iLiad Web2iDS for undocumented communication with the iRex Delivery Server

[Alexander Turcic]

I put off posting about this a) because this tool is still incomplete, and b) iRex promised us to open up the specs of the iRex Delivery Server (iDS) protocol. But as time goes by many of us grow impatient with the company's slow development efforts aimed at making the iLiad reader more usable. So perhaps the best way to convince them how desperately we want to help (through gaining access to the SDK and the flashing process!) is by sharing with you what we've found so far about the iDS protocol.

Web2iDS is a PHP script that uses undocumented XML commands to communicate with the iRex Delivery Server (iDS). Although I wrote the script, all credits should go to TadW who did the main work by finding the XML sequences through connection sniffing and trial and error.

While I am not going to explain the tool sources or XML commands in detail right now (c'mon, it's Sunday, don't you think I've anything better to do?), let me say that you'll find the interesting stuff in iLiadBrowser.php, which contains the class responsible for communicating with the iDS. It's a thin wrapper around the procedural interface to cURL provided by PHP. Obviously for it to work, you must have the cURL extension installed.

Enough said, files are attached to this thread.

[TadW]

Some hints:

• When iRex issues a firmware upgrade, you should get its download URL via "Get Software Upgrade"
• When iRex issues a firmware patch, you should get its download URL via "Get content"
• iRex keeps track of what you've already downloaded and successfully installed on your iLiad. So if you are already fully patched with the latest software, you won't see the download URLs (if you use the same email/password combination as for your iLiad and its serial number) - in other words, if you want to go snooping around, next time there is an upgrade, don't upgrade your iLiad before using this tool

[DHer]

That's cool.

I'll try it right now.

Thanks for releasing it.

[masc]

It works. Real good work. Now vise versa, I want to see some open "Project Gutenberg" - iDS Server out threre :-).

[Alexander Turcic]

Originally Posted by masc

It works. Real good work. Now vise versa, I want to see some open "Project Gutenberg" - iDS Server out threre :-).

That would be easy - if we were allowed to change the iDS IP manually in the iLiad settings.

Other than that, your only chance is to spoof the iDS IP and redirect it to your own location. This way, of course, you could also flash the iLiad with your own firmware (which is what most people here would love to do, I think)

[reiky]

Originally Posted by Alexander Turcic

That would be easy - if we were allowed to change the iDS IP manually in the iLiad settings.

Ok, does someone know exactly what response the iLiad is expecting from iDS in order to download some content and put it into, let's say, the news directory? :-)

[arivero]

Originally Posted by Alexander Turcic

That would be easy - if we were allowed to change the iDS IP manually in the iLiad settings.

You can provide a different primary DNS. Or is it number coded?

[reiky]

well, it should be enough to set your router so that ids.irexnet.com resolves to the IP you want.... :-)

[scotty1024]

Originally Posted by Alexander Turcic

That would be easy - if we were allowed to change the iDS IP manually in the iLiad settings.

Other than that, your only chance is to spoof the iDS IP and redirect it to your own location. This way, of course, you could also flash the iLiad with your own firmware (which is what most people here would love to do, I think)

Actually you could provide the answer to that.

If you opened a proxy server of say: http://ids.mobileread.com:8080 we could set that as our proxy in an iLiad "mobileread" profile and you could serve content by having the proxy point ids.irexnet.com to ids.mobileread.com:80.

I'm willing to help set it up.

[scotty1024]

I hadn't seen this anywhere else so I'm putting it up here...

This is the dump from the iLiad client certificate:
Owner: EMAILADDRESS=ca@irextechnologies.com, CN=iRex Technologies BV Cert Authority, O=iRex Technologies BV, L=Eindhoven, ST=Brabant, C=NL
Issuer: EMAILADDRESS=ca@irextechnologies.com, CN=iRex Technologies BV Cert Authority, O=iRex Technologies BV, L=Eindhoven, ST=Brabant, C=NL
Serial number: eda1401cecd3000a
Valid from: Fri Oct 14 07:33:33 PDT 2005 until: Wed Oct 13 07:33:33 PDT 2010
Certificate fingerprints:
MD5: CC:C7:1C:ED:03:0D:60:AF:33:34:6F:0D7:3D:F3:32
SHA1: F8:5D:6E:AE:C6:52:3B:19:0D:5C:ED:96:25F:81:32:EC E:8E:2C

[arivero]

Originally Posted by scotty1024

I wonder why they're using a "self signed" SSL certificate? Well why wonder when it makes our life easier right?

Thwy could change it if they get a big partner interested on strong DRM. If at the end they do not get any, it is absurd to have strong defenses. Besides, a serious DRM could have its own hardware system based in the SDcard or in the CFcard.

[scotty1024]

Several months ago there was a rumor that the iLiad had one of the Philips TPM chips installed. I haven't seen much evidence of that so far...

[arivero]

Originally Posted by scotty1024

Several months ago there was a rumor that the iLiad had one of the Philips TPM chips installed. I haven't seen much evidence of that so far...

Neither me, but we have not documented all the chips in the board. Still, I think that a more useful strategy for vertical or B2B markets is to have a CF-card device on charge of the autentification and decription. The iDS should send an encrypted document and the CF device should do the decription. If they want maximum security (example, to avoid a decrypted document to leak from the /tmp to some user directory) the card based device can work in a by page basis, or to interact with some extra software instead of xpdf or minimo. As someone has noticed, the iLiad display can be scanned, so to try to control the last phase from decryption to display is nonsense.

[scotty1024]

The TPM chips can do flow through encryption/decryption and have a secure onboard key storage module.

http://en.wikipedia.org/wiki/Trusted_Platform_Module

[design256]

Originally Posted by Alexander Turcic

Web2iDS is a PHP script that uses undocumented XML commands to communicate with the iRex Delivery Server (iDS). Although I wrote the script, all credits should go to TadW who did the main work by finding the XML sequences through connection sniffing and trial and error.

Thanks for this great piece of work guys. Here is a very simple perl/LWP script that accesses the IDS server in the same way for those of you that don't have php and want to experiment. It should be called ids.pl, but the forum doesn't like .pl files, so I've called it ids.txt.