Hacking the new Nook GlowLight

[Edgur]

I just got a new Nook GlowLight (NGL), and came here assuming I would find all sorts of wonderful information about rooting it, and cool hacks I could do to make it more usable. Imagine my surprise when I could only find a couple of threads about it at all, with almost zero information! Finding information is definitely hampered by the name of the device. Any time I google for Nook GlowLight, 99% of the results are instead about the completely different product, Nook Simple Touch with GlowLight. Frustrating!

Anyway, in an effort to get the ball rolling, I will post the little bit that I have been able to find out about my NGL.



I cannot seem to ADB into it. I plugged it in, but ADB does not recognize it. It shows up as a regular mass storage device. The USB VendorID is 2080, and the ProductID is 0007. There seems to be no information out there anywhere about 2080:0007, unfortunately.



I took the back cover off to see if there was a magical "press here to root" button. Sadly, there was not. Since there does not appear to be a NGL teardown annnnnnnnnnnnnywhere on the whole wide Interwebs, I took some amateur photos of mine to share. I didn't want to chance breaking it, as I can't really go and buy a new one right now, so it's not torn down to the individual components, sorry. Hopefully it will be enough to spark some ideas, at least.

I don't know much about hardware hacking, but I've heard about JTAG ports being used to get inside of plenty of Android devices. One of the things I noticed was four unmarked copper pads on the board. That seems about right, as apparently most JTAG interfaces have either 4 or 5 lines, plus Ground. I created a picture with the four unmarked pads + Ground marked.



I know it's not much, but hopefully this information will spark some ideas from people with more experience in cracking these devices! If anyone else has additional information to add, please post it here.

 

[Renate]

Wow, thanks for the photos.

It's really interesting how they reformulated the Nook to use the small PCB.
It seems to be the same hardware basically.
They are using a different WiFi module than the Jorjin in the old Nooks.
There might be hope for having Bluetooth.

No, those four point that you circled are definitely not JTAG.
Some of the tiny gold contact points near the OMAP 3621 processor could be.
There is a missing IC at the top which could be a TXB0104 level shifter for a UART.
I'd be interested to see if/what is on the bottom of the PCB.

VID 2080 is B&N. They have been using the PIDs sequentially, so 0007 is expected.
Presumably it presents a single USB interface and one UMS volume.

Try rebooting the Nook with the USB connected to a PC.
Does it ever say, "New device found"?

You are not going to find an ADB without modifying the INF file for the ADB driver.

Try downloading Microsoft's UsbView from here. (Thank you, FTDI.)
Run it and select the Nook on the left pane, select all on the right pane and copy it here, please.

Oh! Be sure to overwrite your serial number on the text dump.
It's not a big security risk, but still....
Just type "MYSERIALNUMBER" or something.

 

[shanks7777]

USBview

Wow, thanks for the photos.

It's really interesting how they reformulated the Nook to use the small PCB.
It seems to be the same hardware basically.
They are using a different WiFi module than the Jorjin in the old Nooks.
There might be hope for having Bluetooth.

No, those four point that you circled are definitely not JTAG.
Some of the tiny gold contact points near the OMAP 3621 processor could be.
There is a missing IC at the top which could be a TXB0104 level shifter for a UART.
I'd be interested to see if/what is on the bottom of the PCB.

VID 2080 is B&N. They have been using the PIDs sequentially, so 0007 is expected.
Presumably it presents a single USB interface and one UMS volume.

Try rebooting the Nook with the USB connected to a PC.
Does it ever say, "New device found"?

You are not going to find an ADB without modifying the INF file for the ADB driver.

Try downloading Microsoft's UsbView from. (Thank you, FTDI.)
Run it and select the Nook on the left pane, select all on the right pane and copy it here, please.

Oh! Be sure to overwrite your serial number on the text dump.
It's not a big security risk, but still....
Just type "MYSERIALNUMBER" or something.

I'm not sure if this gonna be help. Anyway, I will copy the data from mine.

Device Descriptor:
bcdUSB: 0x0200
bDeviceClass: 0x00
bDeviceSubClass: 0x00
bDeviceProtocol: 0x00
bMaxPacketSize0: 0x40 (64)
idVendor: 0x2080
idProduct: 0x0007
bcdDevice: 0x0216
iManufacturer: 0x01
0x0409: "B&N"
iProduct: 0x02
0x0409: "NOOK GlowLight"
iSerialNumber: 0x03
0x0409: "MYSERIALNUMBER"
bNumConfigurations: 0x01

ConnectionStatus: DeviceConnected
Current Config Value: 0x01
Device Bus Speed: High
Device Address: 0x02
Open Pipes: 2

Endpoint Descriptor:
bEndpointAddress: 0x81 IN
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x00

Endpoint Descriptor:
bEndpointAddress: 0x01 OUT
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x01

Configuration Descriptor:
wTotalLength: 0x0020
bNumInterfaces: 0x01
bConfigurationValue: 0x01
iConfiguration: 0x00
bmAttributes: 0xE0 (Bus Powered Self Powered Remote Wakeup)
MaxPower: 0xFA (500 Ma)

Interface Descriptor:
bInterfaceNumber: 0x00
bAlternateSetting: 0x00
bNumEndpoints: 0x02
bInterfaceClass: 0x08
bInterfaceSubClass: 0x06
bInterfaceProtocol: 0x50
iInterface: 0x00

Endpoint Descriptor:
bEndpointAddress: 0x81 IN
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x00

Endpoint Descriptor:
bEndpointAddress: 0x01 OUT
Transfer Type: Bulk
wMaxPacketSize: 0x0200 (512)
bInterval: 0x01

 

[Renate]

I got a little confused between this thread and private messages.

In short, the new Glow does not have ADB enabled out of the box.
The USB dumps are showing just a single UMS storage ("flash" drive) interface.

 

[jwxuan]

my nook just gives the same information

I got a little confused between this thread and private messages.

In short, the new Glow does not have ADB enabled out of the box.
The USB dumps are showing just a single UMS storage ("flash" drive) interface.

my nook just gives exactly the same information, is there any hope for hacking the new nook glowlight?

 

[Renate]

Sure, there is hope.

There doesn't seem to be any ADB over USB.
A port scan of the WiFi would be a confirmation of no ADB over WiFi.

Check to see if any different VID/PIDs pop up when rebooting with the USB connected.
That could indicate a bootloader, fastboot.

Check to see if recovery has any options besides factory restore.
(Power up with the bottom two buttons depressed.)

Then there are all the possibilities with the case open:

• a console interface
• a JTAG interface
• bootloader jumpers

If B&N releases an update image it could be examined for exploits.
The image could probably be loaded onto an older Nook, rooted and played with.

 

[Edgur]

I ran a complete nmap against the Nook on both TCP and UDP while it was connected to my WiFi. No open ports found.

The USB startup looks more promising, though --

Dec 13 21:19:33 MyLinuxBox kernel: [  741.701292] usb 5-1: new high-speed USB device number 5 using xhci_hcd
Dec 13 21:19:33 MyLinuxBox kernel: [  741.719705] usb 5-1: unable to get BOS descriptor
Dec 13 21:19:33 MyLinuxBox kernel: [  741.722625] usb 5-1: New USB device found, idVendor=0451, idProduct=d00e
Dec 13 21:19:33 MyLinuxBox kernel: [  741.722634] usb 5-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
Dec 13 21:19:33 MyLinuxBox kernel: [  741.722639] usb 5-1: Product: OMAP3630
Dec 13 21:19:33 MyLinuxBox kernel: [  741.722643] usb 5-1: Manufacturer: Texas Instruments
Dec 13 21:19:33 MyLinuxBox mtp-probe: checking bus 5, device 5: "/sys/devices/pci0000:00/0000:00:10.0/usb5/5-1"
Dec 13 21:19:33 MyLinuxBox mtp-probe: bus: 5, device: 5 was not an MTP device
Dec 13 21:19:36 MyLinuxBox kernel: [  744.721151] usb 5-1: USB disconnect, device number 5
Dec 13 21:19:48 MyLinuxBox kernel: [  757.351633] usb 5-1: new high-speed USB device number 6 using xhci_hcd
Dec 13 21:19:48 MyLinuxBox kernel: [  757.371138] usb 5-1: New USB device found, idVendor=2080, idProduct=0007
Dec 13 21:19:48 MyLinuxBox kernel: [  757.371146] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Dec 13 21:19:48 MyLinuxBox kernel: [  757.371152] usb 5-1: Product: NOOK GlowLight
Dec 13 21:19:48 MyLinuxBox kernel: [  757.371156] usb 5-1: Manufacturer: B&N
Dec 13 21:19:48 MyLinuxBox kernel: [  757.371160] usb 5-1: SerialNumber: 303xxxxxxxxxxxxx
Dec 13 21:19:48 MyLinuxBox kernel: [  757.378672] scsi6 : usb-storage 5-1:1.0
Dec 13 21:19:48 MyLinuxBox mtp-probe: checking bus 5, device 6: "/sys/devices/pci0000:00/0000:00:10.0/usb5/5-1"
Dec 13 21:19:48 MyLinuxBox mtp-probe: bus: 5, device: 6 was not an MTP device
Dec 13 21:19:49 MyLinuxBox kernel: [  758.378396] scsi 6:0:0:0: Direct-Access     B&N      NOOK GlowLight   0100 PQ: 0 ANSI: 2
Dec 13 21:19:49 MyLinuxBox kernel: [  758.378613] scsi 6:0:0:1: Direct-Access     B&N      NOOK GlowLight   0100 PQ: 0 ANSI: 2
Dec 13 21:19:49 MyLinuxBox kernel: [  758.379838] sd 6:0:0:0: Attached scsi generic sg2 type 0
Dec 13 21:19:49 MyLinuxBox kernel: [  758.380186] sd 6:0:0:1: Attached scsi generic sg3 type 0
Dec 13 21:19:49 MyLinuxBox kernel: [  758.390847] sd 6:0:0:1: [sdc] Attached SCSI removable disk
Dec 13 21:19:49 MyLinuxBox kernel: [  758.392285] sd 6:0:0:0: [sdb] Attached SCSI removable disk
Dec 13 21:20:06 MyLinuxBox kernel: [  774.892800] sd 6:0:0:0: [sdb] 1040352 512-byte logical blocks: (532 MB/507 MiB)
Dec 13 21:20:06 MyLinuxBox kernel: [  774.893133] sd 6:0:0:0: [sdb] No Caching mode page found
Dec 13 21:20:06 MyLinuxBox kernel: [  774.893143] sd 6:0:0:0: [sdb] Assuming drive cache: write through
Dec 13 21:20:06 MyLinuxBox kernel: [  774.894122] sd 6:0:0:0: [sdb] No Caching mode page found
Dec 13 21:20:06 MyLinuxBox kernel: [  774.894129] sd 6:0:0:0: [sdb] Assuming drive cache: write through
Dec 13 21:20:06 MyLinuxBox kernel: [  774.895708]  sdb:

As you can see, when the NGL first powers on, it presents itself as VID 0451, PID d00e for three seconds.

This seems like good news! Some sort of TI OMAP boot mode?

 

[Renate]

Yup, that's the TI 1st stage bootloader (before x-loader & u-boot).

The good news is that it's the same as the Nook Touch.
That means that we can try a bunch of things with the old Nooks.
We also know already where the console UART is on the old Nooks.

 

[Edgur]

Yup, that's the TI 1st stage bootloader (before x-loader & u-boot).

The good news is that it's the same as the Nook Touch.
That means that we can try a bunch of things with the old Nooks.
We also know already where the console UART is on the old Nooks.

Fantastic. Any suggestions on where to begin? I'm willing to try experiments (though I'd obviously prefer to avoid trying things with a high likelihood of bricking my reader!)

 

[Edgur]

I did some googling to see what I could figure out on my own.

If I am understanding this correctly, that 3 second window between when it identifies itself as 0451:d00e and when it disconnects again, it is receptive to receiving xloader code over the USB.

So we could, in theory, send it an xloader that will read a u-boot over USB as well. Then use that to boot the device into a minimal configuration that would basically "dd" out all of the partitions from the internal flash and emit it over the USB, so we could have a complete image of the built-in disk?

Of course, I have no idea HOW to do those things... But if you can give me some pointers, I am willing to learn.

 

[Renate]

Yes, that 3 second window is the place.
But it's not a big deal.
As soon as you identify down the line it will pause and you have all the time in the world.

I think the thing to do is to get the concept working on an older Nook with SD card.
These (because the ROM bootloader checks the SD card) are unbrickable
and with the UART console dmesg output we'll have some feedback.
At some point we'll have to make the leap and try it on a SD-less new Nook.

 

[straygecko]

Some of the work has been done for the Nook Color which also uses the OMAP 3630. There is a working boot from USB for the Nook Color. It boots over USB to CWM from Linux. We have CWM for the NST. So I thought this ought to be easy to boot my NST over USB to CWM by using the Nook Color USB boot process and replace the image and ramdisk with the NST CWM. If that works someone could try it on a Nook Glowlight. So I gave it a shot but no go. For some reason the usbboot program that tests every 250ms for an OMAP USB device to show up and then sends over the initial boot program never sees it. My log shows 0451:d00e appearing for 3 seconds and disappearing. If I run lsusb when I boot the NST I see 0451:d00e. But for some reason usbboot doesn't see it and just sits there waiting for an OMAP device. I looked at the code and its definitely looking for that VIDID. I tried recompiling usbboot but still no go. Anybody more familiar with USB internals want to take a look at usbboot and see if they can sort out why it doesn't recognize the NST? Here is some more doc on the OMAP USB boot process.

 

[Renate]

Edit: Oops, that solution is for Linux, for Windows this comment would be appropriate:

Do you have the generic USB device driver loaded for the OMAP3630?

 

[Edgur]

Some of the work has been done for the Nook Color which also uses the OMAP 3630. There is a working boot from USB for the Nook Color. It boots over USB to CWM from Linux. We have CWM for the NST. So I thought this ought to be easy to boot my NST over USB to CWM by using the Nook Color USB boot process and replace the image and ramdisk with the NST CWM. If that works someone could try it on a Nook Glowlight. So I gave it a shot but no go. For some reason the usbboot program that tests every 250ms for an OMAP USB device to show up and then sends over the initial boot program never sees it. My log shows 0451:d00e appearing for 3 seconds and disappearing. If I run lsusb when I boot the NST I see 0451:d00e. But for some reason usbboot doesn't see it and just sits there waiting for an OMAP device. I looked at the code and its definitely looking for that VIDID. I tried recompiling usbboot but still no go. Anybody more familiar with USB internals want to take a look at usbboot and see if they can sort out why it doesn't recognize the NST? Here is some more doc on the OMAP USB boot process.

Am I going to break my Nook if I try this as-is (the Nook Color version) to see how far the process gets?

That is, this process does not attempt to replace the recovery partition on the device or anything, right? Just boots it by loading an image over USB serial?

As long as it doesn't make any modifications to the Nook at this point, I don't mind trying it out.

 

[straygecko]

Failure between chair and keyboard. Forgot to sudo when running it and couldn't claim the USB device. Now it gets through recognizing the NST and sending aboot & u-boot to the device. Now u-boot doesn't work. Its a Nook Color u-boot so I tried the u-boot from a noogie and the NST boots but not from USB. Looking into compiling a NST u-boot with USB enabled.

---------- Post added at 12:15 PM ---------- Previous post was at 12:10 PM ----------

Am I going to break my Nook if I try this as-is (the Nook Color version) to see how far the process gets?

That is, this process does not attempt to replace the recovery partition on the device or anything, right? Just boots it by loading an image over USB serial?

As long as it doesn't make any modifications to the Nook at this point, I don't mind trying it out.

Its not breaking my NST so I don't think it will brick your Nook Glowlight. AFAIK your assumptions are correct but I make no guarantees as nearly the same process is used to flash a device. Might be better to wait for the process to get ironed out better on an NST where we can backup and restore the device with an SD card in case something goes wrong.

 

[straygecko]

OK, I sorted out how to compile the NST u-boot and applied the patches to it from the diff file provided in the Nook Color usb boot package. I ran into an issue where it won't work using virtualbox so I had to boot with a live CD to get the NST to boot over USB into CWM but it worked! ADB works fine but for some reason backup doesn't seem to work. It hangs on "Backing up boot...." - the first partition to backup. But ADB is a good start so you can explore your Nook Glowlight.

I looked at the kernel source for the Nook Glowlight and it has a different u-boot config. I'm not sure how different but I think the best next step will be to compile a Nook Glowlight u-boot before giving this a try on a new glowlight.

 

[Dimasio]

ADB works fine but for some reason backup doesn't seem to work.

The best way to make a backup - through noogie.img by this manual

blog.the-ebook-reader.com/2012/05/02/how-to-backup-and-restore-nook-glow-and-nook-simple-touch/

If this method will adapt, it will be very cool!
Sorry for my bad english.

 

[straygecko]

The best way to make a backup - through noogie.img by this manual

blog.the-ebook-reader.com/2012/05/02/how-to-backup-and-restore-nook-glow-and-nook-simple-touch/

If this method will adapt, it will be very cool!
Sorry for my bad english.

Yeah, I might try booting a noogie image over USB and see if I can get a backup that way. I'm not sure how either a CWM backup or noogie backup will translate to the Nook Glowlight as both backup methods backup to the SD card which is non-existent on the Nook Glowlight.

 

[jwxuan]

Do you have any progress？

Yeah, I might try booting a noogie image over USB and see if I can get a backup that way. I'm not sure how either a CWM backup or noogie backup will translate to the Nook Glowlight as both backup methods backup to the SD card which is non-existent on the Nook Glowlight.

Do you have any progress，I have the new Nook glowlight

 

[straygecko]

As I started to build a u-boot.bin from the B&N source I noticed in the config that USB booting might be built into the new Nook Glowlight. Makes sense for a device without an SD slot. Would somebody with a new Glowlight try powering off then powering on while holding down the n button and see what happens?