Kindle Touch 5.0 Jailbreak

[geekmaster]

Originally Posted by yifanlu

I hope your tool is properly coded and does not depend on sb_loader/mfgtool. USB hid is a powerful and dangerous tool. I lead you step by step into fixing your device. You sure you can make a tool to do it again without help?

I am using modified versions of sb_loader and u-boot, which are both open source and freely distributable in modified form. Unlike fastboot, my recovery tool for k4 an touch will not expose potentially dangerous functions.

Software development and debugging are very much like solving a maze puzzle, which requires exploring all possibilites until a solution is found, making educated guesses (i.e. assumptions) to reduce the time needed to solve the puzzle. Although I occasionally spend some time in local minima (i.e. dead end paths), I eventually exhaust those and reach the correct path, leading to a verifiably correct solution. I do my explorations from the bottom up, preferring to build my foundations of knowledge first. This is the way old-school programmers were taught. Modern programming schools usually teach top-down OOP style. Both types are programmers are needed.

I really do appreciate your tips and pointers, and letting me know when I am on a dead end path, so I can save time by changing to an adjacent unexplored path in my quest for understanding and solution of the technical problem that I am studying.

Although your fastboot tool still needs some work, I am very thankful that it works as well as it does, and that it helped me to repair my bricked kindle.

Please make less derogatory questions and comments in the future, to minimize hostility between us. Thanks.

[bartveld]

Seems to me you guys aren't really working together. If there are irreconcilable differences in your approach, why not split up? Geekmaster, why don't you start your own thread (since Yifanlu is the OP)?
All I want is an easy to work jailbreak and a fonthack for the Touch. Hats off to the man who makes it. But if you keep getting on each other's nerve I'm afraid one of you (or both) will quit, leaving me out in the cold.

[geekmaster]

Originally Posted by bartveld

Geekmaster, why don't you start your own thread (since Yifanlu is the OP)?

Like I did here? https://www.mobileread.com/forums/sho...06#post1939306

[bartveld]

Originally Posted by geekmaster

Like I did here? https://www.mobileread.com/forums/sho...06#post1939306

That's Non Touch, isn't it? Anyway, let me rephrase my point: I am very, very grateful for the fonthack on the Kindle3 KB, since the fonts that the Kindle ships with are ugly. With my Kindle Touch arriving soon, I would like the same option. The only people able to give that option are you and/or yifanlu. But... I've seen it happen on more than one forum on very diverse topics and hardware: several knowledgable posters start criticizing each other and in the end everyone returns sulking to his corner and the thread and development die.
Whomever the shoe fits...
I would be very sorry to see that happen here. Evidently, my motives are purely selfish.

[geekmaster]

Originally Posted by bartveld

...
I am very, very grateful for the fonthack on the Kindle3 KB, since the fonts that the Kindle ships with are ugly.
...

FYI - a little background information on WHY the default kindle fonts are ugly: https://www.mobileread.com/forums/showpost.php?p=1928420

[Sworgkh]

Hey yifanlu !
Thanks for your Launcher.
It have some limitation when I use Landscape mode.
If you want to use option "Go to" the keyboard is overlaying buttons on the dialog so there are no any option trick it?
Actually I don't really tried to look in code but it seems to be complicated to change behavior of dialog in landscape mode.
may be I'm wrong...

[bartveld]

Originally Posted by geekmaster

FYI - a little background information on WHY the default kindle fonts are ugly: https://www.mobileread.com/forums/showpost.php?p=1928420

Well, that could be a reason, but my considerations have more to do with aesthetics: the stock fonts are extremely run of the mill and, to put it plainly, ugly. Even on my phone I install my own choice of fonts!

[ixtab]

Hi,

(this is mostly, well, exclusively, targeted at Yifan Lu):

I'm about to experiment again with creating Kindlets, and since your newest jailbreak already includes the Java dev keys, I thought I'd just use them to keep things simple for end users. However, this is what I get when signing the package:

sign:
  [signjar] Signing JAR: package.azw2 to package.azw2 as Kindlet
  [signjar] Warning: 
  [signjar] The signer certificate will expire within six months.
  [signjar] Enter Passphrase for keystore: 
  [signjar] Signing JAR: package.azw2 to package.azw2 as KindletInteractionSupport
  [signjar] Warning: 
  [signjar] The signer certificate will expire within six months.
  [signjar] Enter Passphrase for keystore: 
  [signjar] Signing JAR: package.azw2 to package.azw2 as KindletNetworkSupport
  [signjar] Warning: 
  [signjar] The signer certificate will expire within six months.
  [signjar] Enter Passphrase for keystore:

This means that everything signed with the keys in your jailbreak will stop working within less than 6 months. I doubt that this was your intention. (I would have created the keys with a validity of at least 20 years, just to be on the safe side).

I suggest releasing a new jailbreak version (1.2?) with updated keys ASAP. So far, I don't think a lot of development has been going on with the currently included keys, so I guess the sooner this is fixed, the better...

Just my 2 cents though. There are of course always alternatives like using other keys to sign (and including them in the keystore on the device), but as far as I understand the whole purpose of including those keys directly in the jailbreak was to make things as hassle-free as possible...

UPDATE: Oh well, it doesn't work anyway with the currently included keys. The alias names MUST be of the form "[dk|di|dn]<alias>" (e.g. "dktest, ditest, dntest", or if you want to stick with the "Kindlet" alias, "dkKindlet, diKindlet, dnKindlet"). Otherwise the Kindle just throws a "NullPointerException at com.amazon.kindle.kindlet.internal.security.Kindle tBookletKindletClassLoader.getMappedCertificates(v sb:1101)". I'm sticking with the "test" keys for now, but I really suggest to fix this.

[aliar]

Originally Posted by jglerner

@aliar

From Yifanlu´s site (first post on this thread):

Thanks, But I want uninstall ixtab's jailbreak, not Yifanlu's jailbreak, so which uninstall file i can use? thanks.

[ixtab]

You can use the same uninstaller. *ALL* jailbreaks install the exact same thing (a single file), they just use different methods to do so. Once the jailbreak is installed, you can use any JB uninstaller to remove it.

[aliar]

Thanks, ixtab.

[geekmaster]

Originally Posted by ixtab

You can use the same uninstaller. *ALL* jailbreaks install the exact same thing (a single file), they just use different methods to do so. Once the jailbreak is installed, you can use any JB uninstaller to remove it.

Actually, different payload destination files are used by some jailbreaks, and an uninstaller for one will NOT work with another. The first common data.tar.gz payload destination was /var/local/system/locale, but that payload sets your locale settings to EN_US, and only works on the touch, and only when booted from the main system partition. Other (less used) locations are /var/local/system/tzVar and /var/local/wan/info. Some of these run automatically on startup, and others require triggering by performing some menu selection. All of these have limitations, and only run in either main or in diags mode, and only work on some kindle models.

The currently popular payload destination file is /var/local/system/mntus.params. This one is particularly powerful and dangerous. It runs on ALL kindles that I have tested it on (touch, k4, k3, dxg, and dx). This payload executes multiple times during startup, and during execution of some other scripts. The downside (and a rather LARGE downside using the payload content of most jailbreaks using it), is that it has bricked a number of kindles when the user installed a version intended for a different kindle model. This is because /var/local/system/mntus.params must either not exist (in which case it will be automatically created), or if it does exists, it MUST contain the correct values for the USB drive parameters needed for that kindle model. Installing the wrong version of this jailbreak bricks the kindle.

The correct solution to this "universal payload destination with model-specific contents" problem is to put only "smart" scripting code into this file, that will detect the environment (kindle model) it finds itself in, and behaves correctly for that instance. It cannot just exit -- this will brick the kindle. As mentioned, if this file exists, it MUST return the correct values for that specific device. There are a couple of ways to do implement a "smart" script to be environmentally aware so that it can do the right thing on all kindles, even if installed on the wrong model.

The one provided in yifanlu's jailbreak package calls system scripts to replace both /var/local/system/mntus.params and /var/local/wan/info with system defaults, but his code contains significant error handling, which indicates that this might fail. If installed on a bricked kindle with damaged or missing scripts, it has a much larger chance of failing, and adding to the problem.

Another way is to have the "smart" code in the payload destination script file avoid calling other scripts, and just use linux commands. The first post in the "Select Boot for K4NT and Touch" thread contains a data.tar.gz including a /var/local/system/mntus.params payload file that does exactly that. It extracts the kindle serial number from /proc/cpuinfo and uses the first four characters to determine the kindle model. Then it assigns return values needed for that kindle model. It also mounts /mnt/us (read-write) so that it CAN find a RUNME.sh script on the USB drive, then it sets /mnt/us/RUNME.done, then it calls RUNME.done. It is necessary to mount the USB drive in this script because the first time it is called during starting (especially if bricked) it can be detected as a 0-byte "fake storage" device, used for battery charging in low-power mode (when the battery is low). Bricked kindles can drain the battery rapidly.

The fact that the other jailbreaks fail to run RUNME.sh on bricked kindles until you manage to charge the battery is not a problem for my data.tar.gz, because it mounts the drive itself and then calls the RUNME.sh file if it exists and there is no RUNME.done.

The RUNME.sh script must be careful to NOT remove the RUNME.done file (unless very careful how it is used), to prevent an infinite boot loop.

Although a "smart" /var/local/system/mntus.params will run during startup on all tested kindle models (dx, dxg, k3, k4, touch), it can only be installed with data.tar.gz on the k4 and touch. Earlier kindles need this installed using other known jailbreak techniques, which defeats the need to use this as a jailbreak. However, because the execution is so early in the startup sequence, I plan to use it for a "boot menu", that lets you decide with partition to boot from, and may even let you boot a loop-mounted operating system on the USB drive. We have successfully loaded and executed kernel image files from the USB drive, so we now know how to boot from custom linux kernels without flashing them with fastboot.

[mbspringer]

Thanks, I found it. @ http://www.linuxquestions.org/questi...le-ssh-354780/

If you really want to, remove the corresponding line from /root/ssh/known_hosts , that is, the line beginning with the <ip> you snipped off. It will then ask you to accept the new key when you try to connect.

=

I upgraded from 5.0 to 5.03. Went with the 503 jailbreak. https://wiki.mobileread.com/wiki/Kind...USB_Networking

I installed the USBnet succesfully. Example to connect from Linux: ifconfig usb0 192.168.15.1; ssh root@192.168.15.244

now I get:


root@buntus-desktop:/home/mbs# ifconfig usb0 192.168.15.1; ssh root@192.168.15.244
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
1e:2d:4f:9a:3d:d2:68:72:f5:03:ad:ce:7c:4d:aa:af.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:1
RSA host key for 192.168.15.244 has changed and you have requested strict checking.
Host key verification failed.

what can I do to resolve this issue ?

[geekmaster]

Originally Posted by mbspringer

I upgraded from 5.0 to 5.03. Went with the 503 jailbreak. https://wiki.mobileread.com/wiki/Kind...USB_Networking

I installed the USBnet succesfully. Example to connect from Linux: ifconfig usb0 192.168.15.1; ssh root@192.168.15.244

now I get:


root@buntus-desktop:/home/mbs# ifconfig usb0 192.168.15.1; ssh root@192.168.15.244
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
1e:2d:4f:9a:3d:d2:68:72:f5:03:ad:ce:7c:4d:aa:af.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:1
RSA host key for 192.168.15.244 has changed and you have requested strict checking.
Host key verification failed.

what can I do to resolve this issue ?

The error message tells you how to fix it. It says: "Add correct host key in /root/.ssh/known_hosts to get rid of this message."

I have multiple kindles that use 192.168.15.244, and they have different RSA keys. Changing the key in the known_hosts file just makes the problem come back when you plug in a different kindle using that IP address. You could copy the RSA private key inside the kindles to the other kindles so they all match. Or you could do like I did and replace the known_hosts file on my host PC with a symlink to /dev/null. Now when I SSH in it just has a one line notice that it is "permanently" adding a new key (to /dev/null).

[knc1]

Originally Posted by geekmaster

The error message tells you how to fix it. It says: "Add correct host key in /root/.ssh/known_hosts to get rid of this message."

I have multiple kindles that use 192.168.15.244, and they have different RSA keys. Changing the key in the known_hosts file just makes the problem come back when you plug in a different kindle using that IP address. You could copy the RSA private key inside the kindles to the other kindles so they all match. Or you could do like I did and replace the known_hosts file on my host PC with a symlink to /dev/null. Now when I SSH in it just has a one line notice that it is "permanently" adding a new key (to /dev/null).

Or just use a different IP address for each Kindle.
Since that private address range is 192.168.0.0/16 you shouldn't run into this problem until you have more than (2^16)-3 Kindles hooked up.

The message says which key (line number, same thing) in your known_hosts file is the conflicting one - use a text editor to delete it.

With known_hosts redirected to /dev/null you lose host authentication, not something you want to throw away if using your ssh client to connect to things other than a single Kindle under test.