PW4 PW4 Serial Jailbreaking (OTA updated) - Page 4

trcm · 09-28-2020, 05:49 AM

Is there a USB recovery mode on the PW4? eg. poweron and magic key (touch?)

trcm · 09-28-2020, 07:02 AM

Hmm, OK, so we dont need to boot a diag mode specifically...

Code:

Kernel command line: console=ttymxc0,115200 consoleblank=0 uart_at_4m root=/dev/mmcblk1p8 rootwait quiet secure_cpu=1 androidboot.secure_cpu=1 androidboot.prod=1 androidboot.unlocked_kernel=false
## Flattened Device Tree blob at 83f00000
   Booting using the fdt blob at 0x83f00000
## Traversing FDT blob at 0x83f00000 for imx6sll-moonshine-wfo.dtb at offset 0x8
Found imx6sll-moonshine-wfo.dtb at 0x83f077b0, len 0x78af
   OK to initialize idme device tree
   Loading Kernel Image ... OK
   Loading Ramdisk to 9e79a000, end 9ecebc00 ... OK
   Using Device Tree in place at 83f077b0, end 83f1205e
Starting kernel ...
[    0.000000] L2C-310: enabling full line of zeros but not enabled in Cortex-A9
[    0.197978] bd71827 0-004b: Reboot Reason: WATCHDOG_RST         Watchdog Triggered Reset
[    0.197989] bd71827 0-004b: Reboot Reason: PWRON_LONGPRESS      Long Pressed Power Button Shutdown
[    0.233567] idme_init: 0 2
[    0.363504] IRQ# for BT HOST WAKE: 119
[    0.616498] cpu cpu0: dev_pm_opp_get_opp_count: device OPP not found (-19)
4.1.15-lab126 #1 SMP PREEMPT Wed Mar 20 01:53:16 UTC 2019 armv7l
[    1.199263] imx_epdc_v2_fb 20f4000.epdc: ok to request xon pins 109
[    1.206131] requesting waveform imx/epdc/epdc_ED060KC4.fw
[    2.904350] imx_epdc_v2_fb 20f4000.epdc: Update region is outside bounds of framebuffer.Aborting update.
Press [ENTER] for recovery menu...

At which point we mash the enter key....

Code:

Charge: 12% [#######:::::::::::::::::::::::::::::::::::::::::::::::::::]

Menu
====
3. Load MMC over USB storage
E. Export FAT partition
U. Update using update*.bin file on FAT partition
D. dmesg / kernel printk ring buffer.
Q. quit
Choose:

Option 3 doesn't work : "Unknown option '3'"

Annoyingly, if you dont choose something, or just hit enter before 10 seconds is up, it will proceed to BOOTING DEFAULT.

trcm · 09-28-2020, 07:19 AM

It's not happy to update with either the factory or production bin of the same version as the existing installed software.....

Code:

<12>[   10.875305] INFO:find_file:160 Found update_pw4_5.10.1.3_factory.bin
<12>[   10.875336] INFO:Skipping battery charge check
<12>[   10.875345] INFO:Found bundle /mnt-us/update_pw4_5.10.1.3_factory.bin
<12>[   10.875364] INFO:*** NORMAL MODE
<12>[   10.875622] INFO:get_bdev_sys_info: /sys/class/block/mmcblk1p8/size = 1048576
<12>[   10.875693] INFO:get_bdev_sys_info: /sys/class/block/mmcblk1p8/size = 1048576
<12>[   11.099730] *** CHECKING /mnt-us/update_pw4_5.10.1.3_factory.bin ***
<12>[   12.192683] INFO:do_unbundle: filename=/mnt-us/update_pw4_5.10.1.3_factory.bin, new_file=0x00011dc4
<6>[   12.209874] EXT3-fs (mmcblk1p8): using internal journal
<6>[   12.209889] EXT3-fs (mmcblk1p8): mounted filesystem with ordered data mode
<6>[   12.210571] kjournald starting.  Commit interval 5 seconds
<6>[   12.237394] EXT3-fs (mmcblk1p8): using internal journal
<6>[   12.237410] EXT3-fs (mmcblk1p8): mounted filesystem with ordered data mode
<6>[   12.239328] kjournald starting.  Commit interval 5 seconds
<12>[   12.277058] ERROR:OTA version is less then current device version
<12>[   12.277083] ERROR:do_unbundle: validate_version failed.
<12>[   12.284650] INFO:No uboot image found! skipping uboot installation.
<12>[   12.284678] INFO:No sbios image found! skipping sbios installation.
<12>[   12.284694] INFO:No fbios image found! skipping fbios installation.
<12>[   12.284712] ERROR:Could not unbundle /mnt-us/update_pw4_5.10.1.3_factory.bin,error_code=12
<5>[   31.244748] random: nonblocking pool is initialized
<12>[   37.436689] /mnt-us/update_pw4_5.10.1.3_factory.bin MD5SUM: 538d939c2cb4f05c7952d33d5348f010
<12>[   39.641458] INFO:removing /mnt-us/update_pw4_5.10.1.3_factory.bin
<6>[   40.030854] kernel:pmic:clamp_soc:25,vbat:3955000
<12>[   41.013299] INFO:UPDATE ERROR: 12
<12>[   41.266196] INFO:Rebooting ...

and with the production image the same

Code:

<12>[  206.363672] INFO:do_unbundle: filename=/mnt-us/update_kindle_all_new_paperwhite_v2_5.10.1.3.bin, new_file=0x00011dc4
<12>[  206.395487] ERROR:OTA version is less then current device version

Interesting that it checks for a uboot image, I wonder if it found one (an unlocked one perhaps) if it would have written it ....

NiLuJe · 09-28-2020, 08:25 AM

@tcrm: Contact @ilovejedd, she can help with that last bit

.

trcm · 09-28-2020, 01:07 PM

And all is restored to normal again, thank you to @ilovejedd for the tips.

trcm · 09-29-2020, 06:04 AM

Many interesting IDME variables, particularly downloadsize and unlock_*
alscal1: 0
alscal2: 0
board_id: P001F2xxxxxxxxxx
bootcount: xx
bootloader-version: U-Boot 2016.03
bootmode: 0
bt_mac_addr: 44004xxxxxxx
bt_mfg: 0
dev_flags: 0
device_type_id: AJRLVDTxxxxxx
downloadsize: 0x1c000000
emmc-capacity: 7818182656
fos_flags: 0
fsn: 523860850xxxx
hwid: 12
mac_addr: 440049xxxxxx
mac_sec: 787TC2A1H32DOxxxxxxx
manufacturing:
mfgdate: 20180820
oldboot: 0
postmode: 0
product_name: 0
productid2: 0
productid: 0
qbcount: 737
region: US
serial: G000PP0xxxxxxxxx
serialno: G000PP0xxxxxxxxx
smtid:
tz_keys: 2914
unlock_code: 0x0f2591d263xxxxxx
unlock_status: false
unlock_version: 1
usr_flags: 0
vcom: -2830000
version:2.1

comer · 10-24-2020, 10:44 AM

Hi,trcm

how can you get so many variables? use "idme" command in "uboot>"

or is there any way to unlock and input command in "uboot>" ?

Quote:

Originally Posted by trcm

Many interesting IDME variables, particularly downloadsize and unlock_*
alscal1: 0
alscal2: 0
board_id: P001F2xxxxxxxxxx
bootcount: xx
bootloader-version: U-Boot 2016.03
bootmode: 0
bt_mac_addr: 44004xxxxxxx
bt_mfg: 0
dev_flags: 0
device_type_id: AJRLVDTxxxxxx
downloadsize: 0x1c000000
emmc-capacity: 7818182656
fos_flags: 0
fsn: 523860850xxxx
hwid: 12
mac_addr: 440049xxxxxx
mac_sec: 787TC2A1H32DOxxxxxxx
manufacturing:
mfgdate: 20180820
oldboot: 0
postmode: 0
product_name: 0
productid2: 0
productid: 0
qbcount: 737
region: US
serial: G000PP0xxxxxxxxx
serialno: G000PP0xxxxxxxxx
smtid:
tz_keys: 2914
unlock_code: 0x0f2591d263xxxxxx
unlock_status: false
unlock_version: 1
usr_flags: 0
vcom: -2830000
version:2.1

comer

dhdurgee · 12-18-2020, 05:11 PM

Quote:

Originally Posted by hius07

Successful serial jailbreak for KOA
https://www.mobileread.com/forums/sh...d.php?t=332325
It might help here.

Good question, especially now that >5.13.3 cannot be jailbroken via software. Anyone with the appropriate tools and experience able to point the way to those unfortunate enough to receive a PW4 with the newer firmware?

Dave

HackerDude · 11-17-2023, 03:34 PM

hypothetically if someone had a PW4 with certain pads ripped... would there possibly be alternative solder points?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Tools Serial Jailbreaking your fw >= 5.6.x Kindle for Dummies	grant2	Kindle Developer's Corner	563	12-13-2022 08:12 PM
Placeholder for PW4 jailbreaking notes - reminder - DO NOT UPDATE	coplate	Kindle Developer's Corner	12	11-09-2018 10:11 AM
How much would people pay for easy serial jailbreaking their paperwhite?	coplate	Kindle Developer's Corner	3	02-21-2018 12:45 PM
Serial Jailbreaking FW >= 5.6.1.1	knc1	Kindle Developer's Corner	6	08-14-2017 08:38 AM
PW4 ?	Scarpad	Amazon Kindle	5	11-29-2015 04:51 PM

09-28-2020, 05:49 AM	#46
trcm Connoisseur Posts: 96 Karma: 100000 Join Date: Dec 2018 Location: London Device: Kobo Libra H2O	Is there a USB recovery mode on the PW4? eg. poweron and magic key (touch?)

09-28-2020, 08:25 AM	#49
NiLuJe BLAM! Posts: 13,506 Karma: 26047202 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@tcrm: Contact @ilovejedd, she can help with that last bit .

09-28-2020, 01:07 PM	#50
trcm Connoisseur Posts: 96 Karma: 100000 Join Date: Dec 2018 Location: London Device: Kobo Libra H2O	And all is restored to normal again, thank you to @ilovejedd for the tips.

09-29-2020, 06:04 AM	#51
trcm Connoisseur Posts: 96 Karma: 100000 Join Date: Dec 2018 Location: London Device: Kobo Libra H2O	Many interesting IDME variables, particularly downloadsize and unlock_* alscal1: 0 alscal2: 0 board_id: P001F2xxxxxxxxxx bootcount: xx bootloader-version: U-Boot 2016.03 bootmode: 0 bt_mac_addr: 44004xxxxxxx bt_mfg: 0 dev_flags: 0 device_type_id: AJRLVDTxxxxxx downloadsize: 0x1c000000 emmc-capacity: 7818182656 fos_flags: 0 fsn: 523860850xxxx hwid: 12 mac_addr: 440049xxxxxx mac_sec: 787TC2A1H32DOxxxxxxx manufacturing: mfgdate: 20180820 oldboot: 0 postmode: 0 product_name: 0 productid2: 0 productid: 0 qbcount: 737 region: US serial: G000PP0xxxxxxxxx serialno: G000PP0xxxxxxxxx smtid: tz_keys: 2914 unlock_code: 0x0f2591d263xxxxxx unlock_status: false unlock_version: 1 usr_flags: 0 vcom: -2830000 version:2.1

11-17-2023, 03:34 PM	#54
HackerDude Kindle Bricker Posts: 120 Karma: 862606 Join Date: Sep 2022 Location: Why do you want to know? Device: PW6, PW6(dead), PW5 (brick), PW5 (brick), PW4 (brick)	hypothetically if someone had a PW4 with certain pads ripped... would there possibly be alternative solder points?

Advert

Advert