Tools Software Jailbreak for PW2, PW3, PW3W, KT2, KV, KOA and KT3

[eschwartz]

Originally Posted by knc1

Since Branch Delay has formally announced that he is gone . . .
Let us see if some super moderator can transfer ownership of that thread.
(Some forum softwares allow that, I don't know about this one.)

I don't think this one can, but me or NiLuJe can effectively do the same by applying our own edits ad infinitum.
pdurrant did (had to do) the same with adamselene's KindleUnpack thread.

...

We can exploit the /var/local/system/{{,onetime}fixup,locale} to mntroot rw and replace the default screensaver, but that might be too invasive. Is there another jailbreak splash screen I am not remembering?

[knc1]

Originally Posted by geekmaster

I should probably get back on my kindle video player with sound, in honor of twobob. Or do cancer research. Or figure out what is important from my new perspective. Old habits die hard.

If I do not check PMs, just email me if you need pastebin updates. I get weary from fear when I post here, missing the comfort and safety of days gone by.

I am getting:
"Why aren't you using your free trial"
messages from CDN77 marketing.

I will try to get that up today and we can make it first choice (link, blank line, other links) and see if we can burn through the 1TB trial limit in a day.

It will probably be: http://cdn77.gunshi.org
but don't hold me to that, I have never used their system before.

AND
I will tell the marketing guy that authors those "why aren't you using it" messages of exactly what/why/how I am doing it 'test' their system.
If he objects to every Kindle owner in the world seeing his company's name in the url - TS.

[geekmaster]

Originally Posted by eschwartz

... We can exploit the /var/local/system/{{,onetime}fixup,locale} to mntroot rw and replace the default screensaver, but that might be too invasive. Is there another jailbreak splash screen I am not remembering?

Yes there is another jailbreak splashscreen that you either forgot or were never aware of at a sufficient level of implementation detail. The one with the boy under the tree with "jailbreak" curved over the top. It was a raw framebuffer image, which the jailbreak copied into /dev/fb0 and forced an eink update. No touching rootfs at all.

I propose doing it exactly that way just as previous jailbreaks did since the .mp3 exlpoit. Except for Branch Delay, who put some text on the titlebar instead (which broke on newer kindles though I posted how to fix it in another thread (I discovered a replacement that writes to the titlebar with a similar lipc command as what BD used, when his still worked). Also except for NiLuJe who just eips-prints "*** Jailbreak ***" near the bottom of the screen.

I propose following in the footsteps of yifanlu and ixtab, for this release (so hackaday has "pretty UX stuff" to post, and to end the "how do I tell if the jailbreak worked?" posts).

If somebody else could do exactly that, I can spend my time doing stuff others may not be able to do without a struggle.

[geekmaster]

Originally Posted by knc1

... I will let the marketing guy that authors those "why aren't you using it" messages of exactly what I am doing to 'test' their system.

My parsing algorithm breaks on that sentence. My best guesses seem arbitrary. Perhaps "of" should be "guess" or "learn" or "find out"? Could you reword it or choose one of my replacements? Thanks.

[knc1]

I will tell...

[eschwartz]

Originally Posted by geekmaster

Yes there is another jailbreak splashscreen that you either forgot or were never aware of at a sufficient level of implemenatation detail. The one with the boy under the tree with "jailbreak" curved over the top. It was a raw framebuffer image, which the jailbreak copied into /dev/fb0 and forced an eink update. No touching rootfs at all.

I propose doing it exactly that way just as previous jailbreaks did since the .mp3 exlpoit. Except for Branch Delay, who put some text on the titlebar instead (which broke on newer kindles though I posted how to fix it in another thread (I discovered a replacement that writes to the titlebar with a similar lipc command as what BD used, when his still worked). Also except for NiLuJe who just eips-prints "*** Jailbreak ***" near the bottom of the screen.

I propose following in the footsteps of yifanlu and ixtab, for this release (so hackaday has "pretty UX stuff" to post, and to end the "how do I tell if the jailbreak worked?" posts).

If somebody else could do exactly that, I can spend my time doing stuff others may not be able to do without a struggle.

Makes sense (I knew about framebuffer tricks already), and now I think I remember.


I will look into it I guess. Time to pry open some of the older jailbreaks and see how they tick (and find the existing framebuffer image).

It might have to wait until Sunday, since I am Jewish I will be offline tonight and tomorrow.

[geekmaster]

Originally Posted by eschwartz

Makes sense (I knew about framebuffer tricks already), and now I think I remember.


I will look into it I guess. Time to pry open some of the older jailbreaks and see how they tick (and find the existing framebuffer image).

It might have to wait until Sunday, since I am Jewish I will be offline tonight and tomorrow.

Beware that you will need multiple resolutions of images, and display them based on serial number prefix (see NiLuJe's serial brancing script code). But they gzip compress quite well, so multiple uuendoded gzip images inside the script is not a big concern, or as ixtab did, append the binary onto the end of the script and 'dd' it onto the framebuffer.

[knc1]

Which might be broken with the Oasis changes -
but its a script - anything can be special cased.

[geekmaster]

Extra work, not essential, detracts from code elegance, extra point of failure, but required by non-nerds or they get angry from insufficient eye-candy (i.e. "User Experience Marketing" expectations). Other than that, nerd one-upmanship demands it.

[knc1]

100 downloads of the support files in last 12 hours, zero trouble reports.
I am taking credit for that with my midnight edition of the directions.
(I like #2 now, much better than the first draft)

[NiLuJe]

@GM/@knc1: We don't (really) have code execution, so an image/eips message is out (with the current method, at least). A document, *that* we can do. On the other hand, I *think* the framework restart is pretty obvious already?

That, and what Eli said, we can totally proxy-maintain a thread, not a problem .

@all: I did mention that *nothing* was packaged (or, worse, actually has code to support) for the Oasis yet, right? That includes KUAL .

[geekmaster]

Originally Posted by NiLuJe

@GM/@knc1: We don't (really) have code execution, so an image/eips message is out (with the current method, at least). A document, *that* we can do. On the other hand, I *think* the framework restart is pretty obvious already?

That, and what Eli said, we can totally proxy-maintain a thread, not a problem .

@all: I did mention that *nothing* was packaged (or, worse, actually has code to support) for the Oasis yet, right? That includes KUAL .

Can't the tarbomb drop a cronjob or upstart script? Or perhaps a framebuffer itself and hope for a fullscreen update with a partial screen change? Worth a try, at least.

I need to explore the BD JB package, when time.

FYI, I am walking (barely) without a cane now, so much better than expected.

[NiLuJe]

I'm wary of adding stuff to the rootfs just for a one-off thing...
So I'd go with a doc, if we really really really want user-feedback.

(I'm still not convinced that it's terribly useful, but that's not a new argument, I had the same one the last time this came up ).

[geekmaster]

Originally Posted by NiLuJe

I'm wary of adding stuff to the rootfs just for a one-off thing...
So I'd go with a doc, if we really really really want user-feedback.

(I'm still not convinced that it's terribly useful, but that's not a new argument, I had the same one the last time this came up ).

Absolutely NOT useful for nerds, other than to avoid social problems when presenting this to the outside world.

[geekmaster]

How about dropping a multi-serialno-support /var/local/MNTUS-PARAMS (or whatever it was called) like the old RUNME.SH recovery tarbombs used? We could even drop a one-shot RUNME.sh like we did back then. Too risky for a non-bricked device? Yeah, cost/benefit probably not worth it.

The problem is that tarbombs cannot append, only replace. But they could drop more than a JB key, including a known-safe upstart script including RP or CRP, and perhaps the hotfix built-in.

Mandatory steps should be included in the JB tarbomb IMHO, for less installation steps (less points of failure).