Quote:
Originally Posted by Hellmark
Found a file of some interest at C:\Documents & Settings\usernamegoeshere\Local Settings\Application Data\Amazon\Kindle For PC\{AMAwzsaPaaZAzmZzZQzgZCAkZ3AjA_AY}\kindle.info
The bracketed folder is obviously randomly generated, and the file contains a 10kb string of similarly seemingly random generated characters. My guess, the PID is in there.
|
Yes, I found that file, too. The folder is NOT randomly generated, or if it is, the seed is always the same, because that's the exact folder name on at least two other systems, too. That's the only place I've seen that would be a likely place for the PID to be stored, but 10KB is a big area to look for an encrypted 10-byte string, especially when it's probably encrypted with fairly strong encryption. I suspect it would take some kind of "end run" to acquire the PID, such as is used to get the key for LIT files. The CONTENTS of the kindle.info file is certainly different on different machines (users), although very similar, mostly alpha characters with occasional punctuation characters thrown in.
The only characters used in the two examples I've seen are 0-9, A-Z, a-z, and hyphen, colon, underscore, and open-brace. Interestingly, there are exactly 10 open-braces and exactly 10 colons in both files AND they're all in EXACTLY the same locations in both files. A further impossible-to-be-coincidence, is the addresses (offsets into the file) at which they occur. The offsets are not consistent, but when looked at as hex values, the least significant digit increments by 2 EVERY TIME. In hex, the offsets of the '{' characters are:
0000
01E2
04F4
0686
0828
124A
13FC
160E
24B0
2652
The offsets for the ':' characters are:
0021
0203
0515
06A7
0849
126B
141D
162F
24D1
2673
Notice that the '{' offsets start with their least significant digit at 0 and that digit increments by 2 each time, while the ':' offsets start with a least significant digit of 1 and increment by 2 each time. But those 20 characters are at the exact same places in both instances of the file that I've studied.
Whether it has any bearing on anything, who knows (not enough data points, so it may be pure coincidence) but there's 10 {'s and 10 :'s in each file, at the exact same locations, and there are 10 characters in a MobiPocket PID. Very possibly coincidence, but then maybe not, too.
Another interesting curiousity: The file is, by FAR, mostly A's, Z's, a's, and z's. In kindle.info #1, there are:
1815 A's
1152 a's
1753 Z's
1299 z's
In kindle.info #2, there are:
1777 A's
1153 a's
1764 Z's
1343 z's
Those four characters account for around 60% of the file. The other 60 characters (24 uppercase, 24 lowercase, hyphen and underscore) each have a "random scattering" of between about 50 and 130 instances each.
And that's about all the time I have to spare to spend on the issue. But maybe some of this will mean something to someone else, or be of help.