Customizing the Tolino

[Peripathetic]

Click here to go straight to the final result, otherwise keep reading

While the firmware on the Tolino is quite usable the way it is, and compares favorably to the locked-down competition, it still feels good being able to customize it a bit. So, let's share some ideas what to do and how to do it.

In my case, I like the default reader app, so don't really want to switch to a third-party one at this point, but also have no need for any of its online features and would just like to simply use it as a reader for ePub files I put there on my own.

Here is what I've done so far, with instructions:

• Preliminary Steps: Backup and Clone SD Card (In Case Things Go South…)
• Adventures in the Bootloader Mode: Accessing the Bootloader Mode, Replacing the Stock Recovery with TWRP
• Patching the Boot Image (to Enable ADB and MTP)
• Enabling the 24-Hour Clock (and Changing Other Settings)
• Removing System Crash Reporter (and Making Other Filesystem Changes)
• Fun with APKs: Modifying the Tolino APK
• Modifying EPubProd as a ZIP File
  • Add Hyphenation for More Languages
  • Replace UI Font / Fix Accented Characters in Book Titles & Author Names
  • Disable Calling Back Home / Automatic Update Check
• Modifying EPubProd by Decompiling It
  • Remove Store from Home Screen
  • Adjust Translation Strings
  • Use the Refresh Button to Rescan for Updated Books
  • Remove the Bookmark Icon
• Add Custom Dictionaries [Separate Thread]

I've also been considering the following if I have the time to do it later:

• Make the reader app default to my custom font when opening new books
• Prevent Android icon from showing up when MTP is connected
• Add more book covers to the home screen now that there's more space on it after the store is gone
• Change boot logo (don't really mind the current one though)

What are the things you did to make your Tolino work better for you?

[ottischwenk]

Originally Posted by Peripathetic

What are the things you did to make your Tolino work better for you?

I tried TWRP but finally removed it.
But added
- OneToucher - Apps Change
- Total Commander - File Manager and Apps-installer
- Calibre Companion - library Manager
- AlReader - Reader App for DRM free books
- Golden Dict

On Page2 and Shine3 I changed the built in SD against a 64GB and added Kiwix with Wikipedia.

For any of the above, I can share the instructions how to do it: let me know if anyone is interested. For the record, my device is a Shine 3.

Im interested!

[Peripathetic]

Originally Posted by ottischwenk

Im interested!

Which one do you want to know about? Or all of them? (That's a lot of writing!)

[ottischwenk]

Originally Posted by Peripathetic

Which one do you want to know about? Or all of them? (That's a lot of writing!)

Whats about an update.zip?

[Last Frontier]

Originally Posted by Peripathetic

[*]Add custom dictionaries
[*]Add hyphenation routines for other languages

Although I use KOReader, I am interested in modifying these two options of the original Tolino reading program. What format would be used for the dictionaries?

(I also have the Tolino Shine 3 with the latest firmware update).

[Poppaea]

I'd be interested because I guess I'll have to have a my own Tolino in the near future due to CARE DRM ! Right now I have a borrowed one here. The firmware is a bit of a nuisance as it is and could be considerably improved.

I'd love the clock, the font setting in all books, getting rid of the bookmark. hiding the store recommentations and custom dictionary installation, please.

If you need more ideas of what can be done or what is nice to have you could take a look at the Kobo patches.

Thank you!!!

[Peripathetic]

Great to see so much interest. Thank you. I'll do my best to share all I know. It might need a bit of time though.

Since it seems I can't edit my posts here, it's all the more important then that I try to get everything I write more or less complete the first time, so that there's no need for corrections in the form of more posts further down the thread, which would make things difficult to follow. Bear with me.

[ottischwenk]

Originally Posted by Peripathetic

Great to see so much interest. Thank you. I'll do my best to share all I know.

Interesting for me would be:
when MTP, changing the Tolino Partition from FAT32 to Ext to avoid FAT32 limitations - 4GB File size, ~ 12.000 files in Folder aso.

[Peripathetic]

Apparently posts can be edited after all, it's just that my account somehow got blocked from posting completely but this is now resolved -- thank you to the moderator who intervened on my behalf.

[PeterT]

The other option you might like to use is creating pages in the MobileRead Wiki documenting the process you have followed.

[Peripathetic]

Ideally, before doing anything else:

• Make sure the device is completely powered off
• Use a plectrum or another, preferably plastic, tool to pry open the back cover along the edges:

• Touch a metal surface to discharge any static electricity
• Remove SD card from slot:

• Connect SD card to computer through a USB or built-in card reader
• There are many partitions on the card, and most of them are in the format unrecognized by Windows, so you will get prompted many times to format them. Answer "no" each time.
• Make an image of the SD card. You can use VConsole's Flash Drive Image Creator (graphical interface), or Chrysocome's (command-line) DD for Windows, or another tool of your choice. Ideally, do it one more time, and make sure the images match, for example with fc /b (command-line tool included with Windows).
• Optionally, clone the image to a new SD card and keep the original one as a backup. You can use Flash Drive Image Writer, or DD again, from the pages linked above.
• If you want to use a larger SD card, clone the original image first, and then resize the user data partition (the only one with the FAT32 filesystem) to fit all available space with a tool such as GParted. If you foresee installing more apps, you can perhaps increase the size of the /data partition (the size is 500MB by default, note: I didn't test this).
• Put the SD card (original or cloned one, depending on your choice) back in its place and power on the device to make sure it works. The back cover seems to be a tight fit: you need to press all 4 corners at the same time to make it snap on. In my case, heating it up a bit with a hairdryer also helped.

If you don't backup the SD card you should still be fine, as long as you:

1. Don't accidentally overwrite the bootloader (if not changing the boot logo, the risk is generally low)
2. Don't mess up the partition layout
3. Don't suffer from a hardware failure of the included SD card (most likely of the 3)

So this step is optional.

[ottischwenk]

Here ist an Image of Shine3 for a 16 GB SD Card with a ~1GB System Partition.
You will need it, when you want to install more apps - 504MB (original size) is very little.

[Peripathetic]

Accessing the Bootloader Mode

• Install the Android ADB driver if you haven't already (bootloader driver is included with it)
• Power off the device completely (hold button until dialog appears and choose "Switch off")
• Connect device to computer via USB cable
• Optionally, open the Device Manager (press Win-X, then M) and unmute audio to see and hear when a device is connected and disconnected
• Press and keep holding the button for 30 seconds (note: this step is specific to Shine 3, which has only one button, other devices have different ways of entering the bootloader mode)

Device will enter the bootloader mode and Windows will start installing the driver for it. Meanwhile, after a couple of seconds, the device will leave the bootloader mode and proceed with normal startup (boot), which can't be prevented. If you left the Device Manager open, you could have been able to see an "Android Bootloader Interface" device show up briefly, and then disappear.

Replacing the stock recovery with TWRP

About Recovery and TWRP:

Spoiler:

Most Android devices include a separate, minimal operating system that can be booted into (started) if the main one doesn't work. This is called "recovery [mode]." The device vendor's version of this system ("stock recovery") is usually very simple: it can be used only to wipe all user data or install updates (with a signature check), which is not very useful for our purposes. This separate operating system, stored on its own recovery partition, can be replaced with a different, much powerful one. The most prevalent such system for modern devices is called TeamWin Recovery Project (TWRP).

• Download Ryogo's TWRP for Tolino Shine 3 (note: this is device-specific, other devices need their own builds)
• Download the Android SDK Platform Tools, which include Fastboot and ADB (to be used later)
• Open the command prompt (Win-X, C) and run:
  fastboot boot twrp.img
• The tool will hang at a prompt saying: Waiting for device
• Enter the bootloader mode once again, as described in the previous section. If everything goes well, the device should run TWRP from the external image file (twrp.img):
  
  

So far, nothing has been modified on the device yet. If you do not want to replace the stock recovery, you can still use TWRP occasionally this way but it is cumbersome. Eventually, we want to flash the image to the device so that it can be used on its own. However, it's good practice to make sure an image is bootable before flashing it.

• To flash the recovery image, run:
  fastboot flash recovery twrp.img
• And make the device enter the bootloader mode once again, as described above.

Note that after flashing an image, the device remains in bootloader mode, which gives us an opportunity to flash another image at once.

• To flash a (modified) boot image, which is the remaining thing to do while we are in the bootloader mode:
  fastboot flash boot boot.img

However, we don't have a modified boot image yet: this will be covered in the next installment.

One way to enter recovery mode on the Shine 3 is to make sure the device is powered off, USB cable is not connected, and hold the button for about 25 seconds, at which point the screen should show the TWRP starting. There is another, more convenient way as well, more on that later.

[Peripathetic]

About boot images:

Spoiler:

A boot image is the first thing to be run by the bootloader when a device starts in the usual way (that is, not in recovery or bootloader mode). Here, it consists of an operating system (Linux) kernel (core) and a small filesystem with a couple of basic scripts and utilities to get things going such as mount other partitions.

Why

I can think of at least two reasons to do it, feel free to add your own:

• Enable the Android Debug Bridge (ADB) interface to make all kinds of changes to the device with a utility program from a computer
• Change the way files on the device are made available when it is connected via USB: instead of exposing the user data partition as a mass storage device, use the MTP mode. The benefit is that the device can now be used while it is connected to the computer and even when files are being transferred.

How

• Obtain the boot image: either by (1) extracting the file boot.img from the update.zip manually downloaded from the Tolino Website (this file will be useful later), or - if you really must - by (2) reading it from your device, for example:
  
  adb shell dd if=/dev/block/mmcblk0p1 of=/cache/boot.img
  adb pull /cache/boot.img
  
  Note: this will work from the recovery mode only, unless ADB is already enabled in the boot image.
• Extract boot.img: there is a multitude of ways to do it but if you're using Windows, the most convenient method is to use Android Image Kitchen: drag the file boot.img onto unpackimg.bat and a ramdisk directory will appear
• Inside the unpacked image, there are two files of interest: default.prop and init.rc
• In default.prop, we change the three properties to read:
  
  ro.debuggable=0
  ro.secure=0
  persist.sys.usb.config=mtp,adb
  
  Or, if you do not want to change the USB connection to MTP the last line should read:
  
  persist.sys.usb.config=mass_storage,adb
  
  
• Next, in the file init.rc, we change:
  
  setprop ro.adb.secure 0

The point is not just to enable ADB but to let us have superuser privileges (popularly known as "root"), which is necessary to do anything interesting. The above steps are not enough to accomplish this, however: the ADB daemon binary provided with the boot image, located under sbin/adbd, will still refuse to run as root, so it has to be either (a) replaced or (b) patched.

For the sake of argument, patching would involve finding out where it makes the setuid() and setgid() calls to drop root privileges and replacing them with NOPs. From the android_filesystem_config.h file in the Android source (or prior knowledge) we can learn that ADB runs under the UID 2000 shell, so that would be the value to look for.

Replacing the binary is much easier though. We could compile one ourselves. Or we could perhaps borrow one from a version of the ADBD Insecure app. However, since as I get older I also become more lazy and this month I'm about to get older again, I reached straight for the low-hanging fruit and helped myself to the adbd binary from this article in German describing how to obtain root access on the Tolino Shine 3, which (although referring to an earlier firmware version) practically guaranteed it was going to work and indeed it does.

Whichever way you prefer, the last steps are then:

• Replace or patch sbin/adbd to allow superuser access
• Run repackimg.bat to create the modified image file, image-new.img

Conclusions

I wanted to write the above step-by-step since I haven't seen it written anywhere, so maybe it will be helpful to some people at some point but if you just want the result, it is attached here (for the most recent firmware version as of now): boot-13.2.1-adb-root-mtp.img.zip

For the instructions how to flash it, see the previous post.

Let me also add that recovery images (twrp.img or recovery.img) can be edited in a similar way, although for TWRP it would be more useful to compile it from the sources for any more significant changes.

One more thing to mention is that enabling ADB can lead to a potential security issue: when you plug in to charge your device from an unknown source (such as in a public place) you can never be sure what you are connecting to is just a charger: someone could potentially attempt to scan your device for data using ADB. Many devices use fingerprinting to limit ADB access to pre-approved computers but here it's accessible to everyone.

On the other hand, the Tolino already gives access to all the files to anything connected through USB by default, so perhaps the best way to address this issue is not to charge it from untrusted sources, which should be easy enough as the battery lasts quite a while.

Using ADB

• To check if ADB is working correctly, run:
  
  adb devices
  
  List of devices attached
  ########,... device
  
  If the list is empty, the device is not connected.
  
• To check if ADB has superuser access:
  
  adb shell echo $USER_ID
  
  0
  
  If the user ID is 2000 then ADB is running with limited privileges (this is the case if you keep the original sbin/adbd intact).
• If, after using ADB, you want to eject the device in Windows but it is "busy," you have to run:
  adb kill-server
• Finally, enabling ADB also opens up a convenient way to run TWRP (enter recovery mode):
  adb reboot recovery

For anything that follows, I assume you have ADB and/or TWRP access set up.

[Peripathetic]

Option #1 (Needs ADB Enabled)

Enable the 24-hour clock using the hidden Settings GUI:

• Start the hidden Settings activity using ADB:
  adb shell am start -n com.android.settings/.Settings
• Check the box for:
  Date & time → Use 24-hour format
• Swipe up from the bottom to go back to whatever was open before

Option #2 (Using TWRP)

If you already have TWRP installed:

• Enter recovery mode:
  adb reboot recovery

Or, you can also do this without any of the prior changes to the device, by starting TWRP from an external image with fastboot boot twrp.img as described above.

• Make sure /data partition is mounted (it should be, so a "failed [...] busy" message is in order):
  adb shell mount /data
• Retrieve the settings database:
  adb pull /data/data/com.android.providers.settings/databases/settings.db
  adb pull /data/data/com.android.providers.settings/databases/settings.db-journal
• Download SQLite Tools for Windows, which includes the sqlite3.exe utility and run:
  sqlite3 settings.db "UPDATE system SET value='24' WHERE name='time_12_24';"
• Note: the settings.db-journal file will be automatically deleted by SQLite, this is expected behavior. Also delete it from the device:
  adb shell rm -f /data/data/com.android.providers.settings/databases/settings.db-journal
• Send the modified settings database back:
  adb push settings.db /data/data/com.android.providers.settings/databases/
• Set the correct permissions and ownership metadata for the newly-uploaded file:
  adb shell chown system.system /data/data/com.android.providers.settings/databases/settings.db
  adb shell chmod 660 /data/data/com.android.providers.settings/databases/settings.db
• Reboot into system:
  adb reboot

Other settings can be changed much the same way but this was the only one annoying me so far. If you prefer a graphical interface, the database file can also be edited with SQLiteSpy or SQLite Browser.