pbemu: user-mode emulation for 6.x firmware

datyoma · 05-01-2026, 06:36 AM

Hello everyone,

Don't know about you, but I find it rather annoying to repeatedly copy files to the real device during development, so I thought, why can't we have something like waydro.id for PB? Turns out we can! Let me present you a full-fledged emulator that I've been vibe-coding over the last couple of months:
https://codeberg.org/datyoma/pbemu

All you need is a modern Linux desktop with Wayland, podman, and Python.
The way it works is qemu-arm (user-mode emulation) + LD_PRELOAD to shim all sorts of stuff + framebuffer/sound forwarding via mounted sockets.

Quick start:
* ./pbemu image - builds the Debian-based image with all the development tooling
* ./pbemu install <firmware.zip> - extracts the files downloaded from PB support page
* ./pbemu build <extracted dir> - uses the container to compile the shim & co.
* ./pbemu start <extracted dir> - launches the system and the UI viewer
* ./pbemu stop - stops the container

Firmware unpacking is loosely based on the scripts from this thread: https://www.mobileread.com/forums/sh...d.php?t=314722

The viewer copies framebuffer data to Wayland over the mounted host socket. Mouse/keyboard input is supported, no wheel scrolling though.
Network traffic is forwarded by qemu-arm out of the box, there are stubs to make firmware believe it's connected to Wi-Fi.
Sound is forwarded via mounted PulseAudio/PipeWire socket.

Cloud-related application icons are removed during installation. (I guess you could copy registration data from a real device, if you are adventurous.)

I tested it on various 6.x firmwares, and it works starting from 6.1 onwards more or less reliably now. There had to be a few utterly abhorrent hacks introduced to support 3 variants of hardware event struct layout and different inner workings of NewTaskEx in older firmware.
ARM32 emulation on x86 is quite slow, so the speed is about the same as that of real devices.

At the moment the project is very much in "works on my machine" stage, so your mileage may vary. Any feedback is welcome!

nhedgehog · 05-02-2026, 03:40 AM

Wow, thanks for that. It will take some time for me before I dare to use it, since I'm a Windows user but I was missing actually quite some time.

orontee · 05-09-2026, 03:16 AM

Excellent! I'll definitively have a look to your emulator. Thank you

05-01-2026, 06:36 AM	#1
datyoma Junior Member Posts: 7 Karma: 98538 Join Date: Mar 2026 Location: Berlin Device: PocketBook InkPad 4	pbemu: user-mode emulation for 6.x firmware Hello everyone, Don't know about you, but I find it rather annoying to repeatedly copy files to the real device during development, so I thought, why can't we have something like waydro.id for PB? Turns out we can! Let me present you a full-fledged emulator that I've been vibe-coding over the last couple of months: https://codeberg.org/datyoma/pbemu All you need is a modern Linux desktop with Wayland, podman, and Python. The way it works is qemu-arm (user-mode emulation) + LD_PRELOAD to shim all sorts of stuff + framebuffer/sound forwarding via mounted sockets. Quick start: * ./pbemu image - builds the Debian-based image with all the development tooling * ./pbemu install <firmware.zip> - extracts the files downloaded from PB support page * ./pbemu build <extracted dir> - uses the container to compile the shim & co. * ./pbemu start <extracted dir> - launches the system and the UI viewer * ./pbemu stop - stops the container Firmware unpacking is loosely based on the scripts from this thread: https://www.mobileread.com/forums/sh...d.php?t=314722 The viewer copies framebuffer data to Wayland over the mounted host socket. Mouse/keyboard input is supported, no wheel scrolling though. Network traffic is forwarded by qemu-arm out of the box, there are stubs to make firmware believe it's connected to Wi-Fi. Sound is forwarded via mounted PulseAudio/PipeWire socket. Cloud-related application icons are removed during installation. (I guess you could copy registration data from a real device, if you are adventurous.) I tested it on various 6.x firmwares, and it works starting from 6.1 onwards more or less reliably now. There had to be a few utterly abhorrent hacks introduced to support 3 variants of hardware event struct layout and different inner workings of NewTaskEx in older firmware. ARM32 emulation on x86 is quite slow, so the speed is about the same as that of real devices. At the moment the project is very much in "works on my machine" stage, so your mileage may vary. Any feedback is welcome!

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Kindle firmware emulation?	MK2901	Kindle Developer's Corner	1	05-01-2019 12:37 PM
Regarding the conversion in debug mode of calibre user manual	kevin4fly	Recipes	2	06-10-2015 09:23 AM
Recovery mode for kindle 3? And starting user applications on boot	fivebells	Kindle Developer's Corner	3	12-17-2010 10:08 AM
Table emulation CSS, or...?	Hitch	Sigil	34	09-23-2010 11:59 AM

05-02-2026, 03:40 AM	#2
nhedgehog Guru Posts: 850 Karma: 694086 Join Date: Sep 2013 Device: EnergySistemEreaderPro, Nook STG, Pocketbook 622, Bookeen Cybooks ...	Wow, thanks for that. It will take some time for me before I dare to use it, since I'm a Windows user but I was missing actually quite some time.

05-09-2026, 03:16 AM	#3
orontee Zealot Posts: 104 Karma: 318730 Join Date: Sep 2023 Location: Toulouse, France Device: Vivlio Touch HD Plus, reMarkable Paper Pro	Excellent! I'll definitively have a look to your emulator. Thank you