Beginning Kindle Hackery

1. You can take the Hacker out of Perl...

2. ...but you can’t take the Perl out of the hacker.

3. Laziness, Impatience and Hubris on the Kindle

4. This talk contains almost no Perl.

5. ...and almost no Japanese.

6. I’m very sorry.

7. And no x86 ASM

8. I’m not sorry.

9. The Amazon Kindle

10. eBook Reader

13. eInk Screen

14. 800x600; 16 levels of grey

15. No backlight

16. Looks great outside!

17. Good things about the Kindle

18. 3G for 1-click shopping

19. 250,000+ books to buy

20. (Most < USD10)

21. Newspaper, Magazine, Blog subscriptions

22. Delivered every morning

23. $1-$10 each month

24. Email → eBook conversion

25. $0.10 for autodelivery

26. $FREE if you copy the result by USB

27. Free Web Browser

28. Download .mobi, .prc, .azw, .txt for free

29. “Experimental”

30. Means: We might start charging money for this

31. NetFront 3.5

32. Basic CSS

33. Javascript

34. XmlHttpRequest

35. Free Wikipedia

36. Not “experimental”

37. Text to speech.

38. Minesweeper!

40. Bad things about the Kindle

41. DRM

42. When you buy books, they are locked to the Kindle

43. Amazon lawyers went after a tool to let you read non- Amazon DRMed ebooks

44. (The same tool can help you remove the DRM from books Amazon sells you)

45. Limited eBook formats

46. I want to read PDFs

47. I want to read ePubs

48. I want to read Manga

49. Actually, I don’t read manga

50. But lots of my friends do

51. Surveillance

53. In the US, 3G includes GPS

54. The Kindle has a GPS

55. Device logs are sent to Amazon

56. Including many user actions

57. ...like the websites you visit

58. ...and what books you read

59. Appears to include GPS info

60. Amazon knows where you are

61. Lock-in

63. Designed to work only with Amazon

64. 3G use is free, but only while Amazon likes you

65. Summary: The Kindle is an “appliance”

66. You wouldn’t hack a book, would you?

67. I got a Kindle to read books

68. I didn’t plan to hack it

69. I really wanted to read books in other formats

70. I’m a sucker for sexy platforms

71. And it was begging me

72. It’s a new toy.

73. I am going to hack it.

74. Laziness

75. http://igorsk.blogspot.com

76. Hidden debug commands

77. ;debugOn

78. ‘help

80. Hubris

81. “I can’t possibly brick my Kindle with the keyboard, right?”

82. So, I started typing commands.

83. “‘usbNetwork” sounds good.

84. ...nothing happened

85. How about “‘usbQa’”?

86. It turned off the WIFI

87. ..and turned off USB Disk mode.

88. Impatience

89. I gave up

90. Sometimes laziness wins

91. An hour later, I rebooted my Macbook Air

93. So I set up a DHCP server

94. Nothing...

95. sh-3.2# tcpdump -i en1 listening on en1, link-type EN10MB (Ethernet), capture size 96 bytes [ ...] 12:36:15.238229 arp who-has 192.168.15.200 tell 192.168.15.244

99. Now my Kindle can tether through my Macbook

100. I want to read other eBook formats - attempt #1

101. The Kindle has a browser

102. I have a web server

103. Web based proxy

104. Small perl app

105. mobiperl

106. Perl 4

107. no strict;

108. no warnings;

109. global variables

110. hmm. no ePub support

111. Spent a weekend learning how ePub format works

112. github.com/obra/ unsavory-epub-hacks

113. Slow. Annoying. Requires a Server

114. Servers are evil

115. Hm.

116. Back to the drawing board

117. I want to read other eBook formats - attempt #2

118. Let’s review what we know:

119. What’s inside the Kindle?

120. 800x600 eInk screen

121. You know about the screen

122. Freescale iMX31

123. ARM1136JF-S

124. (Includes FPU)

125. + Multimedia stuff

126. 2 GB Flash

127. 128 MB RAM

128. USB OTG + MicroUSB slot

129. Audio hardware

130. Keyboard

131. The Kindle sounds like a computer, not a book

132. It MUST use some GPL code...

133. https://www.amazon.com/gp/help/ customer/display.html?inodeId=200203720

134. gplrelease.tar.gz

135. alsa-lib-1.0.13 gcc-4.1.2 module-init-tools-3.2.2_patch alsa-lib-1.0.13_patch glib-2.12.9 monit-4.9 alsa-utils-1.0.13 glibc-2.5 mtd-utils-1.0.0 alsa-utils-1.0.13_patch gst-plugins-base-0.10.17 picocom-1.4 base-ﬁles-3.0.14.ipk gst-plugins-base-0.10.6 powertop-1.10 base-passwd_3.5.9 gstreamer-0.10.17 procps-3.2.7 binutils-2.17.50.0.5 hotplug-2004_09_20 procps-3.2.7_patch bonnie++-1.03c ifupdown_0.6.8 readline-4.3 bootchart-0.9 iptables-1.3.3 syslog-ng-1.6.11 busybox-1.7.2 klibc-1.5 sysvinit-2.86 dosfstools-2.11 libol-0.3.18 taglib-1.5 e2fsprogs-1.38 linux-2.6.22-lab126 uboot-1.3.0-rc3 e2fsprogs-1.38_patch lrzsz-0.12.20 udev-112 fuse-2.7.1 lzo-1.08 util-linux-2.12r fuse-2.7.1_link module-init-tools-3.2.2

136. Linux

137. I can work with this

138. But how do I get code onto it?

139. My friend nmap tells me...

140. The Kindle listens on a few ports.

141. None of them love me at all

142. I guess I’ll need to take matters into my own hands.

143. Hey, the Kindle has busybox

144. busybox has telnetd

145. Maybe I just need to install /etc/rc5.d/S99telnetd

146. More research from http://igorsk.blogspot.com

147. Kindle 1 update extractor

148. (Python script)

149. But I want to make new updates...

150. I reverse engineered the reverse engineering tool

151. Updates are a short header, an MD5 and a tarball

152. ...run through a trivial cipher

153. they’re not encrypted

154. The Kindle2 is a little different than the Kindle1

155. It has different magic #s in the update header

156. I waited for the ﬁrst Kindle 2 “update.bin”

157. I grabbed its header

158. I built a new “update”

159. It installed one ﬁle

160. /etc/rc5.d/S99telnetd

161. /bin/busybox telnetd -p 2323

162. ...nope.

163. I ran strings on the Kindle’s busybox

164. No telnetd!

165. Where can I get a busybox for the Kindle?

166. What else has a a similar CPU?

167. My gPhone!

168. Lots of people built static busybox for the gPhone

169. telnetd: take 2

170. login:

171. login: root Password: Login incorrect

173. /bin/sh makes a better /bin/login

175. 125-6-81-160:ß jesse$ telnet kindle 2323 Trying 192.168.15.244... Connected to kindle. Escape character is '^Ü'. / # cat /etc/motd ############################################### ## # NOTICE * NOTICE * NOTICE # ############################################### ## Rootfs is mounted read-only. Invoke mntroot rw to switch back to a writable rootfs. ############################################### ## /#

176. What I found:

177. Most of /sbin is written in sh

178. Fun stuff in /proc

179. /proc/conﬁg.gz

180. # # Automatically generated make conﬁg: don't edit # Linux kernel version: 2.6.22.19 # Mon Mar 2 12:13:07 2009 # CONFIG_ARM=y CONFIG_SYS_SUPPORTS_APM_EMULATION=y # CONFIG_GENERIC_GPIO is not set CONFIG_GENERIC_TIME=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_MMU=y # CONFIG_NO_IOPORT is not set CONFIG_GENERIC_HARDIRQS=y CONFIG_STACKTRACE_SUPPORT=y CONFIG_LOCKDEP_SUPPORT=y ...

181. ...I could rebuild the Kernel

182. /proc/ﬁlesystems

183. nodev sysfs nodev rootfs nodev bdev nodev proc msdos nodev sockfs vfat nodev pipefs nodev nfs nodev nodev rpc_pipefs anon_inodefs nodev fuse nodev futexfs fuseblk nodev tmpfs nodev fusectl nodev inotifyfs nodev devpts ext3 nodev ramfs

185. I’m not restricted to 2GB

186. It’s a Linux box

187. I can cross-compile!

188. http://www.codesourcery.com/ Prebuilt ARM toolchain

189. It generates generic ARM machine code

190. That’s ok, but not great

191. I’ll cross compile Perl

192. 1 day of frustration passes

193. I won’t cross-compile Perl

194. Crosscompiling Perl == Bad Joke

195. I’ll cross-compile Python

196. Same bad joke

197. Maybe I need a native compiler for ARM

198. Where do I get an ARM build farm?

199. I have a gPhone

200. It’s not a great build host

201. I have an N810

202. It’s not a great build host...

203. ...but it has an important advantage

204. apt-get install gcc

205. N810: Linux 2.6; glibc 2.5

206. N810 binaries run unmodiﬁed on the Kindle

207. I built perl in an hour

208. Sadly, I realized that Python is a better choice

209. I also realized that building on the Kindle works better than on the N810.

210. (Version skew in extra libraries makes things hard)

211. I tried building gcc on the N810...

212. Found Pengutronix / OSELAS.de

213. It’s a compiler toolchain builder.

214. I built my own crosscompilers for ARM1136JF-S - Linux 2.6 - glibc 2.5

215. I used the cross compiler to compile gcc, glibc (for proper headers), binutils, shellutils, dropbear & screen

216. I cross-compiled nfsmount

217. I nfs-mounted a disk image with the compiler

218. Then I started building more stuff

219. I am a Perl Hacker

220. I believe in the three virtues

221. Lazyness

222. Impatience

223. Hubris

224. Sometimes, Perl isn’t the Right Tool

225. Calibre is the Killer App for ebook conversion and management

226. Lazyness

227. I like the best tools

228. The best tools already exist

229. Calibre has dozens of eBook format converters.

230. Why reimplement them?

231. Hubris

232. “I can learn enough Python in a weekend to port this application to the Kindle”

233. The downside

234. Dependencies

235. Who’s dealt with Python app dependencies?

236. No CPAN.

237. Everything you need is in the Standard Library.

238. If it’s not in the Standard Library, it’s not worth using.

239. Except when you need it.

240. They have....

241. “easy_install”

242. It’s not so easy

243. It is very perlish

244. It does recursive web scraping to ﬁnd tarballs on developers’ web sites.

245. Most of the deps actually installed ok.

246. I just ran the app over and over until it stopped erroring.

247. God I miss Perl.

248. And then we get to the big problem.

249. Qt

250. Calibre’s UI is in Qt

251. ...so its backend uses Qt because it’s easy

252. PyQt binds Qt to Python

253. For Qt for Windows

254. for Qt for Mac

255. for Qt for X11

256. No X11 on Kindle

257. (Just a Framebuffer)

258. QtEmbedded

259. No problem!

260. No PyQtEmbedded

261. Finally got Calibre running...

262. by hacking out components I don’t need.

263. It was good enough to try to convert a trivial ebook.

264. It took 12 hours...

265. ...after I built swaputils and gave it 256MB of swap

267. So what was it doing?

268. HTML → Mobipocket converter

269. With a full CSS engine

270. It visits every DOM element...

271. and computes CSS styles to convert them to trivial HTML 3.2...

272. ...twice.

273. Lazyness, Impatience, Hubris can all help here.

274. Help me Larry-wan.

275. Very few CSS rules really matter.

276. The Kindle supports very little HTML.

277. It mostly supports HTML 3.2...just no <pre>

278. ...that’s the only thing the 12 hour CSS engine got us

279. You can emulate <pre> with <tt> and

281. if tag == 'pre': self.inside_pre = 1 tag = 'tt' if preﬁxname(elem.tag, nsrmap) == 'pre': buffer.write('<br/>n') self.inside_pre = 0 if self.inside_pre: text=text.replace(' ',' ') text=re.sub(r'(rn|r|n)', '<br/>n', text)

282. Now it runs in 60 megs and about 10 minutes

283. So, now I can run code.

284. Still no UI access.

285. I don’t really want to hack Java GUI code.

286. And where could I plug my custom UI into the Kindle’s?

287. I don’t want to break Amazon’s UI.

288. Oh hey.

289. There is an application I could replace with something custom...

291. But really, I don’t want to.

292. Sure, I could decompile.

293. It’s obfuscated.

294. It’d be annoying.

295. If I built UI, I’d have to maintain a UI.

296. And users can break a UI.

297. No buttons = Less to screw up

298. But I have this ebook converter.

299. I do want to let users convert books.

300. What to do?

303. Inotify blocks on ﬁlesystem events.

304. pyInotify lets me get at fs events easily.

305. class InotifyListener (threading.Thread): global cv def run ( self ): global conversionQueue wm = WatchManager() # Watch Manager mask = IN_MOVED_TO | IN_CREATE # watched events p = PTmp() notifier = Notifier(wm, p) wdd = wm.add_watch('/mnt/us/documents', mask, rec=True) notifier.loop()

306. It works great for downloads

307. Copies over USB didn’t trigger inotify events.

308. It’s probably something fuse-related.

309. I went for the cheap hack.

310. When you eject the Kindle, it generates a DBus event.

311. class DbusWatcher (threading.Thread): global cv def run ( self ): global conversionQueue cmd='/usr/bin/dbus-monitor --system' pipe = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE).stdout while 1: line = pipe.readline() if any(line.ﬁnd(i) != -1 for i in ['usbPlugOut', 'resuming']): for f in os.listdir('/mnt/us/documents'): maybe_enqueue_ﬁle('/mnt/us/documents/'+f)

312. What’s next?

313. Remember conﬁg.gz?

314. I can build a new kernel

315. ...and add back missing drivers

316. USB Mass Storage Host

317. USB WIFI?

318. What isn’t next?

319. Reverse engineering Java to extend the Kindle’s UI

320. Python, and Shell, I’m happy to hack for a good cause.

321. Java is another matter entirely.

322. Thanks!

323. I had a big ﬁnish planned.

324. I was going to build and show off a manga converter.

325. (for .cbz format books)

326. So I downloaded a .cbz.

327. ...and copied it to the Kindle...

328. ...and I saw this...

330. The best hacking is no hacking.

331. Thanks!

Beginning Kindle Hackery

Related slideshows

More Related Content

Beginning Kindle Hackery