[geert]

Quick User Guide for Hacked Pandigital 6" ePaper Touch Screen eReader
=====================================================================

This guide pertains to the model PRD06E20WWH8 running stock firmware
03_01_b. You can look up this information by going to Settings->Support.

After hours of googling I was able to find the original Pandigital firmware
release here:

http://c281656.r56.cf1.rackcdn.com/03_01B_PD_AUO6Q_ENG_S3C2416.tar.gz

I was able to verify the checksums on the components of the tar file, so
I have good faith that this is indeed the complete and correct software.

I put a copy in my box.net account here:

[https://www.box.com/s/ut5nqonwoc2rraektsja this link is dead!]
https://app.box.com/s/a3mv1kt08rcwko4eogy3

Mind the file size is close to a 100MB.

I assume you have access to a Linux box. I use a CentOS 6.3 system on a
laptop. You will need the following tools and utilities:

- terminal program (xterm, Gnome Terminal, etc)
- lsusb
- be able to become root or be a sudo user
- lsmod, modprobe, rmmod
- have usbserial.ko module
- minicom or some other serial communication program (picocom)

Table of contents
1. Button layout and naming
2. Obtain serial access into the device
3. Enable a telnet server
4. Start inetd at boot time
5. Enable a FTP server
6. Useful links
[hr]

1. Button layout and naming

We will use the following naming convention for the buttons on the front
of the device as seen from left to right.

Button:  1      2       3       4       5       6       7<br />
Symbol:  <-       -->   Q       -       +       <       ><br />
          -       <--           -       -<br />
Name:    Return Refresh Search  Menu    Volume  Page Bw Page Forward<br />
Keycode: 158    173     217     139     115     104     109<br />

Sometimes the name Back is used instead of Return but that might be confusing
with the Page Backward button. Also, Search is sometimes referred to as Zoom.

2. Obtain serial access into the device

The device is able to expose a serial interface over USB. Normally the USB
mode is Mass Storage. However, by pressing both the Page Backward and Page
Forward buttons while booting (I usually keep them pressed until the end of
the progress bar) a special kernel module gets loaded (g_serial.ko) and
a getty is made to run on device ttySAC0. Bottom line is that now you have the
ability to get a shell on the eReader in a program like minicom on the host.

USB uses vendor and product codes to identify the connected devices.
In Mass Storage mode the eReader shows up as vendor=0x0525 and product=0xa4a5.
You can verify this by typing lsusb after you have connected the eReader to
your computer via the supplied USB cable and okayed the message
"Activate mass storage device. Device will be temporarily inoperable".
You will be put in "Storage device mode". On my computer I see this:

$ lsusb
Bus 001 Device 021: ID 0525:a4a5 Netchip Technology, Inc. Linux-USB File Storage Gadget

You can also look in /var/log/messages to find some details of the USB device
driver.

What might come as a surprise is that the Pandigital uses a different product
code when operating in USB serial mode, namely product=0xa4a6. Do not use Mass
Storage mode when trying to set up a serial link. You cannot have both at the
same time.

Here are the steps to follow:

1. Preparation: makes sure your usbserial kernel module on the host computer
is loaded and set to recognize the eReader. If it is already loaded,
unload it first with:

$ sudo rmmod usbserial

Now (re-)load it with the proper arguments:

$ sudo modprobe usbserial vendor=0x0525 product=0xa4a6

When doing these operations it is good to have another terminal open that
monitors your /var/log/messages file. I use:

$ sudo tail -f /var/log/messages

That way you can follow what happens and immediately get notified if
things go wrong.

Your USB serial module should be properly loaded and registered. You can
see it in the list of kernel modules by typing:

$ lsmod | fgrep usbserial

2. Prepare minicom. Run

$ sudo minicom -s

Go to "Serial port setup", and set the device to /dev/ttyUSB0, choose a
baudrate of 115200 and select 8 bits, 1 stop bit and no parity (8N1) and
no flow control. Save this as default and exit minicom for now.

3. Make sure the eReader is powered off and not connected via the USB cable.
If you had it in Mass Storage mode, first safely remove the device and
make sure it is unmounted. Then disconnect the cable and power it off.

4. In its powered off state (you likely see the picture of a book shelf on its
screen with the text "pandigital novel" under it), connect the eReader to
your computer. A big battery icon will appear. You will also see some
activity in the /var/log/messages window; you can ignore that.
You are in charge mode.

5. This is the crucial step: hold down the Page Backward and Page Forward
buttons at the same time. Easiest is to press your right-hand thumb on
them. Then with your left hand finger switch on the eReader. Hold the
power switch until the screen blanks and you see movement in the progress
bar. Keep the Page buttons pressed till the progress bar is half way
and then release them too. Now you have entered USB serial mode.

However there is no indication of it on the eReader. Moreover, the
"Activate mass storage device" dialog pops up but you should NOT okay it
but simply cancel it by pressing the X. In USB serial mode you can still
use the eReader unlike when in mass storage mode.

Verify that the USB serial connection is up:
a. $ lsusb
Bus 001 Device 024: ID 0525:a4a6 Netchip Technology, Inc. Linux-USB Serial Gadget

Notice the difference with the earlier lsusb output.

b. Check /var/log/messages and it must say something like this:

usb 1-5: New USB device found, idVendor=0525, idProduct=a4a6
usb 1-5: Product: Gadget Serial
usb 1-5: generic converter now attached to ttyUSB0

The tty device mentioned there is the one that should have been
configured for minicom; verify that this is indeed the case.

6. You can run minicom now and login to the eReader. Yes, surprisingly there
is a password involved unlike most other serial connections to embedded
devices that I have used.

$ sudo minicom

No -s argument this time because we assume all configuration settings are
fine. After the message "Initializing Modem" you should get something
like this:

Welcome to minicom 2.3

OPTIONS: I18n
Compiled on Aug 19 2010, 05:48:57.
Port /dev/ttyUSB0

Press CTRL-A Z for help on special keys

Samsung SMDK Board on a armv5tejl
Samsung login:

There might be some spurious characters and AT commands interspersed.
And you might have to hit Enter a couple of times to get a clean login
prompt. I even sometimes had to restart minicom to get things going:
hit Ctrl-a z in minicom, then type x and hit Enter.

Samsung login: root
Password: SReader

The account name to use is "root" and the password is "SReader".
Give it a try! Once you are in, you will get this prompt:

[[email protected] ~]#

And you are in the /root directory.

BE CAREFUL WHAT YOU DO!
IT DOESN'T TAKE MUCH TO BRICK YOUR EREADER NOW.

Mind that if the device enters the power-save-mode, the usb-port is
closed and the connection is down until you re-establish it following
the above procedure. To avoid that, I usually go into a book and click
on the Page Forward button once in a while. That keeps the serial
connection alive. Clicking Refresh would do fine too. A better solution
is to configure Settings->General->Screen Saver to Never.

3. Enable a telnet server

After you have established a serial connection and logged in as root,
make sure your WiFi connection is up as well, and then run the inetd server:

[[email protected] ~]# inetd

That enables the inetd server on the eReader and enables you to telnet to the
device from your host computer. Using a telnet window is a lot nicer and more
reliable than using the serial connection via minicom. Still, be warned that
when the device goes to sleep or in power-savings mode, likely the WiFi will
be shut off and consequently you will lose your telnet session. You must use
the same user name and password as for the serial login.

This is what it looks like to telnet from my host computer:

[[email protected] ~]$ telnet pdnovel
Trying 192.168.0.107...
Connected to pdnovel.
Escape character is '^]'.

Samsung login: root
Password:
[[email protected] ~]# date
Wed Dec 26 19:57:17 MET 2012
[[email protected] ~]# ^D
Connection closed by foreign host.
[[email protected] ~]$

I assigned the eReader the name "pdnovel" in my /etc/hosts file. Telnetting
works just as well by using the IP address instead.

Since the serial connection is no longer needed, I had already closed my
minicom session. However, once you reboot the eReader, the inetd server won't
run anymore and you have to start it via the serial connection. We can do
better by having inetd start at boot time.

Note that inetd opens up quite a few ports. You can check that using the nmap
program on your host:

[[email protected] ~]$ sudo nmap -A -T4 pdnovel

Starting Nmap 5.51.6 ( http://nmap.org ) at 2012-12-26 14:12 EST
Nmap scan report for pdnovel (192.168.0.107)
Host is up (0.0061s latency).
Not shown: 994 closed ports
PORT STATE SERVICE VERSION
7/tcp open echo
13/tcp open daytime
21/tcp open tcpwrapped
23/tcp open telnet NASLite-SMB/Sveasoft Alchemy firmware telnetd
37/tcp open time (32 bits)
111/tcp open rpcbind 2 (rpc #100000)
MAC Address: 00:27:13:xx:xx:xx (USI)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.13 - 2.6.31
Network Distance: 1 hop
Service Info: Host: Samsung; OS: Unix

TRACEROUTE
HOP RTT ADDRESS
1 6.06 ms pdnovel (192.168.0.107)

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.57 seconds
[[email protected] ~]$

4. Start inetd at boot time

At boot time the eReader executes the scripts located in /etc/rc3.d.
Mind though that much of the /etc files are copied over from /mnt/etc.
So in order to persistently add files under /etc we must do it under /mnt/etc.
The first step in the process is to change the file system from read-only to
writable:

[[email protected] ~]# mount -o rw,remount /

Now we can create a new file /mnt/etc/init.d/inetd and edit it with "vi".
My file looks like this and easiest for you is to copy and past it.

[email protected] ~]# cat /mnt/etc/init.d/inetd

#!/bin/bash<br />
<br />
PATH=/sbin:/bin:/usr/bin:/usr/sbin<br />
<br />
# Source function library.<br />
. /etc/init.d/functions<br />
<br />
# Get config.<br />
test -f /etc/sysconfig/network && . /etc/sysconfig/network<br />
<br />
# Check that we are root ... so non-root users stop here<br />
[ `id -u` = 0 ] || exit 1<br />
<br />
# Check that networking is up.<br />
[ "${NETWORKING}" = "yes" ] || exit 0<br />
<br />
[ -f /usr/sbin/inetd ] || exit 1<br />
[ -f /etc/inetd.conf ] || exit 1<br />
<br />
RETVAL=0<br />
<br />
prog="inetd"<br />
<br />
start(){<br />
    echo -n $"Starting $prog: "<br />
<br />
    unset HOME MAIL USER USERNAME<br />
    $prog<br />
    RETVAL=$?<br />
    echo<br />
    touch /var/lock/inetd<br />
    return $RETVAL<br />
}<br />
<br />
stop(){<br />
    echo -n $"Stopping $prog: "<br />
    killall $prog<br />
    RETVAL=$?<br />
    echo<br />
    rm -f /var/lock/inetd<br />
    return $RETVAL<br />
}<br />
<br />
reload(){<br />
    echo -n $"Reloading configuration: "        <br />
    killproc $prog -HUP<br />
    RETVAL=$?<br />
    echo<br />
    return $RETVAL<br />
}<br />
<br />
restart(){<br />
    stop<br />
    start<br />
}<br />
<br />
condrestart(){<br />
    [ -e /var/lock/inetd ] && restart<br />
    return 0<br />
}<br />
<br />
<br />
# See how we were called.<br />
case "$1" in<br />
    start)<br />
        start<br />
        ;;<br />
    stop)<br />
        stop<br />
        ;;<br />
    status)<br />
        status $prog<br />
        ;;<br />
    restart)<br />
        restart<br />
        ;;<br />
    reload)<br />
        reload<br />
        ;;<br />
    condrestart)<br />
        condrestart<br />
        ;;<br />
    *)<br />
        echo $"Usage: $0 {start|stop|status|restart|condrestart|reload}"<br />
        RETVAL=1<br />
esac<br />
<br />
exit $RETVAL

[[email protected] ~]#

Make this file executable:
[[email protected] ~]# chmod a+x /mnt/etc/init.d/inetd

Next step is to create a symbolic link in the rc3.d directory:

[[email protected] ~]# cd /mnt/etc/rc3.d
[[email protected] ~]# ln -s ../init.d/inetd S57inetd

And that's all. Don't forget to remount the file system read-only:

[[email protected] ~]# mount -o ro,remount /

Test the new script by running:

[[email protected] ~]# /mnt/etc/rc3.d/S57inetd start

The ps command should show a running inetd process.
And now for the ultimate test: reboot and turn your WiFi on. Don't connect via
the USB cable and do not enable the serial connection. From your host you
should be able to telnet into the eReader.

5. Enable a FTP server

We will be using the ftp server /usr/sbin/proftpd in inetd mode.
The entry for ftp in /mnt/etc/inetd.conf is incorrect; it should read:

# These are standard services.                                          <br />
#                                                                       <br />
ftp     stream  tcp     nowait  root    /usr/sbin/proftpd   /usr/sbin/proftpd  <br />
telnet  stream  tcp     nowait  root    /usr/sbin/telnetd   /usr/sbin/telnetd

Don't forget to make the file system writable first. Then create a proper
/mnt/etc/proftpd.conf file. Again the original one won't work. Replace it with
this one:

# This is a basic ProFTPD configuration file<br />
# It assumes that you have a user "nobody" and group "ftp"<br />
<br />
ServerName                      "ProFTPD"<br />
ServerType                      inetd<br />
DefaultServer                   on<br />
DefaultAddress                  127.0.0.1<br />
<br />
# Port 21 is the standard FTP port.<br />
Port                            21<br />
<br />
# Umask 022 is a good standard umask to prevent new dirs and files<br />
# from being group and world writable.<br />
Umask                           022<br />
<br />
# Set the user and group under which the server will run.<br />
User                            nobody<br />
Group                           ftp<br />
<br />
# To cause every FTP user to be "jailed" (chrooted) into their home<br />
# directory, uncomment this line.<br />
#DefaultRoot ~<br />
<br />
# Normally, we want files to be overwriteable.<br />
AllowOverwrite          	on<br />
<br />
<Global>                    <br />
  RootLogin on<br />
  AuthUserFile /etc/passwd<br />
  AllowStoreRestart on      <br />
</Global>       <br />
        <br />
# Bar use of SITE CHMOD by default<br />
<Limit SITE_CHMOD><br />
  DenyAll<br />
</Limit>

One more thing: proftpd expects the directory /var/run/proftpd to exist, if
not it bails out. So we have to create that up front during the boot process.
Therefore edit the /linuxrc file and add the line:

mkdir /tmp/proftpd

a good spot for it is right after the copy of all etc files:

/bin/cp -af /mnt/etc/* /etc
mkdir /tmp/proftpd

To test copy proftpd.conf and inetd.conf from /mnt/etc to /etc and restart
the inetd server. Just kill the process and run inetd again. Now you should be
able to use ftp on your host computer to the eReader using the root account.

6. Useful links

https://www.box.com/s/ut5nqonwoc2rraektsja
http://c281656.r56.cf1.rackcdn.com/03_01B_PD_AUO6Q_ENG_S3C2416.tar.gz
http://www.fwma.de/pmwiki/pmwiki.php?n=Main.OYO?color=blue

 

[mrsburnout]

Quick User Guide for Hacked Pandigital 6" ePaper Touch Screen eReader
=====================================================================
<snip>

Thank you for taking the time to write up and share your work, geert.

pinning this topic - and promoting it to post of the week.

+1

 

[geert]

For those interested, I have also installed dropbear for ssh access to the device.
I added a user and changed the root password. I added ipkg in /opt and used it to install
mlocate from the Optware packages. It's a bit tricky to not get the libraries mixed up:
there's /lib and /usr/lib of course but the ipkg packages usually look in /opt/lib.

I really would like to investigate the QBookApp program in /usr/local/qisda/bin.
I tried to exchange it for the more feature-rich version of the Thalia Oyo reader but that
hung my device! Luckily I could go back in via usbserial and put the original QBookApp back in place.

I am a bit disappointed in not being able to change the fonts in the Reader app. I tried swapping
font files but that did not seem to help. I believe the font in the Reader is Thryomanes which is a
serif font; I rather like a sans serif font like Trebuchet or Sans Droid.

When I discover anything new, I'll report it here.

 

[unreasonable]

I was able to get a serial connection going but it was too unstable to get very far. It seemed very slow to respond and then iffy when it did respond. Did eventually get logged in to a shell prompt but that's as far as I got. I'll try more later. Thanks for figuring this much out.

 

[geert]

I was able to get a serial connection going but it was too unstable to get very far. It seemed very slow to respond and then iffy when it did respond. Did eventually get logged in to a shell prompt but that's as far as I got. I'll try more later. Thanks for figuring this much out.

Yes I noticed that the serial connection was very flaky. I tried all kinds of minicom settings (flow control, slower baudrate) to no avail. It takes a while just to get logged in. Like I said, sometimes you simply have to restart minicom a couple of times. Also, certain commands will spew out some output and then seem to hang. I use the serial as my last resort. Just type inetd on the shell prompt and do the rest
of your exploration in a telnet window. Then follow my steps to make inetd persistent and you are good to go.

As an aside: I have dropbear running fine and can use ssh to get into the device as an alternative to telnet. However, scp and sftp do not work. I did install sftp-server and have everything correctly configured.

Happy Hacking

 

[terminander]

Thanks for a ton of great info geert

I had heard of the serial interface, but never got it connected. Didn't know I needed it connected first.

Anyhow got an Armv5 adbd running through wifi. It requires /system/bin so I just linked it to /bin.

I need to find a full Android armv5. It appears that the Archos 7 Home Tablet is that. I have the file system extracted from the flash, but am still working on the initial ramdisk/kernel. Since I can mess up the the file system and still recovery with back & search keys, seems safe to play.

Been trying to use switch_root and run off the sdcard without much luck.

Last summer, before I bought the ereader, I thought I browsed the FS from the flash, but now nothing seems to open rootfs.img. I did find you can pull a file from the checksum.md5 file and pull it from the flash, and the flash will still work. So basically you can just reflash rootfs.img. Less chance of bricking.

 

[terminander]

Just re-read randomblame post 'initial inspection of firmware' and now I see how I read the filesystem last summer.

getting some_timers LOL

I tried to exchange it for the more feature-rich version of the Thalia Oyo reader but that

We should be able to get that working.... Have you got a link?

This eReader has disappointed me. Can't get email working on Gmail or Hotmail and a bunch of PDF books I want, come up too small and increasing Font just zooms in and requires screen scrolling (doesn't happen on my other tablets)

I am a bit disappointed in not being able to change the fonts in the Reader app.

The ereader supports both sans serif and serif. You need to know the font in the ebook and maybe play with [font.substitutions] in QBookApp.default.ini in usr/local/qisda/etc or where ever it realy is.

.

 

[terminander]

Only in Canada you say EH

 

[terminander]

Well after a few days of non bricking the ereader I am finally making some progress. I have a flash with some of geert's hacks in it.

The root files system is built with some kind of convolutaed cpio/tar archiving. I am able to pull the files with cpio but can't reassemble them with cpio. If I assemble them with tar they look right but crash if I rename to .img and flash. Checking out a few the links geert posted I see the Oyo uses rootfs.tar. So I changed .img to .tar and updated the name and md5 in checksum.md5 and voilà it works.

This is a nondestructive flash. No booloader/kernel and does not wipe data (maybe). Simply flashes the rootfs.

http://www.mediafire.com/?jesg3lje1zgfue6
95megs. Place on SDcard /qdutil/fw and turn on while pressing back & search buttons

Includes:
geerts Telnet hack through wifi, but not Ftp (couldn't get it working)
my ADB hack through wifi

I was able to flash the Oyo file system, not very impressive, must not be their latest. I also flashed some Spanish one and again not as good as what we have.

I did find something interesting. The ereader can boot from the external SDcard. Simply put uzImage and urootfs.img (ramdisk) in qdutil (not fw folder) and reboot like a reflash. Since it's a ramdisk (limited size) it needs to load a real rootfs from say a second partition on the SD. One flash file came with these, but the ramdisk is just a rescue/reflash system. When you boot it, it comes up with rescue OS and then prceeds with reflashing files in fw folder, but no visible Checksum verifing.

http://www.mediafire.com/?5ekd7p62ozoa4h4
4megs. Place on SDcard /qdutil and turn on while pressing back & search buttons

Includes:
uzImage and urootfs (rescue os)

So I should be able to get Android going from an SDcard

. Linux thinks the screen is 16bit color so it should work.

 

[Loner]

@geert: Thanks for combining the instructions and making them easy!

@terminander: Any luck with Android? I am mostly curious about the battery life that you could squeeze out of the device with it compared to the default Linux.

@all: This might be of some interest. There is a (Russian) firmware for these devices that allows loading of external programs. I'm linking Google's translated version of that page. The first program supposedly allows you to draw on the screen (similar to what one of QEngineer's tests-the program that fires up instead of the "usual" Qisda's interface when you hold the first and last buttons during start-up-allows to do).

Also...

I am able to access my Novel using Ubuntu running in VirtualBox on a Win7 machine. Pretty straightforward:

Plug in the Novel and turn it on, hold both page turn keys until the unit boots up, release. Windows installs a new device, LibUSB-Win32 PNX Bulk Device. In VB then attach Linux 2.6.21.5-cfs-v19 with s3c-udc Gadget Serial. Assuming

sudo -i

just do the modprobe, as in geert's post:

modprobe usbserial vendor=0x0525 product=0xa4a6

Now minicom sees ttyUSB0. Unfortunately, there's only one-way communication regardless of minicom configuration. Nevertheless, typing in root, SReader, inetd a few times eventually starts up telnet daemon and, upon establishing WiFi connection, telnet works.

The question that I have is this. In its infinite wisdom, Pandigital decided that contacts database from the address book (yes, there is one in the Novel!) should be hidden from the user. As I understand it, it is just one of the sqlite files. What I want to be able to do is to cp -f that file to the user-accessible partition when the device boots up. (Ideally, it would also check to see if the file on that partition is newer than what it has and copy it over to the "inside," too, thus allowing outside editing of the contacts list, but that's just wishful thinking for now.) To clarify, the idea is that I really don't want to go through all the mounting-telnetting stuff when all I want is to back up the contacts database. The problem is, I don't know how to do it. I tried simply inserting the copy command into linuxrc, but I think I'd need to remount the partition as r/w for this to work? As you can tell, I'm fairly new to Linux. Any thoughts on this would be appreciated.

 

[soags]

I built a running kernel for this thing, dunno how much of an achievement that is, it's for an OYO, see download link. Everything works except the keypad, it works but the keycodes are not lining up with the QBookApp thing. Took a look at the driver, It's messy. Boots of an sd card holding back and search. You will know you've done it right because the bootscreen changed. Getting it to run another userspace is trivial, just change the default cmdline on the kernel config to point to the sd card. But i don't know of a good userspace to run on this thing, any sugestions? Something non-android with a compiler would be sexy.

This thing runs on something called s3c-linux. I know there's a 2.6.24 version around but could not get it to build. If anybody has something newer than this, 2.6.21 please post it.

Here's where to get the source code, http://www.fwma.de/pmwiki/pmwiki.php?n=OYO.BuildKernel
Here's a built uzImage: http://helium.ensistech.com/~ludwig/pdtablet/SG060B00_V009/uzImage
Here's the config: http://helium.ensistech.com/~ludwig/pdtablet/SG060B00_V009/kernel.config
And here's a dmesg: http://helium.ensistech.com/~ludwig/pdtablet/SG060B00_V009/dmesg.txt

Thanks for the instructions on getting into it with serial and the rescue OS.

 

[Loner]

Everything works except the keypad, it works but the keycodes are not lining up with the QBookApp thing. Took a look at the driver, It's messy.

Which keys are mapped where? I've looked at the driver, and I think repairing it might be just a matter of supplying the right configuration.

 

[unreasonable]

Yes, please fix those links to the kernel you created. I've been working/thinking on some ideas for an alternative minimal user-land interface for these sorts of devices that run a linux kernel. Nothing to show sadly. I have one of these ereaders and will test things out. Previously the method for gaining access was real flaky on my device so I should probably be more deliberate next time I try it out.

 

[soags]

Ok, links are fixed, see original post. Sorry, copy paste mishap. As for changing the keycodes around it would be easy, was kind of hoping somoebody out there might have a more recent kernel for this thing. As for userspace, any armv5 should work. Will take a look at angtrom linux later on, would be cool to get arch-linux for arm on this thing, but i think the kernel is too old.

 

[soags]

Which keys are mapped where? I've looked at the driver, and I think repairing it might be just a matter of supplying the right configuration.

The problem seems to be a board definition, I played around with the config for a while and that's the only one i could get working. Some (most?) of the other board definitions wont build they fail on that driver, I'm sure the driver could be hammered into something pretty. I would look at other keypad style drivers as a guide, before working on that. As for making it throw the right key codes i have not mapped stock, i saw some keycodes fly by on the stock dmesg, could be mapped and replicated easily enough.

 

[FazJaxton]

Thanks for the great info! I don't have one of these, but am thinking of getting one after reading this. Do you have access to the e-ink display as a framebuffer or other display device? Could I kill the e-reader process and draw to the screen myself?

 

[dilsiam]

Dear Geert:

Would you please post the files mentioned on your post again?, I've been unable to get them. I need the newest firmware for Pandigital Novel 6" ePaper eReader.

Thanks
dilsiam

 

[geert]

Dear Dilsiam,

What file what that be? The original firmware?
Is the box.net link no longer working?
I will see if I can fix it.

 

[495642]

Here's another mirror on Mega for posterity:

https://mega.co.nz/#!DJ5lXTID!WPUYNVVQsvqHFAzE0AfvVmJCxs91kfvi470FPvn-PSQ

Same MD5/SHA1-sum as original:
MD5
d1fbd1c4a7a3b4ed0d858091d6b7045e 03_01B_PD_AUO6Q_ENG_S3C2416.tar.gz
SHA1
f683b23601b842f020cf5b9a68ee37dc362a1cf3 03_01B_PD_AUO6Q_ENG_S3C2416.tar.gz

I just got one of these for my daughter and it has the standard S10_10_20_PD_AUO6Q_ENG_S3C2416 on it, flashing to this and things seem to be working well.