PRS-T1 Step-by-step guide to hacking the PRS-T1

[MCSmarties]

Sony PRS-T1 step-by-step rooting and tweaking guide

About this guide

There is an extensive page on the wiki about how to tweak your PRS-T1.

However, I found that it was overloaded with sometimes conflicting information. There are many different ways to do this, which also seems to depend on the firmware version you have installed.

So I decided to make this guide from the notes I took a few weeks ago when I rooted my brand-new PRS-T1.
It's based on stuff I read on threads here, on the wiki, on ebook-reader.com and on cme.at (german).

I did not create any of the tools involved and most of the time I'm just parroting other people's findings!

Please note that I'm listing the stuff that worked for me, your mileage may vary!
Also, I use a PC running Windows 7 64bit, some things will be a little different if you use a Mac or a Linux box.



A. Initial setup

• Fully charge the T1. I used a microusb cell phone adapter (5.1V/0.7A)
  
  
• Apply the official firmware PRS-T1_Updater_1.0.04.12210 downloaded from Sony.
  
  
• Register the device with the Sony Reader Store and your local library. (I decided to do it before starting to mess with my reader just in the (unlikely) event that Sony somehow checks whether your reader firmware is "legit".)
  
  
• At this point you can buy or borrow books. Enjoy your reader the way that Sony wants you to!
  
  
• Convert and sideload your existing book files using calibre (beyond the scope of this tutorial, check the forum!)
  
  
• Backup the data on the reader (all the folders in READER)

B. Root the PRS-T1 with AMR

Warning: beyond this point in the tutorial you are on your own if something goes wrong!

You may end up bricking your device if you're not careful.
You will most likely void your warranty.
Also, your hacked T1's battery charge will not last as long as for an unrooted device.


Note:
In Android apps on the T1, "SD card" refers to the READER partition, NOT an external SD card!
In Total Commander, all the storage is detected as "SD card".
You can identify what it is by the total space available:

"SD-card" /mnt/sdcard, 1.4G total = READER partition
"SD-card (2)" /mnt/extsd, xxG total = microSD card inserted in the T1
"SD-card (3)" /mnt/udisk, 9.9M total = SYSTEM partition. Hands off!!

• Download the restore set for firmware 1.0.04.12210.
  Do not use restore_set.zip, it is not compatible with the newest firmware!
  
  
• Run the restore set just to make sure that everything is ok before applying the rooting procedure:
  - unzip restore-set-1.0.04.12210.zip to any folder on the PC
  - connect PRS-T1 to the PC -> Data transfer mode
  - run flash_reader.bat. VERIFY THE TARGET PATH ("READER"), click Y.
  - "Press any key to continue": keep the reader connected and WAIT.
  - the reader will reboot and appear to hang at "Opening book...". This is normal.
  - it takes several several minutes to apply the restore set; during this time the reader will appear to be frozen.
  - once the reader has booted, disconnect it and check that everything works properly before proceeding.
  - you may have to sign in at the sony store again (but you shouldn't have to register the reader)
  
  
• Download the rupor AMR patch.
  - the "stable release" I used was named "20120517".
  - I did NOT follow the procedure to "Make full device backup" because frankly it scared me!
  
  
• Apply the rupor AMR patch:
  - unzip rupor-minimal.7z to any folder on the PC
  - connect PRS-T1 to the PC -> Data transfer mode
  - run flash_reader.bat. VERIFY THE TARGET PATH ("READER"), click Y.
  - "Press any key to continue": keep the reader connected and WAIT, reader will shut down and reboot.
  - it should only take a few seconds longer than normal to boot
  - the AMR was successfully applied if a 3rd screen appears in the home screen with Android applications.
  - disconnect the Reader
  
  
• Change the safety settings to allow installation of non-Market applications:
  - click the "settings" on the 3rd page (not the SONY one!). I'll call this the "Android Settings".
  - go to "Applications"
  - check "Unknown sources" and confirm the warning.
  
  
• Set up a PIN code. I did this for two reasons:
  - to prevent unauthorized access
  - to avoid the risk of setting it up later in an improper fashion.

To specify a screen locking PIN code go to:
Android settings -> Location & security settings -> Change screen lock -> PIN

(Make sure you remember it, I don't know how to bypass it if you forget the PIN... )


*** WARNING *** WARNING *** WARNING ***
NEVER USE A PATTERN OR A PASSWORD TO SECURE YOUR READER!

Specify only a FOUR-DIGIT NUMERIC PIN!

Remember Monty Python's instructions for the Holy Hand Grenade of Antioch (slightly modified):

Thou shalt count to four, no more, no less.
Four shall be the number thou shalt count, and the number of the counting shall be four.
Five shalt thou not count, neither count thou two or three, excepting that thou then proceedst to four.
Six is right out...

But I digress.

Using any other security mechanism may lock you out of your reader PERMANENTLY.



C. Enable the Android Market

• Download the Android Market files (direct link to zip archive) and save to PC
  
  
• Sideload the Android Market files:
  - unzip prs-t1-gingerbread-market.zip to any folder on the PC
  - connect PRS-T1 to the PC -> Data transfer mode
  - in Windows Explorer go to the READER drive and create an installation folder (I called it APK_install)
  - copy the two files GoogleServicesFramework.apk and vending2.2.11-signed.apk to that folder
  - close windows explorer and disconnect reader again
  
  
• Install the Google Framework
  - go to the new 3rd home screen on the rooted reader and launch Total Commander
  - navigate to SD-card (/mnt/sdcard) -> APK_install
  - click on GoogleServicesFramework.apk, confirm install, complete action with Package installer
  - confirm installation ("Install") and click Done.
  
  
• Install the Android Market
  - click on vending2.2.11-signed.apk, confirm install, complete action with Package installer
  - confirm installation ("Install") and click Done.
  - press HOME and SHUT OFF the reader completely (press Power for three seconds), then reboot.
  - Android Market is installed properly if a new icon "Market" appears on the 3rd screen.
  - click on the Market icon sign in with your Google Account (this may take several minutes).
  - if you get an error message connect the reader to your WiFi network manually, then try again.

D. Make some room!

• Download Apps2SD from the same place as before.
  - the "stable release" I used was named "20120327".
  - also download the "revert back" package just in case.
  
  
• Install Apps2SD (even if you don't use SD cards, to move system apps to the READER partition)
  - unzip rupor-enable-asec.7z to any folder on the PC
  - run flash_reader.bat. VERIFY THE TARGET PATH ("READER"), click Y.
  - "Press any key to continue": keep the reader connected and WAIT, reader will shut down and reboot.
  
  
• Install Titanium Backup
  - download the app here (direct link to .apk file)
  - copy the file to the APK_install folder on your READER as before
  - install the apk using Total Commander
  
  
• Remove unnecessary apps (these are useless for the PRS-T1... it's not a cell phone!)
  - launch Titanium Backup
  - I got an error message asking to "fix" su, I said yes. Not exactly sure what this does.
  - I selected the following apps, made a backup and then deleted them:
  

  /system/app/Bluetooth.apk
  /system/app/Mms.apk
  /system/app/Provision.apk
  /system/app/TelephonyProvider.apk
  /system/app/VpnServices.apk
  /system/app/NetworkMonitor.apk
  /system/app/Network3gMonitor.apk

  - if everything works ok after a reboot, delete the backups (again in Titanium Backup)
  
  
• Remove the phone app (there are reports that it makes the battery last longer)
  

  /system/app/Phone.apk

WARNING:
Removing Phone.apk will cause the PRS-T1 to lock up, and may result in an endless rebooting loop.
A soft reset fixed it for me but if you're nervous, don't do it!



E. Stuff your PRS-T1 with apps
This is the part you've been slogging through all this for!

• You can either download compatible apps from Google Play (via the PC) or by sideloading apk files.
  
  
• Don't add too many apps at once, stop and test what you have first!
  
  
• Move as many as possible from the SYSTEM partition (Apps2SD, remember?):
  - go to Android settings -> Applications -> Manage Applications
  - then click on the desired application and select "Move to SD card" (some apps can't be moved)
  
  
• To sideload:
  - copy .apk files to the APK_install directory created earlier in the READER partition
  - install apps from there using Total Commander as before.
  
  
• The mobileread wiki has an entire page with compatible apps.
  Please add any new ones you find, and also report those that don't work!

On my own Sony reader (with a 16GB microSD card) I currently have installed:

Aard Dictionary (+ the entire English and French Wikipedias), AdAway, Androminion, BatteryCalibration, Chess, Choice of Broadsides, Choice of the Dragon, Crrency Converter, handyConverter, Mahjong, Offline dictionaries, OpenSudoku, Pandora, Perfect Viewer, Puzzles, RealCalc, Shortyz, Solitaire, Stars, The Weather Channel and Word Search.

I also installed sonyprst1home and hberntsen's norefresh "hack" (mostly for use with Aard Dictionary).


I hope this little tutorial will help people (like me) who were overwhelmed by all the rooting options available.
Comments, corrections and criticisms are always welcome!

[gardenstate]

Excellent work!! thanks!!

[Pomtroll]

You did a great job.... However I think I'll just keep my T1 as is. Even your step by step guide was confusing to my simple mind. ...

[DuskyRose]

This looks great! Thanks for all the hard work!

[uboot]

nice one!!

you should definitely put that on the wiki!

(I just added a link to this thread)

[FinancialWar]

can you confirm if Ankidroid (from Google Play) will work if a hacked T1?

[Rizla]

Thanks for your effort. It needed to be done.

[MCSmarties]

Thanks for all the kind words (oh, and the karma!)

Originally Posted by FinancialWar

can you confirm if Ankidroid (from Google Play) will work if a hacked T1?

Google play says this app (you mean AnkiDroid Flashcards, right?) is not compatible.

[carpetmojo]

My God - what a performance .......

[dmiller]

Originally Posted by MCSmarties

Thanks for all the kind words (oh, and the karma!)


Google play says this app (you mean AnkiDroid Flashcards, right?) is not compatible.

I can confirm that AnkiDroid works just fine on the PRST1. The link on the MobileRead Wiki will take you directly to a website where you can find a downloadable apk: https://wiki.mobileread.com/wiki/PRST...#Learning_apps

[malawayfromhome]

MCSMARTIES (#1) method worked very well up to
"Remove unnecessary apps " - "I selected the following apps, made a backup and then deleted them".
I do not see a delete area, also I do not see the titles as MCSMARTIES has shown am I missing something. Any chance of further help please

[Ines]

I am stuck at the point where I downloaded the restore set for firmware 1.0.04.12210, unzipped it, ran flash_reader.bat. The reader rebooted and is hanging in "Opening book" forever. When connected cannot be identified on the computer. SD rescue from porkupan doesn't help. Any idea how I can proceed? Thanks.

[nugstar]

Thanks for the guide, currently working my way through it now.

I just went through the backup stage using the google translated page. The comments regarding how it can brick your device are more to do with the usual risks involved with flashing, rather than the process itself. Rupor comments about this in subsequent replies in the thread.

As far as I can tell, the restore image just allows your computer to have access to all partitions on the internal memory via recovery commands. This means it most likely does not flash anything. (Please correct me if I'm wrong)

The main thing to keep in mind:
Ignore all prompts to format partitions. YOU CAN BRICK YOUR DEVICE

As tested on Win7 Pro 64bit. I suspect there wouldn't be any prompts to format partitions in Linux due to native support for ext2/3 partitions.

The process boils down to:
1. Extract rupor-rescue.7z to SD root. (gserial.inf is not required, and can be removed)
SD:\OS Firmware\files\update.img will be created.
2. Turn off PRS-T1 unit
3. Plug unit back into computer.
Cancel all prompts to format partitions
4. Boot into Recovery Mode (Hold Home+Menu until black bar if fully loaded)
Cancel all prompts to format partitions
5. Using Roadkill's DiskImage, backup the Internal Memory (1.82GB). Be sure to select the "Store Image" tab, and select where you want to save the .img.

Let it run (5-10mins) and you'll have the backup. Unmount, remove sd, remove the "OS Firmware" folder from your sd card. This is required before any attempt to root. Reboot and test to make sure everything is working.

gserial.inf is used for access via terminal, and it's usage is covered in the original thread. I didn't use it to make my backup, and it wasn't even present on my sd-card at the time.

A note regarding the backup: it may contain your device details and other personal information, so it is best to store it securely.

[rupor]

@nugstar

You are right - this SD card by iteself does not flash anything. It just makes internal device memory available to the outside PC as a single external USB harddrive. Damage could only come from the outside usage - like accidental formatting or writing something. So backup procedure is pretty safe. Restoration is a bit more dangerous, but I did it on multiple ocasions without a problem...

[MCSmarties]

Originally Posted by malawayfromhome

MCSMARTIES (#1) method worked very well up to
"Remove unnecessary apps " - "I selected the following apps, made a backup and then deleted them".
I do not see a delete area, also I do not see the titles as MCSMARTIES has shown am I missing something. Any chance of further help please

You need to find the app name (different from the filename - sorry, I didn't write them down at the time), click on backup, then later delete/unsinstall them. You should see a confirmation screen listing the file name before you fully commit to uninstalling.

Be careful! The more tweaks you apply, the higher the risk. Removing phone.apk WILL freeze your reader, even though you should be able to recover from it.

Originally Posted by Ines

I am stuck at the point where I downloaded the restore set for firmware 1.0.04.12210, unzipped it, ran flash_reader.bat. The reader rebooted and is hanging in "Opening book" forever...

First of all, I'm afraid that I must be really blunt here.

I CANNOT HELP IF SOMETHING GOES WRONG WITH THE ROOTING.

The warning at the beginning of my guide is there for a reason, and it means exactly what it says: YOU ARE ON YOUR OWN!

I did not write any of these tools and I don't have any particular knowledge about them. I simply listed what I found to work for ME. Do NOT, repeat NOT, think you can just follow this guide without worrying about a thing. These are hacks, you are modifying your reader in ways it was never meant to be.
If you are unwilling to take the risk of bricking your device, just don't do it!

So no, I'm afraid that I don't KNOW how you can proceed.

First, did you wait long enough? It does take up to several minutes. Be patient!
Did you try a soft reset?
If that doesn't work, did you try a hard reset?
Maybe connect your reader to your PC and then try to reset it?

If you find something that works please do share. Like I said, I'm just listing what worked for me, without any deeper insight...