Touch Hacking into the Kobo Touch

[stef70]

I just made a web page to describe my experiments with the Kobo Touch:

http://www.chauveau-central.net/pub/KoboTouch/

My achievements so far:
- execute arbitrary commands
- enable telnet & ftp
- read touchscreen & key events
- take screenshots
- and a lot of technical information about the hardware

[PeterT]

Would you like to put that in the Wiki here?

[Toastedpine]

Dang this is making me want to buy a second Touch just so I can play with the insides. It would be awesome to turn the Kobo into a type of auxiliary screen for quick offline notes.

[stef70]

Originally Posted by PeterT

Would you like to put that in the Wiki here?

I am fine if my document is copied in full or in part in the Wiki but I will probably not do it myself. I am planning to extend my own page with my future findings and that will probably take me more time than I would like. Also, I am not familiar with Wikis.

[Cyberman tM]

Great information. Too bad I don't have a Touch. Perhaps I should reconsider buying one...

Originally Posted by stef70

Also, I am not familiar with Wikis.

They're usually very easy to learn, even if a bit weird at first. Great for microcontent, IMO. (i.e. addings bits and bytes and just linking them together instead of doing a whole writeup for every part; adding a category even groups them nicely - and you get automagically a TOC)

[portablejim]

Very interesting. I myself am wondering about getting a window manager (e.g. fluxbox) running on it and running nickel on top.

[CdnBloodlust]

Edit: Fixed the problem by moving the code from rcS2 to rcS. Telnet works now. I'll leave my original post below.

Spoiler:

Kobo Touch
1.9.10

Thank you, great work. Been using Linux for 5+ years, but I'm not that great. I've tried your tutorial for getting FTP and telnet working. FTP works great but not telnet.

Edited file contents:

Spoiler:

/etc/init.d/rcS2

#!/bin/sh
mkdir -p /dev/pts
mount -t devpts devpts /dev/pts

/etc/inetd.conf

# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args>
# ftp	stream	tcp	nowait	root	/usr/sbin/tcpd		in.ftpd
# telnet	stream	tcp	nowait	root	/usr/sbin/telnetd	telnetd -l /bin/login
21 stream tcp nowait root /bin/busybox ftpd -w -S  /
23 stream tcp nowait root /bin/busybox telnetd -i

/etc/inittab

# This is run first except when booting in single-user mode.
::sysinit:/etc/init.d/rcS
::respawn:/sbin/getty -L ttymxc0 115200 vt100
::ctrlaltdel:/sbin/reboot
::shutdown:/bin/umount -a -r
::restart:/sbin/init
::sysinit:/etc/init.d/rcS2
::respawn:/usr/sbin/inetd -f /etc/inetd.conf

Using the run.sh I first copied the files I was gonna edit just to be safe. There's some comments in inetd.conf, but I just used your lines for those.

So ftp works great but no telnet ...

Output of ftp and telnet where just ftp works:

Spoiler:

[code]
% ftp 192.168.0.158
Connected to 192.168.0.158.
220 Operation successful
Name (192.168.0.158:foo): root
230 Operation successful
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 Operation successful
150 Directory listing
total 171
drwxr-xr-x 2 root root 3072 Sep 17 13:33 bin
drwxrwxrwt 6 root root 2440 Sep 17 15:06 dev
drwxr-xr-x 4 root root 1024 Sep 17 13:33 drivers
drwxr-xr-x 15 1000 1000 1024 Sep 17 14:10 etc
-rw-r--r-- 1 root root 143878 Jun 28 08:01 fs.md5sum
drwxr-xr-x 9 root root 5120 Sep 17 13:19 lib
drwxr-xr-x 6 root root 1024 Sep 17 13:20 libexec
lrwxrwxrwx 1 root root 11 Sep 17 13:19 linuxrc -> bin/busybox
drwx------ 2 root root 12288 Sep 17 13:19 lost+found
drwxr-xr-x 5 root root 1024 Jul 4 15:54 mnt
dr-xr-xr-x 58 root root 0 Dec 31 1969 proc
drwxr-xr-x 3 root root 1024 Sep 17 13:20 root
drwxr-xr-x 2 root root 3072 Sep 17 13:20 sbin
drwxr-xr-x 12 root root 0 Sep 17 14:41 sys
drwxrwxrwt 3 root root 100 Sep 17 14:42 tmp
drwxr-xr-x 7 root root 1024 May 30 20:46 usr
drwxr-xr-x 5 root root 1024 Sep 17 13:20 var
226 Operation successful
ftp> 221 Operation successful
% telnet 192.168.0.158
Trying 192.168.0.158...
Connected to 192.168.0.158.
Escape character is '^]'.
Connection closed by foreign host.

So it seems to be connecting then closing right away. I'm gonna try some things to get it working but I'm not great with telnet so if anyone has any help that would be great.

Note busybox seems to be changed in the latest update kobo3-upgrade-1.9.10.zip KoboRoot.tgz.
Note /dev/pty doesn't exist. only block char input are in /dev. Is rcS2 not getting executed? Gonna try putting the code from rcS2 in rcS.

Thank you very much, great work. <3

[Pistos]

stef70: Brilliant stuff. If I could give you triple karma, I would. Thank you so much for sharing.

[CdnBloodlust]

Playing around with the device lots. Found this.

cat /sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/capacity
48

/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/uevent:
POWER_SUPPLY_NAME=mc13892_bat
POWER_SUPPLY_VOLTAGE_NOW=3739524
POWER_SUPPLY_CURRENT_NOW=58700
POWER_SUPPLY_CHARGE_NOW=0
POWER_SUPPLY_STATUS=Discharging
POWER_SUPPLY_CAPACITY=46
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/status:
Discharging
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/voltage_now:
3716064
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/current_now:
176100
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/charge_now:
0
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/capacity:
45
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/type:
Battery
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/power/control:
auto
/sys/devices/platform/pmic_battery.1/power_supply/mc13892_bat/power/wakeup:

Here's some more code if you wanna play around with images. Havn't tried any except the ghost one which just shows a blank screen for me. Code copied byte for byte from some sh file.

kill -9 `pidof nickel`
zcat /etc/images/ghostbuster.raw.gz | /usr/local/Kobo/pickel showpic

So obviously there's more images in /etc/images.

ls -1 /etc/images
error_epson_instruction.raw.gz
error_epson_waveform.raw.gz
error_hwconfig.raw.gz
error_kernel.raw.gz
error_logo.raw.gz
error_preloader.raw.gz
error_redboot.raw.gz
error_usb_try_again.raw.gz
ghostbuster.raw.gz
initializing_usb_partition.raw.gz
insert_usb_plug.raw.gz
on-0.raw.gz
on-1.raw.gz
on-10.raw.gz
on-2.raw.gz
on-3.raw.gz
on-4.raw.gz
on-5.raw.gz
on-6.raw.gz
on-7.raw.gz
on-8.raw.gz
on-9.raw.gz
one_moment_please.raw.gz
reboot.raw.gz
splash.raw.gz
update-spinner-0.raw.gz
update-spinner-1.raw.gz
update-spinner-2.raw.gz
update-spinner-3.raw.gz
update-spinner-4.raw.gz
update-spinner-5.raw.gz
wait_for_desktop_to_unplug.raw.gz

/etc/init.d/update-animator.sh looks interesting for creating a custom animation. Interesting there's an extra parameter for showpic in that script which is just 1. Sleeps for half a second before each call to showpic. Custom boot animation anybody?! A nice spinning penguin maybe with system information?

[2bits]

@ Toastedpine

Nothing too special required
I create/keep all my notes in TuxCards - simply export them to HTML
Then import into Calibre and convert to EPUB - Gets you table of contents etc
The 1st thing I put on my Kobo Touch was 2MB of personal notes
and music 100 + songs with lyrics & guitar chord diagrams (also from TuxCards)
Books were my 2nd priority. LOL

[CdnBloodlust]

Custom Boot Animation.

[Pistos]

@CdnBloodlust: Nice!

[xuyn2003]

Great works! Thank you stef70。

I changed the code "en_US.UTF-8" in the rcS file to "zh_CN.UTF-8",
wishing this setting could solve the "????" in TXT file for Chinese character,
unfortunetly, failed, the KOBO Touch can't boot up.
So a hard factory reset was done.

It's strange, why kobo touch can render Chinese character correcty in EPUBs, but not in TXTs?

[CdnBloodlust]

I'll try and see if i'm having the same chinese txt problem but right now I'm doing something else. What about this link tho? Might work.
https://www.mobileread.com/forums/sho...d.php?t=149071

Does anyone know the commands to make it load the books from onboard after an ftp transfer? I know I read something about this somewhere just can't find the post right now.

[xuyn2003]

Originally Posted by CdnBloodlust

I'll try and see if i'm having the same chinese txt problem but right now I'm doing something else. What about this link tho? Might work.
https://www.mobileread.com/forums/sho...d.php?t=149071

Hi CdnBloodlust, thanks for your reply.
A new "font" folder with chinese ttf files can't do any help to read chinese TXTs,
I have tested many times ago, by every possible encoding methods:GBK,UTF-8 and etc.