k3flasher, a USB download mode utility

[hawhill]

If you do not fully understand what this is about, do not use this. You have been warned. Others may instruct you to use this tool in certain ways, so make double sure that the circumstances apply to you.

Make sure your battery is fully charged. If your device is not working when you do this, keep it charging for at least a day! No matter what the LED color is!

I've mentioned in the ATK thread that I'm working on a libusb(x/-1.0) based utility that resembles the flashing functionality of ATK, only a bit more convenient for users of the K3. I finished an early, but seemingly nice-working version of it. It is only tested on Linux as of now. When running an ATK compatible Windows installation, you can use ATK instead, see the referenced thread. However, it could certainly be compiled on Windows, too, I think.

What's working in k3flasher: switching to RAM kernel, flash info (will always report a wrong size, just like ATK), flash dumping, flash programming. I've successfully read data with it and also programmed kernels.

Also, there's a simple companion shell script now (from v06) that can make a backup of all the system data regions of the flash.

An addition in v05 introduced NBD server functionality. The device's flash is presented as a network block device and can be connected from the host machine, so you have block devices for the flash memory of the device. Mounting, reading and writing was tested and seems to work unexpectedly fine.

Update, 12.10.: additional to the source code, precompiled binaries for Linux (glibc >= 2.18 - I think, x86 and x86_64 architectures) are provided that are statically linked against libusbx-1.0, should run on most current Linux distributions. You need to run this with sufficient privileges, so if in doubt about my skills and/or intentions check my source code and compile yourself. You're the one who has to take all the risk, after all.

I'm still relying on the RAM kernel from the ATK - which I cannot distribute. Check the README for the filename and scan an ATK folder for the according RAM kernel file. I will certainly stop here and will not create a whole new RAM kernel.

[arooni]

@hawhill:

Are you accessible by IRC/Skype? (My username is arooni). I have little to loose as my K3 is proper borked but would love to have you "there" when I do this.

[arooni]

Also can't get it to compile (yes I did install the latest libusb library before trying to compile. I also ensured that I added /usr/local/lib (where the libusb libraries were installed to, to my .bashrc file to set the path correctly).

I also tried installing the libusbx-1.0.12/ package and moving it to your apps root directory, renaming it to libusb-1.0 as you have in your .c file but that didn't work either.

LilArooni ~/downloads/k3flasher: echo $PATH
/home/david/.rvm/gems/ruby-1.9.3-p194/bin:/home/david/.rvm/gems/ruby-1.9.3-p194@global/bin:/home/david/.rvm/rubies/ruby-1.9.3-p194/bin:/home/david/.rvm/bin:/home/david/bin:/usr/lib/lightdm/lightdm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/home/david/bin/ec2-api-tools-1.3-30349/bin:/home/david/bin:/home/david/bin/get-shit-done:/home/david/bin:/home/david/.rvm/bin:/home/david/bin/ec2-api-tools-1.3-30349/bin:/home/david/bin:/home/david/bin/get-shit-done:/home/david/bin:/usr/local/lib:/home/david/.rvm/bin

LilArooni ~/downloads/k3flasher: make
gcc -g -O0 -lusb-1.0 k3flasher.c -o k3flasher
k3flasher.c: In function ‘flash_program’:
k3flasher.c:394:2: warning: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘__off_t’ [-Wformat]
k3flasher.c:394:2: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘__off_t’ [-Wformat]
/tmp/cceaU0h8.o: In function `usb_send':
/home/david/downloads/k3flasher/k3flasher.c:44: undefined reference to `libusb_bulk_transfer'
/home/david/downloads/k3flasher/k3flasher.c:46: undefined reference to `libusb_error_name'
/tmp/cceaU0h8.o: In function `usb_receive':
/home/david/downloads/k3flasher/k3flasher.c:63: undefined reference to `libusb_bulk_transfer'
/home/david/downloads/k3flasher/k3flasher.c:65: undefined reference to `libusb_error_name'
/tmp/cceaU0h8.o: In function `main':
/home/david/downloads/k3flasher/k3flasher.c:463: undefined reference to `libusb_init'
/home/david/downloads/k3flasher/k3flasher.c:465: undefined reference to `libusb_error_name'
/home/david/downloads/k3flasher/k3flasher.c:469: undefined reference to `libusb_open_device_with_vid_pid'
/home/david/downloads/k3flasher/k3flasher.c:475: undefined reference to `libusb_open_device_with_vid_pid'
/home/david/downloads/k3flasher/k3flasher.c:482: undefined reference to `libusb_claim_interface'
/home/david/downloads/k3flasher/k3flasher.c:484: undefined reference to `libusb_error_name'
/home/david/downloads/k3flasher/k3flasher.c:523: undefined reference to `libusb_release_interface'
/home/david/downloads/k3flasher/k3flasher.c:524: undefined reference to `libusb_close'
/home/david/downloads/k3flasher/k3flasher.c:529: undefined reference to `libusb_open_device_with_vid_pid'
/home/david/downloads/k3flasher/k3flasher.c:533: undefined reference to `libusb_claim_interface'
/home/david/downloads/k3flasher/k3flasher.c:535: undefined reference to `libusb_error_name'
/home/david/downloads/k3flasher/k3flasher.c:641: undefined reference to `libusb_release_interface'
/home/david/downloads/k3flasher/k3flasher.c:642: undefined reference to `libusb_close'
/home/david/downloads/k3flasher/k3flasher.c:644: undefined reference to `libusb_exit'
collect2: ld returned 1 exit status
make: *** [k3flasher] Error 1

[hawhill]

Oh, I did not just copy in libusbx, I compiled and installed it system-wide. Hm, looking at it, the include syntax should probably be in brackets for that case, but my gcc will find headers in /usr/include/libusb-1.0 anyway. However, I guess more relevant here is that it probably did not pick up the compiled libusbx library (which over here is installed in /usr/lib). If your Linux distribution has a development version of libusbx or libusb-1.0, that could be used, too.

I'm heading to my bed now, and I cannot really provide chat support, sorry. Better write to this thread, there might be more helping hands than just mine and others might learn from the questions you had.

[arooni]

I compiled it & installed it system wide. The package libusb-1.0-0 is already installed (ubuntu 12.04 lts).

Still no compilation (I'm not an expert at c programming or else I'd look at it myself).

I'm still really unclear on what happens when I connect my kindle to this tool (if I can ever get it compiled) as the screen is completely frozen and there doesn't seem to be a good thread to tell you how to unbrick a k3)

[hawhill]

It's still a very untested thing, so there's now howto. I've updated the OP with a slightly modified version which has the proper #include syntax. Might fix it for you, I'm not sure, though. Are /usr/include/libusb-1.0/libusb.h and /usr/lib/libusb-1.0.so present?

And did you really read the README? It at least tells you about a first step you can do. Oh, and please make sure you have understood the license, at the begin of the source file :-P

[arooni]

Originally Posted by hawhill

It's still a very untested thing, so there's now howto. I've updated the OP with a slightly modified version which has the proper #include syntax. Might fix it for you, I'm not sure, though. Are /usr/include/libusb-1.0/libusb.h and /usr/lib/libusb-1.0.so present?

And did you really read the README? It at least tells you about a first step you can do. Oh, and please make sure you have understood the license, at the begin of the source file :-P

Thanks for posting a new version -- tried it and same compilation errors below. I do not have the /usr/include/libusb-1.0/ directory.

[hawhill]

libusbmuxd is something different. You have neither the library nor the include files in the default path. They might be beneath /usr/local - if you really installed them - which might not be in your compiler's default search paths.

Please, the last thing I suggest to try is installing libusb-1.0.0-dev from the package list you provide. No need to C&P the compiler errors over again if they stay the same. And I really didn't intend this to get a hand-holding thread. Please understand that this is in an early stage and there might be better consumable versions for people who are still new to all this. It's rough around the edges. Please don't expect too much hand-holding. What you experience is basic compilation problems, not very specific to this software. That might sound harsh, but messing with non-related issues would make this thread go too far off-topic. One day when it's better tested, there might be statically compiled versions for x86 and x86_64.

[arooni]

I installed libusb-1.0-0-dev per your recommendation. Still doesn't compile.

Perhaps you should bundle the libraries in your package that you compiled against. And I have installed both the Sourceforge package system wide... as well as all libusb packages available to me on my system.

I would hardly call what I'm asking for hand holding. It's your software that doesn't compile even with the "required packages". If anything you should be thanking me for jumping on this project eagerly when the documentation and software is just beginning.

[eureka]

v02 compiles and shows help fine here: Debian Sid, with packages libusb-1.0-0 and libusb-1.0-0-dev installed from official repositories (exact library version is 1.0.12).

I don't have KK, so I didn't check utility's work.

(Regarding the k3flasher "if-you-know-what-you-are-doing" license... If I'm implementing the same functionality, but don't know what I'm doing (NB!) as I don't know the exact details of protocol etc., so I'm deciding to look for details in k3flasher source... Do I have a right to use k3flasher [source] in this way?)

[NiLuJe]

@arooni/hawhill: The Makefile is slightly broken. Move $(LIBS) *after* the objects/binaries that depends on it in the commandline. (In this case, at the end). [And possibly get the correct CPPFLAGS/LDFLAGS/LIBS from pkgconfig].

@arooni: Also, PATH has nothing to do with gcc/ld searchpaths.

Patch attached for the simple fix .

EDIT: And another one with pkg-config handling.

EDIT²: And a few printf/include/warning fixes I hit on GCC 4.6.3/GLIBC 2.15 (take with a grain a salt, I suck at C, and it's 6:30 AM here ;D). (unistd is to pull sleep(), read is a shadowed varname, size_t/off_t printf fun times...) .

EDIT^3: Kill the attachments, merged in v03 .

[arooni]

Originally Posted by NiLuJe

@arooni/hawhill: The Makefile is slightly broken. Move $(LIBS) *after* the object/binary in the target. (ie. at the end). [And possibly get the correct CPPFLAGS/LDFLAGS/LIBS from pkgconfig].

Patch attached for the simple fix .

Worked. Maybe the OP should have spent less time of accusing me of requesting "hand holding" and more time fixing his Makefile.

[NiLuJe]

@arooni: That's not a very constructive/productive remark, especially given the fact that hawhill is one of the nicest guys around here....

[arooni]

I don't appreciate being talked down to... especially when I was helping, and the problem ultimately was the OP's fault.

[hawhill]

arooni: I happily take patches. Please do not take offence. I did not mean to be harsh, but the software is focused on a certain target group for now. I can understand that this might be a bit upsetting, but it is a matter of days when there will be a version consumable for end-users. In case you are still struggling: I'm a bit out of ideas. The compiler error indicates that libusb-1.0 is not picked up.

Niluje: Thank you very much. I've included the patches (using pkg-config is a very good idea) and made a v03.

I've also made a little extension in that now the <address> values can be one of the constants "partitiontable", "header", "uboot", "kernel", "isiswf" or "rootfs".

eureka: I know that it is not a very permissive licence :-) But there are good reasons to that. The USB downloader mode has commands for setting the fuses, and writes to registers. I am pretty sure that it can be used to render the Kindle completely useless, not even accessible in USB downloader mode anymore.

The software does pretty much exactly what ATK does - if I didn't introduce bugs. Looks right by looking at the USB exchange (usbmon+wireshark are a great combo, especially when sniffing USB handling of a virtualized WinXP...). I have error checking everywhere to create a safety net, but it might not cover each and every case. At least, I'd like to hear about a few experiences.

The naming of the variables plus the scarce comments only indicate what I think it is. I am not always all that sure, however. But feel free to ask me about protocol details.