PW4 PW4 Serial Jailbreaking (OTA updated) - Page 3

mustdie · 08-04-2019, 03:52 AM

So, I used a kindle specific fastboot version (https://github.com/TobiasWooldridge/Fastboot-Kindle) to try to deal with it.

How to use this fastboot? (WIN7 32-bit)

mustdie · 08-04-2019, 04:15 AM

https://www.mobileread.com/forums/sh....php?p=2000997
This is what I downloaded and used.
fasboot.exe
Failure to enter FastBoot mode

NiLuJe · 08-04-2019, 12:50 PM

Is there a question hidden somewhere in there?

SenorClean · 08-04-2019, 04:23 PM

Quote:

Originally Posted by mustdie

https://www.mobileread.com/forums/sh....php?p=2000997
This is what I downloaded and used.
fasboot.exe
Failure to enter FastBoot mode

I never got the windows build to chat with my pw4 at all - patchy success with Linux, but even then most functions seem to be locked out. My pw4 is still bricked (suspect it'll come back to life if I can find a way to factory reset it.)

These androidised kindles are completely different animals - makes unbricking the pw3 look like a walk in the park!

ironick · 08-13-2019, 06:56 AM

Are we successful with jailbreak on PW4 OTA updated with 5.12.1?

NiLuJe · 08-13-2019, 09:07 AM

@ironick: Double-posting is evil.

ironick · 08-13-2019, 09:22 AM

I understand, I beg your pardon. Please delete my post if possible.

stmusic · 08-15-2019, 07:14 AM

Why kindle pw4 not see my keyborad, not allow me to pres ENTER in serial mode ?
Kindle is plug in serial cable.

knc1 · 08-15-2019, 08:03 AM

Quote:

Originally Posted by stmusic

Why kindle pw4 not see my keyborad, not allow me to pres ENTER in serial mode ?
Kindle is plug in serial cable.

This is a technical forum, you need to give us enough technical information to help you.
Give technical details of what you have done and how you did it.
We can not tell you what you have done wrong until you give us more detail than: "does not work".

stmusic · 08-15-2019, 02:27 PM

Kindle pw4 is demo, i connect it with serial cable,
I have this message: Hit any key to stop autoboot: 0
Enter fastboot mode, use Ctrl+C to exit.
Not allow me to enter fastboot, what to do now, how to open E. Export FAT partition, thats need me to open memory ?

Code:

U-Boot 2016.03 (Aug 13 2018 - 10:50:06 -0700)

CPU:   Freescale i.MX6SLL rev1.1 996 MHz (running at 792 MHz)
CPU:   Commercial temperature grade (0C to 95C) at 46C
Reset cause: POR
Board: MX6SLL Rex
I2C:   ready
DRAM:  512 MiB
entering PMIC test mode
in PMIC test mode -- apply bootup workaround
switching back to PMIC user mode
setup_pmic_mode -- make sure pmic is in user mode
MMC:   FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2
idme_initialize
Idme version is 2.x and set related function to V2.x
IDME table version 2.1
hibernation: Not from hibernation
Core : f770ee83 2018/03/16 19:49:02 (Licensed to Amazon Fulfillment Services,Inc..)
SBIOS: v2.0 2018/08/28 17:08:57
TTBR:9fffc059
Platform: v2.0 2018/08/28 17:08:57
fl
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
force_idle_bus: sda=0 scl=1 sda.gp=0x1 scl.gp=0x0
force_idle_bus: failed to clear bus, sda=0 scl=1
Hardware Board: Unknown(12)
Board ID is P001F20984070A6T
WFO module
secure_cpu: 1, production: 1, unlocked: 0
Boot mode is 0
Hit any key to stop autoboot:  0
Enter fastboot mode, use Ctrl+C to exit.

knc1 · 08-15-2019, 11:36 PM

you are most likely SOL:

Code:

secure_cpu: 1, production: 1, unlocked: 0

MrTick · 11-27-2019, 12:43 PM

I've done some more digging regarding the fastboot part of uboot.
All quoted code comes from uboot\drivers\usb\gadget\f_fastboot.c from source code package.

It seems all commands sent to the device, before even being parsed are censored by lab126 sanitizing function:

Code:

if (is_restricted_command_on_locked_hw((unsigned char*)cmdbuf)) {
    printf("locked command: %s\n", cmdbuf);
    fastboot_tx_write_str("FAILlocked command");
    goto out;
}

That's basically the reason why boot command fails and probably flash too.

As for the interesting part there is following command available:

Code:

> fastboot getvar unlock_code
0xXXXXXXXXXXXX
OKAY [  0.005s]
finished. total time: 0.006s

It returns 128bit key in an hexadecimal format.

Then there's possibility to unlock the device by executing:

Code:

> fastboot download <secret_unlock_file>
> fastboot flash unlock

However for that we need to download the unlock code to memory first:

Code:

if (strncmp("unlock", cmd, 6) == 0) {
    if (amzn_write_unlock_code(
            (void *)interface.transfer_buffer, download_bytes) == 0) {
        fastboot_tx_write_str("OKAY");
    } else {
        fastboot_tx_write_str("FAILincorrect unlock code");
    }
    return;
}

Obviously uploading code obtained before does not work (I've tried the hex format with and without 0x and pure binary representation of 'unlock_code').
Nothing worked.

Most probably lab126 when provided with our serial number and unlock_code should be able to generate proper unlock file.
Most probably they will not be eager to do so

As for another mysterious commands, following two are also available:

Code:

> fastboot oem relock
OKAY [  0.006s]
finished. total time: 0.006s

So there should be possibility to relock the uboot after a successful unlock.
And also:

Code:

> fastboot oem format

I've not yet tried that, and I'm not eager to do so

I hope answering an 3-month old topic will not do much harm.

kenatia · 12-13-2019, 01:52 PM

Quote:

Originally Posted by MrTick

I've done some more digging regarding the fastboot part of uboot.
All quoted code comes from uboot\drivers\usb\gadget\f_fastboot.c from source code package.

It seems all commands sent to the device, before even being parsed are censored by lab126 sanitizing function:

Code:

if (is_restricted_command_on_locked_hw((unsigned char*)cmdbuf)) {
    printf("locked command: %s\n", cmdbuf);
    fastboot_tx_write_str("FAILlocked command");
    goto out;
}

That's basically the reason why boot command fails and probably flash too.

As for the interesting part there is following command available:

Code:

> fastboot getvar unlock_code
0xXXXXXXXXXXXX
OKAY [  0.005s]
finished. total time: 0.006s

It returns 128bit key in an hexadecimal format.

Then there's possibility to unlock the device by executing:

Code:

> fastboot download <secret_unlock_file>
> fastboot flash unlock

However for that we need to download the unlock code to memory first:

Code:

if (strncmp("unlock", cmd, 6) == 0) {
    if (amzn_write_unlock_code(
            (void *)interface.transfer_buffer, download_bytes) == 0) {
        fastboot_tx_write_str("OKAY");
    } else {
        fastboot_tx_write_str("FAILincorrect unlock code");
    }
    return;
}

Obviously uploading code obtained before does not work (I've tried the hex format with and without 0x and pure binary representation of 'unlock_code').
Nothing worked.

Most probably lab126 when provided with our serial number and unlock_code should be able to generate proper unlock file.
Most probably they will not be eager to do so

As for another mysterious commands, following two are also available:

Code:

> fastboot oem relock
OKAY [  0.006s]
finished. total time: 0.006s

So there should be possibility to relock the uboot after a successful unlock.
And also:

Code:

> fastboot oem format

I've not yet tried that, and I'm not eager to do so

I hope answering an 3-month old topic will not do much harm.

It looks like the locked Bootloader of android devices. So a tool is needed to create unlock.bin from unlock code or device ID.

irreld · 01-24-2020, 04:52 PM

If they really use fastboot and bootloader just like Android devices, perhaps getting a uboot partition dump from a jailbroken one could be helpful. Hmm.

hius07 · 08-14-2020, 02:08 PM

Successful serial jailbreak for KOA
https://www.mobileread.com/forums/sh...d.php?t=332325
It might help here.

08-15-2019, 11:36 PM	#41
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	you are most likely SOL: Code: secure_cpu: 1, production: 1, unlocked: 0

11-27-2019, 12:43 PM	#42
MrTick Enhtusiast Posts: 53 Karma: 2340139 Join Date: Dec 2018 Device: K3 DxG PW1 KV PW4	I've done some more digging regarding the fastboot part of uboot. All quoted code comes from uboot\drivers\usb\gadget\f_fastboot.c from source code package. It seems all commands sent to the device, before even being parsed are censored by lab126 sanitizing function: Code: if (is_restricted_command_on_locked_hw((unsigned char)cmdbuf)) { printf("locked command: %s\n", cmdbuf); fastboot_tx_write_str("FAILlocked command"); goto out; } That's basically the reason why boot command fails and probably flash too. As for the interesting part there is following command available: Code: > fastboot getvar unlock_code 0xXXXXXXXXXXXX OKAY [ 0.005s] finished. total time: 0.006s It returns 128bit key in an hexadecimal format. Then there's possibility to unlock the device by executing: Code: > fastboot download <secret_unlock_file> > fastboot flash unlock However for that we need to download the unlock code to memory first: Code: if (strncmp("unlock", cmd, 6) == 0) { if (amzn_write_unlock_code( (void )interface.transfer_buffer, download_bytes) == 0) { fastboot_tx_write_str("OKAY"); } else { fastboot_tx_write_str("FAILincorrect unlock code"); } return; } Obviously uploading code obtained before does not work (I've tried the hex format with and without 0x and pure binary representation of 'unlock_code'). Nothing worked. Most probably lab126 when provided with our serial number and unlock_code should be able to generate proper unlock file. Most probably they will not be eager to do so As for another mysterious commands, following two are also available: Code: > fastboot oem relock OKAY [ 0.006s] finished. total time: 0.006s So there should be possibility to relock the uboot after a successful unlock. And also: Code: > fastboot oem format I've not yet tried that, and I'm not eager to do so I hope answering an 3-month old topic will not do much harm.

01-24-2020, 04:52 PM	#44
irreld Enthusiast Posts: 35 Karma: 10 Join Date: Jan 2016 Device: PW2 PW3 DPT-RP1	If they really use fastboot and bootloader just like Android devices, perhaps getting a uboot partition dump from a jailbroken one could be helpful. Hmm. Last edited by irreld; 01-24-2020 at 08:25 PM. Reason: Wrong post.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Tools Serial Jailbreaking your fw >= 5.6.x Kindle for Dummies	grant2	Kindle Developer's Corner	563	12-13-2022 08:12 PM
Placeholder for PW4 jailbreaking notes - reminder - DO NOT UPDATE	coplate	Kindle Developer's Corner	12	11-09-2018 10:11 AM
How much would people pay for easy serial jailbreaking their paperwhite?	coplate	Kindle Developer's Corner	3	02-21-2018 12:45 PM
Serial Jailbreaking FW >= 5.6.1.1	knc1	Kindle Developer's Corner	6	08-14-2017 08:38 AM
PW4 ?	Scarpad	Amazon Kindle	5	11-29-2015 04:51 PM

08-04-2019, 03:52 AM	#31
mustdie Junior Member Posts: 8 Karma: 10 Join Date: Oct 2015 Device: Kindle	So, I used a kindle specific fastboot version (https://github.com/TobiasWooldridge/Fastboot-Kindle) to try to deal with it. How to use this fastboot? (WIN7 32-bit)

08-04-2019, 04:15 AM	#32
mustdie Junior Member Posts: 8 Karma: 10 Join Date: Oct 2015 Device: Kindle	https://www.mobileread.com/forums/sh....php?p=2000997 This is what I downloaded and used. fasboot.exe Failure to enter FastBoot mode

08-04-2019, 12:50 PM	#33
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	Is there a question hidden somewhere in there?

08-13-2019, 06:56 AM	#35
ironick Junior Member Posts: 5 Karma: 10 Join Date: Aug 2019 Device: kindle paperwhite 4	Are we successful with jailbreak on PW4 OTA updated with 5.12.1?

08-13-2019, 09:07 AM	#36
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@ironick: Double-posting is evil.

08-13-2019, 09:22 AM	#37
ironick Junior Member Posts: 5 Karma: 10 Join Date: Aug 2019 Device: kindle paperwhite 4	I understand, I beg your pardon. Please delete my post if possible.

08-15-2019, 07:14 AM	#38
stmusic Enthusiast Posts: 40 Karma: 94 Join Date: Jul 2017 Device: Kindle	Why kindle pw4 not see my keyborad, not allow me to pres ENTER in serial mode ? Kindle is plug in serial cable.

08-14-2020, 02:08 PM	#45
hius07 Wizard Posts: 1,179 Karma: 3592925 Join Date: Sep 2014 Location: Ukraine Device: Kindle	Successful serial jailbreak for KOA https://www.mobileread.com/forums/sh...d.php?t=332325 It might help here.