Quaderno 1.6.60.04220FP

[laurentbartholdi]

Hi,
I just bought a Fujitsu Quaderno A4, and saw somewhere that the modifications you created should be compatible with that model (which I understand is really based on the same hardware as the Sony DPT-RP1).

However, the software version is indicated as 1.6.60.04220FP, and the root guide says that one should raise an issue if one has a software version not listed.

I also haven't seen any discussion on the possibilities for installing a new basic file manager. The one shipped by Fujitsu is extremely poorly designed: there is only one button, "Home"; no way of going back from "View Document" to "Files"; the only way to delete a file is to open it, delete, confirm, return to files; etc. If it were possible to flash a better manager, that would be great. Perhaps the one shipped with Sony's is better?

[HappyZ]

From janten's dtp-rp1-py I see it looks like the protocols for communications are the same.

The rooting idea (never tried, no device I can test):

1. Obtain the update package file for Quaderno and see if https://github.com/HappyZ/dpt-tools/tree/master/fw_updater_packer_unpacker can unpack it
2. If YES, then try the hacking PKG that obtains diagnosis mode access (need to validate if you can get into diagnosis mode)
3. If YES, then you can backup the system and install DPT pkg (or since we are able to unpack Quaderno one then we should be able to get adb running in there as well by modifying their system)

If you can get me the package file for 1.6.60.04220FP I can help quickly check (1).

[laurentbartholdi]

Hi HappyZ! Unfortunately, it seems impossible to get hold of a package file for 1.6.60.04220FP -- if by that you mean the firmware. I searched, at least, on the fujitsu website but there's no such file; the upgrade is done purely via their program. Did I understand your question correctly?

…

On Wed, Apr 21, 2021 at 8:45 AM HappyZ ***@***.***> wrote: From janten's dtp-rp1-py <https://github.com/janten/dpt-rp1-py> I see it looks like the protocols for communications are the same. The rooting idea (never tried, no device I can test): 1. Obtain the update package file for Quaderno and see if https://github.com/HappyZ/dpt-tools/tree/master/fw_updater_packer_unpacker can unpack it 2. If YES, then try the hacking PKG that obtains diagnosis mode access (need to validate if you can get into diagnosis mode) 3. If YES, then you can backup the system and install DPT pkg If you can get me the package file for 1.6.60.04220FP I can help quickly check (1). — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#181 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARAQUHXCMK33OIFXTYUDQLTJZYAPANCNFSM42U4V7AQ> .

-- Laurent Bartholdi laurent.bartholdi<at>gmail<dot>com Mathematisches Institut, Georg-August Universität zu Göttingen Bunsenstrasse 3-5, D-37073 Göttingen, Germany

[MuMu360121]

the same device as you，hope to help

[FanFansfan]

Hi HappyZ! Unfortunately, it seems impossible to get hold of a package file for 1.6.60.04220FP -- if by that you mean the firmware. I searched, at least, on the fujitsu website but there's no such file; the upgrade is done purely via their program. Did I understand your question correctly?
…
On Wed, Apr 21, 2021 at 8:45 AM HappyZ @.***> wrote: From janten's dtp-rp1-py https://github.com/janten/dpt-rp1-py I see it looks like the protocols for communications are the same. The rooting idea (never tried, no device I can test): 1. Obtain the update package file for Quaderno and see if https://github.com/HappyZ/dpt-tools/tree/master/fw_updater_packer_unpacker can unpack it 2. If YES, then try the hacking PKG that obtains diagnosis mode access (need to validate if you can get into diagnosis mode) 3. If YES, then you can backup the system and install DPT pkg If you can get me the package file for 1.6.60.04220FP I can help quickly check (1). — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#181 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AARAQUHXCMK33OIFXTYUDQLTJZYAPANCNFSM42U4V7AQ .
-- Laurent Bartholdi laurent.bartholdigmailcom Mathematisches Institut, Georg-August Universität zu Göttingen Bunsenstrasse 3-5, D-37073 Göttingen, Germany

unpack the digital paper pc app, and you can find updater url: https://dppa-updatesite-prod.herokuapp.com/api.
but unpacker from this repo can not unpack the update package.
package url: https://dppa-updatesite-prod.herokuapp.com/api/firm/version/1.6.60.04220FP/200706_0634_FwUpdater.pkg

[stavguo]

@laurentbartholdi Were you able to root the Quaderno? I'm also interested in getting one, but I would like to download other apk's for reading.

[laurentbartholdi]

Unfortunately not. I tried a little, but not very hard: first problem was to find a rom, and already there i was stuck.

…

On Mon, May 31, 2021, 18:18 dmellogu ***@***.***> wrote: @laurentbartholdi <https://github.com/laurentbartholdi> Were you able to root the Quaderno? I'm also interested in getting one, but I would like to download other apk's for reading. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#181 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARAQUBISAYJS66NWU3FLQDTQOZGFANCNFSM42U4V7AQ> .

I am also interested in updating my Quaderno

[HappyZ]

Sorry I'm just too busy these days. I'm not able to download through https://dppa-updatesite-prod.herokuapp.com/api/firm/version/1.6.60.04220FP/200706_0634_FwUpdater.pkg.

[raytrace2021]

@HappyZ I think you could download pkg here: https://www.fmworld.net/download/digital-paper/sw/FwUpdater_gen1_1.6.60.04220FP.pkg

[raytrace2021]

@HappyZ I tried but I think fw_updater_packer_unpacker doesn't work for FwUpdater_gen1_1.6.60.04220FP.pkg (failed in verifying data with signature) it sounds Quaderno uses different public key. How to get key.pub and key.private files for Quaderno?

[jd445]

I know that there are some people who flash sony software to Quaderno, and then they crack it. But I do not know how to do that.

[HappyZ]

It's possible you can flash the official on an already rooted device with diagnosis mode access, and then in diagnosis mode dump the system and build a new pkg out of it. Might be an interesting path to try. Unfortunately I no longer have my dpt rp1 so I can't try that.

…

On Wed, Oct 6, 2021, 21:16 Junjie Dong ***@***.***> wrote: I know that there are some people who flash sony software to Quaderno, and then they crack it. But I do not know how to do that. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#181 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABDVEKSH5OJEAXPYASCBBALUFUNJVANCNFSM42U4V7AQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[torytyler]

I have purchased a Quaderno a5 (gen1) from Japan, when it arrives in a few weeks I will try my best to achieve root. I will then post my findings for everyone to know. I can't believe that the only public method for these devices costs $300 from a shady company (goodereader). The device is so similar to the DPT that it shouldn't be too difficult, maybe a few offsets need to be changed... I will let you know ~

-edit-
As posted above, the Fujitsu firmware 1.6.60.04220FP is signed and the private key differs from the Sony firmware packages. Because of this, we are unable to unpack the Fujitsu FwUpdater .pkg. We will have to downgrade the device (in diagnosis mode) to Sony v1.6.50.14130, Ultimately turning it into a DPT-CP1.

I am listing my current strategy that should theoretically work, I just need my hardware to test!

1. get device to and plug into PC, validate successful connection.
2. attempt to get into diagnosis mode and patch the updater script.
3. when in the diagnosis. begin the recovery method, I will "install-pkg" the official cp1/rp1 SONY firmware v1.6.50.14130 (with disabled version check)
4. If this step proceeds, then I can continue getting root and exploit the device as if it was a normal CP1.

edit 2 (removal of goodereader trash talk)- I take back most of what I said about goodereader... but they are still shady. I have come to the conclusion that they are drop shipping pre-hacked devices from TaoBao and not using any method here to root devices. they are known to drop ship and I say this because in the fine print of their root listing you have to purchase the root package at the same time you buy a new ereader.

Thanks for reading, stay safe guys <3

[torytyler]

Not the update you guys want to see -

I tried for a bit now, no luck. I am able to get the Quaderno detected by dpt-tools, and when I attempt to push the package files to enable diagnosis mode, (using "dpt-tools > fw") the update pushes, system reboots, and says update failed, error 90001. I also tried to push a previous modded firmware with the version check disabled, same thing occurred.

I do, however have public and private keys for the Quaderno, maybe they will be useful for decompiling the update pkg... I was unable to decompile ANY package, even official sony, so I think I'm using the script wrong lol (script crashes on signature check, even with stock sony fw + github keys). I don't know if they will be helpful, but I will provide the keys. They differ from the ones on the github, so maybe it's something! Sorry guys, I wouldn't have guessed the device would be this locked down. I feel so close, but so far. :(

I think the method HappyZ mentioned about pushing the Quaderno update to an ALREADY rooted dpt and decompiling is a solid path to try, but I don't have a cp1 available.
I'll be lurking, and if I get anything going I'll let you know!

privatekey.txt
publickey.txt

EDIT - Adding teardown photo, was seeing if there were headers to hard write a cp1 image... maybe I can compare a motherboard of a cp1 to see a if the hardware is changed (I think the blocking of diagnosis mode is done through software though)... the back cover just twists off fyi

one more edit - i'm going oldschool (ie 2018 cp1 hacking days, and making an OTG cable mod to force my way into diagnosis mode... will update)...
so my new course of action is to manually connect to diagnosis mode, once in I can attempt to do an unofficial downgrade to sony version v1.6.50.14130. (then root with the corresponding modified boot.img)... if this doesn't work I give up. sorry for wall of text i'm trying my best to document my journey ~

[torytyler]

OTG cable mod no longer enables Diagnosis mode, so this means that the hardware exploit (otg cable) + software exploit (happyZ diagnosis update) are patched. I deem the Quaderno line + new patched DPT models un-hackable as of now, I tried every method.