[K3]+[DXG] Un-demo information

[stangri]

So I've had a chance to un-demo both K3 (Kindle Keyboard) and DXG earlier today and just wanted to share my experience.

The K3 was easy as the K3 Noob Debrick thru ATK worked wonders: https://wiki.mobileread.com/wiki/K3noobdebrickatk It took a while for the K3 to reboot afterwards and I was afraid it didn't work, but once it rebooted (I say let it sit plugged in for an hour after the programming is done and if that doesn't work -- hold the power switch for a while) it booted into normal K3 software and after Factory reset and jailbreak I was good to go.

The DXG is a bit different in a number of ways. First of all, the DXG demo is just a bunch of rotating pages/images, while the K3 lets you sort of exit the demo mode to play around Kindle with some menus in Settings disabled. I also could not get the ATK to recognize the Demo DXG thru the Power/Home combination (as per wiki article before). I was able however to get into recovery, but I couldn't get the update_restore-os.bin to work -- it gave me errors during update.

I first ran the Sir Alex's KindleDiagnosticTool.exe and got the root password for my Demo DXG. I then copied the retail DXG kernel and rootfs.img to the Kindle thru USB/Mass Storage and unmounted the Kindle.

I then popped the plastic cover, got the USB/RS232 TTL adaptor plugged into my Mac and I could get into the login prompt once connected to Demo DXG.

In the serial console I logged in with the login root and the password from the KindleDiagnosticTool.exe and ran the following command:

PHP Code:

dd if=/mnt/us/mmcblk0_7688.dmp of=/dev/mmcblk0 bs=512 count=7688
dd if=/mnt/us/rootfs.img of=/dev/mmcblk0p1 


At the end it started throwing errors like "Buffer I/O error on device mmcblk0p1, logical block nnnnnnnnnnnnn" -- as I'm guessing when it could no longer load next page/image.

After reboot with the hardware power slide I've got the working Kindle DXG with the 2.5.8 firmware.

A few photos which might help now..

The plastic cover snaps location:

So you could see where to press on the cover to disengage snaps.


Wires on the serial board:

Green to RXD, Yellow to TXD and Red to GRD. WARNING!!! On the photo the black wire connects to 5V output on serial board, as per knc1 suggestion it's better not to use the black wire at all! I have tried it and it works without black wire.


Wires connecting to Kindle DXG:

Black on P1 and red on P4. I've carefully stripped the plugs of the plastic and wrapped everything with tape so I could just touch the contacts on DXG instead of soldering.

On Mac I've done the following to connect to the serial port:

PHP Code:

sudo cu -l /dev/tty.usbserial -s 115200 


With Windows you should try to use putty and if you're on Linux you probably won't need my help on that.

Once you're connected you can either dd from the user mount partition (as briefly explained above) or expose the Kindle to the USB host and dd over the USB cable.

[knc1]

Originally Posted by stangri

PS. If mods can assign both K3 and DXG prefixes, please do so.

We have an index system that handles many-to-one relationships.

You can just enter the link to this thread in the index pages yourself.
Probably: K3, DX(G) and HowTo would be likely places a person would look for a link to this information.

[twobob]

Done. All three. no charge

EDIT: Here is a quote from a future thread: It pertains the fact that you MUST HAVE BOTH DEVICES WORKING TO DEBRICK A DX. It is not really relevant to this thread and when the debricking thread is created I will update this info again.

So to reiterate... The following info is for debricking a dx and you can find this info on : INSERT THREAD HERE. Thanks...

(not knc1 he was bang on topic)

Originally Posted by knc1

Unless you use external software to dump the DX memory image to an external file.
Since that only requires that the iROM (SoC internal ROM), iRAM (SoC internal RAM) and first UART port are working.
System image may be bricked, blanked, non-existent, it does not matter.

For which, you need to find the "magic key" to put the DX into the iROM code.
It should be easier to find the "magic key" using activity on the serial port line than on the USB cable (the iROM code monitors both, then uses the first one on which it detects activity).

The "stock" ATK can not "talk" to the i.MX31 in the DX over the serial link, but the K3Flasher can with modification by the addition of the i.MX31 constants.

All of the above assumes you have access to a Linux machine (other than the Kindle).
But using a "send/expect" script on the serial port while you diddle the key combinations should find the key combination in a hurry.

So. You will need a working DX. please refer to the DX debricking thread for this info. INSERT THREAD AGAIN HERE.

[cavorite]

Thanks, you've confirmed the procedure I will use as soon as my low volt serial converter gets here. Not as easy as ABC, er ATK, but eminently doable.

With the DX becoming a dinosaur, I doubt there will be much effort towards finding the "magic key" for ATK.

[giorgio130]

As you've nearly tried all buttons available, I'd suggest looking inside the case. It could be something that can't be accessed from outside, maybe not even there in the units that get shipped (I mean some pads with nothing on them). I found in a Kindle 3 of mine there's a "reset to factory" button inside (I found out its purpose just pushing it); in the other ones in that place there are only the metallic pads. It could be something like that.

[Begemot]

New to Kindle world question here, how do you create rootfs.img ?

I have gotten yifanlu's custom kernel and updater but if I understand correctly, I would have to copy the create updater .bin first to kindle dx?

PS. this is assuming I only have Demo DX not a regular one

[cavorite]

Originally Posted by knc1

Since finding it on the serial should be easier - let us know if you want to go looking for it once you get your adapter cable made up.
I can give you some tips that may help finding the key.

And both the Freescale software (such as: ATK) and Mobileread software (such as: K3Flasher) rely on this "burned-in" mode.

Not to get the cart before the horse, but once I am unbricked I will sure give it a try. As a follow on to this, is there some bit of code or otherwise I can do through the hardwire internal connection that will let me access console or get out of user area without having to open the case once more?

[cavorite]

Yes, must keep the physical port separate from the multiple roles it may take on.

I'm planning to use the 3.0.2 image from the pastebin. Gitbrew is still not acessable, so the 3.3 image ~dasmoover uploaded is not available, or at least I can't find it anywhere.

[cavorite]

Yes, a DXG specifically. Did I goof in assuming that the DX can use K3 images?

[Begemot]

Originally Posted by twobob

hi begemot - I havent done it myself but possibly some sort of dd command

does the documentation not say how? Which docs are you reading? (location)

Thanks

I was just reading OPs (stangri) instructions, which mention having made a rootfs.img made by a script but it seemed unclear where you would make one (another DX?).

I should just be patient, and wait for my USB to TTL adapter to arrive and also my Demo Kindle DX.

[cavorite]

Hmm... I see that I may have made a faulty assumption based on yifanlu's thread on using 3.1 with the K2 and DX. (https://www.mobileread.com/forums/sho...d.php?t=127969) I do have a working K3, but with more thorough reading, I see that the DX must generate the update file, which is processed on the K3. And with a bricked DX that is not going to fly...

[cavorite]

I will be thrilled to have a functional DX, whatever software version it may be. Beyond that, after a thorough backup, I _may_ attempt an upgrade.

[stangri]

Sorry, I was away for a while.

I've had a few sources of the image files for the DXG:
1. The backup image made on my other (regular) DXG with the "2.5.8 to 3.x update" script by Yifan Lu.
2. The 3.2.1 image from the torrent on, well, you know where. The file in that torrent is the result of the Yifan's script.
3. The per-partition backup of my DXG on the 3.2.1 firmware by the script written by xms here who also helped me alot answering my questions.

Here's the script from #3 if you just want to backup your own Kindle DXG to later write its files onto the Demo DXG:

PHP Code:

#!/bin/sh

# diff OTA patch script 

_FUNCTIONS=/etc/rc.d/functions
[ -f ${_FUNCTIONS} ] && . ${_FUNCTIONS}


MSG_SLLVL_D="debug"
MSG_SLLVL_I="info"
MSG_SLLVL_W="warn"
MSG_SLLVL_E="err"
MSG_SLLVL_C="crit"
MSG_SLNUM_D=0
MSG_SLNUM_I=1
MSG_SLNUM_W=2
MSG_SLNUM_E=3
MSG_SLNUM_C=4
MSG_CUR_LVL=/var/local/system/syslog_level

logmsg()
{
    local _NVPAIRS
    local _FREETEXT
    local _MSG_SLLVL
    local _MSG_SLNUM

    _MSG_LEVEL=$1
    _MSG_COMP=$2

    { [ $# -ge 4 ] && _NVPAIRS=$3 && shift ; }

    _FREETEXT=$3

    eval _MSG_SLLVL=\${MSG_SLLVL_$_MSG_LEVEL}
    eval _MSG_SLNUM=\${MSG_SLNUM_$_MSG_LEVEL}

    local _CURLVL

    { [ -f $MSG_CUR_LVL ] && _CURLVL=`cat $MSG_CUR_LVL` ; } || _CURLVL=1

    if [ $_MSG_SLNUM -ge $_CURLVL ]; then
        /usr/bin/logger -p local4.$_MSG_SLLVL -t "ota_install" "$_MSG_LEVEL def:$_MSG_COMP:$_NVPAIRS:$_FREETEXT"
    fi

    [ "$_MSG_LEVEL" != "D" ] && echo "ota_install: $_MSG_LEVEL def:$_MSG_COMP:$_NVPAIRS:$_FREETEXT"
}

if [ -z "${_PERCENT_COMPLETE}" ]; then
    export _PERCENT_COMPLETE=0
fi

update_percent_complete()
{
    _PERCENT_COMPLETE=$((${_PERCENT_COMPLETE} + $1))
    update_progressbar ${_PERCENT_COMPLETE}
}

update_percent_complete 10

dd if=/dev/mmcblk0 of=/mnt/us/mmcblk0_7688.dmp bs=512 count=7688
update_percent_complete 20
dd if=/dev/mmcblk0p1 of=/mnt/us/mmcblk0p1.dmp
update_percent_complete 70
dd if=/dev/mmcblk0p2 of=/mnt/us/mmcblk0p2.dmp
update_percent_complete 90
dd if=/dev/mmcblk0p3 of=/mnt/us/mmcblk0p3.dmp
update_progressbar 100

return 0 


xms was nice enough to build the .bin-file you can run on your jailbroken kindle dxg to back it up, which I'm also attaching below. To restore those on the Demo DXG you need to get root and then swap if/of in the lines above. I only did it for the first two dd commands (kernel and root partition).

[stangri]

Oh, from my trial and error, as soon as you overwrite the rootfs with an image from another device, your root password (as reported by Sir Alex's KindleDiags) will no longer work. The root password of the device which you made image from should work tho.

[knc1]

Originally Posted by stangri

Oh, from my trial and error, as soon as you overwrite the rootfs with an image from another device, your root password (as reported by Sir Alex's KindleDiags) will no longer work. The root password of the device which you made image from should work tho.

Which you can correct by coping the "root" line from the old /etc/shadow to the new /etc/shadow file.