Kindle Browser Patch

[hardfloat]

I have developed a patch for the built-in web browser on armhf Kindle devices (firmware >= 5.16.4). It provides the following features:
- Remove the restriction on what kind of filetypes you can download
- Remove the restriction on what protocols you can browse, enabling the use of file://
- Option to change the search engine to DuckDuckGo, FrogFind or Bing

Check it out here.

[hardfloat]

Reserved

[BionicGecko]

This is awesome! Just tested on my Oasis 3 and it works great

Makes it possible to download KFX and AZW3 files from something like Calibre-Web or COPS. This makes the browser much more useful!

[kaspar]

Nice work. Is there any way to enable landscape mode? Would be useful on the Scribe's big screen.

[kaspar]

I found this:

https://www.mobileread.com/forums/sh...84&postcount=8

I will try and report back.

[bricker]

Originally Posted by hardfloat

I have developed a patch for the built-in web browser on armhf Kindle devices (firmware >= 5.16.3). It provides the following features:
- Remove the restriction on what kind of filetypes you can download
- Remove the restriction on what protocols you can browse, enabling the use of file://

Check it out here.

incredible. how does this work on a technical level? how did you find what to replace in the binary?

[hardfloat]

Originally Posted by bricker

incredible. how does this work on a technical level? how did you find what to replace in the binary?

After identifying kindle_browser as the primary binary, I disassembled it using Ghidra. I searched for the string "azw3", because the browser must have that string in memory at some point in order to compare whether the file you are downloading matches one of the allowed extensions. I searched for x-refs to the string to find this code:

  FUN_00036b7e(auStack_6c,".azw1");
  FUN_00036b7e(auStack_60,".azw2");
  FUN_00036b7e(auStack_54,".azw3");
  FUN_00036b7e(auStack_48,&DAT_000323a4);
  FUN_00036b7e(auStack_3c,".mobi");
  FUN_00036b7e(auStack_30,&DAT_0002f676);
  iVar10 = 0;
  do {
    if (iVar10 == 0x54) {
      bVar1 = false;
      goto LAB_0004d7d0;
    }
    base::BasicStringPiece<>::BasicStringPiece((char *)&uStack_90);
    iVar7 = base::FilePath::MatchesExtension((GURL *)aFStack_84,uStack_90,uStack_8c);
    iVar10 = iVar10 + 0xc;
  } while (iVar7 == 0);
  bVar1 = true;
LAB_0004d7d0:

which is essentially a for loop checking each extension to see if it matches, and if after checking all of them if it still hasn't matched, it sets the bVar1 to false, indicating our extension is not in the allowed list.

I patched it to:

FUN_00036b7e(auStack_6c,".azw1");
  FUN_00036b7e(auStack_60,".azw2");
  FUN_00036b7e(auStack_54,".azw3");
  FUN_00036b7e(auStack_48,&DAT_000323a4);
  FUN_00036b7e(auStack_3c,".mobi");
  FUN_00036b7e(auStack_30,&DAT_0002f676);
  iVar10 = 0;
  do {
    if (iVar10 == 0x54) {
      bVar1 = true;                   <-- PATCH
      goto LAB_0004d7d0;
    }
    base::BasicStringPiece<>::BasicStringPiece((char *)&uStack_90);
    iVar7 = base::FilePath::MatchesExtension((GURL *)aFStack_84,uStack_90,uStack_8c);
    iVar10 = iVar10 + 0xc;
  } while (iVar7 == 0);
  bVar1 = true;
LAB_0004d7d0:

so that in the case where no extension in the list matches, it still returns true instead of false.

old:

0004d7ce 00 25           movs       r5,#0x0

new:

0004d7ce 01 25           movs       r5,#0x1

Next, I searched for strings "http" and https", but the only thing I could find was this import from libchromium.so:

/* GURL::SchemeIsHTTPOrHTTPS() const */

undefined4 __thiscall GURL::SchemeIsHTTPOrHTTPS(GURL *this)

{
  size_t sVar1;
  int iVar2;
  undefined4 uVar3;
  
  sVar1 = strlen("http");
  iVar2 = FUN_018d3db8(this,&DAT_00840f1b,sVar1);
  if (iVar2 != 0) {
    return 1;
  }
  sVar1 = strlen("https");
  uVar3 = FUN_018d3db8(this,"https",sVar1);
  return uVar3;
}

I tried patching it to:

/* GURL::SchemeIsHTTPOrHTTPS() const */

undefined4 __thiscall GURL::SchemeIsHTTPOrHTTPS(GURL *this)

{
  size_t sVar1;
  int iVar2;
  undefined4 uVar3;
  
  sVar1 = strlen("http");
  iVar2 = FUN_018d3db8(this,&DAT_00840f1b,sVar1);
  
  return 1;              <-- PATCH

  sVar1 = strlen("https");
  uVar3 = FUN_018d3db8(this,"https",sVar1);
  return uVar3;
}

We removed the if statement, and simply executed the return.

old:

018d3e04 08 b1           cbz        this,LAB_018d3e0a

new:

018d3e04 00 bf           nop

The installation script does 3 things:
- Copies the browser binaries from system directories to a new directory in /mnt/us
- Patches them
- Updates /var/local/appreg.db so that the browser launch command executed when you open the browser from the GUI points to the new, patched browser instead.

[BionicGecko]

Thanks for this detailed overview and for sharing your thought process, this was very informative.

[kaspar]

Do you think you could similarly patch the Bluetooth manager to allow any device (a keyboard) instead of only audio devices? Obviously more work would be required after that, but it would be a great start.

[juegos]

What would file:// allow you to do? Thank you!

[DNSB]

Originally Posted by juegos

What would file:// allow you to do? Thank you!

File:// lets you open a local file in a web browser. Firefox has Open file in it's file menu to allow browsing to a file or you can type ctrl-O and browse that way. For Chrome and Edge, you need to type ctrl-O, browse to the file and then open it. I find it useful when looking a downloaded HTML file or testing a file before uploading it. File:// requires you to know the path to the file so you would have to type file://d:/downloads/abenigy.html to open the file.

At one point when Edge supported displaying ePub files, I used ctrl-O to browse to and open the ePub but gave on using Edge since the renderer was not anything to write home about.

[smbgaiden]

hardfloat: The signature for kindle_browser extension checking for downloads on a colorsoft version 5.18.0.1 is:

unsigned char patch1_find[] = { 0x0c, 0x36, 0x0c, 0x34, 0x00, 0x28, 0xea, 0xd0, 0x01, 0x24, 0x00, 0xe0, 0x00, 0x24 };

unsigned char patch1_replace[] = { 0x0c, 0x36, 0x0c, 0x34, 0x00, 0x28, 0xea, 0xd0, 0x01, 0x24, 0x00, 0xe0, 0x01, 0x24 };

The code in this version moves either 0 or 1 into r4, as seen in bytes above. The patch above, just moves 1 into r4 either case.

The patch I used on mine was a little further down where r4 content is moved to r0. Instead of mov r0, r4 (0x20 0x46) made a change to just store 1 in the return value register directly with movs r0, #1 (0x01 0x20).

I don't yet know about the code signature for the protocols change on this version.

[smbgaiden]

Originally Posted by smbgaiden

hardfloat: The signature for kindle_browser extension checking for downloads on a colorsoft version 5.18.0.1 is:

unsigned char patch1_find[] = { 0x0c, 0x36, 0x0c, 0x34, 0x00, 0x28, 0xea, 0xd0, 0x01, 0x24, 0x00, 0xe0, 0x00, 0x24 };

unsigned char patch1_replace[] = { 0x0c, 0x36, 0x0c, 0x34, 0x00, 0x28, 0xea, 0xd0, 0x01, 0x24, 0x00, 0xe0, 0x01, 0x24 };

The code in this version moves either 0 or 1 into r4, as seen in bytes above. The patch above, just moves 1 into r4 either case.

The patch I used on mine was a little further down where r4 content is moved to r0. Instead of mov r0, r4 (0x20 0x46) made a change to just store 1 in the return value register directly with movs r0, #1 (0x01 0x20).

I don't yet know about the code signature for the protocols change on this version.

The lib patch is:
unsigned char patch2_find[] = { 0x0d, 0x48, 0x78, 0x44, 0x05, 0x68, 0x28, 0x46, 0xa5, 0xf0, 0xf7, 0xf9, 0x02, 0x46, 0x20, 0x46, 0x29, 0x46, 0xff, 0xf7, 0xda, 0xff, 0x08, 0xb1}

unsigned char patch2_replace[] = { 0x0d, 0x48, 0x78, 0x44, 0x05, 0x68, 0x28, 0x46, 0xa5, 0xf0, 0xf7, 0xf9, 0x02, 0x46, 0x20, 0x46, 0x29, 0x46, 0xff, 0xf7, 0xda, 0xff, 0x00, 0xbf}

[shiso91]

Could it be possible to patch the browser to allow access to loopback IP?

The thing is I've been trying to access a local Nginx web server I've launched with KUAL in the Kindle's web browser, including this patched one as well, but I've hit the wall of not being able to access it with localhost or even with my own Kindle's 192.x.x.x private IP address.

The Kindle's web server works just fine, since I can access it from other devices, like my PC or my phone. The only device that can't access it is the Kindle, which runs the web server.

For now, I'm happy with being able to use my webapps with the file:// protocol. And I'm very grateful for that!

[shiso91]

Originally Posted by shiso91

Could it be possible to patch the browser to allow access to loopback IP?

The thing is I've been trying to access a local Nginx web server I've launched with KUAL in the Kindle's web browser, including this patched one as well, but I've hit the wall of not being able to access it with localhost or even with my own Kindle's 192.x.x.x private IP address.

The Kindle's web server works just fine, since I can access it from other devices, like my PC or my phone. The only device that can't access it is the Kindle, which runs the web server.

Nevermind this. I tried patching it myself and I only got the browser to crash.
In the end, I only had to add dnsmasq to my web server.