I gave a talk on Kindle hacking at Shibuya Perl Mongers in April 2009. It documents my first couple months messing around with the Kindle.

1. You can take the Hacker out
of Perl...

2. ...but you can’t take the Perl
out of the hacker.

3. Laziness, Impatience and
Hubris on the Kindle

4. This talk contains almost no
Perl.

5. ...and almost no Japanese.

6. I’m very sorry.

7. And no x86 ASM

8. I’m not sorry.

9. The Amazon Kindle

10. eBook Reader

13. eInk Screen

14. 800x600; 16 levels of grey

15. No backlight

16. Looks great outside!

17. Good things about the Kindle

18. 3G for 1-click shopping

19. 250,000+ books to buy

20. (Most < USD10)

21. Newspaper, Magazine, Blog
subscriptions

22. Delivered every morning

23. $1-$10 each month

24. Email → eBook conversion

25. $0.10 for autodelivery

26. $FREE if you copy the result
by USB

27. Free Web Browser

28. Download .mobi, .prc, .azw,
.txt for free

29. “Experimental”

30. Means: We might start
charging money for this

31. NetFront 3.5

32. Basic CSS

33. Javascript

34. XmlHttpRequest

35. Free Wikipedia

36. Not “experimental”

37. Text to speech.

38. Minesweeper!

40. Bad things about the Kindle

41. DRM

42. When you buy books, they
are locked to the Kindle

43. Amazon lawyers went after
a tool to let you read non-
Amazon DRMed ebooks

44. (The same tool can help you
remove the DRM from
books Amazon sells you)

45. Limited eBook formats

46. I want to read PDFs

47. I want to read ePubs

48. I want to read Manga

49. Actually, I don’t read manga

50. But lots of my friends do

51. Surveillance

53. In the US, 3G includes GPS

54. The Kindle has a GPS

55. Device logs are sent to Amazon

56. Including many user actions

57. ...like the websites you visit

58. ...and what books you read

59. Appears to include GPS info

60. Amazon knows where you are

61. Lock-in

63. Designed to work only with
Amazon

64. 3G use is free, but only while
Amazon likes you

65. Summary: The Kindle is an
“appliance”

66. You wouldn’t hack a book,
would you?

67. I got a Kindle to read books

68. I didn’t plan to hack it

69. I really wanted to read
books in other formats

70. I’m a sucker for sexy
platforms

71. And it was begging me

72. It’s a new toy.

73. I am going to hack it.

74. Laziness

75. http://igorsk.blogspot.com

76. Hidden debug commands

77. ;debugOn

78. ‘help

80. Hubris

81. “I can’t possibly brick my
Kindle with the keyboard,
right?”

82. So, I started typing
commands.

83. “‘usbNetwork” sounds
good.

84. ...nothing happened

85. How about “‘usbQa’”?

86. It turned off the WIFI

87. ..and turned off USB Disk
mode.

88. Impatience

89. I gave up

90. Sometimes laziness wins

91. An hour later, I rebooted my
Macbook Air

93. So I set up a DHCP server

94. Nothing...

95. sh-3.2# tcpdump -i en1
listening on en1, link-type EN10MB (Ethernet), capture size 96 bytes
[ ...]
12:36:15.238229 arp who-has 192.168.15.200 tell 192.168.15.244

99. Now my Kindle can tether
through my Macbook

100. I want to read other eBook
formats - attempt #1

101. The Kindle has a browser

102. I have a web server

103. Web based proxy

104. Small perl app

105. mobiperl

106. Perl 4

107. no strict;

108. no warnings;

109. global variables

110. hmm. no ePub support

111. Spent a weekend learning
how ePub format works

112. github.com/obra/
unsavory-epub-hacks

113. Slow. Annoying. Requires a
Server

114. Servers are evil

115. Hm.

116. Back to the drawing board

117. I want to read other eBook
formats - attempt #2

118. Let’s review what we know:

119. What’s inside the Kindle?

120. 800x600 eInk screen

121. You know about the screen

122. Freescale iMX31

123. ARM1136JF-S

124. (Includes FPU)

125. + Multimedia stuff

126. 2 GB Flash

127. 128 MB RAM

128. USB OTG + MicroUSB slot

129. Audio hardware

130. Keyboard

131. The Kindle sounds like a
computer, not a book

132. It MUST use some GPL code...

133. https://www.amazon.com/gp/help/
customer/display.html?inodeId=200203720

134. gplrelease.tar.gz

135. alsa-lib-1.0.13 gcc-4.1.2 module-init-tools-3.2.2_patch
alsa-lib-1.0.13_patch glib-2.12.9 monit-4.9
alsa-utils-1.0.13 glibc-2.5 mtd-utils-1.0.0
alsa-utils-1.0.13_patch gst-plugins-base-0.10.17 picocom-1.4
base-files-3.0.14.ipk gst-plugins-base-0.10.6 powertop-1.10
base-passwd_3.5.9 gstreamer-0.10.17 procps-3.2.7
binutils-2.17.50.0.5 hotplug-2004_09_20 procps-3.2.7_patch
bonnie++-1.03c ifupdown_0.6.8 readline-4.3
bootchart-0.9 iptables-1.3.3 syslog-ng-1.6.11
busybox-1.7.2 klibc-1.5 sysvinit-2.86
dosfstools-2.11 libol-0.3.18 taglib-1.5
e2fsprogs-1.38 linux-2.6.22-lab126 uboot-1.3.0-rc3
e2fsprogs-1.38_patch lrzsz-0.12.20 udev-112
fuse-2.7.1 lzo-1.08 util-linux-2.12r
fuse-2.7.1_link module-init-tools-3.2.2

136. Linux

137. I can work with this

138. But how do I get code onto it?

139. My friend nmap tells me...

140. The Kindle listens on a few
ports.

141. None of them love me at all

142. I guess I’ll need to take
matters into my own hands.

143. Hey, the Kindle has busybox

144. busybox has telnetd

145. Maybe I just need to install
/etc/rc5.d/S99telnetd

146. More research from
http://igorsk.blogspot.com

147. Kindle 1 update extractor

148. (Python script)

149. But I want to make new
updates...

150. I reverse engineered the
reverse engineering tool

151. Updates are a short header,
an MD5 and a tarball

152. ...run through a trivial cipher

153. they’re not encrypted

154. The Kindle2 is a little
different than the Kindle1

155. It has different magic #s
in the update header

156. I waited for the first Kindle 2
“update.bin”

157. I grabbed its header

158. I built a new “update”

159. It installed one file

160. /etc/rc5.d/S99telnetd

161. /bin/busybox telnetd -p 2323

162. ...nope.

163. I ran strings on the Kindle’s
busybox

164. No telnetd!

165. Where can I get a busybox
for the Kindle?

166. What else has a a similar
CPU?

167. My gPhone!

168. Lots of people built static
busybox for the gPhone

169. telnetd: take 2

170. login:

171. login: root
Password:
Login incorrect

173. /bin/sh
makes a better
/bin/login

175. 125-6-81-160:ß jesse$ telnet kindle 2323
Trying 192.168.15.244...
Connected to kindle.
Escape character is '^Ü'.
/ # cat /etc/motd
###############################################
##
# NOTICE * NOTICE * NOTICE #
###############################################
##
Rootfs is mounted read-only. Invoke mntroot rw to
switch back to a writable rootfs.
###############################################
##
/#

176. What I found:

177. Most of /sbin is written in sh

178. Fun stuff in /proc

179. /proc/config.gz

180. #
# Automatically generated make config: don't edit
# Linux kernel version: 2.6.22.19
# Mon Mar 2 12:13:07 2009
#
CONFIG_ARM=y
CONFIG_SYS_SUPPORTS_APM_EMULATION=y
# CONFIG_GENERIC_GPIO is not set
CONFIG_GENERIC_TIME=y
CONFIG_GENERIC_CLOCKEVENTS=y
CONFIG_MMU=y
# CONFIG_NO_IOPORT is not set
CONFIG_GENERIC_HARDIRQS=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_LOCKDEP_SUPPORT=y
...

181. ...I could rebuild the Kernel

182. /proc/filesystems

183. nodev sysfs
nodev rootfs
nodev bdev
nodev proc msdos
nodev sockfs vfat
nodev pipefs nodev nfs
nodev nodev rpc_pipefs
anon_inodefs nodev fuse
nodev futexfs fuseblk
nodev tmpfs nodev fusectl
nodev inotifyfs
nodev devpts
ext3
nodev ramfs

184. nodev sysfs
nodev rootfs
nodev bdev
nodev proc msdos
nodev sockfs vfat
nodev pipefs nodev nfs
nodev nodev rpc_pipefs
anon_inodefs nodev fuse
nodev futexfs fuseblk
nodev tmpfs nodev fusectl
nodev inotifyfs
nodev devpts
ext3
nodev ramfs

185. I’m not restricted to 2GB

186. It’s a Linux box

187. I can cross-compile!

188. http://www.codesourcery.com/
Prebuilt ARM toolchain

189. It generates generic ARM
machine code

190. That’s ok, but not great

191. I’ll cross compile Perl

192. 1 day of frustration passes

193. I won’t cross-compile Perl

194. Crosscompiling Perl
==
Bad Joke

195. I’ll cross-compile Python

196. Same bad joke

197. Maybe I need a native
compiler for ARM

198. Where do I get an ARM
build farm?

199. I have a gPhone

200. It’s not a great build host

201. I have an N810

202. It’s not a great build host...

203. ...but it has an important
advantage

204. apt-get install gcc

205. N810: Linux 2.6; glibc 2.5

206. N810 binaries run
unmodified on the Kindle

207. I built perl in an hour

208. Sadly, I realized that Python
is a better choice

209. I also realized that building
on the Kindle works better
than on the N810.

210. (Version skew in extra
libraries makes things hard)

211. I tried building gcc on the
N810...

212. Found Pengutronix /
OSELAS.de

213. It’s a compiler toolchain
builder.

214. I built my own crosscompilers
for ARM1136JF-S - Linux 2.6
- glibc 2.5

215. I used the cross compiler to
compile gcc, glibc (for
proper headers), binutils,
shellutils, dropbear & screen

216. I cross-compiled nfsmount

217. I nfs-mounted a disk image
with the compiler

218. Then I started building more
stuff

219. I am a Perl Hacker

220. I believe in the three virtues

221. Lazyness

222. Impatience

223. Hubris

224. Sometimes, Perl isn’t the
Right Tool

225. Calibre is the Killer App for
ebook conversion and
management

226. Lazyness

227. I like the best tools

228. The best tools already exist

229. Calibre has dozens of eBook
format converters.

230. Why reimplement them?

231. Hubris

232. “I can learn enough Python
in a weekend to port this
application to the Kindle”

233. The downside

234. Dependencies

235. Who’s dealt with Python app
dependencies?

236. No CPAN.

237. Everything you need is in the
Standard Library.

238. If it’s not in the Standard
Library, it’s not worth using.

239. Except when you need it.

240. They have....

241. “easy_install”

242. It’s not so easy

243. It is very perlish

244. It does recursive web
scraping to find tarballs on
developers’ web sites.

245. Most of the deps actually
installed ok.

246. I just ran the app over and
over until it stopped erroring.

247. God I miss Perl.

248. And then we get to the big
problem.

249. Qt

250. Calibre’s UI is in Qt

251. ...so its backend uses Qt
because it’s easy

252. PyQt binds Qt to Python

253. For Qt for Windows

254. for Qt for Mac

255. for Qt for X11

256. No X11 on Kindle

257. (Just a Framebuffer)

258. QtEmbedded

259. No problem!

260. No PyQtEmbedded

261. Finally got Calibre running...

262. by hacking out components
I don’t need.

263. It was good enough to try to
convert a trivial ebook.

264. It took 12 hours...

265. ...after I built swaputils and
gave it 256MB of swap

267. So what was it doing?

268. HTML → Mobipocket
converter

269. With a full CSS engine

270. It visits every DOM
element...

271. and computes CSS styles to
convert them to trivial HTML
3.2...

272. ...twice.

273. Lazyness, Impatience,
Hubris can all help here.

274. Help me Larry-wan.

275. Very few CSS rules really
matter.

276. The Kindle supports very
little HTML.

277. It mostly supports HTML
3.2...just no <pre>

278. ...that’s the only thing the 12
hour CSS engine got us

279. You can emulate <pre> with
<tt> and &nbsp;

281. if tag == 'pre':
self.inside_pre = 1
tag = 'tt'
if prefixname(elem.tag, nsrmap) == 'pre':
buffer.write('<br/>n')
self.inside_pre = 0
if self.inside_pre:
text=text.replace(' ','&nbsp;')
text=re.sub(r'(rn|r|n)', '<br/>n', text)

282. Now it runs in 60 megs and
about 10 minutes

283. So, now I can run code.

284. Still no UI access.

285. I don’t really want to hack
Java GUI code.

286. And where could I plug my
custom UI into the Kindle’s?

287. I don’t want to break
Amazon’s UI.

288. Oh hey.

289. There is an application I
could replace with
something custom...

291. But really, I don’t want to.

292. Sure, I could decompile.

293. It’s obfuscated.

294. It’d be annoying.

295. If I built UI, I’d have to
maintain a UI.

296. And users can break a UI.

297. No buttons
=
Less to screw up

298. But I have this ebook
converter.

299. I do want to let users
convert books.

300. What to do?

301. nodev sysfs
nodev rootfs
nodev bdev
nodev proc msdos
nodev sockfs vfat
nodev pipefs nodev nfs
nodev nodev rpc_pipefs
anon_inodefs nodev fuse
nodev futexfs fuseblk
nodev tmpfs nodev fusectl
nodev inotifyfs
nodev devpts
ext3
nodev ramfs

302. nodev sysfs
nodev rootfs
nodev bdev
nodev proc msdos
nodev sockfs vfat
nodev pipefs nodev nfs
nodev nodev rpc_pipefs
anon_inodefs nodev fuse
nodev futexfs fuseblk
nodev tmpfs nodev fusectl
nodev inotifyfs
nodev devpts
ext3
nodev ramfs

303. Inotify blocks on filesystem
events.

304. pyInotify lets me get at fs
events easily.

305. class InotifyListener (threading.Thread):
global cv
def run ( self ):
global conversionQueue
wm = WatchManager() # Watch Manager
mask = IN_MOVED_TO | IN_CREATE # watched events
p = PTmp()
notifier = Notifier(wm, p)
wdd = wm.add_watch('/mnt/us/documents', mask, rec=True)
notifier.loop()

306. It works great for downloads

307. Copies over USB didn’t
trigger inotify events.

308. It’s probably something
fuse-related.

309. I went for the cheap hack.

310. When you eject the Kindle, it
generates a DBus event.

311. class DbusWatcher (threading.Thread):
global cv
def run ( self ):
global conversionQueue
cmd='/usr/bin/dbus-monitor --system'
pipe = subprocess.Popen(cmd, shell=True,
stdout=subprocess.PIPE).stdout
while 1:
line = pipe.readline()
if any(line.find(i) != -1 for i in ['usbPlugOut', 'resuming']):
for f in os.listdir('/mnt/us/documents'):
maybe_enqueue_file('/mnt/us/documents/'+f)

312. What’s next?

313. Remember config.gz?

314. I can build a new kernel

315. ...and add back missing
drivers

316. USB Mass Storage Host

317. USB WIFI?

318. What isn’t next?

319. Reverse engineering Java to
extend the Kindle’s UI

320. Python, and Shell, I’m happy
to hack for a good cause.

321. Java is another matter
entirely.

322. Thanks!

323. I had a big finish planned.

324. I was going to build and
show off a manga converter.

325. (for .cbz format books)

326. So I downloaded a .cbz.

327. ...and copied it to the Kindle...

328. ...and I saw this...

330. The best hacking
is no hacking.

331. Thanks!