Introducing Projects: Hacking the Kobo Gen. 1

I am trying to see what I can do with an original kobo. It features an ARM920T core, 64MB of RAM, a little internal NAND, an SD card slot, and a 6 inch eInk screen. It’s running a firmware based on linux 2.6. There’s an exposed 3.3V UART on the bottom of the board running at 115200 baud. Pressing ctrl-c when the kobo starts booting gave me a U-Boot prompt. I rebooted it fully, and that same UART dropped me right into a root shell. This tablet has no networking, so I won’t be able to get ssh or telnet at first. It may be possible to get some kind of USB networking going. My next task is dumping the NAND. I will update and post an image when I have one.

3 Likes

That is really interesting @bkallus. I had been curious about older linux kernels, and realize the ones before 3.0 required a lot less RAM. This one requires 4MB RAM: https://tiny.slitaz.org/

In this day and age, microcontrollers like the ESP32 WROVER come with 8MB (4MB usable RAM. So i’m curious whether an old 2.6 kernel could load on a microcontroller. With a window manager like Openbox perhaps.

4 MB is still enough to run a modern kernel. OpenWrt doesn’t officially support it anymore, but you can still use their build system to compile firmware images with a 5.4 or 5.10 kernel for embedded devices with 4 MB of RAM. If you keep your kernel trim and omit the package manager and web interface, it actually runs okay. I use one of these as a dumb AP in my home.
I imagine the ESP32 could run Linux if someone were to put the work in. It’s been ported to worse; see iPodLinux and the old uClinux project.

2 Likes

That is really cool @bkallus! I’ve been gathering links for linux on MCUs: i’ve been posting them here: https://github.com/EI2030/Low-power-E-Paper-OS/blob/master/Links%20%26%20Scratch%20Pad

Lots of interesting slides by Bootlin and Yoctoprojects: https://bootlin.com/pub/conferences/2017/jdll/opdenacker-embedded-linux-in-less-than-4mb-of-ram/opdenacker-embedded-linux-in-less-than-4mb-of-ram.pdf

@scrunch, that looks really cool. If I see anything that seems like it belongs in that scratchpad, I’ll submit a PR.

Also, in the process of dumping the flash, I forgot to mount the SD card before I dumped all the mtdblock devices into /mnt/sd. This ended up corrupting my firmware image, so I’m in a bind. I can get into U-Boot, but can’t boot the OS (bad magic byte). Without a stock firmware image I will not be able to go any further. I’m hopeful that the Kobo desktop software allows for downloading firmware updates, and that I can unpack one of them to get a uImage. Alternatively, if anyone else has one of these and can extract a uImage I’d be really grateful. I guess it might also be possible to grab the firwmare off the flash directly with something that can speak SPI, but I have a feeling the kernel is corrupted.

Also also, here’s the partition layout of the Kobo gen 1’s flash:
mtd0: 00080000 00020000 “uboot”
mtd1: 001e0000 00020000 “kernel”
mtd2: 000c0000 00020000 “picture”
mtd3: 00020000 00020000 “parameters”
mtd4: 0a000000 00020000 “rootfs”
mtd5: 00100000 00020000 “app”
mtd6: 35b40000 00020000 “other”

“uboot” “kernel” and “rootfs” are self-explanatory, but I have no idea what’s in any of the others since I wasn’t able to actually dump the flash before I mangled it.

I guess this project is on hold until I’m able to get this Kobo up and running or I buy a new one. They’re pretty cheap, but I am a student.

1 Like

Also, I ran /etc/passwd through john, and the password for the “admin” account (which is the only one that has a password, including root) is “admin”

1 Like

We have an EI2030 Zulip server https://ei2030.zulipchat.com/register/ There might be some more with Kobo experience there. Hope that helps!