Quick Kindle 3 root shell via USB - Page 6

NiLuJe · 09-17-2010, 04:10 PM

Because we don't have Amazon's private signing key? And, obviously, a vanilla Kindle doesn't have the public key needed to decrypt our usual custom packages.

That's the whole point of the jailbreak, sneaking in our custom public key.

joblack · 09-18-2010, 10:43 PM

Quote:

Originally Posted by NiLuJe

Because we don't have Amazon's private signing key? And, obviously, a vanilla Kindle doesn't have the public key needed to decrypt our usual custom packages.

That's the whole point of the jailbreak, sneaking in our custom public key.

As far as I have read and experimented the bin files are just shifted and then xor 'encrypted'.

Tiersten · 09-18-2010, 11:41 PM

Quote:

Originally Posted by joblack

As far as I have read and experimented the bin files are just shifted and then xor 'encrypted'.

The signatures are for each of the files inside the bin.

Update_kindle_3.0.2_B00A.bin contains:

111111111-k3.ffs
111111111-k3.ffs.sig
Update_515460094-529960105.bin
Update_515460094-529960105.bin.sig
update-Update_515460094-529960105.dat
update-Update_515460094-529960105.dat.sig

NiLuJe · 09-19-2010, 09:02 AM

@joblack: The update file itself, yes. But each individual file in the tarball is signed (since fw 2.something).

Ged_uk · 09-19-2010, 03:21 PM

Just a side note, if you copy the /test/ebook folder to /test on your kindle you get the ~exec command working as ecostin thought, Not particularily useful output but might come in handy for feeback from simple scripts.
Haven't had this much fun since I used to hack around with linux satellite boxes

G

mubertmumphrey · 09-19-2010, 05:35 PM

To get ~exec working, it seems you also need to copy over the missing files from /test/bin.

Many thanks to to ecostin and NiLuJe for figuring this all out.

mubertmumphrey · 09-19-2010, 05:59 PM

If anyone is interested in testing the Kindle 3 microphone, there's an echo test included in ecostin's /test/bin directory:

ssh into your kindle, and run the command "sh /test/bin/mecho"

s0litaire · 09-19-2010, 07:53 PM

I might be missing something but..
I'm able to telnet into my kindle using usbNetwork
But can't log in using ssh it keeps asking for a password.

Personally I'm more comfortable using ssh than telnet just wondering it I've done something wrong or if there's no password!

NiLuJe · 09-19-2010, 08:04 PM

@s0litaire: Type anything (or even nothing) & enter, the password check itself is bypassed, but we still have the password prompt displayed

.

mubertmumphrey · 09-19-2010, 08:26 PM

ecostin, do you have /usr/sbin/ufbvncd on your kindle? If so, it'd be really nice to experiment with it to see if we can get the VNC server working.

s0litaire · 09-19-2010, 10:27 PM

Quote:

Originally Posted by NiLuJe

@s0litaire: Type anything (or even nothing) & enter, the password check itself is bypassed, but we still have the password prompt displayed

.

Linux user here!
Helps if I run it as root

Code:

 sudo ssh 192.168.2.2

ok working now! lol

NiLuJe · 09-19-2010, 11:44 PM

Yeah, you'll probably need proper permissions on your usb device to use it as a normal user

.

s0litaire · 09-19-2010, 11:46 PM

All i need to do is get that darn "bootchart" to run.
lol!

I'd like to see what it does during boot..

NiLuJe · 09-19-2010, 11:55 PM

Random rant: Damn crappy autotools handling. x-compiling fontconfig was a PITA >_<". Great idea to have to build some binaries for $BUILD on top of the expected $HOST ones while in x-compile mode without making sure they're using a different set of $CFLAGS -_-". Because strangely enough, an x86 gcc doesn't handle -march=armv6j...

Hmpf.

ecostin · 09-20-2010, 03:25 AM

Quote:

Originally Posted by mubertmumphrey

ecostin, do you have /usr/sbin/ufbvncd on your kindle? If so, it'd be really nice to experiment with it to see if we can get the VNC server working.

Here you are. Also, the original USB network driver / daemon can be found in the "test" archive I've posted earlier in this thread.

09-19-2010, 03:21 PM	#80
Ged_uk Enthusiast Posts: 30 Karma: 10 Join Date: Jan 2008 Device: K3-3G, HTC HD2	Just a side note, if you copy the /test/ebook folder to /test on your kindle you get the ~exec command working as ecostin thought, Not particularily useful output but might come in handy for feeback from simple scripts. Haven't had this much fun since I used to hack around with linux satellite boxes G Last edited by Ged_uk; 09-19-2010 at 03:58 PM.

09-19-2010, 11:55 PM	#89
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	Random rant: Damn crappy autotools handling. x-compiling fontconfig was a PITA >_<". Great idea to have to build some binaries for $BUILD on top of the expected $HOST ones while in x-compile mode without making sure they're using a different set of $CFLAGS -_-". Because strangely enough, an x86 gcc doesn't handle -march=armv6j... Hmpf. Last edited by NiLuJe; 09-20-2010 at 09:43 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
PRS-600 Serial console (i.e. shell) over USB	Xaphiosis	Sony Reader Dev Corner	6	08-22-2010 11:06 PM
PRS-900 Any luck getting a root shell? or debug mode?	raisinbrain	Sony Reader	0	01-05-2010 11:33 PM
Hacks can you get a shell on your kindle?	svakanda	Amazon Kindle	4	02-27-2009 10:37 AM
Getting a root shell	guylhem	Sony Reader Dev Corner	4	02-27-2009 05:24 AM
iLiad Can't Connect via USB after Dev Access Shell Install	jfrey	iRex Developer's Corner	4	02-20-2008 12:20 PM

09-17-2010, 04:10 PM	#76
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	Because we don't have Amazon's private signing key? And, obviously, a vanilla Kindle doesn't have the public key needed to decrypt our usual custom packages. That's the whole point of the jailbreak, sneaking in our custom public key.

09-19-2010, 09:02 AM	#79
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@joblack: The update file itself, yes. But each individual file in the tarball is signed (since fw 2.something).

09-19-2010, 05:35 PM	#81
mubertmumphrey Member Posts: 21 Karma: 44 Join Date: Sep 2010 Device: Kindle 3	To get ~exec working, it seems you also need to copy over the missing files from /test/bin. Many thanks to to ecostin and NiLuJe for figuring this all out.

09-19-2010, 05:59 PM	#82
mubertmumphrey Member Posts: 21 Karma: 44 Join Date: Sep 2010 Device: Kindle 3	If anyone is interested in testing the Kindle 3 microphone, there's an echo test included in ecostin's /test/bin directory: ssh into your kindle, and run the command "sh /test/bin/mecho"

09-19-2010, 07:53 PM	#83
s0litaire Member Posts: 12 Karma: 10 Join Date: Sep 2010 Device: Kindle 3	I might be missing something but.. I'm able to telnet into my kindle using usbNetwork But can't log in using ssh it keeps asking for a password. Personally I'm more comfortable using ssh than telnet just wondering it I've done something wrong or if there's no password!

09-19-2010, 08:04 PM	#84
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@s0litaire: Type anything (or even nothing) & enter, the password check itself is bypassed, but we still have the password prompt displayed .

09-19-2010, 08:26 PM	#85
mubertmumphrey Member Posts: 21 Karma: 44 Join Date: Sep 2010 Device: Kindle 3	ecostin, do you have /usr/sbin/ufbvncd on your kindle? If so, it'd be really nice to experiment with it to see if we can get the VNC server working.

09-19-2010, 11:44 PM	#87
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	Yeah, you'll probably need proper permissions on your usb device to use it as a normal user .

09-19-2010, 11:46 PM	#88
s0litaire Member Posts: 12 Karma: 10 Join Date: Sep 2010 Device: Kindle 3	All i need to do is get that darn "bootchart" to run. lol! I'd like to see what it does during boot..