KOReader running on BQ/Fnac devices

[paagtui]

Hi,
I do not want to give up... ;-)

Reading at the end of the bq developer program page in wayback:

To create this image:

1 Package the root filesystem on a tar.gz.
2 Use gpg to encrypt and sign this file using the hackers-keyring-host.tar.gz keyring.
3 Place encrypted image and the signature inside a folder called bqupdate with names update.img and update.asc respectively.
4 Zip the folder.
5 Share the folder with the community

Could that be a way forward?
I have also seen people setting up a Docker with the devel tools...

[pazos]

Originally Posted by paagtui

Hi,
I do not want to give up... ;-)

Reading at the end of the bq developer program page in wayback:

To create this image:

1 Package the root filesystem on a tar.gz.
2 Use gpg to encrypt and sign this file using the hackers-keyring-host.tar.gz keyring.
3 Place encrypted image and the signature inside a folder called bqupdate with names update.img and update.asc respectively.
4 Zip the folder.
5 Share the folder with the community

Could that be a way forward?
I have also seen people setting up a Docker with the devel tools...

Since you bought an ereader to read please read my previous comments

The hackers keyring used to sign an update is valid ONLY IF the bootloader is unlocked. To have an unlocked bootloader you need to follow the steps that no longer work.

Again: please create your own thread elsewhere if you insist it's doable. Let's see how it's going.

[jrjove]

Originally Posted by pazos

Unlock

By default the device is locked (no shell access, no external booting, store, adobe drm) and firmware updates need to be signed with BQ private key.

BQ provides instructions to install a Developers edition firmware on https://blog.bq.com/es/bq-ereaders-developers-program/.

Note 1: Bq pages went down, probably forever. Please use http://web.archive.org/web/202007200...opers-program/ instead.

Note 2: In february 2021 firmware files hosted on amazon cloud are no longer available

Send me a private message and I can pass you a link to the file. Only available for Cervantes 2013, Cervantes 3 and Cervantes 4.

You need to install Developers edition firmware to be able to install KOReader or other software. This means you'll lose the nubico store and adobe drm support.

As Bq servers went down you can not register your serial number and the firmware installetion crashes.
Any idea how to install Developers edition firmware on a Cervantes 3 device?

Regards

[pazos]

Originally Posted by jrjove

As Bq servers went down you can not register your serial number and the firmware installetion crashes.
Any idea how to install Developers edition firmware on a Cervantes 3 device?

Regards

Yup. I need to update OP. The answer is: you can't follow this guide anymore and there're no alternatives AFAIK.

A motivated user could try to open the device, find the serial port, solder it to a TTL USB serial, hook it to a computer and see if you get a login prompt (and hope there's no password in there).

Honestly I've never played with stock firmware, so I'm not sure how hardened it is. I guess not much and, once you get shell access, you can start tweaking things in the root filesystem without problems.

[mitseas]

Originally Posted by pazos

Yup. I need to update OP. The answer is: you can't follow this guide anymore and there're no alternatives AFAIK.

A motivated user could try to open the device, find the serial port, solder it to a TTL USB serial, hook it to a computer and see if you get a login prompt (and hope there's no password in there).

Honestly I've never played with stock firmware, so I'm not sure how hardened it is. I guess not much and, once you get shell access, you can start tweaking things in the root filesystem without problems.

I have bought a Cervantes 4 from BQ back in the day, last time I tried to open it It didn't want to start some led blinking and the backlight turned on while the display never showed anything. Anyway I opened up the device and there are indeed serial debugging pins 2 of them from a glance. I attached my Arduino on one and I got to a login screen. All combinations I tried didn't work but I'm not giving up yet. I would like to offer you ssh access to the machine connected so you can try and see if we can manage something. If yoy would be interested in that Pazos tell me.
Just to make sure, if I am still in stock I can't install the Developers Edition somehow because it needs to connect with some server which is not up?

[QuixoteDon]

Motivated user here. I freed a Cervantes 4 a few weeks ago.

Registering the device with the now defunct online service would just have created one of this flag files, depending on the model:
/mnt/private/hackers_ok
/mnt/private/hackers_e60q22_ok
Installing hackers firmware checks if the file exists.

1. Open the device by sliding a guitar pick around it. The screen sticks with some adhesive to the top half of the case. Be careful not to break your screen.
2. There are at least 3 groups of the four pads that look like serial ports. The boot console is the one at the top.
It uses TTL, so you'll need a level shifter. I used a BusPirate to connect.
3. Send ESC early at boot to enter the U-Boot console.
4. Add the kernel parameter 'init=/bin/bash' and boot. This will bypass most of the startup an go straight to a root shell.
5. Use sed to clear the root password from /etc/passwd (or /etc/shadow, I don't remember), reboot.
6. Login as root.
7. touch /mnt/private/hackers_ok /mnt/private/hackers_e60q22_ok
8. Clean the adhesive residue (not the strip, the other side) with alcohol, reassemble the device.
9. Now you can flash the hackers firmware as if your device was registered.

This instructions are from memory, so details like the pinout of the serial port, sed usage and how to set U-Boot environment variables are left as an excercise to the reader.
It might be possible to skip 5 and 6 and create the flag files from the recovery shell if /mnt/private is available or can be mounted from there. I did not try that.

It might be possible to get the flag files written without opening the device. The original firmware is pretty old, I would be surprised if there is no vulnerability in it that allows that.

[BalooRJ]

Hello, for all running KOReader on BQ Cervantes devices, I noticed one thing:

Is there an easier way to move downloaded dictionaries to the dict folder in /mnt/private/koreader/data/dict/? I noticed that the folder in /mnt/private/koreader/data/dict/ is always invisible, even when looking through the file browser on the device. In comparison, creating a folder in /mnt/public/ called dict will make all files placed within this folder not get moved to the device through USB Mass Storage mounting. Since only the public folder is able to be mounted in USB Mass storage, it makes it a bit more cumbersome for me to move dictionaries when I have to create a randomly-named folder in the Books folder, and then go to telnet, mount that random folder, then mv to /mnt/private/koreader/data/dict. Is this a feature of koreader to hide the /dict/ folder from the file browser on the BQ Cervantes? I would like to be able to remove a dictionary if I find it is not of adequate quality without having to go through telnet. Thank you.

[pazos]

Originally Posted by BalooRJ

Hello, for all running KOReader on BQ Cervantes devices, I noticed one thing:

Is there an easier way to move downloaded dictionaries to the dict folder in /mnt/private/koreader/data/dict/? I noticed that the folder in /mnt/private/koreader/data/dict/ is always invisible, even when looking through the file browser on the device. In comparison, creating a folder in /mnt/public/ called dict will make all files placed within this folder not get moved to the device through USB Mass Storage mounting. Since only the public folder is able to be mounted in USB Mass storage, it makes it a bit more cumbersome for me to move dictionaries when I have to create a randomly-named folder in the Books folder, and then go to telnet, mount that random folder, then mv to /mnt/private/koreader/data/dict. Is this a feature of koreader to hide the /dict/ folder from the file browser on the BQ Cervantes? I would like to be able to remove a dictionary if I find it is not of adequate quality without having to go through telnet. Thank you.

If I undetstood you https://www.mobileread.com/forums/sh...13&postcount=7 no longer works?


/mnt/private is not exporter via USB. Only /mnt/public and /mnt/sd are.

Was a design decision based on a previous attempt at make USBMS work inside KO. Since we currently handle USBMS outside the program I guess it is safe to export /mnt/private too.

A lot of errors. More thab normal. Sorry, on mobilre ATM

[BalooRJ]

Originally Posted by pazos

If I undetstood you https://www.mobileread.com/forums/sh...13&postcount=7 no longer works?


/mnt/private is not exporter via USB. Only /mnt/public and /mnt/sd are.

Was a design decision based on a previous attempt at make USBMS work inside KO. Since we currently handle USBMS outside the program I guess it is safe to export /mnt/private too.

A lot of errors. More thab normal. Sorry, on mobilre ATM

Thanks for the response as always pazos. I seemed to have figured out the issue. This does work, but if you use the /mnt/public/dict folder, it moves everything to /mnt/private/koreader/data/dict/, so if you drag something into /mnt/public/dict/ and the file conflicts (same name) it will overwrite an existing dictionary, and you are unable to see what files are in the existing dict folder because /mnt/public/dict will not display them. I was not realizing that the dictionaries were there because the files were disappearing from /mnt/public/dict/ display on my computer. That seems to have been my issue. Thanks as always for your help pazos.

[pazos]

Yup. The whole thing is a bit messier than I would like.

In a perfect world the user data would be on the public partition (like on android) and would be exported on USBMS session.

Sadly doing that now without breaking the workflow of the (10, 50, 100?) BQ users would be non trivial and a bit messy by itself.

OTOH exporting the private partition can be done without breaking backwards compatibility assuming KOReader is the only program the user has installed and there're no daemons running at the time of export (mostly the SSH server bundled with KO).

[mitseas]

I have successfully broke free of the stock firmware. At least according to my usb to ttl console output. it says hacker in the shebang. I got a new screen from aliexpress but while it is working I don't have touch. All the buttons seem to work. Haven't tested to see if the touchscreen is being recognized. I only tried to run evtest which is missing. I am contemplating going back to stock with a complete reset just to be sure I haven't messed anything while I was trying to hack my way into the hackers firmware.
One interesting fact is that quite shorltly I get a freezing user space programs and I can't interact with the console at least not until I press the power button go to sleep then press it again and go back where I can interact with the machine for a couple of seconds before it freezes again. I guess that is a suspension mechanism, but can I disable it somehow at least until I figure out what is going on with my touchscreen?
If I need to ask for a refund or fix it?

[mitseas]

I am creating a new reply since I don't seem to be able to edit previous posts. After replacing my screen I am glad to say that I am now using KOReader on my BQ Cervantes 4. You can install the developer's firmware over stock even now following the guidelines of QuixoteDon. I can create a more detailed guide if somebody wants it.
The only thing that I tried and seems to not work as before is the frontlight when I try manually to increase Brightness it seems to be working as intended but the Warmth slider while it is going from 0 to 9 it seems to be decreasing brightness (I guess maybe removing blue light which makes overall brightness be perceived as lower) yet when I pass to 10 or higher it shuts all leds altogether. While I remember on the stock firmware it went to a really bright orange colour.

[mitseas]

After replacing my screen I have installed KOReader on my BQ Cervantes 4 and everything seems to be working alright. Now other than getting used to the new UI the only thing that seems missing is the warm light.
In the Frontlight, brightness slider seems to be working as intended yet the Warmth only has a feedback from 0 to 9 which seems to be lowering brightness as you go up and upon hitting 10 it seems to disable frontlight altogether. On stock firmware (not developer's) you could make it a very bright orange. Is there any way to test it without going back to stock?

P.S. I can write a detailed guide on how to install developer's firmware over stock even now if somebody wants it.

[pazos]

Originally Posted by mitseas

After replacing my screen I have installed KOReader on my BQ Cervantes 4 and everything seems to be working alright. Now other than getting used to the new UI the only thing that seems missing is the warm light.
In the Frontlight, brightness slider seems to be working as intended yet the Warmth only has a feedback from 0 to 9 which seems to be lowering brightness as you go up and upon hitting 10 it seems to disable frontlight altogether. On stock firmware (not developer's) you could make it a very bright orange. Is there any way to test it without going back to stock?

P.S. I can write a detailed guide on how to install developer's firmware over stock even now if somebody wants it.

A detailed guide would be awesome, thanks. Just make a new post and I'll link it in OP.

As far as warmth please check with an old version of KOReader (something 2021 up to mid 22) to discard a regression in common code.

Warmth works or at least worked fine here. Not sure if it behaves exactly like stock but I can bet there're no improvements to be made there.

The only thing that differs from stock is double click actions on the home button, which are not available on KO.

There's a ticket on github in case you want to dig in that particular feature.

[mitseas]

Originally Posted by pazos

As far as warmth please check with an old version of KOReader (something 2021 up to mid 22) to discard a regression in common code.

That is as easy as ssh from within KOReader and unziping that version in /mnt/private?
By the way before trying KOReader the stock reading app was crashing (on developer's firmware) on every page turn.
Now that I am already in the developer's mode can I reset the device to an "almost" original state to check the Frontlight and the stock reading app? All the files I used are from the archive dot org so they may not be the latest. Do you maybe have those?