Unbrick a Kindle DX Graphite

[iliis]

Hi all,

I managed to brick my Kindle DX Graphite by updating some libraries manually over SSH (tried to get wget running). Now its stuck in a reboot loop. I can get into recovery mode by pressing 'Home' but I'm unable to find a suitable firmware image to flash because I was presumptuous enough not to make a backup myself.

I couldn't find an image anywhere (link on pastebin is 'removed on request') so any help on getting my Kindle back up would be greatly appreciated.
The only thing that needs 'repairment' are some of the OS' libraries, so there's no need to flasth the boot manager or kernel or anything. I can organize a serial adapter if this is necessary, but I still have access to the normal document partition via USB and I think it lets me apply software updates trough the recovery mode.

Cheers,
iliis

[geekmaster]

That DXG image link was removed because twobob got his wife's kindle blacklisted so it cannot be registered, after posting its image set (which contained the kindle serial number and other private info). We have since learned which file could have been removed from the image set, instead of having deleting the entire set DX image files...

Someday somebody will post an image again, without the private info (or perhaps modified safe values of private info).

[iliis]

Thank you for the answer! And sorry for my late reply, this has been on my backburner for a while.

Originally Posted by geekmaster

We have since learned which file could have been removed from the image set, instead of having deleting the entire set DX image files...

Is this information available somwhere? Assuming I get hold of another DXG, what exactly should I do? As I said, I only need a few harmless system libraries, not the whole image.

Originally Posted by geekmaster

Someday somebody will post an image again, without the private info (or perhaps modified safe values of private info).

I'll ask around, maybe I find somebody willing and able to provide me/us with an image.

[knc1]

Originally Posted by iliis

- - - -
Is this information available somwhere? Assuming I get hold of another DXG, what exactly should I do? As I said, I only need a few harmless system libraries, not the whole image.
- - - -

Which ones?
By name please.

[knc1]

Originally Posted by iliis

- - - -
And sorry for my late reply, this has been on my backburner for a while.
- - - -

If you don't have the time to be available to receive help now;
Come back when you have "front burnered" these requirements.

When you do come back, please help clarify your request.
Although much of the system image files are Amazon copyrighted, there could well be a solution to your problem.

• What do you mean by "bricked" ?
  At least give a good description of changes in the device's behavior you have noticed.
• Which version of firmware is now on the device?
• What have you done to the device?
  
  • What things have you tried already to correct the problem?
    Include the result of each thing you tried.
  • How did you determine it was "just a few system files"?
  • How did you determine the above without learning where they are kept and how to access them?
    Note: the DX(G) devices store the system image spread across multiple physical devices.
    
    This point is the confusing one -
    How did you come about the specific knowledge of the "fix" required without knowing the general background knowledge.
• Names of the files you need.

Translation:
To solve this problem, you will have to visit here more often than once every 3 or 4 months.
If only so you can clarify what your problem is.
There isn't a "black box - answer all problems" solution here, we need to know more about what we are expected to fix.

These model devices are a "bit fragile" to work on -
There is no known way to get them into a "replace system image" mode.

[iliis]

Originally Posted by knc1

• What do you mean by "bricked" ?
  At least give a good description of changes in the device's behavior you have noticed.

The Kindle boots up to about a third of the progress bar and then resets, booting from anew. It's stuck in a loop.

I can enter 'Recovery Mode' by holding 'Home' during startup, doing a factory reset:

Reset to Factory Defaults
You are about to reset your Kindle DX to factory defaults, which will
remove all downloaded or transferred content from this device. You
will still be able to download Archived items. If you wish to continue
enter "reset" on the keyboard.

(click to cancel)

This then gives me a screen displaying the following:

Your Device Is in Reovery Mode.
To exit this mode, press the (R 4) key.

If you need to update your Kindle
through Recovery Mode, please
call Customer Service for rurther
assisstance at 1-866-321-8851 or
1-206-266-0927. For UK customers,
please call +44(0)800 496-2499.

In this mode I can access the document partition (which is empty after a factory reset) via USB and transfer files.

Originally Posted by knc1

• Which version of firmware is now on the device?

Still the original version 2.5.8.

Originally Posted by knc1

• What have you done to the device?

First thing I did was jailbreaking it and installing a VNC viewer according to http://www.techhive.com/article/2595...c_display.html (or something very similiar). This worked perfectly.

I then tried to install wget to be able to automatically download news etc. without needing a PC. I did this by transmitting the binary via the document partition and moving it to /usr/bin with SSH (I'm not sure about the exact paths, but it was a quite standard linux filesystem).

Unfortunately, wget needed some system libraries which weren't on the Kindle or which were too old. So I upgraded them without thinking. Unfortunately, I don't remember where I got them from (just took the first ARM version I found) and which ones I updated. There were at least a few important ones, possibly libc.

Originally Posted by knc1

• What things have you tried already to correct the problem?
  Include the result of each thing you tried.

In fear of doing other stupid things and lacking a complete firmware image, not much.
I put the firmware update from Amazon (https://s3.amazonaws.com/G7G_Firmwar...2.5.8_B002.bin)
on to the document partition and restarted the Kindle, hoping it would apply the .bin file.

Result: Still stuck in a boot-loop.

Originally Posted by knc1

• How did you determine it was "just a few system files"?

Because that's the only thing I changed.

Originally Posted by knc1

• How did you determine the above without learning where they are kept and how to access them?
  Note: the DX(G) devices store the system image spread across multiple physical devices.

They weren't system image files or anything so low-level, I replaced system libraries, meaning .so files in /usr/lib or /usr/local/lib.

Originally Posted by knc1

• This point is the confusing one -
  How did you come about the specific knowledge of the "fix" required without knowing the general background knowledge.

Well, over SSH it's more or less a standard linux system, no specific knowledge required to mess that up. I have no idea about the internals lying below the operating system. Probably some kind of bootloader?

I think the confusion stems from thinking I messed with the system image itself, not just with the files from the OS.

Originally Posted by knc1

• Names of the files you need.

Probably just the content of /usr/lib or /usr/local/lib or wherevere the Kindle keeps its libraries and way of getting them there. These are all open-source libraries and shouldn't be copyrighted by Amazon.

Originally Posted by knc1

Translation:
To solve this problem, you will have to visit here more often than once every 3 or 4 months.
If only so you can clarify what your problem is.
There isn't a "black box - answer all problems" solution here, we need to know more about what we are expected to fix.

Yeah, I'm sorry about that. I do have more time now, so I will reply as soon as I can. (I just noticed I had notification emails on 'weekly', fixed it)

I'm very glad for your help - You have all been very obliging!

[knc1]

Here, the term "system image" refers to that package of files published by Amazon that taken together, constitute the operating system install.
Not a graphic image, nor a binary blob.

- - - -

Note the size of the *.bin file linked to, it's only 22Mbyte.
I.E: It is a bsdiff incremental file update.
And bspatch will not alter a file that does not match its targeted file checksum.

Amazon, as far as we know, never published a complete "recovery image" file, only the incremental update files.

Amazon did not start shipping complete **O.S.** image files until the series 5.x firmware.

- - - -

Find the copy of wget you copied to the Kindle (on whatever host pc you where using - not on the kindle) -
Repeat the following **example** command against that copy of wget:

~ $ readelf -dl /usr/bin/wget | grep NEEDED
 0x00000001 (NEEDED)                     Shared library: [libssl.so.1.0.0]
 0x00000001 (NEEDED)                     Shared library: [libcrypto.so.1.0.0]
 0x00000001 (NEEDED)                     Shared library: [librt.so.1]
 0x00000001 (NEEDED)                     Shared library: [libc.so.6]

Notes:
You can be on any architecture to use readelf against any architecture ELF file.
I.E: you can do the above commands on an x86 based machine against the ARM wget executable.

The version numbers **should** be different than shown above.

The "NEEDED" list of externals **might** be different than shown above.

That, from your description, should be the only files you changed in the Amazon system image (set of files) - -
But, since you are not sure, we have to guess that those are the only ones you touched.

- - - -

Did you run (on the Kindle) the ldconfig command after you changed library files?
If so, with what options?

Did you (manually or with ldconfig command) change the symbolic link structure of the /lib, /usr/lib and/or /usr/local/lib filesystem sub-trees?

[NiLuJe]

Once you've figured that out, if you had USBNetwork installed, it will be able to load an 'emergency' shell script at boot [provided the system doesn't crash earlier that the USBNet startup script runs, which happens to be somewhat late in the boot process, although still as soon as the userstore is available], in which you'll have to write a simple shell script to restore what you broke. Having a backup of a full 2.5.8 rootfs image would of course be of tremendous help. (Barring that, provided you only need OSS stuff, I do have a live 2.5.8 system that I can pilfer).

(Path to said script, which *must* be exact: /mnt/us/usbnet/bin/emergency.sh)

Start by writing a simple "Hello world" script w/ an eips call to check if your device dies earlier than that.

It risks getting annoying fast, because of the need to do a factory reset to actually access the USB drive, but at least that's something .

[iliis]

I'm sorry to dissapoint you both: I was unable to find the copy of wget I used and the emergency.sh script didn't produce any output.

Originally Posted by knc1

Did you run (on the Kindle) the ldconfig command after you changed library files?
If so, with what options?

No, I didn't.

Originally Posted by knc1

Did you (manually or with ldconfig command) change the symbolic link structure of the /lib, /usr/lib and/or /usr/local/lib filesystem sub-trees?

I'm quite sure I didn't create or change any links.

- - - -

I did try out different things, like a simple

eips "hello world!"

or writing random data to the screen. I put the emergency.sh script into the document root (for good measure) and into usbnet/bin/

eips "hello world!"
echo 2 > /proc/eink_fb/update_display

dd if=/dev/urandom of=/dev/fb0 bs=600 count=800
echo 1 > /proc/eink_fb/update_display

Even just putting a 'sleep 120' in there didn't seem to affect the time for a boot cycle (which is about 31s and about a minute after a factory reset).

Would it help if I opened my Kindle and try to read out data over a serial connection?

[NiLuJe]

For eips, the actual text is the third argument, the first two are x/y pos (in characters and lines, respectively. 0 0 should be top left, IIRC.)

Although the fact that it didn't block on sleep isn't terribly reassuring :/.

I don't see a shebang in your snippets, was that just for the quotes? Because the init script doesn't call sh, it *relies* on the script's shebang.

And yeah, a serial access would definitely solve the 'getting in' issue (there are a couple of threads on the subject) .

[iliis]

Thanks for the quick reply!

Originally Posted by NiLuJe

For eips, the actual text is the third argument, the first two are x/y pos (in characters and lines, respectively. 0 0 should be top left, IIRC.)

I tried again with

#!/bin/sh
eips 0 0 "hello world!"

but that didn't work either

Originally Posted by NiLuJe

Although the fact that it didn't block on sleep isn't terribly reassuring :/.

Indeed.

Originally Posted by NiLuJe

I don't see a shebang in your snippets, was that just for the quotes? Because the init script doesn't call sh, it *relies* on the script's shebang.

I didn't know that, thanks. I actually tried both, with and without #!/bin/sh.

Originally Posted by NiLuJe

And yeah, a serial access would definitely solve the 'getting in' issue (there are a couple of threads on the subject) .

Ok, I'll get my screwdrivers and soldering iron then. Can you confirm that the DXG uses 1.8V and 115000,8,n,1?

[NiLuJe]

@iliis: Don't take my word for it, I've never been a HW guy, but that looks reasonably right.

[iliis]

No problem. I measured 2.73V on the Kindle's TX rail, so I went with that and a few 100Ohm resistors in series to be safe. Serial parameters are probably 115200 baud, as this is a standard baudrate.

I actually got output and managed to enter uboot and some sort of recovery/developer menu. It looks like I can flash new files trough the serial link

Attached is a log from the start of factory reset (just before entering 'RESET') until the after the first complete boot. The relevant section doesn't seem very helful however, all I see is a system call that crashes:

INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I S30network:def:initializing network configuration
system: I wancontrol:pc:processing "wanon"
mount: usbfs already mounted or /proc/bus/usb busy
mount: according to mtab, usbfs is already mounted on /proc/bus/usb
waninfo 0.6.2 Copyright (C) 2008, 2009 Amazon Technologies, Inc.  All rights reserved.
modemcmd 0.3.2 Copyright (C) 2008, 2009 Amazon Technologies, Inc.  All rights reserved.
system: I wancontrol:pc:processing "wanoffkill"
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Starting Power Management Daemon: system: I S70netwatchd:def:starting Netwatch Daemon
system: I S70wand:def:starting WAN daemon
Unable to handle kernel paging request at virtual address 4002a000
pgd = c5d58000
[4002a000] *pgd=85d24031, *pte=00000000, *ppte=00000000
Internal error: Oops: 817 [#1] PREEMPT
Modules linked in: ehci_hcd mma7660F mxc_keyb uinput fuse g_file_storage arcotg_udc charger mwan usbcore eink_fb_shim eink_fb_hal_broads eink_fb_hal fiveway
CPU: 0    Not tainted  (2.6.22.19-lab126 #3)
PC is at v6_coherent_kern_range+0x4/0x24
LR is at arm_syscall+0x1f0/0x348
pc : [<c00ac768>]    lr : [<c00a91d0>]    psr: 80000013
sp : c66d7e80  ip : c66d7e80  fp : c66d7fa4
r10: 40051fec  r9 : c66d6000  r8 : 00000000
r7 : 000f0002  r6 : 00000000  r5 : 4004a000  r4 : 40026000
r3 : c0339fe8  r2 : 00000000  r1 : 4004a000  r0 : 4002a000
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  Segment user
Control: 00e5387f  Table: 85d58000  DAC: 00000015
Process wand (pid: 1890, stack limit = 0xc66d6260)
Stack: (0xc66d7e80 to 0xc66d8000)
7e80: c6f29a30 000000a4 c66d7eac c66d7e98 c01b086c c00c102c 00000002 c7c0cbd4 
7ea0: c66d7ebc c66d7eb0 c00df4a4 c01b07c8 c66d7efc c66d7ec0 c00aa5a0 c00df4a0 
7ec0: 0000003a c66d3560 c66d7f04 c66d7ed8 c028e83c c00c102c c0323d60 00000017 
7ee0: c66d7f14 c66d7ef0 c01b09dc c00c102c 00000024 00000000 c5d06230 c5d24924 
7f00: 4004a000 00000000 c66d7f24 c66d7f18 c00df490 c01b089c c66d7fa4 c66d7f28 
7f20: c0102a6c c00df48c 00100075 c7c3fce8 c7805d00 00000000 00000000 c00c102c 
7f40: 00100073 00000005 4004a000 4004a000 00000024 c7c0cba0 c5d59000 c66d6000 
7f60: 0000005f 00000000 c5d59000 4004a000 c00cb5e8 c5d06230 c032a6f8 40020018 
7f80: bee82a88 40026000 0000007d 40020018 bee82a88 40026000 00000000 c66d7fa8 
7fa0: c00a4ec0 c00a8fec 40020018 bee82a88 40026000 4004a000 00000000 00000015 
7fc0: 40020018 bee82a88 40026000 000f0002 40029044 00000000 40051fec bee82b4c 
7fe0: 00000015 bee82a78 4000c884 4000c8a0 60000010 40026000 00000000 00000000 
Backtrace: 
[<c00a8fe0>] (arm_syscall+0x0/0x348) from [<c00a4ec0>] (ret_fast_syscall+0x0/0x2c)
 r6:40026000 r5:bee82a88 r4:40020018
Code: eaffffe8 e1a0f00e e1a0f00e e3c0001f (ee070f3a) 
reboot: I def:pcut::arch_reset
reboot: I def:pcut::mx31_deep_reset
reboot: I def:pcut::pmic_power_set_pc_config

[NiLuJe]

Yup, that's indeed before the userstore is up, which explains why the USBNet hook didn't take.

It's been a while since I've played with a Kindle 2, so I don't really remember how the diags thingy works on this one... There should be at least a rescue shell you can drop in early at boot. Check the output during a cold boot.

[knc1]

Originally Posted by iliis

- - - -
It looks like I can flash new files trough the serial link
- - - -

I seem to recall that the {x,y,whatever}-modem protocol is broken in the 2.x series of firmware.

Searching the forum archives should turn up information on that.