Getting to know Clara
My first step is to figure out what information I can get from the device without opening it. The back cover shows that it’s a N367B model.
Since Kobo apparently has partnered with ifixit, I was able to find some guides showing the devices motherboards. There are two models the N367 and N367B.
We can clearly see a UART port on the top-left side of the N367 motherboard. A UART port is an asynchronous serial interface that uses separate TX (transmission) and RX (reception) lines for bidirectional communication.
On the right side of N367B motherboard, there seems to be something similar but without the same markings, so it would need some further investigation later on.
Why am I trying to figure out if there is a UART port somewhere? Because on most devices, this is where boot messages get printed. You can see what happens in the boot chain and, for linux based systems, the kernel messages, just like when your computer starts. This gives a lot of valuable information to create a bootable system later on. Some manufacturers use a UART port to flash the device before they leave the factory.
So, as finding a suitable UART port would require further investigation on my model and I didn’t want to open it up right away, I started trying to figure out if there was a way to stop the boot process and put the device in either fastboot mode or something else. Usually, you need to find a sequence of actions to perform when the device boots to get there.
Fastboot mode
I tried pressing the power button multiple seconds before pluging the usb cable, different combinations of pluging, unplugging, pressing the button etc… But it was not it.
Some devices sometimes require the host to “poll” the device with a fastboot command for them to interrupt their booting process. So,here’s how I managed to get it into fastboot.
- Turn off and unplug the Clara from your computer
- Launch the
fastboot getvar all command on your computer
- Plug the Clara to your computer
- Quickly hold the power button until you see information in your host console
- Release the power button
- The Clara is now in fastboot mode
This is what you should get in your terminal:
➜ ~ fastboot getvar all
< waiting for any device >
(bootloader) hwcfg.PCB: [0] PCB=0x71
(bootloader) max-download-size: 0x1e00000
(bootloader) version: 0.5
all: Done!!
Finished. Total time: 0.003s
It doesn’t tell us much for now, but having the Clara in fastboot is useful if we want to flash existing partitions, or if we want to try a new boot image without flashing the emmc and potentially bricking it.
To get out of fastboot mode, just press the power button approximately 10 seconds.
Investigating the filesystem
When plugging the Clara to your computer, you can mount it as a mass storage device and put books on it. So let’s see what’s on that partition:
➜ KOBOeReader ls
fonts
➜ KOBOeReader ls -la
total 8364
drwxr-xr-x 7 marc marc 8192 jan 1 1970 .
drwxr-x---+ 3 root root 4096 nov 15 12:13 ..
drwxr-xr-x 2 marc marc 8192 nov 14 10:19 .adobe-digital-editions
drwxr-xr-x 3 marc marc 8192 aoû 28 11:10 fonts
drwxr-xr-x 11 marc marc 8192 nov 15 12:13 .kobo
drwxr-xr-x 49 marc marc 8192 nov 14 11:36 .kobo-images
➜ KOBOeReader
This kobo dot folder seems interesting, let’s check what’s in it:
➜ KOBOeReader ls -la .kobo
total 576
drwxr-xr-x 11 marc marc 8192 nov 15 12:13 .
drwxr-xr-x 7 marc marc 8192 jan 1 1970 ..
-rw-r--r-- 1 marc marc 25 nov 14 10:19 affiliate.conf
drwxr-xr-x 2 marc marc 8192 nov 14 11:34 assets
drwxr-xr-x 2 marc marc 8192 nov 14 11:35 audiobook
-rw-r--r-- 1 marc marc 19456 nov 15 12:06 BookReader.sqlite
drwxr-xr-x 2 marc marc 8192 nov 14 10:19 certificates
drwxr-xr-x 2 marc marc 8192 nov 14 11:34 custom-dict
-rw-r--r-- 1 marc marc 75 nov 14 10:19 device.salt.conf
drwxr-xr-x 2 marc marc 8192 nov 14 11:35 dict
drwxr-xr-x 2 marc marc 8192 nov 14 11:36 dropbox
-rw-r--r-- 1 marc marc 3072 nov 14 11:34 fonts.sqlite
drwxr-xr-x 2 marc marc 8192 nov 14 11:34 guide
drwxr-xr-x 2 marc marc 8192 nov 14 11:34 kepub
drwxr-xr-x 2 marc marc 8192 nov 14 10:19 Kobo
-rw-r--r-- 1 marc marc 427008 nov 15 12:13 KoboReader.sqlite
-rw-r--r-- 1 marc marc 105 nov 14 10:19 ssh-disabled
-rw-r--r-- 1 marc marc 82 nov 15 12:12 version
Hang on… What is this ssh-disabled file…
To enable ssh:
- Rename this file to ssh-enabled
- Reboot the device
- Connect via: ssh root@<device_ip>
Ok, this is exciting 
Having ssh access as root would allow us to gather everything we need to run buildroot and Nerves on this thing.
SSH access
After renaming that file and ejecting the device, getting it’s IP from my dhcp server lease list, I was, as promised, able to connect to the Clara as root… 
[root@kobo ~]# uname -a
Linux kobo 4.9.77 #1 SMP PREEMPT d226bc7bf-20250103T160218-B0103160930 armv7l GNU/Linux
[root@kobo ~]# cat /proc/cpuinfo
processor : 0
Processor : ARMv7 Processor rev 4 (v7l)
model name : ARMv7 Processor rev 4 (v7l)
BogoMIPS : 15.60
Features : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 4
Hardware : MediaTek MT8110 board
Revision : 0000
Serial : 1234567890ABCDEF
[root@kobo ~]# ls -la /dev/disk/by-partlabel/
total 0
drwxr-xr-x 2 root root 280 Nov 15 12:21 .
drwxr-xr-x 7 root root 140 Nov 15 12:21 ..
lrwxrwxrwx 1 root root 15 Nov 15 12:21 UBOOT -> ../../mmcblk0p2
lrwxrwxrwx 1 root root 15 Nov 15 12:21 bl2 -> ../../mmcblk0p1
lrwxrwxrwx 1 root root 15 Nov 15 12:21 boot_a -> ../../mmcblk0p4
lrwxrwxrwx 1 root root 15 Nov 15 12:21 hwcfg -> ../../mmcblk0p6
lrwxrwxrwx 1 root root 15 Nov 15 12:21 ntxfw -> ../../mmcblk0p7
lrwxrwxrwx 1 root root 15 Nov 15 12:21 nvram -> ../../mmcblk0p3
lrwxrwxrwx 1 root root 16 Nov 15 12:21 recovery -> ../../mmcblk0p11
lrwxrwxrwx 1 root root 16 Nov 15 12:21 system_a -> ../../mmcblk0p10
lrwxrwxrwx 1 root root 15 Nov 15 12:21 tee_a -> ../../mmcblk0p5
lrwxrwxrwx 1 root root 16 Nov 15 12:21 userdata -> ../../mmcblk0p12
lrwxrwxrwx 1 root root 15 Nov 15 12:21 vendor -> ../../mmcblk0p9
lrwxrwxrwx 1 root root 15 Nov 15 12:21 waveform -> ../../mmcblk0p8
[root@kobo ~]#
This tells us already quite a lot of things:
- It’s running an old kernel, probably custom
- It’s an Armv7 32 bits
- It seems to rely on AB partitioning and has partitions dedicated to configuration, waveform information for the e-ink screen, etc…
I now need to understand a bit better how all of this is wired up, and also which drivers are used.
[root@kobo ~]# lsmod
wlan_drv_gen4m 1908365 0 - Live 0xbf14a000 (O)
wmt_cdev_bt 16871 0 - Live 0xbf141000 (O)
wmt_chrdev_wifi 12825 1 wlan_drv_gen4m, Live 0xbf138000 (O)
wmt_drv 1059215 4 wlan_drv_gen4m,wmt_cdev_bt,wmt_chrdev_wifi, Live 0xbf000000 (O)
lsmod doesn’t provide much info so I’m assuming there is a lot of stuff compiled within the kernel and some custom logic happening in the init proces. Time to dig into the filesystem and the different partitions! 
