KOReader running on BQ/Fnac devices

[old]

Hi, first of all I'd like to say thanks, I've been using KOReader on my BQ Cervantes 4 since I bought it and I've been very happy with it!
I recently tried to install some packages on the device (wireguard so I can connect to my home server), and I think I may have broken the base system. When running 'apt -f install' I seem to have accidentally removed a few packages, including telnet.
Is there any way anyone can send a list of packages for the device so I can find them online to reinstall, or would it be better to reinstall the developers firmware?
Just to be clear, I have previously installed the developers firmware.

Thanks again

[Frenzie]

Can you reinstall them using apt-get in the terminal emulator (under more tools in KOReader)?

[old]

I tried that, but it couldn't find the sources.
I then found the apt history and a list of packages I removed, found the correct versions online and downloaded them, but then started running out of space on the device when trying to install.
I tried to upgrade the packages previously which may have used up the extra space

[p29]

Originally Posted by pazos

Unlock

By default the device is locked (no shell access, no external booting, store, adobe drm) and firmware updates need to be signed with BQ private key.

BQ provides instructions to install a Developers edition firmware on https://blog.bq.com/es/bq-ereaders-developers-program/.

Note 1: Bq pages went down, probably forever. Please use http://web.archive.org/web/202007200...opers-program/ instead.

Note 2: In february 2021 firmware files hosted on amazon cloud are no longer available

Send me a private message and I can pass you a link to the file. Only available for Cervantes 2013, Cervantes 3 and Cervantes 4.

You need to install Developers edition firmware to be able to install KOReader or other software. This means you'll lose the nubico store and adobe drm support.

I would love having the software to my PM, please, if you still have it there

[pazos]

Originally Posted by p29

I would love having the software to my PM, please, if you still have it there

I think new users don't have PM enabled.

Anyways, here is it: https://fs.pazos.eu/share/4AnLHvai

Link is valid for 10 days

[DNSB]

Originally Posted by pazos

I think new users don't have PM enabled.

Going by my experience with Kobo images, about 85% of new users have PMs enabled. The remainder will autoenable after 8-12 posts. As to how MobileRead makes that decision? No one seems to know.

[Darthagnon]

Can anyone please reupload the developer firmware for Cervantes3, Cervantes4, and Cervantes2013? All the previous links are 404, and I have tried reaching out to Pazos a few times without success.

EDIT: I managed to download a bunch of files from Archive.org linked by Pazos, and have mirrored them here for your convenience:

https://archive.org/details/bq-fnac-...s-dev-firmware

However, from reading around, it sounds like unlocking Fnac/BQ Cervantes devices with the dev firmware might no longer be possible due to some unlock server going down?

[Tirwal]

Originally Posted by Darthagnon

Can anyone please reupload the developer firmware for Cervantes3, Cervantes4, and Cervantes2013? All the previous links are 404, and I have tried reaching out to Pazos a few times without success.

EDIT: I managed to download a bunch of files from Archive.org linked by Pazos, and have mirrored them here for your convenience:

https://archive.org/details/bq-fnac-...s-dev-firmware

However, from reading around, it sounds like unlocking Fnac/BQ Cervantes devices with the dev firmware might no longer be possible due to some unlock server going down?

Hi:

I uploaded a video to YouTube that explains howto install developers firmware today. Here is the link:

https://www.youtube.com/watch?v=69dfu1znsJc

Cheers

[juceda]

For anyone who still has a working BQ Cervantes 4 device, or similar, with the stock firmware and wants to unlock it to install the "hackers firmware" without having to open it and solder wires, please contact me

[iluuuk]

Hi juceda,

I created a fake BQ servers, but I'm stuck: I can't figure out what is the response from the fake BQ servers that will make my bq cervantes 4 go on with the firmware installation process... I capture the outgoing call from the device (GET /api/v2/nubico/ca/device/reader/SN-Vxxxxx/hackersInstallation?nonce=xxxxx), but I haven't figured out what I need to reply for the install process to continue. Have you?

Originally Posted by juceda

For anyone who still has a working BQ Cervantes 4 device, or similar, with the stock firmware and wants to unlock it to install the "hackers firmware" without having to open it and solder wires, please contact me

[lanrenrji]

Originally Posted by pazos

Unlock

By default the device is locked (no shell access, no external booting, store, adobe drm) and firmware updates need to be signed with BQ private key.

BQ provides instructions to install a Developers edition firmware on https://blog.bq.com/es/bq-ereaders-developers-program/.

Note 1: Bq pages went down, probably forever. Please use http://web.archive.org/web/202007200...opers-program/ instead.

Note 2: In february 2021 firmware files hosted on amazon cloud are no longer available

Send me a private message and I can pass you a link to the file. Only available for Cervantes 2013, Cervantes 3 and Cervantes 4.

You need to install Developers edition firmware to be able to install KOReader or other software. This means you'll lose the nubico store and adobe drm support.

I would love having the software to my PM, please, if you still have it there，thank you

[sony111111]

Originally Posted by pazos

First time Installation instructions

You'll need a sdcard.

1. Install Developers firmware and enable telnet
2. Download KOReader dependencies attached in this post
3. Download KOReader from github
4. Copy KOReader and dependencies to the sd card
5. Insert the SD card on your ereader and start a telnet connection.
6. Uncompress/install KOReader and KOReader dependencies:
   
   

   mv /mnt/sd/ko* /mnt/private
   cd /mnt/private
   tar -xvf ko*.tar.gz
   dpkg -i *.deb
   unzip koreader-cervantes*.zip

Congratulations, You are ready to start KOReader

You can run KOReader from telnet with

/mnt/private/koreader/koreader.sh

. This will stop the stock ereader while KOReader is running and return to it when KOReader exits.

If you are happy with KOReader and want to use it at boot you need to do;

cp /etc/rc.local /etc/rc.local.backup
cp /mnt/private/koreader/koreader-standalone.sh /etc/rc.local

.

Note: ko-deps.tar.gz contains generic prerequisites. ko-deps-safemode-latest.tar.gz contains the latest version of the safemode tool, and is only required if you want to enable USB Mass Storage support under KOReader

Hi pazos,

First of all, thank you for all the work you’ve done on the BQ Cervantes

I’m looking for the Developer Edition firmware for the BQ Cervantes 2013 (Q22). Do you still have a copy that you could share? I believe the file was called restore-5.0.2(q22).tar.gz, but I haven’t been able to find this specific version anywhere

As part of this project, I’ve been reverse-engineering the communication between the Cervantes and the now-defunct BQ servers. I’ve built a small local Python server that emulates part of the original BQ API, and the reader successfully connects and sends the expected requests to it

At this point, the missing piece is the Q22 Developer firmware. If you still have it, it would allow me to continue testing the Developer Edition and eventually install KOReader.

Thanks a lot

[Cuikis]

Originally Posted by juceda

For anyone who still has a working BQ Cervantes 4 device, or similar, with the stock firmware and wants to unlock it to install the "hackers firmware" without having to open it and solder wires, please contact me

Hi, juceda. I have a Fnac Light Touch (think it is the first one, the heaviest) and from the web related by pazos

https://web.archive.org/web/20200720...opers-program/

I have download the firmware developers installation package. But, obviously, I have been unable to install de firmware because the BQ servers are down. Can you help me?

Thanks a lot.

PS: I've tried to send you a PM but it seems disabled for new users, sorry.

[tx4man]

Hello everyone,

I'm not sure if anyone mentioned this before, but the reader's stock web browser has a vulnerability that allows you to write to /mnt/private directly. So there's no need to bother with serial a COM adapter and disassemble your device.

You just need to run your own web server to download the "hackers_e60q22_ok" authorisation marker from the webserver and take advantage of the Content-Disposition header, and the parent directory ("..") descriptor.

So if a regular download from the webserver without setting up this response header would save your file at /mnt/public/file, in this case we would set the header to /../../private/file to esentially write to /mnt/private:

Content-Disposition: attachment; filename="/mnt/public/randomfolder/../../private/hackers_e60q22_ok"

I've published my findings to https://github.com/x4m4n/bq-cervantes3-offline-unlock, if anyone is interested in following this method. There you'll also find a python3 server preconfigured and ready to go for you to take advantage of this flaw. It's honestly very easy and fast.

[latepaul]

Thanks so much for this!

It worked with my BQ Cervantes 4, which used to be one of my favourite devices when it was running Koreader. I won't bore you with the full story but a few years ago I planned to do an uninstall/re-install hoping it would fix a minor issue, only to discover BQ and their website had gone away. Never quite brave enough to go the hardware route (I tend to break things). This is perfect.

Thanks again.