PW3 PW3-4, PW3-32, fw-5.8.9.0.1 software jailbreak

[ilovejedd]

Originally Posted by knc1

Post the MrPI log file rather than guess what the problem might be.

Note, when the install failed, I searched the LibrarianSync thread and came across several posts recommending just downloading from GitHub and manually copying to extensions.

The update bin package was last update 04-11-2015 and according to Google, the PW3 was released June 30, 2015 so the package being too old was a reasonable assumption to make. This post refers to the Oasis but I assumed the same thing applied to my PW3.

Originally Posted by NiLuJe

@picree: The package in the first post hasn't been updated in a while.

The code on github is up-to-date, though, so just clone/tarball that and install it manually. It's just a KUAL extension, after all, you just need to make sure it's in the right place

My MrPI log (ignore the date, hadn't fixed it at this point)

[2017-01-01 @ 00:02:42 +0000] :: [MRPI r14394] - Beginning the processing of package 'Update_librariansync_1.10_kindle5.bin' (librariansync 1.10 kindle5) . . .


Package 'Update_librariansync_1.10_kindle5.bin' (librariansync 1.10 kindle5) is not targeting your device [0G1 vs. 11 0F 10 24 1B 1C 1D 1F 20 D4 5A D5 D6 D7 D8 F2 17 60 62 5F C6 13 54 53], skipping . . . :(

[knc1]

It is still better to include the log details if there is a log.
Keep in mind you are training an unknown number of non-member readers.
So "best practices" to the front.

[ilovejedd]

Originally Posted by knc1

It is still better to include the log details if there is a log.
Keep in mind you are training an unknown number of non-member readers.
So "best practices" to the front.

Please note, I only started my crash course on jailbreaking Kindles a few days ago (maybe a week, tops?).

I didn't even know there were logs (nor where they were located). Had to connect the Kindle to the PC to have a look around. Luckily, was in front of a PC at the moment. More often than not, I'm just on an iPad.

For the uninformed like me, MrPI logs can be found here:

extensions/MRInstaller/log/mrinstaller.log

[ilovejedd]

Originally Posted by datanoise

Thank you very much for your detailed report. The strange thing is that I followed exactly the same steps as you did on the (new) PW3 running 5.8.11 that got bricked. But I tried to use 5.7.4 - maybe it would have been a success with 5.8.9.0.1, no way to tell. Good to know that many people are successful downgrading using 5.8.9.0.1 factory, as most PW3 seem to be currently shipped with 5.8.11, this could be a good solution for the time being.

Quite possible.

Extremely small sample size but the behavior I encountered on PW2 (either 5.8.9.2 or 5.9.2, can't remember exactly, don't have it now) and PW3 5.9.4 is they automatically delete the factory update*.bin and UYK remains greyed out.

On two PW3 5.8.11 I've checked (one brand new, one of unknown history), on both factory 5.7.4 and 5.8.9.0.1, the UYK menu entry is available so I assume they pass some check that the Kindle runs. Brand new is the one I JB'd. The one of unknown history is not mine so I just quickly checked if UYK is active and then deleted the update.bin right away.

Maybe there's an arbitrary cutoff point on allowed factory versions for 5.8.x per model? I believe there's been a report of a PW3 5.8.10(.0.1?) being able to install factory firmware (will have to double check if it was 5.7.4 or 5.8.9.0.1). I'm currently reading the Software Jailbreak for PW2, PW3(B), PW3W, KT2, KT3(B), KT3W, KV, and KOA thread starting around the time 5.8.8 was released (03-2017). Currently at page 118 and I've yet to encounter a report of auto-deleting factory 5.7.4 on PW3. Majority of the reports are regarding the PW2 (factory 5.4.3.2). Iirc, there were reports of bricking when installing 5.7.4 in the latest posts but it does seem as if the update isn't immediately blocked on PW3 up to 5.8.11.

I'm considering trading in that PW3 5.9.4 for another PW3 ($45 net with Amazon trade-in promo). Hopefully, I'll get another jailbreakable one.

[ilovejedd]

One more datapoint:

Woot: Kindle Paperwhite Manga 32GB 6" E-Reader

• Is this a new device, never connected to the Internet?
  Yes s/n: G090 LK01
• Is it a "refurbished" device?
  Yes
• Is this the firmware it arrived with or has it been updated to this version?
  No stock 5.8.7.0.1 (3115940037)
• Is it registered?
  No At least not at the time of factory fw install and jb
• Does it have ads (Special Offers)?
  Yes/No Woot page said 'Includes Special Offers' but when device was registered post-jailbreak and fw 5.8.11 update, it was unsubscribed.
• Does it have a pass-code protection or parental controls enabled?
  No
• What country was it sold in?
  US
• What country was it delivered to?
  US
• Was the seller an on-line Amazon site or was it a third-party seller (on-line or brick&mortar).
  Woot.com (Amazon subsidiary)

After updating the PW3-32 to customer 5.8.11 (3243010037), both factory firmwares 5.7.4 and 5.8.9.0.1 were automatically deleted after copy/eject. The other PW3 (brand-new from Amazon) that I downgraded was also running 5.8.11 (3243010037).

coplate's suggestion of new, out-of-box Kindles getting 1-2 free passes definitely has merit.

[knc1]

Good work.
Keep collecting the information, there may be more patterns to be found.

- - - - - - -

Here is another theory, one that would account for apparent random jail breaking vulnerabilities.

The last steps of manufacturing are done "by hand" -
Those workers are often paid on a "piece work" basis - (paid per item completed)
People being people, will sometimes skip a step (or more) in the completion processing (nobody would do that intentionally, just to get more pieces completed, right? Right!).

Now what if one of those final steps was to "disable" the ability to install the jail break image type?
Who Q.A.s the final assembly / Q.A. people? Probably nobody.

So perhaps only the Kindles whose 'final inspection' was done by Won Hun Low can be jail broken?
You know, that guy that works the night shift on alternate Wednesdays.

Kindles don't have a "passed by #1362" tag included in the packaging, so we can't tell which ones Won Hun Low skipped the "final protection" step on.

[PoP]

Originally Posted by knc1

...So perhaps only the Kindles whose 'final inspection' was done by Won Hun Low can be jail broken?...

Well thought out (conspiration?) theory. Increase your odds by buying from amazon.cn!!

No disrespect meant.

[j.p.s]

Originally Posted by knc1

...So perhaps only the Kindles whose 'final inspection' was done by Won Hun Low can be jail broken?

Originally Posted by PoP

Well thought out (conspiration?) theory. Increase your odds by buying from amazon.cn!!

No disrespect meant.

Every culture has at least a few Homer Simpsons and there is probably at least a little Homer Simpson in each of us.

There is probably only one production facility for kindles.

No offense taken.

[ilovejedd]

Originally Posted by Kamikakushi

Thank you. At step 4, when I try to update to factory image, the result is a broken screen (picture attached). If I click on the white rectangle, it restarts and gives the same result. Is this some sort of boot loop? Sorry for my noobness, I just couldn't identify the problem.

Data: G090KB, 5.8.10.1, SO removed, parental control and passcode turned off, airplane mode turned on, has been registered with an Amazon account, MD5 hash of the .bin file matched.

https://www.mobileread.com/forums/at...hmentid=161512

Originally Posted by knc1

If it is running 5.8.10.1 then the special image did not install.
Put the special image at the visible root of the Kindle, then reboot it.

Just a comment, it looks like the factory firmware did install. You can make out version: 3175970011 in the image above the serial number. That matches build number (I assume it's build number) for 5.8.9.0.1. Installation just got borked.

I've been doing more reading and it looks like the same thing that happened here (PW3 5.6.1.1 factory firmware):

https://www.mobileread.com/forums/sh...2&postcount=13

Alas, it doesn't seem like the cause of the bricking was ever positively identified.

Just got my first brick. Will post more details later.

[ilovejedd]

Bricked:

Kindle Paperwhite 3 (used)

• Is this a new device, never connected to the Internet?
  No not new but I never setup wifi, dunno about previous owner
• Is it a "refurbished" device?
  No used or third-party (non-Amazon) refurbished
• Is this the firmware it arrived with or has it been updated to this version?
  No device came with 5.8.11 (3243010037), don't know if stock or already OTA updated
• Is it registered?
  No
• Does it have ads (Special Offers)?
  Maybe? I didn't register the device with Amazon so couldn't check.
• Does it have a pass-code protection or parental controls enabled?
  No
• What country was it sold in?
  MX? bought from ebay US, contacted Amazon US to see if they can repair but based on serial number, was told to go to amazon.com.mx
• What country was it delivered to?
  US
• Was the seller an on-line Amazon site or was it a third-party seller (on-line or brick&mortar).
  ebay: goodystore

Knew this might be more risky since I didn't know the history of the device. Wasn't overly concerned since I already have (1) PW3 5.9.4, (1) JB PW3 5.8.9.0.1 and (1) JB PW3-32 5.8.11. More details to follow.

[ilovejedd]

jprince's post perfectly describes what I saw so copying his post and just editing the relevant parts.

First eight characters of serial number: G090 G105
Firmware version before you started this procedure: 5.8.11

Feature related:
Was this Kindle registered with Amazon? no
Was this an ad supported (Special Offers) Kindle? maybe? purchased used
Was a passcode set? no

Special sub-steps:
Did you clear the passcode before the downgrade? no passcode was not set
Did you do the 'Reset (to factory results)' sub-step? no, it was already factory reset when I got it. Never connected to wifi, no books ever loaded (by me). However, I did run the following and didn't factory reset afterwards (yeah, stupid of me).

;dm
;st {date time}
;dm

Internal data related:
Using the Kindle's Cloud Account or local or both? neither
Where you using collections? no
Where you using bookmarks? no
Where you using annotations? no
Native language in use: US English

Kindle Hung:
What is the filename of factory initial update that was used? update_pw3_factory_5.8.9.0.1.bin same file used for two successful jailbreaks
Which mirror did you get it from? adrive
Confirmed
MD5: 5d38744bd01f4cbf457dae4499c3c32a
SHA1: 3a5d9418a0cdb307f27494ddddd6c187160e8641

Approximately how long did the downgrade process run? 10-20 minutes?
What was showing on the screen when it 'hung'? It cycled to boot, however, the "active" graphics don't fill the whole screen, rather the upper right.

When the USB cable was connected, Kindle to PC, could you see the storage on the Kindle? yes, originally, however, after trying DO_FACTORY_RESTORE, it no longer mounts user store. However, the first time after that, it proceeded to ask what language I wanted to use. The graphics were/are still small, but the onscreen hit targets matched as if it were full size. Regardless, hitting Next lead back into boot cycling
What sort of response did your PC make when you plugged in the Kindle? originally, mounted via USB for a short time
Did using a USB-2 vs a USB-3 port on the PC make a difference? n/a
Was this same cable and same port working normally before the downgrade? yes

Normally, a Kindle is re-booted without any USB cable connected.
Leave the USB cable connected, Kindle-to-PC, re-boot Kindle (hold power button 40 seconds or more, ignore any pop-up panels seen).
What was the result? Same, now. Actually, 40 seconds doesn't seem to change anything. It continues to boot cycle as if you were not holding the power button.

What OS and OS version in use on your PC: Windows 7 32-bit
USB-2 or USB-3 ports, or both? USB-2

Recovery:
If your PC could 'see' the Kindle storage (even briefly) try putting a file named:
DO_FACTORY_RESTORE
(all caps, no extension, no contents)
into the top level of visible USB storage.
Then use the power button to re-boot the Kindle
describe the result here: Described above

Does the 'hung' Kindle boot far enough to show the main screen, can you access the search bar? no

Yes, I know I shouldn't have done the DO_FACTORY_RESTORE per hius' warning. I got impatient. Might eventually try a serial debrick but in no hurry to do so.

[knc1]

Originally Posted by PoP

Well thought out (conspiration?) theory. Increase your odds by buying from amazon.cn!!

No disrespect meant.

Amazon.cn only sells Kindles that where assembled in the U.S.A.

You can tell what part of the world the final assembly was done by the type of cardboard used in the box.
If it is rice paper based cardboard ...

[Xuhu]

(couldn't find a better thread to post to)

Looking at the binaries in the latest update from Amazon, it seems there's a bug that might be useful. Is it possible to get a pm from one of the developers to continue the discussion ?

[knc1]

Originally Posted by Xuhu

(couldn't find a better thread to post to)

Looking at the binaries in the latest update from Amazon, it seems there's a bug that might be useful. Is it possible to get a pm from one of the developers to continue the discussion ?

Threads are cheap here, start your own rather than hijack one.

All work on jail breaks is done in private, never in public.

So just go ahead and develop your attack vector.
Just do not announce anything (including "there might be a bug") in public until you are ready to release it.

This is an adversarial situation, a few part time, unpaid, hobbyist people VS an entire department of full-time, paid, computer professionals.

Rule #1)
Thou shall not publish hints.
Otherwise they will find it and block it before you can develop the attack.

[Jakub.007]

Hello everybody,

I just got my new Kindle Touch WiFi 4GB (serial: G000 K905 7297 0300)
It has been connected to internet.
It have NOT been registered with amazon.
I got it brand new, but unfortunately I don't know where it was purchased, because I have won it in data analysis competition.
I does not seem to have any advertisement.
Device passcode is disabled.
Firmware version is: Kindle 5.8.9.0.1 (3175980011)

I am new to Kindle, but I would like to jail brake it so I can use an SSH client. I could not find the image anywhere, can you send me a link please?

Many thanks. Jakub