How to jailbreak 5.6.1.0.2 (serial port) step by step

[eschwartz]

Use Kindletool -- it gets updated as things change.

Use the version from the snapshots thread

[zhangsiyan12134]

Originally Posted by eschwartz

Use Kindletool -- it gets updated as things change.

Use the version from the snapshots thread

I think this is just a firmware unpack&re-pack tool, how to use this tool to jailbreak? Is there any guidance?

Oh! OK! I just find the command!

KindleTool info <serialno>

I will try it once I set up my environment on my Raspberry Pi~

Thank you~

[knc1]

Originally Posted by zhangsiyan12134

Hi, everyone.

I successfully jailbreak my Kindle Paperwhite 2 before, and somehow I turned on wifi, now my Kindle is on OFW 5.6.2.1. I tried both Python script and https://www.sven.de/kindle/ this website, but none of the giving the right password for root. One thing I noticed that strange was my Kindle S/N start with "90D4" not same as what I saw in other topics.

Thank you!

I presume you mean in the "main" system (the only one replaced by an update).
Since the update is a complete replacement of the system files, your /etc/passwd and /etc/shadow files have also been replaced.
And that means your 'root' username on the "main" system is now set to dis-allow password logins.
The password for your 'root' username on the "diags" system has not changed.

Since you where jailbroken before, check if you are still jailbroken.
And/Or
Just run the 'hotfix' script just to be sure.

Then you will have to re-install everything you had installed - just the same as any other full image update.

Only now, since your on firmware 5.6.x series, you have to use the Mobileread Package Installer (MrPI).
Which is an extension for the KUAL menu - so you have to have that installed also.

Get all of your packages from NuLuJe's "snapshot" thread.

- - - -

You didn't mention what way you are trying to access your Kindle.
Over the USB cable? Over Wifi? From a Kindle terminal?
Using ssh? Using telnet?

Duh ....
There is a lot of information you failed to include.

So just ignore the failure to supply enough information to give a short, specific answer.
Do all of the following:
Hotfix your jail break -
Install Kual -
Install MrPI -
Install USB network -
Enable it (it installs KUAL menu items for that purpose) -
Use TelNet over the USB cable to access your Kindle (TelNet over the USB cable does not require a password - it is modified for just this purpose).

[zhangsiyan12134]

Originally Posted by knc1

I presume you mean in the "main" system (the only one replaced by an update).
Since the update is a complete replacement of the system files, your /etc/passwd and /etc/shadow files have also been replaced.
And that means your 'root' username on the "main" system is now set to dis-allow password logins.
The password for your 'root' username on the "diags" system has not changed.

Since you where jailbroken before, check if you are still jailbroken.
And/Or
Just run the 'hotfix' script just to be sure.

Then you will have to re-install everything you had installed - just the same as any other full image update.

Only now, since your on firmware 5.6.x series, you have to use the Mobileread Package Installer (MrPI).
Which is an extension for the KUAL menu - so you have to have that installed also.

Get all of your packages from NuLuJe's "snapshot" thread.

- - - -

You didn't mention what way you are trying to access your Kindle.
Over the USB cable? Over Wifi? From a Kindle terminal?
Using ssh? Using telnet?

Duh ....
There is a lot of information you failed to include.

So just ignore the failure to supply enough information to give a short, specific answer.
Do all of the following:
Hotfix your jail break -
Install Kual -
Install MrPI -
Install USB network -
Enable it (it installs KUAL menu items for that purpose) -
Use TelNet over the USB cable to access your Kindle (TelNet over the USB cable does not require a password - it is modified for just this purpose).

Thanks for your info. The Password that generated by KindleTool is working!

PS. I access kindle through on board Serial Port.

[knc1]

Are you running the "main" or the "diags" system? (the Kindles are dual boot)

What does the line about user named 'root' in /etc/passwd contain. (just cut and paste it, it doesn't disclose anything)
Prior to 5.6.5 the account for 'root' was locked.

[zhangsiyan12134]

Originally Posted by knc1

Are you running the "main" or the "diags" system? (the Kindles are dual boot)

What does the line about user named 'root' in /etc/passwd contain. (just cut and paste it, it doesn't disclose anything)
Prior to 5.6.5 the account for 'root' was locked.

root:x:0:0:root:/tmp/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:100:sync:/bin:/bin/sync
operator:x:37:37:Operator:/var:/bin/sh
sshd:x:103:99:Operator:/var:/bin/sh
messagebus:x:92:92:messagebus:/bin/false
nobody:x:99:99:nobody:/tmp:/bin/sh
default:x:1000:1000:Default non-root user:/dev/null:/bin/sh
framework:x:9000:150:Framework User:/tmp/framework:/bin/sh

I already changed password by using:

mntroot rw
passwd

and when I run the jb.sh, I got a error

[root@kindle us]# bash jb.sh
info jb_install:mount_root_rw::Mounting rootfs rw
info jb_install:install_update_key::Copying the jailbreak updater key
jb.sh: line 305: can't create /etc/uks/pubdevkey01.pem: nonexistent directory
info jb_install:install_fw54_exec_userstore_flag::Creating the userstore exec flag file
info jb_install:install_bridge::Installing the jailbreak bridge
info jb_install:install::Setting up MKK persistent copy
info jb_install:install::Setting up RP persistent copy

But the funny thing on kindle screen shows:

DIAGS Exit
Please use serial port





**** JAILBREAD ****

Is this means jailbreak successfully?

[knc1]

The:

root:x:0:0:root:/tmp/root:/bin/sh

indicates that root has a password set in /etc/shadow.

But as you said, you did that yourself.
So we don't know what the Amazon image had in it.

Personally, I think you are still running the "diags" operating system, not the "main" operating system.
It is the only thing that I can think of which would make your findings reasonable.

Over your serial connection, try entering these commands:
mkdir /tmp/main
mount /dev/mmcblk0p1 /tmp/main

If your in 'main' I would expect you to get a 'device busy' sort of message.
If your in 'diags' it will just mount the 'main' partition at /tmp/main

and/or
do a:
cd /
df .
The 'main' file system is much bigger than the 'diags' file system.

[zhangsiyan12134]

Originally Posted by knc1

The:

root:x:0:0:root:/tmp/root:/bin/sh

indicates that root has a password set in /etc/shadow.

But as you said, you did that yourself.
So we don't know what the Amazon image had in it.

Personally, I think you are still running the "diags" operating system, not the "main" operating system.
It is the only thing that I can think of which would make your findings reasonable.

Over your serial connection, try entering these commands:
mkdir /tmp/main
mount /dev/mmcblk0p1 /tmp/main

If your in 'main' I would expect you to get a 'device busy' sort of message.
If your in 'diags' it will just mount the 'main' partition at /tmp/main

and/or
do a:
cd /
df .
The 'main' file system is much bigger than the 'diags' file system.

This：

mkdir /tmp/main
mount  /dev/mmcblk0p1 /tmp/main

gives me：

[root@kindle /etc]# mount /dev/mmcblk0p1 /tmp/main
[ 3255.534173] EXT3-fs: barriers not enabled
[ 3255.538985] kjournald starting.  Commit interval 5 seconds
[ 3255.588311] EXT3-fs (mmcblk0p1): using internal journal
[ 3255.593570] EXT3-fs (mmcblk0p1): mounted filesystem with writeback data mode
[root@kindle /etc]# cd /

And

cd /
df

gives me

[root@kindle /]# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                63703     25119     35384  42% /
tmpfs                   127844         4    127840   0% /dev
tmpfs                   127844         0    127844   0% /dev/shm
/dev/mmcblk0p3           63461     17538     42647  29% /var/local
/dev/loop/0            1396728    402232    994496  29% /mnt/base-us
fsp                    1396728    402232    994496  29% /mnt/us
/dev/mmcblk0p1          356471    300293     49016  86% /var/tmp/main

I think it's still in Diags mode. So how can I go to "Main Mode"?

[knc1]

**IT IS** in the 'Diags' operating system!
That is why the password given by kindletool worked.

Now that you have the 'Main' operating system's root file system mounted at /tmp/main
Edit the file: /tmp/main/etc/passwd
to make the second field of the 'root' password empty.
From
root:!: ..... whatever
To
root:: ..... whatever

Now, when you do start running the 'main' os - the login for user 'root' is blank - just press enter.

In this case, your Kindle is depending on the physical security of the USB cable (or serial port cable).
Probably a safe bet that no one is wire tapping those without you noticing.

[zhangsiyan12134]

Thanks a lot！ Now I got it！

[knc1]

You need to scale down those pics before a moderator finds them!
600x600 pix max IIRC.

[eschwartz]

Moderator Notice

Please take a few moments to read our Posting Guidelines, in particular the part about the maximum image size allowed (600x600 pixels). Images that violate those guidelines will be deleted.

Feel free to update your original post with an appropriately-resized image, or use our attachments feature (in the Go Advanced reply mode).

Thanks.

[zhangsiyan12134]

Originally Posted by knc1

You need to scale down those pics before a moderator finds them!
600x600 pix max IIRC.

Thanks but too late~

[eschwartz]

hehehe.
Thanks for resizing them -- oftentimes people don't, which can leave information gaps.

[zhangsiyan12134]

Originally Posted by eschwartz

hehehe.
Thanks for resizing them -- oftentimes people don't, which can leave information gaps.

No problem, I will remember to resize pics next time.