PB62x/740: root + sshd, ftpd, smbd, iptables, usbnet (needs testers)

[x3oo]

dropbox only provides 2gb and pocketbook cloud too.
it would be great to run syncthing on pocketbook

https://github.com/syncthing/syncthing

[gilali]

Hello
Not working on PB743C with FW v6.8.1550

[m4mmon]

The device came from the factory with 6.8.1834.
Pocketbook support page provides one update, 6.8.1835.
I successfully tested jailbreak obviously, USBNet and ssh.

Spoiler:

/mnt/secure # uname -a
Linux pocketbook 3.10.65+ #2 SMP Wed Jun 21 18:01:07 EEST 2023 armv7l GNU/Linux

[contracode]

This is not working on the PocketBook InkPad Color 3 (PB743K3) w/ firmware version 6.8.2480.

[Marek]

Would be really cool if this wasn't completely ancient
For now i have started with dropbear cuz it was the most annoying part of the bunch.

install the pocketbook toolchain from https://github.com/Niluje/koxtoolchain
clone my repo from: https://github.com/notmarek/dropbear-pocketbook
./patch.sh
./mipsbuild.sh
yay you did it the stuff is now built
copy src/dropbearmulti to your pocketbook at /mnt/secure/bin/dropbear
YAYAYY we have working dropbear with key auth and all the jazz
HAVE FUN

(or well just use the binary attached to this post - cuz im so nice or sth)

[neil_swann80]

I'm curious as to why it's not working on the InkPad Color 3 (pb743).

From how I understand the jailbreak to function it first unpacks the binaries "jailbreak" and "su" to /var/tmp, then uses the jailbreak binary (some weird voodoo exploit by sending a buffer to an IPC queue) to change permissions on /mnt/secure, then copies the su binary to this location (making further permissions to this newly situated su binary).

The most obvious failure point would be in setting permissions for /mnt/secure.

I've added a few lines to the jailbreak.app file to provide a simple dialog message that tests for the presence of the files and the required permissions. Could someone experiencing the failure try running it and report back? (They should only show if the root process fails)

[nhedgehog]

Tested it on the device, where enableOPDS was not successful installed.
Installer went through without error message, afterwards I got no root in pbterm but the Jailbreak-installer detected the su binary and asked me if a wanted to uninstall it, which I did and this work well, sind next time Jailbreak asked me to install again.

[neil_swann80]

Originally Posted by nhedgehog

Tested it on the device, where enableOPDS was not successful installed.
Installer went through without error message, afterwards I got no root in pbterm but the Jailbreak-installer detected the su binary and asked me if a wanted to uninstall it, which I did and this work well, sind next time Jailbreak asked me to install again.

Did you prefix your test commands in pbterm with: /mnt/secure/su ???
Sounds like the root/jailbreak worked.

[nhedgehog]

No I didn't. What I just did in pbterm was:
1) NotJailbreaked device
working:
ls /mnt/secure
cp /mnt/secure/device.cfg /mnt/ext1/
not working
ls /mnt/secure >> /mnt/secure/test.tst

2) Jailbreaked device
working:
ls /mnt/secure
cp /mnt/secure/device.cfg /mnt/ext1/
not working
ls /mnt/secure >> /mnt/secure/test.tst
/mnt/secure/su ls /mnt/secure >> /mnt/secure/test.tst

PS: Funfact device.cfg & device.cfg.back are existing in /mnt/secure
device.cfg has have_opds=1 in it, so your installer worked despite my previous comment BUT library does not show the Network library entry. Sorry I didn't check the device.cfg itself previously.

[neil_swann80]

Originally Posted by nhedgehog

not working
ls /mnt/secure >> /mnt/secure/test.tst
/mnt/secure/su ls /mnt/secure >> /mnt/secure/test.tst

The default permissions for /mnt/secure are 755 (after jailbreak). You'll need to change the permissions before running that command.
I can't run that command on my rooted device without making this change either.

/mnt/secure/su chmod 777 /mnt/secure



Weirdly to run mkdir in /mnt/secure with su I need 775 permissions... but for the command you specified 777 is needed. Really odd. But if you can chmod you have root!

Originally Posted by nhedgehog

PS: Funfact device.cfg & device.cfg.back are existing in /mnt/secure
device.cfg has have_opds=1 in it, so your installer worked despite my previous comment BUT library does not show the Network library entry. Sorry I didn't check the device.cfg itself previously.

You'll likely have the same issue as electronicfur, the only solution root, then ssh and nano to make the changes in ebrmain (as ebrmain is on part of the cramfs filesystem rom).

[nhedgehog]

Thanks, yes root is definitely working. Chmod on /mnt/secure too and afterwards I can write on /mnt/secure. Though /ebrmain/config is and remains readonly. I'll check ssh the next days. BTW. firmware is: 6.8.2676-U-W

[neil_swann80]

The bulk of the Pockebook OS is on a compressed read-only rom image - cramfs. Not easy to modify, usually the rom itself is reflashed/rewritten in its entirety to make changes. A command line editor like nano is the only way I know to make the changes to any files within the cramfs on-the-fly.

[EastEriq]

Originally Posted by nhedgehog

Though /ebrmain/config is and remains readonly.

sudo mount -o rw,remount /ebrmain

though, if it is as Neil writes, that all crams is rewritten as bulk for each small change, then it might be better not to abuse of it.

[neil_swann80]

Originally Posted by EastEriq

sudo mount -o rw,remount /ebrmain

though, if it is as Neil writes, that all crams is rewritten as bulk for each small change, then it might be better not to abuse of it.

Swapping a bit here and there CAN BE safe enough, but adding/removing data is more risky and could brick the device.

I have to enter "/mnt/secure/su" rather than "sudo" before my commands in both pbterm and via ssh. I've tried setting a permanent alias without any luck. I ended up writing a simple shell .app launcher for pbterm (to export a variable) as a bodge-fix which works well enough. Works for ssh also if I launch pbterm first.

#!/bin/sh
export udo="/mnt/secure/su"
/mnt/ext1/applications/pbterm
exit

now I can simply enter $udo at the command line.

[neil_swann80]

FYI... After reading through the services.app file I've noticed you can easily run scripts on startup by populating:

/mnt/ext1/system/init.d/*.sh