MobileRead Forums - View Single Post - [Progress] Jailbreaking Kindle 4.0 (Touch/No Keyboard)

yifanlu · 12-10-2011, 02:32 PM

I've posted this in the IRC, but I'm listing this here just for archival and searching purposes.

The Kindle Touch's update system has a very annoying bug. The new new update format, each package is allowed to insert metadata into the header. The format is 0x2 byte number of meta-strings, then for each string, 0x2 byte for length of string followed by the string (without a null terminator). The problem is that Amazon themselves don't know if the length of the string is little endian or big endian. In libotacheck.so (which runs in the background and deletes invalid updates so you can't even run them from the menu), it assumes the length is little endian (like all other data in the file). Meanwhile, "bundlefuncs", which is called by otaup to extract and run the update assumes it is big endian. This means if I say my string is 0x10 bytes long, libotacheck.so will check to make sure I have a 0x1000 byte string. Now, there's no problem if I my file is big enough because right after the metadata is the actual update file (and currently, there is no use for metadata), however, if I have a small update package that is less than 0x1000 bytes, it will libotacheck.so will delete it automatically before you can even tap on "Menu", "Settings" and "Update your Kindle". If you assume it's little endian, then the updater itself will look for a 0x1000 byte string and fail. Also, while we're on the subject, all meta-strings must be in the format of "key=value", if you forget the = sign, libotacheck.so will kill it.

Now what's the point of this? Currently, none. Amazon does not use the metadata values. I was hoping to make use of it for a future packaging system and store version information and such. Also, if anyone from Amazon is reading this, you're welcome.

12-10-2011, 02:32 PM	#238
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	I've posted this in the IRC, but I'm listing this here just for archival and searching purposes. The Kindle Touch's update system has a very annoying bug. The new new update format, each package is allowed to insert metadata into the header. The format is 0x2 byte number of meta-strings, then for each string, 0x2 byte for length of string followed by the string (without a null terminator). The problem is that Amazon themselves don't know if the length of the string is little endian or big endian. In libotacheck.so (which runs in the background and deletes invalid updates so you can't even run them from the menu), it assumes the length is little endian (like all other data in the file). Meanwhile, "bundlefuncs", which is called by otaup to extract and run the update assumes it is big endian. This means if I say my string is 0x10 bytes long, libotacheck.so will check to make sure I have a 0x1000 byte string. Now, there's no problem if I my file is big enough because right after the metadata is the actual update file (and currently, there is no use for metadata), however, if I have a small update package that is less than 0x1000 bytes, it will libotacheck.so will delete it automatically before you can even tap on "Menu", "Settings" and "Update your Kindle". If you assume it's little endian, then the updater itself will look for a 0x1000 byte string and fail. Also, while we're on the subject, all meta-strings must be in the format of "key=value", if you forget the = sign, libotacheck.so will kill it. Now what's the point of this? Currently, none. Amazon does not use the metadata values. I was hoping to make use of it for a future packaging system and store version information and such. Also, if anyone from Amazon is reading this, you're welcome.