Giving the Microsoft Wireless Desktop 900 keyboard a power switch

Say whatever else you want about them, Microsoft has always made amazing peripherals hardware. I got their Microsoft Wireless Desktop 900 keyboard/mouse set, which is much the same as the Wireless Keyboard 850 in a kb/mouse bundle. It's no exception - reasonable price, great quality, does exactly what it says with no nonsense and stray LEDs. The keyboard is really flat and convenient.

Unfortunately they took the minimalism a bit too far. The keyboard has no power switch.

Adafruit Gemma, Macbook and the dim red light

My partner recently picked up an Adafruit Gemma as an intro to Arduino and embedded. It has not gone according to plan - it turns out there's a known issue where on some systems the Gemma will fail to enter the bootloader properly. The green power light comes on, but the red light stays dimly and constantly lit. If the reset button is pressed it goes out for a moment then returns.

Trying to program it anyway results in an error like

avrdude: Error: Could not find USBtiny device (0x1781/0xc9f)

The issue seems to be somewhat intermittent, too. Occasionally it works on her Macbook Air. It always works 100% of the time on my Lenovo T460 (Linux). So there's something platform related...

Not a great intro. The Gemma doesn't behave like usual Ardiuno systems - it doesn't expose a USB serial port, for example - so answers are also thinner on the ground.

But I think we found something.

Updating the tomu bootloader on the tomu.im EFM32HG

I got a tomu tiny EFM32 that fits in a USB port at lca 2018. More information on Tomu.

Mine came with the serial bootloader (it presents a USB CDC ACM device). I didn't manage to get to the update booth to reflash it at LCA.

I had some difficulty getting the new bootloader on it when I pulled out recently to try to play with it, but since I got it working, here's a short runthrough of how I got it updated.

I use Fedora 28 but this info should apply for any Linux really.

WifiBaby - First Impressions

I bought a WiFi Baby remote IP camera / baby monitor from wifibaby.net last week. It arrived today, and I wanted to share my first impressions.

Even though WifiBaby don't usually sell outside the USA and Canada they made a special effort to send me a PayPal invoice and they even pointed me at the discount code on their Facebook page (or rather, applied it, then told me they'd done so!). Huge props for this, I've never had better sales service.

Overall, the product its self is quite impressive, with a few disappointments that detract from what is overall a very good product.

It turns out to be closely related to the Y-Cam Cube, specifically a YCW003 VGA Y-Cam Cube. Y-Cam tell me it's not quite the same (different casing, somewhat different specs), and alas isn't firmware-compatible.

The good

It works! This much neglected feature is becoming rare in IT products, and should be savoured when found.

It's well presented, well built, and comes with a really solid mounting bracket. The power brick seems to be good quality, too, and supports 110-240V (though of course it has USA prongs).

Supports WPA2. None of that dodgy OFDM we-claim-it's-secure-but-you-can't-verify-it business of the proprietary camera vendors. (OTOH, see "HTTPs" below, it's not all roses).

The device comes preconfigured for DHCP with a sensible hostname (wifibaby) that makes it easily discovered on most routers, and it can be configured entirely via a web browser. A flash applet on the browser can be used to stream video, with the caveat noted below.

Image quality is excellent, with a high res image in both colour & active infrared. You can choose from several levels of streaming quality for different bandwidth levels. Active infrared quality is excellent, with pretty impressive range without too much foreground over-exposure. I cannot stress how amazing the infrared camera is enough.

Plenty of control over things like whether it uses infrared or not, whether or not it uses the IR cut filter, whether it publishes its address over dynamic DNS, etc.

Once connected to the network, setup is quick and easy with the browser based wizard.

Built-in support for dynamic DNS providers for those who don't have one already, and it even comes preconfigured.

Phone support for those who need it.

Wired Ethernet port. Very handy for maximum quality if you have the house wired anyway.

Multi-user viewing support - works extremely well.

Remote access from off-site (but see caveat below re HTTPs, password security).

No security screws, clips, etc. So if (OK, let's face it, when) I take it apart to get at its guts, it should be easy.

Neither here nor there

Initial setup to get it on the wifi is OK, but a bit dated. It doesn't support WPS (Wifi Protected Setup) for automatic setup, it expects you to plug it in over wired Ethernet and run a desktop application to discover the device. The quickstart guide is good, though, so inexperienced users should be OK. You don't have to use the app, either, you can just find the address it got over DHCP and visit that with a web browser. (Update: it looks like the current Y-Cam firmware supports WPS, but maybe WifiBaby haven't updated to it yet, despite WPS being added in August 2013 in firmware 5.46).

The web UI is crude but functional. Not much attention has gone into usability, but it's simple enough that that's OK.

Some apps support remote control of the infrared feature, etc. Awesome, except you have to buy 3rd party apps to do it, the browser based Flash app doesn't do it.

Ordering from outside the USA is a little bit of a pain and a bit pricey because of shipping, but on the other hand, they did it when they'd normally not ship at all. Try that with Amazon! (Update: Actually, you can).

The price. The base Y-Cam hardware (if I'm right about that) runs a newer firmware that doesn't seem to lack any functionality present in the WifiBaby and adds some more; it also costs 3/4 as much. Of course, you're not getting personal USA based tech support for that, nor the great sales service WifiBaby provide. Pick your priorities I guess.

Not so great

The camera doesn't seem to support HTTPs. Not impressive for a device that supports UPnP to open up a hole in your firewall for remote access - you have to send the credentials in clear text. They should fix this, especially since it defaults to being Internet accessible with a non-randomly-generated password.

The microphone is fairly poor, and it lacks a socket for an external microphone. That's a serious omission.

The infrared cut filter makes a less than quiet "click" noise as it switches in or out. It's not super loud, but it's sharp, sudden, and plenty loud enough to be disturbing. Not good in a baby product. The device does allow you to turn the use of the filter off, though.

There's over two seconds of time lag on the Flash based mobile viewer. This lag doesn't occur to anywhere near the same extent when using mobile devices that stream video from the device.

It doesn't make you generate a new password or enter a new one when you set it up. That'd be OK ... if it didn't also default to opening a hole in the firewall for streaming video. I can understand this one from an ease of support point of view, but think it'd be a lot better to offer a password reset that only worked on the local WLAN or via a wired connection and then encourage the user to generate or enter a better password/phrase.

It doesn't seem to enter much of a low-power mode, producing a fair amount of heat when not actively streaming. I hope it copes OK with the Western Australian summer.

Concerning

In my opinion the vendor doesn't do a very good job of making it clear that the advertised mobile device support requires extra-cost third-party apps. The prices are shown in the apps section of the site, but there's no reference to them being extra cost where the mobile features are listed on the camera product page its self, though the page strongly highlights the features that are only available via those mobile apps. Mobile device logos are prominent, but lack telltale asterisks. It'd be nice to see this made more prominent - or alternately, for the vendor to license these apps and bundle rebrands of them with preconfigured detection of the wifibaby, which would make setup nice and smooth too.

There's no GPL compliance notice in the box, on the camera web page, or in the CD, but it appears to run Linux 2.6.x. I will be taking this up with the vendor. I could be wrong, so don't get too excited, especially as the distributor probably doesn't know anything much about the firmware produced by the manufacturer. (Confirmed by email discussion - I've sent them some information and guides, and will wait to see if anything happens.)

I've sent WifiBaby, and the hardware vendor Y-Cam, links to:

• the SoftwareFreedom.org compliance guide
• Linux kernel GPLv2 HOWTO
• Software Freedom Conservacy compliance guide
• SFConservacy enforcement information

... so we'll see if anything happens there.

Feature wishlist

Talk-back / two-way audio. In a high end baby monitor. I'd really prefer to have this, and many IP cams support it, so it should not be overly hard (as anyone who's never done something always says, right?). They don't claim it supports two-way anywhere, so I didn't expect to have this feature, but it's something I'd like to see appear in a future version.

External microphone port, or a decent quality mike.

Quieter IR cut filter switch over.

HTTPs. Seriously.

Rate-adaptive streaming.

Alternatives

I've since found a similar looking device, which looks like another OEM rebrand of the same IP camera, sold as BabyPing. It's from the same manufacturer according to WifiBaby (update: That's Y-Cam), but unlike the WifiBaby it's a cloud-based device. So, y'know, security/privacy issues there.

The HomeMonitor is also a Y-Cam rebrand. It seems to be another version with a custom firmware reliant on a cloud service.

The Y-Cam cube its self, mentioned above, may be a good option to consider.

Jaycar sells what looks like a previous revision of the same sort of camera for less than a third of the price and has two way audio. Of course, it's probably rather primitive in image quality in comparison, too, and won't come with the same goodies.

Atmel Microcontroller (non-ATmega/ATtiny compatible) with built-in 433MHz (US: 310MHz) transmitter!

While researching parts for my soil moisture sensors I stumbled across these awesome Atmel microcontrollers:

• ATAM862-4 Microcontroller with UHF ASK/FSK Transmitter (433MHz non-US band)
• ATAM862-3 Microcontroller with UHF ASK/FSK Transmitter (310MHz-330MHz US band)

I was so excited I had to share. At about AU$8 each, these little beasties might make building wireless soil moisture sensors so much easier it's just not funny. The main problem is going to be ordering them, since Jaycar and Element14 don't carry them, and DigiKey has them as non-stock components with 4000 unit minimum volumes. They're 4-bit 8051-architecture micros so they're not going to be compatible with the ATmega or ATtiny range, so I lose the advantage of having the same arch on sensor and control system. For something as relatively simple as sampling an analog temperature and humidity sensor that may not be a big problem.

It may still land up being easier to use an ATtiny for the analog sensor controller and digital sensor data transmitter, so I can use (mostly) the same software tools as for the ATmega on the control board. I could then hook the sensor's ATtiny up to either some wiring for wired service, or to an RF transmitter IC for wireless operation without much if any change to the sensor codebase.

Atmel also have a family of RF receiver ICs (with matching tx modules or transceivers available) so I might be able to avoid the need for a breakout board / shield for the RF receiver support and just make it an optional component in the base design. Things like the ATA5723 /ATA5724/ATA5728 and the ATA5745 /ATA5746 RF receiver ICs could be awfully handy at about AU$4 each ... if I can find someone who'll sell them to me in less than 1,500 unit quantities. If not, there are lots of other highly integrated 433MHz RF receivers and transmitter ICs out there.

The ATA8204P3-TKQY looks particularly suitable; it's a slower and cheaper unit without UHF, but that shouldn't be a biggie for my use. It's cheaper than any of the other units except the ATA8202-PXQW 19 on digi-key, and should do the job fine. It's surface mount so it won't be assembly-friendly, though. An alternative might be the ALPHA-RX433S from RF-Solutions as that's packaged as a little module that'd be a bit saner to solder up.

DIY DC soil moisture sensor - early test successful

On the the progressive difficulty scale of home built soil moisture sensors the bottom of the ladder is a DC soil conductivity sensor that uses simple resistivity measurement.

It took a couple of hours build one of those last night, most of which was spent incompetently attempting to produce a decent solder joint on steel wire and on the cleaned heads of galvanized nails. Anyone who can use a soldering iron without being a hazard to themselves and those around them should be able to whip something like this up in a few minutes.

Interested in soil moisture sensors and irrigation control? Start with the UF/IFAS virual extension series

I've been having ... "fun" ... trying to find a way to build an affordable network of soil moisture sensors that don't require too much looking after.

It's harder than you'd think, but this UF/IFAS Virtual Extension series on soil moisture and irrigation has made it a lot easier to understand the different approaches and sensor types. It'll help you understand the differences between resistive and capacitive soil moisture measurement, introduce alternatives like tensiometers, etc. This is important whether you plan to DIY your sensors or buy off the shelf.

Using a RHT03 (aliases: RHT-22, DHT22, AM2302) temperature/humidity sensor from Arduino

I picked up a nice compact little temperature and relative humidity sensor called the RHT03 for a project from Little Bird Electronics. It and very similar parts appear to go by the names RHT-22, DHT-22 and AM2302. You can find the part at SparkFun, Adafruit, etc too.

It took a lot more work to get it working than I expected, so I thought I'd write it up here for anyone else who is looking into it. There's sample code at the end of this post, but you should probably read the details because this is a quirky beast.

UPDATE: I since found a library on GitHub: nethoncho/Arduino-DHT22 that does a better job more simply and compactly. It works fine with my sensor. It needed some changes for Arduino 1.0 and some further tweaks to work how I wanted, so I've uploaded a fork here: https://github.com/ringerc/Arduino-DHT22.

Extending Arduino example CIRC-05 to use hardware SPI control

For kicks, I've extended the basic Arduino shift register LED control example CIRC-05 from www.oomlout.com to use the Arduino's hardware SPI routines instead of software signalling.

As someone who has done very little with low-level electronics and who didn't know what SPI even was until today, this was embarrassingly easy. Kudos to the excellent Arduino libraries and the great documentation for making this simple.

I'm posting the re-written example for CIRC-05 here. It has the original software-based control as well as support for SPI, so you can see how similar the methods are.

(BTW, if you were wondering what a "latch" is in the IC, see this example.)

No further work on Kobo

This article is part of an extended series on Kobo development and investigation

I've stopped work on the Kobo software and dev env.

Setting up usb gadget serial (g_serial) on Kobo Wifi

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

The Kobo Wifi (apparently) has an onboard serial port, but it doesn't have any header pins let alone a usable socket. Using it will require bulldog clips at best, more likely soldering some pins in. Either way you have to open the case and keep it open while using the port which is inconvenient if you like to actually use your Kobo. In any case, I can't find any documentation for the pinout.

Telnet over wifi works and can be enabled without opening up the device - but tends to go down quite a bit, as it's not really intended for this use. It's hopelessly unsuitable for running a GDB remote debugger over.

It's fairly simple to modify the Kobo Wifi (and presumably the original Kobo, though I haven't tried it) to add support for serial-over-usb and/or ethernet-over-usb, both of which are much easier to work with than physical serial and much better than telnet/ftp over wifi. Enabling USB serial gadget support seems to interfere with the USB gadget mass storage system used to export the file system to a host computer, though, so don't make the change permanent unless you like to keep your library on an SD card. It looks like the 2.6.33-rc1 and newer kernels may contain support for multiple gadgets running at once, but the Kobo is on 2.6.28 and it's unlikely to be worth the effort of an update.

To get usb serial mode working, you must build a new kernel for the Kobo and copy the modules from that kernel over to the Kobo. You might want to make menuconfig and enable CONFIG_USB_CDC_COMPOSITE in drivers -> usb support -> usb gadget -> CDC Composite Device if you'd like to have simultaneous support for Ethernet and serial gadget mode, which can be really handy for debugging. See documentation/README.kernel in the KoboLabs git repository for how to build a new kernel and modules. I've asked them to pull it, so it should be there soon. You should not actually need to install the new kernel, as the modules you build should be compatible with the old kernel already on the device.

To install the modules, install them to some temporary MOD_INSTALL_PATH like /tmp/arm then cd /tmp/arm and tar cvzf KoboRoot.tgz lib. Copy the KoboRoot.tgz file to .kobo/KoboRoot.tgz on the device's onboard user-accessible flash storage and reboot to install the update. After a reboot, you can telnet in and modprobe g_serial (or g_cdc if you compiled the mixed serial/ethernet module) to enable USB serial support. To make the serial port useful you need to run /sbin/getty -L ttyGS0 115200 vt100 to listen for logins. This is easily wrapped in a shell script you can invoke via telnet, or via an autorun hook you add in /etc/init.d/rcS that runs a script off an add-in SD card if one is found. The same script can be used to bring up the usb0 ethernet device if you're using g_cdc.

If you want to make usb serial gadget support start at every boot (thus disabling the ability to manage the internal card library over USB - this will be annoying!), add this line to /etc/inittab on the device:

ttyGS0::askfirst:/sbin/getty -L ttyGS0 115200 vt100

... and add this line to /etc/init.d/rcS after "/bin/mount -t sysfs" :

/sbin/modprobe g_serial

If you'd prefer to have serial and ethernet, and made the kernel config change to enable it as described above, replace g_serial with g_cdc in the line above.

Once you've loaded the g_serial module one way or another and started a getty, you can connect the Kobo to your PC. When prompted for what to do, say "keep reading". You'll discover that the Kobo appears as a USB serial port that you can connect a terminal to. On a Linux host it should be /dev/ttyACMx (/dev/ttyACM0 if you have no other USB serial ports); check dmesg to be sure. You can use a terminal program like minicom, gtkterm or picoterm to talk to the port. The login is "root" and there is no password unless you set one later. You can transfer files using zmodem's rx command if you need to, use the usb ethernet module, or ftp them over wifi.

Unlike telnet over wifi, this serial console stays up no matter what antics nickel performs, and doesn't require the device to be open. It's similarly easy to use g_ether to expose an Ethernet interface or g_cdc to do both ethernet and serial at once. It's just a real pain that using them prevents the g_file_storage module used by the Kobo to manage the onboard memory from working!

Compiling Qt plugins for Kobo Wifi

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

The Kobo Wifi's main user interface application, nickel, is a Qt Embedded app. It drives the ePaper display via a Linux framebuffer interface and some ioctl calls to trigger display refreshes. This is abstracted away from the app behind a QWS (Qt Window System) driver called broadsheet_ioctl that's statically linked into nickel.

Because the QWS driver is only in nickel, we can't really write stand-alone Qt applications to run on the Kobo without reimplementing it. However, the nickel app has a simple plugin interface you can use to load your own code as a shared library.

To do this, you need a full Kobo development environment, including a cross-compiled Qt Embedded build that matches the one used on the Kobo. Once you have that, you can build apps according to the template provided by examples/poker, then drop the shared library produced into /usr/local/Kobo on the device to get it to load.

You now have some totally useless code running on your Kobo. Congratulations. There's no way to invoke it. For now, I'm testing by replacing the poker plugin with my own code, but it's still painful to access it so it's not desirable for real-world use. It may prove necessary to introspect the Qt widget tree or even runtime patch classes to get useful functionality loaded by plugins without having access to the nickel sources.

If your plugin doesn't load, it may be helpful to telnet into your Kobo and create a script like this, called (eg) /usr/local/relaunch-nickel.sh

#!/bin/sh
# Kill off the old nickel
pkill nickel
# Clear plugin cache
rm -f /mnt/onboard/.kobo/Trolltech.conf
# Restart nickel
export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/lib:
export NICKEL_HOME=/mnt/onboard/.kobo
export LD_LIBRARY_PATH=/usr/local/Kobo
export QWS_KEYBOARD=netronix
export INTERFACE=eth0
export LANG=en_US.UTF-8
QT_DEBUG_PLUGINS=1 /usr/local/Kobo/nickel -qws -display broadsheet_ioctl >/mnt/onboard/.kobo/nickel.log 2>&1 &

When executed, this script will restart nickel, causing it to write a debug log to the .kobo directory on the user flash and print detailed information about plugin loading. This might help you figure out what's going on. nickel prints a fair few warnings during normal startup, so don't be thrown by that.

When developing for Qt on Kobo, the Qt for Embedded Linux Environment Variables document may be helpful, though it doesn't mention QT_DEBUG_PLUGINS.

It can also be helpful to determine how Qt was built on your target device. On the Kobo Wifi:

$ strings libQtCore.so | grep 'Build key'
Build key:           arm linux g++-4 full-config

Taking a disk image of the Kobo Wifi without opening the device

This article is part of an extended series on Kobo development and investigation

---

Any attempt to modify your device is risky. Your device might be permanently destroyed. If you cannot risk the permanent loss of your device, so not attempt to modify it. Something can easily go wrong if you do the wrong thing - or follow out of date instructions. I don't continually maintain and test these instructions, so they might well qualify.

If you can't afford to lose it forever, physically open your Kobo up before doing anything, remove the SD card, and take a disk image of it using a PC with a card reader. I use `dd` with a Linux box to make sure I get a complete image of the entire card.

Note that you could break the case or retaining clips when opening your Kobo. I didn't and I opened mine quite a few times, but who knows if they've changed assembly techniques, plastics, etc since then.

Messing with embedded devices that aren't designed to be hacker-friendly is risky. Deal with it, or don't mess with the device.

---

Once you've enabled telnet on your Kobo Wifi, you can use it to transfer a disk image of the Kobo's entire firmware image on the internal MicroSD card. This will give you a backup copy of your Kobo's firmware on your computer.

You can't restore the firmware image without physically opening your Kobo if you mess things up badly enough for it not to boot, but hopefully you won't do that. The Kobo seems to be amazingly hard to break unless you corrupt its file systems, overwrite its kernel, etc. Anyway, this way you can avoid opening the Kobo until/unless you ever need a total firmware restore.

Imaging the Kobo's firmware over wifi

To image the disk of a running system, we need all its file systems in read only mode. This turns out to be trivial to achieve with the Kobo, though it requires terminating the main eReader process ("nickel") so you'll want to reboot after you've done it. During the process, the screen will display whatever was on it before you ran the commands to image the system and none of the keys will respond. Just:

pkill nickel
mount -o ro,remount /mnt/onboard
mount -o ro,remount /
nc -l 9984 < /dev/mmcblk0

Now, take note of the IP address printed by the commands above and use it in this command on your main computer:

nc IP_OF_KOBO 9984 > kobo_internal_microsd.img

The disk imaging process will take a while over wifi, and won't show any progress. Mine took about twenty minutes. If you want progress indication, open a second terminal and run:

watch "du -ms kobo_internal_microsd.img"

... to get a count in megabytes of data transferred so far.

Finally, reboot the kobo to bring it back to normal. You can do this by pressing and holding the power button for 6+ seconds, or by typing control-C then "reboot" and enter into the telnet command line on the kobo.

The image saved on your computer should be 1977614336 bytes for a Kobo Wifi with a 2GB internal card (~1.1GB user accessible memory).

If you have any issues, try a different port number with nc.

^C
reboot

Once you have the Kobo's disk image, you can mount the partitions within it to examine them, and you can extract some individual components of the unpartitioned space in the card.

Imaging the Kobo's firmware to an SD card

In principle you can also image the Kobo's firmware to an SD card instead of using wifi. This will be much easier if you don't run Linux. You need a 2GB or larger card.

To image the Kobo's firmware to an SD card you can telnet in to the kobo and make the file systems read-only as above. Make sure you unmount the external sd card /mnt/sd if it is mounted. Then, instead of getting the IP address and running netcat in listen mode, you can just `dd' the internal mmc card to the external sd card, `sync' to force it to flush, and `reboot'.

Alternately, you may prefer to leave the external SD card mounted, remount everything else read only, then run:

dd if=/dev/mmcblk0 | gzip > /mnt/sd/kobo.img.gz

... to make a compressed image (slow!) on the file system on the SD card. This will be easier to work with under Windows, which doesn't work well with raw devices.

Examining the firmware image

gunzip the image if it's compressed. Either back up a copy of the firmware image that you will not touch, or make the firmware image read-only with chattr +i.

You may now mount the three file systems on the image using this little script - or by hand by using "fdisk -l" to dump the partition table, then calculating the offsets to pass to losetup. If you want to use my script, I make no promises that it won't eat your system and your cat, so be careful. Save the following to "kobomount.sh" and mark it executable:

#!/bin/bash
set -e -u
if test $# -ne 1 ; then
  echo "Usage: $0 firmware.img"
  exit 1
fi
IMG=$1
i=0
sudo -v
for offset in $(sfdisk -d kobo_2gb_microsd_image_v174.img | grep start | cut -d : -f 2 | awk '{print $2}' | sed 's/,//g' |grep -v ^0$); do
  sudo losetup --offset $(( $offset * 512 )) /dev/loop$i "$IMG"
  sudo mkdir -p /mnt/kobo/$i
  sudo mount -o ro /dev/loop$i /mnt/kobo/$i
  ((i++))||true
done

You may then aim it at your firmware image and it'll mount the contained partitions on /mnt/kobo/0 (the recovery partition), /mnt/kobo/1 (the main OS) and /mnt/kobo/2 (the user flash partition). All will be read-only.

You may also want to extract some blobs from the unpartitioned space at the start of the image. That's where the kernel, boot splash image, etc live. I don't have official documentation on the layout of this space, but reading the upgrade scripts in /etc/init.d suggests that these values should be about right. They are UNVERIFIED except for the boot splash image, which I've been able to edit and replace.

IMG=kobo_2gb_microsd_image_v174.img
dd if=$IMG of=serialnumber.bin bs=512 count=1 skip=1
dd if=$IMG of=hwconfig.bin bs=512 count=1 skip=1024 count=2
# The image that ships with the kobo is < 470 512 byte blocks long. It's not clear
# if something else takes the space between the end of the image and the start of
# the epson display binaries, if it's dead space, or if there's room for bigger
# images.
dd if=$IMG of=bootlogo.bmp bs=512 skip=1026 count=470 
dd if=$IMG of=epson_display_setup.bin bs=512 count=1 skip=1920 count=8
dd if=$IMG of=epson_waveform.bin bs=512 count=1 skip=1928 count=$((2048 - 1928))
dd if=$IMG of=kernel.bin bs=512 count=1 skip=2048 count=$((7564-2048))

The Kobo's kernel

We can now examine the existing kernel to learn more about it. This post tells us how to extract the kernel (but it's more easily done with scripts/extract-ikconfig from a kernel tree)

The hard way (which lets us extract the image, not just the config) in brief:

od -A d -t x1 kernel.bin | grep '1f 8b 08 00'
# Note the (decimal) offset, correct for offset of deflate header into line
dd if=kernel.bin bs=1 skip=0013076 | zcat > vmlinux

The easy way to dump the config:

scripts/extract-ikconfig $HOME/kobo/kobofirmwaredump/kernel.img

Boot loading is apparently performed by RedBoot (2.0 according to shipped sources), which should offer tools like `fis list' to report on the structure of the redboot-managed areas of flash storage. Building redboot is a nightmare, so I haven't investigated this yet.

Enabling telnet and ftp access to the Kobo Wifi

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

The Kobo Wifi has this handy 802.11 radio that it really only uses for online shopping. Not only is it calling out to be used for RSS feeds and web browsing, but it is also a really handy tool for developing on the device without having to crack it and solder serial port headers onto the board.

We can gain telnet and ftp access to the device quite trivially; see the pre-made KoboRoot.tgz patch linked to below for the really easy way. (WARNING: The premade patch is for an older Kobo Wifi firmware. See the comments for instructions and newer version info).

If you want to roll your own patch or you're using a different firmware revision, there isn't much to do. The Kobo already has busybox's telnetd, ftpd and inetd on it. All that's necessary is to:

• Edit /etc/inittab and add the lines:

  ::sysinit:/etc/init.d/rcS2
  ::respawn:/usr/sbin/inetd -f /etc/inetd.conf.en
  

• Create /etc/init.d/rcS2 with the content:

  #!/bin/sh
  mkdir -p /dev/pts
  mount -t devpts devpts /dev/pts
  /usr/sbin/inetd /etc/inetd.conf
  

  and run chmod a+x /etc/init.d/rcS2 to flag it executable.
• create /etc/inetd.conf with the content:

  # service_name sock_type proto flags user server_path args
  21 stream  tcp     nowait  root    /bin/busybox ftpd -w -S  /
  23 stream tcp nowait root /bin/busybox telnetd -i
  

• tar our new /etc into KoboRoot.tgz

(Edited for safer method suggested by tjm)

KoboRoot.tgz may then be used to update the device's operating system by putting it in the .kobo directory on the user-accessible flash.

Because it's not designed to be accessible from the outside world, the Kobo doesn't have any root password set. Telnet and FTP access as root will be offered with a blank password by default. You can change that once you telnet in if you like, by typing "passwd" at the root prompt. This won't affect the device's normal operations, only telnet/ftp access.

I created a canned KoboRoot.tgz (for firmware 1.7 ONLY) with these changes to save you the hassle of making them yourself. It was made from the initscripts in firmware release 1.7.4; if you use it with any other firmware and it fails to boot you'll have to do a factory reset. Because there are no binaries in the patch, only a modified /etc/init.d/rcS and a new /etc/inetd.conf, you can easily verify that the code isn't malicious. It has two optional features you can uncomment in /etc/init.d/rcS to (a) syslog to user flash for debugging, and (b) run a user-defined script from .kobo/rc.sh every boot. Both are commented out so they do nothing unless you edit the script to enable them.

Unlike modifying the boot splash screen, this is a pretty safe change as it's completely erased by a factory reset of the device.

Changing the Kobo's boot image

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

The Kobo's boot splash image is stored in unpartitioned space on the internal MicroSD flash. It's an 600x800 4-bit greyscale Windows bitmap (not RLE compressed) starting 1026 512-byte sectors from the beginning of /dev/mmcblk0 (the onboard SD).

Before trying to modify the boot splash image or anything else on the onboard SD card, make a backup of your Kobo's firmware by disk-imaging the internal SD card. If you don't back it up and you damage the kernel or bootloader you won't even be able to factory reset your device; it'll be useless.

If you use a bitmap that is too large you will render your kobo useless, so be careful. I've verified a bitmap of 240120 bytes, saved from Adobe Photoshop CS2, to work on my Kobo Wifi.

`file logo.bmp' should report PC bitmap, Windows 3.x format, 600 x 800 x 4

I haven't found any unix/linux based tools that will write 4-bit greyscale Windows Bitmap images yet, so Photoshop is your best bet. Recommendations appreciated.

The boot splash image may be replaced by putting a compatible bitmap on the user-accessible onboard fat32 partition. It must be located at .kobo/upgrade/logo.bmp. Once placed, disconnect the kobo. It'll detect the upgrade files automatically, apply them, and reboot. On reboot, it'll show the new splash.

(Sorry for the horrible phone-camera pic)

Preparing a development environment for the Kobo Wifi

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

First, I'd like to thank the KoboLabs members for being so helpful and responsive as I try to get up and running with Kobo development. They've pushed several tools, config files, scripts etc to the KoboLabs repository, all of which have drastically reduced the amount of time it's taken to get up and running and largely eliminated the need for reverse-engineering work. This is incredibly unusual for an embedded company, and absolutely wonderful. I was already impressed by their ongoing releases of new firmwares for the original Kobo after the release of the Wifi, as most companies just drop supports old products. Now I'm blown away. Please tell people how damn impressive the Kobo folks are with their after-sales product support and maintenance; I know I will be.

In fact, this whole document has been rendered largely unnecessary by improvements to the KoboLabs code drops. They've posted their build scripts and configurations. To get started, just clone the git repo and read documentation/README.

Overview

You will need to download the CodeSourcery toolchain used for Kobo development, then build the libraries the Kobo uses so that you can link your new executables against them. Qt Embedded, with its dependencies, is particularly crucial. The latest GitHub code drop includes the Qt Embedded configuration used on the Kobo, letting you compile a compatible version of Qt.

Installing Sourcery G++

Download Sourcery G++ 2010q1-202 4.4.1 for your platform and run the installer.

If you're on an x64 RPM-based Linux distro, you may need to install a 32-bit userspace to be able to run the tools. x64 Debian/Ubuntu users will have to install them in the 32-bit chroot, and do all future steps described here within that chroot.

cd ~/Downloads
chmod a+x arm-2010q1-202-arm-none-linux-gnueabi.bin
./arm-2010q1-202-arm-none-linux-gnueabi.bin

Accept the default install path of $HOME/CodeSourcery/Sourcery_G++_Lite when prompted. Accept all other installer defaults.

You now need to symlink your tools to new names, as some of the Kobo makefiles etc expect the tools to be named arm-linux-x where they're named arm-linux-gnuegabi-none-x by CodeSourcery. To do this:

cd ~/CodeSourcery/Sourcery_G++_Lite/bin
for f in arm-none-linux-gnueabi-* ; do ln -s $f arm-linux-${f:23}; done

If all is configured properly, after a logout & login or after running "bash -l" you should now be able to type "arm-linux-g++" and get the response "arm-linux-c++: no input files".

Compiling libraries

Now that we have a toolchain in place, including gcc, binutils, glibc, and all of that provided for us by the wonderful folks at CodeSourcery, we can get on with the real work of preparing our dev environment.

Clone a copy of the KoboLabs git repository to get the required sources and patches:

mkdir ~/kobo
cd ~/kobo
git clone git://github.com/kobolabs/Kobo-Reader.git koboreader

This will take a while, as it's downloading the sources to a lot of libraries the Linux kernel used on the Kobo, and more.

Once you've cloned the repository, it should be easy to get going. A reasonable option might be:

echo "DEVICEROOT=$HOME/kobo/fs" > ~/kobo/build/build-config-user.sh
mkdir ~/kobo/tmp
cd ~/kobo/tmp
../koboreader/build/build-all.sh

... which will use the Kobo build scripts to compile all the libraries and install them in DEVICEROOT, which you set to $HOME/kobo/fs . The unpacked sources and temporary object files will be stored in ~/kobo/tmp , so your git clone of the kobo sources doesn't get messed up by the build.

Now you need to build Qt, which you can do by following the instructions in documentation/README.trolltech

Running your own code on the Kobo

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

The 1.7.4 update tarball (see http://soapyfrogs.blogspot.com/2011/01/getting-kobo-update-urls.html) contains a new copy of /etc/init.d/rcS. Reading it tells us how to replace files on the Kobo's root file system, giving us a way to replace rcS with a patched version that calls out to a shell script on the more easily writable FAT32 main flash, so we can tinker with the system with minimal risk. This initial change is risky, though, as you might render your Kobo useless with a typo!

Replacing files on the Kobo Wifi's root file system

The Kobo Wifi's /etc/init.d/rcS startup script tests for the presence of a number of files within the .kobo subdirectory of the main fat32 partition.

Two notable files are .kobo/Kobo.tgz and .kobo/KoboRoot.tgz. If these files exist, they will be extracted into /usr/local/kobo or / (the root directory) respectively. The system uses this mechanism to apply incremental updates.

We can exploit this mechanism to insert our own files onto the device's main memory or very carefully replace existing files. If you screw it up you might render your Kobo useless and possibly irreparable, so don't try anything unless you don't mind breaking it.

You're much better off copying the firmware from the internal microSD card to a 2G SD card then booting off the external SD by holding "enter" down during power-on. Getting the image for this requires physically opening the Kobo to get to it, unless someone finds an image of it hosted by Kobo somewhere, though.

BTW, the rcS script also looks for .kobo/upgrade and if found, runs /etc/init.d/upgrade-wifi.sh . This is probably the hook for a full upgrade installation. Don't mess with it.

Getting Kobo update URLs

This article is part of an extended series on Kobo development and investigation

Whenever the Kobo eReader connects to wifi, it sends a HTTP/XML request to the Kobo severs with some details about the device, including the current firmware version. The server sends a HTTP/XML response containing various URLs for the Kobo store, etc.

If the firmware version sent by the Kobo isn't the same as the current Kobo firmware, the server also includes the URL for a software update in the HTTP/XML post.

This is apparently only an incremental patch on the main firmware, not a full firmware download, so I still need a full firmware image and will have to extract the MicroSD card from the hardware to get it.

The 1.7.4 update

The URL for the 1.7.4 update is: http://download.kobobooks.com/firmwa...rade-1.7.4.zip

Examination of it tells us some useful things that help open the hardware up some more. See the next post.

How to get the current firmware URL from the server

You can find out the update URL by capturing the wifi traffic of a Kobo with an older firmware when it connects to the network. Use wireshark with the capturing machine's wifi card in monitor mode, or capture the traffic at the router. If you capture off wifi, you'll need to enable 802.11 decryption in Wireshark's protocols->802.11 preferences and enter the key of your network.

In your network capture, look for a request like:

POST /MobileRequest.ashx HTTP/1.1

and in the HTTP/XML response to it you'll find something like:

<UpdateURL>http://download.kobobooks.com/firmwares/kobo2/kobo2-upgrade-1.7.4.zip</UpdateURL>

If you don't have a Kobo with an old firmware, you can achieve the same effect by recording the POST request from an up-to-date Kobo, saving it, modifying it so that <ApplicationVersion>1.7.4</ApplicationVersion> instead reads (eg) <ApplicationVersion>1.6.0</ApplicationVersion>. Because changing the length of the request will corrupt it, you're best off using `sed' to do it. Eg:

sed -e '/^Accept-Encoding/d' -e 's/1.7.4/1.6.0/g' request.txt > request-mod.txt
nc mobile.kobobooks.com < request-mod2.txt > response-mod2.txt

The command deletes the request header that asks the server to gzip the response (for easier reading) and changes the version the "Kobo" announces its self to be running when it connects to the server.

(post series)

Kobo and Kobo Wifi exploration and enhancement

This article is part of an extended series on Kobo development and investigation

---

Apparently I have to make this more obvious:

• Take a backup of your Kobo's SD card before doing anything. If something doesn't work, you can't fix your Kobo without this backup. I will not send you a backup.
• Any device hacking is risky. If you can't afford to break your device, leave now.

---

I just got myself a new Kobo Wifi, after spending a year drooling over my girlfriend's Kobo 1st gen. I immediately felt the impulse to fiddle come over me, resulting in this collection of information about the hardware, firmware, etc as I research what I can do with it. The result is this series of posts.

There's lots to be learned about it from the sticky threads in the Kobo section of the MobileRead forums. I also strongly recommend reading their wiki article on the Kobo, including the FAQ.

About the Kobo

The Kobo is a great device - it has a few flaws, but may good points that greatly outweigh those flaws. The original Kobo was based on the Netronix EB600, the same board as the Cool-er reader, Astak Mentor Lite, booq, and numerous other devices. Netronix's website is scary-bad, but their products are pretty nice. It's not 100% clear if the Kobo Wifi is still an EB600 product - the kernel refers to the "imx357" - but it's certainly Netronix.

Kobo good points include price, format support, gorgeous eInk screen, light weight and nice feel, and a nice-to-use UI. It's also extremely moddable. It uses a nice standard USB mass storage interface for transferring books so you don't need dedicated vendor crapware applications. With the -wifi you can buy books directly on the device, and with the old version you can use the Adobe Digital Editions app if you don't want to use the Kobo application to buy DRM'd books. Support for DRM-free books is perfect, and is just a matter of dropping them onto the flash.

Bad points include somewhat slow menu navigation (some say page turns too, but I find those just fine), lack of full-justified text display option, useless Bluetooth in the 1st gen, and the inability to remove books from the "currently reading" list. It also has a long pause after unplugging it when you've added books, during which it scans them and adds them to the internal SQLite catalog. It's a pity the Kobo Desktop application can't be used for this while it's connected, though it's wonderful that the device can do it its self and doesn't rely on such an application.

Later firmwares improve some prior issues dramatically, allowing things like charging while reading, and are strongly recommended. The latest firmware is out for both the Kobo and Kobo Wifi; they haven't dropped support for the old generation of hardware, which they deserve real credit for. The use of FAT32 means it risks file system corruption if it's unplugged while transferring books - but this will only happen if you mistreat it, won't cause the device to fail to boot or anything, and is trivial to fix.

The Kobo is massively improved by the use of the free and open source Calibre e-Book management software, which is vastly superior to the Kobo Desktop application in every way. You don't need any management app at all (thanks to USB mass storage support) but Calibre is wonderful for document conversion and cleanup, management, automatic conversion of newsfeeds to ebooks, etc.

Kobo modding - hardware/software info

First: Do not try to reflash your Kobo with firmwares from other EB600 devices. Reports from the mobileread.com forums suggest that this will render your device nonfunctional and make it impossible to restore the original firmwares, though others report having successfully converted a Kobo into a Cool-ER Reader. If you try it, make sure you can afford to replace your eReader or are a JTAG wizard before you try converting it to the Cool-ER firmware or anything like that. At the very least, make sure you take a disk image of its MicroSD card first.

There is much to be learned about the Kobo and many other devices on the MobileRead forums. I'm ringerc there, though I'm not a big forum user so you're better off commenting here or emailing me.

The kobo's kernel, operating system, and user data is stored on an onboard 2GB MicroSD card. There's also a full size externally accessible SD card slot for add-on storage. There are three partitions on the internal microSD - a recovery root FS (ext3), the main root FS (ext3) and the user data partition (fat32). The fat32 partition is exported over USB as a mass storage device when the device is connected in "manage library" mode. The MicroSD card has some unpartitioned space before the recovery partition, where it stores the boot splash screen (800x600x4 Windows BMP), kernel, bootloader, hardware config data, epson display setup data, and probably more.

Because everything is on MicroSD, it's wonderful to hack on. Just pop it open, disk image the MicroSD card using a MicroSD adapter in a PC, and you can recover from pretty much whatever screwup you might make without attacking a flash chip with a soldering iron or learning your JTAG voodoo.

The Kobo (original) apparently presents a root console via its internal 3.3V RS232-like serial port headers, though examination of the Kobo Wifi's board suggests that it may lack these headers. This should allow full access if you're willing to crack your Kobo case - possibly literally, because it's made for easy assembly not easy opening, and is by all accounts a pain to open. I had no real problems opening my Kobo Wifi carefully using a butter knife to pop open all the clips around the edge of the front bezel, but I don't recommend that you try this unless you don't mind the risk of breaking it.

I've been informed by someone working on the Kobo that there is no "trusted boot" with signed kernel and bootloader. The Kobo uses u-boot (the Kobo Wifi may use Redboot; not sure yet) and a regular Linux kernel (2.6.28 for the -wifi). Kernel and u-boot sources, along with some userspace helper apps and other things of interest can be found in the Kobo git repository on GitHub. It's a binary drop of tarballs in git (ugh); there's no version history and no way to differentiate Kobo mods from the original Netronix-supplied kernel etc, but at least it's there. Props to gtalusan for posting the updated sources for the new Kobo Wifi model less than a day after I asked him about them. He's also been wonderful about posting updates, fixes, config files etc as I get further into setting up a Kobo development environment.

The numerous ways of updating the Kobo firmware and root file system

The Kobo has an amazing number of different ways to perform firmware updates, plus several ways to apply small incremental patches to the root file system contents.

Smaller firmware patches are applied by putting a file called KoboRoot.tgz in the .kobo directory of the main onboard FAT32 flash. Upon reboot, this is untarred into the / directory then deleted. Another file named Kobo.tgz (also in .kobo) is untarred into /usr/local/Kobo if found, making for somewhat safer updates when only the Kobo application is being changed. There also seems to be a mechanism to update the Kobo firmware using the .kobo/update file, but I recommend staying away from that.

Firmware updates to the Kobo may be performed by copying a new firmware archive file to a separate piece of FAT32-formatted flash. The device then uses that file to rewrite its firmware. There's no direct flashing over USB to worry about. The Kobo Wifi can download new firmwares over wifi instead of having them dropped on it via USB mass storage. Both the Kobo and Kobo Wifi can also be updated via the Kobo Desktop application or by a simple "cp" of the firmware file by putting the device in firmware upload mode then connecting it over USB.

USB firmware upload mode (which seems to use the minimalist linux recovery partition on the microUSB) is entered by turning the device off and unplugging it from USB, then holding down the Menu key then pressing power. Continue to hold Menu until "Initializing USB partition" appears on the screen. The device will show "Please connect your eReader to USB" on the display. Doing so will mount an empty 200MB FAT32 volume labeled "KoboUpgrade" from a USB mass storage volume from "Netchip Technology" (usb 0525:a4a5). You may safely unmount and unplug the Kobo without copying a firmware file to the partition; it will briefly report that it's "updating software" then reboot back into the old firmware with all your books etc unchanged.

Kobo firmware updates can also be performed via the SD card. Some Canadian users received SD cards with firmware updates for the original Kobo. Reports suggest that it prefers <= 2GB SD cards for updates (not SDHC). Instructions here. I have not tested this. Do not try to install firmwares for other eReaders on your Kobo unless you don't mind rendering it permanently non-functional.

The Kobo can boot off an SD card - just hold down the middle button of the D-PAD ("enter") during power-on, until the first five black boxes of the boot progress bar have filled in. This can be used to test new firmwares without rewriting the onboard flash.

I've yet to build a new firmware for the Kobo, though I've been using the KoboRoot.tgz patch method on mine in an attempt to get telnet and FTP access over wifi. Figuring out how it's put together isn't too hard, but it's unlikely I'll be able to get the rights to distribute new firmwares, so using the Kobo's firmware patch mechanism is likely to be safer and more useful.

The Kobo Wifi runs on an ARMv6 CPU on a Motorola MX35 3-Stack compatible board. It has 128MB of RAM. (I previously said "ARM6" but this is incorrect, see comments).

[root@(none) /]# cat /proc/cpuinfo 
Processor       : ARMv6-compatible processor rev 3 (v6l)
BogoMIPS        : 530.84
Features        : swp half thumb fastmult vfp edsp java 
CPU implementer : 0x41
CPU architecture: 6TEJ
CPU variant     : 0x1
CPU part        : 0xb36
CPU revision    : 3

Hardware        : Freescale MX35 3-Stack Board
Revision        : 35120
Serial          : 0000000000000000

What runs on the Kobo

The Kobo Wifi runs Linux 2.6.28, glibc 2.11.1, Busybox v1.17.1, and Qt Embedded 2.6.2 among other things. A fuller list can be found in the KoboLabs git repository.

The busybox configuration is fairly complete, though it lacks a bbconfig command. The full list is easily gained by running "busybox" without arguments on the Kobo, so I won't reproduce it here.

The sd8xxx wireless driver is loaded as a module. Everything else seems to be built in to the kernel, but module support is present.

The Kobo Wifi binaries were developed with CodeSourcery Sourcery G++ Lite 2010q1-202 4.4.1. To build plugins for the Kobo Qt application, rebuild Kobo binaries, or build your own, you will need these tools.