[Progress] Jailbreaking Kindle 4.0 (Touch/No Keyboard) - Page 6

yifanlu · 11-17-2011, 03:58 PM

Quote:

Originally Posted by babkayaga

Sounds interesting, could you share how it's done?

Not yet, just in case I could make use of it.

yifanlu · 11-17-2011, 09:34 PM

http://wwwimages.adobe.com/www.adobe...erence_1-7.pdf

A very detailed specification of the PDF format. If you want to look for flaws in Kindle's PDF renderer, you first need to understand how PDFs get rendered. I understand to the point where I can write a couple of working PDF documents from scratch in notepad. However, I can't get it to print any texts though. Anyone want to help?

James D · 11-17-2011, 10:46 PM

Hey guys. Sorry if someone already answered but it is 20 minutes before 6 a.m. and I haven't slept yet.
As you probably already know Kindle Touch 3G is "impossible" to use for free web-browsing by 3G modem. Paradox, ha?
So I am asking if it is possible someone will make jailbreak and hack for this or not?
Also I found that it is is not (for now

) able to change keyboard language. How do you think if it will be able to put a hack to change a language? Thank you.

yifanlu · 11-18-2011, 12:07 AM

If we can jailbreak the touch, this thread wouldn't exist. Also, if we can jailbreak, you probably won't get your free Internet hack as it may be based on the modem serial number. On this subject, has anyone tried swapping a sim card from k3 an kindle touch and see if the Internet works?

kevinpars · 11-18-2011, 06:05 AM

Can someone confirm that the reader.pref file is not accessible in the Kindle Touch? I am on a Mac and used a terminal command to show all files and did not see it in any of the directories on the KT. I assume it was changed even from the K4 - which allows the non hack font change.

James D · 11-18-2011, 10:53 AM

Quote:

Originally Posted by yifanlu

Also, if we can jailbreak, you probably won't get your free Internet hack as it may be based on the modem serial number. On this subject, has anyone tried swapping a sim card from k3 an kindle touch and see if the Internet works?

Well I know people used JB then put a lang hack so then all guid interface and keyboard was russian but 3G internet was free.

Also it is possible to connect Kindle 3 to a computer as a modem so you will have free internet on a computer/laptop. Only minor thing is that it is not portable enough

geekmaster · 11-18-2011, 01:56 PM

Quote:

Originally Posted by James D

...
Also it is possible to connect Kindle 3 to a computer as a modem so you will have free internet on a computer/laptop. Only minor thing is that it is not portable enough

Umm... That is called "tethering" and is in violation of the Amazon "Terms Of Service" contract that you agreed to in exchange for your free 3G internet access.

Amazon knows who you are, has access to your kindle logs (and proxied kindle web traffic), and even better -- they have your CREDIT CARD on file, and can charge you $0.15 per MB just like when you send contents to your kindle's built-in email account.

The *Really Bad* thing about violating your "No Tethering" clause is that you risk getting free 3G internet access shut down for ALL OF US!

Please do not even *think* about tethering. Pretty please?

P.S. Not only does Amazon look at your web traffic, but they also have back-door access to your kindle even when it is in "screen saver" mode. I got a call from a local kindle user who reported that ALL of the (unauthorized) ebooks on his Wi-Fi connected kindle "dissappeared" last night while his kindle was "asleep". You need to keep your 3G *AND* Wi-Fi turned OFF if you expect to have any privacy in your kindle usage -- and you agreed to this when you registered your kindle to your Amazon account. Remember TANSTAAFL ("There Ain't No Such Thing As A Free Lunch"). ;-)

NiLuJe · 11-18-2011, 03:08 PM

I'm all in favor of a proper FS hierarchy for hacks

.

In fact, I've been mostly following a loose scheme for my packages (/$hackname/{bin,etc,lib,run,$data}), minus the prefix (but that sure would help with the mess in the us root ^^), and avoiding messing with the rootfs in install scripts (usually just an init script and the runlevels symlinks), and keeping a human readable versioning info (both for the release package itself via $hackname/info.txt, and for every non binary file with the SVN $Id$ keyword). And, like salfred said, it doesn't take much effort to do that manually. A fully fledged PMS seems a little overkill to me

.

As for the install process itself (or a launcher), keep in mind that some hacks (ie. usbnetwork) have very specific timing requirements regarding when they can be started during the boot process.

I actually like the update process as an installer (it's already there, users usually know about it, it's nicely integrated in the system, it handles runlevels switching for us (ie. some hacks might need the framework to be down/other hacks stopped to be installed correctly)), but I'm not against something custom, provided it has a simple GUI/visible user output, and detailed logging/debugging capabilities.

EDIT: But I also like the idea of no per-package install scripts at all, and just one 'package manager' setup during the jailbreak install, and a simple file/folder to drop/delete to install/remove stuff. It's not convenient for packages that *need* to touch the rootfs someway beyond a simple init script during the install process (because they'd have to do it another time, and probably mntroot rw to do so), and it could be tricky to handle the timing of when to start stuff during the boot process, and we would then *really* need a launcher/installer, because for now the update process takes care of everything for us.

yifanlu · 11-18-2011, 03:34 PM

Why is the timing tricky? I though we can start/stop usbnetwork at any time, so why does it need to be specific? I was thinking that the packager init scripts runs right before framework, and it starts all other scripts.

James D · 11-18-2011, 07:40 PM

Quote:

Originally Posted by geekmaster

Umm... That is called "tethering" and is in violation of the Amazon "Terms Of Service" contract that you agreed to in exchange for your free 3G internet access.

Amazon knows who you are, has access to your kindle logs (and proxied kindle web traffic), and even better -- they have your CREDIT CARD on file, and can charge you $0.15 per MB just like when you send contents to your kindle's built-in email account.

The *Really Bad* thing about violating your "No Tethering" clause is that you risk getting free 3G internet access shut down for ALL OF US!

Please do not even *think* about tethering. Pretty please?

1. I have never agreed any terms of usage. I haven't bought any Kindle yet, but I say what I heard and what is well-known.
2. Actually they already "shut down" free 3G because now it is not allowed to use 3G fro web-browsing. Even more, I think that after changing name from Kindle 3 to a Kindle Keyboard they also locked 3G web-browsing.

About e-mail... you can send it to @free.*** and you will get it for free.

NiLuJe · 11-18-2011, 08:19 PM

@yifanlu: When we want to start it at boot, the cleanest way to play nice with Amazon's volumd that I found was to start it *after* volumd, and before the framework (And not in rcS like it was done at some point, or in the range the fonts & ss hack use early in rc6 (for no good reason, AFAIK, it wouldn't hurt them to run a bit later in rc6)). If it's started before volumd, weird stuff happens (nothing exported over usb, stuck on the connected to computer screen, etc). AFAICT, Duokan does some tricky stuff to deal with that issue, but this seemed simpler and cleaner ^^.

Short answer: just before the framework would be good

.

geekmaster · 11-18-2011, 08:28 PM

Quote:

Originally Posted by James D

1. I have never agreed any terms of usage. I haven't bought any Kindle yet, but I say what I heard and what is well-known.
2. Actually they already "shut down" free 3G because now it is not allowed to use 3G fro web-browsing. Even more, I think that after changing name from Kindle 3 to a Kindle Keyboard they also locked 3G web-browsing.

About e-mail... you can send it to @free.*** and you will get it for free.

Regarding claim #1: You must agree to Amazon Terms of Service when you register an account with them. You cannot get 3G access on an unregistered kindle.

Regarding claim #2: Do you have any proof to backup your claims?

My 3G in the USA still lets me web browse anywhere. I just tried it. Perhaps 3G has been restricted in other countries OR some users have had their Amazon accounts restricted due to excessive bandwidth consumption. Can anybody here verify whether or not a renamed kindle "keyboard" has restricted 3G?

The new kindle touch DOES have restricted 3G that can only access Amazon and Wikipedia. Of course, because both Amazon and Wikipedia have information that can be viewed and modified from both a kindle and a home PC, it *could* be bent into service as a proxy, but that could be interpreted as a violation of the Amazon TOS.

Just because something is "well known" does not make it right. Amazon provides their experimental web browser over 3G as a privelege and not a right, and they are VERY generous in doing so. We must not abuse that privelege or we risk losing it.

Regarding e-mail: I was referring to sending attached FILES to your kindle e-mail that incurs a per-MB cost. Please supply a link showing how to send to @free.*** that does not cost money for attached files.

yifanlu · 11-19-2011, 01:11 AM

Still looking for an exploit in the PDF renderer. So far, there isn't much progress. I found one stack overflow bug in the PDF loader, but unfortunately, the code seems to be for debugging or future implementation or something, as it will never be called (AFAIK, need more research). The function is supposed to build a complete path for a PDF file when passed just the file name, and skip it if passed an already complete path. Problem is, that it seems like the Kindle will always pass a complete path where the bug is in the creation of the path. Basically, it created a stack of 0x200 bytes, memset() it to zero, and call getcwd() to get the current directory. However, afterwards, it calls strncat to add the filename. However, strncat is passed with size_t max_len set to 0x200. This means if the length of the filename + path is > 0x200 bytes, it would overflow the stack, allowing us to write the return pointer. It would be great if I can use this, but it's just amazon teasing us.

I want to start a IRC or something. If there's anyone else working on the jailbreak, please contact me.

hswift · 11-19-2011, 02:55 AM

Quote:

Originally Posted by geekmaster

Can anybody here verify whether or not a renamed kindle "keyboard" has restricted 3G?

Hi all, came out of lurking to answer this. My Kindle Keyboard 3G (shipped to Australia) is less than a week old, and browses over 3G just fine. Considering I bought it over the Touch for just this reason, I'd be quite annoyed if it were otherwise.

reprep · 11-19-2011, 03:34 AM

Hate to be off-topic but no worries there. My Kindle DXG bought from US still has free 3G web browsing in Europe so all kindles with free 3G should be fine.

11-17-2011, 10:46 PM	#78
James D Junior Member Posts: 6 Karma: 10 Join Date: Nov 2011 Device: Kindle Touch	3G for real WEB-browsing or never be? Hey guys. Sorry if someone already answered but it is 20 minutes before 6 a.m. and I haven't slept yet. As you probably already know Kindle Touch 3G is "impossible" to use for free web-browsing by 3G modem. Paradox, ha? So I am asking if it is possible someone will make jailbreak and hack for this or not? Also I found that it is is not (for now) able to change keyboard language. How do you think if it will be able to put a hack to change a language? Thank you.

11-18-2011, 03:08 PM	#83
NiLuJe BLAM! Posts: 13,477 Karma: 26012492 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	I'm all in favor of a proper FS hierarchy for hacks . In fact, I've been mostly following a loose scheme for my packages (/$hackname/{bin,etc,lib,run,$data}), minus the prefix (but that sure would help with the mess in the us root ^^), and avoiding messing with the rootfs in install scripts (usually just an init script and the runlevels symlinks), and keeping a human readable versioning info (both for the release package itself via $hackname/info.txt, and for every non binary file with the SVN $Id$ keyword). And, like salfred said, it doesn't take much effort to do that manually. A fully fledged PMS seems a little overkill to me . As for the install process itself (or a launcher), keep in mind that some hacks (ie. usbnetwork) have very specific timing requirements regarding when they can be started during the boot process. I actually like the update process as an installer (it's already there, users usually know about it, it's nicely integrated in the system, it handles runlevels switching for us (ie. some hacks might need the framework to be down/other hacks stopped to be installed correctly)), but I'm not against something custom, provided it has a simple GUI/visible user output, and detailed logging/debugging capabilities. EDIT: But I also like the idea of no per-package install scripts at all, and just one 'package manager' setup during the jailbreak install, and a simple file/folder to drop/delete to install/remove stuff. It's not convenient for packages that need to touch the rootfs someway beyond a simple init script during the install process (because they'd have to do it another time, and probably mntroot rw to do so), and it could be tricky to handle the timing of when to start stuff during the boot process, and we would then really need a launcher/installer, because for now the update process takes care of everything for us. Last edited by NiLuJe; 11-18-2011 at 03:19 PM.

11-18-2011, 08:19 PM	#86
NiLuJe BLAM! Posts: 13,477 Karma: 26012492 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@yifanlu: When we want to start it at boot, the cleanest way to play nice with Amazon's volumd that I found was to start it after volumd, and before the framework (And not in rcS like it was done at some point, or in the range the fonts & ss hack use early in rc6 (for no good reason, AFAIK, it wouldn't hurt them to run a bit later in rc6)). If it's started before volumd, weird stuff happens (nothing exported over usb, stuck on the connected to computer screen, etc). AFAICT, Duokan does some tricky stuff to deal with that issue, but this seemed simpler and cleaner ^^. Short answer: just before the framework would be good . Last edited by NiLuJe; 11-18-2011 at 10:30 PM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
No Progress bar on the Touch...	grizedale	Amazon Kindle	13	09-29-2011 05:02 PM
Questions about jailbreaking a Kindle 3	daviesgeek	Kindle Developer's Corner	0	09-13-2011 02:09 PM
Touch screen vs keyboard e-ink only	Zarich	Which one should I buy?	24	03-05-2011 06:47 AM
Which Kindle do I need for jailbreaking?	chas0039	Kindle Developer's Corner	6	11-10-2010 10:04 PM

11-17-2011, 09:34 PM	#77
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	http://wwwimages.adobe.com/www.adobe...erence_1-7.pdf A very detailed specification of the PDF format. If you want to look for flaws in Kindle's PDF renderer, you first need to understand how PDFs get rendered. I understand to the point where I can write a couple of working PDF documents from scratch in notepad. However, I can't get it to print any texts though. Anyone want to help?

11-18-2011, 12:07 AM	#79
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	If we can jailbreak the touch, this thread wouldn't exist. Also, if we can jailbreak, you probably won't get your free Internet hack as it may be based on the modem serial number. On this subject, has anyone tried swapping a sim card from k3 an kindle touch and see if the Internet works?

11-18-2011, 06:05 AM	#80
kevinpars Connoisseur Posts: 53 Karma: 509166 Join Date: Feb 2008 Device: Kindle	Can someone confirm that the reader.pref file is not accessible in the Kindle Touch? I am on a Mac and used a terminal command to show all files and did not see it in any of the directories on the KT. I assume it was changed even from the K4 - which allows the non hack font change.

11-18-2011, 03:34 PM	#84
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	Why is the timing tricky? I though we can start/stop usbnetwork at any time, so why does it need to be specific? I was thinking that the packager init scripts runs right before framework, and it starts all other scripts.

11-19-2011, 01:11 AM	#88
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	Still looking for an exploit in the PDF renderer. So far, there isn't much progress. I found one stack overflow bug in the PDF loader, but unfortunately, the code seems to be for debugging or future implementation or something, as it will never be called (AFAIK, need more research). The function is supposed to build a complete path for a PDF file when passed just the file name, and skip it if passed an already complete path. Problem is, that it seems like the Kindle will always pass a complete path where the bug is in the creation of the path. Basically, it created a stack of 0x200 bytes, memset() it to zero, and call getcwd() to get the current directory. However, afterwards, it calls strncat to add the filename. However, strncat is passed with size_t max_len set to 0x200. This means if the length of the filename + path is > 0x200 bytes, it would overflow the stack, allowing us to write the return pointer. It would be great if I can use this, but it's just amazon teasing us. I want to start a IRC or something. If there's anyone else working on the jailbreak, please contact me.

11-19-2011, 03:34 AM	#90
reprep Addict Posts: 202 Karma: 6720 Join Date: May 2011 Device: amazon kindle DXG	Hate to be off-topic but no worries there. My Kindle DXG bought from US still has free 3G web browsing in Europe so all kindles with free 3G should be fine.