Kindle 3.1 software for Kindle 2, 2i, & DX (under construction)

[yifanlu]

I have managed to get the Kindle 3.1 software to run on a Kindle 2. Unlike what I expected, the software runs fine with no slowdowns (it is slower then the K3, but on 2.5.8, it is also slower). I've tested the internet browser, pdf reader, audiobook reader, etc. Everything works just as it does on the Kindle 3.

There are TWO things you can do to help test.

Kindles
If you have a broken/unwanted Kindle that you can donate for science, PM me. I'm looking for K2i, DX, DXi, DXGs.

Beta Test
You can also help beta test the packages. Installation directions are found in README.txt. Recovery directions are also in there. With my custom kernel, you do not need TTL access to recover from most errors. This also makes your Kindle mostly brick-proof. Please post the logs found in the output folder after you use this even if everything went well.

YOU MUST PROVIDE ME WITH LOGS IF YOU WANT HELP/SUPPORT, OTHERWISE I HAVE NO IDEA WHAT'S WRONG!!! (sorry about the annoying text, but NOBODY seems to understand this fact.)

Confirmed Working
Kindle 2 US
Kindle 2 International
Kindle DX US
Kindle DXG

I need someone to test Kindle DX international.

Known Bugs
-Sound fuzzy sometimes
-Active content doesn't work

Demo
http://www.youtube.com/watch?v=OMFIYSGLz4M

Changelog
1.0:
-Same as beta 4, just removed the beta.
Beta 4:
-Better logging, all output redirected to log
-Better "save old files" method. Using the rsync --delete option instead of taring up old files and copying them back. Should save some time.
Beta 3:
-Using rsync instead of cp for better memory management and speedups in the update maker
-Fixed no 3G bug on DX
-Fixed no USB bug on DX
-Fixed web browser on DX
-Removed "NO_TTS" option, no longer needed
Beta 2:
-New package generator, allows easy extendibility
-Factory reset on first boot
-Fixed some bugs
Beta 1:
-Initial release

Download
http://yifan.lu/p/kindleupdater

[montalex]

Boy, Yifanlu, I really wish I could help with this! I am afraid I lack the skills to be of assistance, but I am really excited about your work, and can't wait to give it a try on one of my 2 Kindle 2's. As I wrote elsewhere, I really like the Kindle 2 for its sturdy construction and full keyboard, so I bought a 2nd (reconditioned) one. This way, if I mess something up, I have a backup.

[yifanlu]

Progress report:
One of the things I want to do is allow the Kindle to create it's own update. So the Kindle 3 can generate the Kindle 2 update using its own files. (Otherwise, you have to copy all the files from the K3 to your computer and make an update with kindle_update_tool.py). The hard thing about creating a K3 update is Amazon's "encryption" method (left shift 4 OR right shift 4 & 0xff ^ 0x7a). Igor wrote the nice kindle_update_tool.py, but it would be stupid to port python to Kindle just for this one thing. So what I did was disassemble amazon's "dm" (decrypt update) and modified it to a new file "md" (encrypt update). Here's the changes

DM (from Amazon, comment by me):

		BL	getchar // get byte to modify
		EOR	R3, R0,	#0x7A // R3 = R0 ^ 0x7A
		CMN	R0, #1 // if !(R0 == 1), we are at the end of the file ...
		MOV	R0, R3,LSR#4 // R0 = R3 >> 4
		AND	R0, R0,	#0xF // R0 = R0 & 0xF
		ORR	R0, R0,	R3,LSL#4 // R0 = R0 | R3 << 4
		BNE	loc_8470 // ... then jump to end of program
		MOV	R0, #0 // clear R0 register
		ADD	SP, SP,	#4 // don't care
		LDMFD	SP!, {PC} // don't care

MD (by me, comment by me):

		BL	getchar // get byte to modify
		CMN	R0, #1 // if byte is 0x01, then ...
		MOV	R3, R0,LSR#4 // set R0 to R0 >> 0x4
		AND	R3, R3,	#0xF // set R4 to R4 & 0xF
		ORR	R3, R3,	R0,LSL#4 // set R3 to R3 | ( R0 << 0x4 )
		EOR	R0, R3,	#0x7A // set R0 to R3 ^ 0x7A
		BNE	loc_8470 // ... exit program
		MOV	R0, #0 // clear register R0
		ADD	SP, SP,	#4 // don't care
		LDMFD	SP!, {PC} // don't care

Now we can create updates from the Kindle directly.

If you want to try it out, here's the patch from dm to md: http://yifan.lu/files/md.bspatch

MD5 values:
dm: 6725ac822654b97355facd138f86d438
md.bspatch: 64404f7f82b0a1ba3561cdf12e9cbd18
md: 3b650bcf4021b41d70796d93e1aad658

Usage: bspatch /path/to/dm md /path/to/md.bspatch

You can play around with encryption, decryption by:
echo 'hello world' | md > hello.bin
cat hello.bin | dm
You should see you message back.


EDIT: Here's a script that will run on the Kindle and convert a tar.gz into an update package http://pastebin.com/2L4pqhsw

[troyme]

Can the 3.1 software run in the linux chroot mode ???
If it can , then all will be much easy.

[yifanlu]

The problem is that 3.1 is completely different starting with the init scripts and low level binaries. It may be possible to do a "soft" reboot, but the OS is 500MB, and that's 1/3 of the userstore.

Also progress update: I've finished writing all the installation and package creation scripts. However they are completely untested. I plan to test this weekend.

[bZkindle]

And they said it wasn't possible! Incredible stuff yifanlu!

[Caleb666]

I know this is offtopic, but this just goes to show that Amazon really did screw their DX customers.

[montalex]

If I were to install 3.1 on my Kindle 2i, would that mean that I would have to use jailbreaks and hacks meant for Kindle 3? How would that work?

[yifanlu]

Originally Posted by montalex

If I were to install 3.1 on my Kindle 2i, would that mean that I would have to use jailbreaks and hacks meant for Kindle 3? How would that work?

No, you still use hacks for kindle 2. Just make sure it works.

[troyme]

Originally Posted by yifanlu

No, you still use hacks for kindle 2. Just make sure it works.

Could you please first release the version 3.1 rootfs img got by dd ????
then I can see what's new in it and play with.

[yifanlu]

Originally Posted by troyme

Could you please first release the version 3.1 rootfs img got by dd ????
then I can see what's new in it and play with.

If you have recovery access and would like to beta test, pm me.

[yifanlu]

Another progress update. The installer is 2/3 complete. Currently, I am able to create a recovery package directly on the Kindle. The process currently is:

1) Copy "update_make_image.bin" to Kindle 2
2) Generates "output/update_recover_k2_os.bin" and "output/rootfs.img" and also installs recovery kernel. Copying "update_recover_k2_os.bin" to the root and you can restore your Kindle to whatever it was before.
4) Copy rootfs.img and update_make_image.bin to Kindle 3
5) Kindle 3 takes rootfs.img and generates "update_k2_os.bin" which will install Kindle 3.1 when you copy it back to the Kindle 2.

[yifanlu]

It's done! Well, sort of. It's done, but untested. I'm going to release the first alpha, but here are the current limitations:

-ONLY supports upgrading Kindle 2 US 2.5.8 to 3.1 using a Kindle 3 3G 3.1 (All conditions version, model, etc must be met)
However, you can easily change the code to support other versions/models, but I want to concentrate on getting one thing right at a time. I made sure no model/version specific code exists, so you can rename stuff to produce other packages, but if you are knowledged enough to do this, I don't need to give directions.
-Slow. It WILL take 2 hours. Luckly, you don't have to stare at it. Just keep it charged.
-You need 900MB of free space on the Kindle 2.
-You need 1.2GB of free space on the Kindle 3.
-Make sure to back up your Kindle 2!!!

DO NOT PROCEED UNLESS YOU KNOW HOW TO RECOVER! I TRY TO MAKE IT BRICK PROOF, BUT IT IS UNTESTED

To use:
1) Copy "update_k2_2.5.8_prepare_kindle.bin" to your Kindle 2 US. It must be version 2.5.8 (555370010)
2) Run the updater. The updater will create a rootfs image and a backup recovery package (for restoring beck to 2.5.8). It will also flash the patched recovery kernel for running unsigned recovery packages. This will take around 45 minutes to complete (the compression takes the most time).
3) After the updater completes, connect the kindle 2 to the computer and open up the folder "output" on the usb drive. You'll find two files: update_restore-k2-os.bin and rootfs.img. Keep update_restore-k2-os.bin safe, as you need that to restore 2.5.8.
4) Copy rootfs.img from the Kindle 2's output folder and "update_k3g_3.1_create_updater.bin" from the download to the root of the Kindle 3's usb partition.
5) Run the update. This will take about an hour. Do NOT interrupt!
6) After that completes, connect your Kindle 3 back to your computer and you'll find "update_k2-os.bin" and "tts-files.tar" in the output folder.
7) Copy those two files to the root of the Kindle 2 (you can delete the output folder from Kindle 2)
8) Restart your kindle 2 and it'll update.

NOTES:
-Check the log files in the output folder to see what steps completed (if it fails)
-The kindle will display progress and error messages on the lower right hand corner of the screen.
-If you do not want to flash the recovery kernel because you flashed it before (recovery kernel is REQUIRED for upgrading), create a file named "NO_KERNEL" on the root of the USB partition.
-If you want to skip file checks, create a file named "NO_VALIDITY_CHECKS" on the root of the USB partition to bypass the md5 checks.

[tekkasit]

yifanlu, I just confused with the following statement.

1. That means I need to have Kindle 3 and 2, right?

2. How to uninstall or undo this thing on Kindle 2 (including remove the backup recovery package)? Because I afraid that if I feel doesn't like software v3.1 for what ever reason, I can't revert back my K2 to the original state.

3. After the upgrade K2 to run v3.1 software, what will happen if Amazon release an update of K3 software?

[troyme]

Originally Posted by tekkasit

yifanlu, I just confused with the following statement.

'-You need 1.2GB of free space on the Kindle 3.'

Because you need a working k3 to extract the 3.1 software