iKobo Clara HD Notes for Nickel
iLast Updated: 2021-07-10
i------------------------------
i
iMy ereader of choice is the Kobo Clara HD and I particularly like it because my
ieyes hurt less when reading for long periods of time compared to when I read on
imy phone or when I still had my iPad. It also had much longer battery life and
ionly need to charge it about once every two weeks when I read for about 4 hours
ion average daily.
i
iHowever, the two notable things I don't like about it is it's included
itelemetry, like using Google Analytics by default and keeping a unique salt
i
iSpyware/Anti-Features:
i* Google Analytics (a lot of actions, if not everything, is sent to Google)
i* Auto-update by default
i  * You may or may not like this, I personally hate it
i  * I don't like the new redesign in firmware v4.23.15505
i
iI'm also assuming your Kobo reader and it's SD card's device file would be
iwould located at /dev/sdf and be mounted at /mnt/kobo.
i
iIf you're going to not be using Nickel and instead be using something like
iPlato, there's a newer version of this article available, but the notes are
ifor ~KSM~ loading it directly and not through k/fmon because I don't want to
iload Nickel if I'm already using a different reader.
i
hPlato Github Repo      URL:https://github.com/baskerville/plato
1Loading Plato Directly kobo-clara-plato.gph
i
iUPGRADE/BACKUP INCLUDED SD CARD
iWhile the included 8GB microSD card is decent for storing your ebook library
ithat may not have a lot of images, that would likely not be enough if you were
iaiming to read some comics on your ereader as they can be pretty big (quite a
ifew of mine are over a gigabyte, with some over 8). Luckily, you can replace
ithe microSD card with another one.
i
iBefore upgrading, you should backup the SD card to into an image file so the
ifilesystem would be preserved when putting the contents of the image on the new
iSD card. I'm using the command `dd` but there might be another program doing
ithe same thing. Even if you're not going to upgrade, I still suggest to backup
ithe SD card in case something goes wrong.
i
idd if=/dev/sdf of=kobo_sd.img conv=sync
i
iAfter this is done, you can plug in your new SD card and reimage kobo\_sd.img
ionto it. With dd, you can do something like:
i
idd if=kobo_sd.img of=/dev/sdf conv=sync
i
iChecking it's partition table via `lsblk` or `fdisk -l` should show three
ipartitions. If you replaced the SD card with something bigger, than you should
iresize the third partition.
i
iBYPASSING REGISTRATION ON SETUP
iWhen setting up your Kobo, you will be asked to sign into a Kobo account. There
iare other options like logging in via Google, Walmart, and other stores, but I
idon't like having to login to a device that would likely not be connected to
ithe public internet. Fortunately, you can bypass this by choosing that you
icannot connect to a Wi-Fi network and mount your Kobo to your computer. In,
i`.kobo/KoboReader.sqlite`, you can run:
i
i```sh
iecho "INSERT INTO user(UserID,UserKey) VALUES('1','');" \
i       | sqlite3 KoboReader.sqlite
i```
i
iThis way you don't have to install their application just to be able to use
iyour device.
i
iNote: Do not try doing this when you still have your SD card mounted before you
isetup your device. The device's screen would likely not update, at least on an
iearly firmware version like v4.7.10733.
i
iBLOCKING GOOGLE ANALYTICS AND OTHER TELEMETRY
iJust adding `0.0.0.0 analytics.google.com` to /etc/hosts may be enough to block
imost of the telemetry from being sent. However, you can try intercepting what
iconnections your Kobo is making via mitmproxy set to transparent mode or using
ia hosts file that blocks all connections to Google (but not necessarily to
iKobo's servers) like [Baobab's host file](https://codeberg.org/baobab/hosts)
i[(raw file here)](https://codeberg.org/baobab/hosts/raw/branch/master/hosts).
i
iTo put the hosts file without root (which will be detailed in another section),
iyou can make a directory called etc, put the hosts file in there, and tar it
iinto a file called KoboRoot.tgz.
i
i```sh
imkdir etc
iwget -O etc/hosts https://codeberg.org/baobab/hosts/raw/branch/master/hosts
itar czvf KoboRoot.tgz etc
icp KoboRoot.tgz /mnt/kobo/.kobo/
i```
i
iWhen you move a tar file with that name into your Kobo's .kobo folder, it's
icontents gets untarred into it's root at / when the device is turned on again,
iwhich is usually done for their updates but can be used for custom files like
ithis and gaining root access.
i
iGAINING ROOT ACCESS VIA TELNET
iTo gain root access, we first need to get the `/etc/inittab` and
i`/etc/inetd.conf` which you can get from mounting the SD card's first partition
iinto your computer (the second partition seems to be like a backup). You should
icopy those two files into a folder called `etc` somewhere (probably not on the
iSD card).
i
iIn the `etc/inittab` file, you should add these two lines:
i
i```
i::sysinit:/etc/custominit.sh
i::respawn:/usr/sbin/inetd -f /etc/inetd2.conf
i```
i
iYou would want to rename the etc/inetd.conf file you copied into
ietc/inetd2.conf (or whatever the custom inetd.conf's filename is) and when
iediting that, you should add:
i
i```
i23 stream tcp nowait root /bin/busybox telnetd -i
i```
i
iHowever, if there is already a commented line for root telnet in the
iinetd2.conf, you should probably still add the above line and ignore the
icommented line as that may or may not work (didn't for me).
i
iTo actually start inetd, you should add these lines somewhere in
i/etc/custominit.sh:
i
i```
imkdir -p /dev/pts
imount -t devpts devpts /dev/pts
i/usr/sbin/inetd /etc/inetd2.conf
i```
i
iAfter that, you just have to tar the `etc/` folder again and copy it to your
iKobo's onboard/third partition's `.kobo` folder.
i
i```sh
itar czvf KoboRoot.tgz etc
icp KoboRoot.tgz /mnt/kobo/.kobo/
i```
iNow you could put your SD card back into your Kobo provided that they are
ialready unmounted and turn your Kobo back on.
i
iAfter connecting to the WiFi, simplying telnetting (?) into your Kobo and
ilogging in as root should give you a root shell. :D
i```
itelnet $KOBO_IP
i```
i
iBy default, root has no password so you should change it with `passwd`.
i
iGETTING SSH AND SFTP ACCESS VIA DROPBEAR
iI'm using Dropbear instead of OpenSSH because it's better suited for embedded
ihardware like the Kobo Clara HD. Obviously we can't copy a binary compiled for
iamd64 or whatever architecture your compiling computer is running so we would
ihave to cross-compile for our ereader.
i
iFortunately, we are not required to cross-compile gcc/clang and friends as we
ican simply download the linaro arm toolchain which has the binaries for gcc and
iothers included. You could get the toolchain [here](https://releases.linaro.org/components/toolchain/binaries/latest-7/arm-linux-gnueabihf/)
iand you should get the release that matches your host's architecture. After
iuntarring the file, you should also set your PATH variable to the toolchain's
ibin/ folder so you don't have to manually set the CC and CXX variables when
ibuilding Dropbear.
i
i```
iwget https://releases.linaro.org/components/toolchain/binaries/latest-7/arm-linux-gnueabihf/gcc-linaro-7.5.0-2019.12-x86_64_arm-linux-gnueabihf.tar.xz
itar xvf gcc-linaro-7.5.0-2019.12-x86_64_arm-linux-gnueabihf.tar.xz
iexport PATH=$(pwd)/gcc-linaro-7.5.0-2019.12-x86_64_arm-linux-gnueabihf/bin:$PATH
i```
i
iNow you could get the source for Dropbear and cross-compile it. The source can
ibe found on their [homepage (clownflared)](https://matt.ucc.asn.au/dropbear/dropbear.html) or [github repo](https://github.com/mkj/dropbear/releases).
i
i```
iwget https://matt.ucc.asn.au/dropbear/releases/dropbear-2020.81.tar.bz2
itar xvf dropbear-2020.81.tar.bz2
icd dropbear-2020.81
i./configure --enable-static --host=arm-linux-gnueabihf
i# MULTI=1 combines the binaries like busybox does and is also smaller in size
imake MULTI=1 PROGRAMS="dropbear dropbearkey"
i```
i
iNow you only need to copy the `dropbearmulti` binary over to your Kobo. What
iI've done is running `python3 -m http.server` and downloading the file onto my
iKobo but you could also just copy it onto the microSD card.
i
i```
iwget your.computer.ip.or.fqdn:8000/dropbearmulti
ichmod +x dropbearmulti
imv dropbearmulti /usr/bin
icd /usr/bin
i# below are optional but dropbear(key) would be an argument for dropbearmulti
iln -s dropbearmulti dropbear
iln -s dropbearmulti dropbearkey
i```
i
iNow you only need to generate the host keys. My client key is ed25519 so I'm not
igoing to generate the others.
i
i```
imkdir /etc/dropbear
idropbearkey -t ed25519 -f /etc/dropbear/dropbear_ed25519_host_key
idropbear -F -r /etc/dropbear/dropbear_ed25519_key
i```
i
iNow you could ssh into your Kobo and login as root. Remember to change root's
ipassword beforehand though if you haven't already! I suggest copying your
ipublic key to your Kobo via ssh-copy-id so you don't have to enter root's
ipassword all the time and so password-based logins can be disabled in dropbear.
i
iTo start it on boot, you could add the following line to `/etc/inetd2.conf`:
i
i```
i22 stream tcp nowait root /usr/bin/dropbearmulti dropbear -i -r /etc/dropbear/dropbear_ed25519_key
i```
i
iFor some reason, the symlink wasn't resolving for me inetd so I had to call the
imulti-binary directly. You could also add the command/args into
i/etc/custominit.sh.
i
iFTP ACCESS
iIf you don't or can't use sftp or scp for some reason, there's always ftp :D
iThere's a ftp daemon included in busybox so all we have to do is enable it in
i`/etc/inetd2.conf`:
i
i```
i21 stream tcp nowait root /bin/busybox ftpd -w -S /
i```
i
iThis would share the entire filesystem so you may or may not want to restrict
ithe shared directory to maybe just your ebook directory (`/mnt/onboard`) and
imove the files out via telnet or ssh.
i
iREFERENCES AND OTHER LINKS
hRémy Grünblatt - Kobo Aura H2O electronic reader hacking     URL:https://remy.grunblatt.org/kobo-aura-h2o-electronic-reader-hacking.html
hYingtongli - Bypassing Kobo Account Registration       URL:https://yingtongli.me/blog/2018/07/30/kobo-rego.html
hMobile Read Forums - Disabling Google Analytics        URL:https://www.mobileread.com/forums/showthread.php?t=162713
hMobile Read Wiki - Kobo Touch Hacking  URL:https://wiki.mobileread.com/wiki/Kobo_Touch_Hacking

You are viewing proxied material from tilde.institute. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.