KindleDrip — From Your Kindle’s Email Address to Using Your Credit Card

[tryol]

Anybody with a non-jailbroken device between 5.11.1-5.13.3? I'd need one last test before publishing the thread. No risks of harming your device, I promise.

Please PM if you can help!

Edit: No need anymore!

[hius07]

One more version missed in the table: the latest 5.12.2.1.1 exclusive for PW2, KT2.

[tryol]

Originally Posted by hius07

One more version missed in the table: the latest 5.12.2.1.1 exclusive for PW2, KT2.

I added it to the list, ty!

[tryol]

Thanks to j.p.s, I found out that 5.10.3 also belongs to this first firmware group, meaning that instead of 5.11.1, now 5.10.3 is the lowest supported version.
My script that downloads and analyses the different firmware versions didn't download that version for some reason, but after I manually did, it categorized it in the first group. It's already been tested and confirmed to be working.

Now if I can fix up the jailbreak code, (which I was told is semi-outdated even though it worked for every version we've tested it on) I'll make the thread.

[melksnor]

Originally Posted by tryol

This looks promising, maybe finally a way to jailbreak KOA3?!
I hope somebody'll be able to make make some kind of an ultimate jailbreak ebook / image!

You came a long way! Will you have some snazzy name for the new jail break?

[tryol]

Originally Posted by melksnor

You came a long way! Will you have some snazzy name for the new jail break?

I've been referring to it as KindleBreak, which is a big name considering that it's only of the 10s of jailbreak methods, but since almost all the devices are supported, I think it's fair.

I'm not really attached to it so I'm open to ideas. KindleBreak will remain as a project name either way because I'm not planning on touching the shellcode - which has references to the name - ever again.

Edit: Welp, seems like everything is finalized now, including the name.

[jp12323]

Originally Posted by tryol

I'm not sure what I'd write about because Yogev Bar-On's Medium post in the OP already explains how the exploit works. It only took this long to make because of my inexperience.

75% of the time I've spent on making this was basically studying stuff I didn't know. I had to learn IDA and Ghidra to reverse engineer the binaries/libraries. I had to deepen my knowledge on memory management. I also learned how to write shellcodes on different CPUs, how ELF files work, etc.

The other 25% was spent on reproducing what Yogev documented, and figuring out some of the details in the places where they - probably intentionally - left some things out.

I had a feeling that the researchers left some details out of the article, probably at Amazon's request.

I know how long it takes to just do one part of what you did (the reversing/ida part, especially if you don't know which version of the libs to reverse). But you took the time to learn about reverse engineering, elf files, writing shell code, and the overall JPEG XR reference code. Major props

Appreciate all the time and effort you put into this

[tryol]

Originally Posted by jp12323

I had a feeling that the researchers left some details out of the article, probably at Amazon's request.

I know how long it takes to just do one part of what you did (the reversing/ida part, especially if you don't know which version of the libs to reverse). But you took the time to learn about reverse engineering, elf files, writing shell code, and the overall JPEG XR reference code. Major props

Appreciate all the time and effort you put into this

The reverse engineering part was the hardest by far. I expected the shellcode to be the most difficult but it's actually pretty easy if you have basic assembly knowledge.

The thread is up now!

I'd like to thank everybody here who helped with this. All the testers and people who contributed with tips and suggestions, you are the best!

[hius07]

Thank you very much!

[katadelos]

Originally Posted by tryol

I've ran the script, rebooted, checked that both binaries are renamed and they have no processes running.

I put the update file to usb-root, the update kindle button was still grayed out.
I restarted my device and it updated itself to 5.12.4 again succesfully, so it seems like those binaries don't block updates.

Also, I answered your a PM if you didn't notice.

This behaviour is caused by recovery-util, a binary within the initramfs of stock kernels. As you've noticed, it's capable of acting as a secondary update mechanism even when the main OTA update binaries have been removed or otherwise disabled.

The nuclear option of dealing with it is to build your own kernel from the kernel sources - IIRC this doesn't have an noticeable impact on the boot process because the initramfs is optional in the first place and U-Boot passes the rootfs partition to the kernel as part of the command line parameters.

That said, recovery-util can be useful for bootstrapping a borked kindle if you have serial access so it might be worth leaving it in place and using some form of iptables based DNS blocking instead.

[tryol]

Originally Posted by katadelos

This behaviour is caused by recovery-util, a binary within the initramfs of stock kernels. As you've noticed, it's capable of acting as a secondary update mechanism even when the main OTA update binaries have been removed or otherwise disabled.

The nuclear option of dealing with it is to build your own kernel from the kernel sources - IIRC this doesn't have an noticeable impact on the boot process because the initramfs is optional in the first place and U-Boot passes the rootfs partition to the kernel as part of the command line parameters.

That said, recovery-util can be useful for bootstrapping a borked kindle if you have serial access so it might be worth leaving it in place and using some form of iptables based DNS blocking instead.

That explains things, thanks for your insight! I don't think I want to go that far, I'll just check the OTA binaries and make sure that they really are the only way for amazon to download updates.

[j.p.s]

Originally Posted by ilovejedd

I think the last 5.10 (works with update.bin.tmp.partial folder blocker), last 5.11 (works with /var/local/system/SKIP_UPDATE_CHECK file) then going straight to 5.13.3 and skipping 5.12 would be the best options to support.

Why is 5.13.3 less bad than 5.12.x WRT unwanted FW updates?

[ilovejedd]

Originally Posted by j.p.s

Why is 5.13.3 less bad than 5.12.x WRT unwanted FW updates?

Not less bad. OTA update issues are the same on either.

Just less work to do just in case the offsets are different for each firmware version and tryol had to check compatibility one-by-one.

[doctoralvarez]

how could I check if I installed correctly the jb hotfix?

[NiLuJe]

By looking at the screen during the install: if it succeeded, well, it succeeded .