Tutorial WatchThis - Software Jailbreak for any Kindle <= 5.14.2

[Mari123]

Originally Posted by katadelos

AKA CVE-2022-23224, CVE-2022-23225, CVE-2022-23226 - full writeup with technical details to be released after 5.14.3 has been widely rolled out.

Thank you to NiLuJe, yparitcher and darkassassinua for adding KOReader support for PW5, repackaging all of the hacks and testing this jailbreak

This vulnerability is released in good faith and in the hope that other security researchers will utilise the access that it provides to assist Amazon/Lab126 in improving their security posture.

If you're concerned about the security of your device and do not wish to jailbreak, install firmware version 5.14.3 from this link - I've been working with Amazon to create a fix and can confirm that this version has been hardened against this vulnerability.

Additional thanks to everyone at Amazon/Lab126 who contributed towards this .

Finally, I encourage Amazon/Lab126 to provide a method of unlocking their devices that doesn't involve the need of a 0-day, both for security researchers and for technical users who are interested in modifying their devices. We know that your employees lurk here, use tools that we've created internally and that our ideas have been implemented by you more than once, so help us help you - I promise that we don't bite

Device Compatibility

Spoiler:

This jailbreak is compatible with Kindle devices running the following firmware versions:

KT3, KT4, KOA1, KOA2, KOA3, PW3, PW4, PW5:
5.14.2
5.14.1 (5.14.1.1 on PW5)
5.13.7
5.13.6
5.13.5
5.13.4

KV:
5.13.6
5.13.5
5.13.4

KT2, PW2:
5.12.2.2

You must use the exploit payload that matches your device/firmware combination exactly.

Download Link
watchthis-jailbreak-r03.zip


Installation
Please ensure that you have read the entirety of the instructions before proceeding.

Setup

1. Factory reset the device. Make sure to use the "en_GB" or "English (United Kingdom)" locale when setting the language.
2. Type ;enter_demo in the Kindle search bar after performing a factory reset
3. Reboot the device
4. Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted.
5. Skip searching for a demo payload
6. Select the "standard" demo type
7. Press "Done" at the prompt to sideload content. Do not sideload the jailbreak at this stage.
8. Once the demo is setup, skip the misconfiguration lockout using the "secret gesture" (double finger tap on bottom right of screen then swipe left)
9. Enter the demo configuration menu by typing ;demo into the search bar
10. Select the "Sideload Content" option

Jailbreak

1. Connect the device to a PC and:
2. Create the directory .demo at the root of the Kindle storage
3. Copy ${YOUR_DEVICE}-${YOUR_FW_VERSION}.zip to .demo/
4. Copy demo.json to .demo/
5. Create an empty folder at .demo/goodreads. Do not put any files in this folder.
6. Press "Done" at the prompt to install the jailbreak script
7. Exit the demo menu and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
8. If an application error occurs, hard reboot the device by holding the power button, enter the demo menu again and select Sideload Content -> Done once more without connecting to USB
9. Select "Help & User Guides" then "Get started"
10. If jailbreaking KT2 or PW2, select the store button instead
11. The device will reboot
12. The jailbreak script will run during the next boot

Post Jailbreak

1. After the device has rebooted, type ;uzb into the search bar
2. Connect the device to a PC and copy Update_hotfix_watchthis_custom.bin to the root of the Kindle storage
3. Eject the device and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
4. Select Update Your Kindle to install the custom hotfix
5. This will take your device out of demo mode, rebuild the application registry and clean up unneeded jailbreak files.

Troubleshooting

• Alternative Demo Mode entry method:
  • Create an empty file named DONT_CHECK_BATTERY at the root of the Kindle USB storage
  • Activate demo mode by typing ;demo into the search bar
  • Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted
• If you need to reset your device whilst in Demo Mode, enter ;uzb in the search bar to enable USB storage mode then create an empty file named "DO_FACTORY_RESTORE" at the root of the Kindle storage. Once this has been created, reboot the device.
• Video demonstration of secret gesture

You should now have a freshly jailbroken Kindle

Okay, so at this part
Create an empty folder at .demo/goodreads. Do not put any files in this folder.
Do you mean I should create a folder named goodreads inside the .demo folder?

[Mari123]

Originally Posted by katadelos

AKA CVE-2022-23224, CVE-2022-23225, CVE-2022-23226 - full writeup with technical details to be released after 5.14.3 has been widely rolled out.

Thank you to NiLuJe, yparitcher and darkassassinua for adding KOReader support for PW5, repackaging all of the hacks and testing this jailbreak

This vulnerability is released in good faith and in the hope that other security researchers will utilise the access that it provides to assist Amazon/Lab126 in improving their security posture.

If you're concerned about the security of your device and do not wish to jailbreak, install firmware version 5.14.3 from this link - I've been working with Amazon to create a fix and can confirm that this version has been hardened against this vulnerability.

Additional thanks to everyone at Amazon/Lab126 who contributed towards this .

Finally, I encourage Amazon/Lab126 to provide a method of unlocking their devices that doesn't involve the need of a 0-day, both for security researchers and for technical users who are interested in modifying their devices. We know that your employees lurk here, use tools that we've created internally and that our ideas have been implemented by you more than once, so help us help you - I promise that we don't bite

Device Compatibility

Spoiler:

This jailbreak is compatible with Kindle devices running the following firmware versions:

KT3, KT4, KOA1, KOA2, KOA3, PW3, PW4, PW5:
5.14.2
5.14.1 (5.14.1.1 on PW5)
5.13.7
5.13.6
5.13.5
5.13.4

KV:
5.13.6
5.13.5
5.13.4

KT2, PW2:
5.12.2.2

You must use the exploit payload that matches your device/firmware combination exactly.

Download Link
watchthis-jailbreak-r03.zip


Installation
Please ensure that you have read the entirety of the instructions before proceeding.

Setup

1. Factory reset the device. Make sure to use the "en_GB" or "English (United Kingdom)" locale when setting the language.
2. Type ;enter_demo in the Kindle search bar after performing a factory reset
3. Reboot the device
4. Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted.
5. Skip searching for a demo payload
6. Select the "standard" demo type
7. Press "Done" at the prompt to sideload content. Do not sideload the jailbreak at this stage.
8. Once the demo is setup, skip the misconfiguration lockout using the "secret gesture" (double finger tap on bottom right of screen then swipe left)
9. Enter the demo configuration menu by typing ;demo into the search bar
10. Select the "Sideload Content" option

Jailbreak

1. Connect the device to a PC and:
2. Create the directory .demo at the root of the Kindle storage
3. Copy ${YOUR_DEVICE}-${YOUR_FW_VERSION}.zip to .demo/
4. Copy demo.json to .demo/
5. Create an empty folder at .demo/goodreads. Do not put any files in this folder.
6. Press "Done" at the prompt to install the jailbreak script
7. Exit the demo menu and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
8. If an application error occurs, hard reboot the device by holding the power button, enter the demo menu again and select Sideload Content -> Done once more without connecting to USB
9. Select "Help & User Guides" then "Get started"
10. If jailbreaking KT2 or PW2, select the store button instead
11. The device will reboot
12. The jailbreak script will run during the next boot

Post Jailbreak

1. After the device has rebooted, type ;uzb into the search bar
2. Connect the device to a PC and copy Update_hotfix_watchthis_custom.bin to the root of the Kindle storage
3. Eject the device and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
4. Select Update Your Kindle to install the custom hotfix
5. This will take your device out of demo mode, rebuild the application registry and clean up unneeded jailbreak files.

Troubleshooting

• Alternative Demo Mode entry method:
  • Create an empty file named DONT_CHECK_BATTERY at the root of the Kindle USB storage
  • Activate demo mode by typing ;demo into the search bar
  • Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted
• If you need to reset your device whilst in Demo Mode, enter ;uzb in the search bar to enable USB storage mode then create an empty file named "DO_FACTORY_RESTORE" at the root of the Kindle storage. Once this has been created, reboot the device.
• Video demonstration of secret gesture

You should now have a freshly jailbroken Kindle

Okay, I have the right kindle and firmware. The problem is, when I'm jailbreaking, there is this problem of pressing store, and something popping up that Wifi is locked instead of rebooting. I succeeded in entering demo, sideloading. I made a folder named '.demo'(without the ''), and added the right zip file and the .json file. Afterwards, I made a folder named 'goodreads'(without the ''). I ejected kindle, pressed done, entered ;dsts into the search bar and pressed the store. Nothing happened except a wifi locked pop up. What should I do?

[oldman20]

I success the first time, but now I trying again, at step "Update Your Kindle" is grayout! How can pass demo mode?

[oldman20]

Originally Posted by dhdurgee

I would suggest that you install the rename OTA binaries KUAL extension and use it to disable "automatic" updates before you exit airplane mode. At present firmware updates can be handled by the JB, but there is no guarantee that will continue in the future. With the KUAL extension installed you can manually control when and which firmware updates are applied.

Dave

is it still working properly in 5.14.2? How to use it? thank! like OTA Block?

[oldman20]

Originally Posted by dhdurgee

Get the rename OTA binaries extension for KUAL and use it to prevent an upgrade without your action.

Dave

how to use it? pls

[oldman20]

Which fine should install in Kindle OA2? Update_KUALBooklet_hotfix_v2.7.29_install.bin ỏr Update_KUALBooklet_v2.7.29_install.bin

[JackProject]

Hello,

I have a KT2, i managed to JB it, but i want to use calibre to create collections from my PC, for easier management, but for the life of me i cannot understand the instructions

I think i need to install Librarian Sync:
https://www.mobileread.com/forums/sh...d.php?t=245691

But i need to install some additional stuff, but thats where i get stuck

Anyone willing to help?
I see i need to install first MKK:
https://www.mobileread.com/forums/sh...d.php?t=233932

But i cannot find the update file for my KT2.

[vurt]

@katadelos Thank you so much

My KV is on 5.13.6, waited a while for this. I'd pretty much given up.

Finally got KOReader on the Kindle.

[tucker13234]

Is there any way to downgrade OS on 5.14.3.0.1 PW3?

I don't even care about the jailbreak, I just genuinely despise new UI. Is there a factory reset to original firmware?

[j.p.s]

Originally Posted by tucker13234

Is there any way to downgrade OS on 5.14.3.0.1 PW3?

Yes, via jailbreak with, say, popcorn:
https://www.mobileread.com/forums/sh...d.php?t=345655
Then install hotfix, download and install desired firmware,, then reapply hotfix because you never know when you might need jailbreak again. You proably then want to install KUAL and the rename ota binaries extension to prevent another update.

I don't even care about the jailbreak, I just genuinely despise new UI. Is there a factory reset to original firmware?

No.

[expeditionunknow]

does jailbreaking a kindle prevents auto update?

[Name28]

Hello,

I have PW3, firmware version 5.13.7. Yesterday I did jailbreak to my paperwhite, installed Koreader, etc. Thank you, all works great so far.
I have some questions:
1. I have also installed "Update_hotfix_watchthis_custom.bin" from this topic. Does this mean my jailbreak survives if autoupdate occurs? Or should I install some other hotfixes? I mean, even after update I would be able to jailbreak it again.
2. Is there any way to block autoupdates? I usually set Autopilot mode on, but when I need to copy new books or articles, I turn wi-fi on. I plan to use both Koreader and native app, if it is important.

Thank you.
Best regards,

[dhdurgee]

Originally Posted by expeditionunknow

does jailbreaking a kindle prevents auto update?

No. There are only two ways with the current firmware to prevent this:

1) keep the kindle in airplane mode, or never configure WiFi, and side load

2) Install KUAL and the renameotabinaries extension and use it

Keep in mind that 2 above is true at the current firmware level. That might change in the future, so be cautious about upgrading firmware.

Dave

[tucker13234]

Thank you very much for the reply, I appreciate it.

[_Calculated_]

Can someone point me in the right direction with respect to getting a supported firmware (5.13.2 not supported?) onto my device.

Kindle Paperwhite 3 (2015) 
7th  PW3
Kindle Version 5.13.2

(Sorry, I'm sure this has been answered in the thread but I am paranoid about doing something wrong with this step.)

Really appreciate what you guys are doing <3.