Information
Resources
Categories
Inside the Amazon Kindle
Posted by Aki in Hardware at 09:47 | Sunday, December 2. 2007
By now you might have heard of the Amazon Kindle, the e-paper based reader, that allows wireless access to a vast library of electronic books from Amazon, and some selected blogs, newspapers, and such. There is even "experimental" access to the internet, though it's not very powerful, and is geared around static data only. I won't rehash more of the publicly available details on the unit, but give an inside peek at the guts of the unit.
One of the things that I noticed right away is the limited set of file formats that Kindle supports. Glaring omissions were the popular PDF format, and all forms of images, such as JPG and TIFF. Amazon provides a service that can be accessed for free and for fee, that converts image files to Kindle format. However, the service seems a bit slow, and requires the the file must be e-mailed to be converted.
To see what it can do, I used the service to convert several image files. The result was an image file that apparently had a maximum size and maximum resolution. An analysis of the files that were produced showed a header, followed by some HTML code, and then a binary image file. What appeared to be some closing bytes appeared at the end of the file.
With a hex file editor I cut&pasted the obvious header and footer, and placed them around some JPG files of my own. The resulting combinations did appear in Kindle as files, and were even partially viewable as images.
Kindle, however, seemed to refuse to display images above a certain size. While I did not determine the exact cut off point, it seemed to be somewhere around 64kB. An image larger than 64kB would only display correctly for information in the first 64kB. The remaining pixels were shown in a uniform pleasant gray.
I can't tell if the behavior is an intentional limitation in the Kindle software, a CPU-driven feature (e.g. 16-bit registers), or caused by memory constraints. I wanted to find out, hence I had no alternative to popping the covers on the unit.
The unit is relatively easy to open. There are 8 screws, all accessible without peeling labels. The corners of the plastic case have tabs with a very firm grip, but they will pop with an even pull on the side while pushing the top cover in the opposite direction. (Kids, if you have never done this before, or if you are worried about having a broken Kindle, don't try this at home.)
The interior of the unit was not exactly crowded. There is one main circuit board, with attachments for the keyboard, the displays, main power switches, scrolling mouse and the SD card adapter.
The AnyData DTEV-DUAL cellular modem is connected using a board-to-board connector, but its shell is permanently soldered to the main circuit board. It seems to have two antennas, one on the top, and one on the bottom right side of the unit.
The main microcontrollers are a Microchip PIC16LF874A, NXP ISP1761BF and Intel PXA255. The purpose of the PIC part is unknown, but a hunch based on its location is that it provides handling for the scroller and the keyboard. The NXP part is a USB-On-The-Go controller, which means that it can also function as a USB host, even though the Kindle only supports being a USB client device. The Intel part is an X-Scale ARM processor, which likely is the main processing unit for the Kindle.
Audio is handled by a Wolfson Microelectronics WM8971 Stereo codec that seems to be driven by another small PIC microcontroller marked "6282E/7270SH". The latter could also be memory or a voltage controller, but I had insufficient time to determine its type.
Memory on the unit is present in two Infineon 256 megabit Mobile-RAM parts, giving the PXA255 a total of 64 megabytes of RAM, accessible over a 32-bit bus. There are two Samsung K6F4016U6G chips that provide 1 megabyte of SRAM, accessible over a 32 bit bus, which are either working memory for the NXP part, or more likely video memory. Firmware is stored in a Spansion 512 megabyte boot-sector Flash, type S29AL004D90BFI01.
The display controller is the same as on the Sony electronic book series, a part marked "9322 571 0032 1 Apollo 1.18 T6TW8XBG-001".
The only part that remained a minor mystery is marked KFG2G16Q2M-DEB8 from Samsung. It is located next to two ADG3247 bus switches. It appears to be a 2 gigabit Flash part (256 megabytes). Its proximity to the bus switches might mean that these provide for sharing of the Flash between the NXP part when USB is connected to a PC, and the Intel PXA255 in the normal operating mode.
The last parts worthy of mention are a LM75A and a LTC3455. The LM75A measures temperature, and is likely used to avoid overheating the battery and the cellular modem. The LTC3455 provides battery power management, charging, and DC-DC conversion to change the variable voltage of the battery to a fixed voltage for the internal electronics.
Conclusions
Now that I know what's inside the unit, it's easier to say where limitations to functionality are intentional and where they are not.
First, there appears to be no good reason for this system to not handle large images. The CPU thinks in 32 bit, there is plenty of memory, and video output is not generated on the fly, but stored in SRAM. Hence, the limit is arbitrary.
This system should also easily be able to handle compressed and encrypted PDF files, making that limit arbitrary as well.
The USB-OTG controller is interesting, as it means that the unit might have future applications beyond what's apparent.
Hacking Opportunities
I'm not about to start hacking my Kindle, but it's apparent that serious hacking opportunities are present. The PXA255 is a common MCU, and its firmware comes from an external flash. The file system is likely on the other flash. And access to all is likely to be easy, since the board seems to have JTAG connectors and connection points for programming the various microcontrollers and memories. One of the connectors is even accessible while the case is closed, just by popping off a small access panel next to the battery.
If you end up hacking your Kindle, please let the world know what you find!
One of the things that I noticed right away is the limited set of file formats that Kindle supports. Glaring omissions were the popular PDF format, and all forms of images, such as JPG and TIFF. Amazon provides a service that can be accessed for free and for fee, that converts image files to Kindle format. However, the service seems a bit slow, and requires the the file must be e-mailed to be converted.
To see what it can do, I used the service to convert several image files. The result was an image file that apparently had a maximum size and maximum resolution. An analysis of the files that were produced showed a header, followed by some HTML code, and then a binary image file. What appeared to be some closing bytes appeared at the end of the file.
With a hex file editor I cut&pasted the obvious header and footer, and placed them around some JPG files of my own. The resulting combinations did appear in Kindle as files, and were even partially viewable as images.
Kindle, however, seemed to refuse to display images above a certain size. While I did not determine the exact cut off point, it seemed to be somewhere around 64kB. An image larger than 64kB would only display correctly for information in the first 64kB. The remaining pixels were shown in a uniform pleasant gray.
I can't tell if the behavior is an intentional limitation in the Kindle software, a CPU-driven feature (e.g. 16-bit registers), or caused by memory constraints. I wanted to find out, hence I had no alternative to popping the covers on the unit.
The unit is relatively easy to open. There are 8 screws, all accessible without peeling labels. The corners of the plastic case have tabs with a very firm grip, but they will pop with an even pull on the side while pushing the top cover in the opposite direction. (Kids, if you have never done this before, or if you are worried about having a broken Kindle, don't try this at home.)
The interior of the unit was not exactly crowded. There is one main circuit board, with attachments for the keyboard, the displays, main power switches, scrolling mouse and the SD card adapter.
The AnyData DTEV-DUAL cellular modem is connected using a board-to-board connector, but its shell is permanently soldered to the main circuit board. It seems to have two antennas, one on the top, and one on the bottom right side of the unit.
The main microcontrollers are a Microchip PIC16LF874A, NXP ISP1761BF and Intel PXA255. The purpose of the PIC part is unknown, but a hunch based on its location is that it provides handling for the scroller and the keyboard. The NXP part is a USB-On-The-Go controller, which means that it can also function as a USB host, even though the Kindle only supports being a USB client device. The Intel part is an X-Scale ARM processor, which likely is the main processing unit for the Kindle.
Audio is handled by a Wolfson Microelectronics WM8971 Stereo codec that seems to be driven by another small PIC microcontroller marked "6282E/7270SH". The latter could also be memory or a voltage controller, but I had insufficient time to determine its type.
Memory on the unit is present in two Infineon 256 megabit Mobile-RAM parts, giving the PXA255 a total of 64 megabytes of RAM, accessible over a 32-bit bus. There are two Samsung K6F4016U6G chips that provide 1 megabyte of SRAM, accessible over a 32 bit bus, which are either working memory for the NXP part, or more likely video memory. Firmware is stored in a Spansion 512 megabyte boot-sector Flash, type S29AL004D90BFI01.
The display controller is the same as on the Sony electronic book series, a part marked "9322 571 0032 1 Apollo 1.18 T6TW8XBG-001".
The only part that remained a minor mystery is marked KFG2G16Q2M-DEB8 from Samsung. It is located next to two ADG3247 bus switches. It appears to be a 2 gigabit Flash part (256 megabytes). Its proximity to the bus switches might mean that these provide for sharing of the Flash between the NXP part when USB is connected to a PC, and the Intel PXA255 in the normal operating mode.
The last parts worthy of mention are a LM75A and a LTC3455. The LM75A measures temperature, and is likely used to avoid overheating the battery and the cellular modem. The LTC3455 provides battery power management, charging, and DC-DC conversion to change the variable voltage of the battery to a fixed voltage for the internal electronics.
Conclusions
Now that I know what's inside the unit, it's easier to say where limitations to functionality are intentional and where they are not.
First, there appears to be no good reason for this system to not handle large images. The CPU thinks in 32 bit, there is plenty of memory, and video output is not generated on the fly, but stored in SRAM. Hence, the limit is arbitrary.
This system should also easily be able to handle compressed and encrypted PDF files, making that limit arbitrary as well.
The USB-OTG controller is interesting, as it means that the unit might have future applications beyond what's apparent.
Hacking Opportunities
I'm not about to start hacking my Kindle, but it's apparent that serious hacking opportunities are present. The PXA255 is a common MCU, and its firmware comes from an external flash. The file system is likely on the other flash. And access to all is likely to be easy, since the board seems to have JTAG connectors and connection points for programming the various microcontrollers and memories. One of the connectors is even accessible while the case is closed, just by popping off a small access panel next to the battery.
If you end up hacking your Kindle, please let the world know what you find!
Trackbacks
Trackback specific URI for this entry
No Trackbacks
Comments
Display comments as
(Linear | Threaded)
Does this appear to be sold as a money looser with the profit coming from sales of the books? Think razors, xbox, etc. I am guessing this is a very hard question to answer as the cost of the screen and R&D are unknown. It seems similar in complexity and capability to modern PDA phones or the iPhone. Some more photos of the entire device would be cool.
What other formats can it view? It claims word compatibility. Word can barely open word files so I would guess it has issues.
What other formats can it view? It claims word compatibility. Word can barely open word files so I would guess it has issues.
#1
on
2007-12-04 10:57
My gut states that the Kindle is sold at more than production cost, unless they don't know how to make these things, or haven't done a good job negotiating parts.
There are several inefficiencies in the design that could be used to drop the production cost further. For example, the NXP part functionality could be integrated into the PXA255, freeing up space to move some or all the parts on the reverse of the circuit board to the top, dropping process costs significantly. The SD card attachment can go onto the main PCB. The PIC microcontroller could be replaced with something cheaper, or integrated into the PXA255. The Flash memory should go from the custom Samsung to a standard type.
The R&D on this appears to have gone into the server side. The placement of buttons, the responsiveness of the keyboard (even in light of the slow display update), and other factors make me think that the device software is quite simple.
What I found surprising is the amount of air inside the case. With better placement and better choice of components the case could have been noticeably smaller.
As far as I can tell, it can only handle the Kindle-specific formats and plain text. Thus everything must be converted to Kindle using the email-based service. I doubt it would open word files, but perhaps the conversion takes them to the electronic book format or something.
There are several inefficiencies in the design that could be used to drop the production cost further. For example, the NXP part functionality could be integrated into the PXA255, freeing up space to move some or all the parts on the reverse of the circuit board to the top, dropping process costs significantly. The SD card attachment can go onto the main PCB. The PIC microcontroller could be replaced with something cheaper, or integrated into the PXA255. The Flash memory should go from the custom Samsung to a standard type.
The R&D on this appears to have gone into the server side. The placement of buttons, the responsiveness of the keyboard (even in light of the slow display update), and other factors make me think that the device software is quite simple.
What I found surprising is the amount of air inside the case. With better placement and better choice of components the case could have been noticeably smaller.
As far as I can tell, it can only handle the Kindle-specific formats and plain text. Thus everything must be converted to Kindle using the email-based service. I doubt it would open word files, but perhaps the conversion takes them to the electronic book format or something.
Hey Doc,
If you see any hacking out there will you post a link here for all to see? We are certainly interested to see if the EVDO can be wedged away from the kindle and used on other computers. Thoughts?
David
If you see any hacking out there will you post a link here for all to see? We are certainly interested to see if the EVDO can be wedged away from the kindle and used on other computers. Thoughts?
David
#3
on
2007-12-19 12:25
Did you try out converting any PDF or word documents? I'm curious to know if the images were converted into the Kindle AZW file format and if word / PDF are the same.
#4
on
2007-12-04 13:20
It seems crazy for them to sell it above production costs. How do you know how much it cost to develop and manufacture the screen, for example?
#5
on
2007-12-05 07:23
Fred, what I meant that they are making a profit on it. The screen is purchased from another company, the same on that also supplies to to several others. (The name escapes me this second.)
Perhaps their development effort was not as efficient as it could. Time permitting, I'm hoping to get to make comparisons to the guts in the Sony eBook Reader, as I believe it illustrates what efficient design is all about.
Perhaps their development effort was not as efficient as it could. Time permitting, I'm hoping to get to make comparisons to the guts in the Sony eBook Reader, as I believe it illustrates what efficient design is all about.
[...] Dr.Ã? Blip’s PC-Doctor has recently documented a step-by-step guide to disasssemble kindle, and inspected what’s inside the kindle.Ã? What led him to popping the covers on kindle is his obsevation that kindle do not display images above 64KB. Dr. Blip couldn’t be sure whether it’s an ‘intentional limitation in the kindle software, a a CPU-driven feature (e.g. 16-bit registers), or caused by memory constraints’.Ã? Ã? [...]
If you mean physically removing the EVDO, that shouldn't be too difficult, as the signal pins are on a board-to-board connector, and solder appears to only be on attachment points for the metallic shell of the EVDO board. The "API" for the EVDO board is published, and it seems to be sort of like an AT-command based modem.
But why would you do that? You'd have a broken Kindle and a modem that's not very different from ones you can buy separately for less than the cost of a Kindle. If you want to use the internet connection for other purposes on a "no-fee" basis, it might be possible, but it's also equally likely that there's a secret handshake between the Kindle software and the network service provider, in which case you are probably out of luck.
In any case, that type of hack would be outside of the spirit of hacking, in that you are trying to repurpose hardware to circumvent a commercially available service. The "ethical" hacking concept centers on making things do stuff they were not designed to do, and there is no alternative to achieve the same.
On the coolness meter, I'd very much like to see hacks for also running my own software on the Kindle. Auto-updating weather comes to mind. Some documentation lookup applications also. I'd happily pay for that flexibility, though as it appears that Amazon already made a profit on the unit when they sold it to me, I wouldn't expect it to be a big pile. It's also possible that Amazon wouldn't care, but their network provider does.
But why would you do that? You'd have a broken Kindle and a modem that's not very different from ones you can buy separately for less than the cost of a Kindle. If you want to use the internet connection for other purposes on a "no-fee" basis, it might be possible, but it's also equally likely that there's a secret handshake between the Kindle software and the network service provider, in which case you are probably out of luck.
In any case, that type of hack would be outside of the spirit of hacking, in that you are trying to repurpose hardware to circumvent a commercially available service. The "ethical" hacking concept centers on making things do stuff they were not designed to do, and there is no alternative to achieve the same.
On the coolness meter, I'd very much like to see hacks for also running my own software on the Kindle. Auto-updating weather comes to mind. Some documentation lookup applications also. I'd happily pay for that flexibility, though as it appears that Amazon already made a profit on the unit when they sold it to me, I wouldn't expect it to be a big pile. It's also possible that Amazon wouldn't care, but their network provider does.
The Kindle converted image format is a mobipocket container. The mobipocket format (which is basically the Palm database format) is record-based and limited to 64KB of data per record, so it's not surprising that your images were limited to 64KB. (What is surprising is that the rest of the file worked. Or did you only convert a single image?)
#11
on
2008-01-03 20:41
Here's an article discussing an in-depth reverse engineering project on the Kindle, which revealed some interesting hidden features including minesweeper (the game), location technology, and more.
http://crave.cnet.com/8301-1_105-9838934-1.html?tag=nl.e501
http://crave.cnet.com/8301-1_105-9838934-1.html?tag=nl.e501
I think the second Microchip part is really a rail-to-rail op amp. Here's the datasheet showing similar markings on page 17.
#13
on
2008-01-04 12:10
That makes sense now that I look at the part, too. The traces to the legs are wider than most of the signal traces, which implies that they are intended to carry more current. It's most likely the MCP6282E op amp. Thanks for locating it.
[...] Dr. Blip’s blog has a lot of close-up shots of the Kindle. [...]
Only registered users may post comments here. Get your own account here and then log into this blog. Your browser must support cookies.
© 2008 PC-Doctor, Inc. ALL RIGHTS RESERVED.
Quicksearch
Polls
Did you buy an iPhone 3G?
Archives
Archives