Beyond Your Bookshelf - Hackable eReaders
Where
IoT Village
DEF CON 34
Duration
39 min
Explores how e-readers from Kindle, Kobo, Android and low-cost ESP32 makers can be jailbroken, customized and reflashed with community firmware.
Summary
The talk argues that e-ink readers, usually treated as single-purpose appliances, are an open platform that many owners never explore. The speaker surveys the main ecosystems: Kindles locked to Amazon accounts, Kobos that accept launchers and patches, Android-based e-ink tablets with old and rarely patched forks, and cheap ESP32-based readers. She explains how Amazon closed the older Calibre plugin route for stripping DRM from purchased books.
The middle section walks through Kindle jailbreaks at a high level. Winterbreak abuses a web view that loads from a replaceable folder while the device is in airplane mode, then runs a shell script that swaps Amazon's signing keys. An older route for devices with special offers uses a WebKit flaw from 2012 to gain arbitrary memory read and write. A fake update package provides persistence, after which package managers and open readers such as CoReader can be installed.
The bulk of the ESP32 discussion covers constraints. These devices have roughly 400 KB of RAM, so heap fragmentation from TLS libraries matters, and EPUBs are cached to the SD card in pieces. Sharing the frame buffer lets Wi-Fi and Bluetooth run, and e-ink refresh behaviour shapes how images are drawn. The takeaway is that developer-mode hardware makes a practical, low-cost introduction to embedded programming, and that regional firmware locks should be checked before buying.
Materials
Related talks
BioHacking Village·32 min
Marie Mo · Cheyenne · Christian
Follows a pacemaker patient and two students as they reverse engineer a clinic programmer and an implant's firmware, exposing its weaknesses.
Main Stage·41 min
Darren McDonald
Shows how full disk encryption on Dell, HP and IGEL thin clients falls to boot chain and TPM flaws, letting an attacker reach the disk from a powered-off device.
Payment Village·18 min
Chaio-Lin Yu
Shows how a nine-dollar payment terminal fell to a three-bug chain over Wi-Fi, giving unauthenticated access and then root on a certified production unit.


