yashsingh1/xdaforums huggingface dataset:
[Nook Color Q&A, Help & Troubleshooting] Spookymonster:
Which is precisely why it isn't in their best interest to have it hacked to run vanilla Android. They're counting on the revenue from book sales and purchases from their curated app store.
[Nook Color Q&A, Help & Troubleshooting] yerand:
I don't agree, they knew that hackers would embrace such a low priced android tablet, but what's a few hackers when the majority of NC owners will pay over $100 on books.
[Nook Color Q&A, Help & Troubleshooting] cabbieBot:
they are going to get their book sales. as long as they dont lose money on the device, any NC sold is fine. more questionable is potential lost sales from the app store, but no one seems to know anything about what its even going to look like. is there going to be slingbox or angry birds....or just reading/education-related apps? That is whats going to ultimately decide the success of the NC. The hardware is rock solid. The software is TBD.
[Nook Color Q&A, Help & Troubleshooting] 10equals2:
But isn't there an Android B&N app? I've never used it, but how is it different from the store/way that the NC handles the purchasing of books now?

Is there anything stopping us from having our cake and eating it too?

Having a vanilla android install, and also purchasing books from B&N store?
[Nook Color Q&A, Help & Troubleshooting] PHiZ:
Building on the file:// work, here are some ideas.

* craft a .PDF or .epub with an internal link to file://Sdcard/application.apk (or whatever the appropriate directory is), and see if it executes with different privileges, or just hands off the link to the web-browser.

* Same as above, but host the .APK on an external website.

* rename an APK to PDF, Epub, Jpg, etc. and see what happens. (Some OS strictly interpret file extension, some look into file header to guess the type of file. There may be an inconsistency in permissions that can be exploited.)

* Put a symlink on SDcard, that points to nook filesystem. (I'm not sure how this would be helpful, but maybe it will spur people to think.)

* Would it be interesting to use File:// to peep at any TTY/Device files, or log files? Regarding log files, it might be interesting to see what the behind the scenes explanation for the ".apk denied" user message is.

Regarding sniffing network traffic, I am curious what the initial device setup process looks like. And what sort of "ping" the device sends out when it connects to wifi (we know it checks some website prior to launching the browser app, because captive portals cause a long hang.)

I imagine that any application store functionality would be cryptographically authenticated. I could see the browser relaxing the "no .apk" policy on certain authenticated domains, such as BN.com. It might be possible to masquerade as BN.com, using SSLstrip, and redirect to an .APK on one's own server.

I think this will probably be overkill, because the android browser is well-known, and runs javascript. I predict that the existing community will find an exploit through this route.
[Nook Color Q&A, Help & Troubleshooting] PHiZ:
I was just poking around the UI a little bit, and came up with some additional attack vectors.

* the nook store and some of the Extras (Pandora, Contacts) connect to the Internet. And they might run with different permissions than the browser. It would be interesting to do some html proxy re-writes to substitute APKs or just fuzzed data where the nook is expecting a jpg or whatever. See if it installs or crashes in interesting ways.

* Can someone put an .APK on the device and see if you can launch it through the search interface?
[Nook Color Q&A, Help & Troubleshooting] 10equals2:
Doesn't work. The search feature apparently does not locate files that it doesn't recognize. NC currently won't recognize .apk
[Nook Color Q&A, Help & Troubleshooting] pokey9000:
I've now got u-boot working and talking fastboot over USB. Get the zip from here and put it on a microsd formatted following these directions. Then power down, put in the card, and power back up. When you plug in USB fastboot should be able to connect. To get back to normal, take out the card and hold the power button for about 20 seconds.

Make sure to use a dedicated SD reader, i.e. don't use the Nook to format the card. If that fails, I have a disk image you can dd to the disk device of any card 128MB or bigger. It has just a 32MB FAT partition, so if you want to try to extend it somehow you're on your own. Get it here.

The USB ID has been changed from the OMAP default so it should work with the HTC fastboot client. Google for directions on how to use Fastboot on an N1 or G1.

Fastboot unfortunately is one way. You can use it to flash images or load a kernel and ramdisk, but not to read stuff out. So the effort now is to make a Linux image that we can throw on to read out what's in the flash, either to the microsd or over USB. Don't try to use any of the flash commands, they might actually work and brick your Nook until we extract the fw.
[Nook Color Q&A, Help & Troubleshooting] occip:
greetings !

It's a good news ! may be with usbtty we will able to dump the emmc . Developping a kernel image is not mandatory for now , because we can use the kernel uImage from emmc, we just have to build a small rootfs to communicate at a higher level with the NC.

Occip
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
Its pretty easy to poke around in the filesystem using the web browser. /proc/devices works but /proc/kmesg doesn't. I'm familiar with linux but not android specifics but I'm sure some useful info could be garnered. At the least its amusing me for a few minutes anyway :)

/proc/version yields the kernel version they built 2.6.29-imap1 but I think we already knew that. /proc/cpuinfo shows the cpu so we wouldn't have had to tear it apart to figure that out.
[Nook Color Q&A, Help & Troubleshooting] archongtv:
http://www.barnesandnoble.com/nookcolor/developer/?cds2Pid=35703&linkid=1641735 what about this? I think when SDK will come out it will be easier to view files on card.

Dumb question - is it possible to load own pdfs etc to nook color? How it is made? Is it possible to recognize what kind of software opens pdfs (if adobe - maybe it is vulnerable for exploits?).

What engine is used in web browser? Maybe it's vulnerable for javascript errors?

P.S. It would be funny to get full android on it and install kindle for android ;P
[Nook Color Q&A, Help & Troubleshooting] 10equals2:
Maybe it will. I doubt it though... the SDK won't help us copy the flash and get the information off it.

Yes, loading pdfs is possible. drag and drop.

The pdf reader is called quickpdf, a part of the quickoffice software.

Since the nook cannot currently install or run any apps, even if we could get the pdf reader to attempt to run something, it would still fail.

We'd have the same problem with javascript as we would with pdf. Neither address the fact that there is currently no way for the software to install stuff...

Or it's turned off. or whatever.
[Nook Color Q&A, Help & Troubleshooting] newton1666:
This is what I plan to do. Most of my digital books are in Kindle and iBookstore. The key for me is to have more than one bookstore, and the BIG one is to check out library books.

Can someone check if you can run adobe drm books on the nook color? I can use it in the form it is now while a wait for the community to hack this. If so, on the xmas list.

I got my hands on one at B&N, great screen, slow ui. I hope that it's 2.1 and not the hardware.
[Nook Color Q&A, Help & Troubleshooting] Spookymonster:
The android nook app handles books only. The nook devices also do magazine subscriptions. As for the curated store, it remains to be seen what B&N's cut is for each app, but it's certain to be more than what they see from any Market app sales (i.e., nothing).

People who want to hack the NC may be an insignificant number in the big picture, but that doesn't mean they want to encourage or endorse it.
[Nook Color Q&A, Help & Troubleshooting] madjsp:
it should be able to handle your library books through adobe digital editions, as long as they are ePub. It should work the same as the original Nook3g/wifi did.
[Nook Color Q&A, Help & Troubleshooting] tekrecon:
When you say "network dump" are you referring to a packet capture of the Nook Color during startup? If so, I have done that and can post a pcap file if anyone wants it.
[Nook Color Q&A, Help & Troubleshooting] jackjumper85:
I almost picked up a NC at best buy this morning... Just out of curiosity, what is the probability of us achieving root for the nook and installing a custom ROM, i.e. Cyanogen
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
Anything is possible. The TMobile G2 has a special chip to prevent people from hacking the system. However there is still a software Root hack available for it and it people have been hacking away. It will just take time.
[Nook Color Q&A, Help & Troubleshooting] pokey9000:
Very good.
[Nook Color Q&A, Help & Troubleshooting] boret:
I am very excited about the progress so far! Keep up the good work guys. I've been lurking in xdadev since I got my Captivate a few months ago. Now I am all over any progress to open up the NookColor.

I can't offer any technical advice but I can offer free hosting space for files if needed at some point.

I found a couple of annoying things on the current software version of the NC. It can't handle large pdf files. This is a quickoffice issue, as I have the same problem on the Captivate. And the LendMe app is broken. You can't see friends or books available to be lent. I am pretty sure they will come up with a software update fairly soon... before xmas.

Still, I think it is a great device for the price. I was waiting on the Samsung Tab as I like the 7" form factor better than the iPad, but the $600+ price is outrageous. For $250 on the NookColor I get what I need. A portable eReader, a browser, and the possibility to get some productivity apps once you guys open it up. Once I can do email, calender, etc... I will be set.

Someone mentioned it before and I completely agree, if B&N is smart about it, they will look the other way at hacking/rooting attempts, because at the end of the day it will make it a popular device, with a huge following.

Just wanted to post to thank all of you making contributions to this thread.
[Nook Color Q&A, Help & Troubleshooting] capnron65:
re: pdf file sizes

@ Boret Not sure what you consider a large pdf file, but I have a 42.8 MB pdf file on my NC. It handles it, but poorly - i.e. the search functions are almost nil.

Ron
[Nook Color Q&A, Help & Troubleshooting] boret:
Hmm, then it must be the number of pages.

I carry my motorcycle service manuals on pdf. The one for the Suzuki DL1000 is 450 pages and 20MB. All I get is a white blank page with a thin line red cross.
[Nook Color Q&A, Help & Troubleshooting] SystemIdleProcess:
It's probably an image embedded PDF instead of textual PDF.
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
I've made my own PDF using OpenOffice with both pictures and words and it works fine.

However that motorcycle manual may be using pictures that are entirely too large to fit into memory. It is typical when inserting exploded views into a PDF. I've seen desktop PC bottleneck up to the same issue with exploded view PDFs.
[Nook Color Q&A, Help & Troubleshooting] Mastiff:
Actually your problem is that the Nook has a certain sense of pride and only accept Yamaha manuals! ;)
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
LOL!! :D

But then why do my Kymco Manuals work?
[Nook Color Q&A, Help & Troubleshooting] Philosophy757:
Any way to pull the keyboard up while viewing PDF? My school PDF are protected and I have to enter my login info to view them.
[Nook Color Q&A, Help & Troubleshooting] aludal:
pokey9000 must be very busy digging into his new found hole...

Anyway fineoils.blogspot.com offers 2-day summary of main approaches and achievments, as usual, together with my take on these.
[Nook Color Q&A, Help & Troubleshooting] John-Galt:
@boret, I had the same problem with LendMe, until I figured out that my wife and I had to add each other to "contacts" before it would work. We also had to enable LendMe for each book we want to lend. After that, it works like a charm.

Like you, I'm watching the progress closely, hoping it's ultimately successful.

John
[Nook Color Q&A, Help & Troubleshooting] modembug:
Starting to get kind of spammy dude, folks that want to see it can look back at the past few posts like this...
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
It seems like since we can boot off microsd that ubuntu could be compiled for omap3xxx and put on a card. Once we have access it'd be simple to read the nooks file system. Or perhaps I'm missing something.
[Nook Color Q&A, Help & Troubleshooting] HotShotAzn:
Agreed.

(10 chars)
[Nook Color Q&A, Help & Troubleshooting] axe2:
Anyone know if this can be made to boot with fastboot?

https://wiki.ubuntu.com/ARM/OMAPMaverickInstall
[Nook Color Q&A, Help & Troubleshooting] boret:
LOL, I'll try with the R6 manual ;)

Thanks John, I will try that. I still think they need to make it a bit more user friendly.
[Nook Color Q&A, Help & Troubleshooting] lekofraggle:
probably not going to happen but...

As you all are looking at hardware and grumblings of basic linux boot hapen I was wondering if anyone found outif this had usb host? I would love to beable to move photos off my camera and onto an external drive on the road. I came to he conclusion this would not be possible, but I also dd not think it could run a full linux kernel.

Thank you all for your work.

~Leko
[Nook Color Q&A, Help & Troubleshooting] robinson.me:
Files in Browser

Not Found:

file:///system/bin/bash

file:///system/bin/cp

file:///system/bin/dash

file:///system/bin/hostname

Folders Not Found:

file:///system/boot

file:///system/dev

file:///system/home

file:///system/mnt

file:///system/opt

file:///system/proc

file:///system/root

file:///system/sbin

file:///system/srv

file:///system/var

Display Issues:

file:///system/bin/cat

file:///system/bin/chmod

file:///system/bin/chown

file:///system/bin/date

file:///system/bin/dbus-daemon

file:///system/bin/kill

file:///system/bin/ls

file:///system/bin/mkdir

file:///system/bin/mount

file:///system/bin/ping

file:///system/bin/sh

file:///system/bin/toolbox

Can not access as they are folders:

file:///system

file:///system/bin

file:///system/etc

file:///system/lib

file:///system/lost+found

file:///system/media

file:///system/usr

Readable:

I'm certain there has to be a way to access the file structure without root access at least in some read capability. However I don't know enough about it to get too deep. In any case I was checking various files that are within linux and figured knowing that a few of these files are there may be helpful.

Also, has anyone been able to locate where the pre-installed apps (suduko, chess, etc.) are at in the file structure? Because I was looking through all the various files and found the books under /media/media/B&N Downloads/books (on Ubuntu) but there is nothing under Extras where one would imagine the apps would be. If we can discover where those apps are pre-installed we might could side-load an app.

Just a thought.

If there are specific files people need checked (and they don't have an NC yet) just let me know I'll look for them.
[Nook Color Q&A, Help & Troubleshooting] pokey9000:
In my digging through datasheets, it seems both the CPU and the PMIC chips used in the Nook Color support USB OTG, but it depends on how B&N wired them up. Time will tell if it actually works.
[Nook Color Q&A, Help & Troubleshooting] rutter9:
I agree with the others. All you are doing is copy and pasting on to a blog. Please stop spamming your "site".
[Nook Color Q&A, Help & Troubleshooting] lekofraggle:
wonderful

Thanks alot. I will wait paitently. You are all the best.

~Leko
[Nook Color Q&A, Help & Troubleshooting] zer0her0:
Starting to? This cat has been spamming his blog since the beginning and posts it every page or two, I've yet to see him contribute anything, I'm @ the point to ignoring anything he says.

In other news, any further progress on the fastboot via microSD card front?
[Nook Color Q&A, Help & Troubleshooting] therealguppy:
Hey I don't know if this is use full or not, but I thought I would throw it in, since i haven't seen anyone else mention it.

I was playing around with my nook tonight, and took a .APK of a game and renamed it .m4v and tried to open it via the File manager and the Movie player opened it and started playing the music that was part of the game. when I unzipped the APK I found the file it was playing which was the first MP3 in the Dir Structure.

No idea if this can be used for anything or if its just a odd quirk of the software
[Nook Color Q&A, Help & Troubleshooting] modembug:
I was being polite lol
[Nook Color Q&A, Help & Troubleshooting] cjthebest:
....................
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
Well, english isn't his first language, russian is. I think he's just over excited but not really hurting anything other than annoying us with the same links.
[Nook Color Q&A, Help & Troubleshooting] cjthebest:
Sorry. I regret what i posted :(
[Nook Color Q&A, Help & Troubleshooting] Mastiff:
Seems the Nook has a sense of ironi as well! ;)
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
Non-Root Solutions

Genius ideas phiz! They do need some modifying though.

so far in the field of getting a file to link off to the ".apk" i have discovered that links will show up but not work with ".pdf" files or ".epub" files and the only way to even get a link in a pdf or epub successfully is to make a html file (using 'a href' or link tags for the link) and then convert it to pdf or epub (i used calibre for Ubuntu 10.10). BUT A SUCCESS was made when putting the link in a ".doc" file then opening it... the problem is when it opens the browser it opens as http: // NOT file: /// but we now know that a solution is out there we just need to work around the http: // thing.

i am currently trying your other ideas.

great work phiz, keep it up

P.S. i am currently trying to get the NOOK app for Android on the NC because there is a chance that it will authenticate itself as Barnes and Noble in the "Manifest.xml" file and remove the "no unknown sources".
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
he is contributing more than those of you talking about motorcycles.

i think he is contributing by allowing us to see a quick summary of the past 2 days events and not have to skim through all of the non-relevant motorcycle cra p .
[Nook Color Q&A, Help & Troubleshooting] axe2:
pokey9000,

I now have an sdcard containing your u-boot, and it appears to be working, but I I'm having difficulty finding drivers. I'm using Windows 7 (64 bit), and it shows 2 new devices: OMAP3630 and Zoom2. Do you know where I can find Windows 7 drivers for these devices? I found references to an OMAPFlash package, but I can't find that either. I can use Linux as well, but it's not as convenient.

Great work so far! I would would like to try to help if I can get this setup.
[Nook Color Q&A, Help & Troubleshooting] pokey9000:
I co-opted the HTC fastboot USB vid/pid so you can follow directions for setting up fastboot for G1 or Nexus.
[Nook Color Q&A, Help & Troubleshooting] aludal:
Nomad has offered to use the exploit based on this A. 2.0, 2.1 vulnerability:

Vulnerability Summary for CVE-2010-1807

Original release date:09/10/2010

Last revised:11/11/2010

Source: US-CERT/NIST

Overview

WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2, and Android before 2.2, does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

So, the presumption is the vulnerability was discovered quite recently, after the original NC firmware was finalized, hence it's not patched in NC yet. He offers the services of injecting abdb out of his server, but the risk of bricking the NC is kinda big. The discussion is described in my blog.

And yes, it's in Russian, as I have no time to translate right now: time zones difference between me and Moscow is 11 hours. Use Google Translate.

Of course, those who think I'm a spammer don't need to go there.

And as always: I'm a messenger, and the author is Nomad, and if it doesn't play out as we might want, call it a patched vulnerability, not a "spam"
[Nook Color Q&A, Help & Troubleshooting] modembug:
This information is not spam, your constant linking to your blog from the forum is VERY spammy.
[Nook Color Q&A, Help & Troubleshooting] modembug:
The following is the post from Nomad ran through google translate :)

method is to use the exploit CVE-2010-1807, of which at XDADevs mentioned, but apparently did not dig and understand how it works.

To get through it access should open a specific browser page and parallel to hold an open listening server (nc or anything else) over IP, spelled out in the page. At boot time, we do not know when the exploit has worked - there will be no warnings, no nothing. The browser also does not respond. Moreover, somewhere in a minute memory ends and the browser will fall.

On the server can also find out whether the exploit was just typing any system command, for example, / system / bin / ps

In the case of NookColor likely will be enough to make

echo «service new_adbd / sbin / adbd»>> / init.rc and restart.
[Nook Color Q&A, Help & Troubleshooting] modembug:
Id be willing to host a copy of this exploit on my webserver if it helps anyone!
[Nook Color Q&A, Help & Troubleshooting] clockworx:
If this works, I would think you could use it to dump flash to the sdcard, which should be relatively safe as opposed to, say, flashing new stuff.
[Nook Color Q&A, Help & Troubleshooting] modembug:
I think the first step is to setup a payload that just causes the browser to crash, or perhaps delete a test.txt file from the sdcard etc...
[Nook Color Q&A, Help & Troubleshooting] psychoticsmiley:
Nook Developer?

Great job so far guys, (been trolling and love where this is going)

Btw has anyone actually gotten access to the nook developer site so far or like me are you in the waiting game for the email to come withing 10-15 business days?

Also typically in the developers sites they have to have the source files right?

you can't develop without having the actual os, do you think they will have a software copy of the source like how apple does?

I wish B&N had an app or two available on their site so we could 1 re-route the traffic to a webserver and load any .apk's that we want making the nook color think that it is hitting their server.

That could also lead to a rewrite of their code making B&N a local host on the nook color, possibly even the memory card to then install whatever we want.

Hell it could even be in an html/ xml, or doc list of files on the mem card.

Keep up the amazing job guys!
[Nook Color Q&A, Help & Troubleshooting] modembug:
I wonder if that would bypass the cannot install apk files from unknown sources? Perhaps if the B&N domain were spoofed on a local DNS/Webserver APK files could be installed via the web browser.
[Nook Color Q&A, Help & Troubleshooting] eduardx:
About:debug

This is my first post and I don't know if this might help someone, but I found that you can type "about:debug" in the nook's browser just like you would do on an Android phone. It gives you access to the JavaScript console, and it enables an option to change the User Agent on the settings menu. I found this trying to get the iPhone gmail website on the browser.

Screenshot: img222.imageshack.us/img222/788/1011271.png

English is my second language