yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] CapitainDerya:
Good share.

[MENTION=3093900]sartrism[/MENTION]

Can you provide all system files using some sort of Android App which can backup file system. I think testmode requires password which is saved in SQlite. testmode has right to reboot in diagnostic mode. Normal user has not authentication for this. Software engineers of this system looks like have a Web Development background. DPT-RP1 runs like a webserver.
[General Questions and Answers] hadesome1:
hope has any process
[General Questions and Answers] CapitainDerya:
I think we are so close to success
[General Questions and Answers] hadesome1:
any news?
[General Questions and Answers] skirhir:
I've been looking into the USB pairing process.

The device reports idPorduct=0x0be5

It lists a CDC ACM (serial) interface, and a USB HID interface.

I don't know what the HID is for, but the serial one is used to send some configuration that restarts the device USB interface.

After restarting, the device shows a different idProduct=0x0bdd . This one has an RNDIS NIC Interface that can be used to connect to the REST API.

/****************/

This is just a guess, but maybe there are other serial commands available that allow debugging/rootin/jaillbraking.

This is a capture of the USB port, maybe somebody else has seen a similar USB setting before

https://drive.google.com/open?id=1P-K9vW-XlzOZ6KqozaEO_Jr8CbLPlo8r
[General Questions and Answers] mateng1996:
jailbreak DPT-RP1 please

As a Chinese student who can not afford the jailbreak fee, I hope you guys can be able to jailbreak DPT-RP1 sooner and release the crack files for free.
[General Questions and Answers] jess91:
While this remains interesting, it is now really mostly an intellectual challenge. The new Onyx Boox 2 is superior device with same screen but far better features, very happy with mine. 6 months ago I would have purchased the Sony if they hadn't done all this nonsense of locking every little thing down. Hopefully Sony will learn in future, I like their products but not to the level of buying when there are better alternatives, they are missing the boat.
[General Questions and Answers] stevenvo:
I guess you have not actually used the DPT-RP1 so there wasn't any real experience that you can refer to after you own the Onyx Boox 2.

I have owned both devices and this is my review: https://www.mobileread.com/forums/showpost.php?p=3660223&postcount=10

TLDR; Boox2 is just too heavy to hold for a long time, writing is not natural, however, Sony locking software sucks, but their rendering and writing software is way better than neoreader - however still lack of basic features. In the end I return the Boox 2 and will focus on rooting the Sony.
[General Questions and Answers] jess91:
Correct, I haven't used the RP1, there is no point. The better hardware can not make up for the software restrictions, as nice and pretty as the Sony may be it is useless to people who need formats beyond just PDF. Shortsighted and total overkill decision by Sony, they should have made an "open" variant that lets install apps to open epub, etc.
[General Questions and Answers] sartrism:
Actually the opposite is more accurate in my opinion. At least RP1 has better chance to be perfect after software update or rooting (and it is possible to root in China by investing some money). To be honest, most of RP1/S1 users didn't move to other devices although Sony's attitude has been so disappointing. It is very interesting to see that the most aggressive people are actually ones who don't own RP1 yet.

Anyway, I think iOS users would be interested in this post by a Japanese user, who adapts python scripts to be implemented in iPhone or iPad.
[General Questions and Answers] ghostwheel:
I have the boox max, not the max 2. But for what the DPT-RP1 does, it is superior to the MAX2- annotating PDFs. The Neo 2 app for annotating is quite bad.

First, you can't just start writing - you have to press on screen, and select annotation.

The annotations are also not saved directly to the file. You have to export, and then it is saved to a new file somewhere on your device.

Neo 2 also doesn't play nicely with Dropbox - you can't just open a file from dropbox, edit in Neo 2, and save the changes.

For note taking, the supplied papers are really bad - the lines are too thick and dark.

There is also no good way to convert a bunch of notes to PDFs. You have to convert to png page by page,.. (I think)

All these problems exist since the Max days, and should take very little for a competent programmer to fix, but Onyx doesn't really care. You can use other note taking apps on android, but none currently work well with the stylus and the e-ink - much too slow!

So, for now hacking the RP1 could give benefits for people who want to use the device for taking notes and annotating pdfs.

---------- Post added at 03:41 ---------- Previous post was at 03:20 ----------

I'm not sure this helps, but this project implements communicating with the RP1:

https://github.com/janten/dpt-rp1-py
[General Questions and Answers] hdwrp:
PCBs of DPT-RP1 and new DPT-CP1 look identical (I can't post links yet):

mobileread.com/forums/attachment.php?attachmentid=163532&d=1523968266

fccid.io/AK8DPTRP1/Internal-Photos/Short-Term-Confidential-Internal-Photo-3309371

Same hardware except the display size.
[General Questions and Answers] altopalo:
Don't have enough knowledge to do such kind of rooting. Hope someone can help. Thanks in advance.
[General Questions and Answers] Droidriven:
You obviously haven't read this whole thread. This discussion was started quite some time ago and they aren't any closer to gaining root than when the thread first started so unless you have something to add to finding a possible way to root this device, there is nothing you can add to or gain from this thread.
[General Questions and Answers] Atcold:
On sale on Amazon

I wanted to point out that the device is now on sale on Amazon (see attachment).
[General Questions and Answers] Nvechenyu:
Whenever I connect to WiFi, it would pop up a web browser. It opens Baidu.com automately which is quite strange. I can visit any website by searching in baidu but I cannot download anything. I don't know if this is useful for your guys.
[General Questions and Answers] jess91:
Thought about you guys. This is now mainstream, not limited to some guy in China. Goodereader is now selling the RP1 and newer smaller CP1 with Android 5.1.1.

https://goodereader.com/blog/electr...-dpt-rp1-and-dpt-cp1-can-now-run-android-apps

https://goodereader.com/blog/product/sony-digital-paper-dpt-rp1-android-5-1-1-with-google-play

https://www.youtube.com/watch?v=UUbK6JctplI

https://www.youtube.com/watch?v=etokGSqDs2E
[General Questions and Answers] hdwrp:
Don't be mistaken. Goodereader is just reselling the very same stuff of the person "Ladyhack" from China.

It's called affiliation.

I would not be surprised if the item would be shipped by the very same person from China.

The hack is Sony's internal leak.
[General Questions and Answers] Anti-paradox:
I can't agree more, this leak surely comes from Sony's internal.

As you can tell, most software engineering are done by Linfiny Japan, which is a subsidiary of Eink, cooperated with Sony, as a platform for their E-ink development. And I am certain that some insider find this "jailbreaking" lucrative.

This thread haven't gain any actual progress ever since it is started, and I bet the hacker must have required more info from their engineering department than any one of us.

I have this device for over six months now and I am trying to hack into it, and here's what I found so far.

The device itself is running Debian, which is a linux platform, with android supports.

The E-reader utility is a separate App on this device, which means each time you open a document this App launches itself, and it is not integrated with any other parts. This App is called "DigitalPaperApp"

I recently hack into the PC software so that you can upload any firmware onto this device with a modified version of DigitalPaperApp, linked below:

https://github.com/Antiparadox/Sony-Digital-Paper-Hack"]https://github.com/Antiparadox/Sony-Digital-Paper-Hack

My plan is to install a hacked version of update package into this device, and this is now possible because Sony just released its new version of firmware, which is now downloaded and included into my git repo, (v1.4.0.1)

Unfortunately this .pkg file is assumed to use the same protocol as Sony's PlayStation internal update file, which means Un-pack and repackaging this update file is surely no easy task.

I will look into the this file and see what I can find, and hopefully this will reveal a major breakthrough.
[General Questions and Answers] shankerzhiwu:
some light on rooting

I have kicked my DPT-RP1 into diagnose mode.

The method is plugging an OTG cable whose ID pin is soldered with 7.87 k resistor to GND. Press and hold home button while the device is booting up. Finally you will get a gray rectangle at the center of the screen. On the computer, a USB modem device will be detected and a login tty will be on that tty.

Now, the question arises that we need to crack the login password. The shadow hash is

$6$HtJrWqxU$gJtuFqZLU/tOwjrXY1dxLgh021mKpNlI4wOn8eEkiD3qj7Tb69.iKNh6KpzE6rotBaCGPH3PjYDKPbmHaaDCw1

.

Does anyone have any idea on that hash?
[General Questions and Answers] jra166:
I guess it isn't as easy as buying the GoodeReader hacked version, ripping the firmware, and uploading it with your modified PC software? So the remaining challenge is how to get the firmware off of a hacked DPT, yes?
[General Questions and Answers] yanzi:
Interesting findings. What does it say upon booting?
[General Questions and Answers] cypresstwist:
It's a sha512 encryption HASH. You can put hashcat to work to crack it.
[General Questions and Answers] Honami754:
rockyou.txt tried with no outcomes. Try something harder:)

Also how did he got the shadow hash without a complete system dump?
[General Questions and Answers] shankerzhiwu:
Nothing. Because the USB modem device seen on the host computer is emulated by the DPT device with USB Gadget.

---------- Post added at 08:10 AM ---------- Previous post was at 08:02 AM ----------

Yes, I have. If the hash is cracked, DPT can be rooted without disassembling and re-soldering the eMMC chip. However, I desoldered the eMMC chip and dumped the firmware. However, I now have trouble re-soldering the chip back after modifying the content inside. The PCB is too thin that it was broken when heated. The device is now totally a brick and I have sent it to an experienced engineer to see if it can get recovered.
[General Questions and Answers] hadesome1:
Another chinese hacks DPT-RP1 and DPT-CP1，support Magisk & Xposed. Can be used as a computer monitor，Looks so cool！

=

And he supports remote hack！

=

https://item.taobao.com/item.htm?id=571237107893

=

The video link

https://v.youku.com/v_show/id_XMzkwODcxNzA4OA==.html

=
[General Questions and Answers] shankerzhiwu:
Rooted DPT-RP1

Hi, all I have ROOTed my DPT-RP1 (in fact., my friend's). Here is a brief guide:

Before rooting:

1. Make a usb OTG cable described in the quoted post, aka. an OTG cable whose ID pin is soldered with 7.87 k resistor to GND.

2. Make sure that you can reproduce the steps described in the quoted post and get a login tty.

3. Press the reset button with a sim-ejector or so to put the device in normal mode. Don't worry, you won't lose your user data.

4. Prepare dpt-rp1-py tool (https://github.com/janten/dpt-rp1-py), make sure you can communicate with your DPT with that tool.

Rooting steps:

1. Download the modified firmware. Sha256sum is 5b9a10201d1cf29fbb072ebbfed517d22ddc00f014aef3ee816e43c2932e3803.

2. "Flash" the firmware into the device using `dptrp1 update`.

3. After flashing, the device will complain that firmware upgrading has failed.

4. Power off the device, and kick your device into diagnose mode. The password for root is set to `12345`

5. Now you have FULL control over your own device. Do whatever you want.

The download link for the modified firmware is https://gofile.io/?c=ezd8UX
[General Questions and Answers] ghostwheel:
Amazing!

Wow! Amazing (in theory... haven't tried it yet).

Thanks!
[General Questions and Answers] silvertriclops:
Who's gonna be the guinea pig? I want to try it but can't afford another one if I screw mine up.
[General Questions and Answers] shankerzhiwu:
Though I won't be responsible for any loss, the risk of losing a device is very low. The firmware I modified does not contain any meaningful payload. Even if anything should go wrong, the worst result would be that the firmware is simply ignored by the device and nothing happens.
[General Questions and Answers] 30sheets:
Hi everyone, and many thanks to the people who are putting lots of efforts into freeing the DPT-RP1 software.

I am ready to hack my own device. However, I would like first to ask [MENTION=9489357]shankerzhiwu[/MENTION] if he/she could explain how the modified firmware was generated? Is there a source for it, that I could compile myself? Or is it just some manual edit of Sony's official firmware?

Also, I would find it interesting if anyone has a particular tip on creating an OTG cable with the right configuration for this operation. I guess I could do it all by myself by following a tutorial, but I would find it reassuring if someone could share their experience about their own method of manufacturing the cable.

Again, many thanks to everyone involved.
[General Questions and Answers] shankerzhiwu:
It is manually modified from official FactoryReset.pkg. You can find it at https://github.com/octavianx/Unpack-and-rebuild-the-DPT-RP1-upgrade-firmware

By reading the `start_eufwupdater.sh`, you will know why my modified firmware works.

WARNING: If anyone wants to run `start_eufwupdater.sh` or `start_eufwupdater2.sh` with my modified firmware on his/her own computer, please DO NOT run as root, or the system could be damaged.
[General Questions and Answers] shankerzhiwu:
About the OTG cable, I have no shortcut available. Pinout of micro usb plugs can be found on https://en.wikipedia.org/wiki/USB_(Physical)#Pinouts . The 7.87 k resistor should be soldered between ID(PIN 4) and GND(PIN 5). Alternately, you can also use a 7.5k resistor. Since such resistor value is beyond OTG standard, you have to do the solder work. For simplicity, a breakout board can be used like www.digikey.com/product-detail/en/sparkfun-electronics/BOB-10031/1568-1192-ND/5673778 . Moreover, you can also choose to only solder the resistor itself without a USB cable. If so, after the gray rect is shown on the screen, the OTG plug can be safely disconnected and a normal USB to micro USB cable can be used to connect the DPT to your computer.

The detailed steps for entering diagnose mode are :

1. Power off your DPT.

2. Connect the OTG cable.

2. Press and hold the Home button.

3. With the Home button pressed, press and release the Power button.

4. Continue holding the Home button. See if anything is shown on the screen.

4.a. If "Welcome" screen shows, which means that the Home button is not detected pressed when booting, go back to step 1.

4.b. If nothing is shown on the screen and the power LED is also not flashing, which means that you are too nervous to trigger the power button -- your DPT is not powered on at all, go back to step 3.

4.c. if nothing is shown on the screen and the power LED keeps flashing, then the Home button can be released.

5. Wait for about 12 seconds. See if anything is shown on the screen.

5.a. If the screen flashes blank and the power LED stops flashing and turns off, which means that the id resistor is not soldered well (ill-connected or wrong value)., check your OTG cable and go back to step 2.

5.b. if a gray rect is shown on the screen, the device is now in diagnose mode

6. If a USB cable is not soldered with the micro USB plug, you can now unplug it and use a normal micro USB cable to connect the DPT with your computer.

7. A USB modem device should now be detected on the computer. Use a serial terminal software to access the diagnose tty.
[General Questions and Answers] silvertriclops:
I'm not knowledgeable enough to do this but is there any way you could modify the package to provide a way to access the shell without the OTG cable? I personally don't have a soldering iron but would love to root mine. Could maybe include an SSH server (and assume that anyone who wants to root it knows how to secure it further), or ADB, or possibly enable the debug port in normal mode.

In fact, it probably has ADB already and is just disabled.
[General Questions and Answers] shankerzhiwu:
Sorry, but I have no idea how to make such a package. What I can do is only write at most about 230 bytes to an arbitrary file. As a result, the best thing could be to override the file containing the password hash.

BTW, There is no adbd available and it should be compiled and enabled by yourself.
[General Questions and Answers] shankerzhiwu:
Hi, all

Good news for guys who do not want to make the OTG cable! I made another firmware to remove the detection of the special id resistor. The download link is https://gofile.io/?c=NE6qV8 and the sha256sum is ce57b43fe59364724580908e967fa4d68eab608a457ad3a3a4a249cd009d3b1d.

Use this firmware ONCE and ONLY ONCE, and the detection of the special id resistor will be removed. To enter diagnose mode, only pressing Home button is needed.

WARNING: I recommend AGAINST the use of this firmware, because I did not test this firmware on a not-rooted device. If something unexpected happens, the firmware may do harm to your diagnose environment, which means including but not limited to:

* your DPT may not be able do firmware upgrade anymore, or

* your DPT may get stuck in diagnose mode and cannot boot normally.
[General Questions and Answers] cypresstwist:
Play Store?

Would you be able to implement Google PlayStore functonality in this firmware? I would love to have Pocket and EPUB support on this device.
[General Questions and Answers] silvertriclops:
From what OP said earlier it looks like adding apps to the firmware is not possible. I don't want to risk my device with the non-OTG firmware but will try to get ahold of the right cable later today and start experimenting with installing the play store.
[General Questions and Answers] shankerzhiwu:
Some clarification is needed for my two "firmware"s. They are NOT real firmwares, and they cannot upgrade or downgrade your system. Nothing meaningful is contained in them. The ONLY function of the "JB.pkg" firmware is to set the root password for the diagnose environment and "JB2.pkg" firmware is to disable the detection of the special ID resistor. The two firmwares are independent and of different functions. They both exploit the same bug in the firmware upgrade script.

Valid firmwares are digital signed and cannot be repacked without the signing private key.

---------- Post added at 02:27 AM ---------- Previous post was at 02:04 AM ----------

After gaining root privilege, you can do anything you want to your device. I can give some suggestions:

* Manually disable OTG detection. The modification is at `/usr/local/bin/diag_functions`. Make the function `DIAG_get_mode` always return 0. (My JB2.pkg does the same ting)

* Backup your current firmware

* Add an adbd program into the iniramfs image and make adb work

* Install a third-party launcher

However, this can be a huge task. At fist I thought it could simple and straight forward after gaining root privilege. After installing several applications, I found most normal Android applications not fit the digital paper screen well. The rendered text is too thin and hard to recognize. As a result, for normal users who only want to read epub books, I strongly recommend the rooted version sold on Taobao and GoodReader or their rooting services. Judging from their demo video, I think the root service is worth itself.

---------- Post added at 02:34 AM ---------- Previous post was at 02:27 AM ----------

BTW, the diagnose mode is not a standard Android recovery environment but a simplified ubuntu system.
[General Questions and Answers] silvertriclops:
How do you install apps? pm utility won't work simply after mounting /dev/mmcblk0p9 in diag mode (as expected) but I can't figure out how to get a shell in normal mode.
[General Questions and Answers] shankerzhiwu:
Use adb shell
[General Questions and Answers] silvertriclops:
Any way you could post your adbd? I can't get cross compiling down
[General Questions and Answers] yanzi:
hey great work! just want to say thank you! it's a clever way using pkg to overwrite and reset password for root. Have you tried to disable the pkg validation and install a customized pkg? If not, I'll take a look at it. But first try your method. Thanks again.

I know how to de-compile and compile pkg, with a self signed key. So it will be very helpful without needing usb anymore.

Another thing I haven't tried is to trigger the wifi webpage to display and through web vulnerabilities. Have you looked at it also? So I can confirm it works or not.

Sorry that's a lot of questions. But I'm quite busy lately so it would be awesome if you can share your thoughts and what you have tried other than the USB interface.

===============

and if possible, can you explain how'd you find the offset in pkg where it starts to validate AES and insert the following hex?

9043D58142271DC68044D8D8ACCCA48B139BD00B7FE9883E72BDBCF65EFCFCE9908143829900B781D7969536263688ECFEB29D24C362935EEAA7411FA13BAAC64004F72E7B7CB80E112AFED37C0A154DBC16B887A876CD584802563C159B54F6EA0F765F0EDBD0959D03DF2CF78AA74DB112CEB1E3A11A392E0B339A5ECCEF5179374BE8555016198FF7085B9416F385610F1211397FE5AA7AA6067A24FEADB5DF2D151435B70FA38F0CB38053A0E8E8D3114A8CACF5C70C697F554122BF863D6F9C0B488B62EE2FC224441DB6CF582EFC892B41F65212D9D69173FE4022681B49DD1CD31FB4CBC9BDD2F5FCFAE466779A5A0907A1F1653F629CF39246

===

never mind i got it

====

confirm it works; thanks for the great work again
[General Questions and Answers] shankerzhiwu:
Regarding the bash scripts, disabling the validation is not possible. The package is digitally signed and we do not have the signing private key. It is not wise to crack RSA digital signature/private key.

No, I haven't. Because I am not familar with Android things.
[General Questions and Answers] yanzi:
Yea I know you can't directly bypass the pkg validation. But it's possible after your hack I believe, with few tweaks. I like your solution. I was thinking about this direction, and I'm so glad you did it! Thanks again. If you don't mind, I will refer your hack in my original git and add a small script to automate this a bit. I confirm for a non rooted device, you can disable id check first, and then change password. But now this method is released, and I'm not sure how SNY reacts and whether they will update this.
[General Questions and Answers] shankerzhiwu:
You can directly replace the public key used for verification with your own. The command is `rawdata --set_dump=sig_key < your_own_pub_key`. Actually, the public key is stored in offset 0x83000 of the emmc flash.

Thanks for your confirmation and your refer is welcomed

Yeah, let's see what is going on next. However, the bug occurs in the script `start_eufwupdater.sh` and you know it is this script that calls the update script inside the firmware. What will happen if a running script is replaced? It is not easy for a firmware update to get this bug repaired.
[General Questions and Answers] chenlong828:
how to enable the adb after get root privileges? Can you give us a detail step?

Thanks for your effort!
[General Questions and Answers] yanzi:
The concept is to dump your boot partition, unpack it on your computer, unpack ramdisk, add adbd to /sbin/ and change the default.prop, and repack and flash it back to partition `/dev/mmcblk0p8`

Dump boot partition via `dd if=/dev/mmcblk0p8 of=/tmp/boot.img bs=4M`

When I get time this weekend i'll try it
[General Questions and Answers] sekkit:
Hi,

I know how to make apps display properly on DPT RP1. according to taobao root service description, it says XPOSED can adjust dpi for apps so that it can be larger.

Also changing the dpi settings of system can work too.