Hacking on the PRS-600 - can you run arbitrary code?

[AndreiC]

A crazy thought:

Since the device is running Linux after all, one might even add internet access (by using some USB connected modem) and a browser.

[RyeBrye]

usb client and host are not the same. If the hardware doesn't support it, it won't work.

A wifi sdcard might be doable, but we need to get the device hacked first.

I saw they have a "russification" version for the 600 - so presumably they have figured out how to modify a firmware update.

[nrg]

If you take a peek at Russian forum you will see device is already hacked, and more than that you can easily modify firmware by yourself by creating your own cramfs file although there is a disclaimer not to put any information about it here because of sony :-0

[RyeBrye]

Originally Posted by nrg

If you take a peek at Russian forum you will see device is already hacked, and more than that you can easily modify firmware by yourself by creating your own cramfs file although there is a disclaimer not to put any information about it here because of sony :-0

I don't speak Russian, and Google translate doesn't speak it very well either. Is here a thread there that has instructions on building a cramfs and loading it on?

[okalyddude]

I'm hoping people keep an eye on this... I'll be excited when the firmware can be hacked for possible editing the dictionary, adding multi-language support (which they may do anyway) adding encyclopedia support with dictionary, adding wifi sd cards like the bebook, add a clock, fonts, etc...

[AndreiC]

Didn't know about the WiFi SD Cards.

Cool stuff!

However, what stops you from using one now?

As far as I could tell those will work on any device that can accept an SD card.

[donald1]

Yes, also I are very interested in adding functionality to the current software.
WiFi (and a basic-browser) would really, really add enormeous value to the ereader !
Online checking on wikipedia, dictionaries, your email etc would become reality. This would be great fun !

[Brolo]

Me too. I quite like my 600, although not the prices of new books. I've found the scribble app handy for sketching quick diagrams, but wish Sony had included a calculator in it

[donald1]

Originally Posted by Brolo

Me too. I quite like my 600, although not the prices of new books. I've found the scribble app handy for sketching quick diagrams, but wish Sony had included a calculator in it

yes, I understand a browser and wifi support maybe reaching too high.....
A calculator, clock and sudoku puzzle (for times your are out of books ) would be marveleous.

[Zerker]

I am a bit confused: was a way to run "arbitrary code" found? If so, is any such code available to view and modify?

[Anne Marie]

I live in Belgium and registered my PRS600 in Dutch. Now it seems I cannot buy books from the American reader Store only from bol.com which has less books at a much higher price. Anyone can help?

[donald1]

Originally Posted by Anne Marie

I live in Belgium and registered my PRS600 in Dutch. Now it seems I cannot buy books from the American reader Store only from bol.com which has less books at a much higher price. Anyone can help?

You can buy the books via the internet and download the file to your pc.
Then transfer the file to your reader and it works !

The file can be transferred to your reader by means of tools like Sony elibrary, Calibre or just manual drag&drop within the explorer.

[Fraktul]

After viewing the thread on russification of the PRS-600 and addition of functionality such as the calendar I am somewhat confused as to if arbitrary code can be run or not. I would assume the changes required for the russification and calendar would required decrpytion of the CRAMFS, mounting and then making said changes followed by re-encryption. If this is the case then the block cipher and key are presumably known so I don't see what is preventing changes to config in other portions of the CRAMFS?

I have attempted to follow the translations on the-ebook forums but these are somewhat unclear as to why arbitrary code cannot be run. I cannot seem to find a definitive answer in these forums either - if I have missed this however then apologies in advance.

[Auger]

How to get the test mode to work.

This took some working out to get the required components in the right place but here goes.

Create the directory Sony Reader/software

Create the file autorun.xml (No cap A the manual is wrong)
In the autorun.xml put the following

"<?xml version="1.0" encoding="UTF-8"?>
<document xmlns="http://www.kinoma.com/fskin/1">
<code>
<function id="modelChanged">
//this.trace("[autorun] modelChanged enter\n");
arguments.callee.grammar.call(this);
var state = this.getVariable("STATE");
var target;
//this.trace("[autorun] state="+state+"\n");
if (this.state != state) {
this.focus(true)
this.AUTORUN_GROUP.show(false)
switch(state) {
case "AUTORUN":
this.AUTORUN_GROUP.show(true);
target = this.AUTORUN_GROUP.AUTORUN
break;
}
this.state = state;
if (target.isEnabled())
target.focus(true)
}
//this.trace("[autorun] modelChanged exit\n");
</function>
</code>
<clock/>
<group id="AUTORUN_GROUP" left="0" right="0" top="0" bottom="0" visible="false">
<group id="AUTORUN" width="480" height="440">
<code>
<function id="doDigit" params="part"><![CDATA[
var keyCode = part.key.charCodeAt(0);
if (keyCode == 53) /* 5 */
{
try {
var stream = new Stream.File("b:/screen.jpg", 1);
this.getWindow().getBitmap().writeJPEG(stream);
stream.close();

this.MSGTEXT.setValue("Done\npress MENU to exit");
}
catch(e)
{
}

}
else
this.getModel().doDigit(part);
]]></function>
<function id="doMenu">
kbook.autoRunRoot.exitIf(kbook.model);
</function>
</code>
<sprite skin="diskSprite" id="DANGER" width="140" top="0" height="140" u="-2" active="false" canFocus="true"/>
<text active="false" id="MSGTEXT" left="0" right="0" top="140" height="300" value=""/>
</group>
</group>
</document>"

Hold the Home and Vol + keys and insert the card and hey presto you have the diag menu.

Hope someone finds this of help, I think it should be easy to execute arbitary code let me know how it goes.

Regards Auger

[porkupan]

Originally Posted by Auger

How to get the test mode to work.

Yes, that's cool, thanks for sharing. But I hope you didn't waste your time playing with the autorun.xml. All you needed was for this file to be there - it could even be an empty file.