en pl

Hack Remarkable 2

Posted on Sat 07 September 2024 in hack • 2 min read

Do you need additional tools on you Remarkable?

Use toltec.

Toltec is a community-maintained repository of free software for the reMarkable tablet. It is the recommended way to install software on the device.

But:

⚠️ Warning: Toltec only supports OS builds between 2.6.1.71 and 3.3.2.1666.

So, you need to downgrade from the current version (mine was 3.14.1.9) that's why I wrote this manual. Be careful: notes created on a higher version may not be compatible with an older version.

In versions >=3.11 of the system software, automatic updates are no longer possible. Firmware must be downloaded and extracted using dd.

Say, your Remarkable has IP: 192.168.10.29

You need SSH password for RM2. Go to "Menu" -> "Help" -> "Copyright & linceses". At the bottom you'll find password - store it in the safe place.

Here are the steps to downgrade firmware:

  1. Download the upgrade file with codexctl.
  2. Extract the raw ext4 image from the upgrade file.
  3. Transfer the image to the device.
  4. Determine which partition is the fallback partition.
  5. Use dd to write the image to the fallback partition.
  6. Use codexctl restore to make the fallback partition active.
  7. Reboot the device.

1. Download the upgrade file with codexctl

You will need 2 versions of codexctl binary - one for Rm2 and another for your PC.

Binary for Rm2:

Download the latest version from: https://github.com/Jayy001/codexctl/releases/

Extract it and copy it to the Rm2:

wget https://github.com/Jayy001/codexctl/releases/download/1719419372/remarkable.zip
unzip remarkable.zip
scp codexctl.bin root@192.168.10.29:.

Binary for PC:

Build codexctl on your PC/laptop and download the image with firmware:

git clone https://github.com/Jayy001/codexctl.git
cd codexctl
python -m venv venv
source ./venv/bin/activate
pip install wheel
pip install -r requirements.remote.txt
python codexctl.py download toltec

Downloaded image has a name: 3.3.2.1666_reMarkable2-ihUirIf133-.signed.

2. Extract the raw ext4 image from the firmware file

Extract the image:

python codexctl.py extract --out ./3.3.2.1666_reMarkable2-ihUirIf133-.extracted ../3.3.2.1666_reMarkable2-ihUirIf133-.signed
$ file 3.3.2.1666_reMarkable2-ihUirIf133-.extracted
extracted_fw: Linux rev 1.0 ext4 filesystem data, UUID=fb041d03-92fd-48ab-993f-6ee5b0f954a7 (extents) (64bit) (large files) (huge files)

3. Transfer the image to the device.

Copy extracted image to the Rm2:

scp ./3.3.2.1666_reMarkable2-ihUirIf133.extracted root@192.168.10.29:.

4. Determine which partition is the fallback partition

On Rm2:

root@reMarkable:~# fdisk -l
Disk /dev/mmcblk2: 7456 MB, 7818182656 bytes, 15269888 sectors
238592 cylinders, 4 heads, 16 sectors/track
Units: sectors of 1 * 512 = 512 bytes

Device       Boot StartCHS    EndCHS        StartLBA     EndLBA    Sectors  Size Id Type
/dev/mmcblk2p1    32,0,1      671,3,16          2048      43007      40960 20.0M 83 Linux
/dev/mmcblk2p2    672,0,1     95,3,16          43008     595967     552960  270M 83 Linux
/dev/mmcblk2p3    96,0,1      543,3,16        595968    1148927     552960  270M 83 Linux
/dev/mmcblk2p4    544,0,1     1023,3,16      1148928   15269887   14120960 6895M 83 Linux

root@reMarkable:~# mount
/dev/mmcblk2p3 on / type ext4 (rw,relatime)
[...]
/dev/mmcblk2p1 on /var/lib/uboot type vfat  (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mmcblk2p4 on /home type ext4 (rw,relatime)

As seen above, only /dev/mmcblk2p2 is NOT MOUNTED, so that is the fallback partition.

5. Use dd to write the image on the fallback partition

dd if=/home/root/3.3.2.1666_reMarkable2-ihUirIf133.extracted of=/dev/mmcblk2p2

6. Use codexctl restore to make the fallback partition active

On Rm2:

/home/root/codexctl.bin restore

Confirm twice and shut down Rm2.

7. Reboot the device.

After the restart, you will have older firmware.