├── .gitattributes ├── Preloader.bndb ├── brom_8512.bin ├── docs └── sw_yocto_secure-boot_workflow.png ├── update.sh ├── EnableDevmode └── update.tar ├── DowngradePackages └── update.tar ├── pyproject.toml ├── getLatestUpdate.py └── README.md /.gitattributes: -------------------------------------------------------------------------------- 1 | *.tar filter=lfs diff=lfs merge=lfs -text 2 | -------------------------------------------------------------------------------- /Preloader.bndb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/notmarek/KoboTolinoFindings/HEAD/Preloader.bndb -------------------------------------------------------------------------------- /brom_8512.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/notmarek/KoboTolinoFindings/HEAD/brom_8512.bin -------------------------------------------------------------------------------- /docs/sw_yocto_secure-boot_workflow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/notmarek/KoboTolinoFindings/HEAD/docs/sw_yocto_secure-boot_workflow.png -------------------------------------------------------------------------------- /update.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | python getLatestUpdate.py 3 | git add README.md 4 | git commit -m "New version release, auto-update" 5 | git push -------------------------------------------------------------------------------- /EnableDevmode/update.tar: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:a6a8044c69cb682624562f7090c5cb2c500609fbecac6694d802cab0601c75be 3 | size 10240 4 | -------------------------------------------------------------------------------- /DowngradePackages/update.tar: -------------------------------------------------------------------------------- 1 | version https://git-lfs.github.com/spec/v1 2 | oid sha256:619507b2a1346879e080a3f07752a7f6cadbe5661840cedcb57c8b46920d8c91 3 | size 258344960 4 | -------------------------------------------------------------------------------- /pyproject.toml: -------------------------------------------------------------------------------- 1 | [project] 2 | name = "kobotolinofindings" 3 | version = "0.1.0" 4 | description = "Add your description here" 5 | readme = "README.md" 6 | requires-python = ">=3.13" 7 | dependencies = [ 8 | "requests>=2.32.5", 9 | ] 10 | -------------------------------------------------------------------------------- /getLatestUpdate.py: -------------------------------------------------------------------------------- 1 | from asyncio import get_event_loop 2 | import requests 3 | import re 4 | 5 | URL="https://api.kobobooks.com/1.0/UpgradeCheck/Device/00000000-0000-0000-0000-000000000{code}/kobo/{version}/T0" 6 | 7 | def walk(dev_code, version="0.0", prev_version=None, raw=None): 8 | if version == prev_version: 9 | return version 10 | 11 | res = requests.get(URL.replace("{version}", version).replace("{code}", str(dev_code)), headers={"Accept": "application/json"}) 12 | data = res.json() 13 | if data["UpgradeURL"] is None: 14 | return (version, raw["UpgradeURL"], raw["ReleaseNoteURL"]) 15 | next_version = re.search(r"-(\d\..*\d)", data["UpgradeURL"]).group(1) 16 | 17 | return walk(dev_code, next_version, version, data) 18 | 19 | MARKDOWN_TEMPLATE = "| {VERSION} | {MONTH} {YEAR} | [Normal]({URL}) | [Release notes]({NOTES}) |" 20 | MARKDOWN_REGEX = r"5\.\d*\.\d{6}" 21 | 22 | def get_latest_known(file="README.md"): 23 | with open(file, "r") as f: 24 | txt = f.read() 25 | found = re.findall(MARKDOWN_REGEX, txt, re.MULTILINE | re.DOTALL) 26 | return found[-1] 27 | 28 | last_version = get_latest_known() 29 | 30 | 31 | 32 | 33 | 34 | DEVICES = [ 35 | { 36 | "name": "Tolino Vision Color", 37 | "code": 690, 38 | }, 39 | { 40 | "name": "Tolino Shine BW", 41 | "code": 691, 42 | }, 43 | # { 44 | # "name": "Tolino Shine Color", 45 | # "code": 693 46 | # } 47 | ] 48 | month_dict = { 49 | "Jan": "January", 50 | "Feb": "February", 51 | "Mar": "March", 52 | "Apr": "April", 53 | "May": "May", 54 | "Jun": "June", 55 | "Jul": "July", 56 | "Aug": "August", 57 | "Sep": "September", 58 | "Oct": "October", 59 | "Nov": "November", 60 | "Dec": "December" 61 | } 62 | 63 | 64 | def get_version_md() -> dict: 65 | out = {} 66 | for dev in DEVICES: 67 | (version, url, release_notes) = walk(dev["code"]) 68 | 69 | url = url.replace(".zip", "/update.tar") 70 | date = re.search(r"\/(.{3})(\d{4})\/", url) 71 | 72 | month = month_dict[date.group(1)] 73 | year = date.group(2) 74 | # if (version != last_version): 75 | # print("NEW!") 76 | md = MARKDOWN_TEMPLATE.replace("{VERSION}", version).replace("{MONTH}", month).replace("{YEAR}", year).replace("{URL}", url).replace("{NOTES}", release_notes) 77 | out[dev["code"]] = { 78 | "new": version != last_version, 79 | "md": md, 80 | "version": version 81 | } 82 | # print(dev["name"], version) 83 | # print(md) 84 | return out 85 | 86 | data = get_version_md() 87 | readme = "" 88 | with open("README.md", "r") as f: 89 | readme = f.read() 90 | for x in data: 91 | if (data[x]["new"]): 92 | print(f"yooo we got a new thing for {x}") 93 | readme = readme.replace(f"", data[x]["md"] + f"\n") 94 | with open("README.md", "w") as f: 95 | f.write(readme) 96 | 97 | 98 | # # updates for vision are almost identical to shine but have foxit 99 | # print(, walk(URL, "0.0")) 100 | # # updates for shine bw and c are identical 101 | # print("Tolino Shine BW", walk(URL.replace("690", "691"), "0.0")) 102 | # print("Tolino Shine Color", walk(URL.replace("690", "693"), "0.0")) 103 | 104 | 105 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # KoboTolinoFindings 2 | 3 | ### This is targeted specifically toward the Kobo Libra Colour, Clara BW/Colour and their Tolino counterparts 4 | 5 | 6 | 7 | 8 | # Upgrading to 5.x 9 | 10 | - Before upgrading i recommend making a backup of your recovery partition `/dev/disk/by-partlabel/recovery` as it contains a base kobo fw image and can help you to get back to the stable 4.x branch 11 | - Links to most firmware versions can be found at [mytolino.de/software-updates-tolino-ereader](https://mytolino.de/software-updates-tolino-ereader/) (English site is missing new updates) 12 | - Conversion fw for Libra Colour is at `https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2024/tolino-qt5-qt6-update-5.1.184318/KoboRoot.tgz` 13 | - Conversion fw for Clara BW/Coulour is at `https://ereaderfiles.kobo.com/firmwares/kobo12/May2024/tolino-qt5-qt6-update-5.0.175773/KoboRoot.tgz` 14 | - You will not be able to use the built in update mechanism unless you switch to Tolino inside dev settings, you will instead have to sideload all updates manually by placing them inside `/mnt/onboard/.kobo` folders 15 | 16 | # Enabling devmode on 5.x firmware 17 | 18 | - Drop the [update.tar](https://github.com/notmarek/KoboTolinoFindings/raw/refs/heads/master/EnableDevmode/update.tar) file into `/mnt/onboard/.kobo` 19 | - After the update fails/applies search `devmodeon` - devmode should be enabled :) 20 | 21 | # Downgrading from 5.x back to stock 4.x 22 | 23 | - the update.tar in DowngradePackages is universal for the Clara (Shine 5) bw/c and Libra (Vision) Colour 24 | 25 | ### How do i do it? 26 | 27 | 0. If you in Kobo mode already skip to step 2 28 | 1. [enable devmode on your tolino](#enabling-devmode-on-5x-firmware) and switch to kobo `(this may not be required but i haven't tried it in tolino mode)` 29 | 2. sideload update.tar into your `.kobo` folder 30 | 3. eject your ereader 31 | 4. profit! 32 | 33 | # Updates 34 | 35 | - Updates have changed quite a bit since 4.x firmware 36 | - if `/etc/init.d/ota` finds one `update.tar|Kobo.tgz|serial.txt` 37 | 38 | ### Normal update 39 | 40 | ``` 41 | update.tar 42 | |- driver.sh # main file does most of the work 43 | |- decompressor # sh file used to decompress other files - this just has exec unzstd inside 44 | |- rootfs.img # flashed in stage2 - main part of the update a zstd packed ext4 image of the whole rootfs 45 | |- sha2-256sums # zstd packed list of sha256 hashes of the update files in HASH\tFILE_NAME\n format 46 | |- bl2.img # flashed in stage1 47 | |- uboot.img # flashed in stage1 48 | |- tee.img # flashed in stage1 49 | |- monza 50 | |- kernel.img # flashed in stage1 51 | |- ntxfw.img # flashed in stage1 52 | |- spa-bw 53 | |- same as monza 54 | |- spa-colour 55 | |- same as monza 56 | ``` 57 | 58 | - Normal update similar to KoboRoot.tgz 59 | - Can be found at `https://ereaderfiles.kobo.com/firmwares/kobo11/{Month}{Year}/tolino-qt6-update-{version}/update.tar` - kobo11 is vision/libra colour and kobo12 is Clara/Shine bw/c 60 | - Step 1. ota service extracts and executes the driver.sh while still in rootfs `/tmp/update/driver.sh $update stage1 $PRODUCT` 61 | - Step 2. if stage1 finishes without an error ota service proceeds to reboot into the recovery partition 62 | - Step 3. recovery notices an unfinished update and executes stage2 of the driver, it then reboots back to rootfs 63 | 64 | ### Recovery update 65 | 66 | ``` 67 | update.tar 68 | |- driver.sh # main file does most of the work 69 | |- decompressor # sh file used to decompress other files - this just has exec unzstd inside 70 | |- recoveryfs.img # flashed in stage1 - main part of the update a zstd packed ext4 image of the whole recoveryfs 71 | |- stock-rootfs # an empty file telling driver.sh stage2 to skip looking for a rootfs.img and instead flash the one thats included in the recovery 72 | |- sha2-256sums # zstd packed list of sha256 hashes of the update files in HASH\tFILE_NAME\n format 73 | |- bl2.img # flashed in stage1 74 | |- uboot.img # flashed in stage1 75 | |- tee.img # flashed in stage1 76 | |- monza 77 | |- kernel.img # flashed in stage1 78 | |- ntxfw.img # flashed in stage1 79 | |- spa-bw 80 | |- same as monza 81 | |- spa-colour 82 | |- same as monza 83 | ``` 84 | 85 | - This type of update replaces the recoveryfs meaning that you will stay on this update trough force resets using the right button + power combo 86 | - Can be found at `https://ereaderfiles.kobo.com/firmwares/kobo11/{Month}{Year}/tolino-qt6-recovery-{version}/update.tar` - kobo11 is vision/libra colour and kobo12 is Clara/Shine bw/c 87 | - This type of update is applied the same as a normal udpate, only difference is inside the driver. 88 | 89 | ### /usr/local/Kobo only updates 90 | 91 | ``` 92 | Kobo.tgz 93 | |- libnickel.so 94 | |- # etc whatever you want unpacked in /usr/local/Kobo 95 | ``` 96 | 97 | - You can use this type of update to enable devmode on the firmware by overriding `/usr/local/Kobo/branch` with a non-release branch eg. devmode (libnickel.so only checks for `release/` in this file to decide if it should run in release mode) 98 | - ota service extracts Kobo.tgz over /usr/local/Kobo 99 | 100 | ### serial.txt 101 | 102 | - Let's you change your serial number, this is the regex it's verified againts, i have no clue what `,[0-9a-f]{32}$` is meant to be 103 | `^SN-[TN][0-9]{4}[1-9A-C][0-9]{7},[0-9a-f]{32}$` 104 | - after verifying that the serial number is acceptable its dded into `/dev/disk/by-partlabel/hwcfg` 105 | 106 | # Known FW versions 107 | 108 | | Name | Function | 109 | |------------|--------------------------------------------------------------------------------------------------------------------| 110 | | Conversion | An update allowing conversion from the 4.x to the 5.x branch of the fw, uses old update format (KoboRoot.tgz) | 111 | | Recovery | Replaces the whole recoveryfs, also contains a rootfs image inside /recovery folder that is applied during stage2. | 112 | | Normal | Replaces the whole rootfs, the most common type. | 113 | | Kobo.tgz | Similar to the old KoboRoot.tgz, applied the same way. Updates /usr/local/Kobo. Never seen in the wild afaik. | 114 | 115 | ### Shine 5 / Clara BW/Color 116 | 117 | | Version | Release Date | Type | Notes | 118 | |------------|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----| 119 | | 5.0.175773 | May 2024 | [Conversion](https://ereaderfiles.kobo.com/firmwares/kobo12/May2024/tolino-qt5-qt6-update-5.0.175773/KoboRoot.tgz), [Recovery](https://ereaderfiles.kobo.com/firmwares/kobo12/May2024/tolino-qt6-recovery-5.0.175773/update.tar) | | 120 | | 5.0.178115 | May 2024 | [Conversion](https://ereaderfiles.kobo.com/firmwares/kobo/May2024/tolino-qt5-qt6-update-5.0.178115/KoboRoot.tgz), [Normal](https://ereaderfiles.kobo.com/firmwares/kobo/May2024/tolino-qt6-update-5.0.178115/update.tar), [Recovery](https://ereaderfiles.kobo.com/firmwares/kobo/May2024/tolino-qt6-recovery-5.0.178115/update.tar) | | 121 | | 5.1.184318 | July 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Jul2024/tolino-qt6-update-5.1.184318/update.tar) | | 122 | | 5.2.190625 | August 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Aug2024/tolino-qt6-update-5.2.190625/update.tar) | | 123 | | 5.3.195056 | September 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Sep2024/tolino-qt6-update-5.3.195056/update.tar) | | 124 | | 5.4.197982 | October 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Oct2024/tolino-qt6-update-5.4.197982/update.tar) | | 125 | | 5.6.209315 | February 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Feb2025/tolino-qt6-update-5.6.209315/update.tar) | | 126 | | 5.7.212781 | March 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Mar2025/tolino-qt6-update-5.7.212781/update.tar) | | 127 | | 5.8.216841 | May 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/May2025/tolino-qt6-update-5.8.216841/update.tar) | | 128 | | 5.9.220067 | June 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Jun2025/tolino-qt6-update-5.9.220067/update.tar) | | 129 | | 5.10.225420 | July 2025 | [Conversion](https://ereaderfiles.kobo.com/firmwares/kobo12/Jul2025/qt5-qt6-5.10.225420/Koboroot.tgz), [Recovery](https://ereaderfiles.kobo.com/firmwares/kobo12/Jul2025/qt6-recovery-5.10.225420/update.tar) | As of this version kobo has started testing the 5.x firmware on EU kobo devices, more info [here](https://www.mobileread.com/forums/showthread.php?t=361035&page=20) and [here](https://help.kobo.com/hc/en-us/articles/32246787707799-Kobo-eReader-Accessibility-Features-Software-Support), this also seems to contain a recovery update, probably to faciliate the downgrade option in accessibility settings. | 130 | | 5.12.232736 | October 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo12/Oct2025/tolino-qt6-update-5.12.232736/update.tar) | [Release notes](https://api.kobobooks.com/1.0/ReleaseNotes/175) | 131 | 132 | 133 | ### Vision Colour / Libra Colour 134 | 135 | | Version | Release Date | Type | Notes | 136 | |------------|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------| 137 | | 5.1.184318 | July 2024 | [Conversion](https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2024/tolino-qt5-qt6-update-5.1.184318/KoboRoot.tgz), [Recovery](https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2024/tolino-qt6-recovery-5.1.184318/update.tar) | | 138 | | 5.1.186250 | July 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2024/tolino-qt6-update-5.1.186250/update.tar) | | 139 | | 5.2.190625 | August 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Aug2024/tolino-qt6-update-5.2.190625/update.tar) | | 140 | | 5.3.195056 | September 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Sep2024/tolino-qt6-update-5.3.195056/update.tar) | | 141 | | 5.4.197982 | October 2024 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Oct2024/tolino-qt6-update-5.4.197982/update.tar) | | 142 | | 5.6.209315 | February 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Feb2025/tolino-qt6-update-5.6.209315/update.tar) | | 143 | | 5.7.212781 | March 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Mar2025/tolino-qt6-update-5.7.212781/update.tar) | | 144 | | 5.8.216841 | May 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/May2025/tolino-qt6-update-5.8.216841/update.tar) | | 145 | | 5.9.220067 | June 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Jun2025/tolino-qt6-update-5.9.220067/update.tar) | | 146 | | 5.10.225420 | July 2025 | [Conversion](https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2025/qt5-qt6-5.10.225420/KoboRoot.tgz),[Recovery](https://ereaderfiles.kobo.com/firmwares/kobo11/Jul2025/qt6-recovery-5.10.225420/update.tar) | As of this version kobo has started testing the 5.x firmware on EU kobo devices, more info [here](https://www.mobileread.com/forums/showthread.php?t=361035&page=20) and [here](https://help.kobo.com/hc/en-us/articles/32246787707799-Kobo-eReader-Accessibility-Features-Software-Support), this also seems to contain a recovery update, probably to faciliate the downgrade option in accessibility settings. | 147 | | 5.12.232736 | October 2025 | [Normal](https://ereaderfiles.kobo.com/firmwares/kobo11/Oct2025/tolino-qt6-update-5.12.232736/update.tar) | [Release notes](https://api.kobobooks.com/1.0/ReleaseNotes/175) | 148 | 149 | 150 | # Recovery Options 151 | 152 | - Fix your fuckups 153 | 154 | ### Recovery Partition 155 | 156 | - Assuming your bootloader and kernel aren't broken you can recover from broken rootfs updates by holding the right button + power until the light shuts off 157 | - Recovery will flash all the images stored in /recovery rolling you back to your recovery version 158 | 159 | ### Fastboot 160 | 161 | - Can be access by holding power and spamming right button with a cable connected to the computer 162 | - Very stripped down, not sure how useful, `flash` command ~~might~~ works -- I've managed to flash the serial number and some other things. 163 | 164 | # Boot 165 | 166 | - Some docs about the boot process 167 | 168 | ### BootRom (BL1) 169 | 170 | - SBC, SLA, DAA are disabled (Secure boot seems to be disabled for the preloader) 171 | - Can be accessed by shorting the download pads on the board 172 | 173 | ``` 174 | Preloader - CPU: MT8512() 175 | Preloader - HW version: 0x0 176 | Preloader - WDT: 0x10007000 177 | Preloader - Uart: 0x11002000 178 | Preloader - Brom payload addr: 0x100a00 179 | Preloader - DA payload addr: 0x111000 180 | Preloader - CQ_DMA addr: 0x10214000 181 | Preloader - Var1: 0xa 182 | Preloader - Disabling Watchdog... 183 | Preloader - HW code: 0x8512 184 | Preloader - Target config: 0xe0 185 | Preloader - SBC enabled: False 186 | Preloader - SLA enabled: False 187 | Preloader - DAA enabled: False 188 | Preloader - SWJTAG enabled: False 189 | Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False 190 | Preloader - Root cert required: False 191 | Preloader - Mem read auth: True 192 | Preloader - Mem write auth: True 193 | Preloader - Cmd 0xC8 blocked: True 194 | Preloader - Get Target info 195 | Preloader - BROM mode detected. 196 | Preloader - HW subcode: 0x8a00 197 | Preloader - HW Ver: 0xca02 198 | Preloader - SW Ver: 0x100 199 | Preloader - ME_ID: FA1F001954B53BEC0EC423FE9D59C26C 200 | Preloader - SOC_ID: 0000000000000000000000000000000000000000000000000000000000000000 201 | ``` 202 | 203 | - mtkclient has support for the SOC but i haven't been able to use it to extract the preloader 204 | - preloader can be optained from the update files (bl2.img) 205 | - you can also dump the preloader on device by using `dd if=/dev/mmcblk0boot0 of=/mnt/onboard/preloader.img` 206 | - Bootrom is available at `brom_8512.bin` 207 | - even tho mtkclient and other tools say that SBC is disabled a modified preloader image doesn't boot and device is forced into brom DL mode 208 | 209 | ### Preloader (BL2) 210 | 211 | - Packaged with every update inside the bl2.img 212 | - Does secure boot checks 213 | - Includes stripped down fastboot 214 | - My BinaryNinja db with some names and structs is present in `Preloader.bndb` 215 | 216 | 217 | # Other links 218 | 219 | - [pgaskin kobopatch issue #130](https://github.com/pgaskin/kobopatch-patches/issues/130) 220 | - [NerdyProjects koreader pr #12401](https://github.com/koreader/koreader/pull/12401) 221 | - [beedaddy koreader issue #12047](https://github.com/koreader/koreader/issues/12047) 222 | - [fohvok kfmon issue #9](https://github.com/NiLuJe/kfmon/issues/9) 223 | - [NerdyProjects kfmon pr #11](https://github.com/NiLuJe/kfmon/pull/11) 224 | --------------------------------------------------------------------------------