(semi)automatic dump of Kobo firmware on a SD card

[frafra]

Hi all!
I've just bought a Kobo Aura HD and I'm trying to dump internal microsd without using another memory.

This is my script:

#!/bin/sh

insmod /drivers/ntx508/wifi/sdio_wifi_pwr.ko
insmod /drivers/ntx508/wifi/dhd.ko sleep 2
ifconfig eth0 up
wlarm_le -i eth0 up
wpa_supplicant -s -i eth0 -c /etc/wpa_supplicant/wpa_supplicant.conf -C /var/run/wpa_supplicant -B sleep 2
udhcpc -S -i eth0 -s /etc/udhcpc.d/default.script -t15 -T10 -A3 -f -q

mount 2>&1 | nc 192.168.1.5 2223

mount -o ro,remount / 2>&1 | nc 192.168.1.5 2223
mount -o ro,remount /mnt/onboard 2>&1 | nc 192.168.1.5 2223

# On the other side: $ nc -l 2222 > dump.img.xz
(dd if=/dev/mmcblk0 bs=8M | xz | nc 192.168.1.5 2222) 2>&1 | nc 192.168.1.5 2223

# restore mounted devices as expected
mount -o rw,remount / 2>&1 | nc 192.168.1.5 2223
mount -o rw,remount /mnt/onboard 2>&1 | nc 192.168.1.5 2223

Obviously 192.168.1.5 is my pc local ip address, and I've two nc processes that are listening for data.

The first part is taken from https://bitbucket.org/david_weese/ko...7261?at=master (I'm not sure if wifi connection works while updating) while the rest is taken from this discussion.

The strange think is that... Nothing happens! It just reboot itself, nothing more. As you can see, I'm using nc in order to try to understand what's happening and to save my dump, but no data is sent. Is there a better way to have some kind of feedback, like text on screen while updating?

Another question for you: why do you copy the code from upgrade-wifi.sh provided with the firmware? It doesn't seem to do anything useful because there's no real upgrade.

[frafra]

Other code work flawlessly. I suppose that during updates network is down and I've not found yet how to bring it up. Any suggestion?

By the way, I also tried to add this test code at the end of rcS:

usleep 10000000
echo "wow" | /usr/bin/nc 192.168.1.5 2223
usleep 10000000
/usr/bin/wget http://192.168.1.5:2223/wow -T 1 -t 1 > /dev/null

No network signal from Kobo by the way, even if everything is up, including wifi (note: this code is placed after nickel and dhcpcd, just at the end of rcS).

I also tried to run this code in background before nickel stars, without success. Kobo web browser can access to 192.168.1.5 (my pc local ip), so it's not a network problem.

What it could be?

[frafra]

Ok! I was able to dump the entire internal microsd without open my Kobo and without using an external microsd

I figured out that my Kobo wasn't connected even if wifi was up, so I changed rcS in order to wait for network and creating a reverse shell.

This is the code I've added at the end of rcS:

(code=1;
while [ $code -ne 0 ]; do
usleep 10000000;
echo "# Hello world!" | nc 192.168.1.5 2223;
code=$?;
done;
nc 192.168.1.5 2223 -e /bin/sh
) &

...where 192.168.1.5 is my pc address where I run netcat like this:

nc -klp 2223

When Kobo update is finished, you can turn off wifi and start the browser, so the network goes up and I can start send command from my computer (xz is for compression). Keep in mind that I'm using a GNU/Linux box

nc -lp 2222 | xz > dump.img.xz

Then, on the previous nc instance (where I have my Kobo reverse shell) I launched:

pkill nickel
mount -o ro,remount /mnt/onboard
mount -o ro,remount /
dd if=/dev/mmcblk0 bs=8M | nc 192.168.1.5 2222
mount -o rw,remount /
mount -o rw,remount /mnt/onboard
/usr/local/Kobo/nickel -platform kobo -skipFontLoad &

While dd is running, you can look your dump growing with:

watch du -h dump.img.xz

It will take a while, about ~15 minutes. My dump.img.xz for Kobo Aura HD (almost new) is ~800 MB.

Possible improvements:

• Don't touch rcS, put code under update-wifi.sh (it requires starting network with some commands)
• Send compressed image, reducing network stress (xz -c maybe)

[silver217]

Does this work with the Kobo Aura with 3.8.0 ?
I used a micro-SD card 8 gig and FAT32 formatted, but no Dump folder
and back within a minute.

[swamp thing]

Originally Posted by met67

....
if [ -e /mnt/sd/KoboDump ]; then
# mount / as readonly and unmount internal FAT
mount -o remount,noatime,nodiratime,ro /dev/mmcblk0p1 /
umount /mnt/onboard
....

[/CODE]

Why do we need to unmount the internal partition here?



Thanks,
ST

[jncrft]

I just bought a Kobo Glo with version 3.13. Will this work on it? I don't want to brick my device. Thanks in advance.

Jonathan

[PeterT]

Why bother? It's just as easy to get a known good image on the forums here (davidfor tends to be the main person acting as a image manager) and then write it to the SD card IF required.

[frostschutz]

@jncrft:

If you don't mind opening the device, my "Magic Memory Upgrade Mod" can create bootable sdcard clones directly using the Kobo's internal SD card slot.

Or if you have an ext. sd card slot, the external variant of Magic Memory Upgrade creates the clone to the external card, and you don't have to open the device until you actually intend to replace the internal card.

Without opening device and without external sdcard slot you're left with the wifi method a few posts above yours. You can do this by installing telnet, or you can install my WebPortal mod and then download /dev/mmcblk0 through WebPortal's FileManager.

Originally Posted by PeterT

Why bother?

If you backup your own card it will also contain your installed firmware modifications, books, database, reading progress... and you get to keep your serial number

[PeterT]

You can keep ypur own S/N with the restored image too.

[Sinseman]

Hi,
does anyone have a Kobo Aura backup (non-hd) ?
I broke my kobo and I have no backup...

Thanks

[runapp]

Originally Posted by frafra

Hi all!
I've just bought a Kobo Aura HD and I'm trying to dump internal microsd without using another memory.

This is my script:


Obviously 192.168.1.5 is my pc local ip address, and I've two nc processes that are listening for data.

The first part is taken from https://bitbucket.org/david_weese/ko...7261?at=master (I'm not sure if wifi connection works while updating) while the rest is taken from this discussion.

The strange think is that... Nothing happens! It just reboot itself, nothing more. As you can see, I'm using nc in order to try to understand what's happening and to save my dump, but no data is sent. Is there a better way to have some kind of feedback, like text on screen while updating?

Another question for you: why do you copy the code from upgrade-wifi.sh provided with the firmware? It doesn't seem to do anything useful because there's no real upgrade.

Thanks for your script! I've modified it a little to make it run more conveniently.

Add to rcS:

(code=1;
while true ; do
while [ $code -ne 0 ]; do
usleep 10000000;
echo "# Hello world!" | nc 192.168.1.5 2223;
code=$?;
echo $code
done;
usleep 5000000;
nc 192.168.1.5 2223 -e /bin/sh
done;
) &

If you are using gnu-netcat (I encounter this cause I can't get netcat-traditional easyly), use this:

nc -ltp 2223

And when the Hello world message came, you have 5 seconds to rerun nc! Fair enough I think...

Once connected (run ls for sure), run this to wait for image data:

nc -ltp 2224 > backup.img.lzo

For Kobo Aura One, simply kill nickle will result the device to reboot after several seconds. Maybe Kobo is doing this to prevent from frozen system or so. So... we can just kill the daemon:

sh 2>&1 # To get stderr easily
ps
#Now find PID of hindenburg,nickel,{sickel-launcher},sickel,{fickel-launcher},fickel.
#I killed all of those 6 processes.
#PID is the number in the first column
#run for i in #pids you found here seperated by space#; do kill $i; done, for eg
for i in 100 102 200 202 300 302; do kill $i; done
ps #ensure those six procs has gone!
mount -o remount,ro /mnt/onboard
mount -o remount,ro /
mount #ensure /dev/root and /dev/mmcblk0p3 is mounted readonly!
dd if=/dev/mmcblk0 bs=1M | lzop -1cf | nc 192.168.1.5 2224

Now wait for dd's report:

7456+0 records in
7456+0 records out
7818182656 bytes (7.3GB) copied, 599.670308 seconds, 12.4MB/s

I'll choose to reboot though, or use frafra's method to restart nickel as well as sickel and fickel (What things are you two??? And such bad names...).

Now enjoy your image!

[Elaxon]

The script seems broken for me on H20 Aura with the latest firmware 4.7. I am not sure what edits I would have to do. But upgrade was deleted and the script ran but it instantly went back to Nickel after reboot.

[Atilla]

Originally Posted by PeterT

You can keep ypur own S/N with the restored image too.

Hi Peter, is keeping the original serial number a given or a special procedure is needed after using the image.

Thanks

[davidfor]

Originally Posted by Atilla

Hi Peter, is keeping the original serial number a given or a special procedure is needed after using the image.

With the method outlined in the first post, the serial number will be kept. If you get an image from elsewhere, it will either have the serial number that was on the device the image came from, or it will have been modified to something else. For these images, you have to update the image with your own serial number.

[cramoisi]

There is also this alternative (for those who want to make a working backup) https://www.mobileread.com/forums/sh...d.php?t=261578 it was done in 2015 still works great two months ago when I used it.