UnJailbreaking Kindle 4 NT

[knc1]

Originally Posted by vitalidon

I am not "bricked". I just was not able to flash the new software update 4.1.0 (error code u006) so I used a main image for kindle 4NT (version 4.0.1) to restore it to brand new state. Then I was able to update the device to the new firmware 4.1.0. The only one problem is that I am not able to get root access because my old root password does not work anymore.

Translation: You did not change the "diags mode" software.

My answer, and your solution, remains the same. Use your "diags mode" access to fix the "main mode" software image contents of <mount-point>/etc/shadow.

[geekmaster]

Originally Posted by vitalidon

I am not "bricked". I just was not able to flash the new software update 4.1.0 (error code u006) so I used a main image for kindle 4NT (version 4.0.1) to restore it to brand new state. Then I was able to update the device to the new firmware 4.1.0. The only one problem is that I am not able to get root access because my old root password does not work anymore. I also have tried root,mario. The only combination that works is framework,mario, but it does not give you the root rights to the device. And I am not sure when the root password has changed: when I flashed the main image file mmcblk0p1.img from http://pastebin.com/Wdw4L7yT or after I did the update to new firmware 4.1.0

You need hostar's root pw. You can use john the ripper with the fiona wordlist, or ask hostar for the pw...

When I added ssh to dasmoover's 5.0.0 diags, I replace HIS diags root password hash with the "mario" pw hash from my K4, in /etc/shadow (using a text editor). It would be a good idea for all uploaded main and diags partitions to have their passwords changed to DES mario (using a text editor to copy the hash), just to prevent people not knowing the root password (or serial number) of the original owner of that partition image.

From a framework:mario login, you can do "cat /etc/shadow", then copy paste that to a file on your host PC, then use john (the ripper) to crack it "instantly" using the fiona wordlist in the tools index. It would be helpful to publish that pw here for others who have this problem.

[Aleyst]

Root pw for hostar's img is mario

[geekmaster]

Originally Posted by Aleyst

Root pw for hostar's img is mario

That is good news. I hope to keep using "mario" as the root password for all archived forensic images, so that people do not have password problems after debricking (or restoring unhacked firmware).

[knc1]

Or use the character Fiona's last name: Glenanne

If there was ever any question of the truth to the saying that: "Too much TV rots the mind" - just look what it has done to the staff of lab126.

[kirokko]

Originally Posted by geekmaster

That is good news. I hope to keep using "mario" as the root password for all archived forensic images, so that people do not have password problems after debricking (or restoring unhacked firmware).

After update to 4.1.0 password was changed. /etc/shadow file in diags partition was replaced (maybe it was done another way) with /etc/shadow- in main (mmcblk0p1) partition. Main partition also has /etc/shadow with mario password. What if somebody edit image file and replce /etc/shadow- with /etc/shadow? Will this hack work? It might break the firmware update if it will check the shadow file during update (not only 4.1.0 but future updates).

[geekmaster]

Originally Posted by kirokko

After update to 4.1.0 password was changed. /etc/shadow file in diags partition was replaced (maybe it was done another way) with /etc/shadow- in main (mmcblk0p1) partition. Main partition also has /etc/shadow with mario password. What if somebody edit image file and replce /etc/shadow- with /etc/shadow? Will this hack work? It might break the firmware update if it will check the shadow file during update (not only 4.1.0 but future updates).

I think the firmware update uses a calculated (original serial-number based) password, not the one stored in /etc/shadow. Others had changed the root pw with no OTA update breakage.

[vitalidon]

Originally Posted by geekmaster

From a framework:mario login, you can do "cat /etc/shadow", then copy paste that to a file on your host PC, then use john (the ripper) to crack it "instantly" using the fiona wordlist in the tools index. It would be helpful to publish that pw here for others who have this problem.

I did all this and the password that works is "fionaadc". Thank you.

[geekmaster]

Originally Posted by vitalidon

I did all this and the password that works is "fionaadc". Thank you.

You are welcome. I am glad it worked for you. And thanks for posting that password. When I get pastebin access again, I will add the pw to the pastebin (until we get all images to be mario root pw).