Hacks Jailbreaking Unregisterable Kindle Scribe 2 (firmware 5.18.1)

[UpDryTwist]

As I wasn't able to find a clean post with this information, here's how I was able to jailbreak a Kindle Scribe 2 (unregisterable, "stuck" on the "sign up" screen, firmware version 5.18.1).

1. Preferably, set up your own access point that will allow certain sites (kindlemodding.org) but blackhole all the Amazon sites. Your AP should act like a hotspot, and trigger a login. Or, you can use any hotspot that requires a login - but be sure to fill the Kindle first, as it actively is looking to upgrade.

2. Connect to the access point. You will be prompted to log in (that's the whole point), which will open a web browser.

3. Type ;demo in the search/URL box

4. Answer "NO" when asked if you really want to enter demo mode.

... et voila, you will be at the home screen.

5. Check your version, start the web browser, and jailbreak using Vera as usual. Install KOReader.

6. Afterwards, you'll notice that it goes back to the registration screens. Exit using ;demo as above.

7. Start KOReader. Start the terminal. rm /var/local/decanter/RESUME_OOBE_FOR_OTA

8. Exit out and reboot.

You should be operating normally, now. (At any rate, as a reader; haven't figured out how to get the pen working, yet.)

[mergen3107]

Pen works, but not in Notebook - which is guarded by registration.

Only question is that there is no alternative yet to actually write with pen.
Someone reported that this plugin to annotate books in KOReader works on KS1, although the plugin is designed for Kobo

[mergen3107]

https://github.com/mysticknits/pencil.koplugin

[UpDryTwist]

Actually, I was able to get the pen and notebooks working.

Short version: on a jailbroken, never-registered Kindle Scribe 2 (2024 release, FW 5.18.1), writing a fake /var/local/java/prefs/reginfo is enough to create and use Notebooks, and it also stops the “set up your Kindle” nagging. No Amazon account, no network access to Amazon.

Prior belief (362492) was that the Scribe must “generate and decode a GUID (used for notebook folder) associated with your Amazon account”, requiring a real registration so the account hash is “in the expected database”. The account hash is real — but it is computed on the device, from the file you write. After applying fake registration and rebooting, the framework created:

/var/local/java/prefs/d811a3956b7a908342cfc7ca7f63a044.reader.glb

and

md5("amzn1.account.HDGD6DJS6SJDhD4DJD8SPNSGC5SF") = d811a3956b7a908342cfc7ca7f63a044

an exact match for the userId in the forged reginfo. Nothing was fetched from Amazon: the registration server was blocked in /etc/hosts and there were no valid credentials. So the hash needs a plausible userId string, not a genuine account.

(One thing does not agree: lipc-get-prop com.lab126.amazonRegistrationService isDeviceFreshUnregistered still returns 1. The
registration service remains unconvinced while the per-account state machinery is satisfied. Notebooks only need the latter.)

HOW TO
======

This is derived from fakereg. You need a root shell (KUAL is obsolete on current firmware; KOReader’s built-in Terminal emulator works, and runs as root). In this shell:

mntroot rw

# optional but sensible: stop a deregistration wiping your content
touch /var/local/system/DONT_DELETE_CONTENT_ON_DEREGISTRATION

# optional: keep the device from talking to the registration server
cp /etc/hosts /mnt/us/etc-hosts.orig
echo "127.0.0.1 firs-ta-g7g.amazon.com" >> /etc/hosts

cat > /var/local/java/prefs/reginfo <<'EOF'
#Mon Jul 29 22:44:35 GMT+02:00 2019
givenName=YourName
userId=amzn1.account.HDGD6DJS6SJDhD4DJD8SPNSGC5SF
deviceName=Scribe
userName=Scribe
deviceEmailAddress=scribe@kindle.com
EOF
chmod 444 /var/local/java/prefs/reginfo
chown root:root /var/local/java/prefs/reginfo

mntroot ro
reboot

Then open Notebooks and create one!

HOW TO UNDO
===========

mntroot rw

chattr -i /var/local/java/prefs/reginform /var/local/java/prefs/reginfo

cp /mnt/us/etc-hosts.orig /etc/hosts# only needed if you set +i

mntroot ro

reboot


Two differences from the original fakereg extension:

1) Do not chattr +i the reginfo. The original sets it. On the next boot the framework re-owns the file from root:root to
root:javauser — an immutable file will block that, and what it does when that write fails is untested. Leaving it mutable
worked.

2) Do not reboot from inside the script. The original does, so you never see whether the writes landed. Verify first, reboot separately.

CAVEATS
=======

Only do this on a device with no real registration. Writing over a genuine reginfo will cost you the Store, sync and Send-to-Kindle, and you cannot get it back from a copy of that file. A quick check: a device that has been registered has ^[0-9a-f]{32}\. files in

/varlocal/java/prefs

mntroot ro may fail with '/ is busy'. The Chromium chroot at /var/tmp/chroot/ bind-mounts /dev/root in a dozen places, so
remount,ro returns EBUSY while it is up. A reboot restores read-only; it is not damage.

Tested on one device: Kindle Scribe 2 (2024), device code 3X5, FW 5.18.1, jailbroken with Véra.

Get a recovery shell working before you touch reginfo. Someone in 362359 had a device hang at “Loading, please wait” after fakereg and needed SSH to recover. (If you want SSH: USBNetLite installs fine, but ;usbnetwork aborts at volumd on this firmware — start dropbear directly instead, and note MRPI cannot run at all on hard-float devices, as every binary it ships is soft-float.)

CREDITS
=======

The fakereg KUAL extension (author “S”) is the original; this is its bin/fake.sh with the two changes above. USBNetLite and the dropbear build are NiLuJe’s. john1980 in 362359 documented rm /var/local/decanter/RESUME_OOBE_FOR_OTA to get past the setup screen permanently, which is what made an unregistered device usable in the first place. Frogm4n asked in that same thread whether Notebooks would work on a fake-registered device and never got an answer — this is it. I'll be dual-posting this as an answer in that thread as well.

[mergen3107]

Wow, that’s a breakthrough! Thank you!

One typo: in the “HOW TO UNDO” reginfo is joined with rm producing the word reginform which actually happens to look legit

Also, MRPI does work on hard float you just need to grab Marek’s package: https://fw.notmarek.com/khf/

[mergen3107]

> john1980 in 362359 documented rm /var/local/decanter/RESUME_OOBE_FOR_OTA to get past the setup screen permanently

Can you please share the direct link to this post? I couldn’t find it just replacing the number after showthread in the link