PB62x/740: root + sshd, ftpd, smbd, iptables, usbnet (needs testers) - Page 4

random42 · 03-06-2020, 08:27 PM

Quote:

Originally Posted by random42

This is pretty slick. Have a number of things I would like to do with this device as I am a seasoned software dev.

on PB HD3 - U632.5.19.832

Rooting worked, service install worked, but keep getting prompted that the storage may be corrupt. About half the time when I reboot it acts like it just reset back to factory defaults, although root and services a still present.

Update: I un-rooted via uninstall, deleted data, then factory reset and re-rooted. No issues.

rkomar · 03-06-2020, 10:01 PM

If there is an internal SD card, you should probably take it out and back up the contents. It may be failing. It could be that resetting the database and deleting files freed up some space that isn't corrupted yet, allowing the device to continue working for a while.

I could be wrong, but having a copy doesn't hurt.

ezdiy · 03-08-2020, 05:22 AM

The scripts in jailbreak.app and services.app hard-reboot the device by simply running /sbin/reboot. It's possible doing this may corrupt the database on vfat partition if there is a write pending, because the partition is never really unmounted. I'll add running /sbin/sync beforehand in next version, together with some other small fixes (wifi power management is still shoddy...).

Marco77 · 04-22-2020, 07:01 PM

Hi @ezdiy, the beta 6.0 firmware for 740-2 is available at https://www.e-reader-forum.de/t/beta...-3-pro.155193/
Can you see if this jailbreak will still work after upgrade (and what are the failsafe mechanisms to keep root otherwise)?

ezdiy · 05-01-2020, 10:37 PM

@Marco77: Well, that was thrilling. I've just yolo'd it and popped SWUPDATE in, and started update from menu (not via magic buttons). It rebooted 3 times, and then after long being stuck at 80% dropped into the following console screens:

Code:

Apply start
[SHELL] starting shell script ./S01-setup-740.sh
rootfs on / type rootfs (rw)
/dev/root on / type cramfs (ro,relatime)
none on /proc type proc (rw,relatime)
none on /var type tmpfs (rw,relatime,size=98304k)
none on /sys type sysfs (rw,relatime)
/dev/bootfs on /boot type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/user_int on /mnt/ext1 type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=utf8,shortname=mixed,errors=remount-ro)
/dev/ebrmain on /ebrmain type ext2 (rw,relatime,errors=remount-ro)
/dev/loop0 on /ebrmain/cramfs type cramfs (ro,relatime)
/dev/secure on /mnt/secure type ext2 (rw,relatime)
/dev/loop1 on /ebrmain/cramfs type cramfs (ro,relatime)
TARGETS="WW.d ALL.d"
Done start
TARGETS=WW.d ALL.d me=RU.d
Skip RU.d
TARGETS=WW.d ALL.d me=CIS.d
Skip CIS.d
TARGETS=WW.d ALL.d me=WW.d
---- Apply WW.d ------
[SHELL] starting shell script ./S33-install-low_power_logo.sh
[SHELL] starting shell script ./S33-install-offlogo.sh
Install offlogo:
Use PocketBook.bmp
logo @cover_logo validated
In system/config/global.cfg: offlogo=@cover_logo
[SHELL] starting shell script ./S43-install-bootlogo.sh
[SHELL] starting shell script ./S46-low-power-v2.sh
Install lowbatlogo:
install B740_WW_pwr.low_logo.bmp
Use /ebrmain/logo/lowbatlogo/B740_WW_pwr.low_logo.bmp as low power logo after restart
Use /ebrmain/logo/lowbatlogo/B740_WW_pwr.low_logo.bmp as low power logo after restart
Update failedThe device will turn off in few seconds

(you can find it later in swupdate.log in /mnt/ext)

Luckily, after turning the device on it booted up to unresponsive garbled menu. After suspend-resume cycle it started working.
The changelog says "Fixed several minor bugs.", HOWEVER this release introduces major changes from 2019-07 fw. Some screens:

Some observations:
* The device runs newer kernel. Subjectively the device seems faster, but could be just placebo.
* usbnet is broken for some reason (probably some quirk of the new kernel). This is probably fixable, but for the time being you may need to disable it in root menu so as to not break mass storage too. Wifi ssh works fine.
* All standard @Jailbreak/@Services/@Uninstall tools work perfectly ok.

Meaning, If you want to try this, uninstall the jailbreak first. Then copy SWUPDATE.BIN, and start update. After new fw boots, reinstall root. This way we can verify whether my update soft-failed due to jb being present, or it's just a general quirk of this being beta.

bottomline: While playing with unsupported fw (with root on top of that) sounds all pretty risque, sunxi tools CAN boot stage0 of uboot via pure USB-FEL if you brick the device - it can write to RAM, and jump to an address. Not much, but it's a verified route. Unfortunately there's no working profile to chain uboot from it yet. But the moment someone bricks this, we'll be at least motivated to attempt to blind-bootstrap it. No need to run anything fancy, just bare kernel that does raw dd to emmc from a cloned dump.

Marco77 · 05-04-2020, 04:19 PM

Thanks for putting your body on the line

I thought you would extract and have a look, or at most run it in qemu or sth but you went the extra mile!
Those messages are quite scary, hope you didn't break it.

franc · 06-05-2020, 10:38 AM

Hallo
I didnt find the PocketBook Basic 3 in the list of working devices. Could it be working to get root?
I havent got it yet, but will buy it, if I can get it rooted.
Thanks, frank

PS.: my intention of root is to disable or delete the games on the PocketBook Basic 3, should be a simple ebook reader and nothing more (its for a child).

rkomar · 06-05-2020, 02:00 PM

You don't need root to delete the games from the App tab. Just delete the script files for the games in the applications/ directory when you mount the device over USB, and they won't show up with the rest of the applications.

franc · 06-08-2020, 11:38 AM

Quote:

Originally Posted by rkomar

You don't need root to delete the games from the App tab. Just delete the script files for the games in the applications/ directory when you mount the device over USB, and they won't show up with the rest of the applications.

Today the Pocketbook arrived and I did that. Works

Thanks

But back to my question: is root (and ssh over wifi) possible with that device?

rkomar · 06-08-2020, 12:05 PM

All my devices are old, so I don't know much about using @ezdiy's root kit. If it works on your device, it would be the easiest way to get ssh over wifi working. However, if it doesn't, you can install and run ssh without root privileges, as described in this thread: https://www.mobileread.com/forums/sh...d.php?t=159636. It involves more work, and it doesn't seem to work as well with newer firmware versions, so I would only use it as a last resort.

franc · 06-23-2020, 04:12 AM

In the end I did not try to root. All working as it is enough good

Thank!

nomoi · 06-26-2020, 05:35 AM

Thank you so much, ezdiy, for sharing this and the sourcecode. A PB without a root-shell would have rendered it useless for me and disrespected the freedom of the user. I registered solely for this posting resp. the following questions:

I looked into the source but am unable to understand how it does it precisely. Can someone elaborate or give me some hint, (i) why it does work and (ii) how the solution is found in the first place. It's like a mathematical proof at this point but without description what led to it in the first place. =)

Thanks again and a nice day.

PS. Some hints about literature about this topic i'd admire to.

ezdiy · 06-27-2020, 06:10 AM

Nomoi: The bug i chose is deliberately complex one, obscure enough only folks familiar can see what's going on, hopefully ensuring some longevity/not having to babysit much.

This is because whenever the exact details (or the bug is trivial to see/fix) are described it often leads to some "good samaritan" pestering the vendor for a fix. Quotes, because more often than not they have a commercial interest in making loud noises, with complete disregard that they're breaking things for everyone. One such example of this in the past is https://www.synacktiv.com/posts/hard...-reverser.html

Overall I'm all for vendors making root somewhat difficult, so as to scare away inexperienced users who would brick stuff. However a vendor that aggressively locks the device (Apple, Amazon) have clearly other interest than consumer protection in mind.

nomoi · 06-28-2020, 11:50 PM

Quote:

Originally Posted by ezdiy

Nomoi: The bug i chose is deliberately complex one, obscure enough only folks familiar can see what's going on, hopefully ensuring some longevity/not having to babysit much.

My well-meaning curiosity shall then be hushed for the great purpose you intended. =)

Quote:

Originally Posted by ezdiy

This is because whenever the exact details (or the bug is trivial to see/fix) are described it often leads to some "good samaritan" pestering the vendor for a fix. Quotes, because more often than not they have a commercial interest in making loud noises, with complete disregard that they're breaking things for everyone. One such example of this in the past is https://www.synacktiv.com/posts/hard...-reverser.html

Nice read though. Are the authors and the ones that led to that "happy ending" identical?

I assume the hardware option that implies soldering will remain intact. It's sad to force such expenditure to a consumer if this remains our last option. I bought the device , so I shall decide on using it as I want. Moreover I shall have the right to disable the malfunction described in the paragraph on "Analytics". I have to look into it, but this is exactly what I expected and intended to abrogate with jailbreaking.

Quote:

Originally Posted by ezdiy

Overall I'm all for vendors making root somewhat difficult, so as to scare away inexperienced users who would brick stuff. However a vendor that aggressively locks the device (Apple, Amazon) have clearly other interest than consumer protection in mind.

Like mentioned above the reason is unlikely to avoid breaking stuff. The specious argument functions more often to justify prescribing the possibilities and malicious behaviour of the device. The consequence of "device bricked by owner/user" is harmless and uncostly compared to "owner/user (p)owned by company", so to speak..

Thanks again and all the best. =)

HelloWorld · 08-17-2020, 02:55 PM

Hello,

I am having problems using the root script on the pocketbook color PB633.
Using the latest release (v6), the Jailbreak.app device will ask for confirmation. After confirming that I indeed want to permit root access, the script will exit without rebooting. After no change after ~15 minutes, I started Jailbreak.app again, this time not receiving any dialog, instead freezing the device.
Running Jailbreak.app using pbterm, stdout/stderr showed the message [1343 : dialog] (hw_nextevent)mq_receive ret -1 (Resource temporarily unavailable), though I am not sure whether this is relevant.

Hardware and Software details:

Device: PB633 Color

OS Version: U633.6.1.593 - also tried on a previous version.

pbjb version: Release v6

Is the PB633 simply not supported or am I doing something wrong? Thanks in advance.

03-08-2020, 05:22 AM	#48
ezdiy Zealot Posts: 121 Karma: 156515 Join Date: Oct 2019 Device: KT, KPW4, PB740-2	The scripts in jailbreak.app and services.app hard-reboot the device by simply running /sbin/reboot. It's possible doing this may corrupt the database on vfat partition if there is a write pending, because the partition is never really unmounted. I'll add running /sbin/sync beforehand in next version, together with some other small fixes (wifi power management is still shoddy...). Last edited by ezdiy; 03-08-2020 at 05:25 AM.

05-01-2020, 10:37 PM	#50
ezdiy Zealot Posts: 121 Karma: 156515 Join Date: Oct 2019 Device: KT, KPW4, PB740-2	@Marco77: Well, that was thrilling. I've just yolo'd it and popped SWUPDATE in, and started update from menu (not via magic buttons). It rebooted 3 times, and then after long being stuck at 80% dropped into the following console screens: Code: Apply start [SHELL] starting shell script ./S01-setup-740.sh rootfs on / type rootfs (rw) /dev/root on / type cramfs (ro,relatime) none on /proc type proc (rw,relatime) none on /var type tmpfs (rw,relatime,size=98304k) none on /sys type sysfs (rw,relatime) /dev/bootfs on /boot type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro) /dev/user_int on /mnt/ext1 type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=utf8,shortname=mixed,errors=remount-ro) /dev/ebrmain on /ebrmain type ext2 (rw,relatime,errors=remount-ro) /dev/loop0 on /ebrmain/cramfs type cramfs (ro,relatime) /dev/secure on /mnt/secure type ext2 (rw,relatime) /dev/loop1 on /ebrmain/cramfs type cramfs (ro,relatime) TARGETS="WW.d ALL.d" Done start TARGETS=WW.d ALL.d me=RU.d Skip RU.d TARGETS=WW.d ALL.d me=CIS.d Skip CIS.d TARGETS=WW.d ALL.d me=WW.d ---- Apply WW.d ------ [SHELL] starting shell script ./S33-install-low_power_logo.sh [SHELL] starting shell script ./S33-install-offlogo.sh Install offlogo: Use PocketBook.bmp logo @cover_logo validated In system/config/global.cfg: offlogo=@cover_logo [SHELL] starting shell script ./S43-install-bootlogo.sh [SHELL] starting shell script ./S46-low-power-v2.sh Install lowbatlogo: install B740_WW_pwr.low_logo.bmp Use /ebrmain/logo/lowbatlogo/B740_WW_pwr.low_logo.bmp as low power logo after restart Use /ebrmain/logo/lowbatlogo/B740_WW_pwr.low_logo.bmp as low power logo after restart Update failedThe device will turn off in few seconds (you can find it later in swupdate.log in /mnt/ext) Luckily, after turning the device on it booted up to unresponsive garbled menu. After suspend-resume cycle it started working. The changelog says "Fixed several minor bugs.", HOWEVER this release introduces major changes from 2019-07 fw. Some screens: Some observations: * The device runs newer kernel. Subjectively the device seems faster, but could be just placebo. * usbnet is broken for some reason (probably some quirk of the new kernel). This is probably fixable, but for the time being you may need to disable it in root menu so as to not break mass storage too. Wifi ssh works fine. * All standard @Jailbreak/@Services/@Uninstall tools work perfectly ok. Meaning, If you want to try this, uninstall the jailbreak first. Then copy SWUPDATE.BIN, and start update. After new fw boots, reinstall root. This way we can verify whether my update soft-failed due to jb being present, or it's just a general quirk of this being beta. bottomline: While playing with unsupported fw (with root on top of that) sounds all pretty risque, sunxi tools CAN boot stage0 of uboot via pure USB-FEL if you brick the device - it can write to RAM, and jump to an address. Not much, but it's a verified route. Unfortunately there's no working profile to chain uboot from it yet. But the moment someone bricks this, we'll be at least motivated to attempt to blind-bootstrap it. No need to run anything fancy, just bare kernel that does raw dd to emmc from a cloned dump.

06-05-2020, 10:38 AM	#52
franc Connoisseur Posts: 68 Karma: 10 Join Date: Feb 2010 Device: none	Hallo I didnt find the PocketBook Basic 3 in the list of working devices. Could it be working to get root? I havent got it yet, but will buy it, if I can get it rooted. Thanks, frank PS.: my intention of root is to disable or delete the games on the PocketBook Basic 3, should be a simple ebook reader and nothing more (its for a child). Last edited by franc; 06-05-2020 at 10:45 AM.

06-26-2020, 05:35 AM	#57
nomoi Junior Member Posts: 8 Karma: 12 Join Date: Jun 2020 Device: pb627	jailbreak Thank you so much, ezdiy, for sharing this and the sourcecode. A PB without a root-shell would have rendered it useless for me and disrespected the freedom of the user. I registered solely for this posting resp. the following questions: I looked into the source but am unable to understand how it does it precisely. Can someone elaborate or give me some hint, (i) why it does work and (ii) how the solution is found in the first place. It's like a mathematical proof at this point but without description what led to it in the first place. =) Thanks again and a nice day. PS. Some hints about literature about this topic i'd admire to. Last edited by nomoi; 06-26-2020 at 05:38 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Paperwhite 2 usbnet asks for root password	cokolokolo	Kindle Developer's Corner	2	09-07-2014 04:51 PM
/etc/sysconfig/iptables from 3.0.1	wahlis	Amazon Kindle	1	08-14-2011 10:10 AM
iLiad Samba/smbd/shared folder access to iLiad	ajnorth	iRex Developer's Corner	12	02-29-2008 09:02 AM

03-06-2020, 10:01 PM	#47
rkomar Wizard Posts: 2,985 Karma: 18343081 Join Date: Oct 2010 Location: Sudbury, ON, Canada Device: PRS-505, PB 902, PRS-T1, PB 623, PB 840, PB 633	If there is an internal SD card, you should probably take it out and back up the contents. It may be failing. It could be that resetting the database and deleting files freed up some space that isn't corrupted yet, allowing the device to continue working for a while. I could be wrong, but having a copy doesn't hurt.

04-22-2020, 07:01 PM	#49
Marco77 Connoisseur Posts: 55 Karma: 8430 Join Date: Mar 2016 Device: PW3, Clara HD, PB740	Hi @ezdiy, the beta 6.0 firmware for 740-2 is available at https://www.e-reader-forum.de/t/beta...-3-pro.155193/ Can you see if this jailbreak will still work after upgrade (and what are the failsafe mechanisms to keep root otherwise)?

05-04-2020, 04:19 PM	#51
Marco77 Connoisseur Posts: 55 Karma: 8430 Join Date: Mar 2016 Device: PW3, Clara HD, PB740	Thanks for putting your body on the line I thought you would extract and have a look, or at most run it in qemu or sth but you went the extra mile! Those messages are quite scary, hope you didn't break it.

06-05-2020, 02:00 PM	#53
rkomar Wizard Posts: 2,985 Karma: 18343081 Join Date: Oct 2010 Location: Sudbury, ON, Canada Device: PRS-505, PB 902, PRS-T1, PB 623, PB 840, PB 633	You don't need root to delete the games from the App tab. Just delete the script files for the games in the applications/ directory when you mount the device over USB, and they won't show up with the rest of the applications.

06-08-2020, 12:05 PM	#55
rkomar Wizard Posts: 2,985 Karma: 18343081 Join Date: Oct 2010 Location: Sudbury, ON, Canada Device: PRS-505, PB 902, PRS-T1, PB 623, PB 840, PB 633	All my devices are old, so I don't know much about using @ezdiy's root kit. If it works on your device, it would be the easiest way to get ssh over wifi working. However, if it doesn't, you can install and run ssh without root privileges, as described in this thread: https://www.mobileread.com/forums/sh...d.php?t=159636. It involves more work, and it doesn't seem to work as well with newer firmware versions, so I would only use it as a last resort.

06-23-2020, 04:12 AM	#56
franc Connoisseur Posts: 68 Karma: 10 Join Date: Feb 2010 Device: none	In the end I did not try to root. All working as it is enough good Thank!

06-27-2020, 06:10 AM	#58
ezdiy Zealot Posts: 121 Karma: 156515 Join Date: Oct 2019 Device: KT, KPW4, PB740-2	Nomoi: The bug i chose is deliberately complex one, obscure enough only folks familiar can see what's going on, hopefully ensuring some longevity/not having to babysit much. This is because whenever the exact details (or the bug is trivial to see/fix) are described it often leads to some "good samaritan" pestering the vendor for a fix. Quotes, because more often than not they have a commercial interest in making loud noises, with complete disregard that they're breaking things for everyone. One such example of this in the past is https://www.synacktiv.com/posts/hard...-reverser.html Overall I'm all for vendors making root somewhat difficult, so as to scare away inexperienced users who would brick stuff. However a vendor that aggressively locks the device (Apple, Amazon) have clearly other interest than consumer protection in mind.

08-17-2020, 02:55 PM	#60
HelloWorld Junior Member Posts: 3 Karma: 10 Join Date: Aug 2020 Device: Pocketbook Color	Hello, I am having problems using the root script on the pocketbook color PB633. Using the latest release (v6), the Jailbreak.app device will ask for confirmation. After confirming that I indeed want to permit root access, the script will exit without rebooting. After no change after ~15 minutes, I started Jailbreak.app again, this time not receiving any dialog, instead freezing the device. Running Jailbreak.app using pbterm, stdout/stderr showed the message [1343 : dialog] (hw_nextevent)mq_receive ret -1 (Resource temporarily unavailable), though I am not sure whether this is relevant. Hardware and Software details: Device: PB633 Color OS Version: U633.6.1.593 - also tried on a previous version. pbjb version: Release v6 Is the PB633 simply not supported or am I doing something wrong? Thanks in advance.

Advert

Advert