Kindle 3 FS Image?

[mpercy725]

Anyone have some information about how to image the entire Kindle over ssh? I am able to dd over ssh just fine, but dd doesn't work on directories. I want everything from / up.

Here is the command I use for dd over ssh:

ssh root@myk.ind.les.IP "dd if=/dev/mmcblk0*" | dd of=/home/username/image.dd bs=1024


Ideally I'll be able to do this directly from a Windows machine eventually (I've tried using a variety of methods, eg PuTTY and WinSCP, problem is that dd isn't a Windows command so it can't output correctly). Currently I'm working with Ubuntu in a VM then just copying the image file wherever I need in Windows.

Any information about imaging an entire Linux machine, FS and all, from Windows or Linux would be great, thanks!

[kranu]

For Windows, you would just put the output file on the Kindle itself. Then copy it over via USB.

[mpercy725]

Yeah, I was able to do that. Only problem is that typically a full image won't fit in the free space on a regularly-used Kindle, and writing information to the device could overwrite necessary information. The latter is the bigger problem, as we are trying to do this in a forensic capacity and overwriting unallocated space can mean losing potentially useful information. Looks like we'll have to stick to using a Linux VM, thanks!

[yifanlu]

Try

ssh root@myk.ind.les.IP "dd if=/dev/mmcblk0" | dd of=/home/username/image.dd

The * is pointless because mmcblk0 is the whole NAND.

[mpercy725]

I specified the * because I do mmcblk0, 0p1, 0p2, 0p3, and 0p4 all separately. So is imaging these files actually imaging the whole thing?

[hawhill]

But in combination with the "if=" syntax of "dd", the shell glob "*" wouldn't work. You would have to issue each of these seperately, globbing does not work here.

As yifanlu wrote, there's no need to image the partitions (...p<n>) if you already have an image of the full device (mmcblk0). It already is what you call "the whole thing", a full image of the flash block device. When you use "fdisk" on it, you should see the partitions. If you want to loop-mount single partitions on the desktop, you could e.g. use the "offset" option of losetup or mount.

Besides using linux for this, another option would be to do it on the windows command line. You don't have to use a pipe into "dd", redirecting output to a file is sufficient. So if you have a SSH cli client (e.g. openssh, putty's plink or similar), you can do "ssh root@kindle dd if=/dev/mmcblk0 > kindle.img" and it should work (cannot test, since no Windows installation).

[PoP]

Originally Posted by hawhill

So if you have a SSH cli client (e.g. openssh, putty's plink or similar), you can do "ssh root@kindle dd if=/dev/mmcblk0 > kindle.img" and it should work (cannot test, since no Windows installation).

indeed:

Microsoft Windows [version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tous droits réservés.

E:\

E:\>cd z

E:\z>ls mmcblk0.img
ls: cannot access mmcblk0.img: No such file or directory

E:\z>ssh root@10.0.0.30 dd if=/dev/mmcblk0 > mmcblk0.img


Welcome to Kindle!


7815168+0 records in
7815168+0 records out

E:\z>ls -all mmcblk0.img
-rwxrwxrwx+ 1 User None 4001366016 2011-05-18 13:34 mmcblk0.img

E:\z>

[mpercy725]

I haven't been globbing it. The reason I've done each separately is because for some reason I find different information in the final partition, mmcblk0p4. The data seen on C in mmcblk0 and mmcblk0p4 are drastically different. Thoughts why this might be?

That Windows command will be very useful, thanks!

[yifanlu]

Originally Posted by mpercy725

I haven't been globbing it. The reason I've done each separately is because for some reason I find different information in the final partition, mmcblk0p4. The data seen on C in mmcblk0 and mmcblk0p4 are drastically different. Thoughts why this might be?

That Windows command will be very useful, thanks!

mmcblk0p4 is the vfat partition, aka, the USB drive where you copy all your books to.

[PoP]

Originally Posted by mpercy725

The data seen on C in mmcblk0 and mmcblk0p4 are drastically different. Thoughts why this might be?

Further to hawhill suggestion to use the "offset" option and to yifanlu highlighting that mmcblk0p4 is the vfat partition I thought I would illustrate:

The partitions:

# set up the loop device to the whole block device of the Kindle:
user$  sudo losetup /dev/loop0 /media/usb/mmcblk0.img

#show the partition table:
user$  sudo fdisk -l -u /dev/loop0

Disque /dev/loop0: 4001 Mo, 4001366016 octets
4 têtes, 16 secteurs/piste, 122112 cylindres, total 7815168 secteurs
Unités = secteurs de 1 * 512 = 512 octets
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Identifiant de disque : 0x489339d6

Périphérique Amorce  Début        Fin      Blocs     Id  Système
/dev/loop0p1   *        7688     1338943      665628   83  Linux
/dev/loop0p2         1338944     1388095       24576   83  Linux
/dev/loop0p3         1388096     1404479        8192   83  Linux
/dev/loop0p4         1404480     7815167     3205344    b  W95 FAT32

And after converting to byte offsets for each partition:
512 * 7688 = 3936256
512 * 1338944 = 685539328
512 * 1388096 = 710705152
512 * 1404480 = 719093760

Partition1 (contains the read only file system of the Kindle):

	
user$  sudo losetup -o 3936256 /dev/loop0 /media/usb/mmcblk0.img
user$  sudo mount /dev/loop0 mmc0
user$  cd mmc0
user/mmc0$ ls
bin  dev  etc  lib  linuxrc  mnt  opt  proc  sbin  sys  test  tmp  usr  var

Partition2 (contains the writeable file system of the Kindle):

user$  sudo losetup -o 685539328 /dev/loop0 /media/usb/mmcblk0.img
user$  sudo mount /dev/loop0 mmc0
user$  ls mmc0
audio  browser  eink  java  linkfonts  log  run  system

Partition4 (contains an embedded disk image of the /mnt/us user store of the Kindle):

user$  sudo losetup -o 719093760 /dev/loop0 /media/usb/mmcblk0.img
user$  sudo fdisk -l -u /dev/loop0

Disque /dev/loop0: 3282 Mo, 3282272256 octets
4 têtes, 16 secteurs/piste, 100167 cylindres, total 6410688 secteurs
Unités = secteurs de 1 * 512 = 512 octets
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Identifiant de disque : 0x00000000

Périphérique Amorce  Début        Fin      Blocs     Id  Système
/dev/loop0p1              16     6410687     3205336    b  W95 FAT32

Finaly, calculating the additional byte offset to skip the partition table of the embedded image, over to the vfat file system itself
719093760 + 512 * 16 = 719101952

user$  sudo losetup -o 719101952 /dev/loop0 /media/usb/mmcblk0.img
user$  sudo mount /dev/loop0 mmc0
user$  cd mmc0
user$  ls
audible              EuropeanPlus.keyb  linkss            screensaver-timeout
autorun.inf          fbKindle           local             shellinabox
bozohttpd            helloworld         md                sstimeout
CdcApplication1      keybru             metadata.calibre  system
configgz             keystore           mplayer           tcc
developer            kimesg             music             tcpdump
documents            kindle.ico         nano              TTSMod
driveinfo.calibre    KiTerm             nb                usbnet
dumbfrotz            linkfonts          pictures
ENABLE_HACK_UPDATES  linkjail           screen

Hope this helps

[hawhill]

PoP: Great additional info, I've just been too lazy to illustrate it properly. Thanks for filling in the blanks :-)

[mpercy725]

PoP: What were you using when you did this? When I use SSH or Telnet into the Kindle to try it I am unable to use losetup. Your illustration of this is fantastic, I'm really excited to be able to get the VFAT FS image. If you could elaborate on your process of getting to the point of being able to mount the VFAT this way that would be great.

Thanks so much everyone, all the information is really useful!

[mpercy725]

Scratch that- I figured out how to get losetup working. Now the only problem is that when I use the offset option it tells met that the file is too big.

[PoP]

Originally Posted by mpercy725

PoP: What were you using when you did this?

Post #7 was done on a windows 7 machine where I installed cygwin (for ssh and ls).

The more serious Post #10 was done on a linux (Ubuntu 11.04) virtual machine where I brought the mcblk0.img on a USB stick.

Have fun.