[Progress] Jailbreaking Kindle 4.0 (Touch/No Keyboard)

[yifanlu]

Originally Posted by Matan

Does u-boot still have memory read/write commands? You could write an ATAG_CMDLINE directly.

Referring to my previous post.

To summarize, most uboot options (including read/write to NAND or RAM) are gone.

[Matan]

Sorry, I missed that.

The kernel in the 4.0.1 source from Amazon ignores command line from boot loader, so there is no much use looking in that direction.

[giorgio130]

a couple thoughts:
-maybe updating option in recovery doesn't check signature (I don't know why it shouldn't, but may be worth a try)
-root password could be the same as recovery password, have you tried that?

another one:
hitting ctrl+c during boot could drop you into a shell.

[yifanlu]

The root partition has been dumped! Yes, @giorgio, according to ichinomoto, that is what he did. I feel stupid for not having thought of that. I was thinking way too hard. uboot. recovery script. kernel. When the solution was right in front of me (using root password, same as recovery password). So thanks again to ichinomoto for getting the serial port, getting root, and dumping the nand. Now is the second half of the journey. Actually analyzing the operating system.

[Matan]

The kindle browser is using a very old webkit. Perhaps there is a known exploit that works? It runs as root, so even reading or writing a local file should be enough:

http://www.metasploit.com/modules/au...t_xslt_dropper


This is not an easy option, but the iMX50x SoCs have two external boot mode signals that control the boot process, allowing for download and execution a program from the USB port. This will allow you to run a non crippled uboot.

http://cache.freescale.com/files/32b...=Documentation

[yifanlu]

Originally Posted by Matan

The kindle browser is using a very old webkit. Perhaps there is a known exploit that works? It runs as root, so even reading or writing a local file should be enough:

http://www.metasploit.com/modules/au...t_xslt_dropper


This is not an easy option, but the iMX50x SoCs have two external boot mode signals that control the boot process, allowing for download and execution a program from the USB port. This will allow you to run a non crippled uboot.

http://cache.freescale.com/files/32b...=Documentation

Thanks for the advice. My main concern right now is finding out how the signature checks for the updater works. If that's secure, we should try another avenue of getting in. It seems like after, what, 4 years of exploiting the updater script. It may have lived it's days.

[yifanlu]

I know the format for the new update files now.

0x4 bytes update type: SP01 means signature file
0x4 bytes certificate number: 0 = pubdevkey01.pem, 1 = pubprodkey01.pem, 2 = pubprodkey02.pem (first one does not exist, second two are same as older kindles)
0x38 byte unknown: I think this is random/garbage data. Someone test this by taking a 4.0 kindle. Downloading the 4.0.1 update, and changing the 0x38 bytes of data from offset 0x8 to 0x40 to 00 or random digits. I need to know for sure so we can ignore this space
0x100 / 0x80 byte signature depending on the size of the certificate as noted by the certificate number.

This is used to validate the second part of the file (below). If validation is passed, the next part is extracted and run.

0x4 byte update type: FC04 means signed update
... same as older updates

The new Kindle updater script also has more information on the usage of various fields of the headers and I'll be writing an updated "kindle_update_tool.py" sometime in the future.

Also, I'll be gone for the next few days or maybe a week or so, so sorry.

[bartveld]

I haven't got the faintest idea what you guys are babbling on about and am deeply impressed by it. I fervently hope you are succesful for I want a Kindle Touch as soon as it's available in my country, BUT with all the hacks I've grown used to on my old Kindle.
So please, go on babbling!

[rng29a]

Hi all, nice to see that there is already so much progress.

I made a preliminary kindle_update_tool.py with yifanlu's instructions so others can have a look at the extracted firmware:
https://gist.github.com/1318051

[NiLuJe]

Great news !

For the less adventurous, I've somewhat hacked around the packager to make it parse (at least) the 4.0.1 update, thanks to yifanlu for the details, and rng29a for the initial implementation . (Hopefully, I did it in a backwards compatible way, but I didn't verify that on a whole lot of files).

It's in the original packager thread.

[Sir Alex]

I have got rootfs for 4.0 and 4.0.1 firmwares. If somebody interested in, ask in PM.

[yifanlu]

I won't be home for a while, but on my free time, I'm planning to rewrite the kindle update tool from scratch because I don't like how some parts of it are implemented. Also, I forgot to mention how the FC04 update format works (the part after the SP01 signature):

0x4 byte header "FC04"
0x8 bytes source version (used to be 4 bytes)
0x8 bytes target version (used to be 4 bytes)
0x2 bytes number of devices supported
for each device:
0x2 bytes device id of each supported device
end for each
0x2 bytes critical update flag + 1 byte padding
0x32 byte md5 hash "munged" (dm)
0x2 bytes number of metadata
for each metadata:
0x2 bytes string length
that amount of bytes string metadata "munged" (dm)
end for each

[yifanlu]

https://github.com/yifanlu/KindleTool

Here's the new update tool that I'm writing. It's written in pure C. My first "real" experience with C. Not anywhere near done. I'm just finished with extraction and haven't touched on creation. My goal is for it to be 1) lightweight (no need to download python), 2) fast (300MB update extracted in 5 seconds. took 5 minutes with the python tool), 3) portable (hopefully will work on osx, windows, linux, and arm-linux (on the kindle itself). I know the python tool is "good enough", but I constantly find problems with it, like slow extraction times on 300mb recovery updates. I also hope that some other experienced developers can help so I'm putting it on github.

[yifanlu]

Not really anything new in terms of jailbreaking, but WHEN it's possible to jailbreak, it will be VERY EASY to modify the boot images (as we modify the screen savers now).

EDIT: To change custom bootscreens:
1) modify /var/local/java/prefs/com.amazon.ebook.framework/prefs
2) set low_level_screens.dir to any directory
3) Put images into this directory

K4 also has built in custom screensaver support
1) modify /var/local/java/prefs/com.amazon.ebook.framework/prefs
2) Add this line: "screensaver.enable.userdefined=true"
3) put your screensavers into /mnt/us/sleepscreens

Just some advice for future purposes when we jailbreak this thing.

Also, it seems like all kindles include a secondary rootfs partition for diags. This partition contains SSH and usbnetwork. However, other then using the serial port, I don't think you can reboot to this mode.

EDIT: When I posted this, I was referring to the Kindle 4, not the touch.

[NiLuJe]

Ha! Nice find!

And the screensaver stuff is in there as far back as in a Kindle 2 (at least on 2.5.x)!
It automatically tag them with the 'Slide and release power switch to wake' black bar on the bottom (at least on a K2).

Couldn't get the framework to pick up a config file from /mnt/us/system instead of /var/local/java/prefs though (just in case it might be doable *without* a jailbreak, like the alt font family).