search

ddvk / remarkable2-framebuffer

remarkable2 framebuffer reversing
MIT License
270 stars 22 forks source link

Does not work with my version of Xochitl #18

Open raisjn opened 3 years ago

raisjn commented 3 years ago

This issue is for when rm2fb's server process fails to find the signature it needs.

Please respond with which binary was being used and what its md5sum is, thank you!

NOTE: this issue is specifically for if rm2fb server or client prints out an error referencing issue #18. The error message means that the signatures we use are no longer valid in the version of xochitl being used. Please open separate threads for other issues.

Witos commented 3 years ago

Where this (int *)locate_signature(SDK_BIN.c_str(), "|@\x9f\xe5|P\x9f\xe5", 8); come from? How did you get this magic string?

ddvk commented 3 years ago

this is the signature of a function we are loooking for

Witos commented 3 years ago

I know what it is. I don't know how do you know which function to look for? Did you reverse engineer remarkable-shutdown?

ddvk commented 3 years ago

of course

On Mon, 16 Nov 2020 at 09:19 Witos notifications@github.com wrote:

I know what it is. I don't know how do you know which function to look for? Did you reverse engineer remarkable-shutdown?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/ddvk/remarkable2-framebuffer/issues/18#issuecomment-727816261, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIYZFLWDZINBXHPR4QUTDVTSQDN7TANCNFSM4TQ3VQVA .

pgaskin commented 3 years ago

@ddvk or @raisjn, I don't have a reMarkable, but I'd like to take a look at xochitl and remarkable-shutdown. Is there somewhere I can find the binaries?

Eeems commented 3 years ago

@pgaskin Due to licensing you'll need to have a device to get the binaries.

pgaskin commented 3 years ago

Are the firmware updates available somewhere?

Eeems commented 3 years ago

I'm sure they are, just not entirely sure where to look. The code that handles updating can be found here: https://github.com/reMarkable/update_engine

ddvk commented 3 years ago

can you ask in the discord channel, https://discord.gg/ATqQGfu

there was an irc bridge as well

On Mon, 16 Nov 2020 at 17:23 Patrick Gaskin notifications@github.com wrote:

Are the firmware updates available somewhere?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ddvk/remarkable2-framebuffer/issues/18#issuecomment-728169106, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIYZFLWB32UMJWIMUASNQULSQFGZXANCNFSM4TQ3VQVA .

pgaskin commented 3 years ago

I have these:

remarkable-shutdown: eacf23b176dcda8f1727ff0ac433ca8f4c85c809 xochitl: c88d155b7ca8c770240b2c00048968f8445f8115

ClashTheBunny commented 3 years ago

md5sum /usr/bin/remarkable-shutdown /usr/bin/xochitl:

fec600ccae7743dd4e5d8046427244c0  /usr/bin/remarkable-shutdown
aaa77163501618b0cfae54843505df88  /usr/bin/xochitl
More info: Downloaded the `.so`s from release 0.0.1. To show the same data as @pgaskin when doing a sha1sum: sha1sum /usr/bin/remarkable-shutdown /usr/bin/xochitl: ``` eacf23b176dcda8f1727ff0ac433ca8f4c85c809 /usr/bin/remarkable-shutdown c88d155b7ca8c770240b2c00048968f8445f8115 /usr/bin/xochitl ``` Actual error message: ``` reMarkable: ~/koreader/ LD_PRELOAD=librm2fb_server.so /usr/bin/remarkable-shutdown ERROR: ld.so: object 'librm2fb_server.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored. EPD platform plugin loaded! QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root' qt.qpa.input: evdevtouch: Using device discovery qt.qpa.input: evdevtouch: Adding device at "/dev/input/event2" qt.qpa.input: evdevtouch: Using device /dev/input/event2 qt.qpa.input: evdevtouch: /dev/input/event2: Protocol type B (multi), filtered=no qt.qpa.input: evdevtouch: /dev/input/event2: min X: 0 max X: 1403 qt.qpa.input: evdevtouch: /dev/input/event2: min Y: 0 max Y: 1871 qt.qpa.input: evdevtouch: /dev/input/event2: min pressure: 0 max pressure: 0 qt.qpa.input: evdevtouch: /dev/input/event2: device name: cyttsp5_mt Waveform file with correct FPL_LOT not found, using fallback: /usr/share/remarkable/320_R299_AFC421_ED103TC2U2_VB3300-KCD_TC.wbf Reading waveforms from /usr/share/remarkable/320_R299_AFC421_ED103TC2U2_VB3300-KCD_TC.wbf Running INIT (111 phases) SWTCON initialized \o/ Creating painter Battery left: 97 REMARKABLE_SHUTDOWN_STATE= "" Sending update Epaper integration dying Epaper integration dead ```
raisjn commented 3 years ago

can you try using the full path to the so file in the ldpreload?

ClashTheBunny commented 3 years ago

That's exactly my problem. I saw a note in #rm2 about it and it worked perfectly! I've got KOReader up on the screen as we speak. I also did need the full version number at the end.

LinusCDE commented 3 years ago

https://github.com/toltec-dev/toltec/pull/163#issuecomment-751889405

Triggered the watchdog to downgrade the device. Seems to be some weired combinations between the new entware-reenable doing something that maybe crashes (?) the device and then rm2fb fails to find a signature. My device is a rM 1.

Mounted the old partition to get the hash of the xochitl in question:

MD5: 6709a445112e783c59a926aabdbd49c9 /mnt/usr/bin/xochitl

Eeems commented 3 years ago

rm2fb should probably check to see if it's being run on a rM1 and just stop if not.

LinusCDE commented 3 years ago

Not sure if I installed something today that cause this other than entware-rerenable (and that probably switched the repo to stable and reinstalled sw a bunch). I have binge read a fair amount of hours in the last 2 days without any issues.

matteodelabre commented 3 years ago

Failing with update 2.6.1.71 (getting Unable to find update fn).

6f4162d7685b27a69acbd5ad2b6c447d  /usr/bin/xochitl
fcf12062da3fbfeb5aca3ac225ecddc2  /usr/bin/remarkable-shutdown
Foxmilk commented 3 years ago

I am encounter this as well after an update to 2.6, I noticed someone said they downgraded and re-upgraded, what are the instructions for that? I can only use xochitl if I start it manually from command-line.

EDIT: I got it to boot at least by removing rm2fb: reMarkable: ~/ opkg remove rm2fb Removing package rm2fb from root... Removed /etc/systemd/system/multi-user.target.wants/rm2fb.service. Removed /etc/systemd/system/xochitl.service.wants/rm2fb.service. make sure to disable / uninstall any launchers like draft, oxide or remux before rebooting your tablet to complete the uninstallation

Pemo11235 commented 3 years ago

Same issue here after update to 2.6.

Edit: If I type: LD_PRELOAD=/home/root/librm2fb_client.so.1.0.0 xochitl I got this:

OPENED SHARED MEM: /dev/shm/swtfb.01 at 735dc000, errno: 1
Unable to find update fn
PLEASE SEE https://github.com/ddvk/remarkable2-framebuffer/issues/18
Aborted
Eeems commented 3 years ago

See #55

Witos commented 3 years ago

Same issue after update to 2.8.

Eeems commented 3 years ago

Same issue after update to 2.8.

Could you perhaps compare some of the library versions to see what was updated that might cause this?

consp commented 3 years ago

Got the message:

21d4e562034aff4f8a9f103137920976  /usr/bin/xochitl
fcf12062da3fbfeb5aca3ac225ecddc2  /usr/bin/remarkable-shutdown

edit: version 2.8.0.98-patch_23.2.02-0-gd889977

matteodelabre commented 3 years ago

Hi @consp, what system version are you using?

consp commented 3 years ago

Hi @consp, what system version are you using?

Sorry for the late reply.

2.8.0.98-patch_23.2.02-0-gd889977

i-am-shodan commented 3 years ago

Can also confirm those hashes - looks like they are remarkable-hacks 28098_rm2 patch_23.2.02

consp commented 3 years ago

Can also confirm those hashes - looks like they are remarkable-hacks 28098_rm2 patch_23.2.02

Should have mentioned that. Yes, the are with remarkable-hacks.

RickyGrassmuck commented 3 years ago

Running 2.8.0.98 (Unpatched) and am also getting the error.

878c12dfee135d1a0a9e83552db61891  /usr/bin/xochitl
fcf12062da3fbfeb5aca3ac225ecddc2  /usr/bin/remarkable-shutdown
matteodelabre commented 3 years ago

Which remarkable2-framebuffer version did you install? The version currently in Toltec stable doesn't work with 2.8. You need the version in testing, or manually install from this repo's latest release.

i-am-shodan commented 3 years ago

I’m running 1.6 in Toltec testing. The display package as it’s now called.

matteodelabre commented 3 years ago

Running system version 2.8.0.98 (with or without rmhacks) and display & rm2fb-client 1.0.1-6 from Toltec testing, I cannot reproduce your issue unfortunately. Could you please provide more details on what is failing precisely? Detailed logs including the error message would also be helpful. Thanks!

i-am-shodan commented 3 years ago

https://github.com/ddvk/remarkable2-framebuffer/issues/64

i-am-shodan commented 3 years ago 
systemctl stop xochitl
systemctl stop rm2fb
LD_PRELOAD=/opt/lib/librm2fb_server.so.1.0.1 /usr/bin/remarkable-shutdown &

BIN FILE: /usr/bin/remarkable-shutdown ADDR: 227a8 REPLACING THE IMAGE with shared memory Error decoding barcode: EUFA8RBH9W3V00DSSAT -1.45! Waveform file with correct FPL_LOT and TFT_VID not found, using fallback: /usr/share/remarkable/320_R299_AFC421_ED103TC2U2_VB3300-KCD_TC.wbf Reading waveforms from /usr/share/remarkable/320_R299_AFC421_ED103TC2U2_VB3300-KCD_TC.wbf Running INIT (111 phases) SWTCON initialized \o/ 1404 1872 16 WAITING FOR SEND UPDATE ON MSG Q

LD_PRELOAD=/opt/lib/librm2fb_server.so.1.0.1 koreader

STARTING RM2FB BIN FILE: /usr/bin/env COULDNT LOCATE SIGNATURE IN /usr/bin/env PLEASE SEE https://github.com/ddvk/remarkable2-framebuffer/issues/18

checksum fcf12062da3fbfeb5aca3ac225ecddc2 /usr/bin/remarkable-shutdown

matteodelabre commented 3 years ago

You should preload librm2fb_server.so into /usr/bin/xochitl (instead of remarkable-shutdown) to start the rm2fb server. remarkable-shutdown may be missing some waveforms compared to xochitl, so you may encounter visual glitches if you use the former.

In your second command, you’re trying to preload librm2fb_server.so into a client app (koreader). You need to preload the client lib (librm2fb_client.so) into client apps instead. Note that if you installed koreader from Toltec, its startup script already includes the necessary preloading variable, so you can just type koreader to launch it from your SSH session.

matteodelabre commented 3 years ago

By the way I have encountered the Error decoding barcode message several times and it does not seem to have any consequences on the proper functioning of apps.

matteodelabre commented 3 years ago

Does not work with 2.9.0.153 (as reported by @Witos and others on Discord). Update:

matteodelabre commented 2 years ago

@consp @i-am-shodan @rigrassm Any updates?

lz233 commented 2 years ago

Device which runs 2.9.0.153 cannot start up.

e236bccce09685b8e87f91a0fd10c7db /usr/bin/xochitl

Eeems commented 2 years ago

@lz233 2.9 is still in beta is it not?

lz233 commented 2 years ago

@lz233 2.9 is still in beta is it not?

yes... I just wanted to have a try but I can't downgrade now.

Eeems commented 2 years ago

@lz233 2.9 is still in beta is it not?

yes... I just wanted to have a try but I can't downgrade now.

Just run switch.sh from https://github.com/ddvk/remarkable-update and reboot. After which disable automatic update.

lz233 commented 2 years ago

@lz233 2.9 is still in beta is it not?

yes... I just wanted to have a try but I can't downgrade now.

Just run switch.sh from https://github.com/ddvk/remarkable-update and reboot. After which disable automatic update.

I've tried to restore this device and now it is bootloop. Can I use this tools without touching UI?

Eeems commented 2 years ago

I've tried to restore this device and now it is bootloop. Can I use this tools without touch UI?

Restore? I'd recommend getting on the community discord and getting help there. We likely can get you sorted. I would also recommend that you give https://github.com/ddvk/remarkable2-recovery a read and look into getting the parts required. If you are in a boot loop that is never able to SSH in, you'll need to get access to the filesystem to sort things out.

lz233 commented 2 years ago

community discord

Thanks, Let me try it first.

brentbrownfield commented 2 years ago

Just received this running 2.9.0.210

My rm2 failed to start up after this, and I had to ssh in to be able to remove/restore.

Eeems commented 2 years ago

Just received this running 2.9.0.210

My rm2 failed to start up after this, and I had to ssh in to be able to remove/restore.

Running what version of rm2fb? You'll need the latest to support 2.9

rotech commented 2 years ago

Remarkable software version 2.9.1.217 MD5SUM: ff1a8b77ce3ecb818191667eac29efc8 xochitl

STARTING RM2FB Missing address for function 'getInstance' PLEASE SEE https://github.com/ddvk/remarkable2-framebuffer/issues/18

Tried to find the function locations with arm-remarkable-linux-gnueabi-objdump. Found the strings I should be looking for, but couldn't find the reference in the disassembly. Going to keep trying, but I might need a little help.

Eeems commented 2 years ago

Are you running the latest version?

rotech commented 2 years ago

Yes, latest version compiled from source. Also double-checked that the latest commit of src/shared/config.cpp does not contain the signatures for 2.9.1.217.

rotech commented 2 years ago

Got it working!

!20210812195523 version str 2.9.1.217 update addr 0x3afc04 updateType str QRect create addr 0x3b2204 shutdown addr 0x3b1fbc wait addr 0x3b153c getInstance addr 0x3a64bc