
It is comprised of a zip file containing several files: $ file updates/T626./*Īfter decompressing the SWUPDATE.BIN file using gzip, we obtain a binary file starting with a 0x400 bytes header, shown below. Reverse engineering the upgrade file formatįirmware upgrades for the device can be downloaded from both the retailer and the manufacturer website. It is possible by design to run custom software on the reader, and PocketBook has published several Software Development Kits on GitHub. There is also a Realtek RTL8188 (label1) Wi-Fi module on the top left of the PCB. Two debug interfaces are present, 4 UART pins on the right of the device (label 8), and some I2C pins next to the touchscreen controller connector (label 7). This processor drives two controllers (labels 4 and 5) for the touchpad and the electronic ink screen, and the firmware is stored in a SD memory card (label 4).

HardwareĪt the core of the reader is an Allwinner A13 system-on-chip, based on an ARM processor (label 6). There are several variations of this model, sold by several companies worldwide, but we assume that the hardware is similar and the findings should still apply.


This device is branded by a French Ebook company, but is manufactured by a Swiss company (PocketBook 1) and another company (Obreey 2), based in Ukraine. We will proceed in little steps, from getting to know the device, reversing its update file format, gaining an initial foothold, elevating our privileges and finally trying to explore some interesting parts.

The main objective of this blog post is to better understand the internal workings of the reader, in order to eventually root it.
