yashsingh1/xdaforums huggingface dataset:
[Nook Color Q&A, Help & Troubleshooting] psychoticsmiley:
That's exactly what I'm saying. Right now it's hit or miss until they have a live app that is available.

I'm just surprised that they didn't have another app or two available for purchase or something up before launch.

Didn't any of these companies learn Anything from Apple?

-edit -

It might be worth it to spoof B&N dot com to see if it works anyway.

or similar links like B&N dot com /apps or /appstore or /nook/app etc.
[Nook Color Q&A, Help & Troubleshooting] modembug:
They are supposed to have the app store early 2011 :\, chances are there will be a rom developed or we will have this bad boy rooted prior to their app store launch
[Nook Color Q&A, Help & Troubleshooting] modembug:
Nifty Keen :D
[Nook Color Q&A, Help & Troubleshooting] aludal:
Here's more precise translation:

"The method is based on using an exploit [based on vulnerability] CVE-2010-1807 which was mentioned at XDADevs, but obviously didn't try to dig deeper and understand how it may work.

To get the access via this exploit, one can open a special page in one's [NC] browser and also keep a running listening server (nc (?) or something else) by IP [address?] indicated on that page. We don't see any indications, or messages when the page is loaded. the browser itself also won't react. Moreover, browser will crash in a minute or so when out of RAM.

At the server's side, one can determine whether the exploit was successful by typing in some system command, a '/system/bin/ps', for example.

In case of NookColor, it might be sufficient to just issue "echo «service new_adbd /sbin/adbd» >> /init.rc" and reboot. To see whether the exploit worked, one can open file:///init.rc in the browser and check whether the adbd is in the correct path.

I could prepare and host a corresponding Web page and a server for several minutes, but it should be done in a concerted effort, and not with a time lag of 8-9 hours and talking in a blog."

Brakets [...] are for my assumptions.

In my answer (in Russian still) I asked whether some of XDAdevs could start such a server, for themselves.

Now, I would like to add: take a lot of care trying this. Crushing the browser with a vulnerability of this (perceived) strength may brick the device.
[Nook Color Q&A, Help & Troubleshooting] modembug:
ive been looking for the code snippet for this, anyone have any ideas?
[Nook Color Q&A, Help & Troubleshooting] aludal:
Obviously, Nomad has one. On my PDN, it didn't work yet, so he's rewriting it as we speak. But the vulnerability is here: the browser loads some code till it crushes. The thing is to execute some /system/bin/ps command, or to poke in some other manner.
[Nook Color Q&A, Help & Troubleshooting] modembug:
I was just curious if there was anything published out there in the interwebs to tinker with :)
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
The word you're looking for is "crashes" not crushes. Hopefully this will yield some results. I'd love to be able to install Dolphin as a browser instead of the default. I'm still leaning toward the bootable SD card as the solution though.
[Nook Color Q&A, Help & Troubleshooting] joeld82:
Is the Nook Color awesome or or what?
[Nook Color Q&A, Help & Troubleshooting] yerand:
If we figure out how to sideload apps, would it be possible to sideload adw launcher and switch between adw and the nook ui whenever we want?
[Nook Color Q&A, Help & Troubleshooting] modembug:
Should be able to
[Nook Color Q&A, Help & Troubleshooting] aludal:
well, my humblest apologies.

But so far, it's like both: the browser unloads, but before that, a server at Nomad's has not been able to get the access for, say, /system/bin/ps on my PDN.
[Nook Color Q&A, Help & Troubleshooting] pokey9000:
Yeah, I tried this from my own webserver and while the browser crashes it doesn't open a socket to the target address.
[Nook Color Q&A, Help & Troubleshooting] aludal:
Nomad suspects that either what code he wrote doesn't work outright, or the (his) server was unnecessarily firewalled.

At least, the vulnerability is here. It just takes some malware/virus coder to use it, so one day somebody will see something like "All your base (Nookbooks) are belong to us" on his/her NookColor.

Just kidding, calm down you motocycle lovers...

It may also pay to look for more Android 2.1 Browser vulnerabilities of this severity level, I guess it's not the last one unpatched.
[Nook Color Q&A, Help & Troubleshooting] Mastiff:
Hey, bikers can have humor too you know! Maybe rough and primitive humor, but still humor! ;)

More on topic, I think the spoofing of a B&N app store sounds like a really sneaky idea. Maybe a ready made solution could be made into a virtual machine for VMWare so aybody could put in any Android program they would like.
[Nook Color Q&A, Help & Troubleshooting] modembug:
not as elegant as just having root access or a custom rom :\
[Nook Color Q&A, Help & Troubleshooting] Mastiff:
No, it's not. But maybe as an interim solution, if this is possible before somebody finds out how to root it completely.
[Nook Color Q&A, Help & Troubleshooting] modembug:
Very true, and easy to try... just need to learn the addy of their app market lol
[Nook Color Q&A, Help & Troubleshooting] modembug:
http://imthezuk.blogspot.com/2010/11/float-parsing-use-after-free.html

Perhaps the exploit mentioned here would give us some joy? I am going to read into it a bit more.
[Nook Color Q&A, Help & Troubleshooting] aludal:
It sounds really sneaky because it is, hehe. But with no "active" B&N server which might send legit commands to NC's and which are supposed to be spoofed, any "crafted" server with a looping/malicious script ca do (in principle) what the "B&N server spoofing" was meant to do: inject some commands/executable code/rooting tools/chmod, dumps, terminals, the whole 9 yards.

So far, it is proven that the NC's browser can be "stunned". What's not proven is whether any socket to the intruding server can be opened and maintained long enough to inject a "security breaking" code during these 12-20 seconds while the browser eats RAM like crazy.

Any code injection scheme deserves its own research, even a sideloading approach, of say, a "sneaky" PDF book designed to exploit the NC's PDF reader vulnerability. The problem is who knows these, plus who knows how to write that malicious "PDF" code.

"Good" page with lots of "interesting" (or some say, "test") Java/Javascript code can wreck a havoc to even more buttressed browsers than that silly toy from

Google.

At last, the hole discovered by pokey9000 is here still, and widening, so to speak, if ever so slowly.

Sun is shining bright -- even if rains all day here in Capitola. And actually I like motor people, even those goofs from OCC. I like their artists, plus some of the design ideas thrown here and there. Well, I'm a starving artist myself, heh.
[Nook Color Q&A, Help & Troubleshooting] modembug:
http://nookdevs.com/Rooting_New_Hardware_No_Router

Put this method along with a WAMP installation on a laptop you might be able to spoof the B&N server and get some sideloading going on... Going to give it a shot at some point..
[Nook Color Q&A, Help & Troubleshooting] axe2:
I'm not getting anywhere with this. All the instructions that I find say to simply point Windows at the usb_driver directory and it should find the driver, but this doesn't work for me. I've tried forcing the fastboot driver on the Zoom2 device, but that doesn't seem to be working either.

Has anybody gotten this to work on Windows 7?
[Nook Color Q&A, Help & Troubleshooting] aludal:
Hell, it works like a charm. Sorta. Just copied and pasted the code in my blog, and here we are, my Opera, and Firefox crashed like in seconds. I deleted the "malicious" post from Chrome which was reacting much slower for some reason.

"Some joy" it is, be assured, Mr. modembug.
[Nook Color Q&A, Help & Troubleshooting] axe2:
Isn't that the same exploit that was mentioned earlier today? In any case, I tried this one a couple of days ago and it didn't work.
[Nook Color Q&A, Help & Troubleshooting] modembug:
yeah i guess it is, for some reason i thought it was something different. Oh well, ill give it a shot anyway.
[Nook Color Q&A, Help & Troubleshooting] modembug:
So did u change the ip addy to ur host in that script? Did u run the listener on ur home pc with port forwards? Interested to see ur method as I'm farting around with virtual ip addresses to mimic his config..
[Nook Color Q&A, Help & Troubleshooting] aludal:
Whose config? Itz? or Nomad's? They are kinda different as far as I can tell. Nomad didn't tell me which version of the initial script -- MJ's or a simplified of his own coding/based on Itz -- he used. I believe it's not that important. He started the server on his runserver.net/temp/test, I pointed the browser in my PDN to that and watched the browser crashing, and the PDN slowing significantly for a minute or so. Then we synced over Google Talk, so he tried to netcat and issue something like echo «service new_adbd /sbin/adbd» >> /init.rc while my browser was bloating (12-15 seconds). Then he used 'system/bin/ps', just to check whether there's any response. I turned off NAT/Privoxy, nothing.

Now, the Itz script worked on my WinXP machine by plain posting of uncommented script on my blog. Wanted to view it, and boom! That's what I call shooting my own foot. Vulnerability is fresh, and not patched in Opera, Firefox. Even Chrome was breaking but slowly enough for me to delete the whole offending post.

My suggestion is to follow an Itz advice to modify his script by addition of battery of probes via netcat, so something will stick, eventually. Nomad didn't wake up yet, obviosly, to share his thoughts on what went wrong. If nothing helps, there's a good chance to get some qualified help from Itz. It just takes somebody more knowledgeable than me, to ask.
[Nook Color Q&A, Help & Troubleshooting] archongtv:
KCHASE731: could you please tell me how does other side (I mean bottom of motherboard) of memory chip looks like? Maybe it's possible to directly attach to pins and read whole card directly.
[Nook Color Q&A, Help & Troubleshooting] KCHASE731:
the last set of photos are the underside of the board.
[Nook Color Q&A, Help & Troubleshooting] axe2:
I think I got fastboot setup on windows. The secret was adding the following to android_winusb.inf:

%SingleBootLoaderInterface% = USB_Install, USB\VID_0BB4&PID_CAFE&REV_0311

The key that I was missing was the SinbleBootLoaderInterface tag...

Where do we go from here? It looks like there's an omap kernel here:

https://wiki.ubuntu.com/ARM/OMAPMaverickInstall

If we can figure out how to boot this kernel with a minimal init script, we might be able to start poking around the system (assuming it has the required drivers). Even without a shell, we should be able to get to a point where we can turn on ADB and root it if we can figure out how to get some form of output.

pokey9000 are you working on anything along those lines?
[Nook Color Q&A, Help & Troubleshooting] psychoticsmiley:
I was thinking the sane thing. With both sides the voltage and ground should be easy and the rest should follow there. Hell reading it like that, you should be able to write to it as well.

That would be a solid local hack, which would give us the file system for a remote hack.
[Nook Color Q&A, Help & Troubleshooting] bphillips09:
The script runs, but not easily.
[Nook Color Q&A, Help & Troubleshooting] aludal:
Mods to CVE-2010-1807 exploit

There are some mods to the script of http://imthezuk.blogspot.com/2010/11/float-parsing-use-after-free.html I collected and posted in my blog -- directly from the author.

Have a look and try. It looks like a much more massive attack.
[Nook Color Q&A, Help & Troubleshooting] bphillips09:
ePub files

So, I'm not sure if this has been mentioned yet or not, but the eBooks bought from the B&N Store are .ePub files. These files, when extracted, are simply .htm/.html files. All the books are in .html! I've tried using the eCub software here: www(DOT)juliansmart(DOT)com/ecub to create my own ePub file with an HTML redirect to a .apk file, but that didn't work either, it just showed up as a blank book. Anyway, I'm sure someone can easily write an html code to be executed inside an eBook.

tl;dr: eBooks are written in HTML, therefore easily exploitable
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
I suspect regardless of how we call the apk file, the package manager won't let it install. B&N likely has some kind of signing or authentication that we'll need to deal with until a root has been discovered.

I've been playing with u-boot and trying to compile in usbtty support so we can at least see the console via usb but its slow going and I work 6 days a week.
[Nook Color Q&A, Help & Troubleshooting] clockworx:
I think it's just more the standard android way of doing things, Unknown Sources is disabled, and there's presently no way to enable it. Once the B&N Market is up, we may have another avenue of getting in "known" sources, as others have mentioned.

Huh, I just had another thought.

When we try to install a downloaded APK, we don't get the option to enable Unknown Sources. I wonder if this is due to Android detecting that Settings.apk is not installed, so there's no way to enable. This might present another avenue of attack if we gain a way to write, by pushing over a stock Settings.apk. Granted, by that point, we'd probably have many other options that this would be pointless, but another possible avenue never hurts.
[Nook Color Q&A, Help & Troubleshooting] Pinesal:
I am excited about rooting the Nook and truthfully the possibility is probably the only reason I bought one so I hope it happens soon.

Ok I have a thought that I haven't seen talked about yet on this thread.

The Nook Color does not have a back button or a menu button so this would be problematic for many apps. Is there a proposed solution for this?

EDIT: Ah yes, I see as Tom in AZ pointed out that his has been discussed on the first page. Silly me. We could use the volume keys as menu and back as a last resort. I would prefer soft keys. Could soft key be made persistent across all apps?
[Nook Color Q&A, Help & Troubleshooting] TheDoctor1971:
Yeah, if we had write access this would have been rooted already. You'd think since we can boot off microsd that someone would have gotten it to boot ubuntu or android by now. I'm sure there's lots of people experienced with embedded devices that could do it but I don't know any. I'm very familiar with linux and coding but this u-boot etc. is all new territory for me so I'm learning as I go.
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
We discussed this already. I had suggested to take the route that Velocity Micro did for their Cruz Tablet and Reader... They made soft buttons on the bar at the top of the screen.
[Nook Color Q&A, Help & Troubleshooting] archongtv:
About direct attaching to mmc. I talked with friend from robotics and he said that it's impossible to dettach (and attach again) that module 'cause it's BGA. But he said that there are many testpads so it is very possible that there's JTAG to connect to card (as firmware is probably injected during production). So when I will get my own nook (I hope in next 3 weeks) I will be able to try accessing mmc directly (but I think someone else will root it first) ;)
[Nook Color Q&A, Help & Troubleshooting] madsquabbles:
it does have a back and menu soft button. just load a pdf as you last read document. press the little book icon in any app and you'll see the back and menu buttons along the bottom bar. it doesn't work with full screen apps though.

just curious as to why the pdf reader is the only program that utilizes the buttons and why they're only available after using a pdf as your last read document.
[Nook Color Q&A, Help & Troubleshooting] aludal:
I'm still a believer in CVE-2010-1807 exploit. Whoever tried it on his NC's browser and have seen that browser stunned and crash, but no reverse connection, should try a modified script -- with all-out cavalry attack. Proposed script is placed in a series of HTML pages so connected as to load in the browser till the connection is made. The moment the connection is established you can run a truckload of adb, rooting tools, whatever, through that hole.

What stops anyone with NC, to try, I don't understand. The holidays?
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

I thought up and successfully executed a method to get utilities (calculator, office, calendar, etc.) and small games on the NC... i will post a link to a video demonstrating how to do this... i will post this video in about an hour and a half
[Nook Color Q&A, Help & Troubleshooting] king conan:
"get utilities" means install .apk's?
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
OK!! You have my attention!! :)
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

no... by utilities i mean java-script apps/utilities (non-android)
[Nook Color Q&A, Help & Troubleshooting] archongtv:
Yyyy in web browser or where?
[Nook Color Q&A, Help & Troubleshooting] Tom in AZ:
You still have my attention :) and thanks for being honest.
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

in the browser...

i modified a web-OS made for PSP... it is called Gnextop... it may not me much in the way of extra apps but it is more than nothing, i also found that you can use the Win7, Win Vista, and iPSP for the Nook as well... but modifications in the links and general sizes of things are needed still
[Nook Color Q&A, Help & Troubleshooting] archongtv:
There's also Eye OS. Is your solution similar to this one?
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

my camera is broken for the moment... i will try to get it fixed and have a video up soon... until then here are some screen shots to tame the crowd...........
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

yes it is similar... but what i am talking about is no internet connection needed; all local files
[Nook Color Q&A, Help & Troubleshooting] cabbieBot:
Um somethings up with this photos. Forgive me if I'm skeptical. Its almost like you are using LogMeIn or some web based remote access service from the NC browser
[Nook Color Q&A, Help & Troubleshooting] bphillips09:
That's what I thought at first, too, but you can see in the address bar: "file:///media/"
[Nook Color Q&A, Help & Troubleshooting] Aquarianperry:
This is another back button to it as well, if you in anything and want to go back to the last application just swipe from right to left on the blank space between the menu and setting soft button on the bottom black bar, I've gone from a book I was reading to the web then back to pandora using that :)
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

... and a tab-windows 7 or as i like to call it Nook7
[Nook Color Q&A, Help & Troubleshooting] :
Hate to sound stupid, but what are the images you've attached showing? I get the first set with the gnextop, but what is the win 7 stuff?
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

...and the rest of the Nook7 pics...

P.S. for this one i used... BlazeByte's PSP-Win7... which i modified to work better with the nook (i.e. no crashing as seen in Gnextop when looking for documents) but i can still work without mods.

P.S.S. I will post instructs (w/video and pics and text{duh}) with in a few (6) days... so just hold on until then.
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

look at the next set of pics they tie everything together... it is showing the setup and use of a different group of apps with a windows 7 style UI.
[Nook Color Q&A, Help & Troubleshooting] Spookymonster:
Yeah, I'm not getting it either. From the sound of it, he's executing javascript scripts, not apks. So we still don't have a vector for gaining root.
[Nook Color Q&A, Help & Troubleshooting] Ap3x Ve!0city:
A SUCCESS IN SIDE-LOADING APPS!!! (sort-of)

You are correct we still do not have a vector for gaining root access... but that was not the point of this; this was just to get the apps on that people wanted that were semi-necessities; ie: mail (from Nook7 [and i think it's on Gnextop too]), calculator (in everything), calendar (in Gnextop and Nook7), document processors - Spreadsheet and Word (in Gnextop and some-what in Nook7), Multi-Conversion calculators (in Gnextop)... etcetera (etc)
[Nook Color Q&A, Help & Troubleshooting] Spookymonster:
Got it. Thanks for clearing that up.
[Nook Color Q&A, Help & Troubleshooting] bobdude5:
i just played with one today at barnes and nobels..there is no way to install downloaded apk's :( i tried to get dolphin browser on there but it wouldnt let me. Everything has pinch zoom accept the damn browser.
[Nook Color Q&A, Help & Troubleshooting] pezhore:
Well I just picked up my nook. I'm attempting to figure out how to boot into recovery mode by holding down power and volume buttons... no luck thus far. Is there a forum other than this one dedicated to rooting the Nook Color?

EDIT: Found the Factory reset... Power + Home + Volume up
[Nook Color Q&A, Help & Troubleshooting] deeoh:
I found the factory reset, too, but no luck yet with booting in to recovery mode either. There's a thread in dev and hacking, but it hasn't seen any action: http://xdaforums.com/showthread.php?t=841912
[Nook Color Q&A, Help & Troubleshooting] aludal:
Hi, NC people:

In my blog fineoils.blogspot.com I presented a way of rooting attack for NC, have a look.

There's also quite a collection of reviews of those who had a "professional" hands-on experience, with my comments.

My opinion is the toy will be a smash hit, and after some hopefully light hacking it could outperform Galaxy Tab (antiglare screen outperforms it already, LOL)
[Nook Color Q&A, Help & Troubleshooting] KCHASE731:
went to BN for a book today

i wondered into BN do get a book, they had 2 Nook Colors in stock. I bought one right away...the only real reason is to read the news paper online with coffee instead of my laptop.

Ive been playing with it for a few hours and would love to contribute to a root. i would really like to get just a few apps on it. mainly k-9 mail. I have a rooted evo....and love esfile explorer also. would be really nice to be able to grab PDFs and ebooks from my computer wireless.

i think if this device does get rooted and quickly it will be the hottest device around. i played with a galaxy tab...its nice but i dont want a monthly bill. my dad has an ipad...and ive played with it many time. this device is a better size. it fits in my jeans pocket, or jacket. and makes a great little web browser.

so anything i can
[Nook Color Q&A, Help & Troubleshooting] aludal:
Once again:

I posted a link to a _possible_ way to root NC in my blog fineoils.blogspot.com

Now, here's the link for Droid X rooting: http://www.droid-life.com/2010/09/22/how-to-root-droid-x-running-official-android-2-2/

Sure, Droid X is OMAP3630, and NC's is OMAP3621, but for ADB they may use the same Moto driver.
[Nook Color Q&A, Help & Troubleshooting] forcedfab:
Except for the fact you can only connect to the nookcolor for usb file transfer as you can not turn developement mode on as bn's software overlays the android system....... its a great idea

Looks like we need to get it to boot into recovery mode to have a chance.