Quantcast
Channel: MobileRead Forums - PocketBook
Viewing all articles
Browse latest Browse all 1253

PB62x/740: root + sshd, ftpd, smbd, iptables, usbnet (needs testers)

$
0
0
This tutorial & tools is meant for power users who can make use of configuring the device in fancy ways, such as running custom stuff for linux, or advanced mods to the GUI. As of v2, the package does
  • install public su binary
  • install iptables binary, and script to load firewall rules on startup
  • install ssh, smb, ftp services and launch those at boot
  • permanetly enable usbnet (even when mass storage is on, usbnet runs alongside)
  • runtime patch out the worst of wifi glitches of stock firmware (arbitrary disconnects)

Devices supported

I have PB740-2 (InkPad 3 Pro), so that's pretty much the only one I can vouch for. Essentially if your firmware latest version is something like 5.20.xxxx, *it should run* (these images are all nearly identical). However I have no way to verify that for a fact. You might want to start slowly only with jailbreak su and nothing else on older devices, as bugs in older kernels can introduce nasty boot crashes, especially when configuring for combined usbnet. Chances are that for older devices significant tweaks to service scripts will be necessary.

How to install

Extract the 3 app files from pbjb*.zip release on github into applications folder of your device.

Then from app menu:

* Launch @Jailbreak. If it succeeds, it will install su binary and reboot the device. If it silently exits, chances are the exploit doesn't run on your firmware. After reboot finishes,
* Launch @Services. This will install the service files and start scripts.

Once the device boots after @Services install, you can ssh into root@169.254.0.1 with connected usbnet and look around. The root password is randomly generated, stored in 'password.txt' document the install process generated. If you want it changed, simply edit that file and reboot again for services to take note. All other services (smbd, ftpd) expect the same username=root and password.txt pair.

Samba share

Spoiler:

For frequent use of the device's storage from a PC, its useful to map the share permanently as:

Code:

net use p: \\169.254.0.1\uext1
And use that network drive instead of using the usual USB mass storage. The reason for doing this is that you can now set the device to 'charge only' mode when plugging to USB, and keep reading a book while files are copied.

The full list of the shares when you navigate to \\169.254.0.1 is:

ext1 - main storage (wifi & usbnet), passworded
ext2 - sd storage (wifi & usbnet), passworded
ext3 - sd2 storage (wdifi & usbnet), passworded
uext1,uext2,uext3 same as above, works ONLY via USBNet, no password
public - see below (wifi & usbnet), read only, no password

Finally, theres a hidden 'system' share exposing root of the filesystem tree. Use only if you know what that means. Most of it is mounted read only by default, so you need to ssh in anyway (perhaps to fix wrong permissions introduced by samba as well).

Password-less access for guests

Guest samba (\\ip\public) and anonymous ftp land the visitor in 'public' folder you can create on the main storage. By pulling documents in there you can share stuff with random strangers/devices you don't trust on the LAN.


Troubleshoot
Spoiler:

Huh, I click explore network neighborhood and it shows no shares?

Network discovery doesn't always work well over wifi (AP blocks broadcasts between clients). You can ssh root@169.254.0.1 via USBNet and see via ifconfig in any event. or check listing on your wifi router, or click Network Information in koreader...

I'm bricked, network/usb storage fails completely now...

It's absolutely crucial to keep '@Uninstall' package around - for if something goes horribly wrong, network or storage access can become completely cut off. Running this package will undo everything of the jailbreak and the network services, restoring the device to the way it was.

If stuff breaks to a point not even launching any app is viable (ie frozen screen), there's a boot escape hatch: Keep rapidly pressing *any* button all the while during startup. The boot script does a tally of press events, and if count is more than 5 times over a specific window of time, the services scripts will not start at all. This way you should get functioning system again assuming it was a service script causing trouble.


Low level internals

Spoiler:

Everything of above is stored on the /mnt/secure partition - this one is ext2, and mostly left alone by firmware updates, meaning the JB has a high chance of survival across OTAs. As far as jailbreaks go, this one is fairly conservative one - it doesn't modify *any* files of currently installed fw, it simply places itself in a directory the stock firmware auto-executes stuff from (/mnt/secure/runonce). This minimizes chances of conflict with future OTA updates.

I just want the jailbreak, not all this fancy stuff...

Good! That's why its split into two packages. If you run only @Jailbreak, you can get rudimentary root ssh, specifically:

* Start ssh in koreader
* log in with ssh reader@ip -p 2222 /bin/sh, you'll get dumb terminal
* run /mnt/secure/su /sbin/dropbear -G "" in it

At this point, built-in root sshd with no password is running and has a working terminal. Using the jailbreak standalone this way is much safer as all it does is just drop single file and doesn't fiddle with the running firmware. It doesn't protect itself to survive OTAs though, so it will stop working the moment some "good samaritan" ruins it.

Viewing all articles
Browse latest Browse all 1253

Trending Articles