Original "Simple" debricking methods for K5-Touch, K4-Mini, & K3-Keyboard

[geekmaster]

Originally Posted by qsoo

Thx a lot!
It works)

I am glad it worked out. I linked this success report to the first post.

[murz_07]

Hi again.
CAN ANYBODY PLEASE get main kernel image and post it here?
I really need it!

[TCCPhreak]

Hello,

after some experiments, I guess my Kindle (4, nontouch) is broken pretty good. Fun is: I didn't even try anything strange - it froze while trying to connect to a network and then never bounced back.

Originally, i could reboot it to the startscreen, with the loading bar stuck at about half. After some time, it rebooted. It did that again and again and din't care whether it was connected to PC, Power supply or not at all.

After finding this forum, I was able to use MfgTool to boot into debug mode. Unfortunately, it froze soon after. With some more tries and quick copying I was able to activate USB-storage and to get the "ENABLE_DIAGS" file onto it. This way, I at least could try some stuff before the kindle froze. Still, it didn't help much.

Starting fastboot and connecting via fastboot worked (I installed the driver via inf-wizard in libusb). That way, I at least knew that some parts still work. The kindle doesn't seem to crash in fastboot but - of course - it's not of much use in fastboot. I can verify the information from getvar (mac, serial, product) and the kindle responds to information from here but it doesn't help me getting it up and running, again.

"fastboot check" reports CRC-failures on bist, userdata, kernel, diags_kernel, system, diags and data. Even after doing a "fastboot erase diags", check fails. Same response after "fastboot flash diags mmc..." (I dd'ed the partitions from another kindle 4nt as I didn't find a diags backup online) - although it sometimes fixes that "not booting to diags but to black screen" problem.
I tried flashing "system" with mmcblk0p1.bin and although fastboot pretends that is succeeded (still check fails), I've read that fastboot 350MB is too much for flashing via fastboot and should be written via dd - once you can use usb-net (which I can't because diags mode freezes before I can do anything).

For the record: I tried bootmodes factory and reset and although my kindle did "something" after reboot, it refused to load correctly.
Some little thing that confused me: The "Adjust battery" in diags mode often reports a negative battery charge current. Still, that screen assured me that charging the battery works. When the Kindle is connected to a charging device, the device battery level rises.. (up to 100 where it is at the moment).

Very many thanks for all the documentation and tools that have been compiled in this forum. Without these, I'd have given up some time ago and I guess this will prove useful if I ever decide to toy with my next Kindle.

I'm pretty much labeling this Kindle "broken beyond repair", so if anyone has some ideas, experimental kernels or stuff like this, I'd be more than happy to try it.

Regards,

TCC

[hostar]

Originally Posted by TCCPhreak

diags mode freezes before I can do anything).

For the record: I tried bootmodes factory and reset and although my kindle did "something" after reboot, it refused to load correctly.
Some little thing that confused me: The "Adjust battery" in diags mode often reports a negative battery charge current. Still, that screen assured me that charging the battery works. When the Kindle is connected to a charging device, the device battery level rises.. (up to 100 where it is at the moment).

Does it mean, that you can select "Adjust battery", but can't select Enable USBnet? As you wrote, dd the main partition with correct backup should fix it.

Can you select in diags "Export USB device"?
If so, you can try to install RUNME hack and put RUNME.sh with proper commands inside to Kindle. For that proper content refer partially to instructions here:
https://www.mobileread.com/forums/sho...70&postcount=3

From link above follow instructions from point 1)
EXCEPT - the data.tar.gz download from here:
https://www.mobileread.com/forums/sho...d.php?t=169645
(see attached files)
Thanks geekmaster, I didn't know that exists some universal file.

I think that's all I can say to your problem.
Also I appreciate that you asked after trying all options and you was looking on forum for answers.

murz_07:

Spoiler:

you can download whole partition from first post and extract the kernel.

EDIT: murz_07: Nope, you can't

[geekmaster]

Originally Posted by hostar

From link above follow instructions from point 1)
EXCEPT - the data.tar.gz download from here:
http://dl.dropbox.com/u/16679763/kin...lbreak-1.0.zip
(use just data.tar.gz from archive, ignore other files)

That old data.tar.gz from your download link only works for the kindle model it was designed for (K4 or Touch). Using it on the wrong kindle will brick that kindle. Too many kindles were bricked by running the wrong data.tar.gz, which is why I created a generic version of it that works on all kindle models. It is the one that is recommended by the first post in this thread, and you can download it from this "Select Boot" first post: https://www.mobileread.com/forums/sho...d.php?t=169645

Originally Posted by hostar

murz_07: you can download whole partition from first post and extract the kernel.

The kernel is not stored in the partition images that you can download. The kernels are stored in the mmc at a different location, inside /dev/mmcblk0 (the entire mmc device). The only one that I am aware of that you can download is the diagnostics kernel for the Touch.

Extracting kernel images from mmcblk0 takes a bit of effort. We typical backup only the first 32MB of /dev/mmcblk0, which contains all the stuff outside the normal partitions.

I plan to write a script to make backing up these kernel images easier.

Because kernel versions should match the partition they boot, it would help to know the kindle model AND firmware version, but using the wrong kernel version should still work (better than being bricked, at least).

[geekmaster]

Originally Posted by TCCPhreak

"fastboot check" reports CRC-failures on bist, userdata, kernel, diags_kernel, system, diags and data. Even after doing a "fastboot erase diags", check fails. Same response after "fastboot flash diags mmc..." (I dd'ed the partitions from another kindle 4nt as I didn't find a diags backup online) - although it sometimes fixes that "not booting to diags but to black screen" problem.

These CRC failure messages reported by fastboot are normal for kindles. You can generally ignore them. One reason is that the CRC is stored in the flash header, but when the kindle changes the contents of these partitions by booting from them or doing updates on them, it does not adjust the CRC stored in the flash header, which makes the fastboot check function report false errors.

Originally Posted by TCCPhreak

Some little thing that confused me: The "Adjust battery" in diags mode often reports a negative battery charge current. Still, that screen assured me that charging the battery works. When the Kindle is connected to a charging device, the device battery level rises.. (up to 100 where it is at the moment).

The kindles use a Lithium Ion battery, which is supposed to be discharged to only 40% capacity (but no more than 70%) for shipping or long term storage, for maximum life. The diagnostics will discharge the battery (negative charging current) to get the voltage down to a safe shipping level. This is NOT normally something you want to do after you put a kindle into service.

My testing shows that kindles charge best in fastboot mode.

[hostar]

Originally Posted by geekmaster

The kernel is not stored in the partition images that you can download. The kernels are stored in the mmc at a different location, inside /dev/mmcblk0

I didn't know that at all .
Is it possible to extract and backup it?

EDIT: I see...

[geekmaster]

Originally Posted by hostar

I didn't know that at all .
Is it possible to extract and backup it?

EDIT: I see...

You can backup the kernels with:

dd if=/dev/mmcblk0 of=/mnt/us/mmcblk0.img bs=1K count=32K

That will save the first 32MB of the mmc device (with the "write-only" areas showing as all "\x00"). You can extract kernel images from that, which you can flash with fastboot. The main kernel starts at 0x41000 and the diags kernel starts at 0xe41000 (on the touch). I am not sure about the K4, but you can find them by searching for "Linux-" with grep. The flash header is in the 32-bytes before the "Linux-" string, and it contains the length of the flash image. It should be rounded up to the next erase block boundary. The kernel images are normally padded with a bunch of /x00 or /xff from the end of the kernel identified in the flash header up to the flash erase block boundary.

As you can see, it would be easier if this were automated in a script, which is what I plan to do.

[geekmaster]

UPDATE: Added missing "skip" option to "dd" commands, and updated kernel download links in first post.

EDIT: I show how I do what I do, as below, so that others may learn how to do as I do. Even if I did not provide these images, others could by using these methods. Hopefully, you can use these methods to solve OTHER problems as well. Good luck, enjoy and learn!

Originally Posted by murz_07

Hi again.
CAN ANYBODY PLEASE get main kernel image and post it here?
I really need it!

Yes... I am working on it... What model kindle and what firmware version? I have too much going on right now to look through old posts for it. It would help a LOT if required details were supplied with each request.

Tested on touch 5.0.4:

[root@kindle us]# hexdump -C -n$((32768*1024)) /dev/mmcblk0|grep -B2 "Linux-"
00041000  27 05 19 56 69 ce dd f4  4f 44 58 1d 00 4d ab 40  |'..Vi...ODX..M.@|
00041010  70 00 80 00 70 00 80 00  b4 3c c1 c3 05 02 02 00  |p...p....<......|
00041020  4c 69 6e 75 78 2d 32 2e  36 2e 33 31 2d 72 74 31  |Linux-2.6.31-rt1|
--
00e41000  27 05 19 56 69 af 75 1f  4e b2 dc 2a 00 4e 2a 00  |'..Vi.u.N..*.N*.|
00e41010  70 00 80 00 70 00 80 00  42 2f b5 70 05 02 02 00  |p...p...B/.p....|
00e41020  4c 69 6e 75 78 2d 32 2e  36 2e 33 31 2d 72 74 31  |Linux-2.6.31-rt1|
[root@kindle us]#

The length of the main kernel image is 0x004dab40 = 5,090,112 (the last 4 bytes of the first line). (5090112+1023/1024) = 4971 1K blocks. So, we should be able to use:

dd if=/dev/mmcblk0 of=/mnt/us/kernel.img bs=1K count=4971 skip=$((0x41000/1024))

or

dd if=/mnt/us/mmbclk0.img of=/mnt/us/kernel.img bs=1K count=4971 skip=$((0x41000/1024))

The second linux kernel found is the diags kernel, which boots the diags partition. Of course, the lengths shown above may be different for other firmware versions, and the offsets may be different for different kindle models. I will check into it...

Tested on K4 4.0.1:

[root@[192_168_15_244] us]# hexdump -C -n$((32768*1024)) /dev/mmcblk0|grep -B2 "Linux-"
00041000  27 05 19 56 ee 89 78 6d  4e 7c 0c 6f 00 48 a5 40  |'..V..xmN|.o.H.@|
00041010  70 00 80 00 70 00 80 00  04 f9 5a 54 05 02 02 00  |p...p.....ZT....|
00041020  4c 69 6e 75 78 2d 32 2e  36 2e 33 31 2d 72 74 31  |Linux-2.6.31-rt1|
--
00e41000  27 05 19 56 2a 4a 2e 2c  4e 61 8a 64 00 4e 29 80  |'..V*J.,Na.d.N).|
00e41010  70 00 80 00 70 00 80 00  ab 66 60 c5 05 02 02 00  |p...p....f`.....|
00e41020  4c 69 6e 75 78 2d 32 2e  36 2e 33 31 2d 72 74 31  |Linux-2.6.31-rt1|
[root@[192_168_15_244] us]#

The length of the main kernel image is 0x0048a540 = 4,724,032. (4724032+1023/1024) = 4614 1K blocks. So, we should be able to use:


dd if=/dev/mmcblk0 of=/mnt/us/kernel.img bs=1K count=4614 skip=$((0x41000/1024))

or

dd if=/mnt/us/mmbclk0.img of=/mnt/us/kernel.img bs=1K count=4614 skip=$((0x41000/1024))

Kernel image files extracted using dd commands shown above were added to the first post in this thread: https://www.mobileread.com/forums/sho...d.php?t=170929

[SharkNX]

Guys, I'm really sorry that I'm OT but one dumb friend tried to instal Duokan on my K4NT. He copied Duokan files and that Diag file to my Kindle.
He was lost at that Tequila diags, panicked and tried to Exit from it.
He tried Restart but it always get back into Diag mode ... So he did something stupid.
In Tequila he selected Section D) Exit, Reboot or Disable Diag ... And selected 1.St option ... Now my Kindle is Frozen.
Can you navigate me, how to get my Kindle back to work? I'm really sorry but I don't know what to do.

[geekmaster]

Originally Posted by SharkNX

Guys, I'm really sorry that I'm OT but one dumb friend tried to instal Duokan on my K4NT. He copied Duokan files and that Diag file to my Kindle.
He was lost at that Tequila diags, panicked and tried to Exit from it.
He tried Restart but it always get back into Diag mode ... So he did something stupid.
In Tequila he selected Section D) Exit, Reboot or Disable Diag ... And selected 1.St option ... Now my Kindle is Frozen.
Can you navigate me, how to get my Kindle back to work? I'm really sorry but I don't know what to do.

Ex-dumb friend?

Use MfgTool to boot to diags. Start SSH from menu N) U) Z) then at shell type:

idme -d --bootmode main
rm -f /mnt/us/ENABLE_DIAGS
reboot

You can download MfgTool from first post in this thread.

[SharkNX]

geekmaster Thank You Very Much!
It worked, I was afraid that I lost my Kindle in Silicon Heaven.
He is definatelly EX-Dumb Friend.

[TCCPhreak]

Hi hostar, thanks for your reply.

Originally Posted by hostar

Does it mean, that you can select "Adjust battery", but can't select Enable USBnet? As you wrote, dd the main partition with correct backup should fix it.

I have access to the diags menu and can even select USBnet or "Export USB Device" if I'm quick. The ENABLE_DIAGS was copied this way: I selected Export USB device and then tried copying the file from terminal and hoped that the Kindle would refrain from freezing long enough for the file to be copies without any trouble due to the "no clean disconnection".

So I can enable USBnet. But I'm lucky to have ssh-connected to the Kindle before it freezes - so zero chance of running a 350-MB-dd.

Originally Posted by hostar

Can you select in diags "Export USB device"?
If so, you can try to install RUNME hack and put RUNME.sh with proper commands inside to Kindle.

I could try to quickly copy the RUNME.sh - the same way I did with ENABLE_DIAGS. I'd hope for it to run "completely" before the Kindle freezes and reboots again.

Also thanks to geekmaster for the information on the crc fail. One of my guesses was that the flash just was extremely broken and therefore refusing to accept anything.

I think I'll try reflashing the diags-kernel and hope that this fixes the freezes. My main problem is that everything outside of fastboot is a race against time.

Regards,

TCC

[geekmaster]

Originally Posted by TCCPhreak

I think I'll try reflashing the diags-kernel and hope that this fixes the freezes. My main problem is that everything outside of fastboot is a race against time.

If I were you I would erase mmcblk0p3 (the /var/local partition), using a RUNME.sh script to do

dd if=/dev/zero of=/dev/mmcblk0p3 bs=4K

Using my data.tar.gz from the "Select Boot" thread.

[murz_07]

Hello.
I tyred to flash main kernel tou provided using fastboot, tried dd if=/dev/mmcblk0 of=/mnt/us/kernel-5.0.4.img bs=1K count=4971, but my Kindle Touch still can't boot in main mode.
I don't know firmware version, I used mmcblk0p1.img from the first post.