Tools Software Jailbreak for PW2, PW3, PW3W, KT2, KV, KOA and KT3

[ShaNoob]

Cheers, you're both legends. I guess I didn't get that bit to sink in properly when I was haphazardly skimming through the JB/extension install instructions

Thanks again for humouring me

[strategist922]

My Device is Kindle PW3 SN prefix is "G090G105" bought Amazon US.
I can successfully downgrade firmware to 5.7.4(2929620018)
but when I want go to next step ";installHtml"
nothing happen@@
could someone give me a hand?

Originally Posted by knc1

Software jail break for the 6th, 7th, and 8th generation devices listed in the title, running any known firmware version.
Except for the G090LK, G090LL (Black and White, PW-3, 32GB, Wifi only) models along with the corresponding two Wifi+3G versions.

Step #1 below describes how to learn what nickname your device has here based on its serial number.

These directions are written for the experienced (grayscale) Kindle user.

Testing (touchscreen devices listed in title):
Attached below is a "Dummy" installation package which will test the jail break installed on your device.
If it runs, your JB is complete. If it fails to run, your JB is missing or damaged.
This dummy install package will not install anything, only write a report document in the top level of visible USB storage (dummy_updatetest.log, example attached below).
If this test package fails to write its report, follow these directions exactly and completely Step #0 to and including Step #8.

Spoiler:

1. Download the attached archive.
2. Open the archive.
   The archive contains a single directory, "Dummy", all contents are in that directory.
3. From the archive contents in the "Dummy" directory, move the file: Update_dummy_0.0.N.bin to the /mrpackages directory of your Kindle.
   If you do not have a /mrpackages on the visible root of your kindle, you either have a damaged JB or the JB was never installed.
4. Trigger the test package installation either from KUAL or from the main search bar:

   ;log mrpi

   command.
   If the KUAL 'install mrpackages' button works but the ;log mrpi command does not work, then the JB survival code is missing or damaged.

PW-2 users running firmware 5.4.4.2 or older, go directly to:
PW-2 Early firmware versions, jail break

For prior (grayscale) Kindle models, see:
Legacy devices, jail breaks

Credits:

Spoiler:

• NiLuJe - for discovering the initial factory update could be recovered. PW-2
• knc1 - for posting the 'HowTo' and recovering the KT-2 and PW-3 initial updates.
• Forum members - several members who recovered and provided initial update images for the KV.
• knc1 - recognition that the factory initial update could be re-installed on any (matching) customer model.
• Branch Delay - the original software jb for version 5.6.5 and the generic jb for initial factory images.
• Branch Delay, NiLuJe, Geekmaster - initial testing of the method.
• Geekmaster - archivist of the off-site Kindle recovery resources.
• knc1, Geekmaster, NiLuJe, kindlefere - server resources.
• NiLuJe, Ryccardo, eschwartz - recognizing and testing of the source of the hung Kindles problem.
• Forum member - who recovered the image required to create Oasis support.
• eeeee - who recovered the image required to create updated, PW-3 and PW-3W support.
• ktwombley - who recovered the image required to create KT3 support.
• eschwartz - now the maintainer of Branch Delay's factory image jail break.
• eschwartz, NiLuJe, others - New menu launcher for Oasis (KOA) and other models.
• The first public announcement was made by Hackaday, see:
  https://hackaday.com/2016/07/09/a-ja...-every-kindle/
  Which can take credit for many of this thread's views.

A long list of a lot of work done over a period of more than a year. Work that is continuing.
This downgrade attack did not happen over-night nor was it the work of any one person.

Release Policy:

Spoiler:

It is our policy to use a 'single point of maintenance' model for our released items, with one exception:

• NiLuJe's snapshots, use: (filter prefix: tools, show threads).
  Users should always check the snapshot thread for the most recent build of our after-market add-ins.

Make Ready:
Consider the following bullet list a "Step #0" that can be done in any order.

• For some firmware versions, your Kindle must be registered with Amazon to access the required menus.
  The general rule to cover all versions, is: If not yet registered, do that now.
• Remove any device passcode or parental control passcode you may have set.
• If you have an ad supported (Special Offers) model consider unsubscribing it at your Kindle account.
  If you do unsubscribe from special offers, be sure to give your Kindle enough time on-line for Amazon's servers to update its local status files.
• Is your Kindle fully charged?
  Get started with that now, put it on a wall charger to be certain.
• Only do one step at a time.
  They are intended and designed to be done one at a time.
  At the completion of a step, if the file you previously put at the top level of visible USB storage is still there, remove it.
• Your Kindle should remain off-line (in airplane mode) during this procedure.

Step-by-Step:

1. Positively identify the nickname of your Kindle model from the serial number.
   Use four of the first six characters, older Kindles: xxxx xx, newer Kindles: xx xxxx in this table:
   Serial Number Nicknames
   The factory images **are not** model locked, your care taken with this step is your Kindle's only protection! If not found in the table, STOP HERE and tell us.
2. Prepare your Kindle for running an earlier version of the firmware.
   The Kindles have two user storage areas, the one seen over the USB cable and a hidden one.
   The process that wipes the hidden one will also wipe what can be seen over the USB cable.
   
   Spoiler:

   • Make backup copies of the contents of /documents
     You are about to wipe them all out, if you have them pushed to your Kindle's cloud, you should be covered.
     You should not need copies of the contents of /system - the 'system' should re-build them for you.
   • Do not copy the contents of /documents back to the Kindle until after you have returned to the same firmware version that you copied them from.
     The indexer might go crazy if you try anything else than 'back to same place, with same version running'.
   • You are about to lose all personalization of your kindle.
     You can't reach that hidden directory they are stored in and it is this database that causes most of the problems, so it MUST go.
   • Home -> Menu -> Settings -> Menu -> Reset
     Or whatever the path is on your current firmware version.
     This is the infamous "Reset (to factory defaults)" menu choice, but in this case it is a requirement, a must use entry.
     
     This is the ONLY TIME you should ever use the Reset menu entry in the lifetime of the device because it wipes out a vital part of what is about to be added.
     NEVER AGAIN USE THE "Reset" MENU ENTRY. Never.
3. Download your model's initial factory firmware image to your computer from one of these (IPv4 only) links.
   The *.md5 validation file may be used to confirm that the download was complete and correct.
   • Primary (Confirmation panel but no wait delay.)
     
     Spoiler:

     • KOA
       factory_KOA_5.7.4_initial
       factory_KOA_5.7.4_md5
     • KV
       factory_KV_5.5.0_initial
       factory_KV_5.5.0_md5
     • KT3
       factory_KT3_5.8.0_initial
       factory_KT3_5.8.0_md5
       
     • KT2
       factory_KT2_5.6.0_initial
       factory_KT2_5.6.0_md5
     • PW3
       factory_PW3_5.7.4_initial
       factory_PW3_5.7.4_md5
     • PW2
       factory_PW2_5.4.3.2_initial
       factory_PW2_5.4.3.2_md5
   • Secondary
     
     Spoiler:

     • KOA
       factory_KOA_5.7.4_initial
       factory_KOA_5.7.4_md5
     • KV
       factory_KV_5.5.0_initial
       factory_KV_5.5.0_md5
     • KT3
       factory_KT3_5.8.0_initial
       factory_KT3_5.8.0_md5
       
     • KT2
       factory_KT2_5.6.0_initial
       factory_KT2_5.6.0_md5
     • PW3
       factory_PW3_5.7.4_initial
       factory_PW3_5.7.4_md5
     • PW2
       factory_PW2_5.4.3.2_initial
       factory_PW2_5.4.3.2_md5
4. After validating the downloaded file, transfer the initial factory image from your computer to your Kindle.
   Do not panic if the update is not immediate, it usually takes 10 minutes or longer.
   
   Spoiler:

   1. Connect Kindle to PC with the USB cable.
   2. Place the downloaded update_*.bin file in the topmost, visible level of USB storage (alongside of /documents).
   3. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   4. Remove the USB cable.
   5. Home -> Menu -> Settings -> Menu -> Update Your Kindle
   6. Confirm
   7. Wait
   
   ** The PW-2 is a special case at this point in the directions **
   1. Use the prior 'universal jailbreak' from this post:
      Old Universal Jail Break
   2. After completing those directions, skip the next two steps here and continue with Steps #7 and #8 below.
5. Download and install the current version of Branch Delay's factory firmware jail break.
   This step installs two files, our signature certificate and a 'Jail Broken' document.
   If the 'Jail Broken' document is not on your Kindle in the /documents folder after the completion of this step, then the certificate is not on it either!
   If this happens to you, stop here and post about the problem, there is no reason to continue if the JB is now missing.
   
   The current version is attached to its release post, see:
   Factory Image Jail Break
   
   Spoiler:

   1. Connect Kindle to PC with the USB cable.
   2. Place the downloaded file (an archive - as is) in the topmost, visible level of USB storage (alongside of /documents).
   3. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   4. Remove the USB cable.
   5. Home
   6. Search bar, enter:
      

      ;installHtml

      Press 'return'
      Yes, the semi-colon is part of the search bar command string.
6. Download and install the current 'hotfix'
   The current version is attached to its release post, see:
   Jail Break Survival Code
   
   Spoiler:

   1. Unarchive the release archive package.
   2. Connect Kindle to PC with the USB cable.
   3. Place the Update_jailbreak_hotfix_*_install.bin in the topmost, visible level of USB storage (alongside of /documents).
   4. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   5. Remove the USB cable.
   6. Home -> Menu -> Settings -> Menu -> Update Your Kindle
   7. Confirm
   8. Wait
7. You can now update your Kindle to a newer firmware version, the jailbreak will survive.
   • Current firmware version by OTA:
     Allow the Kindle to connect to the Internet and wait.
     It will update over the air to the current firmware version
     OR:
   • Manual download from Amazon and install a selected firmware version.
     • To prevent OTA updates, add the OTA blocker directory (folder) name to the top level of visible USB storage.
       The blocker directory is named: update.bin.tmp.partial
       Use that exact name, no additional extension, no contents.
     • You can get any released firmware version from the Amazon download server.
       The following gives direct links to the Amazon download server for selected firmware versions.
     • Amazon
       
       Spoiler:

       • KOA
         customer_KOA_5.7.4_update
         customer_KOA_5.8.1_update
         customer_KOA_5.8.2_update
         customer_KOA_5.8.5_update
         customer_KOA_5.8.7_update
       • KV
         customer_KV_5.7.4_update
         customer_KV_5.8.1_update
         customer_KV_5.8.2_update
         customer_KV_5.8.5_update
         customer_KV_5.8.7_update
       • KT3
         customer_KT3_5.8.1.1_update
         customer_KT3_5.8.2_update
         customer_KT3_5.8.5_update
         customer_KT3_5.8.7_update
       • KT2
         customer_KT2_5.7.4_update
         customer_KT2_5.8.1_update
         customer_KT2_5.8.2_update
         customer_KT2_5.8.5_update
         customer_KT2_5.8.7_update
       • PW3
         customer_PW3_5.7.4.1_update
         customer_PW3_5.8.1_update
         customer_PW3_5.8.2_update
         customer_PW3_5.8.5_update
         customer_PW3_5.8.7_update
       • PW2
         customer_PW2_5.7.4_update
         customer_PW2_5.8.1_update
         customer_PW2_5.8.2_update
         customer_PW2_5.8.5_update
         customer_PW2_5.8.7_update
8. All of the models covered in this thread must use one of the two following installation methods.
   The KOA and KT3 owners must use the new installation methods.
   The other device models may use either the old or the new installation methods.
   
   Spoiler:

   1. Any of our after-market add-ins, with an update_*.bin format filename requires the use of the Mobileread Package Installer (MrPI).
      • Get the MR Package Installer from the KUAL and KUAL extensions section of:
        https://www.mobileread.com/forums/sh...d.php?t=225030
      • This is an "un-archive to top level of visible USB storage" package.
        Be sure that the un-archive tool you use has options set to create directories.
      • KOA and KT3 owners:
        You must run the installer with your new, search bar command: ;log mrpi
        Other models covered in this thread may do the same or may run it from KUAL.
   2. Nearly all of our after-market add-ins require an application launcher.
      • Get the KUAL package from the KUAL and KUAL extensions section of:
        https://www.mobileread.com/forums/sh...d.php?t=225030
      • Beginning with version 2.6.40 of the release, the archive contains three (3) different builds of KUAL.
        The 'keyboard' version, the '(old) touchscreen' version, and the new 'KOA, KT3' version.
      • This is not a substitute for reading the README.txt file included in the archive bundle, but ...
        • KOA and KT3 owners:
          You must use the update_*.bin format package of KUAL and you must use the MrPi installer to install it.
        • Other devices:
          The archive still contains the previous 'document' style of KUAL, used by just placing the (correct) KUAL document into the /documents folder of USB storage.
          Note: The new (update_*.bin format KUAL) will run on all touchscreen devices running firmware 5.1.2 or newer.
      • "Nearly all applications require an application launcher" - I was expecting someone to ask . . . .
        KUAL is one of the applications that does not required an application launcher.
        It has a mime type associated with it that tells the system how to run it, when it is selected.

[knc1]

Give complete details of how you followed Step #5 please.
Keystroke by keystroke.
Repeat it if you do not remember and keep notes.

What PC are you using? MacOSx for instance?

[strategist922]

I use windows 10 enterprise 64 bit edition
And very sure followed each steps in step 5.

[knc1]

Originally Posted by strategist922

I use windows 10 enterprise 64 bit edition
And very sure followed each steps in step 5.

Well, you did something that you should not have done or did not do something that you should have.

Since I can not see over your shoulder, you must either write down what you did or solve the problem yourself.

You know that tens of thousands of people have done this without problems, which means you know the problem is most likely local to your attempt.
If you don't want to help us, help you, your on your own.

[strategist922]

Dear knc1,

Should I re-start from step 1 ? or start from step 5?

Thanks and best regards,

Originally Posted by knc1

Well, you did something that you should not have done or did not do something that you should have.

Since I can not see over your shoulder, you must either write down what you did or solve the problem yourself.

You know that tens of thousands of people have done this without problems, which means you know the problem is most likely local to your attempt.
If you don't want to help us, help you, your on your own.

[knc1]

I have no way of knowing, since you refuse to say what you did.

All I can say from the information you have given is to carefully, completely, do as directed in Step #6, it will work when you get it correct.

But this exchange shows how you are when it comes to: "do as directed" - mostly you don't.

[dgxianxin]

Hi

I am new to jailbreaking kindle, so I apologise if I ask stupid questions. I have followed your steps and successfully jailbroke my Kindle Paperwhite 7th Gen (PW3). However, I have few questions in mind:

1. Why it is mentioned that we can't use reset button anymore? What will happen if I accidentally press it?

It is mentioned in the first post "This is the ONLY TIME you should ever use the Reset menu entry in the lifetime of the device because it wipes out a vital part of what is about to be added.
NEVER AGAIN USE THE "Reset" MENU ENTRY. Never."

2. I successfully jailbroke my device while running on the latest firmware attached in the first post, which is 5.8.7. However, I noticed that the latest version in amazon website (my device is from amazon.co.jp) is 5.8.7.0.1. What to do to update my firmware while keeping my jailbreak? Should I run everything again from Step 0, or Step 1 (since I can't use reset button anymore), or just simply upgrade the firmware?
I know that it is a very minor change firmware compared to what is installed (5.8.7) I am asking for the future updates too

3. What will happen with the KUAL, mrpackagesinstaller, and all of the extensions after the firmware update? Do i need to install them all over again? (assuming I don't need to re-do from Step 0 or 1 when I update my firmware)

Thank you so much for the great post knc1! That is really a comprehend guide for a noob like me!

[Cinisajoy]

1. Because a factory reset erases everything you have on the kindle.
So do not accidentally do it.

3. The jailbreak will hold but you will need to reinstall MRPI and any hacks you installed after any firmware update.

[dgxianxin]

Originally Posted by Cinisajoy

1. Because a factory reset erases everything you have on the kindle.
So do not accidentally do it.

3. The jailbreak will hold but you will need to reinstall MRPI and any hacks you installed after any firmware update.

You mentioned that the jailbreak will hold

So to answer my question 2, I am assuming I can just simply update my firmware without having to do the steps to jailbreak again (which involve reset and downgrade to 5.7.4)? and then next, I just need to install MRPI and any hacks I had previously, is that right?

[Cinisajoy]

Originally Posted by dgxianxin

You mentioned that the jailbreak will hold

So to answer my question 2, I am assuming I can just simply update my firmware without having to do the steps to jailbreak again (which involve reset and downgrade to 5.7.4)? and then next, I just need to install MRPI and any hacks I had previously, is that right?

Yes..

[dgxianxin]

Originally Posted by roger64

Hi

Way to go?

I have been a year a quite happy user of Koreder. However after an install of KPVBooklet which I found unstable, I uninstalled it. It had left a lot of documents on the Kindle side that I could not erase, even if the documents were gone... Now my mistake: I thought I could only deregister and register again my Kindle to Amazon to make these empty documents disappear. Not only they stayed but Amazon politely informed me that my PW3 wifi G090 G1 version 5.7.2.1. was no longer a test machine and that I had to inform "Developer". (see screenshot which I do not translate). The effect of such a warning is that, for example, I cannot launch KUAL and instead a dialogue box pops up telling me to read this letter...

What I did after that

I upgraded -downgraded successfully to 5.7.4. initial bin after downloading it (735 MB) but the Amazon warning is still in place.

Question

I am looking for advice: should I reinitialize totally the PW3 and downgrade again to version 5.7.4. initial?

Should I try directly some jailbreak even with this Amazon warning?

Thanks for your help and advice.

EDIT: now on my way to a successful new jailbreak, after a full reset, 5.7.4 and so on.

I did not read any previous warning about NOT REGISTER. It makes you lose some hours...

I just did the same to my newly jailbroken PW3

I read somewhere that you just need to go offline (airplane mode) and restart your device after you register the new account. The bridge code will restore the keys during startup.

[badgoodDeb]

Originally Posted by Cinisajoy

1. Because a factory reset erases everything you have on the kindle.
So do not accidentally do it.

3. The jailbreak will hold but you will need to reinstall MRPI and any hacks you installed after any firmware update.

Originally Posted by dgxianxin

You mentioned that the jailbreak will hold

If you manage to do the factory reset, THAT is the one time when the jailbreak will not hold. That's the only reason they say to never never do it. If you are reselling the device, or you really WANT the jailbreak to go away, by all means do a reset! It's not like a reset will break your device, or anything. It'll just remove the jailbreak. [And all your downloaded books, etc]

[Cinisajoy]

The jailbreak will hold through firmware updates, not a factory reset.

[knc1]

Everybody is correct to a certain extent.

There is one part of the Kindle system (the majority of it) that is completely replaced by an Amazon update.
That includes over-writing our signature certificate (a.k.a: the "jail break").

There are two parts of the Kindle system that is not disturbed by an image update, they are:
The user's local data (which the user can not see).
The user's local documents (which the user can see over USB).

We include in the user's local data, the files required to replace (re-jailbreak?) the newly installed Amazon image by restoring our signature certificate.

Selecting "(Factory) Reset" erases all of the user's local files.
That includes the files required to restore the signature certificate after an Amazon update.

Then installing an Amazon update over-writes the signature certificate (a.k.a: the jail break).

= = = = =

Why did I write "never again use the reset function" ?

a) Because the object of this thread is to jail break the Kindle.

b) And an unwritten object of this thread is to keep it jail broken.
That is just assumed, that since the user went to a lot of trouble to do it, they want to keep it.
(and in step #7, the user will over-write the signature certificate, which will then need to be auto-replaced.)

Selecting the "Reset" function erases everything required to keep the device jail broken across Amazon updates. That is, "Reset" undoes (b) above.
People are told while doing (a) not to erase those things needed for (b), ever.

= = = =

Now people should be able to understand why it takes from 3 months to over a year to devise one of these jail break procedures. It is a complex undertaking.