Tools Serial Jailbreaking your fw >= 5.6.x Kindle for Dummies

[Mikii]

You have a point, knc1. I think I saw it scrolling on the putty screen, but when the bootm process finished, It was only visible on my kindle screen, on my PW3.

[Mikii]

Hello everybody,

after some struggle, I was finally able to complete a jailbreak using a Mac computer. You really have to go an extra mile if you want to use a Macintosh, but you end up having a perfectly working Putty port on your mac.

My configuration is:

Nome modello:	iMac
  Identificatore modello:	iMac12,2
  Nome processore:	Intel Core i7
  Velocità processore:	3,4 GHz
  Numero di processori:	1
  Numero totale di Core:	4
  Cache L2 (per Core):	256 KB
  Cache L3:	8 MB
  Memoria:	20 GB
Versione sistema:      macOS 10.13.3 (17D102)
Versione kernel:	Darwin 17.4.0

This post explains how to prepare a mac for jailbreaking.
All this info relates to my personal experience.

How to prepare a mac for jailbreaking.

1. Install mac putty using these instructions here: https://onvinetech.wordpress.com/2016/01/26/49/
(note: this will also install python !).

2. Install the latest quartz release (you need X11 which is in there) https://www.xquartz.org/releases/index.html
Now if everything went ok, if you open a shell window and type putty the program interface should appear in an X11 window. Quit putty and go to step 3.

3. Now you need to find out which device to set for your serial communication. I was able to find it out using this instruction here: https://stackoverflow.com/questions/...-for-putty-mac.
(in my case: I used a “USB to TTL UART RS232 Isolated FT230 5V 3.3V 2.5V 1.8V” found on ebay https://www.ebay.it/itm/USB-to-TTL-U...EAAOSw7z1aK8A~ .
It is not the cheapest solution, but it is very handy as it auto-sets the working voltage and is an isolated board.
If you use this chip, you can download the mac drivers here: http://www.ftdichip.com/Drivers/VCP.htm)

Whatever chip you buy, make sure you also have access to its mac osx drivers

If you use this interface, after installing the driver on the mac, the correct configuration for mac putty serial device is “/dev/cu.usbserial-DM008AG7”. Remember this will only work if you use my very same chipset.

To enter this config select the “session” Item on the left part of the putty window. You then have to enter this driver next to the “speed” box in putty, which needs to be set to “115200”. It looks pretty much as it is shown here: https://www.mobileread.com/forums/at...8&d=1447624748, only instead of "COM3" you have to input your mac drivers's name.

That’s it, now you are done, your mac should now be ready for jailbreaking. If you connect the USB-to-TTL-UART-RS232 interface to an usb port on the mac and then press the “open” button in putty, a black text window should appear just like the one shown here: https://www.mobileread.com/forums/at...1&d=1447624770

[hius07]

Trying to write a new system to the bricked PW3 through serial port. uImage and rootfs.img were taken from update_pw3_factory_5.8.9.0.1.bin. The log:

[192_168_15_244] login: root
Password: 
[root@[192_168_15_244] root]# dd if=/mnt/us/uImage of=/dev/mmcblk0 bs=4096 seek=
65
712+1 records in
712+1 records out
2918312 bytes (2.8MB) copied, 0.293244 seconds, 9.5MB/s
[root@[192_168_15_244] root]# dd if=/mnt/us/rootfs.img of=/dev/mmcblk0p1 bs=4096
112500+0 records in
112500+0 records out
460800000 bytes (439.5MB) copied, 68.487468 seconds, 6.4MB/s
[root@[192_168_15_244] root]# idme -d --bootmode main
Devmode enabled
Reading vars from temp storage...
...None found, Copying vars from /proc
Setting bootmode to main
Writing new vars to temp area
You must reboot before new values will take effect
[root@[192_168_15_244] root]# reboot

The system is going down NOW!

Sent SIGTERM to all processes
Terminated
[root@[192_168_15_244] root]# 
Sent SIGKILL to all processes
Requesting system reboot
[  263.067903] imx2-wdt imx2-wdt.0: Device shutdown: Expect reboot!
[  263.073951] Restarting system.

After that the Kindle does not reboot itself, waited about an hour. After rebooting with the button it remains bricked. Any ideas please.

[knc1]

Originally Posted by Mikii

Hello everybody,

after some struggle, I was finally able to complete a jailbreak using a Mac computer. You really have to go an extra mile if you want to use a Macintosh, but you end up having a perfectly working Putty port on your mac.
- - - -

Why?
Why waste your time screwing with a port of PuTTY when a usable terminal emulator (screen) is shipped pre-installed with your MAC:
https://software.intel.com/en-us/set...-with-mac-os-x
(steps 7, 8, and 9 are shown for the arduino, so expect the Kindle interaction instead)

[eriver]

@knc1: I do not know how to start a new thread.

Do you have a checksum for "update_kindle_5.6.5.bin"?
I get all the time Update Error: 4

[knc1]

First index page of this forum, blue button at upper left of the page, labeled: "new thread"

I do not recognize that filename, where did you get it?

[eriver]

https://www.touslesdrivers.com/index...68&v_langue=en

[knc1]

Originally Posted by eriver

https://www.touslesdrivers.com/index...68&v_langue=en

So get the md5sum from them.

OR

Download that version from Amazon's servers.
https://s3.amazonaws.com/G7G_Firmwar...ndle_5.6.5.bin

PS: There where/are three 7th. generation Kindles, please be specific by using your devices nickname, see:
https://wiki.mobileread.com/wiki/Kindle_Serial_Numbers

Since Kindle update packages are "model locked" we (and you) really need to know what model you are speaking of and include that information in your posts.
Your info box on the left is even worse: "PW 1+3" == they haven't produced a model even with that marketing name (nor a PW4).
AND
you are asking about a file used only on the KT2, which is not even mentioned in your info box.

The filename in the link I included above is for (only) the KT2, it will not work on the other two 7th. generation models.

Translation:
You either have the wrong device for the filename you are trying to use or you have the wrong filename for the device you are using it on.

PS:
With our very limited number of active members here, we are lucky to support what we post, our supporting things posted anywhere else on the Internet is out of the question.

[DennisH]

You can get the password via one of the online Python interpreters.

This one is easy to use:

https://www.tutorialspoint.com/execu...hon_online.php

Just type in the instructions as given in the tutorial:

import hashlib

print("fiona%s"%hashlib.md5("<your kindle serial number with no spaces and all capital letters>\n".encode('utf-8')).hexdigest()[13:16]

Then click on the 'Execute' button and it should print your password.

[knc1]

Originally Posted by DennisH

You can get the password via one of the online Python interpreters.

This one is easy to use:

https://www.tutorialspoint.com/execu...hon_online.php

Just type in the instructions as given in the tutorial:

import hashlib

print("fiona%s"%hashlib.md5("<your kindle serial number with no spaces and all capital letters>\n".encode('utf-8')).hexdigest()[13:16]

Then click on the 'Execute' button and it should print your password.

That is how to get the password for the "Diags" system.
The "Main" system is set to not allow log-ins, which is why you have to change that lock character in the passwd file.

[Bergfux]

Hey Guys, I need your help!

I have a Kindle 8th gen (G000 K905) with Firmware 5.9.4. I want to jailbreak it to use the Screensaver Hack.
I followed the steps to serial jailbreak it but now I'm stuck on part 4: Hackary Stuff.
When I get into uboot and type in "bootm 0xE41000" , it always starts normally.
I can't get into diagnostic mode.

[Night Rider]

Also here, stuck on part 4: Hackary Stuff, on windows and linux.
When I get into uboot and type in "bootm 0xE41000" , it always starts normally.
Kindle 8th gen (G000 K905) with Firmware 5.9.5.1

[knc1]

if it "starts normally" what are you trying to achieve?
I mean, "starting normally" is the end goal here.

[Night Rider]

When you type "bootm 0xE41000", back to uboot again.

[knc1]

So why are you trying to run the "diags" system before you install one?

At least that seems to be the most likely cause of what you report, the trying to run something that isn't there.
How it got that way must be based on something you did or did not do previously.

Please report on each thing which you did and what the result was, in the order you did them.
The best way to do that is to read back over your notes or even better, read back over the capture logs you had your terminal emulator create.

For instance, at what point did you choose: "Erase All"?