep 2009 Device: PRS-600	Ha. I didn't even notice that. Sorry... I come from a background of phone hacking... if that wasn't made immediately obvious :P

10-03-2009, 07:45 AM	#35
itestl Junior Member Posts: 4 Karma: 10 Join Date: Sep 2009 Device: sony!	Hi igorsk and RyeBrye What's the news about hacking and the serial console? Have you any new information?

10-03-2009, 08:47 AM	#36
booksonthemove Connoisseur Posts: 72 Karma: 16 Join Date: Sep 2009 Location: UK Device: Sony PRS-600 with latest Calibre and Linux Ubuntu-9.10	Does anyone know if one were to format the SD card as ext2fs, would the sony be able to read it? I presume it can, if the OS is linux-based.

10-04-2009, 03:21 AM	#38
itestl Junior Member Posts: 4 Karma: 10 Join Date: Sep 2009 Device: sony!	Hi There is a dump of prs-600 http://ifolder.ru/14310536 I found it today here http://www.the-ebook.org/forum/viewt...=290891#290891

10-04-2009, 08:45 PM	#39
nrg Member Posts: 12 Karma: 96 Join Date: Apr 2009 Device: PRS-600	Anyone was able to download dump from that site? I only can see the content 600-dump.zip and can't download anything even after registration.

10-05-2009, 05:11 AM	#41
nrg Member Posts: 12 Karma: 96 Join Date: Apr 2009 Device: PRS-600	Thank you Beland much better It seams to me that it is not the whole device firmware, just sony program that is executed on top of the linux.

10-05-2009, 06:15 AM	#42
itestl Junior Member Posts: 4 Karma: 10 Join Date: Sep 2009 Device: sony!	I looked this "dump". There is really only part of the firmware. As I think, by analogy with 700, this is only opt\sony\ebook\application\resources. Maybe igorsk have some news. But he did not write anything from 09-29-2009.

10-05-2009, 02:29 PM	#43
ivor Junior Member Posts: 8 Karma: 10 Join Date: Sep 2009 Device: PRS-300	The content of the test directory looks quite interesting.

Advert

Advert

10-06-2009, 01:46 PM	#45
porkupan Fanatic Posts: 556 Karma: 1057213 Join Date: Sep 2006 Location: North Eastern U.S. Device: Sony Reader	It's not the autorun.xml, it's the place where this file is. In PRS-600 the only autorun allowed is the autorun from /opt/sony/application/resources/test directory. That's all...