I recently purchased an iRiver Story EB02 e-reader. I haven't actually received it yet but I was curious about its details and the type of software it would run.
I learned it's an abolute must to download / install the latest firmware so I decided to have a look at that for now as I didn't have a device to install it on anyway.
The firmware is called "ebook.hex" which is a bit mysterious. It turns out to be an ordinary zipfile with some (128 bytes) leading garbage:
0000000 i r i v e r N e t w o r k T
0000020 e a m Y o o H y u n g S e
0000040 o u n g a j f e o q n a n g h
0000060 o q p o e a ] [ [ k l m . / . .
0000100 , m z l l o e = - 0 j . 376 _ @ 324
0000120 \b 206 236 351 026 242 036 n 350 335 Q a c 1 8 \0
0000140 . \ _ p r e _ w o r k . b a t \0
0000160 . \ E B O O K . y h s \0 C r e a
0000200 P K 003 004 024 \0 \t \0 \b \0 261 m 3 < ( G
Unpacking the zipfile will prompt for a password, however. You'll be able to find the password relatively easy using the following command, though:
$ fcrackzip -c "a" -p aaaaaaaa -v ebook.hex
The OS
The OS the iRiver Story appears to be running is (big surprise!) Linux! It appears to be for an ARM based system, using Cairo for rendering the e-books. The most suprising however is that I didn't see any GPL notices or links to source code anywhere. Let's hope that's handled better in the package when it arrives, this is starting to smell a bit like a GPL violation.
It contains a ramfs which you can easily mount
# mount -o loop rootfs.cramfs /mnt/iriver-mnt
Some observations
- on the rootfs, /tmp/status_managers is responsible for handling upgrades (and general system startup probably). Using "strings -a" you will again find the ZIP password. It also appears to try something with "ebook.yhs.
- the zipfile itself contains an app/ directory with some "real" binaries (book2pngd, Jmp3_player_copy and mattrib). The other files are ".feb" files and I'm not sure what they are. They're binary with some plaintext strings included. Perhaps native ARM, perhaps interpreted. The binary "/flow_copy" appears to be responsible for starting "start.feb" which in turn may be responsible for starting the other .febs.
- booting (or at least starting stuff) from sdcard seems possible. The following snippet comes from rootfs' /etc/init.d/rcS
############ Detect SD Booting Movi Booting ###
echo 157 > /sys/class/gpio/export
if [ "`cat /sys/class/gpio/gpio157/value`" != "0" ]; then
#SD Booting
mount -t vfat -o shortname=mixed /dev/mmcblk1p1 /mnt/SDFAT
# SD Card에 elisamake_sh 가 있다면
if [ -f /mnt/SDFAT/factory/elisamake_sh ]; then
echo "##### SD Booting #####"
echo "##### Run script /mnt/SDFAT/factory/elisamake_sh #####"
dos2unix /mnt/SDFAT/factory/elisamake_sh
/mnt/SDFAT/factory/elisamake_sh
sync
else
#MOVI NAND fdisk
echo "##### SD Booting Start Fdisk MOVI NAND #####"
fdisk -u -S 16 -H 1 /dev/mmcblk0 < /etc/init.d/sfdisk
mkfs.vfat -n Story -F 16 /dev/mmcblk0p1
/tmp/mke2fs /dev/mmcblk0p2
sync
fi
fi
- firmware 1.61 uses Linux kernel 2.6.28.6, Linux version 2.6.28.6 (root@jang) (gcc version 4.3.2 (GCC) ) #706 PREEMPT Tue Dec 15 11:59:43 KST 2009
- it uses/runs busybox
- it uses SQLite
- There may be WIFI support someday. Perhaps in this device (if it carries the hardware) or else some future device. The following is the contents of the settings.xml file:
<?xml version="1.0" encoding="utf-8"?>
<system_setting>
<setting_info>
<passwd>NULL</passwd>
<title1>NULL</title1>
<title2>NULL</title2>
<name>iriver</name>
<phone>0000</phone>
<time>200901010900am</time>
<lang>2</lang>
<shortkey>YURTF</shortkey>
<font>NULL</font>
<power>15</power>
<dic>DD</dic>
<wifi>NULL</wifi>
</setting_info>
</system_setting>
More may follow once I actually have the device :)
Misc.
A happy blogging iRiver Story user
iRiver story firmware download
