Hacking the Amazon Kindle DX, Part 1: Bluetooth Shell

I got an Amazon Kindle DX for XMas.  I wanted one mostly for viewing device datasheets (PDF).

I should say I do like the Kindle, and I will keep it (anyway there's no choice now).   However, the PDF viewer is very disappointing.

Really, that disappointment is mostly for one reason: No table of contents!  I don't know who uses PDFs without TOC... it's terrible! In the past, I've passed up ICs in the chip selection process for products/projects solely because they had datasheets without TOCs.

So, Amazon...  no TOC support?  Seriously?

Anyway...  I decided to start hacking on it and see what happened.  I found a great forum at MobileRead, with exactly what I was looking for.  (thanks, Jyavenard)  It's a hack that more or less re-enabled a leftover QA test mode on the Kindle, and ultimately let me telnet into a shell on the Kindle over USB.

However, I started to get concerned about bricking it.  What's the first thing you should do when worrying about damaging your new toy?  Take it apart, of course!  :)

The little gray bezel was the hardest part.  Once I figured out how to get that off the Kindle DX, the rest was quick work with a screwdriver.  (Although it really was a ridiculous number of screws...  did I mention I lost one?)

I should pause here to note that this is about the point my wife walked in.  Case off, screws and bezel lying to the side, hunched over it with a voltmeter...  *sigh*

So, what to do? Well, the point of opening it was really just to get to the one known serial port that gives you bootloader, recovery, and Linux console access. Basically, what this guy did.

However, I didn't want holes in my kindle or wires hanging around. So, what about that nice little Bluetooth module I just finished playing with as a slave device for my Nokia phone? You know, SparkFun's Bluetooth Mate?  It converts any TTL-level RS232 serial interface into a Bluetooth connection.

Great stuff, eh? 

First things first... space needed to be made for it.  Since I wanted easy access to it (eventually I need some way to turn it on and off) I chose to put it just under the gray bezel.

You can see the paper and tape I added to cover some unpopulated resistor pads. The Kindle DX does NOT appear to be conformal coated at all, so all these pads are potential shorting points! The internal cover needed cutting out to fit over the Bluetooth module:

So, how does it fit?

You can see the wires I routed to it. The three large pads in the middle of the Kindle are GND, RX, and TX. The Bluetooth Mate has an internal 3.3V regulator. The fourth pad is probably power, but it reads 2.8V. I could bypass the Bluetooth Mate's regulator, but the Roving Networks module on it wants 3-3.6V. I found about 4V (battery voltage) on one side of the wakeup switch. So, I passed that in to the Bluetooth Mate's voltage regulator. However, the Bluetooth Mate does voltage translation back up to the input voltage, and I didn't want the 4V going to the serial port, when it's IO lines seem to idle at 2.8V. So, I modified the Bluetooth Mate to pull TX up to the regulated 3.3V rail instead of the 4V input. This is probably very important. I don't know what kind of voltage the serial port can handle, but 4V is very likely too much.

With the gray bezel back on it looks completely untouched.

I created a new user 'ppp' on the Kindle, and set it up to launch pppd on login.  Getting ppp to work took some fiddling, but I eventually got it right.  I ended up putting my own compile of a ssh server on it, created a ssh key, and voila!

I can now connect via Bluetooth, and I have a wireless network connection to my Kindle DX!

Now hacking on it is easier than ever.

Note: The Bluetooth module unconnected must always listen for connections.  So, it's drawing 20-30 mA of power at all times.  (It is counter-intuitively using less power when it's connected, since the module and your PC can agree on when to wake up to talk)  It turns out that this idle current may be more than double what the Kindle DX uses on it's own (when idle), so I'm dramatically shortening the battery life.  However, it's still about four days...  down from over a week or two.  I may address that issue later.

Comments

[kindx]

Hi darron,
you can check the actual current via console:
gasgauge-info -l
with and without BT and unplugged usb (loading current)

[darron]

The current usage is not measured (my Fluke meter's current mode fuse is blown at the moment), it's from the RN-41 datasheet. Standby/idle usage is 25ma, connected (low power sniff) is 8ma. The Bluetooth Mate board probably uses a little bit more (regulator, etc)

Reducing the scanning interval like Bernhard said would help, but it's not in master mode.

[jie liu]

Your module must be working in SPP devA and is inquiring all the time. A SPP devB (slave) should be able to reduce the current to several mA by just waiting for connection.

[darron]

Looking here: http://www.ifixit.com/Teardown/Kindle-2/624/1 You can see that the Kindle 2 still has the same 4 big pads for the serial port under the gray bezel. So, it's doable. The problem is making room for the Bluetooth module somewhere. There -may- be room for it in pretty much the same place I put it on the DX, if you cut out some of the white plastic.

[A Facebook User]

any way we can do this with the regular kindle 2?

[kindx]

I found some additional info:
S2 is a mini pci-e slot, pinout at http://www.allpinouts.org/index.php/PCI_Express_Card_and_PCI_Express_Mini_Card (with USB! and simcard pins).
There are a lot of WIFI cards for mini pci-e out there (notebooks) - so it's just to handle the driver and settings (and the antenna! :(
Good pictures of open DX can be found here:
http://www.rapidrepair.com/guides/kindle-dx/amazon-kindle-dx-disassembly-repair-guide.html

[kindx]

@darron: sorry - no the J3 is just for simcard, but when you read the specs of the UMTS modul it say's it has a USB 2.0, so there should be USB pins on J2.
I think the simcard pins are connected to J2 too. So if the module doesn't support a sim they might be used for nothing.
But I would be pretty happy if I could exchange the sim to a local provider with cheap internet package and browse all the internet on my international DX.
At the moment only amazon and wikipedia is allowed.

[darron]

@kindx: So, the simcard socket is the USB2 connection? There are pads on the US DX for a sim card, but I wasn't brave enough to do too much with it. I saw the SD card pads, even soldered on a connector I happened to have lying around... before I noticed all I/O pins on it are shorted. There are probably resistors pulling them all to some common point to avoid floating some microcontroller inputs, since it's unpopulated. I never removed the top of the box shield, so I didn't explore much further.

[kindx]

Hi!
Congratulations, great work!
The international version of kindle dx has a anydata DTP-600W module (J2) for UMTS/GPRS/EGPRS and a simcard in a socket beside (J3).
There is a USB2 on it - so there should be a WIFI solution too!
Did you mention the empty P1 connector, I'm pretty sure it's for SD-card.

[darron]

Okay, thanks! I may try the scanning interval change. I saw that, but I didn't want any problems making a connection if I got it wrong. The power usage is high enough to be worth figuring it out, though. The blink interval is new to me, so that's cool. I'll do that. I thought about removing the power led, but it's really the disconnected state that is active 99% of the time.

[Bernhard Wörndl-Aichriedler]

Hey =)

I worked quite a lot with the BlueSmirf .. or Bluetooth mate , and there are several different tactics to bring down the power consumption.

You could for example reduce the scanning intervall, so the 20 two 30 mA for scanning will only be consumed every 10s or so. What also helps is increasing the blink intervall timer for the active led and desoldering the power led.

[darron]

Well, it's possible to remove the Whispernet module and put in a Wifi card. Then you'd need to change the web proxy stuff to stop going through Amazon.

I suppose if there was a PPP-capable WiFi (or if you put another microcontroller in there managing a WiFi and present a PPP interface) you could make it work with the serial port, like this uses it for Bluetooth.

[Zhongyin Wang]

Can you make any WIFI module work on DX?