De-sandboxed kindlet loader

[pwr]

Hello,

I've written a small tool that allows loading Kindlets outside of their sandbox. Right now it only works for the Kindle 4 (software version 4.1.0), but I think it could be easily ported to Kindle 3 and Touch.

It implements a custom classloader for the kindlets, which skips all the sandboxing checks: certificates, java permissions and class whitelisting. With it, when launching a Kindlet for the first time, you will get a dialog (see attached screen-shot) asking if you want to allow it full permissions (using the custom classloader) or load it normally (inside the regular Kindlet API sandbox).

If you load it with full permissions:

• the certificate checks will not be performed; so the kindlet can be signed with a developer key, or not signed at all, it does not matter; you will not need to install any developer certificates.
• the kindlet will have full access to the device's filesystem, not just inside the regular sandbox -- it will be able to read and write any file.
• the kindlet will have full access to the Java framework's classes, not just to the Kindlet API. This is not as useful as it may sound due how heavily obfuscated the framework is.

Detailed documentation is available, as well as an already-built .jar ready-to-use.

Hope you find it useful .

Cheers,
-pwr

[knc1]

Its an entire function, it deserves a copyright statement and a license statement.
What OSI license are you releasing this under? MIT? Something else?

[pwr]

Haven't thought of that. BSD, I guess?

I'll update the sources and upload a license file.

Cheers,
-pwr

[knc1]

Originally Posted by pwr

Haven't thought of that. BSD, I guess?

I'll update the sources and upload a license file.

Cheers,
-pwr

Thanks, that tells people your willing to let them re-use your work.

[geekmaster]

Originally Posted by pwr

... I've written a small tool that allows loading Kindlets outside of their sandbox. Right now it only works for the Kindle 4 (software version 4.1.0), but I think it could be easily ported to Kindle 3 and Touch.

It implements a custom classloader for the kindlets, which skips all the sandboxing checks: certificates, java permissions and class whitelisting.

How is this different from ixtab's class loader replacement?

Originally Posted by ixtab

...It allows to escape the restrictive class loader, and also allows you to do other nifty things, like gaining additional permissions to write to the file system, read additional properties etc.
...

Alternative implementations are welcome. We can learn things from parallel development efforts. Sometimes combining the best ideas from them can result in a much better hybrid implementation. Thanks for sharing this.

[eureka]

Nice. If you are looking for KT Java libraries, you can take them from mmcblk0p1 images floating somewhere in this forum.

[pwr]

Originally Posted by geekmaster

How is this different from ixtab's class loader replacement?

It only allows for more powerful Kindlets. While using the available Java framework classes is possible, is quite limited compared to ixtab's; certainly it does not offer the possibility to change the Java bytecode on-the-fly. On the plus side, it does not require having to mess about with the bytecode . It's more high-level, if you like, with all the benefits and disadvantages it implies.

Cheers,
-pwr

[geekmaster]

Originally Posted by pwr

It only allows for more powerful Kindlets. While using the available Java framework classes is possible, is quite limited compared to ixtab's; certainly it does not offer the possibility to change the Java bytecode on-the-fly. On the plus side, it does not require having to mess about with the bytecode . It's more high-level, if you like, with all the benefits and disadvantages it implies.

Cheers,
-pwr

Great! More power (than stock firmware) with less "tampering" may not break so quickly with the next firmware update, requiring less "end-user maintenance".

Your method may be more desirable for beginners, while power users may prefer ixtab's method (which I use myself).

[eureka]

Originally Posted by pwr

It only allows for more powerful Kindlets. While using the available Java framework classes is possible, is quite limited compared to ixtab's; certainly it does not offer the possibility to change the Java bytecode on-the-fly. On the plus side, it does not require having to mess about with the bytecode . It's more high-level, if you like, with all the benefits and disadvantages it implies.

Cheers,
-pwr

I think, you've confused ixtab's jbpatcher with ixtab's Kindlet jailbreak (read also post #6 in that thread).

You're describing jbpatcher, while geekmaster spoke about Kindlet jailbreak.

[geekmaster]

Originally Posted by eureka

I think, you've confused ixtab's jbpatcher with ixtab's Kindlet jailbreak (read also post #6 in that thread).

You're describing jbpatcher, while geekmaster spoke about Kindlet jailbreak.

I believe that jbpatcher also uses a replacement classloader, so the same argument applies in that case.

[eureka]

Originally Posted by geekmaster

I believe that jbpatcher also uses a replacement classloader, so the same argument applies in that case.

jbpatcher is definitely using custom classloader, but described major technical differencies between jbpatcher and pwr's solution are pretty obvious and uninteresting for me. It's also obvious that pwr's solution has goals different to jbpatcher, despite the fact that it takes similar approach. I'm [persistently] pointing exactly to ixtab's Kindlet jailbreak as I'd like to know whether pwr personally will find it targeted at the same goals as his solution or not.

[geekmaster]

Originally Posted by eureka

jbpatcher is definitely using custom classloader, but described major technical differencies between jbpatcher and pwr's solution are pretty obvious and uninteresting for me. It's also obvious that pwr's solution has goals different to jbpatcher, despite the fact that it takes similar approach. I'm [persistently] pointing exactly to ixtab's Kindlet jailbreak as I'd like to know whether pwr personally will find it targeted at the same goals as his solution or not.

It may be as I suggested that a better kindlet jailbreak can be made by combining ideas from both pwr and ixtab methods.