[Progress] Jailbreaking Kindle 4.0 (Touch/No Keyboard)

[igich]

Originally Posted by yosoyeleze

Igich:

Hello

how and where should I place the file you attached? Could you explain a little more in detail? thank you very much

You need a root shell (jailbreak) to your KT.

1. Plug in your Kindle and open the USB drive that it creates.
2. Copy the MobiReader-impl.jar in the music folder.
3. Open root shell and rename from /opt/amazon/ebook/lib/MobiReader-impl.jar to /opt/amazon/ebook/lib/MobiReader-impl.jar.bak
4. Move /mnt/us/music/MobiReader-impl.jar in to /opt/amazon/ebook/lib
5. Reboot.

That's it.

[yifanlu]

Long time no progress?

I will write a detailed post later, but here's what I've been working on for the past week.

-Kindle Touch can be put into "iMX50 USB Recovery Mode" by holding the home button, holding the power button for 15 seconds (20 seconds to be safe), and releasing the power button but continue to hold the home button then release the home button. (But we already know this from the Wiki)
-Kindle 4 can be put into the same mod by holding the DOWN button on the keypad, holding the power button for 15 seconds (20 seconds to be safe), and releasing the power button but continue to hold the down button and then release the down button. (This is new info. I found it by accident when my fingers slipped).
-In this mode, one can easily upload unsigned u-boot (thanks amazon for the source!) which can load an unsigned kernel (usb download mode can download linux kernel to RAM, but you need a custom uboot to load it).
-When u-boot crashes, the CPU falls back into USB download mode. This is NOT the same mode! In this mode, you CANNOT load a custom uboot because the device has already be initialized. This means if you bricked your Kindle and you automatically fall into USB download mode (USB HID as some call it), you STILL have to perform the directions above to get into the "proper" usb download mode.
-To compile u-boot, extract the sources from amazon and do:

TYPE=prod make CROSS_COMPILE=path-to-cc/arm-linux-gnueabi-
TYPE=prod make CROSS_COMPILE=path-to-cc/arm-linux-gnueabi- u-boot.bin

(thanks nueva for the advice about TYPE=prod)
-The kindle contains two uboots, the main uboot is small enough to fit on the OCRAM (128KB embedded in the CPU), but it also loads another uboot "BIST" (built in self test) into the DRAM (1-2GB in the kindle) that can be loaded by typing "bist" into the uboot shell. The bist uboot has more features such as read/write mmc blocks, read/write memory, upload files via serial to memory, etc.

Now what does that mean?
Some potential applications (no code has been written yet):
-De-bricking utility. You will ALWAYS be able to debrick a kindle (without a serial cable) even if you wipe the MMC clean since the usb download mode resides in the bootrom burnt into the CPU.
-Permanent jailbreak utility. Amazon (afaik) cannot turn this mode off (this isn't a "discovery" or "mistake", they purposely left this mode in. perhaps they would release a recovery tool in the future?). Because we can "hook" on to the very beginning of the boot process, we can load a custom uboot to load a custom kernel that auto-roots.
-Android. We could always have booted android (if someone ports it), but now that we can freely modify the bootloader, we don't have to "work around" anything anymore. Plus it would no longer be risky to try to develop an android port since bricking is fixable.
(once again, these are potentials but no actual code has been written).

What does this mean for you?
Nothing. Right now. I'll be writing a nice and easy "one click" tool sometime in the near future. For now, just sit tight and wait. If you have a bricked kindle, just put it on the shelves for now. If you want to attempt a solution, join the development chat room and if I have time I may help you. (but it won't be easy and it'll take time from making the tool! you need to be technically knowledged)

[geekmaster]

Originally Posted by yifanlu

What does this mean for you?
Nothing. Right now. I'll be writing a nice and easy "one click" tool sometime in the near future. For now, just sit tight and wait. If you have a bricked kindle, just put it on the shelves for now. If you want to attempt a solution, join the development chat room and if I have time I may help you. (but it won't be easy and it'll take time from making the tool! you need to be technically knowledged)

While not YET a one-click tool, we have taken this information learned while debricking my K4NT over IRC, and simplified it as we successfully used it to debrick a LOT more kindles since my K4NT.

With requests for help still coming in (also from other forums including amazon.com) while the information needed to debrick a kindle (k4 or touch) was scattered through various threads, I decided to create a new "step-by-step debricking guide" in a new thread "simple kindle touch (and k4nt) debricking method" which simplifies information from the "Select Boot" and "Fastboot Manifesto" threads.

And now it has become even easier, by using fastboot to flash a kindle touch diags partition with SSH preinstalled.

The current "state-of-the-art" in kindle debricking is here:
https://www.mobileread.com/forums/sho...d.php?t=170929

[SharkNX]

Guys, I'm really sorry that I'm OT but one dumb friend tried to instal Duokan on my K4NT. He copied Duokan files and that Diag file to my Kindle.
He was lost at that Tequila diags, panicked and tried to Exit from it.
He tried Restart but it always get back into Diag mode ... So he did something stupid.
In Tequila he selected Section D) Exit, Reboot or Disable Diag ... And selected 1.St option ... Now my Kindle is Frozen.
Can you navigate me, how to get my Kindle back to work? I'm really sorry but I don't know what to do.

[heeby]

Sorry for the noob questions but what are the advantages and disadvantages of jailbreaking a Kindle 4 NT? I have read through the thread but much of it is over my head.

[geekmaster]

Originally Posted by heeby

Sorry for the noob questions but what are the advantages and disadvantages of jailbreaking a Kindle 4 NT? I have read through the thread but much of it is over my head.

All the "jailbreak" does is install a custom update key to make it easy to install developer-signed updates. The K4 is already pretty open (through diagnostics SSH) and using other methods (data.tar.gz), so installing it is less important than on a K3 or earlier, where jailbreaking was about the only way to install custom apps.

[geekmaster]

Originally Posted by SharkNX

Guys, I'm really sorry that I'm OT but one dumb friend tried to instal Duokan on my K4NT. He copied Duokan files and that Diag file to my Kindle.
He was lost at that Tequila diags, panicked and tried to Exit from it.
He tried Restart but it always get back into Diag mode ... So he did something stupid.
In Tequila he selected Section D) Exit, Reboot or Disable Diag ... And selected 1.St option ... Now my Kindle is Frozen.
Can you navigate me, how to get my Kindle back to work? I'm really sorry but I don't know what to do.

Cross-posted. Already solved in another thread.

[352478140]

anybody has kindle4 nt diags img,so i can flash my kindle 4 nt in fastboot mode

[hostar]

Here is mine:
http://uploading.com/files/f83519me/mmcblk0p2.bin/

[352478140]

thanks so much

[geekmaster]

I obtained "unofficial" (spoken) word from amazon techs that these images "should be" fine for debricking purposes, but I would like the direct links moved offset just to be safe.

These links are essential and critical to our success in helping people debrick their kindles.

Could somebody "please" put up a simple webpage at an offsite webserver that contains links to the files on the web page linked above? Please add some "unique and unusual" keywords to that page to make it easy to Google (when we provide the keywords in a post or PM). Thanks.

EDIT: Done. The "simple debricking" first post now has a "forensic" link to a pastebin with the URLs in it. A user needs to have at least enough technically competence to do a "cut and paste" to use them. Also, all the files are mirrored so you can Google "gitbrew dasmoover forensic" to find copies of them.

[sebarkh]

Originally Posted by AlexeyII

Usbnetwork & Dropbear package for Kindle 4 no touch for runing in production (non-diag) mode

This stuff need because in PROD mode needed files in /usr/local absent, and startup scripts cannot run usbnetwork & dropbear services
Requirements: Kindle 4 no touch 4.0.0/4.0.1 firmware, installed jailbreak

Installing:
1) instal jailbreak if you dont have
2) place update_k4w_usbnetwork&dropbear.bin to root folder of attached kindle
3) update

Activate:
1) place empty ENABLE_USBNET in root folder of attached kindle & restart
2) after restart you will see screen about usb connection with no switch to main screen
3) ssh to 192.168.15.244, login as root and enter password (password relative to serial number of your device, you need calculate it before )
4) if you want remove "usb connection screen" do command:

lipc-set-prop -i com.lab126.volumd useUsbForNetwork 1
/etc/init.d/volumd stop
/etc/init.d/volumd start
/etc/init.d/framework restart

5) if you want restore normal mode and have "usb connection screen", you need reboot device manualy, like "sh /etc/init.d/reboot stop" or other way
6) file ENABLE_USBNET will be deleted by kindle automaticaly, after reboot usbnetwork will be disabled

Could you make the uninstall .bin for this?

[lpgdsxyz]

Originally Posted by Belkaar

My first post and first steps:

!! Read the entire tutorial before starting. If you don't understand one of the steps don't try it. You will risk bricking your Kindle !!

How to enable SSH via Wifi on Kindle 4 (4.0.1) nt on windows:

1) Get your kindle serial from the settings menu

2) Run the following python code to get your root password

#!/usr/bin/env python
import hashlib
print("fiona%s"%hashlib.md5("XXXYOURSERIALXXX\n".encode('utf-8')).hexdigest()[7:11])

3) Enter diagnostic mode: create an empty file with name ENABLE_DIAGS on your kindle via USB and reboot (Settings -> Menu -> Restart)

4) In diagnostic mode plug in the USB cable and go to usb networking: Misc individual diagnostics -> Utilities -> Enable USBnet

5) Install windows driver. Windows (7) won't recognize the correct driver, so you have to select it manually: Go to device manager, and select the new unkown device, right click and install driver. Then click your way to the driver list, select "Network card" then "Microsoft Inc" then "Remote NDIS based internet sharing device"

6) setup windows network. Setup the IP for the new connection: IP 192.168.15.1 Subnet 255.255.255.0, rest empty

7) Open ssh client like putty and connect to 192.168.15.244 user name root and password from the python script 'fionaXXXX' (or 'mario' for 4.0)

8) mount main partition

mount /dev/mmcblk0p1 /mnt/base-mmc

9) copy dropbear binary:

cp -r /usr/local /mnt/base-mmc/usr/
sync

10) add firewall rule:

vi /mnt/base-mmc/etc/sysconfig/iptables

add line

-A INPUT -i wlan0 -p tcp --dport 22 -j ACCEPT

hit ESC , then enter :wq and press enter

11) reboot: On the kindle exit usb mode and go to the main menu, then select 'Exit, Reboot or Disable Diags' -> 'Disable Diagnostics'

12) disconnect USB cable

13) after it finished rebootin you can point your SSH client (or WinSCP) to the Wifi IP when kindle is running in normal mode

I just got my kindle 4.1.0, and I followed your steps untill to the putty part.

when I tried to set up a ssh session via putty, it says like this
"Network error: connection refused"

then I ping the address of kindle 192.168.15.244
reply is ok, no loss.

So what should I do?
Can you help me?

[NiLuJe]

@lpgdsxyz: *whistles*

[lpgdsxyz]

Originally Posted by NiLuJe

@lpgdsxyz: *whistles*

problem solved!