KOReader running on BQ/Fnac devices

[Cuikis]

Originally Posted by tx4man

Hello everyone,

I'm not sure if anyone mentioned this before, but the reader's stock web browser has a vulnerability that allows you to write to /mnt/private directly. So there's no need to bother with serial a COM adapter and disassemble your device.

You just need to run your own web server to download the "hackers_e60q22_ok" authorisation marker from the webserver and take advantage of the Content-Disposition header, and the parent directory ("..") descriptor.

So if a regular download from the webserver without setting up this response header would save your file at /mnt/public/file, in this case we would set the header to /../../private/file to esentially write to /mnt/private:

Content-Disposition: attachment; filename="/mnt/public/randomfolder/../../private/hackers_e60q22_ok"

I've published my findings to https://github.com/x4m4n/bq-cervantes3-offline-unlock, if anyone is interested in following this method. There you'll also find a python3 server preconfigured and ready to go for you to take advantage of this flaw. It's honestly very easy and fast.

Thanks you very much, I am going to try this with my BQ Cervantes Fnac Touch light to install Koreader, I hope it works.

[Cuikis]

Originally Posted by tx4man

Hello everyone,

I'm not sure if anyone mentioned this before, but the reader's stock web browser has a vulnerability that allows you to write to /mnt/private directly. So there's no need to bother with serial a COM adapter and disassemble your device.

You just need to run your own web server to download the "hackers_e60q22_ok" authorisation marker from the webserver and take advantage of the Content-Disposition header, and the parent directory ("..") descriptor.

So if a regular download from the webserver without setting up this response header would save your file at /mnt/public/file, in this case we would set the header to /../../private/file to esentially write to /mnt/private:

Content-Disposition: attachment; filename="/mnt/public/randomfolder/../../private/hackers_e60q22_ok"

I've published my findings to https://github.com/x4m4n/bq-cervantes3-offline-unlock, if anyone is interested in following this method. There you'll also find a python3 server preconfigured and ready to go for you to take advantage of this flaw. It's honestly very easy and fast.

I get the bq_download_probe file with the correct message and size. But when I press Write the Cervantes 3 authorization marker, and insert an empty microsd, I don't get the Device already authorised for hackers firmware installation message.

I understand that it should work in a different way as my device is older. Can you tell me how do you know what should be write and where in your version?

Thanks again for all

[tx4man]

Originally Posted by Cuikis

I get the bq_download_probe file with the correct message and size. But when I press Write the Cervantes 3 authorization marker, and insert an empty microsd, I don't get the Device already authorised for hackers firmware installation message.

I understand that it should work in a different way as my device is older. Can you tell me how do you know what should be write and where in your version?

Thanks again for all

Hello!

Can you post your device information? Model and bqOS Version. The cervantes source code is on github (https://github.com/bq/cervantes) so I could perhaps check if there's a specific quirk for your version and help you out.

Cheers!

[Cuikis]

Originally Posted by tx4man

Hello!

Can you post your device information? Model and bqOS Version. The cervantes source code is on github (https://github.com/bq/cervantes) so I could perhaps check if there's a specific quirk for your version and help you out.

Cheers!

Yes, of course. My ebook looks exactly like this one:

https://www.muycomputer.com/2013/01/...s-touch-light/

but instead of "BQ" in the back it is written "fnac" (lowercase).

From basic information option in settings:

Software --> bqOS-5.1.0
Versión interna --> 125181_default_20131217_1125
Versión rootfs --> 236-122334/236-122334/ffcc0c
Versión kernel --> 2.6.35.3-850-gbc67621-bq+

Thanks again for your time

[tx4man]

Originally Posted by Cuikis

Yes, of course. My ebook looks exactly like this one:

https://www.muycomputer.com/2013/01/...s-touch-light/

but instead of "BQ" in the back it is written "fnac" (lowercase).

From basic information option in settings:

Software --> bqOS-5.1.0
Versión interna --> 125181_default_20131217_1125
Versión rootfs --> 236-122334/236-122334/ffcc0c
Versión kernel --> 2.6.35.3-850-gbc67621-bq+

Thanks again for your time

Hello Cuikis!

I think we got it

Apparently for bqOS 5.1.0 on your hardware, the name of the marker changes. The online authorization function doesn't look for /mnt/private/hackers_e60q22_ok, it looks for exactly for the filename hackers_ok.

The name of the marker appears to depend on not only the firmware version but also the model .

So if you pull the latest changes of the python server and run it again with --enable-marker, you should see an additional button to write the hackers_ok. This should authorize your device to install the developer's firmware.

Try it and let me know if it worked!

[Cuikis]

Originally Posted by tx4man

Hello Cuikis!

I think we got it

Apparently for bqOS 5.1.0 on your hardware, the name of the marker changes. The online authorization function doesn't look for /mnt/private/hackers_e60q22_ok, it looks for exactly for the filename hackers_ok.

The name of the marker appears to depend on not only the firmware version but also the model .

So if you pull the latest changes of the python server and run it again with --enable-marker, you should see an additional button to write the hackers_ok. This should authorize your device to install the developer's firmware.

Try it and let me know if it worked!

IT WORKS LIKE A CHARM!!

Thanks you very, very, very, very much, really, I have no words enough to express my gratitude. Sincere and full admiration both for your knowledge and devs skill and also for your altruism. I would really like to be able to unravel the code to create the server.py, to me, you have just done magic.

THANKS AGAIN