k3flasher, a USB download mode utility

[DROM]

Originally Posted by hawhill

Ah, sorry, I'm only seeing this now. It's written in the OP, you need to extract the RAM kernel from an ATK installation:

Though knc1 offered a nice interpretation of the License of the ATK sources that would allow me to compile the RAM kernel into executables of k3flasher. So when I can spare the ten minutes to do that, I probably will do soon. I guess I won't get much more reports on this software otherwise...

Ok, I'm sorry but I didn't see it before. Once the RAM kernel is ok, I got the next:

sudo ./k3flasher mx35to2_mmc.bin program 0x00041000 kernel.bin
I: found suitable device
E: wrong transfer length, wanted to receive 8 bytes but received 4 bytes.
I: above error can be ignored, it's due to the device being in ROM kernel mode
I: RAM kernel should be running now. Trying to re-open device: .
I: got it.
E: reading data from device: LIBUSB_ERROR_OVERFLOW
E: aborting. It is suggested you power-cycle the device.

Identical info when I execute the info parameter...

[knc1]

Originally Posted by hawhill

Though knc1 offered a nice interpretation of the License of the ATK sources that would allow me to compile the RAM kernel into executables of k3flasher. So when I can spare the ten minutes to do that, I probably will do soon. I guess I won't get much more reports on this software otherwise...

Ah, forgot to update the info on that one - - -

My reading of the license has been confirmed by Freescale's license compliance division.

They will be including the license files **inside** the source bundle starting with the next release.

(The object files can be re-distributed as a component of an executiable intended to support an i.MX licensed device. There are no restrictions on distribution of *.h files. Both conditions apply to either the original or programs derived from the original.
That is **two** license files - but a person only sees one when signing for the source file.)

They will also be including the source files for the GPL licensed binaries included in the ATK source bundle.

I only received their e-mail last Friday and forgot to post the results here.
(They even said: "Thank you" for spotting the omissions.)

[klonk]

Thanks for you hard work on this,

I have problem while trying debrick my kindle kbr 3g.

Its says something like this https://gist.github.com/3369924 . after a while i thing device go off and some mem error apears. I tryed windows ATK method but no succes

Thanks for help K.

[knc1]

Originally Posted by klonk

Thanks for you hard work on this,

I have problem while trying debrick my kindle kbr 3g.

Its says something like this https://gist.github.com/3369924 . after a while i thing device go off and some mem error apears. I tryed windows ATK method but no succes

Thanks for help K.

If you back up a few posts, you will discover that a change is pending (in the works, not yet posted) that may help you with this situation.

[hawhill]

I'm not so sure. It reads as if it gets into RAM kernel mode only temporarily, not long enough to really stay there, and then resets.

My guess is on (in order of likeliness to me) a) empty battery, and b) broken hardware (constant resets due to non-software dependent reason).

[knc1]

Originally Posted by hawhill

I'm not so sure. It reads as if it gets into RAM kernel mode only temporarily, not long enough to really stay there, and then resets.

My guess is on (in order of likeliness to me) a) empty battery, and b) broken hardware (constant resets due to non-software dependent reason).

There is a hardware watchdog that must be serviced by whatever has control of the machine (iROM kernel or RAM kernel).
This hardware watchdog can not be disabled or masked out.

So it may just be a timing issue of getting things loaded (between starting the replacement of the iROM kernel to when the RAM kernel takes over).

I haven't read your code, but if you issue a "get info" command as soon as you detect the iROM activity (or just keep sending it blind until the iROM loader replies) - then that will switch the iROM loader into different timing loop.

Depending on the i.MX SoC being addressed, there is either a 30 second or a 90 second window between when the iROM kernel is started and when it gives up, and shuts down the SoC.

(The slower the processor, the longer that time-out in seconds.)

That 30 to 90 second window is independent of the hardware watchdog.
During that window, the iROM code polls the OTG and serial ports for activity (and picks the first one to show activity) - then must receive at least one valid command (the "get info" will do and should be safe on all i.MX SoCs) to switch into "normal" command processing mode.

[geekmaster]

I am making images from my "new-in-box" K3-wifi. After charging, it changed the display from the factory/shipping screen to a welcome screen. After plugging it into my linux host PC, it opened the "welcome to your new kindle" ebook (or whatever it was called), without even touching the power switch.

I did not have much luck with nbd so far. It has been many years since I last used nbd. On linux mint, my nbd-client wants IP, port, and device. When k3flasher exports nbd, it does not give a device name.

For now, I am dumping mmc from 0 for 0xfffffe0 bytes (4GB minus one sector) to a file instead.

Other than not figuring out how to use nbd, k3flasher seems to be working fine so far.

[geekmaster]

Do K3 firmware images contain any proprietary information that I need to change?

I plan to replace the root password hash with DES "mario", but other than that, what else should change on the main partition?

[qlob]

Serial number? Registration info?

[geekmaster]

Originally Posted by qlob

Serial number? Registration info?

Serial number and other idme vars on a K4/K5 read as all zero, but on a K3 they may be visible in a full mmc dump. But they should not be in the kernel or main partition images.

I was concerned about anything else that may be found within the main partition.

In my case, it has not been registered yet (fresh out of the box), so no registration data.

I just wanted to know if anybody is aware of any information on a K3 that I should remove or change.

My full K3-wifi 4GB mmc is now about 75% dumped to disk on my host PC, using k3flasher, and in progress. I will extract kernel and partition images from it after it completes.

[geekmaster]

I have K3 "factory fresh" images to upload (somewhere) for kernel-3.0.2-factory.img.gz and mmcblk0p1-3.0.2-factory.img.gz. Unfortunately, my mediafire account has a 200MB per file limit, and the K3 root partition image is 350MB.

I changed the root pw to mario, but everything else is fresh from a new-in-the-box kindle 3 wifi (but version 3.0.2 firmware). You can always install old firmware and then do an upgrade to newer firmware.

Any ideas on where to put the K3 firmware image?

EDIT: Upload progress: https://www.mobileread.com/forums/sho....php?p=2190957

[hawhill]

Originally Posted by geekmaster

Serial number and other idme vars on a K4/K5 read as all zero, but on a K3 they may be visible in a full mmc dump. But they should not be in the kernel or main partition images.

I was concerned about anything else that may be found within the main partition.

I've looked thoroughly, once, and I did not came across anything related. The serial number is stored in a non-filesystem area between kernel and rootfs (or was it between uboot and kernel? Not sure right now...). Running "strings" on the dump should show the data, it's stored as ASCII data (non-binary serial number).

In my case, it has not been registered yet (fresh out of the box), so no registration data.

Errm, don't they come pre-registered to the Amazon account which bought them?

Glad to hear it all worked, though :-)

[geekmaster]

Originally Posted by hawhill

...
Errm, don't they come pre-registered to the Amazon account which bought them?

Glad to hear it all worked, though :-)

I have 11 kindles. 4 of them were new, but only one of them came pre-registered.

Interestingly, my first K4 came with 4.0.1 firmware (pre-registered), but the second one purchased months later came with 4.0.0 firmware (not registered). Perhaps they upgraded the firmware on the first one when they registered it before sending it out. The "not registered" K4 also came with a full /test/ folder on it (which I copied).

The new K3 images are in the pastebin now.

[thatworkshop]

http://en.wikipedia.org/wiki/Compari...sting_services
http://www.ivanexpert.com/blog/2010/...es-up-to-10gb/

I personally use ADrive.com and I love it! <--- use unpaid version not the free 14-day trial of their premium service and you'll have 50GB and max size per file is 1GB.

Request: Also if you/anyone can upload diags kernel for KT 5.1.2, I'll appreciate.

[geekmaster]

Originally Posted by cscat

http://en.wikipedia.org/wiki/Compari...sting_services
http://www.ivanexpert.com/blog/2010/...es-up-to-10gb/

Request: Also if you/anyone can upload diags kernel for KT 5.1.2, I'll appreciate.

I use a free mediafire account. I do not know what the monthly bandwidth limits are, but the file size must be less that 200MB. I used a multi-part zip file for the 350MB compressed K3 image file.

It would be nice to have more mirror sites in case mediafire goes down or is blocked from some areas. Please PM me any download links, so I can add them to the pastebin page.