Glo Android on Glo

[SyreKron]

My googling produced an interesting find yesterday:
http://naberius.de/category/linux/programming/kernel/

Hecke has torn down a 99 euro Android reader from Germany called the Tolino Shine. Investigation of his pictures revealed that the hardware is very similar to the Glo. Not just the same parts, but the reference designators on the PWB are identical to my Glo.

Hecke was kind enough to post an image of the microsd in his Shine. I installed it in my Glo and it seems to work perfectly. It would be even better if I could read German

[Image violates Posting Guidelines for size - MODERATOR]

The frontlight button on the Glo is mapped the Android "home" or "back" button. The interface appears to be a custom apk running on the android. Hopefully it can be hacked for standard apks and a different UI. I'm not much of an android hacker but I suddenly have motivation

I think battery life of a Glo running android would not be good. The battery in the Hecke's Shine appears to be at least 2x the size as what my Glo has.

I imagine that the Glo firmware will run on the Shine. Don't have one (yet) but 2x the battery for a Glo would be nice. I imagine they'll start showing up used at some point. The shine does have an update process similar to the Kobo except that they 'dd' images directly onto the internal microsd rather than extracting a tarball over the mounted root. I am thinking it should be possible to load Glo firmware on it without opening the case (Hecke comments that this is a pain due to the use of glue).

I imagine there are other readers out there with compatible hardware. Has anyone else noticed other examples?

[JonnyXDA]

Hi,

Im downloading this now, very interesting and a good find

I'm an Android developer and know a lot about reverse engineering apk files into smali language and then editing the smali so I'd be interested in helping out on this in my spare time

[SyreKron]

Jonny,

Sounds great. I don't really know where to start. I'd love to be able to use android text note and keyboard aps on my reader. That would allow me to leave one of my 3 regularly carried devices at home

Google gives me too many results. How does one get started "opening" a closed android like this?

-SyreKron

[giorgio130]

Great find!!! Could you mirror the image in case it is put down? I'm not able to download it right now and I jon't want to miss the opportunity

[mastnacek]

Its posible make image for Mini? I try write backup_internal_sd_shine_after_sys_recover into kobo mini and not work.

[SyreKron]

@giorgio130:
Right. I've got the file and I think JonnyXDA does also. I'm sure someone will be able to mirror it if the original goes down.

So, I've been poking at the android load and managed to get a shell on it over adb using windows 7 (64-bit). Should be able to install and remove apks now.

For anyone interested I downloaded the Android SDK for windows from http://developer.android.com/sdk/index.html and got it up and running.

I followed the instructions on Hecke's blog post about enabling adb in the update script on the first linux partition on the microsd card. I did it the easy way by using a card reader and a linux pc.

Next I obtained the "oem" adb driver from http://developer.android.com/tools/extras/oem-usb.html. I added the following lines to android_winusb.inf in the [Google.NTamd64] section. I presume adding them to the [Google.NTx86] section would allow installation on an 32-bit platform as well.

;Tolino Shine
%CompositeAdbInterface%     = USB_Install, USB\VID_1F85&PID_1689&MI_01
%CompositeAdbInterface%     = USB_Install, USB\VID_1F85&PID_1689&REV_0226MI_01

After that I booted my Kobo/Shine and touched the "Freigeben" button once the "USB-Verbindung" window was displayed. I pointed windows to the modified adb driver it successfully installed!

The final modification was to create a file called "adb_usb.ini" in the .android directory in my user folder. Without it adb doesn't notice the installed adb device and will refuse to discover it on its own. Contents of this file

0x1F85

Not sure what to do now that I've got adb running. Time to google and learn some more

[SyreKron]

Originally Posted by mastnacek

Its posible make image for Mini? I try write backup_internal_sd_shine_after_sys_recover into kobo mini and not work.

How did you write the image to your sd card? How big is the sd card you used (capacity)?

Provided you correctly wrote the image to your sd card....I don't think I can offer much help right now.

(I'm still pretty new at this myself!)

[JonnyXDA]

Originally Posted by SyreKron

Jonny,

Sounds great. I don't really know where to start. I'd love to be able to use android text note and keyboard aps on my reader. That would allow me to leave one of my 3 regularly carried devices at home

Google gives me too many results. How does one get started "opening" a closed android like this?

-SyreKron

Ok, reverse engineering android apps is complicated but there are many tools to help with this.

Personally I use Virtuous Ten Studio made by a developer team on XDA. However, for first time users I would recommend using straight apktool.jar file as VTS is mainly for advanced users. apktool is available free and opensource from here and is called from a command prompt (java -jar apktool.jar d apkname.apk).

A guide to using apktool (the commands have been incorporated into batch files to save typing it every time) can be found here

Apk files consist of 2 parts, code and resources. Resources are your images, layouts, xml preferences, integers, strings, arrays etc. If you add something to the resources you must also create a new hex value for it in res/values/public.xml

The code part once decompiled is in a language called smali which is basically the dalvik bytecode (or an easier way of thinking of it is java's version of ASM) and its not the easiest language to understand, the below sample is part of a hack or modification that allows the current foreground application to be killed and removed from RAM by long pressing the back key, this is just to give you an example of what smali code looks like with regards its function:

.method private launchBackKeyLongPressAction()V
    .locals 18

    const/4 v1, 0x0

    const/4 v2, 0x0

    :try_start_0
    move-object/from16 v0, p0

    invoke-virtual {v0, v1, v2, v2}, Lcom/android/internal/policy/impl/PhoneWindowManager;->performHapticFeedbackLw(Landroid/view/WindowManagerPolicy$WindowState;IZ)Z

    invoke-static {}, Landroid/app/ActivityManagerNative;->getDefault()Landroid/app/IActivityManager;

    move-result-object v9

    invoke-interface {v9}, Landroid/app/IActivityManager;->getRunningAppProcesses()Ljava/util/List;

    move-result-object v5

    move-object/from16 v0, p0

    iget-object v14, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mContext:Landroid/content/Context;

    const-string v15, "activity"

    invoke-virtual {v14, v15}, Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;

    move-result-object v2

    check-cast v2, Landroid/app/ActivityManager;

    const/4 v14, 0x1

    invoke-virtual {v2, v14}, Landroid/app/ActivityManager;->getRunningTasks(I)Ljava/util/List;

    move-result-object v12

    const/4 v14, 0x0

    invoke-interface {v12, v14}, Ljava/util/List;->get(I)Ljava/lang/Object;

    move-result-object v14

    check-cast v14, Landroid/app/ActivityManager$RunningTaskInfo;

    iget-object v6, v14, Landroid/app/ActivityManager$RunningTaskInfo;->topActivity:Landroid/content/ComponentName;

    invoke-interface {v5}, Ljava/util/List;->iterator()Ljava/util/Iterator;

    move-result-object v14

    :cond_0
    :goto_0
    invoke-interface {v14}, Ljava/util/Iterator;->hasNext()Z

    move-result v15

    if-nez v15, :cond_2

    :cond_1
    :goto_1
    return-void

    :cond_2
    invoke-interface {v14}, Ljava/util/Iterator;->next()Ljava/lang/Object;

    move-result-object v3

    check-cast v3, Landroid/app/ActivityManager$RunningAppProcessInfo;

    iget v13, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->uid:I

    const/16 v15, 0x2710

    if-lt v13, v15, :cond_0

    const v15, 0x1869f

    if-gt v13, v15, :cond_0

    iget v15, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->importance:I

    const/16 v16, 0x64

    move/from16 v0, v16

    if-ne v15, v0, :cond_0

    iget-object v15, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->pkgList:[Ljava/lang/String;

    if-eqz v15, :cond_0

    invoke-interface {v5}, Ljava/util/List;->size()I

    move-result v15

    if-lez v15, :cond_0

    iget-object v15, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->processName:Ljava/lang/String;

    invoke-virtual {v6}, Landroid/content/ComponentName;->getPackageName()Ljava/lang/String;

    move-result-object v16

    invoke-virtual/range {v15 .. v16}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v15

    if-eqz v15, :cond_0

    new-instance v8, Landroid/content/Intent;

    const-string v15, "android.intent.action.MAIN"

    invoke-direct {v8, v15}, Landroid/content/Intent;-><init>(Ljava/lang/String;)V

    const-string v15, "android.intent.category.HOME"

    invoke-virtual {v8, v15}, Landroid/content/Intent;->addCategory(Ljava/lang/String;)Landroid/content/Intent;

    move-object/from16 v0, p0

    iget-object v15, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mContext:Landroid/content/Context;

    invoke-virtual {v15}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;

    move-result-object v15

    const/16 v16, 0x0

    move/from16 v0, v16

    invoke-virtual {v15, v8, v0}, Landroid/content/pm/PackageManager;->resolveActivity(Landroid/content/Intent;I)Landroid/content/pm/ResolveInfo;

    move-result-object v11

    iget-object v15, v11, Landroid/content/pm/ResolveInfo;->activityInfo:Landroid/content/pm/ActivityInfo;

    iget-object v15, v15, Landroid/content/pm/ActivityInfo;->processName:Ljava/lang/String;

    iget-object v0, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->processName:Ljava/lang/String;

    move-object/from16 v16, v0

    invoke-virtual/range {v15 .. v16}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z

    move-result v15

    if-nez v15, :cond_1

    move-object/from16 v0, p0

    iget-object v15, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mContext:Landroid/content/Context;

    invoke-virtual {v15}, Landroid/content/Context;->getPackageManager()Landroid/content/pm/PackageManager;
    :try_end_0
    .catch Ljava/lang/Exception; {:try_start_0 .. :try_end_0} :catch_0

    move-result-object v10

    :try_start_1
    invoke-virtual {v6}, Landroid/content/ComponentName;->getPackageName()Ljava/lang/String;

    move-result-object v15

    const/16 v16, 0x0

    move/from16 v0, v16

    invoke-virtual {v10, v15, v0}, Landroid/content/pm/PackageManager;->getApplicationInfo(Ljava/lang/String;I)Landroid/content/pm/ApplicationInfo;
    :try_end_1
    .catch Ljava/lang/Exception; {:try_start_1 .. :try_end_1} :catch_1

    move-result-object v1

    :goto_2
    if-eqz v1, :cond_3

    :try_start_2
    invoke-virtual {v10, v1}, Landroid/content/pm/PackageManager;->getApplicationLabel(Landroid/content/pm/ApplicationInfo;)Ljava/lang/CharSequence;

    move-result-object v4

    :goto_3
    check-cast v4, Ljava/lang/String;

    invoke-virtual {v6}, Landroid/content/ComponentName;->getPackageName()Ljava/lang/String;

    move-result-object v15

    invoke-static {}, Landroid/os/UserHandle;->myUserId()I

    move-result v0

    invoke-interface {v9, v15, v0}, Landroid/app/IActivityManager;->forceStopPackage(Ljava/lang/String;I)V

    iget v15, v3, Landroid/app/ActivityManager$RunningAppProcessInfo;->pid:I

    invoke-static {v15}, Landroid/os/Process;->killProcess(I)V

    new-instance v16, Ljava/lang/StringBuilder;

    invoke-static {v4}, Ljava/lang/String;->valueOf(Ljava/lang/Object;)Ljava/lang/String;

    move-result-object v17

    invoke-direct/range {v16 .. v17}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V

    const-string v17, " killed."

    invoke-virtual/range {v16 .. v17}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v16

    invoke-virtual/range {v16 .. v16}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v16

    move-object/from16 v0, p0

    move-object/from16 v3, v16

    iput-object v3, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mKillMessage:Ljava/lang/String;

    const-string v0, "DarkSense"

    invoke-static {v0, v3}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    move-object/from16 v0, p0

    iget-object v2, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mHandler:Landroid/os/Handler;

    iget-object v3, v0, Lcom/android/internal/policy/impl/PhoneWindowManager;->mKill_Toast:Ljava/lang/Runnable;

    invoke-static {}, Landroid/view/ViewConfiguration;->getGlobalActionKeyTimeout()J

    move-result-wide v7

    invoke-virtual {v2, v3, v7, v8}, Landroid/os/Handler;->postDelayed(Ljava/lang/Runnable;J)Z

    goto/16 :goto_0

    :catch_0
    move-exception v14

    goto/16 :goto_1

    :catch_1
    move-exception v7

    const/4 v1, 0x0

    goto :goto_2

    :cond_3
    const-string v4, "(unknown)"
    :try_end_2
    .catch Ljava/lang/Exception; {:try_start_2 .. :try_end_2} :catch_0

    goto :goto_3

    move-exception v0

    const-string v2, "WindowManager"

    const-string v3, "No activity to handle backkey action."

    invoke-static {v2, v3, v0}, Landroid/util/Slog;->w(Ljava/lang/String;Ljava/lang/String;Ljava/lang/Throwable;)I

    goto/16 :goto_1
.end method

[JonnyXDA]

Originally Posted by SyreKron

Not sure what to do now that I've got adb running. Time to google and learn some more

Can you do whats called a system dump using "adb pull /system"?

[JonnyXDA]

Originally Posted by SyreKron

@giorgio130:
Right. I've got the file and I think JonnyXDA does also. I'm sure someone will be able to mirror it if the original goes down.

I take it the file was this one?

9a9427be4988ac7050c77a9a023f0c1e 673 backup_internal_sd_shine_after_sys_recover.img.gz

If so then I can upload a mirror

[SyreKron]

Originally Posted by JonnyXDA

Can you do whats called a system dump using "adb pull /system"?

Yes, I can execute the command.

Doesn't this copy the contents of the /system directory to the PC? Is there some benefit to doing this over ADB versus reading the sd card or the image file directly??

[JonnyXDA]

Originally Posted by SyreKron

Yes, I can execute the command.

Doesn't this copy the contents of the /system directory to the PC? Is there some benefit to doing this over ADB versus reading the sd card or the image file directly??

Yes, need to get a raw system folder so we can edit the entire ROM. And nevermind, I'm using a program called ext2explore from dsixda's kitchen to get the system folder direct from the 1.img file contained in the backup_internal_sd_shine_after_sys_recover.img file.

I'm going to deodex it so we can edit the apk's and jars then upload the raw system folder with no other changes for now.

[mastnacek]

Originally Posted by SyreKron

How did you write the image to your sd card? How big is the sd card you used (capacity)?

Provided you correctly wrote the image to your sd card....I don't think I can offer much help right now.

(I'm still pretty new at this myself!)

Image is 8GB after write. Use imagewriter, but on mini dont work.

[SyreKron]

Originally Posted by mastnacek

Image is 8GB after write. Use imagewriter, but on mini dont work.

I can't think of anything that would go wrong with imagewriter and an 8GB card.

I'm not really surprised that it doesn't work. I would expect that the minor hardware differences between the Glo and the Mini could cause it to not work. This android image isn't like the Kobo firmware that works on multiple devices. I expect Kobo went to a great deal of effort to keep the firmware compatible between different devices whereas Tolino only has one device (AFAIK) to support.

As for Shine images for the Mini....Someone else may be able to make it work on the Mini but I'm not able to at this point. I'm still somewhat new to the scene myself.

Best of luck!

[KevinShort]

This is awesome! This website has rooting directions for the Tolino Shine, it should work on the Kobo Shine as well.

Edit: And I'm rooted!