OPDS access an recent PocketBook

[pitdicker]

This is how I enabled OPDS access on a PocketBook InkPad Color 3. Hopefully it is of help for others.

1. Get a terminal on the PocketBook

See the discussion thread: https://www.mobileread.com/forums/sh...d.php?t=221543
A version of pbterm that works on recent devices is available on https://github.com/leomeyer/pbterm
InkPad Color 3 needs te version for an Allwinner B300 SoC.
Download the binary, and place it in ext1/applications/.

2. Enable developer mode

As described in this root exploit: https://www.redguard.ch/blog/2025/03...nkpad-color-3/

In pbterm execute

sh -c '/usr/cramfs/bin/iv2sh WriteConfig /mnt/secure/developer_mode privesc 1'

3. Connect over SSH as root

Restart the device while it is connected with a USB cable to a PC. This enables the SSH deamon.
Choose "File Transfer" as the USB mode.

On your (Linux) PC, it will show up as an extra device in

ip link

.
Connect to that device as root.

ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.205.1

5. Enable OPDS

See the full (closed) thread on https://www.mobileread.com/forums/sh...d.php?t=359271

Remount the filesystem as writable:

mount -o rw,remount /ebrmain

Change the line with

have_opds=0

to

have_opds=1

in 3 files with vi:
- /mnt/secure/device.cfg
- /ebrmain/config/device.cfg.gen
- /ebrmain/config/device.cfg

6. Test

After rebooting, you should now have the option available to browse network libraries on the Library.

[neil_swann80]

Nice find! Have you used this method to get permanent root on your device? Should be easy enough to add the ezdiy's su binary to /mnt/secure. Once done you could try installing his services package.

[nhedgehog]

Originally Posted by neil_swann80

Nice find! Have you used this method to get permanent root on your device? Should be easy enough to add the ezdiy's su binary to /mnt/secure. Once done you could try installing his services package.

Yes that is working: Device; U700k3.6.10.2359 (Pocketbook Era Color)
Steps:
1) Installed the right pbterm version
2) In Pbterm:

sh -c '/usr/cramfs/bin/iv2sh WriteConfig /mnt/secure/developer_mode privesc 1'

than reboot
3) Got su from here (https://github.com/ezdiy/pbjb/releases/tag/v8 it is in the source code zip) and copied su into the device under win7 in folder su which corrospondends to /mnt/ext1/su
4a) Linux machine SSH access (connect the switched off device via USB cable to Linux machine):

ssh -o HostKeyAlgorithms=ssh-rsa root@192.168.205.1 -v

4b) Alternative to 4a on a Win7 machine:
Got RNDIS installed properly (sounds easier than it is). Connected via WinSCP:
Protocol: SCP
Hostname:192.168.205.1
Username:root
Passwort:
5) trying to remount /ebrmain ->failed (missing rigths)

mount -o rw,remount /ebrmain

6) copy su into mnt/secure

cp /mnt/ext1/su/su /mnt/secure/su

7) trying to remount /ebrmain with su (working)

/mnt/secure/su mount -o rw,remount /ebrmain

8) editing /ebrmain/config/device.cfg.gen: change line have_opds=0 to have_opds=1 (edit mode with i,ESC stops Edit mode, :w saves file :q quits vi)

vi /ebrmain/config/device.cfg.gen

9) trying to remount /ebrmain with su (working)

/mnt/secure/su mount -o ro,remount /ebrmain

10) Reboot device: OPDS is enabled

PS: I was allowed to change /mnt/secure/device.cfg without su but it was changed back after reboot.

[neil_swann80]

Nice! What about ezdiy's services installer? Will that now install with su in place?

[nhedgehog]

I didn't test the service installer. Was scared of eventually bricking the device during future firmware updates.

[neil_swann80]

Originally Posted by nhedgehog

I didn't test the service installer. Was scared of eventually bricking the device during future firmware updates.

Fair enough. It's survived a FW update on my HD3, but there's no guarantee it will in a future update.

I wonder if Step #5 would have succeeded running as sudo? (ssh-ing as root should have been enough)

Still very useful having su available to you even if it did.

[nhedgehog]

Originally Posted by neil_swann80

I wonder if Step #5 would have succeeded running as sudo? (ssh-ing as root should have been enough)

Tried it:
FAILED
Step #5

sudo mount -o rw,remount /ebrmain

Sorry, user root is not allowed to execute '/bin/mount -o rw,remount /ebrmain' as root on pocketbook.

[neil_swann80]

Originally Posted by nhedgehog

Tried it:
FAILED
Step #5

sudo mount -o rw,remount /ebrmain

Sorry, user root is not allowed to execute '/bin/mount -o rw,remount /ebrmain' as root on pocketbook.

It was a long-shot, but thanks for testing. Nice to know that su is the way to go!

And thanks also for the write-up, will be useful to many I imagine.

[nhedgehog]

Edited Post3_Step4, since I was able to recreate the process on a Win7 machine too.

Windows made it even easier:
0) step1&step2 from post3
1) Connect via WinSCP (Protocol: SCP;Hostname:192.168.205.1;Username:root)
2) In WinSCP Terminal:

mount -o rw,remount /ebrmain

3) Now edit /ebrmain/config/device.cfg.gen in your prefered editor (mine is Notepad++).
4) Save it, close Notpad++
5) In WinSCP Terminal:

mount -o ro,remount /ebrmain

6) Close WinSCP, disconnect Reader, Reboot Pocketbook device.

PS: Strange that mount is working via WinSCP