PB62x/740: root + sshd, ftpd, smbd, iptables, usbnet (needs testers)

[kakonema]

Originally Posted by leomeyer

Jailbreak apparently does not work on Verse Pro Color (U634k3.6.8.3806) with Linux kernel version 4.9.56 (this is the kernel version in the current SDK 6.8 for the B300 CPU).

Maybe the exploit in the old kernel (3.10.65 iirc) has been fixed so this tool will no longer work on newer devices.

Can anyone confirm this? Is someone already working on a fix?

Thanks, Leo

This jailbreak is based on the old linux kernel exploit that affects kernel versions ranging from 2.x to 4.8.2, so any device with kernel version 4.8.3 or newer is unaffected by this exploit.

[AlexPechkin]

Originally Posted by Valwit

Verse Pro still uses 3.10.65+

Does this jailbreak work on latest firmware on Verse Pro? For some reason I couldn't get FTP server to work. The same with HTTP server actually. But the root menu in settings indeed appears.

[AlexPechkin]

How to fix FTP on rooted PocketBook with newer firmware

On newer PocketBook firmware, proftpd fails to start because libcrypt.so.1 is missing. The root cause is that pbjb binaries were compiled for armel (soft-float), but the library is not present on the device. Here's how to fix it.

Prerequisites
- pbjb installed (jailbreak + services): http://github.com/ezdiy/pbjb
- SSH enabled in Rooted device settings
- Phone and PocketBook on the same Wi-Fi network
- Termux installed on Android (from F-Droid or Play Store)

Step 1 - Connect via SSH

Standard Termux uses Dropbear as SSH client which is incompatible with the old algorithms on the PocketBook SSH server. Install OpenSSH first:

pkg install openssh

Then connect (replace IP with what you see in Rooted device settings → System status):

ssh -oHostKeyAlgorithms=+ssh-rsa root@192.168.x.x

Your password is stored in /mnt/ext1/password.txt — the value after password=.

Step 2 - Fix missing libcrypt.so.1

The key insight: PocketBook uses armel (soft-float ABI), so armhf packages from Debian will NOT work. You need the armel version of glibc.

Run these commands in your SSH session on the PocketBook:

# Remount /ebrmain as read-write
mount -o remount,rw /ebrmain

# Download correct glibc version (armel!)
curl -O http://archive.debian.org/debian/pool/main/g/glibc/libc6_2.19-18+deb8u10_armel.deb

# Extract
busybox ar x libc6_2.19-18+deb8u10_armel.deb
busybox tar xzf data.tar.gz

# Copy the library
cp ./lib/arm-linux-gnueabi/libcrypt-2.19.so /ebrmain/lib/libcrypt.so.1

Step 3 - Start FTP server

/mnt/secure/bin/proftpd

Now connect from any FTP client:
- Host: IP shown in System status
- Port: 21
- Username: root
- Password: value from password.txt

Notes
- proftpd starts automatically on reboot if FTP is enabled in Rooted device settings
- SFTP does not work even after this fix. sftp-server also requires a libcrypto symlink (ln -s /ebrmain/lib/libcrypto.so.3 /ebrmain/lib/libcrypto.so.1.0.0) but still fails due to further incompatibilities with newer firmware
- For file transfer from Termux you can also use SCP:

scp -oHostKeyAlgorithms=+ssh-rsa /path/to/file root@192.168.x.x:/mnt/ext1/

- Tested on PocketBook firmware 6.10.x with pbjb v8

[nhedgehog]

@AlexPechkin: Cool, thanks for sharing this. I think most of us are using SCP via KoReader, since it has an integrated SSH server option.

[nath57]

Hi,
I'm using a PB743K3 (version 6.10.2680) and the jailbreak does not seem to work. When i run it, the confirmation prompt pops up but the device does note reboot, and nothing happens when I try to run Services.app.

I managed to acces ssh as root over usb following this method : https://www.redguard.ch/blog/2025/03...nkpad-color-3/
So i think the jailbreak should be possible ?

I want to jailbreak it as it is necessary to run the Text-Editor app (https://github.com/JuanJakobo/Pocketbook-Texteditor).

I've read a lot of messages in this thread but i could not find a solution for this model, sorry if it was already explained !

[neil_swann80]

Originally Posted by nath57

Hi,
I'm using a PB743K3 (version 6.10.2680) and the jailbreak does not seem to work. When i run it, the confirmation prompt pops up but the device does note reboot, and nothing happens when I try to run Services.app.

I managed to acces ssh as root over usb following this method : https://www.redguard.ch/blog/2025/03...nkpad-color-3/
So i think the jailbreak should be possible ?

I want to jailbreak it as it is necessary to run the Text-Editor app (https://github.com/JuanJakobo/Pocketbook-Texteditor).

I've read a lot of messages in this thread but i could not find a solution for this model, sorry if it was already explained !

Maybe try following THIS

Particularly post #3 by nhedgehog
(Only up to step 6 for the Jailbreak, only need to proceed further to add OPDS to the Library)

[Mr.Weegley]

Successfully installed pbjb v8 on my PocketBook Touch HD 3 (PB632) running the latest firmware U632.6.11.2001 (September 2026).

Installed @Jailbreak from pbjb v8.

Installation completed successfully and the device rebooted.

Verified that /mnt/secure/su was installed with SUID-root permissions.

Executed su from an application running as the default reader user (UID 101).

Confirmed root access: uid=0(root) gid=0(root).

Device boots and operates normally after installation.

Kernel: 3.10.65+, ARMv7, sun8iw10.

I have only tested the jailbreak/root functionality so far, not the @Services package.

Thanks for the great work!

[Mr.Weegley]

Could not find PM on this forum thus asking here for permission to use your Jailbreak App in my patch installer.