diff --git a/thirdparty/dropbear/CMakeLists.txt b/thirdparty/dropbear/CMakeLists.txt
index ffb7ec281..4b0c9b18f 100644
--- a/thirdparty/dropbear/CMakeLists.txt
+++ b/thirdparty/dropbear/CMakeLists.txt
@@ -1,22 +1,46 @@
+# This is pretty much platform-specific... Hard-coded paths and all that...
+if(CERVANTES)
+    set(PLATFORM_KOREADER_DIR "/mnt/private/koreader")
+elseif(KINDLE)
+    set(PLATFORM_KOREADER_DIR "/mnt/us/koreader")
+elseif(KOBO)
+    set(PLATFORM_KOREADER_DIR "/mnt/onboard/.adds/koreader")
+elseif(POCKETBOOK)
+    set(PLATFORM_KOREADER_DIR "/mnt/ext1/applications/koreader")
+else()
+    set(PLATFORM_KOREADER_DIR)
+endif()
+
+# Increase the number for higher verbosity.
+set(DEBUG_TRACE 1)
+set(DROPBEAR_DEFPORT "2222")
+set(DROPBEAR_SMALL_CODE TRUE)
+set(DROPBEAR_X11FWD TRUE)
+set(INETD_MODE FALSE)
+# NOTE: Consider enabling this to debug our crazy scp/sftp hack...
+set(LOG_COMMANDS FALSE)
+# Paths.
+set(DEFAULT_PATH "/sbin:/usr/sbin:/bin:/usr/bin")
+set(DROPBEAR_PIDFILE "settings/SSH/dropbear.pid")
+if(PLATFORM_KOREADER_DIR)
+    set(DBSCP_PATH ${PLATFORM_KOREADER_DIR})
+    set(SFTPSERVER_PATH "${PLATFORM_KOREADER_DIR}/sftp-server")
+endif()
+# Keys.
+set(DSS_PRIV_FILENAME "settings/SSH/dropbear_dss_host_key")
+set(RSA_PRIV_FILENAME "settings/SSH/dropbear_rsa_host_key")
+set(ECDSA_PRIV_FILENAME "settings/SSH/dropbear_ecdsa_host_key")
+
+configure_file(localoptions.h.cmake ${CMAKE_CURRENT_BINARY_DIR}/localoptions.h ESCAPE_QUOTES)
+set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/localoptions.h)
+
 list(APPEND PATCH_FILES
-    dropbear-2018.76-kindle-nopasswd-hack.patch
-    dropbear-2018.76-kindle-pubkey-hack.patch
-    dropbear-2018.76-kindle-pubkey-gen-hack.patch
-    dropbear-2018.76-kindle-nochdir-hack.patch
-    dropbear-2018.76-kindle-options-hack.patch
-    dropbear-2018.76-upstream-fixes.patch
+    dbscp-path.patch
+    nochdir-hack.patch
+    nopasswd-hack.patch
+    pubkey-hack.patch
     reduce_build_verbosity.patch
 )
-# This is pretty much platform-specific... Hard-coded paths and all that...
-foreach(PLATFORM CERVANTES KINDLE KOBO POCKETBOOK)
-    if(${PLATFORM})
-        string(TOLOWER ${PLATFORM} PLATFORM)
-        list(APPEND PATCH_FILES dropbear-2018.76-scp-command-hack-${PLATFORM}.patch)
-        break()
-    endif()
-endforeach()
-
-list(APPEND PATCH_CMD COMMAND autoreconf -v)
 
 if(ANDROID)
     set(LIBS -static)
@@ -36,17 +60,18 @@ list(APPEND CFG_CMD
     --enable-zlib
     --with-zlib=${STAGING_DIR}
 )
+list(APPEND CFG_CMD COMMAND ${CMAKE_COMMAND} -E create_symlink ${CMAKE_CURRENT_BINARY_DIR}/localoptions.h localoptions.h)
 
 list(APPEND BUILD_CMD COMMAND make strip PROGRAMS=dropbear)
 
 append_binary_install_command(INSTALL_CMD dropbear)
 
 external_project(
-    DOWNLOAD URL c3912f7fcdcc57c99937e4a79480d2c2
-    http://deb.debian.org/debian/pool/main/d/dropbear/dropbear_2018.76.orig.tar.bz2
+    DOWNLOAD URL d4b107f6fd103bc2c6ed7226bbae69b2
+    https://github.com/mkj/dropbear/archive/refs/tags/DROPBEAR_2024.85.tar.gz
     PATCH_FILES ${PATCH_FILES}
-    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CFG_CMD}
+    BUILD_DEPENDS ${CMAKE_CURRENT_BINARY_DIR}/localoptions.h
     BUILD_COMMAND ${BUILD_CMD}
     INSTALL_COMMAND ${INSTALL_CMD}
 )
diff --git a/thirdparty/dropbear/dbscp-path.patch b/thirdparty/dropbear/dbscp-path.patch
new file mode 100644
index 000000000..13ca82401
--- /dev/null
+++ b/thirdparty/dropbear/dbscp-path.patch
@@ -0,0 +1,20 @@
+--- i/src/svr-chansession.c
++++ w/src/svr-chansession.c
+@@ -681,6 +681,17 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
+ 				TRACE(("leave sessioncommand, command too long %d", cmdlen))
+ 				return DROPBEAR_FAILURE;
+ 			}
++
++#ifdef DBSCP_PATH
++			// HACK. This is terrible. Truly, truly awful.
++			if (strncmp(chansess->cmd, "scp", 3) == 0) {
++				char* mangled_cmd = m_malloc(cmdlen + sizeof(DBSCP_PATH));
++				snprintf(mangled_cmd, cmdlen + sizeof(DBSCP_PATH) + 1, "%s/%s", DBSCP_PATH, chansess->cmd);
++				m_free(chansess->cmd);
++				chansess->cmd = m_strdup(mangled_cmd);
++				m_free(mangled_cmd);
++			}
++#endif
+ 		}
+ 		if (issubsys) {
+ #if DROPBEAR_SFTPSERVER
diff --git a/thirdparty/dropbear/dropbear-2018.76-kindle-nopasswd-hack.patch b/thirdparty/dropbear/dropbear-2018.76-kindle-nopasswd-hack.patch
deleted file mode 100644
index 039e00b9b..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-kindle-nopasswd-hack.patch
+++ /dev/null
@@ -1,149 +0,0 @@
-diff --git a/runopts.h b/runopts.h
-index 3123383..1bf4f1d 100644
---- a/runopts.h
-+++ b/runopts.h
-@@ -122,6 +122,7 @@ typedef struct svr_runopts {
- 
- 	buffer * banner;
- 	char * pidfile;
-+	int nopasschk;
- 
- 	char * forced_command;
- 
-diff --git a/svr-authpasswd.c b/svr-authpasswd.c
-index bdee2aa..d5fb2cf 100644
---- a/svr-authpasswd.c
-+++ b/svr-authpasswd.c
-@@ -79,35 +79,74 @@ void svr_auth_password() {
- 	m_burn(password, passwordlen);
- 	m_free(password);
- 
--	if (testcrypt == NULL) {
--		/* crypt() with an invalid salt like "!!" */
--		dropbear_log(LOG_WARNING, "User account '%s' is locked",
--				ses.authstate.pw_name);
--		send_msg_userauth_failure(0, 1);
--		return;
--	}
--
--	/* check for empty password */
--	if (passwdcrypt[0] == '\0') {
--		dropbear_log(LOG_WARNING, "User '%s' has blank password, rejected",
--				ses.authstate.pw_name);
--		send_msg_userauth_failure(0, 1);
--		return;
--	}
--
--	if (constant_time_strcmp(testcrypt, passwdcrypt) == 0) {
--		/* successful authentication */
--		dropbear_log(LOG_NOTICE, 
--				"Password auth succeeded for '%s' from %s",
--				ses.authstate.pw_name,
--				svr_ses.addrstring);
--		send_msg_userauth_success();
-+	/*
-+	 * Hack. Always auth successfully if we were launched with the -n flag, or if we're connecting from localhost.
-+	 * Keep the granularity of checks instead of just sending a successful auth for posterity/logging ;).
-+	 */
-+	if (svr_opts.nopasschk || strncmp(svr_ses.addrstring, "127.0.0.1", 9) == 0) {
-+		if (testcrypt == NULL) {
-+			/* crypt() with an invalid salt like "!!" */
-+			dropbear_log(LOG_WARNING, "User account '%s' is locked (But we're letting you in, as configured ;))",
-+					ses.authstate.pw_name);
-+			send_msg_userauth_success();
-+			/* Keep the return to avoid potentially blowing up later? */
-+			return;
-+		}
-+
-+		/* check for empty password */
-+		if (passwdcrypt[0] == '\0') {
-+			dropbear_log(LOG_WARNING, "User '%s' has blank password, but we're letting you in, as configured ;)",
-+					ses.authstate.pw_name);
-+			send_msg_userauth_success();
-+			/* Ditto */
-+			return;
-+		}
-+
-+		if (constant_time_strcmp(testcrypt, passwdcrypt) == 0) {
-+			/* successful authentication */
-+			dropbear_log(LOG_NOTICE,
-+					"Password auth succeeded for '%s' from %s",
-+					ses.authstate.pw_name,
-+					svr_ses.addrstring);
-+			send_msg_userauth_success();
-+		} else {
-+			dropbear_log(LOG_WARNING,
-+					"Bad password attempt for '%s' from %s (But we're letting you in, as configured ;))",
-+					ses.authstate.pw_name,
-+					svr_ses.addrstring);
-+			send_msg_userauth_success();
-+		}
- 	} else {
--		dropbear_log(LOG_WARNING,
--				"Bad password attempt for '%s' from %s",
--				ses.authstate.pw_name,
--				svr_ses.addrstring);
--		send_msg_userauth_failure(0, 1);
-+		if (testcrypt == NULL) {
-+			/* crypt() with an invalid salt like "!!" */
-+			dropbear_log(LOG_WARNING, "User account '%s' is locked",
-+					ses.authstate.pw_name);
-+			send_msg_userauth_failure(0, 1);
-+			return;
-+		}
-+
-+		/* check for empty password */
-+		if (passwdcrypt[0] == '\0') {
-+			dropbear_log(LOG_WARNING, "User '%s' has blank password, rejected",
-+					ses.authstate.pw_name);
-+			send_msg_userauth_failure(0, 1);
-+			return;
-+		}
-+
-+		if (constant_time_strcmp(testcrypt, passwdcrypt) == 0) {
-+			/* successful authentication */
-+			dropbear_log(LOG_NOTICE,
-+					"Password auth succeeded for '%s' from %s",
-+					ses.authstate.pw_name,
-+					svr_ses.addrstring);
-+			send_msg_userauth_success();
-+		} else {
-+			dropbear_log(LOG_WARNING,
-+					"Bad password attempt for '%s' from %s",
-+					ses.authstate.pw_name,
-+					svr_ses.addrstring);
-+			send_msg_userauth_failure(0, 1);
-+		}
- 	}
- }
- 
-diff --git a/svr-runopts.c b/svr-runopts.c
-index fe83e02..69079b5 100644
---- a/svr-runopts.c
-+++ b/svr-runopts.c
-@@ -93,6 +93,7 @@ static void printhelp(const char * progname) {
- 					"		(default port is %s if none specified)\n"
- 					"-P PidFile	Create pid file PidFile\n"
- 					"		(default %s)\n"
-+					"-n             Disable password checking (/!\\ Hack, don't use this!)\n"
- #if INETD_MODE
- 					"-i		Start for inetd\n"
- #endif
-@@ -150,6 +151,7 @@ void svr_getopts(int argc, char ** argv) {
- 	svr_opts.hostkey = NULL;
- 	svr_opts.delay_hostkey = 0;
- 	svr_opts.pidfile = DROPBEAR_PIDFILE;
-+	svr_opts.nopasschk = 0;
- #if DROPBEAR_SVR_LOCALTCPFWD
- 	svr_opts.nolocaltcp = 0;
- #endif
-@@ -230,6 +232,9 @@ void svr_getopts(int argc, char ** argv) {
- 				case 'P':
- 					next = &svr_opts.pidfile;
- 					break;
-+				case 'n':
-+					svr_opts.nopasschk = 1;
-+					break;
- #if DO_MOTD
- 				/* motd is displayed by default, -m turns it off */
- 				case 'm':
diff --git a/thirdparty/dropbear/dropbear-2018.76-kindle-options-hack.patch b/thirdparty/dropbear/dropbear-2018.76-kindle-options-hack.patch
deleted file mode 100644
index 5143b5770..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-kindle-options-hack.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-diff --git a/default_options.h b/default_options.h
-index 3b75eb8..1b3588d 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -19,9 +19,9 @@ IMPORTANT: Some options will require "make clean" after changes */
- #define DROPBEAR_DEFADDRESS ""
- 
- /* Default hostkey paths - these can be specified on the command line */
--#define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
--#define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
--#define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
-+#define DSS_PRIV_FILENAME "settings/SSH/dropbear_dss_host_key"
-+#define RSA_PRIV_FILENAME "settings/SSH/dropbear_rsa_host_key"
-+#define ECDSA_PRIV_FILENAME "settings/SSH/dropbear_ecdsa_host_key"
- 
- /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
-  * on chosen ports and keeps accepting connections. This is the default.
-@@ -44,10 +44,10 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * several kB in binary size however will make the symmetrical ciphers and hashes
-  * slower, perhaps by 50%. Recommended for small systems that aren't doing
-  * much traffic. */
--#define DROPBEAR_SMALL_CODE 1
-+#define DROPBEAR_SMALL_CODE 0
- 
- /* Enable X11 Forwarding - server only */
--#define DROPBEAR_X11FWD 1
-+#define DROPBEAR_X11FWD 0
- 
- /* Enable TCP Fowarding */
- /* 'Local' is "-L" style (client listening port forwarded via server)
-@@ -239,7 +239,7 @@ Homedir is prepended unless path begins with / */
- 
- /* The default file to store the daemon's process ID, for shutdown
-    scripts etc. This can be overridden with the -P flag */
--#define DROPBEAR_PIDFILE "/var/run/dropbear.pid"
-+#define DROPBEAR_PIDFILE "settings/SSH/dropbear.pid"
- 
- /* The command to invoke for xauth when using X11 forwarding.
-  * "-q" for quiet */
-@@ -290,6 +290,6 @@ be overridden at runtime with -I. 0 disables idle timeouts */
- #define DEFAULT_IDLE_TIMEOUT 0
- 
- /* The default path. This will often get replaced by the shell */
--#define DEFAULT_PATH "/usr/bin:/bin"
-+#define DEFAULT_PATH "/sbin:/usr/sbin:/bin:/usr/bin"
- 
- #endif /* DROPBEAR_DEFAULT_OPTIONS_H_ */
diff --git a/thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-gen-hack.patch b/thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-gen-hack.patch
deleted file mode 100644
index c335d2912..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-gen-hack.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/gensignkey.c b/gensignkey.c
-index 8317fea..7c212ce 100644
---- a/gensignkey.c
-+++ b/gensignkey.c
-@@ -140,16 +140,13 @@ int signkey_generate(enum signkey_type keytype, int bits, const char* filename,
- 		goto out;
- 	}
- 
--	if (link(fn_temp, filename) < 0) {
--		/* If generating keys on connection (skipexist) it's OK to get EEXIST 
--		- we probably just lost a race with another connection to generate the key */
--		if (!(skip_exist && errno == EEXIST)) {
--			dropbear_log(LOG_ERR, "Failed moving key file to %s: %s", filename,
--				strerror(errno));
--			/* XXX fallback to non-atomic copy for some filesystems? */
--			ret = DROPBEAR_FAILURE;
--			goto out;
--		}
-+	/* Hack. We can't do hardlinks on vfat, so just use rename */
-+	if (skip_exist && access(filename, F_OK) == 0) {
-+		/* Ok. */
-+	} else if (rename(fn_temp, filename) < 0) {
-+		dropbear_log(LOG_ERR, "Failed moving key file to %s: %s", filename,
-+		strerror(errno));
-+		ret = DROPBEAR_FAILURE;
- 	}
- 
- out:
diff --git a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-cervantes.patch b/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-cervantes.patch
deleted file mode 100644
index 492d59ab0..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-cervantes.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-diff --git a/default_options.h b/default_options.h
-index 7d28085..c1a14ef 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -13,7 +13,7 @@ Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
- 
- IMPORTANT: Some options will require "make clean" after changes */
- 
--#define DROPBEAR_DEFPORT "22"
-+#define DROPBEAR_DEFPORT "2222"
- 
- /* Listen on all interfaces */
- #define DROPBEAR_DEFADDRESS ""
-@@ -34,7 +34,7 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * Both of these flags can be defined at once, don't compile without at least
-  * one of them. */
- #define NON_INETD_MODE 1
--#define INETD_MODE 1
-+#define INETD_MODE 0
- 
- /* Include verbose debug output, enabled with -v at runtime. 
-  * This will add a reasonable amount to your executable size. */
-@@ -250,7 +250,10 @@ Homedir is prepended unless path begins with / */
-  * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER. 
-  * The sftp-server program is not provided by Dropbear itself */
- #define DROPBEAR_SFTPSERVER 1
--#define SFTPSERVER_PATH "/usr/libexec/sftp-server"
-+#define SFTPSERVER_PATH "/mnt/private/koreader/sftp-server"
-+
-+// Hack! Absolute path, no trailing slash...
-+#define DBSCP_PATH "/mnt/private/koreader"
- 
- /* This is used by the scp binary when used as a client binary. If you're
-  * not using the Dropbear client, you'll need to change it */
-@@ -259,6 +262,7 @@ Homedir is prepended unless path begins with / */
- /* Whether to log commands executed by a client. This only logs the 
-  * (single) command sent to the server, not what a user did in a 
-  * shell/sftp session etc. */
-+// NOTE: Consider setting this to 1 to debug our crazy scp/sftp hack...
- #define LOG_COMMANDS 0
- 
- /* Window size limits. These tend to be a trade-off between memory
-diff --git a/svr-chansession.c b/svr-chansession.c
-index faf62e5..08f3ca3 100644
---- a/svr-chansession.c
-+++ b/svr-chansession.c
-@@ -661,6 +661,15 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
- 				/* TODO - send error - too long ? */
- 				return DROPBEAR_FAILURE;
- 			}
-+
-+			// HACK. This is terrible. Truly, truly awful.
-+			if (strncmp(chansess->cmd, "scp", 3) == 0) {
-+				char* mangled_cmd = m_malloc(cmdlen + sizeof(DBSCP_PATH));
-+				snprintf(mangled_cmd, cmdlen + sizeof(DBSCP_PATH) + 1, "%s/%s", DBSCP_PATH, chansess->cmd);
-+				m_free(chansess->cmd);
-+				chansess->cmd = m_strdup(mangled_cmd);
-+				m_free(mangled_cmd);
-+			}
- 		}
- 		if (issubsys) {
- #if DROPBEAR_SFTPSERVER
diff --git a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kindle.patch b/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kindle.patch
deleted file mode 100644
index 90105c397..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kindle.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-diff --git a/default_options.h b/default_options.h
-index 7d28085..c1a14ef 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -13,7 +13,7 @@ Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
- 
- IMPORTANT: Some options will require "make clean" after changes */
- 
--#define DROPBEAR_DEFPORT "22"
-+#define DROPBEAR_DEFPORT "2222"
- 
- /* Listen on all interfaces */
- #define DROPBEAR_DEFADDRESS ""
-@@ -34,7 +34,7 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * Both of these flags can be defined at once, don't compile without at least
-  * one of them. */
- #define NON_INETD_MODE 1
--#define INETD_MODE 1
-+#define INETD_MODE 0
- 
- /* Include verbose debug output, enabled with -v at runtime. 
-  * This will add a reasonable amount to your executable size. */
-@@ -250,7 +250,10 @@ Homedir is prepended unless path begins with / */
-  * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER. 
-  * The sftp-server program is not provided by Dropbear itself */
- #define DROPBEAR_SFTPSERVER 1
--#define SFTPSERVER_PATH "/usr/libexec/sftp-server"
-+#define SFTPSERVER_PATH "/mnt/us/koreader/sftp-server"
-+
-+// Hack! Absolute path, no trailing slash...
-+#define DBSCP_PATH "/mnt/us/koreader"
- 
- /* This is used by the scp binary when used as a client binary. If you're
-  * not using the Dropbear client, you'll need to change it */
-@@ -259,6 +262,7 @@ Homedir is prepended unless path begins with / */
- /* Whether to log commands executed by a client. This only logs the 
-  * (single) command sent to the server, not what a user did in a 
-  * shell/sftp session etc. */
-+// NOTE: Consider setting this to 1 to debug our crazy scp/sftp hack...
- #define LOG_COMMANDS 0
- 
- /* Window size limits. These tend to be a trade-off between memory
-diff --git a/svr-chansession.c b/svr-chansession.c
-index faf62e5..08f3ca3 100644
---- a/svr-chansession.c
-+++ b/svr-chansession.c
-@@ -661,6 +661,15 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
- 				/* TODO - send error - too long ? */
- 				return DROPBEAR_FAILURE;
- 			}
-+
-+			// HACK. This is terrible. Truly, truly awful.
-+			if (strncmp(chansess->cmd, "scp", 3) == 0) {
-+				char* mangled_cmd = m_malloc(cmdlen + sizeof(DBSCP_PATH));
-+				snprintf(mangled_cmd, cmdlen + sizeof(DBSCP_PATH) + 1, "%s/%s", DBSCP_PATH, chansess->cmd);
-+				m_free(chansess->cmd);
-+				chansess->cmd = m_strdup(mangled_cmd);
-+				m_free(mangled_cmd);
-+			}
- 		}
- 		if (issubsys) {
- #if DROPBEAR_SFTPSERVER
diff --git a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kobo.patch b/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kobo.patch
deleted file mode 100644
index ab0d0e8a6..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-kobo.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-diff --git a/default_options.h b/default_options.h
-index 7d28085..c1a14ef 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -13,7 +13,7 @@ Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
- 
- IMPORTANT: Some options will require "make clean" after changes */
- 
--#define DROPBEAR_DEFPORT "22"
-+#define DROPBEAR_DEFPORT "2222"
- 
- /* Listen on all interfaces */
- #define DROPBEAR_DEFADDRESS ""
-@@ -34,7 +34,7 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * Both of these flags can be defined at once, don't compile without at least
-  * one of them. */
- #define NON_INETD_MODE 1
--#define INETD_MODE 1
-+#define INETD_MODE 0
- 
- /* Include verbose debug output, enabled with -v at runtime. 
-  * This will add a reasonable amount to your executable size. */
-@@ -250,7 +250,10 @@ Homedir is prepended unless path begins with / */
-  * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER. 
-  * The sftp-server program is not provided by Dropbear itself */
- #define DROPBEAR_SFTPSERVER 1
--#define SFTPSERVER_PATH "/usr/libexec/sftp-server"
-+#define SFTPSERVER_PATH "/mnt/onboard/.adds/koreader/sftp-server"
-+
-+// Hack! Absolute path, no trailing slash...
-+#define DBSCP_PATH "/mnt/onboard/.adds/koreader"
- 
- /* This is used by the scp binary when used as a client binary. If you're
-  * not using the Dropbear client, you'll need to change it */
-@@ -259,6 +262,7 @@ Homedir is prepended unless path begins with / */
- /* Whether to log commands executed by a client. This only logs the 
-  * (single) command sent to the server, not what a user did in a 
-  * shell/sftp session etc. */
-+// NOTE: Consider setting this to 1 to debug our crazy scp/sftp hack...
- #define LOG_COMMANDS 0
- 
- /* Window size limits. These tend to be a trade-off between memory
-diff --git a/svr-chansession.c b/svr-chansession.c
-index faf62e5..08f3ca3 100644
---- a/svr-chansession.c
-+++ b/svr-chansession.c
-@@ -661,6 +661,15 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
- 				/* TODO - send error - too long ? */
- 				return DROPBEAR_FAILURE;
- 			}
-+
-+			// HACK. This is terrible. Truly, truly awful.
-+			if (strncmp(chansess->cmd, "scp", 3) == 0) {
-+				char* mangled_cmd = m_malloc(cmdlen + sizeof(DBSCP_PATH));
-+				snprintf(mangled_cmd, cmdlen + sizeof(DBSCP_PATH) + 1, "%s/%s", DBSCP_PATH, chansess->cmd);
-+				m_free(chansess->cmd);
-+				chansess->cmd = m_strdup(mangled_cmd);
-+				m_free(mangled_cmd);
-+			}
- 		}
- 		if (issubsys) {
- #if DROPBEAR_SFTPSERVER
diff --git a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-pocketbook.patch b/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-pocketbook.patch
deleted file mode 100644
index 72d1515c2..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-scp-command-hack-pocketbook.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-diff --git a/default_options.h b/default_options.h
-index 7d28085..c1a14ef 100644
---- a/default_options.h
-+++ b/default_options.h
-@@ -13,7 +13,7 @@ Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS
- 
- IMPORTANT: Some options will require "make clean" after changes */
- 
--#define DROPBEAR_DEFPORT "22"
-+#define DROPBEAR_DEFPORT "2222"
- 
- /* Listen on all interfaces */
- #define DROPBEAR_DEFADDRESS ""
-@@ -34,7 +34,7 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * Both of these flags can be defined at once, don't compile without at least
-  * one of them. */
- #define NON_INETD_MODE 1
--#define INETD_MODE 1
-+#define INETD_MODE 0
- 
- /* Include verbose debug output, enabled with -v at runtime. 
-  * This will add a reasonable amount to your executable size. */
-@@ -250,7 +250,10 @@ Homedir is prepended unless path begins with / */
-  * OpenSSH), set the path below and set DROPBEAR_SFTPSERVER. 
-  * The sftp-server program is not provided by Dropbear itself */
- #define DROPBEAR_SFTPSERVER 1
--#define SFTPSERVER_PATH "/usr/libexec/sftp-server"
-+#define SFTPSERVER_PATH "/mnt/ext1/applications/koreader/sftp-server"
-+
-+// Hack! Absolute path, no trailing slash...
-+#define DBSCP_PATH "/mnt/ext1/applications/koreader"
- 
- /* This is used by the scp binary when used as a client binary. If you're
-  * not using the Dropbear client, you'll need to change it */
-@@ -259,6 +262,7 @@ Homedir is prepended unless path begins with / */
- /* Whether to log commands executed by a client. This only logs the 
-  * (single) command sent to the server, not what a user did in a 
-  * shell/sftp session etc. */
-+// NOTE: Consider setting this to 1 to debug our crazy scp/sftp hack...
- #define LOG_COMMANDS 0
- 
- /* Window size limits. These tend to be a trade-off between memory
-diff --git a/svr-chansession.c b/svr-chansession.c
-index faf62e5..08f3ca3 100644
---- a/svr-chansession.c
-+++ b/svr-chansession.c
-@@ -661,6 +661,15 @@ static int sessioncommand(struct Channel *channel, struct ChanSess *chansess,
- 				/* TODO - send error - too long ? */
- 				return DROPBEAR_FAILURE;
- 			}
-+
-+			// HACK. This is terrible. Truly, truly awful.
-+			if (strncmp(chansess->cmd, "scp", 3) == 0) {
-+				char* mangled_cmd = m_malloc(cmdlen + sizeof(DBSCP_PATH));
-+				snprintf(mangled_cmd, cmdlen + sizeof(DBSCP_PATH) + 1, "%s/%s", DBSCP_PATH, chansess->cmd);
-+				m_free(chansess->cmd);
-+				chansess->cmd = m_strdup(mangled_cmd);
-+				m_free(mangled_cmd);
-+			}
- 		}
- 		if (issubsys) {
- #if DROPBEAR_SFTPSERVER
diff --git a/thirdparty/dropbear/dropbear-2018.76-upstream-fixes.patch b/thirdparty/dropbear/dropbear-2018.76-upstream-fixes.patch
deleted file mode 100644
index 6ac75f855..000000000
--- a/thirdparty/dropbear/dropbear-2018.76-upstream-fixes.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 8d0b48f16550c9bf3693b2fa683f21e8276b1b1a Mon Sep 17 00:00:00 2001
-From: Matt Johnston <matt@ucc.asn.au>
-Date: Sat, 3 Mar 2018 10:10:16 +0800
-Subject: [PATCH] Fix CFLAGS for configure
-
----
- configure.ac | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 6621120a..d1b26027 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -15,6 +15,7 @@ if test -s "`which hg`" && test -d "$srcdir/.hg"; then
- 	AC_MSG_NOTICE([Source directory Mercurial base revision $hgrev])
- fi
- 
-+ORIGCFLAGS="$CFLAGS"
- # Checks for programs.
- AC_PROG_CC
- 
-@@ -35,7 +36,7 @@ AC_DEFUN(DB_TRYADDCFLAGS,
- }])
- 
- # set compile flags prior to other tests
--if test -z "$OLDCFLAGS" && test "$GCC" = "yes"; then
-+if test -z "$ORIGCFLAGS" && test "$GCC" = "yes"; then
- 	AC_MSG_NOTICE(No \$CFLAGS set... using "-Os -W -Wall" for GCC)
- 	CFLAGS="-Os -W -Wall"
- fi
diff --git a/thirdparty/dropbear/localoptions.h.cmake b/thirdparty/dropbear/localoptions.h.cmake
new file mode 100644
index 000000000..0a2baa29d
--- /dev/null
+++ b/thirdparty/dropbear/localoptions.h.cmake
@@ -0,0 +1,15 @@
+#cmakedefine DEBUG_TRACE @DEBUG_TRACE@
+#cmakedefine DROPBEAR_DEFPORT "@DROPBEAR_DEFPORT@"
+#cmakedefine01 DROPBEAR_SMALL_CODE
+#cmakedefine01 DROPBEAR_X11FWD
+#cmakedefine01 INETD_MODE
+#cmakedefine01 LOG_COMMANDS
+// Paths.
+#cmakedefine DBSCP_PATH       "@DBSCP_PATH@"
+#cmakedefine DEFAULT_PATH     "@DEFAULT_PATH@"
+#cmakedefine DROPBEAR_PIDFILE "@DROPBEAR_PIDFILE@"
+#cmakedefine SFTPSERVER_PATH  "@SFTPSERVER_PATH@"
+// Keys.
+#cmakedefine DSS_PRIV_FILENAME   "@DSS_PRIV_FILENAME@"
+#cmakedefine RSA_PRIV_FILENAME   "@RSA_PRIV_FILENAME@"
+#cmakedefine ECDSA_PRIV_FILENAME "@ECDSA_PRIV_FILENAME@"
diff --git a/thirdparty/dropbear/dropbear-2018.76-kindle-nochdir-hack.patch b/thirdparty/dropbear/nochdir-hack.patch
similarity index 53%
rename from thirdparty/dropbear/dropbear-2018.76-kindle-nochdir-hack.patch
rename to thirdparty/dropbear/nochdir-hack.patch
index bea487502..f6b2cf1a9 100644
--- a/thirdparty/dropbear/dropbear-2018.76-kindle-nochdir-hack.patch
+++ b/thirdparty/dropbear/nochdir-hack.patch
@@ -1,8 +1,6 @@
-diff --git a/svr-main.c b/svr-main.c
-index 6f3144b..65a5c63 100644
---- a/svr-main.c
-+++ b/svr-main.c
-@@ -156,7 +156,7 @@ static void main_noinetd() {
+--- i/src/svr-main.c
++++ w/src/svr-main.c
+@@ -185,7 +185,7 @@ static void main_noinetd(int argc, char ** argv, const char* multipath) {
  			closefds = 1;
  		}
  #endif
diff --git a/thirdparty/dropbear/nopasswd-hack.patch b/thirdparty/dropbear/nopasswd-hack.patch
new file mode 100644
index 000000000..0f62e9b40
--- /dev/null
+++ b/thirdparty/dropbear/nopasswd-hack.patch
@@ -0,0 +1,56 @@
+--- i/src/runopts.h
++++ w/src/runopts.h
+@@ -126,6 +126,7 @@
+ 
+ 	buffer * banner;
+ 	char * pidfile;
++	int nopasschk;
+ 
+ 	char * forced_command;
+ 	char* interface;
+--- i/src/svr-authpasswd.c
++++ w/src/svr-authpasswd.c
+@@ -80,6 +80,15 @@
+ 		return;
+ 	}
+ 
++	/*
++	 * Hack. Always auth successfully if we were launched with the -n flag.
++	 */
++	if (svr_opts.nopasschk) {
++		dropbear_log(LOG_WARNING, "Password-less mode enabled, you're in!");
++		send_msg_userauth_success();
++		return;
++	}
++
+ 	if (passwordlen > DROPBEAR_MAX_PASSWORD_LEN) {
+ 		dropbear_log(LOG_WARNING,
+ 				"Too-long password attempt for '%s' from %s",
+--- i/src/svr-runopts.c
++++ w/src/svr-runopts.c
+@@ -103,6 +103,7 @@
+ 					"-l <interface>\n"
+ 					"		interface to bind on\n"
+ #endif
++					"-n             Disable password checking (/!\\ Hack, don't use this!)\n"
+ #if INETD_MODE
+ 					"-i		Start for inetd\n"
+ #endif
+@@ -173,6 +174,7 @@
+ 	svr_opts.hostkey = NULL;
+ 	svr_opts.delay_hostkey = 0;
+ 	svr_opts.pidfile = expand_homedir_path(DROPBEAR_PIDFILE);
++	svr_opts.nopasschk = 0;
+ #if DROPBEAR_SVR_LOCALANYFWD
+ 	svr_opts.nolocaltcp = 0;
+ #endif
+@@ -270,6 +272,9 @@
+ 				case 'P':
+ 					next = &svr_opts.pidfile;
+ 					break;
++				case 'n':
++					svr_opts.nopasschk = 1;
++					break;
+ #ifdef SO_BINDTODEVICE
+ 				case 'l':
+ 					next = &svr_opts.interface;
diff --git a/thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-hack.patch b/thirdparty/dropbear/pubkey-hack.patch
similarity index 53%
rename from thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-hack.patch
rename to thirdparty/dropbear/pubkey-hack.patch
index c7b30514b..150a4076e 100644
--- a/thirdparty/dropbear/dropbear-2018.76-kindle-pubkey-hack.patch
+++ b/thirdparty/dropbear/pubkey-hack.patch
@@ -1,8 +1,6 @@
-diff --git a/svr-authpubkey.c b/svr-authpubkey.c
-index aa6087c..7395837 100644
---- a/svr-authpubkey.c
-+++ b/svr-authpubkey.c
-@@ -296,7 +296,7 @@ static int checkpubkey(const char* algo, unsigned int algolen,
+--- i/src/svr-authpubkey.c
++++ w/src/svr-authpubkey.c
+@@ -439,10 +439,9 @@ static int checkpubkey(const char* keyalgo, unsigned int keyalgolen,
  		const unsigned char* keyblob, unsigned int keybloblen) {
  
  	FILE * authfile = NULL;
@@ -10,24 +8,27 @@ index aa6087c..7395837 100644
 +	char filename[] = "settings/SSH/authorized_keys";
  	int ret = DROPBEAR_FAILURE;
  	buffer * line = NULL;
- 	unsigned int len;
-@@ -320,15 +320,6 @@ static int checkpubkey(const char* algo, unsigned int algolen,
- 		goto out;
- 	}
- 
--	/* we don't need to check pw and pw_dir for validity, since
--	 * its been done in checkpubkeyperms. */
--	len = strlen(ses.authstate.pw_dir);
--	/* allocate max required pathname storage,
--	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
--	filename = m_malloc(len + 22);
--	snprintf(filename, len + 22, "%s/.ssh/authorized_keys", 
--				ses.authstate.pw_dir);
+-	unsigned int len;
+ 	int line_num;
+ 	uid_t origuid;
+ 	gid_t origgid;
+@@ -462,15 +461,6 @@ static int checkpubkey(const char* keyalgo, unsigned int keyalgolen,
+ 	if (checkpubkeyperms() == DROPBEAR_FAILURE) {
+ 		TRACE(("bad authorized_keys permissions, or file doesn't exist"))
+ 	} else {
+-		/* we don't need to check pw and pw_dir for validity, since
+-		 * its been done in checkpubkeyperms. */
+-		len = strlen(ses.authstate.pw_dir);
+-		/* allocate max required pathname storage,
+-		 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
+-		filename = m_malloc(len + 22);
+-		snprintf(filename, len + 22, "%s/.ssh/authorized_keys",
+-					ses.authstate.pw_dir);
 -
- 	/* open the file as the authenticating user. */
- 	origuid = getuid();
- 	origgid = getgid();
-@@ -377,7 +368,6 @@ out:
+ 		authfile = fopen(filename, "r");
+ 		if (!authfile) {
+ 			TRACE(("checkpubkey: failed opening %s: %s", filename, strerror(errno)))
+@@ -516,7 +506,6 @@ out:
  	if (line) {
  		buf_free(line);
  	}
@@ -35,14 +36,14 @@ index aa6087c..7395837 100644
  	TRACE(("leave checkpubkey: ret=%d", ret))
  	return ret;
  }
-@@ -390,48 +380,20 @@ out:
+@@ -529,39 +518,11 @@ out:
   * g-w, o-w */
  static int checkpubkeyperms() {
  
--	char* filename = NULL; 
+-	char* filename = NULL;
 +	char filename[] = "settings/SSH/authorized_keys";
  	int ret = DROPBEAR_FAILURE;
- 	unsigned int len;
+-	unsigned int len;
  
  	TRACE(("enter checkpubkeyperms"))
  
@@ -56,8 +57,9 @@ index aa6087c..7395837 100644
 -
 -	/* allocate max required pathname storage,
 -	 * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */
--	filename = m_malloc(len + 22);
--	strncpy(filename, ses.authstate.pw_dir, len+1);
+-	len += 22;
+-	filename = m_malloc(len);
+-	strlcpy(filename, ses.authstate.pw_dir, len);
 -
 -	/* check ~ */
 -	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
@@ -65,28 +67,34 @@ index aa6087c..7395837 100644
 -	}
 -
 -	/* check ~/.ssh */
--	strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
+-	strlcat(filename, "/.ssh", len);
 -	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
 -		goto out;
 -	}
 -
 -	/* now check ~/.ssh/authorized_keys */
--	strncat(filename, "/authorized_keys", 16);
+-	strlcat(filename, "/authorized_keys", len);
  	if (checkfileperm(filename) != DROPBEAR_SUCCESS) {
  		goto out;
  	}
- 
- 	/* file looks ok, return success */
+@@ -570,8 +531,6 @@ static int checkpubkeyperms() {
  	ret = DROPBEAR_SUCCESS;
--	
--out:
--	m_free(filename);
  
-+out:
+ out:
+-	m_free(filename);
+-
  	TRACE(("leave checkpubkeyperms"))
  	return ret;
  }
-@@ -449,25 +411,6 @@ static int checkfileperm(char * filename) {
+@@ -581,7 +540,6 @@ out:
+ /* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
+ static int checkfileperm(char * filename) {
+ 	struct stat filestat;
+-	int badperm = 0;
+ 
+ 	TRACE(("enter checkfileperm(%s)", filename))
+ 
+@@ -589,25 +547,6 @@ static int checkfileperm(char * filename) {
  		TRACE(("leave checkfileperm: stat() != 0"))
  		return DROPBEAR_FAILURE;
  	}
@@ -104,7 +112,7 @@ index aa6087c..7395837 100644
 -	if (badperm) {
 -		if (!ses.authstate.perm_warn) {
 -			ses.authstate.perm_warn = 1;
--			dropbear_log(LOG_INFO, "%s must be owned by user or root, and not writable by others", filename);
+-			dropbear_log(LOG_INFO, "%s must be owned by user or root, and not writable by group or others", filename);
 -		}
 -		TRACE(("leave checkfileperm: failure perms/owner"))
 -		return DROPBEAR_FAILURE;
diff --git a/thirdparty/dropbear/reduce_build_verbosity.patch b/thirdparty/dropbear/reduce_build_verbosity.patch
index aa1a10ec8..ab535407d 100644
--- a/thirdparty/dropbear/reduce_build_verbosity.patch
+++ b/thirdparty/dropbear/reduce_build_verbosity.patch
@@ -1,14 +1,16 @@
 --- i/Makefile.in
 +++ w/Makefile.in
-@@ -125,7 +125,7 @@
- # for simplicity assume all source depends on all headers
- HEADERS=$(wildcard $(srcdir)/*.h *.h) $(OPTION_HEADERS)
- %.o : %.c $(HEADERS)
--	$(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@
-+	$(if $V,,@echo "   * ${CC} $@"; )$(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@
+@@ -166,7 +166,7 @@
+ 	mkdir -p $@
  
- default_options_guard.h: default_options.h
- 	@echo Creating $@
+ $(OBJ_DIR)/%.o: $(srcdir)/%.c $(HEADERS) | $(OBJ_DIR)
+-	$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@ -c
++	$(if $V,,@echo "   * ${CC} $@"; )$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@ -c
+ 
+ fuzz/%.o: $(srcdir)/../fuzz/%.c $(HEADERS)
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $< -o $@ -c
+--- i/Makefile.in
++++ w/Makefile.in
 --- i/libtomcrypt/Makefile.in
 +++ w/libtomcrypt/Makefile.in
 @@ -243,7 +243,7 @@
@@ -20,3 +22,14 @@
  
  #Create libtomcrypt.a
  $(LIBMAIN_S): $(OBJECTS)
+--- i/libtommath/Makefile.in
++++ w/libtommath/Makefile.in
+@@ -10,8 +10,6 @@
+ CFLAGS += -Wno-deprecated
+ CFLAGS += $(CPPFLAGS)
+ 
+-V = 1
+-
+ ifeq ($V,1)
+ silent=
+ else