Restoring broken Kindle 3 Wi-Fi

glon · 03-09-2011, 08:30 AM

I have broken Kindle 3 (stuck on wallpaper screen), probably by pressing U in Recovery Menu. Is there anything I can do? If I still can get into a root usb shell, did a whole firmware image can help?

kranu · 03-09-2011, 01:37 PM

Well I've never done it, but as far as I've heard you're pretty much screwed. If you have the JTAG adapter, I think you may be able to re-install the Kindle (if you backed it up before hand). If you haven't installed any hacks on your Kindle, you could perhaps ask Amazon for help.

Good Luck!

Sir Alex · 03-10-2011, 03:14 AM

@glon, If you pressed I - Initialize partitions, in Recovery menu - you have two ways:
1. Ask for help from Amazon support
2. Restore it yourself with Serial line adapter. But it hard to do and you must have experience in Linux.

yifanlu · 03-10-2011, 04:45 PM

I'm actually looking into the Kindle recovery process. My findings aren't complete, but I'm looking for a way to restore firmware without the recovery port. If anyone has more knowledge, please contribute.

The Kindle kernel (on a two seperate partitions (backup) from rootfs and fat32) contains a small initramfs that contains a recovery script. This script, unlike otaup, is hard-coded in ARM-binary and all resources (binaries, images, strings) are found in the file. Basically, this script can run without almost any dependencies. Now, this script is very similar to otaup. First it looks for update*.bin. Then it checks the bin headers for FB01 (recovery update). Then it extracts from it and looks for rootfs.img.gz rootfs.img.gz.sig diagsfs.img.gz diagsfs.img.gz.sig imx35_luigi/u-boot.bin imx35_luigi/u-boot.bin.sig imx35_luigi/uImage imx35_luigi/uImage.sig imx31_mario/u-boot.bin imx31_mario/u-boot.bin.sig imx31_mario/uImage imx31_mario/uImage.sig. Basically, compressed rootfs image, compressed diagsfs image (the script seems to ignore this though), bootloader and kernel. (imx35=kindle3, imx31=kindle2/dx) Then it SHA256 the file to get the digest and encodes it with a RSA1024 key and a different RSA2048 key, comparing it to the .sig. If the signature passes, it will extract rootfs.img.gz into the root partition and flash necessary kernel and bootloaders.

Now what I want to do is bypass signature checks. The public keys is stored in the binary as a hex sequence. It's the same public keys that is base64 coded in /etc/uks. I got my script to run after decompressing the kernel (twice), extracting the recovery script, modifying it to use the jailbreak keys, and recompressing it into the kernel. However, this is useless if your Kindle is already bricked. Maybe next jailbreak script will modify this recovery script? The upside is that so far, Amazon never used this recovery script outside their factory. It is most likely used to upload the first rootfs. However, if Amazon ever release a recovery image or a full update file, it would be unusable.

Another interesting thing is that if you make a diagsfs.img and place it along with ENABLE_DIAGS on the fat32 root, I THINK the recovery script will mount it. However, my ARM-asm knowledge is flakey, and after an hour of reading the IDA-pro disassemblies, I still am not sure how that works.

Finally, it is really interesting what is in this recovery script. Tons of code. Maybe after Amazon gets agressive with blocking jailbreaks, we can exploit this script to jailbreak or something.

Also: I wonder how often people brick their Kindles? I bricked my fair share of Kindles (thank god for TTL recovery port). Is it worth the effort to research and develop a recovery package?

boostjunki3 · 03-10-2011, 05:08 PM

Have you tried running the recovery mode on reboot? Hold the power slider for about 15-20 seconds and then once you let go, immediately hold down the "Home" button before the screen even has a chance to flicker back on. This should Hard Reset the kindle and holding down the "Home" key while it's starting back up, you should be presented with a Recovery Mode. It will ask you to type in "RESET", which it will then run I suppose a factory reset on the kindle. You'll have to re-register and all of your books will be in the archived folder, instead of organized as you had it, because it's formatted your kindle obviously...but this is what it took to fix mine when I was having issues with the screen not changing.

By any chance, have you updated to firmware 3.1 and ran the fonts hack? After a few times, I realized that the issues came up after I installed the font hack and replaced the font with the Droid Sans package included in the forum. I reformatted, tried the font hack and left it alone and my issues were no longer there. I'm not sure if anybody else has had a similar issue, but if so, it should be noted that the 'Droid_Sans' package might not be compatible with the new update. Hopefully you get everything up and running again, I remember the feeling all too well of when things go wrong, so I wish you the best!

03-09-2011, 08:30 AM	#1
glon Junior Member Posts: 2 Karma: 10 Join Date: Mar 2011 Device: Kindle 3	Restoring broken Kindle 3 Wi-Fi I have broken Kindle 3 (stuck on wallpaper screen), probably by pressing U in Recovery Menu. Is there anything I can do? If I still can get into a root usb shell, did a whole firmware image can help? Last edited by glon; 03-09-2011 at 11:57 AM.

03-10-2011, 03:14 AM	#3
Sir Alex Groupie Posts: 157 Karma: 1777 Join Date: Sep 2010 Location: Minsk, Belarus Device: Kindle 4	@glon, If you pressed I - Initialize partitions, in Recovery menu - you have two ways: 1. Ask for help from Amazon support 2. Restore it yourself with Serial line adapter. But it hard to do and you must have experience in Linux. Last edited by Sir Alex; 03-10-2011 at 04:00 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Restoring Kindle 4 to factory settings and removing mods	guybrushT	Kindle Developer's Corner	6	06-24-2012 06:21 AM
KINDLE DEAL: Steven Curtis Chapman - Restoring Broken Things ($4.25)	gospelebooks	Deals and Resources (No Self-Promotion or Affiliate Links)	0	08-30-2011 10:42 PM
Restoring Youtube	Sethman	Nook Developer's Corner	11	01-25-2011 02:01 PM
Troubleshooting Help restoring a replacement Kindle	mypolar	Amazon Kindle	5	11-13-2010 09:02 AM
Restoring original Kindle 1 Screensavers...	jmlaabes	Amazon Kindle	3	03-12-2009 11:36 PM

03-09-2011, 01:37 PM	#2
kranu I <3 my Kindle Posts: 528 Karma: 51332 Join Date: Nov 2010 Location: United States Device: Kindle 3G + WiFi	Well I've never done it, but as far as I've heard you're pretty much screwed. If you have the JTAG adapter, I think you may be able to re-install the Kindle (if you backed it up before hand). If you haven't installed any hacks on your Kindle, you could perhaps ask Amazon for help. Good Luck!

03-10-2011, 04:45 PM	#4
yifanlu Kindle Dissector Posts: 662 Karma: 475607 Join Date: Jul 2010 Device: Amazon Kindle 3	I'm actually looking into the Kindle recovery process. My findings aren't complete, but I'm looking for a way to restore firmware without the recovery port. If anyone has more knowledge, please contribute. The Kindle kernel (on a two seperate partitions (backup) from rootfs and fat32) contains a small initramfs that contains a recovery script. This script, unlike otaup, is hard-coded in ARM-binary and all resources (binaries, images, strings) are found in the file. Basically, this script can run without almost any dependencies. Now, this script is very similar to otaup. First it looks for update*.bin. Then it checks the bin headers for FB01 (recovery update). Then it extracts from it and looks for rootfs.img.gz rootfs.img.gz.sig diagsfs.img.gz diagsfs.img.gz.sig imx35_luigi/u-boot.bin imx35_luigi/u-boot.bin.sig imx35_luigi/uImage imx35_luigi/uImage.sig imx31_mario/u-boot.bin imx31_mario/u-boot.bin.sig imx31_mario/uImage imx31_mario/uImage.sig. Basically, compressed rootfs image, compressed diagsfs image (the script seems to ignore this though), bootloader and kernel. (imx35=kindle3, imx31=kindle2/dx) Then it SHA256 the file to get the digest and encodes it with a RSA1024 key and a different RSA2048 key, comparing it to the .sig. If the signature passes, it will extract rootfs.img.gz into the root partition and flash necessary kernel and bootloaders. Now what I want to do is bypass signature checks. The public keys is stored in the binary as a hex sequence. It's the same public keys that is base64 coded in /etc/uks. I got my script to run after decompressing the kernel (twice), extracting the recovery script, modifying it to use the jailbreak keys, and recompressing it into the kernel. However, this is useless if your Kindle is already bricked. Maybe next jailbreak script will modify this recovery script? The upside is that so far, Amazon never used this recovery script outside their factory. It is most likely used to upload the first rootfs. However, if Amazon ever release a recovery image or a full update file, it would be unusable. Another interesting thing is that if you make a diagsfs.img and place it along with ENABLE_DIAGS on the fat32 root, I THINK the recovery script will mount it. However, my ARM-asm knowledge is flakey, and after an hour of reading the IDA-pro disassemblies, I still am not sure how that works. Finally, it is really interesting what is in this recovery script. Tons of code. Maybe after Amazon gets agressive with blocking jailbreaks, we can exploit this script to jailbreak or something. Also: I wonder how often people brick their Kindles? I bricked my fair share of Kindles (thank god for TTL recovery port). Is it worth the effort to research and develop a recovery package?

03-10-2011, 05:08 PM	#5
boostjunki3 Junior Member Posts: 1 Karma: 10 Join Date: Mar 2011 Device: Kindle 3 Wi-Fi	Have you tried running the recovery mode on reboot? Hold the power slider for about 15-20 seconds and then once you let go, immediately hold down the "Home" button before the screen even has a chance to flicker back on. This should Hard Reset the kindle and holding down the "Home" key while it's starting back up, you should be presented with a Recovery Mode. It will ask you to type in "RESET", which it will then run I suppose a factory reset on the kindle. You'll have to re-register and all of your books will be in the archived folder, instead of organized as you had it, because it's formatted your kindle obviously...but this is what it took to fix mine when I was having issues with the screen not changing. By any chance, have you updated to firmware 3.1 and ran the fonts hack? After a few times, I realized that the issues came up after I installed the font hack and replaced the font with the Droid Sans package included in the forum. I reformatted, tried the font hack and left it alone and my issues were no longer there. I'm not sure if anybody else has had a similar issue, but if so, it should be noted that the 'Droid_Sans' package might not be compatible with the new update. Hopefully you get everything up and running again, I remember the feeling all too well of when things go wrong, so I wish you the best!

Advert

Advert