Kobo Vox Hacking Progress

[Difflugia]

I managed to root my Vox with the June firmware without opening the case. It's actually easier to just open the case and make changes to the internal card, which is what I did the first time, but I decided to figure this out after it factory reset on me and removed my root.

Here are the important bits:

• The factory reset file, recovery_backup_signed.zip, is in fact, not signed.
• The factory reset firmware version is vulnerable to Gingerbreak
• The same version of firmware downloaded from Kobo appears to give ADB root access, anyway
• The initial firmware version check is vulnerable to spoofing
• A factory reset can be forced by causing five failed boots in a row

First, the Vox retrieves the firmwares in 1MB chunks from http://download.kobobooks.com/vox/images/<build id>/xnnn where nnn is a three-digit number from 000 to the highest chunk (166, in the case of the June firmware). So the first chunk of the current firmware is at http://download.kobobooks.com/vox/im...04.161216/x000 and the last one is at x166.

When you have them all downloaded, they can be concatenated into a signed update.zip that can be sideloaded.

For the moment, a firmware from November, 2011 can be retrieved from http://download.kobobooks.com/vox/im...539.40022/x000 through x122. This firmware can be sideloaded as well and seems to allow root access with ADB, so you probably won't even need Gingerbreak. If you plan on downloading this, I'd recommend doing it soon. People from Kobo read this forum and I wouldn't expect it to remain available for too long.

The setup and firmware update apps check the version by retrieving http://download.kobobooks.com/vox/im...ackageinfo.txt. If you can cause the setup app to retrieve a file with the same version as what's running, it won't force the download.

Reverting to an older firmware by sideloading (putting "update.zip" on a memory card and powering on the Vox) causes the book animation to keep looping rather than completing the boot. This appears intentional. I've found that to go to an older version, you have to force a factory reset and then insert the memory card with the update before the reset completes. It will do the factory reset and then immediately do the update from the memory card.

Here's a brief rundown of the steps I took:

Set up a wireless access point with a web server that serves a modified packageinfo.txt. Recent versions of Windows make this (relatively) easy. I downloaded Apache and set it up with vox/images/packageinfo.txt in htdocs. Change the version in packageinfo.txt to eng.CAN.20111117.182539.40022 and start the web server. Then I added an entry to Windows\system32\drivers\etc\hosts to point download.kobobooks.com to my computer's IP address. Follow the directions here to create a virtual access point.

Put the update.zip for the old firmware on a memory card (but don't put it into your Vox yet). Force a factory reset by aborting the boot five times: turn on your Vox and when the book-flipping animation starts (accompanied by the terrible boot audio), hold down the power button until the power flips off. Repeat. On the sixth boot, you'll get the "something's wrong" message and it will start the update. Put the memory card in now. Let it complete both updates.

When the Vox reboots, go through the "get started" bit, selecting your virtual AP. If the hosts file and web server are set up correctly, the Vox should check the version and immediately go to setting up your Kobo account. After doing that, turn on USB debug access in "Manage Applications".

To get your new factory update, take the recent firmware update.zip and unzip it. Use Linux to mount system.img read/write as ext4. Download "su" and "Superuser.apk" from here. Put "su" in bin and do a "chmod u+s su". Put Superuser.apk in app. While you're at it, you might want to remove some of the bloatware, but be careful about chopping too much (I had to do this a few times because I got overzealous). Unmount the image and then zip the update directory back up. This will be your recovery file. Copy it to your memory card as recovery_backup_signed.zip.

Connect the USB cable and run an ADB shell. You should see the "#" prompt, but if you don't for some reason, you can run Gingerbreak. Create a directory to mount the recovery partition. I made one at /data/temp. "mount -t ext4 /dev/block/mmcblk0p2 /data/temp"

cd /data/temp
rm recovery_backup_signed.zip
cat /mnt/extsd/recovery_backup_signed.zip > ./recovery_backup_signed.zip
cd /
umount /data/temp
rmdir /data/temp

If the update.zip file is still on the memory card, either delete or rename it.

Now exit the shell. Power down the Vox, force the factory reset again and let it complete. After going through the startup process again, you should have the superuser app listed in your apps. Furthermore, from here on out, any factory reset should put you back here.

As a final caveat, if you screw up too badly, you may still have to remove the internal card and restore your backup. You made a backup first, right? You could also skip most of the above by opening your vox and just putting the new recovery image in the recovery partition on the memory card, knowing that you'll only have to open it once.

[Difflugia]

Well, the combination of su and Superuser.apk isn't working correctly at the moment (it's hanging), so I did something wrong when I installed it. I guess double-check my installation description if you use it. I think I'm taking a short break from watching my Vox reset, though, and using it to read some books.

EDIT: OK, I just sat down to try and figure out what was wrong and root appears to be working as intended. Maybe I just needed to reboot or something. Or maybe I just needed my caffeine to kick in.

[SteveCampsOut]

What kind of files are those at download.kobobooks.com? My browser wants to save them as text files. Has the Kobo VOX 7 really been successfully r ooted?

[Difflugia]

Originally Posted by SteveCampsOut

What kind of files are those at download.kobobooks.com? My browser wants to save them as text files. Has the Kobo VOX 7 really been successfully rooted?

They're 1MB pieces of a large binary (ZIP file). I used "wget" to script the downloading (I used Linux to do it, but there's a Win32 version as well).

wget -c "http://download.kobobooks.com/vox/images/eng.CAN.20120604.161216/x000"
wget -c "http://download.kobobooks.com/vox/images/eng.CAN.20120604.161216/x001"
wget -c "http://download.kobobooks.com/vox/images/eng.CAN.20120604.161216/x002"
   .
   .
   .
wget -c "http://download.kobobooks.com/vox/images/eng.CAN.20120604.161216/x165"
wget -c "http://download.kobobooks.com/vox/images/eng.CAN.20120604.161216/x166"

If you then concatenate the files together, you'll have a signed ZIP file of the firmware. You can verify that it correctly downloaded by unzipping it.

I rooted a 7" Vox using the process in the prior post. The trickiest part for me was setting up the "man-in-the-middle" webserver, but you also need to be able to mount the filesystem image to create the rooted image that you push back to the Vox.

[mightyzazz]

Hi Everyone, Apologies in advance if I am posting this incorrectly or have gotten the wrong thread. I am a 45 year old of limited intelligence with two (10yr old) children, each of whom have a Kobo Vox. Today is August 26th 2013, and I understand now that this is important (having previously downloaded Gingerbreads and something beginning with Z, to no avail), as updates invalidate previous fixes. Could somebody please point me in the right direction, to root their devices? Many Thanks. Rob.

[Difflugia]

Originally Posted by mightyzazz

Hi Everyone, Apologies in advance if I am posting this incorrectly or have gotten the wrong thread. I am a 45 year old of limited intelligence with two (10yr old) children, each of whom have a Kobo Vox. Today is August 26th 2013, and I understand now that this is important (having previously downloaded Gingerbreads and something beginning with Z, to no avail), as updates invalidate previous fixes. Could somebody please point me in the right direction, to root their devices? Many Thanks. Rob.

There isn't a "one-click" way to do it and probably there won't be. The easiest way to do it is to take the back off the Vox, remove the internal SD Card, make changes to the filesystem and put it all back together again. This requires enough knowledge of Linux filesystems to be able to mount and copy files to different partitions of the SD Card. Since this involves a real risk of damaging your Vox and I'm assuming that "limited intelligence" actually means "limited knowledge of computer hardware", I'd suggest that it might not be worth doing in your case (especially since the last Vox update included Google Play).

If you want to try, though, I'll help if I can.

[mightyzazz]

Thank-you Difflugia for your kind offer. Sorry for the delay in replying, but you have given me much to consider (If it were my own Kobo, I would immediately risk it and rise to the challenge, but it was a present for my son). What would decide it for me would be to have an idea of how much better a rooted device would perform. At present, it seems to take a long time to boot up (probably in part to the amount of apps on it, and having the wifi switched on so that it feels obliged to update everythng on start-up). Would it be significantly quicker, and would it run quicker, if rooted? Finally, what would I need (a new SD card? - whats specs/speed/capacity etc.)
Thanks, Roberto.

[Difflugia]

Originally Posted by mightyzazz

Thank-you Difflugia for your kind offer. Sorry for the delay in replying, but you have given me much to consider (If it were my own Kobo, I would immediately risk it and rise to the challenge, but it was a present for my son). What would decide it for me would be to have an idea of how much better a rooted device would perform. At present, it seems to take a long time to boot up (probably in part to the amount of apps on it, and having the wifi switched on so that it feels obliged to update everythng on start-up). Would it be significantly quicker, and would it run quicker, if rooted? Finally, what would I need (a new SD card? - whats specs/speed/capacity etc.)
Thanks, Roberto.

Unfortunately, the long boot time is just a feature of the Vox. Equally unfortunate is that the stock internal card (8GB SanDisk class 4) is probably optimum for speed. Higher speed cards (class 6, class 10) tend to be optimized for read/write of larger files and are good for secondary storage, but are actually slower when the OS is running from them. You could upgrade to a 16GB or 32GB class 4 SanDisk card, though.

The biggest problem with running speed on the Vox is just that the processor is a little slow and outdated (800MHz compared to the 1.3GHz dual-core in the NOOK HD, for example). The Kobo software itself is kind of a dog, too. There's a little bit of bloatware that can be removed, but the speed improvement was much less than I'd hoped (and some of what I thought was "bloatware" turned out to be needed). The Vox's Android build seems a little glitchy as well and I've noticed odd screen artifacts on a few games (Bad Piggies, for example).

The two things that ultimately improved speed didn't actually require rooting. First, I removed all the widgets (particularly the one that shows your library and suggestions) from the launcher screen. I also switched launchers (to GO Launcher Ex, but there are others; search Google Play for "launcher"), but I don't think that affected speed.

The second speed enhancement was just switching to Mantano Reader Lite. I find that it performs much better than the Kobo software does and nearly all Kobo books can be downloaded in EPUB format using Adobe Digital Editions and transferred to Mantano Reader. Mantano also has the benefit of allowing you to keep files on the secondary card if you like, so the 8GB internal card isn't as big of a limitation. As an aside and if you don't already, you may want to consider using Calibre on your PC along with Apprentice Alf's tools to maintain your library. Lots of Calibre information is available on Mobileread and Googling for "Apprentice Alf" should get you to the tools.

Here are the main reasons/benefits I've found for rooting the Vox:

• Because I'm a hardware nerd and enjoy that sort of thing
• I switched the sdcard directory (where the apps store most of their data) from the internal to the external card
• I use Titanium Backup to maintain backups of my Android devices and it requires root for some of its functions

[Midnighthyperion]

Difflugi, I have access to Linux mint, would you please give me instructions on how to rot my vox. Could you upload all the files that I would need to push onto the vox's SD card. I'm guessing you would need to push the files through terminal? Please tell me at the the commands I need to insert. I loved your previous way of rooting. I would really appreciate it if you could simply teach me how to push the necessary rooting files onto the vox. I can open it up and take out the SD card. I have done it many times. I will connect it to the computer and await your instructions. Thanks a lot

[Midnighthyperion]

So can this be rooted through linux mint?

[Difflugia]

Originally Posted by Midnighthyperion

hi I'm sorry for posting again but I'm replying to your post in hopes of you being notified through your account. Could you read my previous post? Thanks for your time

I saw the post, but the question you asked would have taken a little longer than the few Mobileread minutes I have during weekdays to post an adequate response. Your request is kind of like, "I'm standing at my stove with eggs, now tell me how to make Eggs Benedict."

OK, I'm assuming at this point that you are looking at a Linux screen on a computer and have the SD Card out of your Vox and in a USB card reader.

For the following procedure, you need to be the user "root" on your Linux computer. That means that you'll be giving yourself the ability to erase everything on your computer and possibly even wreck your hardware if you do something wrong. If you're not comfortable with that, STOP NOW.

Step 1: Find the device for your SD Card

We first need to know what device gets assigned to the SD Card when you plug it into your computer. At the terminal, type "tail -f /var/log/messages" and hit ENTER. Now insert the USB card reader with your SD Card in it. You should see something very similar to the following:

Aug 31 10:46:16 dungheap kernel: [  943.606509] usb 1-3: New USB device found, idVendor=058f, idProduct=6366
Aug 31 10:46:16 dungheap kernel: [  943.606524] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Aug 31 10:46:16 dungheap kernel: [  943.606534] usb 1-3: Product: Mass Storage Device
Aug 31 10:46:16 dungheap kernel: [  943.606542] usb 1-3: Manufacturer: Generic
Aug 31 10:46:16 dungheap kernel: [  943.606548] usb 1-3: SerialNumber: 058F63666433
Aug 31 10:46:16 dungheap kernel: [  943.608523] scsi7 : usb-storage 1-3:1.0
Aug 31 10:46:17 dungheap kernel: [  944.739719] scsi 7:0:0:0: Direct-Access     Multiple Card  Reader     1.00 PQ: 0 ANSI: 0
Aug 31 10:46:17 dungheap kernel: [  944.740466] sd 7:0:0:0: Attached scsi generic sg2 type 0
Aug 31 10:46:17 dungheap kernel: [  945.384600] sd 7:0:0:0: [sdb] 15523840 512-byte logical blocks: (7.94 GB/7.40 GiB)
Aug 31 10:46:17 dungheap kernel: [  945.385809] sd 7:0:0:0: [sdb] Write Protect is off
Aug 31 10:46:17 dungheap kernel: [  945.404538]  sdb: sdb1 sdb2 sdb3 < sdb5 sdb6 > sdb4
Aug 31 10:46:17 dungheap kernel: [  945.408295] sd 7:0:0:0: [sdb] Attached SCSI removable disk

For this output, the device that I want is sdb. If your output is different enough that you can't tell what device you need, then stop. Don't guess. My hard drive, for example is at sda. If I guessed wrong and used that device instead, I'd lose everything on my computer, including my recipe for Eggs Benedict.

Step 2: Make a backup

You can skip this step if you want, but if you do and something goes wrong, there's not much anyone can do to help. First, make sure that you're in your home directory on your Linux computer. The command "pwd" should show you something like "/home/midnighthyperion". Replacing sdb with the device you found earlier, run the following command.

dd if=/dev/sdb of=./vox_backup.img bs=512

This will take a long time to complete (twenty minutes to more than an hour depending on the speed of your computer's USB hardware). When it's done, you should have a file named "vox_backup.img" that's around 8GB. To restore the backup (or create a duplicate), put the SD Card in your card reader and run the following, again replacing sdb with your SD Card's device:

dd if=./vox_backup.img of=/dev/sdb bs=512

Step 3: Add su to the Android filesystem

For this step, you need to download the Android Superuser package from here. Get the latest ZIP package that includes both su and Superuser.apk. The latest ZIP is currently here. Unzip the file and find the files named "su" and "Superuser.apk" and copy them to your current directory.

Now you need to mount the filesystem on your SD Card. You'll need to have a mountpoint, so type "mkdir /mnt/vox" and hit enter. Then, run the following, once again replacing sdb with your SD Card's device:

mount -t ext4 /dev/sdb1 /mnt/vox

The following will put "su" and "Superuser.apk" in the right places and set the "su" permissions correctly.

cp Superuser.apk /mnt/vox/app
cp su /mnt/vox/bin
chmod 6755 /mnt/vox/bin/su

Now umount the SD Card.

umount /mnt/vox

The SD Card can now be put back into the Vox and will be rooted when you reboot. Root won't survive a factory restore, but mine hasn't spontaneously restored itself since I stopped deleting random things out of /system/app.

Having root on your Vox means that you can inadvertantly break things there, too, but you can always restore from your backup to get back to a clean state. Just keep in mind that the backup that you created has whatever personal information that you've entered into your Vox, so don't upload it to the Interwebs or anything.

[suedenim]

Thanks for the instructions I might just give this a go. Also as the card is being tweaked in Linux would that also be a good time to remove the other bloat like the INQ apps etc. or is this best done in Android?

[Difflugia]

Originally Posted by suedenim

Thanks for the instructions I might just give this a go. Also as the card is being tweaked in Linux would that also be a good time to remove the other bloat like the INQ apps etc. or is this best done in Android?

Either has the same result, but I would suggest testing it either way before screwing the back down. It's been long enough that I don't remember which apps did it, but some things that I thought were bloatware were required for boot. Removing one (or more) of them also triggered a factory reset a few boots later. The first time I just thought I got unlucky, but it happened again after the same deletes. I think it was the OTA downloader that did it, but I didn't take the time to figure it out for sure. I ended up just removing the most obvious ones (INQ apps, YouTube, Facebook...) and the main Kobo app so I could sideload updates (the Kobo app from Google Play works fine once it's on the Vox, but the Vox is blacklisted from downloading it).

[Midnighthyperion]

so is this possible to do through windows

[Midnighthyperion]

anyways thanks for making this