Hack Remarkable 2
Posted on Sat 07 September 2024 in hack • 2 min read
Do you need additional tools on you Remarkable?
Use toltec.
Toltec is a community-maintained repository of free software for the reMarkable tablet. It is the recommended way to install software on the device.
But:
⚠️ Warning: Toltec only supports OS builds between 2.6.1.71 and 3.3.2.1666.
So, you need to downgrade from the current version (mine was 3.14.1.9) that's why I wrote this manual. Be careful: notes created on a higher version may not be compatible with an older version.
In versions >=3.11 of the system software, automatic updates are no longer possible. Firmware must be downloaded and extracted using dd.
Say, your Remarkable has IP: 192.168.10.29
You need SSH password for RM2. Go to "Menu" -> "Help" -> "Copyright & linceses". At the bottom you'll find password - store it in the safe place.
Here are the steps to downgrade firmware:
- Download the upgrade file with codexctl.
- Extract the raw ext4 image from the upgrade file.
- Transfer the image to the device.
- Determine which partition is the fallback partition.
- Use dd to write the image to the fallback partition.
- Use codexctl restore to make the fallback partition active.
- Reboot the device.
1. Download the upgrade file with codexctl
You will need 2 versions of codexctl binary - one for Rm2 and another for your PC.
Binary for Rm2:
Download the latest version from: https://github.com/Jayy001/codexctl/releases/
Extract it and copy it to the Rm2:
wget https://github.com/Jayy001/codexctl/releases/download/1719419372/remarkable.zip unzip remarkable.zip scp codexctl.bin root@192.168.10.29:.
Binary for PC:
Build codexctl on your PC/laptop and download the image with firmware:
git clone https://github.com/Jayy001/codexctl.git cd codexctl python -m venv venv source ./venv/bin/activate pip install wheel pip install -r requirements.remote.txt python codexctl.py download toltec
Downloaded image has a name: 3.3.2.1666_reMarkable2-ihUirIf133-.signed.
2. Extract the raw ext4 image from the firmware file
Extract the image:
python codexctl.py extract --out ./3.3.2.1666_reMarkable2-ihUirIf133-.extracted ../3.3.2.1666_reMarkable2-ihUirIf133-.signed
$ file 3.3.2.1666_reMarkable2-ihUirIf133-.extracted extracted_fw: Linux rev 1.0 ext4 filesystem data, UUID=fb041d03-92fd-48ab-993f-6ee5b0f954a7 (extents) (64bit) (large files) (huge files)
3. Transfer the image to the device.
Copy extracted image to the Rm2:
scp ./3.3.2.1666_reMarkable2-ihUirIf133.extracted root@192.168.10.29:.
4. Determine which partition is the fallback partition
On Rm2:
root@reMarkable:~# fdisk -l Disk /dev/mmcblk2: 7456 MB, 7818182656 bytes, 15269888 sectors 238592 cylinders, 4 heads, 16 sectors/track Units: sectors of 1 * 512 = 512 bytes Device Boot StartCHS EndCHS StartLBA EndLBA Sectors Size Id Type /dev/mmcblk2p1 32,0,1 671,3,16 2048 43007 40960 20.0M 83 Linux /dev/mmcblk2p2 672,0,1 95,3,16 43008 595967 552960 270M 83 Linux /dev/mmcblk2p3 96,0,1 543,3,16 595968 1148927 552960 270M 83 Linux /dev/mmcblk2p4 544,0,1 1023,3,16 1148928 15269887 14120960 6895M 83 Linux root@reMarkable:~# mount /dev/mmcblk2p3 on / type ext4 (rw,relatime) [...] /dev/mmcblk2p1 on /var/lib/uboot type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro) /dev/mmcblk2p4 on /home type ext4 (rw,relatime)
As seen above, only /dev/mmcblk2p2 is NOT MOUNTED, so that is the fallback partition.
5. Use dd to write the image on the fallback partition
dd if=/home/root/3.3.2.1666_reMarkable2-ihUirIf133.extracted of=/dev/mmcblk2p2
6. Use codexctl restore to make the fallback partition active
On Rm2:
/home/root/codexctl.bin restore
Confirm twice and shut down Rm2.
7. Reboot the device.
After the restart, you will have older firmware.