In this post I detail how I went about enabling telnet and FTP support on my e-reader, the Kobo Aura H2O Edition 2 Version 2. Yes, that is a mouthful.

Full credit where it is due: My instructions are based on those written by Yingtong Li on their blog (copyrighted CC-BY-SA-4.0). Those instructions were written for another Kobo device (Clara HD), but work much the same as for the H2O. I’ve also added in some ftp support, as noted by the Mobile Read wiki, as well as some changes that would have made life easier had I known them beforehand.

IMPORTANT WARNING! Editing files in the way described in this post could well brick your device if you make a mistake. I take no responsibility for this.

Prep

The first step I took was to make sure that my device was up to date. The wiki notes a long list of firmware updates provided by Kobo, but figuring out which one to use is a bit daunting. Particularly of note is the fact that there are several editions of the H2O. The best way to check the version is as follows:

Open the main menu on the device and select “Settings”
Look at the “About” page title, and it says “H2O Edition 2”
Then, back on the settings screen, look at “Device Information”
Count to the 7th digit† and see if it is a 2. If it is a 2, this is a version 2 device.

The version 2 uses Mark 7 firmware, so it can be downloaded from the table on the wiki – you might as well pick the one closest to the bottom as that is the most recent release. Version 1 uses Mark 6 firmware – the rest of the steps are likely the same but, full disclosure, I haven’t tried them.

Hacking the H2O

…in 50 steps.

Prepping the latest firmware

Once the firmware package is downloaded, you’ll need to start fiddling with some files. I would suggest doing so in a linux environment‡. If you’re using Windows 10 like me, wsl will suffice.

You have downloaded a file called something like kobo-update-x.yy.zzz.zip
Make 2 new directories to work in: mkdir ~/WorkingDir ~/WorkingDirRoot
Go to your working directory for the upgrade: cd ~/WorkingDir
Extract the upgrade files:unzip ~/Downloads/kobo-update-x.yy.zzz.zip
Extract the firmware: tar xzf KoboRoot.tgz -C ~/WorkingDirRoot

Note that during the remainder of this post, if I refer to etc/ or opt/, I mean the directories inside ~/WorkingDirRoot/, and not your host OS’s /etc/ or /opt/.

At this point, we should make sure to apply the latest firmware upgrade, to make sure that everything is working so far.

Connect the H2O via USB
When prompted, Connect to the computer
Locate the device in a file browser, and make sure you can access the .kobo directory
Copy the contents of ~/WorkingDir to .kobo
Eject the device from your connected PC and it will reboot, applying the update

Bootstrapping our way in

To start networking on the device, we need to change the /etc/inittab file. Unfortunately, /etc/inittab isn’t included in the firmware update package, so we need to do the following to grab a copy of it from the device itself. Luckily, Kobo devices will treat any KoboRoot.tgz as a valid firmware update, so we can put modified scripts in there to let us obtain a copy of hidden files.

Edit the file in ~/WorkingDirRoot/etc/init.d/rcS
Find the lines near the end of the file:

/usr/local/Kobo/hindenburg &
LIBC_FATAL_STDERR_=1 /usr/local/Kobo/nickel -platform kobo -skipFontLoad &
[ $PLATFORM != freescale ] && rm -rf /dev/mmcblk1* && udevadm trigger &
insmod /drivers/$PLATFORM/misc/lowmem.ko &

Add a new line in as follows:

/usr/local/Kobo/hindenburg &
cp /etc/inittab /mnt/onboard
LIBC_FATAL_STDERR_=1 /usr/local/Kobo/nickel -platform kobo -skipFontLoad &
[ $PLATFORM != freescale ] && rm -rf /dev/mmcblk1* && udevadm trigger &
insmod /drivers/$PLATFORM/misc/lowmem.ko &

/mnt/onboard is the directory that allows you to see files when connected to a PC via USB.

Make sure you are in the right directory: cd ~/WorkingDirRoot
Prepare this modifed file as an “upgrade”: tar czf KoboRoot.tgz etc/init.d/rcS
Connect the H2O via USB
When prompted, Connect to the computer
Locate the device in a file browser, and access the .kobo directory
Copy the ~/WorkingDirRoot/KoboRoot.tgz to .kobo
Eject the device from your connected PC and it will reboot, applying the changed script
Delete the newly created “upgrade” to avoid later confusion: rm KoboRoot.tgz
Connect the H2O via USB
When prompted, Connect to the computer
Locate the device in a file browser, and look for the inittab file in the base directory (it will be alongside all of your ebooks)
Copy the file to ~/WorkingDirRoot/etc/inittab

Activating the networking daemons

We can now start editing the files required to allow us to use telnet.

Open etc/inittab, and at the end of the file, add the following new lines to the bottom of the file:

::sysinit:/bin/sh /opt/afterinit.sh
::respawn:/usr/sbin/inetd -f /opt/inetd.conf

After editing, my whole etc/inittab looks like this:

# This is run first except when booting in single-user mode.
::sysinit:/etc/init.d/rcS
::respawn:/sbin/getty -L ttymxc0 115200 vt100
::ctrlaltdel:/sbin/reboot
::shutdown:/bin/umount -a -r
::restart:/sbin/init
::sysinit:/bin/sh /opt/afterinit.sh
::respawn:/usr/sbin/inetd -f /opt/inetd.conf

Make the new opt directory referenced in the lines we added, mkdir opt. This directory won’t be overwritten by official firmware upgrades in the future.
Add in a new file, which will have a script that should run after the device starts up: opt/afterinit.sh
Add the following to opt/afterinit.sh (code supplied by Li), to enable the use of pseudo terminals in telnet

mkdir -p /dev/pts
mount -t devpts devpts /dev/pts

Copy the existing network configuration to the new directory, so we can edit it: cp etc/inetd.conf opt/inetd.conf
Edit opt/inetd.conf so that it contains the following new lines:

21 stream tcp nowait root /bin/busybox ftpd -w -S /
23 stream tcp nowait root /bin/busybox telnetd -i

We must undo the change we made to the kobo startup script in step 13. Open etc/init.d/rcS
Remove the line you added, so the end of the file should look like this again:

/usr/local/Kobo/hindenburg &
LIBC_FATAL_STDERR_=1 /usr/local/Kobo/nickel -platform kobo -skipFontLoad &
[ $PLATFORM != freescale ] && rm -rf /dev/mmcblk1* && udevadm trigger &
insmod /drivers/$PLATFORM/misc/lowmem.ko &

Now that we’ve made all the necessary changes, we only need to make one final upgrade and then we can use telnet to make any changes in the future.

Make sure you are in the right directory: cd ~/WorkingDirRoot
Prepare the final modifications as an “upgrade”: tar czf KoboRoot.tgz etc/init.d/rcS etc/inittab opt
Connect the H2O via USB
When prompted, Connect to the computer
Locate the device in a file browser, and access the .kobo directory
Copy the ~/WorkingDirRoot/KoboRoot.tgz to .kobo
Eject the device from your connected PC and it will reboot, applying the changed script
Connect the H2O to the same WiFi network as the PC
Open the main menu, open Settings > Device information
Make a note of the IP address, mine is 192.168.0.20
In a terminal, type telnet 192.168.0.20
Log in using the username root
You will notice there is no password, so set a new one passwd
Type a new password for “root”, press enter, and type it again – don’t forget it!

Now that you’re connected, you can run any commands you want through telnet. There’s even an editor, vi, pre-installed so you can edit files directly on the H2O without needing to deal with faking upgrade packages. For FTP, connecting is very easy:

Type ftp 192.168.0.20
When prompted, enter root as the username (see caveats below)
You can now put and get files as you need

Important Caveats:

From my testing, there is a tendency for the WiFi connections to drop out. I suspect this is likely due to power saving measures in the device itself. If you are using the telnet connection for a long time, or transferring a large file over FTP, I would suggest tapping the screen of the device to keep it “awake” about once a minute.
Telnet and FTP are insecure protocols. You should only use them if you are using the device on a secure network that you trust. There are more complex steps to enable secure tools such as SSH given on Li’s blog, though I haven’t tried using those yet.
FTP does not seem to require a password. This could potentially allow anyone to modify the device. If anyone reading this has suggestions of how to fix this issue, please let me know so I can update this article. If you will be frequently using WiFi on insecure / untrusted networks, I suggest not enabling FTP. (Don’t include the line beginning 21 in step 31). This seems to be due to how the FTP configuration for busybox was set, and the solution would be to rebuild it.

Conclusion

Thanks to Li for their existing blog post, and all the people who help maintain the mobile reads wiki. Let me know if there’s anything I could improve to make clearer, and happy telnetting.

Footnotes

† Example: Serial No. N000002000000 would be a version 2, as the 7th digit is a 2.

‡The H2O device itself runs linux. I don’t know if line endings are an issue, but you can never be too safe when dealing with them. Also, windows 10 does not have a telnet client, but you can use the one available in the windows subsystem for linux.

Enabling Telnet & FTP on the Kobo H2O Edition 2