Tutorial Popcorn - Hardware Jailbreak for KV, KT2, PW2 and PW3 (no serial port, no soldering)

[Vlash]

Ok, just leaving my 2 cents here saying it works the PaperWhite 3 FW 5.15.1 and that you don't need to have the USB cable on get into SDP mode, you can connect the cable later.

I had some trouble because my the kindle is 6 years old and the USB port is malfunctioning, but you can do it too.

The steps I followed where:

Taking the kindle apart

The glue in the front is strong and will stick back very quickly if you pry the edges open leave them in contact.
It's super easy, but with that in mind:

1. I heated the glue with a hairdryer, makes it a piece of cake to lift the edges
2. You need something thin to pry it open at first. My spatulas where too thick, so I used the tip of a very thin meat cleaver to pry the first edge open
3. START AT THE BOTTOM EDGE, I'm pretty sure if you start at the top or the sides you might easily break it
4. I padded every corner with a credit card, because it easily sticks back together
5. Taking all the screws. THERE IS ONE SCREW BEHIND THE STICKY TAPE ON THE TOP. I didn't know this, had to look a video up to see why the board didn't leave the case.

Overall it's easy to take it apart, but I had to be careful otherwise I'd break something

THE ACTUAL JAILBREAK
1. I used a hard wire to bridge CR501 to TP508. Contacts are much smaller than they look in the photo, but it's easy to bridge them if the wire is hard or you use a staple
2. I opened up MfgTool in the PC and downloaded the hotfix
3. went to the restart prompt under Settings > device options > restart device
4. I don't have 3 hands to manipulate the screen, hold the bridge and connect the cable. If the cable is already connected you enter the transfer mode and the prompt disappears.
5. For this reason, I DID NOT CONNECT THE USB CABLE, IT'S UNECESSARY, held the kindle on its side, against my stomach, held the bridge with one hand and pressed restart with the other.
6. The device just "shutdown" and remained on the splash screen. It worked
7. Connected the USB cable, it took one minute for it to show up in MfgTools, the text written was "Device provided by ... "(the rest was not visible)
8. Clicked start, took 3 minutes to flash. A popcorn pot showed up and it booted normally
9. Installed the hotfix, it takes just a few seconds.

[furyat]

This thread is gold. Every kindle now is up to date.

Agreed with above. Don't need no cable. Just a couple of seconds of bridge with restart and its done and ready to go.

[cn1rpx]

Is this jailbreak the best option for my device/fw combination?

These threads are kind of a labyrinth, it would be nice to confirm the following statements are true before I take out a screwdriver and start to pry.

> Kindle is incompatible with WatchThis, OpenSesame! and KindleBreak.
> Kindle is not jailbroken so it can't be downgraded.
> Based on OP's first sentence, Popcorn was made for this situation, and there is no non-hardware alternative.

Thank you all for your time and effort

[ye379]

will this work on a pw3 with 5.15.1.1 (3925040005)?

[j.p.s]

Originally Posted by ye379

will this work on a pw3 with 5.15.1.1 (3925040005)?

Did you read post #61, which is only 3 posts above yours?

[JSWolf]

Originally Posted by j.p.s

Did you read post #61, which is only 3 posts above yours?

Did you read that the #61 is about 5.15.1 and the question is about 5.15.1.1?

[katadelos]

Originally Posted by JSWolf

Did you read that the #61 is about 5.51.1 and the question is about 5.15.1.1?

Irrelevant point but at least you tried 👍

[j.p.s]

Originally Posted by JSWolf

Did you read that the #61 is about 5.51.1 and the question is about 5.15.1.1?

No, I did not, because post #61 is about 5.15.1, not 5.51.1, which does not exist.

5.15.1.1 can not keep Popcorn from working.

[ye379]

thanks guys; yeah, i should have highlighted the extra .1 at the end - my bad. i guess my questions are more specificly whether (1) popcorn-jailbreak-v1.1.tar.gz and (2) JailBreak-1.16.N-FW-5.x-hotfix.zip both support 5.15.1.1 (given that i read that the keys are squashfs'd in this latest version).

[ameeno]

I have not been able to install Hotfix after popcorn on 5.15.1.1.

I can successfully launch popcorn, but i think it is deleting the keys in the wrong location, it really makes no difference to jailbreak.

could popcorn exploit be used to downgrade the firmware perhaps?

[ameeno]

Originally Posted by ameeno

I have not been able to install Hot fix after popcorn on 5.15.1.1.

I can successfully launch popcorn, but i think it is deleting the keys in the wrong location, it really makes no difference to jailbreak.

could popcorn exploit be used to downgrade the firmware perhaps?

Upon further research, it seems the keys have moved

The files pubprodkey01.pem and pubprodkey02.pem have been moved from /etc/uks to a new archive named etc/uks.sqsh.

as described in this thread:

https://www.mobileread.com/forums/sh...d.php?t=352359

Would it be possible to get a hotfix and another jailbreak for this newer firmware version? or perhaps could this jailbreak method be used to also downgrade the firmware?

perhaps force push an update file?

[beyonik]

Can confirm this does not work in its current state on PW3 5.15.1.1.

I've built a modified payload that replaces the squashfs archive that contains the keys with a pre-modified one, and then re-constructed the jailbreak hotfix and KUAL hotfix with KindleTool to raise the OTA boundary.

Doing these things seems to have worked fine as I am now running KUAL on a previously stock 5.15.1.1 PW3, in theory this should work for the models that the PW3 jailbreak hotfix also supports.

I hope me attaching these modified binaries isn't going to be an issue, to use the modified popcorn payload just replace the uImage with the one attached, and then after reboot copy the hotfix, use UYK to install it, and then install KUAL as usual substituting the normal hotfix with the one attached.

I of course can not guarantee that this will work for you and that it won't damage your device, it is destructively replacing the uks.sqsh image and if something goes wrong it might turn into a bigger issue, but as long as you get past that point the rest should work as usual.

[beyonik]

Originally Posted by beyonik

Can confirm this does not work in its current state on PW3 5.15.1.1.

I've built a modified payload that replaces the squashfs archive that contains the keys with a pre-modified one, and then re-constructed the jailbreak hotfix and KUAL hotfix with KindleTool to raise the OTA boundary.

Doing these things seems to have worked fine as I am now running KUAL on a previously stock 5.15.1.1 PW3, in theory this should work for the models that the PW3 jailbreak hotfix also supports.

I hope me attaching these modified binaries isn't going to be an issue, to use the modified popcorn payload just replace the uImage with the one attached, and then after reboot copy the hotfix, use UYK to install it, and then install KUAL as usual substituting the normal hotfix with the one attached.

I of course can not guarantee that this will work for you and that it won't damage your device, it is destructively replacing the uks.sqsh image and if something goes wrong it might turn into a bigger issue, but as long as you get past that point the rest should work as usual.

Repackaged jailbreak hotfix & KUAL hotfix to support all originally supported devices (previously only supported PW3 / WiFi (which this was tested on); KUAL package now "supports" more devices but you should only install it on the devices supported by the original hotfix).

Feel obligated to add that this is technically not a supported configuration, these packages haven't officially been updated for 5.15.1.1 but they do seem to work for the time being, practice caution when using these.

[ameeno]

Originally Posted by beyonik

Can confirm this does not work in its current state on PW3 5.15.1.1.

I've built a modified payload that replaces the squashfs archive that contains the keys with a pre-modified one, and then re-constructed the jailbreak hotfix and KUAL hotfix with KindleTool to raise the OTA boundary.

Doing these things seems to have worked fine as I am now running KUAL on a previously stock 5.15.1.1 PW3, in theory this should work for the models that the PW3 jailbreak hotfix also supports.

I hope me attaching these modified binaries isn't going to be an issue, to use the modified popcorn payload just replace the uImage with the one attached, and then after reboot copy the hotfix, use UYK to install it, and then install KUAL as usual substituting the normal hotfix with the one attached.

I of course can not guarantee that this will work for you and that it won't damage your device, it is destructively replacing the uks.sqsh image and if something goes wrong it might turn into a bigger issue, but as long as you get past that point the rest should work as usual.

thanks very much, it works, i have my jb back!!!!!

now how do i downgrade/ block future OTA?

[4649ceynou]

Originally Posted by beyonik

Repackaged jailbreak hotfix & KUAL hotfix to support all originally supported devices (previously only supported PW3 / WiFi (which this was tested on); KUAL package now "supports" more devices but you should only install it on the devices supported by the original hotfix).

Feel obligated to add that this is technically not a supported configuration, these packages haven't officially been updated for 5.15.1.1 but they do seem to work for the time being, practice caution when using these.

Unfortunately it didn't work on my PW4 (G000 PP13 0191 00JT)
Just to make sure I didn't do it the wrong way, after a reset the kindle was not registered, there was no book and then I tried the hotfix first with UYK and it failed, same for the kual hotfix.
;log mrpi exists if that means anything