Kindle Touch 5.0 Jailbreak

[geekmaster]

[geekmaster]

[yifanlu]

Originally Posted by ixtab

Whooooo....

folks, calm down, please. Personal attacks won't get this any further, on the contrary. Please try to stay as constructive as you both have been until now. We've got technical challenges to solve... and BTW it's more fun to reverse-engineer than to write disgruntled replies.

Get a beer, or two, or five... cheers!

Thanks for the intervention :P, I hate to beat the dead horse, but I hate to have my actions misinterpreted. I was not trying to make a personal attack, but was just defending myself from the interpretation that my corrections and failure to answer questions are "trolling". I also apologize to geekmaster for saying that that the tar exploit was fixed years ago. I admit that was a statement without justification and I'm sorry to lead you down the wrong path.

Now in terms of Kindle news. It seems that the lipc command to change orientation does not work anymore, but the code to change orientation still works. Can someone check this in SSH to double check and then look for a new way to activate rotation? Someone emailed me a while ago saying they managed to rotate the home screen also, but I never got an update from them.

[geekmaster]

I found a proc buried deep in /sys/ that controlled orientation when you echoed the right value into it. I forgot exactly where. I should have documented my research while poking around the /sys/ tree.

Great... I just did a recursive grep in my /sys/ folder for "orient". After it reported a bunch of "Permission denied" messages it locked up. Even the power button does not work.

I had to do the long reset. It is restarting now...

BTW, I discovered when doing timing tests with
time cp file.xxx /dev/null
that it DELETES the /dev/null device and creates a /dev/nul FILE, resulting in a "device full error". I was comparing large file copy times against large file decompression times, while porting my old memory compression code I use in my windows apps for much faster speed. It is MUCH faster to copy compressed data from the dictionary window in cache than to copy new data from RAM.

Anyway, I was wondering if renaming devices could be useful for MITM code (after a jailbreak) to intercept OTA updates, for example...

@yifanlu: Did you see this? It is what I was referring to as the "other" exploit:
[... secret URL ...]


I was thinking along the lines of an iPod style tethered jailbreak to encapsulate, automate, and hide all the client-server communications cruft behind a pretty GUI interface. Cross-platform for Windows, Mac and Linux (using an SDL framework I already have working), of course.

[rastik]

Originally Posted by yifanlu

Now in terms of Kindle news. It seems that the lipc command to change orientation does not work anymore, but the code to change orientation still works. Can someone check this in SSH to double check and then look for a new way to activate rotation? Someone emailed me a while ago saying they managed to rotate the home screen also, but I never got an update from them.

Orientation change still works for me after update. But I'm using updated lipc code:

https://www.mobileread.com/forums/showpost.php?p=1923855&postcount=41

[ixtab]

Originally Posted by Novas

Hi yifanlu,
I try to use your tool to create new update package to kindle touch.
I use it this way ./kindletool create ota2 -dk5w /media/USB_DISK/kindle/install/
but I get this error message:
Cannot read input.
Segmentation fault
What is wrong? Directory /media/USB_DISK/kindle/install/ exist and included install files.

Originally Posted by yifanlu

Are you sure you want to output to stdout? Try outputting to a file.

I'm experiencing the same here. (Ubuntu Lucid 64-bit). It seems that the argc/argv manipulation in conjunction with optind goes wrong somewhere. In fact, it's trying to read the file "ota2" and aborting for that reason.

I have been fiddling around in create.c, inserting a few debug prints around line 720. Now it looks like this:

   if(info.version != OTAUpdateV2 && (info.source_revision > UINT32_MAX || info.target_revision > UINT32_MAX))
    {
        fprintf(stderr, "Source/target revision for this update type cannot exceed %u\n", UINT32_MAX);
        goto do_error;
    }

    argc -= (optind-1); argv += optind; // next argument

fprintf(stderr, "Skipped %d arguments, argc now %d \n", optind, argc);
fprintf(stderr, "argv[0] is %s\n", argv[0]);
fprintf(stderr, "argv[1] is %s\n", argv[1]);
fprintf(stderr, "argv[2] is %s\n", argv[2]);
argv++;

    // input
    if(argc < 1)
    {
        fprintf(stderr, "No input found.\n");
        goto do_error;
    }

And the output is:

Skipped 3 arguments, argc now 4 
argv[0] is ota2
argv[1] is /tmp/kindle
argv[2] is /tmp/update_test_install.bin

There is clearly something weird happening. Note that incrementing argv once more gets the program to work, but it's still kinda fishy. I guess getopt just doesn't like starting off with optind == -1

PS: Invocation was via command "./kindletool create ota2 -d k5w -d k5g /tmp/kindle /tmp/update_test_install.bin". I would assume that getopt keeps argv[0] (because it thinks its the executable name), while throwing away the options it parsed?

[geekmaster]

I have a new jailbreak that does not use MP3 files, and does not use data.tar.gz, and does not require any assistance from a host PC after the exploit package is put onto the kindle USB drive. It uses something that I previously used in 2005 to inject and execute code in WRT54G routers with no firmware modification. It works on both the kindle touch and the k4nt.

[yifanlu]

Congratulations!

[geekmaster]

Originally Posted by yifanlu

Congratulations!

Thanks! Who should be the "backup caretakers" for this until we need it? I sometimes drop out for months at a time when "new data" comes out at my main job...

[pittapittae]

Originally Posted by ixtab

Here it is.

This jailbreak should work with all versions of the Kindle Touch currently available. (5.0.0 - 5.0.3).

Instructions are contained in the archive. Please report back any issues here.

First of all, thank you all for all your time and impressive work on this. Going back on topic, I'm going to use this jailbreak. Two quick questions:
1. Will the jailbreak disable ads on my Kindle? Just to be sure, because I DO NOT want to disable them, since I don't want to cheat Amazon.
2. Is there a way to disable jailbreak (as for example for updating)? Does the jailbreak work in the same way of the previous versions, creating a single file which can then be deleted?

Sorry about the terribly noobish questions, I'm not yet familiar with hacks and so.

[yifanlu]

Read the readme file. It's like I can read your mind.

[pittapittae]

Ok, thank you, it's quite clear in the 5.0.0 jailbreak, it wasn't (as far as I read it) in the 5.0.3 readme. I'm jailbroken! Or is it just free?

[ixtab]

... I forgot to put this in the README... The uninstaller from 5.0.0 also works with the 5.0.3 jailbreak. Or you can simply "rm /etc/uks/pubdevkey01.pem".

[ixtab]

@yifanlu: compiling kindletool on a recent Linux (Ubuntu 11.10) got things going even worse. Even after "patching" the file with my (admittedly hacky) argc "change" that worked with getopt issues on Ubuntu 10.04, Ubuntu 11.10 is simply segfaulting somewhere else (presumably in libtar). strace doesn't reveal anything sensible, except for, well, a segfault. Could you please look into that? (instructions: just try to build and run kindletool on Ubuntu 11.10 using the standard development packages, as outlined in th Wiki). I'm totally clueless

[yifanlu]

Are you on x86 or x64? Have you tried running the compiled binary?