Imaging the PocketBook InkPad 3 (740) and misc notes

Step 1: Root device

See https://www.mobileread.com/forums/showthread.php?t=325185 and its associated code repository https://github.com/ezdiy/pbjb

Step 2: Dump device to external SD

Required space is around 1.5GB once compressed, more if the internal storage was modified (added books, dictionaries, TTS voices, etc.).

Once inserted, the external SD is automatically mounted at /mnt/ext2/

# dd bs=1M if=/dev/mmcblk0 | gzip -c | split -b 4095m - /mnt/ext2/mmcblk0--dd.gz. &
# watch -n5 'kill -USR1 $(pgrep ^dd)'

Since the InkPad 3 uses a FAT32 filesystem for the SD, size is limited to 4GB per file. You may opt to dump the device with no compression (because the embedded SoC, Allwinner B288, is a very slow dual-core ARM CPU) but retain the split part: remove the | gzip -c part.

Hit Ctrl+C when the dd program ends and there is no process to monitor.

Misc.

Device-specific data

/sys/block/mmcblk0/device/cid
/sys/block/mmcblk0/device/csd

Historically on devices booting on the hidden internal SD (PocketBook 626), they would bootloop when swapping the original SD for a cloned larger one, because of a check in monitor.app. See https://www.mobileread.com/forums/showthread.php?t=278728

Mounts / partitioning

$ mount

device	mountpoint	type
rootfs	on /	(rootfs)
dev/root	on /	(ext2)
/dev/mmcblk0p2	on /boot	(ext2)
/dev/ebrmain	on /ebrmain	(ext2)
/dev/secure	on /secure	(ext2)
/dev/loop0	on /ebrmain/cramfs	(cramfs)
/dev/user_int	on /mnt/ext1	(vfat)
/dev/user_extp1	on /mnt/ext2	(vfat)

$ cat /etc/fstab

device	mountpoint	type	opts etc.
none	/proc	proc	defaults 0 0
none	/dev/pts	devpts	mode=0622 0 0
tmpfs	/dev/shm	tmpfs	defaults 0 0
/dev/ebrmain	/ebrmain	auto	ro 0 0
/dev/secure	/mnt/secure	auto	defaults 0 0
/ebrmain/cramfs.img	/ebrmain/cramfs	auto	defaults,loop 0 0
/dev/mmcblk0p2	/boot	auto	ro 0 0

fstab from swupdate (Extracted from SWUPDATE.BIN with the "SynkActiv" script):

none			/proc		proc	  defaults  0 0
none			/dev/pts	devpts  mode=0622 0 0
tmpfs			/dev/shm	tmpfs	  defaults  0 0
/dev/ebrmain		/ebrmain	auto    ro        0 0
/dev/secure		/mnt/secure	auto    defaults  0 0
/ebrmain/cramfs.img	/ebrmain/cramfs	auto	defaults,loop 0 0
/dev/bootfs		/boot		auto	ro 	0 0

fdisk -l: blank response

Filled with 00-bytes: mmcblk0boot0 and mmcblk0boot1

# dd if=/dev/mmcblk0boot0 of=/mnt/ext2/mmcblk0boot0.dd
# dd if=/dev/mmcblk0boot1 of=/mnt/ext2/mmcblk0boot1.dd

Exploring the partitioning with root

cat /proc/partitions

major	minor	#blocks	name
7	0	120004	loop0
179	0	7634944	mmcblk0
179	1	6793216	mmcblk0p1
179	2	32768	mmcblk0p2
179	3	1	mmcblk0p3
179	5	16384	mmcblk0p5
179	6	34816	mmcblk0p6
179	7	65536	mmcblk0p7
179	8	524288	mmcblk0p8
179	9	131072	mmcblk0p9
179	224	4096	mmcblk0boot1
179	208	4096	mmcblk0boot0
179	16	61897728	mmcblk1
179	17	61896704	mmcblk1p1

Notice how the block count seems off for mmcblk0p3

# fdisk -l Disk /dev/mmcblk0: 7456 MB, 7818182656 bytes, 15269888 sectors 954368 cylinders, 1 heads, 16 sectors/track Units: cylinders of 16 * 512 = 8192 bytes

Device	Boot	StartCHS	EndCHS	StartLBA	EndLBA	Sectors	Size	Id	Type
/dev/mmcblk0p1	*	0,0,0	0,0,0	1683456	15368191	13684736	6682M	b	Win95
Partition 1 does not end on cylinder boundary
/dev/mmcblk0p2		0,0,0	0,0,0	73728	139263	65536	32.0M	6	FAT16
Partition 2 does not end on cylinder boundary
/dev/mmcblk0p3		0,0,0	0,0,0	1	1544192	1544192	754M	5	Extended
Partition 3 does not end on cylinder boundary
/dev/mmcblk0p5		0,0,0	0,0,0	139264	172031	32768	16.0M	83	Linux
/dev/mmcblk0p6		0,0,0	0,0,0	172032	241663	69632	34.0M	83	Linux
/dev/mmcblk0p7		0,0,0	0,0,0	241664	372735	131072	64.0M	83	Linux
/dev/mmcblk0p8		0,0,0	0,0,0	372736	1421311	1048576	512M	83	Linux
/dev/mmcblk0p9		0,0,0	0,0,0	1421312	1683455	262144	128M	83	Linux

Partition table entries are not in disk order
Disk /dev/mmcblk0boot1: 4 MB, 4194304 bytes, 8192 sectors
128 cylinders, 4 heads, 16 sectors/track
Units: cylinders of 64 * 512 = 32768 bytes

Disk /dev/mmcblk0boot1 doesn't contain a valid partition table
Disk /dev/mmcblk0boot0: 4 MB, 4194304 bytes, 8192 sectors
128 cylinders, 4 heads, 16 sectors/track
Units: cylinders of 64 * 512 = 32768 bytes

Disk /dev/mmcblk0boot0 doesn't contain a valid partition table

Detecting supported file systems

# blkid /dev/mmcblk0p*
/dev/mmcblk0p1: LABEL="Vivlio" UUID="4B3D-7544"
/dev/mmcblk0p2: LABEL="Volumn"
/dev/mmcblk0p7: UUID="da0bb0fb-8c84-477c-b781-1f8c7b6c5016"
/dev/mmcblk0p8: UUID="04ce3511-5916-48d5-99be-c57f0bc955f1"
/dev/mmcblk0p9: UUID="e3f04df8-c1d9-4de3-8640-b40d3a2ee37e"

# df -h

Filesystem	Size	Used	Available	Use%	Mounted
/dev/root	63.6M	19.8M	40.6M	33%	/
none	128.0M	504.0K	127.5M	0%	/var
/dev/mmcblk0p2	63.9M	12.8M	51.0M	20%	/boot
tmpfs	498.1M	4.0K	498.1M	0%	/var/dev/shm
/dev/ebrmain	507.7M	301.0M	181.1M	62%	/ebrmain
/dev/secure	124.0M	41.6M	76.0M	35%	/mnt/secure
/dev/loop0	220.6M	220.6M	0	100%	/ebrmain/cramfs
/dev/user_int	6.5G	1.1G	5.4G	17%	/mnt/ext1
/dev/user_extp1	59.0G	1.2G	57.8G	2%	/mnt/ext2
/dev/secure	124.0M	41.6M	76.0M	35%	/ebrmain/cramfs/bin/netagent
/dev/secure	124.0M	41.6M	76.0M	35%	/lib/modules/ins_usb_mod.sh
/dev/secure	124.0M	41.6M	76.0M	35%	/lib/modules/rm_usb_mod.sh
/dev/secure	124.0M	41.6M	76.0M	35%	/lib/modules/ins_usbnet.sh
/dev/secure	124.0M	41.6M	76.0M	35%	/lib/modules/rm_usbnet.sh

Note the dev/secure mounts are added by the jailbreak kit.

# find /var/dev -type l -exec ls -al {} ';'
lrwxrwxrwx    1 root     root             6 Dec  1 23:19 /var/dev/input/keyboard0 -> event0
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/secure -> mmcblk0p9
lrwxrwxrwx    1 root     100              3 Dec  1 23:19 /var/dev/fb -> fb0
lrwxrwxrwx    1 root     100              4 Dec  1 23:19 /var/dev/pvi_io -> zero
lrwxrwxrwx    1 root     100              4 Dec  1 23:19 /var/dev/rtc -> rtc0
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/rootfs -> mmcblk0p7
lrwxrwxrwx    1 root     root             7 Dec  1 23:19 /var/dev/misc/rtc -> ../rtc0
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/ebrmain -> mmcblk0p8
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/user_int -> mmcblk0p1
lrwxrwxrwx    1 root     100              4 Dec  1 23:19 /var/dev/pvi_ioc -> zero
lrwxrwxrwx    1 root     100              7 Dec  1 23:19 /var/dev/user_ext -> mmcblk1
lrwxrwxrwx    1 root     100              3 Dec  1 23:19 /var/dev/einkdrv -> fb0
lrwxrwxrwx    1 root     100              7 Dec  1 23:19 /var/dev/mxc_mem -> mxc_iim
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/user_extp1 -> mmcblk1p1
lrwxrwxrwx    1 root     100              9 Dec  1 23:19 /var/dev/root -> mmcblk0p7

See https://linux-sunxi.org/PocketBook_Touch_Lux_2_(626)#Device_specific_topic for a similar layout Here we have A20-style NAND layout at 0x01400000 See https://github.com/linux-sunxi/sunxi-tools/blob/master/nand-part-a20.h

(all offsets below need to add 0x01400000 = 20 MB)

Parsing the sunxi partition table at offset 20 MB

nandmbr-parse$ ./a.out SUNXIMBR.bin
SUNXIMBR.bin
check partition table
mbr: version 0x00000200, magic softw411
7 partitions
partition  1: class =         DISK, name =       bootfs, partition start =    32768, partition size =    65536 user_type=32768
partition  2: class =         DISK, name =          env, partition start =    98304, partition size =    32768 user_type=32768
partition  3: class =         DISK, name =        pbenv, partition start =   131072, partition size =    69632 user_type=32768
partition  4: class =         DISK, name =       rootfs, partition start =   200704, partition size =   131072 user_type=32768
partition  5: class =         DISK, name =      ebrmain, partition start =   331776, partition size =  1048576 user_type=32768
partition  6: class =         DISK, name =       secure, partition start =  1380352, partition size =   262144 user_type=32768
partition  7: class =         DISK, name =        UDISK, partition start =  1642496, partition size =        0 user_type=33024

nandmbr-parse$ ./a.out SUNXIMBR2.bin
SUNXIMBR2.bin
check partition table
mbr: version 0x00000200, magic softw411
7 partitions
partition  1: class =         DISK, name =       bootfs, partition start =    32768, partition size =    65536 user_type=32768
partition  2: class =         DISK, name =          env, partition start =    98304, partition size =    32768 user_type=32768
partition  3: class =         DISK, name =        pbenv, partition start =   131072, partition size =    69632 user_type=32768
partition  4: class =         DISK, name =       rootfs, partition start =   200704, partition size =   131072 user_type=32768
partition  5: class =         DISK, name =      ebrmain, partition start =   331776, partition size =  1048576 user_type=32768
partition  6: class =         DISK, name =       secure, partition start =  1380352, partition size =   262144 user_type=32768
partition  7: class =         DISK, name =        UDISK, partition start =  1642496, partition size =        0 user_type=33024

nandmbr-parse$ ./a.out SUNXIMBR3.bin
SUNXIMBR3.bin
check partition table
mbr: version 0x00000200, magic softw411
7 partitions
partition  1: class =         DISK, name =       bootfs, partition start =    32768, partition size =    65536 user_type=32768
partition  2: class =         DISK, name =          env, partition start =    98304, partition size =    32768 user_type=32768
partition  3: class =         DISK, name =        pbenv, partition start =   131072, partition size =    69632 user_type=32768
partition  4: class =         DISK, name =       rootfs, partition start =   200704, partition size =   131072 user_type=32768
partition  5: class =         DISK, name =      ebrmain, partition start =   331776, partition size =  1048576 user_type=32768
partition  6: class =         DISK, name =       secure, partition start =  1380352, partition size =   262144 user_type=32768
partition  7: class =         DISK, name =        UDISK, partition start =  1642496, partition size =        0 user_type=33024

nandmbr-parse$ ./a.out SUNXIMBR4.bin
SUNXIMBR4.bin
check partition table
mbr: version 0x00000200, magic softw411
7 partitions
partition  1: class =         DISK, name =       bootfs, partition start =    32768, partition size =    65536 user_type=32768
partition  2: class =         DISK, name =          env, partition start =    98304, partition size =    32768 user_type=32768
partition  3: class =         DISK, name =        pbenv, partition start =   131072, partition size =    69632 user_type=32768
partition  4: class =         DISK, name =       rootfs, partition start =   200704, partition size =   131072 user_type=32768
partition  5: class =         DISK, name =      ebrmain, partition start =   331776, partition size =  1048576 user_type=32768
partition  6: class =         DISK, name =       secure, partition start =  1380352, partition size =   262144 user_type=32768
partition  7: class =         DISK, name =        UDISK, partition start =  1642496, partition size =        0 user_type=33024

Mermaid graph

View

Rendered

graph LR

%%define classes
classDef classOk fill:green,color:#00FF00,stroke-width:2px,stroke:darkGreen;
classDef classWarn fill:orange,color:#FFF,stroke-width:2px,stroke:darkOrange;
classDef classDis fill:#eee,color:#000,stroke-width:0;
%%classDef node stroke:#0000ff,stroke-width:4px;

subgraph unmapped["fa:fa-microchip 36 MB unmapped data fa:fa-question-circle at SD card start"]
egon0-1("BOOT0_EMMC3<br/>fa:fa-hdd upto 32 KB<br/>fa:fa-map-marker-alt @192 KB (384*512)<br/>eGON.BT0 (4.0 boot0)<br/>'the Embedded GO-ON Bootloader System'")
---

egon0-2("BOOT0_EMMC3 backup<br/>fa:fa-hdd upto 32 KB<br/>fa:fa-map-marker-alt @256 KB (512*512)<br/>eGON.BT0 (4.0 boot0)")
---

uboottoc-backup("UBOOT-backup pkg<br/>fa:fa-hdd upto 4? MB<br/>fa:fa-map-marker-alt @12MB (24576*512)<br/>boot1 sunxi-package")
---

uboottoc-main("UBOOT pkg<br/>fa:fa-hdd upto 4? MB<br/>fa:fa-map-marker-alt @~16MB (32800*512)<br/>boot1 sunxi-package")
---

parttable("partitions<br/>fa:fa-hdd 64 KB<br/>fa:fa-map-marker-alt @20MB<br/>4x 16KB sunxi PT")
end
parttable --- mmcblk0p2

subgraph "mmcblk0p2: primary<br/>"
mmcblk0p2(("mmcblk0p2 (/dev/boot)<br/>fa:fa-hdd 32 MB [df says 64MB?]<br/>fa:fa-map-marker-alt @36MB<br/>FAT16 /boot"))
end
mmcblk0p2 --- mmcblk0p5

subgraph "mmcblk0p3: extended [protective?] fa:fa-hdd 754 MB (wrong fa:fa-map-marker-alt @.5MB in MBR)"
mmcblk0p5("mmcblk0p5<br/>fa:fa-hdd 16 MB<br/>fa:fa-map-marker-alt @68MB<br/>env")
---

mmcblk0p6("mmcblk0p6<br/>fa:fa-hdd 34 MB<br/>pbenv")
---

mmcblk0p7("mmcblk0p7 (/dev/root)<br/>fa:fa-hdd 64 MB<br/>EXT2 /")
---

mmcblk0p8("mmcblk0p8 (/dev/ebrmain)<br/>fa:fa-hdd 512 MB<br/>EXT2 /ebrmain")
---

mmcblk0p9("mmcblk0p9 (/dev/secure)<br/>fa:fa-hdd 128 MB<br/> /mnt/secure")
end
mmcblk0p9 --- mmcblk0p1

subgraph "mmcblk0p1: primary"
mmcblk0p1("mmcblk0p1 (/dev/user_int)<br/>fa:fa-hdd 6.5 GB<br/>fa:fa-map-marker-alt @822MB<br/>FAT32 /mnt/ext1")
end

%%Style subgraph/nodes
style unmapped fill:#eef,color:#33F,stroke-width:2px,stroke:darkBlue
class egon0-1,egon0-2,uboottoc-backup,uboottoc-main,parttable classDis
class mmcblk0p1 classOk
class mmcblk0p2 classWarn

Misc: References to device SN in memory dump

BOOT: 2 refs, only /boot/hwdevice found
MNTsecure: 12 refs = fwinfo.txt + 11 dictionary *.lic
User FAT32: 16 in raw, 9 refs = 8device.xml(7 deleted?) + 8 cookies

splitter script

(Optional) Regenerate the python handler code from the ksy descriptive file.

C:\EXTRACT\kaitai-struct-compiler-0.8\bin\kaitai-struct-compiler.bat -t all pocketbook-pb740-dd-dump.ksy

Install pip dependencies

$ sudo pip install kaitaistruct
(--user if you want, or create a venv)

Run the splitter script on dd image

$ python pocketbook-pb740-dd-dump-to-files.py mmcblk0--dd

You may then use 7-zip GUI to extract or browse the partitions' contents.

mchubby / pb740-inkpad-notes Goto Github PK

pb740-inkpad-notes's Introduction

Imaging the PocketBook InkPad 3 (740) and misc notes

Step 1: Root device

Step 2: Dump device to external SD

Misc.

Device-specific data

Mounts / partitioning

Filled with 00-bytes: mmcblk0boot0 and mmcblk0boot1

Exploring the partitioning with root

Detecting supported file systems

Parsing the sunxi partition table at offset 20 MB

Mermaid graph

Misc: References to device SN in memory dump

splitter script

(Optional) Regenerate the python handler code from the ksy descriptive file.

Install pip dependencies

Run the splitter script on dd image

pb740-inkpad-notes's People

Contributors

Stargazers

Watchers

Forkers

Recommend Projects

Recommend Topics

Recommend Org