Not Nearly Enough Time
Griffin I'Net, Inc. - Fun semi-random explorations into electronics, FPGAs, embedded development, the
Qt framework, and software.
Home
Archives
Profile
Subscribe
01/26/2010
Hacking the Amazon Kindle DX, Part 1: Bluetooth Shell
I got an Amazon Kindle DX for XMas. I wanted one mostly for viewing device datasheets (PDF).
I should say I do like the Kindle, and I will keep it (anyway there's no choice now). However, the PDF viewer is very
disappointing.
Really, that disappointment is mostly for one reason: No table of contents! I don't know who uses PDFs without TOC... it's
terrible! In the past, I've passed up ICs in the chip selection process for products/projects solely because they had datasheets
without TOCs.
So, Amazon... no TOC support? Seriously?
Anyway... I decided to start hacking on it and see what happened. I found a great forum at MobileRead, with exactly what I
was looking for. (thanks, Jyavenard) It's a hack that more or less re-enabled a leftover QA test mode on the Kindle, and
ultimately let me telnet into a shell on the Kindle over USB.
However, I started to get concerned about bricking it. What's the first thing you should do when worrying about damaging
your new toy? Take it apart, of course! :)
The little gray bezel was the hardest part. Once I figured out how to get that off the Kindle DX, the rest was quick work with a
screwdriver. (Although it really was a ridiculous number of screws... did I mention I lost one?)
I should pause here to note that this is about the point my wife walked in. Case off, screws and bezel lying to the side,
hunched over it with a voltmeter... *sigh*
So, what to do? Well, the point of opening it was really just to get to the one known serial port that gives you bootloader,
recovery, and Linux console access. Basically, what this guy did.
However, I didn't want holes in my kindle or wires hanging around. So, what about that nice little Bluetooth module I just
finished playing with as a slave device for my Nokia phone? You know, SparkFun's Bluetooth Mate? It converts any TTL-level
RS232 serial interface into a Bluetooth connection.
Great stuff, eh?
First things first... space needed to be made for it. Since I wanted easy access to it (eventually I need some way to turn it on
and off) I chose to put it just under the gray bezel.
You can see the paper and tape I added to cover some unpopulated resistor pads. The Kindle DX does NOT appear to be
conformal coated at all, so all these pads are potential shorting points! The internal cover needed cutting out to fit over the
Bluetooth module:
So, how does it fit?
You can see the wires I routed to it. The three large pads in the middle of the Kindle are GND, RX, and TX. The Bluetooth
Mate has an internal 3.3V regulator. The fourth pad is probably power, but it reads 2.8V. I could bypass the Bluetooth Mate's
regulator, but the Roving Networks module on it wants 3-3.6V. I found about 4V (battery voltage) on one side of the wakeup
switch. So, I passed that in to the Bluetooth Mate's voltage regulator. However, the Bluetooth Mate does voltage translation
back up to the input voltage, and I didn't want the 4V going to the serial port, when it's IO lines seem to idle at 2.8V. So, I
modified the Bluetooth Mate to pull TX up to the regulated 3.3V rail instead of the 4V input. This is probably
very important. I don't know what kind of voltage the serial port can handle, but 4V is very likely too much.
With the gray bezel back on it looks completely untouched.
I created a new user 'ppp' on the Kindle, and set it up to launch pppd on login. Getting ppp to work took some fiddling, but I
eventually got it right. I ended up putting my own compile of a ssh server on it, created a ssh key, and voila!
I can now connect via Bluetooth, and I have a wireless network connection to my Kindle DX!
Now hacking on it is easier than ever.
Note: The Bluetooth module unconnected must always listen for connections. So, it's drawing 20-30 mA of power at all
times. (It is counter-intuitively using less power when it's connected, since the module and your PC can agree on when to
wake up to talk) It turns out that this idle current may be more than double what the Kindle DX uses on it's own (when
idle), so I'm dramatically shortening the battery life. However, it's still about four days... down from over a week or two. I
may address that issue later.
Posted at 10:20 PM in Electronics, Hacking, Kindle, Mobile platforms | Permalink
| Digg This
Comments
You can follow this conversation by subscribing to the comment feed for this post.
Yes it would but the e-ink makes a big difference. The combo I'm thinking of would give back the joy of reading (and doing something) to
those who can not even turn a book page without help. It would be relatively easy to do on tablet/pc but reading on lcd is rubbish. And also
such a hack/mod for Kindle would turn a lot of attention to BCI tech, to locked-in patients, and of course to the creators of the mod.
Posted by: Neurogadget | 04/25/2012 at 04:53 PM
@Neurogadget: Why not use an iPad and the Kindle app for iPad? Wouldn't the XWave work directly with that?
Posted by: darron | 04/25/2012 at 03:11 PM
Hi Darron, thanks for the answer. Unfortunately I'm not a technical person, so what I understand is that the hacked-in bluetooth can not do
the job. However it would be great to find a way to connect a neuro-headset to an ebook reader, that could potentially cheer up the everyday
life of tens of thousands of paralysed people or patients who suffer from locked-in syndrome. Do you think it's possible somehow? Know
anyone who could do the trick? The neuro-headset has an SDK, the Kindle has a KDK, so why would it be impossible? :)
Posted by: Neurogadget | 04/24/2012 at 02:11 PM
@Neurogadget: Very likely not as described. The bluetooth module is acting in a serial port mode... probably not compatible with the
headsets. However, you could use a small microcontroller with an ADC to simulate the microphone port the one set usually uses. I'd do
some kind of passthrough to allow a replaced console to pass through the microcontroller, else you'd lose the console and have to find some
other way to interact with the unit.
Posted by: darron | 04/22/2012 at 04:20 PM
sorry, Darron of course
Posted by: Neurogadget | 04/22/2012 at 04:01 AM
Hi Darren,
Is it possible, at least in theory, to connect an external hardware device to a Kindle ebook reader and control via this device? The device I'm
thinking of would be a mobile brain-computer interface such as a MindWave or a PLX Xwave (http://bit.ly/nbo9aV).
Thanks!
Posted by: Neurogadget | 04/22/2012 at 03:56 AM
@Kuba Radzikowski: I don't have the bluetooth module currently to check... but looking at the schematic on Sparkfun's web site, it looks
clear that I changed where one end of R4 connects to. Change the connection on R4 which is currently tied to VCC to go to 3.3V instead.
You'd also need to do this with R8 if you use RTS, which I didn't.
Posted by: darron | 04/04/2012 at 11:37 PM
Hi, how did you modify the Bluetooth Mate to pull TX up to the regulated 3.3V rail instead of the 4V input?
Posted by: Kuba Radzikowski | 04/04/2012 at 03:07 AM
@Zachary Rubin: Nothing usable. I now just use a TouchPad for viewing schematics and datasheets while soldering... which was my entire
point for having a Kindle. My wife used the Kindle for a bit, but now she's using an iPad.
Posted by: darron | 09/05/2011 at 09:29 PM
Hey awesome hack - nice job!
I also up a DX for mostly datasheet / reference book usage but the lack of pdf ToC support does make it nearly useless for this... were you
ever able to get a better pdf reader running under qt?
Posted by: Zachary Rubin | 09/03/2011 at 07:30 PM
Great project!
I'm currently trying to design a remote pushbutton/microcontroller interface for the Kindle DX (graphite) for my dad who is a quadriplegic.
DO you know if it would it be possible to send simple commands to the serial port to navigate the Kindle? I'm just looking for next/previous
page commands for now. Thanks!
Posted by: Rob Hamersma | 04/17/2011 at 04:11 PM
It is my first time see your post, it's a very nice introdcution, I learnt much from your essay. and I think that some components can be find
on http://www.seekic.com and http://www.chinaicmart.com
Posted by: Account Deleted | 09/26/2010 at 01:08 AM
Successfully built bluetooth module into Kindle Global Wireless (Kindle2). Thanks for your great work and sharing information.
http://hondamarlboro.blog112.fc2.com/blog-entry-48.html
Posted by: Hondamarlboro | 04/14/2010 at 09:39 AM
How small are the contacts? You could try some plastic mount with Pogo Pins. You can get anything made in plastic these days using rapid
prototyping (Redeye RPM, etc)... if you actually need anything more complex than a little plastic rectangle with holes drilled in it.
There's also a chance the Linux Input API would let you push keystrokes in to the system, but I'm not sure if the Kindle framework would
use it.
Posted by: darron | 03/25/2010 at 08:33 AM
I am disabled and provide adaptations for disabled individuals who have limited or no use of their hands and arms. I have had quite a few
requests from individuals who would like to have the Kindle on one of our mounts on their bed or wheelchair, but have no way to push the
buttons that move the page forward or back. I dissected a Kindle 2 but the contact points for the buttons are too small to solder to for
external SPST switch connections. Does anyone know if there would be a way to use this Bluetooth connection or any other method to tell
the Kindle to move forward or back a page?
Posted by: Mark Felling | 03/23/2010 at 04:39 PM
Hi darron,
you can check the actual current via console:
gasgauge-info -l
with and without BT and unplugged usb (loading current)
Posted by: kindx | 02/11/2010 at 09:06 AM
The current usage is not measured (my Fluke meter's current mode fuse is blown at the moment), it's from the RN-41 datasheet.
Standby/idle usage is 25ma, connected (low power sniff) is 8ma. The Bluetooth Mate board probably uses a little bit more (regulator, etc)
Reducing the scanning interval like Bernhard said would help, but it's not in master mode.
Posted by: darron | 02/05/2010 at 09:59 AM
Your module must be working in SPP devA and is inquiring all the time. A SPP devB (slave) should be able to reduce the current to several
mA by just waiting for connection.
Posted by: Account Deleted | 02/05/2010 at 01:43 AM
Looking here: http://www.ifixit.com/Teardown/Kindle-2/624/1 You can see that the Kindle 2 still has the same 4 big pads for the serial
port under the gray bezel. So, it's doable. The problem is making room for the Bluetooth module somewhere. There -may- be room for it in
pretty much the same place I put it on the DX, if you cut out some of the white plastic.
Posted by: darron | 02/04/2010 at 11:33 AM
any way we can do this with the regular kindle 2?
Posted by: A Facebook User | 02/04/2010 at 11:14 AM
I found some additional info:
S2 is a mini pci-e slot, pinout at http://www.allpinouts.org/index.php/PCI_Express_Card_and_PCI_Express_Mini_Card (with USB! and
simcard pins).
There are a lot of WIFI cards for mini pci-e out there (notebooks) - so it's just to handle the driver and settings (and the antenna! :(
Good pictures of open DX can be found here:
http://www.rapidrepair.com/guides/kindle-dx/amazon-kindle-dx-disassembly-repair-guide.html
Posted by: kindx | 02/02/2010 at 05:56 PM
@darron: sorry - no the J3 is just for simcard, but when you read the specs of the UMTS modul it say's it has a USB 2.0, so there should be
USB pins on J2.
I think the simcard pins are connected to J2 too. So if the module doesn't support a sim they might be used for nothing.
But I would be pretty happy if I could exchange the sim to a local provider with cheap internet package and browse all the internet on my
international DX.
At the moment only amazon and wikipedia is allowed.
Posted by: kindx | 02/02/2010 at 03:16 PM
@kindx: So, the simcard socket is the USB2 connection? There are pads on the US DX for a sim card, but I wasn't brave enough to do too
much with it. I saw the SD card pads, even soldered on a connector I happened to have lying around... before I noticed all I/O pins on it are
shorted. There are probably resistors pulling them all to some common point to avoid floating some microcontroller inputs, since it's
unpopulated. I never removed the top of the box shield, so I didn't explore much further.
Posted by: darron | 02/02/2010 at 03:03 PM
Hi!
Congratulations, great work!
The international version of kindle dx has a anydata DTP-600W module (J2) for UMTS/GPRS/EGPRS and a simcard in a socket beside
(J3).
There is a USB2 on it - so there should be a WIFI solution too!
Did you mention the empty P1 connector, I'm pretty sure it's for SD-card.
Posted by: kindx | 02/02/2010 at 01:39 PM
Okay, thanks! I may try the scanning interval change. I saw that, but I didn't want any problems making a connection if I got it wrong. The
power usage is high enough to be worth figuring it out, though. The blink interval is new to me, so that's cool. I'll do that. I thought about
removing the power led, but it's really the disconnected state that is active 99% of the time.
Posted by: darron | 02/02/2010 at 08:26 AM
The comments to this entry are closed.
Not Nearly Enough Time
Powered by TypePad