Description
This how-to covers the process of manually flashing a Kindle Voyage with a rootfs image from the 5.14.1 update for PW3.
Compatibility
This how-to is ONLY applicable to KV models with 512MB of RAM. Even then, you should use caution - the PW3 rootfs boots successfully without modification but there is presumably a reason why 5.14.1 was not released for KV.
Process
Download a copy of the 5.14.1 update for PW3 and extract it using Kindletool:
Decompress rootfs.img.gz to obtain the raw rootfs.img:
Code:
gzip -d /tmp/pw3/rootfs.img.gz
Boot into diags mode from u-boot:
Code:
uboot > bootm 0xE41000
Once in diags, export the userspace partition:
Code:
usb export
Transfer rootfs.img to the device:
Code:
cp /tmp/pw3/rootfs.img /media/user/Kindle
sync
Eject the Kindle from the host PC and exit USB Export mode:
Code:
x ICE-WARIO-WFO-512 - USB EXPORT - 71
~~~~ 1.16.614.264341 ~~~~
pcbId:04XXXXXXXXXXXX
USB device exported
Once you are done
Eject the USB device from the PC then
Battery capacity 71
(Q)-to continue
(X)-Exit
x
Exit diags mode and drop to a shell:
Code:
exit login
Flash rootfs.img using DD. This will take a while to complete:
Code:
[root@[192_168_15_244] root]# dd if=/mnt/us/rootfs.img of=/dev/mmcblk0p1 bs=4096
112500+0 records in
112500+0 records out
460800000 bytes (439.5MB) copied, 95.986967 seconds, 4.6MB/s
Reboot the device - it will now boot into 5.14.1:
Code:
reboot
MrTick
12-01-2021 06:30 PM
I'm wondering (as my KV is still a serial-virgin) if we can create a FB03 (Recovery v2) update - that is designed exactly for flashing system partitions.
I'll brick... I mean I'll test it tomorrow :)
Package is there, looking at me, waiting to be flashed, but I'll be strong and resist till morning before the flashing (attempt) :D
NiLuJe
12-01-2021 07:50 PM
You'd need a patched initrd for that (c.f., @katadelos' previous post on that front ;)) (and explicitly flag the package with the right key number but our actual JB key, because I don't think the updater even supports the dev key index).
All of that *should* be doable via KindleTool, but, obviously, has never been tested (to my knowledge) ;).
Or @yifanlu's old FW-3.x-on-DXg posts/scripts, which might have been doing something of the sort way back in the day ;).
katadelos
12-01-2021 08:16 PM
Quote:
Originally Posted by NiLuJe
(Post 4177361)
You'd need a patched initrd for that (c.f., @katadelos' previous post on that front ;)) (and explicitly flag the package with the right key number but our actual JB key, because I don't think the updater even supports the dev key index).
All of that *should* be doable via KindleTool, but, obviously, has never been tested (to my knowledge) ;).
Pretty much this - once the initrd thing is out of the way, it's not particularly difficult to create a self-signed update that will successfully install. I've tested this in the past but can't find the exact KindleTool args that I used to create the update :smack:
I had a look and managed to find the script that I was using to patch recovery-util, it's just a simple find and replace:
with open("recovery-util", 'rb') as original:
original_bytes = original.read()
with open("recovery-util-patch", 'wb') as patched:
print(pubprodkey1 in original_bytes)
k1 = original_bytes.replace(pubprodkey2, jailbreak_k_2)
k2 = k1.replace(pubprodkey1, jailbreak_k_1)
patched.write(k2)
patched.close()
original.close()
MrTick
12-02-2021 04:29 AM
Quote:
Originally Posted by NiLuJe
(Post 4177361)
You'd need a patched initrd for that (c.f., @katadelos' previous post on that front ;)) (and explicitly flag the package with the right key number but our actual JB key, because I don't think the updater even supports the dev key index).
All of that *should* be doable via KindleTool, but, obviously, has never been tested (to my knowledge) ;).
Or @yifanlu's old FW-3.x-on-DXg posts/scripts, which might have been doing something of the sort way back in the day ;).
I've tested this in the past but can't find the exact KindleTool args that I used to create the update :smack:
Possibly something like -c 2? I don't recall if you actually need to supply a private key manually with this (but I don't think so. [EDIT: You don't, but keep the key length into consideration, c.f., below]), and the doc appears to be slightly incomplete in that it only mentions OTA V2, while the flag should be honored anywhere it's supported, which probably includes Recovery V2 ;p.
EDIT: Or `-c 1`, actually, unless you pass an actual custom 2K key to -k, otherwise shit happens ;).
(I also had to add -p wario, otherwise system was complaining, and the update was failing)
I've built the custom kernel according more or less to katadelos guide: https://www.mobileread.com/forums/sh...d.php?t=343310
Did my first very own kernel bricked KV?... maybe (no more serial virgin!)
Did one of the screws jumped through fourth dimension to some inaccessible universe?... I don't really want to talk about that :)
