Hacking the Amazon Kindle DX, Part 1: Bluetooth Shell

I got an Amazon Kindle DX for XMas.  I wanted one mostly for viewing device datasheets (PDF).

I should say I do like the Kindle, and I will keep it (anyway there's no choice now).   However, the PDF viewer is very disappointing.

Really, that disappointment is mostly for one reason: No table of contents!  I don't know who uses PDFs without TOC... it's terrible! In the past, I've passed up ICs in the chip selection process for products/projects solely because they had datasheets without TOCs.

So, Amazon...  no TOC support?  Seriously?

Anyway...  I decided to start hacking on it and see what happened.  I found a great forum at MobileRead, with exactly what I was looking for.  (thanks, Jyavenard)  It's a hack that more or less re-enabled a leftover QA test mode on the Kindle, and ultimately let me telnet into a shell on the Kindle over USB.

However, I started to get concerned about bricking it.  What's the first thing you should do when worrying about damaging your new toy?  Take it apart, of course!  :)

The little gray bezel was the hardest part.  Once I figured out how to get that off the Kindle DX, the rest was quick work with a screwdriver.  (Although it really was a ridiculous number of screws...  did I mention I lost one?)

I should pause here to note that this is about the point my wife walked in.  Case off, screws and bezel lying to the side, hunched over it with a voltmeter...  *sigh*

So, what to do? Well, the point of opening it was really just to get to the one known serial port that gives you bootloader, recovery, and Linux console access. Basically, what this guy did.

However, I didn't want holes in my kindle or wires hanging around. So, what about that nice little Bluetooth module I just finished playing with as a slave device for my Nokia phone? You know, SparkFun's Bluetooth Mate?  It converts any TTL-level RS232 serial interface into a Bluetooth connection.

Great stuff, eh? 

First things first... space needed to be made for it.  Since I wanted easy access to it (eventually I need some way to turn it on and off) I chose to put it just under the gray bezel.

You can see the paper and tape I added to cover some unpopulated resistor pads. The Kindle DX does NOT appear to be conformal coated at all, so all these pads are potential shorting points! The internal cover needed cutting out to fit over the Bluetooth module:

So, how does it fit?

You can see the wires I routed to it. The three large pads in the middle of the Kindle are GND, RX, and TX. The Bluetooth Mate has an internal 3.3V regulator. The fourth pad is probably power, but it reads 2.8V. I could bypass the Bluetooth Mate's regulator, but the Roving Networks module on it wants 3-3.6V. I found about 4V (battery voltage) on one side of the wakeup switch. So, I passed that in to the Bluetooth Mate's voltage regulator. However, the Bluetooth Mate does voltage translation back up to the input voltage, and I didn't want the 4V going to the serial port, when it's IO lines seem to idle at 2.8V. So, I modified the Bluetooth Mate to pull TX up to the regulated 3.3V rail instead of the 4V input. This is probably very important. I don't know what kind of voltage the serial port can handle, but 4V is very likely too much.

With the gray bezel back on it looks completely untouched.

I created a new user 'ppp' on the Kindle, and set it up to launch pppd on login.  Getting ppp to work took some fiddling, but I eventually got it right.  I ended up putting my own compile of a ssh server on it, created a ssh key, and voila!

I can now connect via Bluetooth, and I have a wireless network connection to my Kindle DX!

Now hacking on it is easier than ever.

Note: The Bluetooth module unconnected must always listen for connections.  So, it's drawing 20-30 mA of power at all times.  (It is counter-intuitively using less power when it's connected, since the module and your PC can agree on when to wake up to talk)  It turns out that this idle current may be more than double what the Kindle DX uses on it's own (when idle), so I'm dramatically shortening the battery life.  However, it's still about four days...  down from over a week or two.  I may address that issue later.

Comments

[darron]

@Zachary Rubin: Nothing usable. I now just use a TouchPad for viewing schematics and datasheets while soldering... which was my entire point for having a Kindle. My wife used the Kindle for a bit, but now she's using an iPad.

[Zachary Rubin]

Hey awesome hack - nice job!
I also up a DX for mostly datasheet / reference book usage but the lack of pdf ToC support does make it nearly useless for this... were you ever able to get a better pdf reader running under qt?

[Rob Hamersma]

Great project!

I'm currently trying to design a remote pushbutton/microcontroller interface for the Kindle DX (graphite) for my dad who is a quadriplegic. DO you know if it would it be possible to send simple commands to the serial port to navigate the Kindle? I'm just looking for next/previous page commands for now. Thanks!

[Cherry2005]

It is my first time see your post, it's a very nice introdcution, I learnt much from your essay. and I think that some components can be find on http://www.seekic.com and http://www.chinaicmart.com

[Hondamarlboro]

Successfully built bluetooth module into Kindle Global Wireless (Kindle2). Thanks for your great work and sharing information. http://hondamarlboro.blog112.fc2.com/blog-entry-48.html

[darron]

How small are the contacts? You could try some plastic mount with Pogo Pins. You can get anything made in plastic these days using rapid prototyping (Redeye RPM, etc)... if you actually need anything more complex than a little plastic rectangle with holes drilled in it.

There's also a chance the Linux Input API would let you push keystrokes in to the system, but I'm not sure if the Kindle framework would use it.

[Mark Felling]

I am disabled and provide adaptations for disabled individuals who have limited or no use of their hands and arms. I have had quite a few requests from individuals who would like to have the Kindle on one of our mounts on their bed or wheelchair, but have no way to push the buttons that move the page forward or back. I dissected a Kindle 2 but the contact points for the buttons are too small to solder to for external SPST switch connections. Does anyone know if there would be a way to use this Bluetooth connection or any other method to tell the Kindle to move forward or back a page?

[kindx]

Hi darron,
you can check the actual current via console:
gasgauge-info -l
with and without BT and unplugged usb (loading current)

[darron]

The current usage is not measured (my Fluke meter's current mode fuse is blown at the moment), it's from the RN-41 datasheet. Standby/idle usage is 25ma, connected (low power sniff) is 8ma. The Bluetooth Mate board probably uses a little bit more (regulator, etc)

Reducing the scanning interval like Bernhard said would help, but it's not in master mode.

[jie liu]

Your module must be working in SPP devA and is inquiring all the time. A SPP devB (slave) should be able to reduce the current to several mA by just waiting for connection.

[darron]

Looking here: http://www.ifixit.com/Teardown/Kindle-2/624/1 You can see that the Kindle 2 still has the same 4 big pads for the serial port under the gray bezel. So, it's doable. The problem is making room for the Bluetooth module somewhere. There -may- be room for it in pretty much the same place I put it on the DX, if you cut out some of the white plastic.

[A Facebook User]

any way we can do this with the regular kindle 2?

[kindx]

I found some additional info:
S2 is a mini pci-e slot, pinout at http://www.allpinouts.org/index.php/PCI_Express_Card_and_PCI_Express_Mini_Card (with USB! and simcard pins).
There are a lot of WIFI cards for mini pci-e out there (notebooks) - so it's just to handle the driver and settings (and the antenna! :(
Good pictures of open DX can be found here:
http://www.rapidrepair.com/guides/kindle-dx/amazon-kindle-dx-disassembly-repair-guide.html

[kindx]

@darron: sorry - no the J3 is just for simcard, but when you read the specs of the UMTS modul it say's it has a USB 2.0, so there should be USB pins on J2.
I think the simcard pins are connected to J2 too. So if the module doesn't support a sim they might be used for nothing.
But I would be pretty happy if I could exchange the sim to a local provider with cheap internet package and browse all the internet on my international DX.
At the moment only amazon and wikipedia is allowed.

[darron]

@kindx: So, the simcard socket is the USB2 connection? There are pads on the US DX for a sim card, but I wasn't brave enough to do too much with it. I saw the SD card pads, even soldered on a connector I happened to have lying around... before I noticed all I/O pins on it are shorted. There are probably resistors pulling them all to some common point to avoid floating some microcontroller inputs, since it's unpopulated. I never removed the top of the box shield, so I didn't explore much further.

[kindx]

Hi!
Congratulations, great work!
The international version of kindle dx has a anydata DTP-600W module (J2) for UMTS/GPRS/EGPRS and a simcard in a socket beside (J3).
There is a USB2 on it - so there should be a WIFI solution too!
Did you mention the empty P1 connector, I'm pretty sure it's for SD-card.

[darron]

Okay, thanks! I may try the scanning interval change. I saw that, but I didn't want any problems making a connection if I got it wrong. The power usage is high enough to be worth figuring it out, though. The blink interval is new to me, so that's cool. I'll do that. I thought about removing the power led, but it's really the disconnected state that is active 99% of the time.

[Bernhard Wörndl-Aichriedler]

Hey =)

I worked quite a lot with the BlueSmirf .. or Bluetooth mate , and there are several different tactics to bring down the power consumption.

You could for example reduce the scanning intervall, so the 20 two 30 mA for scanning will only be consumed every 10s or so. What also helps is increasing the blink intervall timer for the active led and desoldering the power led.

[darron]

Well, it's possible to remove the Whispernet module and put in a Wifi card. Then you'd need to change the web proxy stuff to stop going through Amazon.

I suppose if there was a PPP-capable WiFi (or if you put another microcontroller in there managing a WiFi and present a PPP interface) you could make it work with the serial port, like this uses it for Bluetooth.

[Zhongyin Wang]

Can you make any WIFI module work on DX?