View Single Post
Old 02-18-2019, 07:05 PM   #4
RandomInsano
Member
RandomInsano began at the beginning.
 
Posts: 11
Karma: 10
Join Date: Feb 2019
Location: Canadia: Land of Loonie
Device: Kindle Touch 4G / Kobo N416 / Kobo Touch / Kobo Mini
Good news all! I spent a few hours yesterday hacking around and managed to unbrick things:

Using the link from the following thread, I was able to grab the kernel image:
https://www.mobileread.com/forums/sh...d.php?t=314655
http://download.kobobooks.com/firmwa...pgrade-1.8.zip

From there, because U-Boot doesn't have a good way to load data from an SD card (that I could find) I wrote a quick Python script that would convert the binary data from the "uImage-eb600em" into lines of text that U-Boot's `mm` command would understand.

I then connected with a USB-FTDI device to the system using `cu` from my Mac like so:

Code:
$ cu -l /dev/usb.tty-00000000 -s 115200
From here, I entered the right magic for `mm`:

Code:
U-Boot# mm 31000000
Once that was set up, I called on `cu`s `~>` send file functionality to essentially type out all 1.5MB of Kernel as though I were typing it by hand. This took probably around 3 hours to complete.
(ref: https://www.computerhope.com/unix/ucu.htm)

Once done, I typed "." and the enter key to exit `mm` and stored the RAM that was just transferred over using the following command:

Code:
U-Boot# nandw 80000 200000 31000000
After rebooting, I have my Kobo back!

I have some details over here:
https://gist.github.com/RandomInsano...621f4699d3595e

And here's the Python script in case that link ever gets lost to the sands of time:

Code:
#!/usr/bin/env python3

import sys

# There's some acrobatics here as our binary file
# is stored in a different endiannes than what U-Boot's
# `mm` command is expecting

with open(sys.argv[1], "rb") as f:
	bytes = f.read(4)
	while bytes != b'':
		buffer = list('00000000')
		i = 3
		for byte in bytes:
			value = list('{:02x}'.format(byte))
			buffer[i * 2] = value[0]
			buffer[i * 2 + 1] = value[1]

			i -= 1
		print(''.join(buffer))
		bytes = f.read(4)
RandomInsano is offline   Reply With Quote