I got an Amazon Kindle DX for XMas. I wanted one mostly for viewing device datasheets (PDF).

I should say I do like the Kindle, and I will keep it (anyway there's no choice now). However, the PDF viewer is very disappointing.

Really, that disappointment is mostly for one reason: No table of contents! I don't know who uses PDFs without TOC... it's terrible! In the past, I've passed up ICs in the chip selection process for products/projects solely because they had datasheets without TOCs.

So, Amazon... no TOC support? Seriously?

Anyway... I decided to start hacking on it and see what happened. I found a great forum at MobileRead, with exactly what I was looking for. (thanks, Jyavenard) It's a hack that more or less re-enabled a leftover QA test mode on the Kindle, and ultimately let me telnet into a shell on the Kindle over USB.

However, I started to get concerned about bricking it. What's the first thing you should do when worrying about damaging your new toy? Take it apart, of course! :)



The little gray bezel was the hardest part. Once I figured out how to get that off the Kindle DX, the rest was quick work with a screwdriver.(Although it really was a ridiculous number of screws... did I mention I lost one?)

I should pause here to note that this is about the point my wife walked in. Case off, screws and bezel lying to the side, hunched over it with a voltmeter... *sigh*

So, what to do? Well, the point of opening it was really just to get to the one known serial port that gives you bootloader, recovery, and Linux console access. Basically, what this guy did.

However, I didn't want holes in my kindle or wires hanging around. So, what about that nice little Bluetooth module I just finished playing with as a slave device for my Nokia phone? You know, SparkFun's Bluetooth Mate? It converts any TTL-level RS232 serial interface into a Bluetooth connection.

Great stuff, eh?

First things first... space needed to be made for it. Since I wanted easy access to it (eventually I need some way to turn it on and off) I chose to put it just under the gray bezel.

You can see the paper and tape I added to cover some unpopulated resistor pads. The Kindle DX does NOT appear to be conformal coated at all, so all these pads are potential shorting points! The internal cover needed cutting out to fit over the Bluetooth module:





So, how does it fit?





You can see the wires I routed to it. The three large pads in the middle of the Kindle are GND, RX, and TX. The Bluetooth Mate has an internal 3.3V regulator. The fourth pad is probably power, but it reads 2.8V. I could bypass the Bluetooth Mate's regulator, but the Roving Networks module on it wants 3-3.6V. I found about 4V (battery voltage) on one side of the wakeup switch. So, I passed that in to the Bluetooth Mate's voltage regulator. However, the Bluetooth Mate does voltage translation back up to the input voltage, and I didn't want the 4V going to the serial port, when it's IO lines seem to idle at 2.8V. So, I modified the Bluetooth Mate to pull TX up to the regulated 3.3V rail instead of the 4V input. This is probably very important. I don't know what kind of voltage the serial port can handle, but 4V is very likely too much.

With the gray bezel back on it looks completely untouched.

I created a new user 'ppp' on the Kindle, and set it up to launch pppd on login. Getting ppp to work took some fiddling, but I eventually got it right. I ended up putting my own compile of a ssh server on it, created a ssh key, and voila!

I can now connect via Bluetooth, and I have a wireless network connection to my Kindle DX!



Now hacking on it is easier than ever.

Note: The Bluetooth module unconnected must always listen for connections. So, it's drawing 20-30 mA of power at all times. (It is counter-intuitively using less power when it's connected, since the module and your PC can agree on when to wake up to talk) It turns out that this idle current may be more than double what the Kindle DX uses on it's own (when idle), so I'm dramatically shortening the battery life. However, it's still about four days... down from over a week or two. I may address that issue later.