PRS-500 Reader internals - Page 4

NatCh · 10-17-2006, 12:18 PM

D'oh! That'll teach me not to skim!

porkupan · 10-17-2006, 12:18 PM

Quote:

Originally Posted by igorsk

Okay, so I did some investigation (mostly consisting of reading S20libromount script

) and here's the summary:
/opt, /opt1/keys and /opt1/info are mounted from cramfs images, meaning they're read-only.
/opt0 and /Data use jffs2 which is writable
/etc and /var are copied to ramdisk (created in /dev/shm/) and remounted at /, so we can't access the original dirs.

Yeah, that's a hassle. We can't change any of the startup scripts, I guess, because we would have to unmount the copies from the /dev/shm first before we can overwrite the originals. Perhaps there is a way to force running some sort of a script on the Reader, but that would clearly be a "security breach", so I suspect Sony would try to close that loophole (assuming they don't want us to hack into their device, which may be an incorrect assumption, but this is not a Nokia 770 for you).

Otherwise Mr. gseryakov's idea would have been implementable, if space-costly - make your own copy of /opt (if the USB Reader interface protocol allows us to create directories in the Reader's filesystem, which is not yet done in ebook.py, or just copy a tar file and untar it locally) and make a mod in one of the rc scripts to overmount /opt (or perhaps even only /opt/sony/ebook/FONT) on boot-up. But first we would have to come up with a way to execute a program of our own in the device's OS.

I suspect Sony's way of doing the Software upgrades assumes a certain authentication procedure, and then a special set of commands which will (a) load the updates into a writable directory in the Reader (b) tell the local service to perform a software update/reflash from a local copy.

If Librie-I allowed a hack to update firmware or install applications, it is possible that the same or similar hack still works for the current Reader. Chances are, the flash updater is proprietary, not open source.

gseryakov · 10-17-2006, 12:21 PM

Quote:

Originally Posted by Slava

Probably these steps will help if reflashing goes bad

...
9. Your device should be ready to read eBooks purchased from your account.[/list]

Very interesting. Do that with filemon to see weather the PC software downloads the repair image and does the actial repair reflashing.

NatCh · 10-17-2006, 12:24 PM

Quote:

Originally Posted by porkupan

...assuming they don't want us to hack into their device, which may be an incorrect assumption....

While we were in San Diego, they kinda-sorta implied that they didn't have any intention to stop ignoring hacking on the Reader, as they did on the Librie'

Slava · 10-17-2006, 12:28 PM

Instead of standing there - doing nothing, they could help hacking

NatCh · 10-17-2006, 02:24 PM

Given the overall Sony attitude toward hacking (PSP anyone?) I think their staying out of the way may be the best help they can officially give.

igorsk · 10-17-2006, 02:47 PM

The only modifiable parts of fs are /opt1 and /Data. You can write to /tmp, /var and /etc, but all changes will be lost on a reboot. So, we don't have any way to change the scripts or programs with just the USB copy interface. However, I have some good news.
1) I can dump the original flash partitions with a slightly modified ebook.py. This gives me the original cramfs images that I can edit to my heart's content.
2) I've discovered functions used for updating of the flash and figured out most of their parameters. Now I need to add them to ebook.py and maybe try reflashing the same image back... that shouldn't break anything, I hope. Of course, the best would be to wait for an official updater and try to hijack the updated firmware binary as it was done with Librie... but who knows how long we'll have to wait for that.

igorsk · 10-17-2006, 02:56 PM

BTW, if any of the Linux guys wants to try writing some tools, contact me. Apparently the interface is almost the same as in the sample programs from the Sony site, just with a lot of extra commands added.

gseryakov · 10-17-2006, 04:46 PM

Quote:

Originally Posted by igorsk

1) I can dump the original flash partitions with a slightly modified ebook.py. This gives me the original cramfs images that I can edit to my heart's content.
2) I've discovered functions used for updating of the flash and figured out most of their parameters. Now I need to add them to ebook.py and maybe try reflashing the same image back... that shouldn't break anything, I hope.

What kind of return policy do the SonyStyle stores have?

NatCh · 10-17-2006, 04:50 PM

igorsk · 10-17-2006, 07:24 PM

Slava · 10-17-2006, 07:59 PM

Igor, has Sony offered you job yet ?-)

igorsk · 10-17-2006, 08:13 PM

Well, actually I didn't do the actual flashing yet. I only tried switching to the update mode and back. I need to investigate the other functions more some more.

Slava · 10-17-2006, 08:15 PM

Quote:

Originally Posted by igorsk

I only tried switching to the update mode and back. I need to investigate the other functions more some more.

I have no doubts you'll get there

geekraver · 10-18-2006, 02:08 AM

Aargh. I'm finally at the point where I'm trying to build my C shim program, and I get:

fatal error LNK1107: invalid or corrupt file: cannot read at 0x280 c:\Program Files\Sony\CONNECT Reader\Data\bin\ebookusb.dll 1

10-17-2006, 12:28 PM	#50
Slava Addict Posts: 285 Karma: 129 Join Date: Sep 2006 Location: New England Device: PRS-500 · iPad · K3	Instead of standing there - doing nothing, they could help hacking Last edited by Slava; 10-17-2006 at 12:31 PM.

10-17-2006, 02:24 PM	#51
NatCh Gizmologist Posts: 11,615 Karma: 929550 Join Date: Jan 2006 Location: Republic of Texas Embassy at Jackson, TN Device: Pocketbook Touch HD3	Given the overall Sony attitude toward hacking (PSP anyone?) I think their staying out of the way may be the best help they can officially give. Last edited by NatCh; 10-17-2006 at 03:01 PM.

10-17-2006, 07:24 PM	#56
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	Attached Thumbnails

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
PRS-500 Reader Internals 2.0 (pics!)	lint	Sony Reader Dev Corner	60	11-18-2013 08:25 AM
Kindle DX Internals	revilo	Amazon Kindle	0	06-15-2009 04:50 AM
Kindle 2 Internals	JSWolf	Amazon Kindle	19	02-27-2009 02:45 PM
PRS-500 Connect internals	igorsk	Sony Reader Dev Corner	1	10-12-2006 04:50 AM
iLiad Iliad internals	ali	iRex Developer's Corner	39	07-21-2006 04:28 AM

10-17-2006, 12:18 PM	#46
NatCh Gizmologist Posts: 11,615 Karma: 929550 Join Date: Jan 2006 Location: Republic of Texas Embassy at Jackson, TN Device: Pocketbook Touch HD3	D'oh! That'll teach me not to skim!

10-17-2006, 02:47 PM	#52
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	The only modifiable parts of fs are /opt1 and /Data. You can write to /tmp, /var and /etc, but all changes will be lost on a reboot. So, we don't have any way to change the scripts or programs with just the USB copy interface. However, I have some good news. 1) I can dump the original flash partitions with a slightly modified ebook.py. This gives me the original cramfs images that I can edit to my heart's content. 2) I've discovered functions used for updating of the flash and figured out most of their parameters. Now I need to add them to ebook.py and maybe try reflashing the same image back... that shouldn't break anything, I hope. Of course, the best would be to wait for an official updater and try to hijack the updated firmware binary as it was done with Librie... but who knows how long we'll have to wait for that.

10-17-2006, 02:56 PM	#53
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	BTW, if any of the Linux guys wants to try writing some tools, contact me. Apparently the interface is almost the same as in the sample programs from the Sony site, just with a lot of extra commands added.

10-17-2006, 04:50 PM	#55
NatCh Gizmologist Posts: 11,615 Karma: 929550 Join Date: Jan 2006 Location: Republic of Texas Embassy at Jackson, TN Device: Pocketbook Touch HD3

10-17-2006, 07:59 PM	#57
Slava Addict Posts: 285 Karma: 129 Join Date: Sep 2006 Location: New England Device: PRS-500 · iPad · K3	Igor, has Sony offered you job yet ?-)

10-17-2006, 08:13 PM	#58
igorsk Wizard Posts: 3,442 Karma: 300001 Join Date: Sep 2006 Location: Belgium Device: PRS-500/505/700, Kindle, Cybook Gen3, Words Gear	Well, actually I didn't do the actual flashing yet. I only tried switching to the update mode and back. I need to investigate the other functions more some more.

10-18-2006, 02:08 AM	#60
geekraver Addict Posts: 364 Karma: 1035291 Join Date: Jul 2006 Location: Redmond, WA Device: iPad Mini,Kindle Paperwhite	Aargh. I'm finally at the point where I'm trying to build my C shim program, and I get: fatal error LNK1107: invalid or corrupt file: cannot read at 0x280 c:\Program Files\Sony\CONNECT Reader\Data\bin\ebookusb.dll 1