06-30-2015, 05:12 PM | #1 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
PW3 - First Look
Model: G090 G090 G1 : Wifi Only : USA (No, I did not typo that first character, it is "G")
Firmware: 5.6.1.1 The following is written for the Linux command line. People with Windows can use Win32 Disk Imager to create a raw image file of USB storage. https://sourceforge.net/projects/win32diskimager/ For people using that disk imager, the following step-by-step is just FYI. A computer with MacOSx on it can not be used because Spotlight will write metadata index files on the Kindle's USB storage as soon as it is attached. If submitting this image for study by our developers, please include: Firmware version number shown in 'device info' First six characters of the device's serial number (which encodes the model number only). Something like this: <nickname_here>_<firmware_version>_<first_six_char acters>.raw Then compress that file (zip, gzip, etc) and post where a copy can be downloaded.
This section may be used as a guide to recoverying a damaged USB storage area. This section uses the "testdisk" recovery utility. Home site: http://www.cgsecurity.org/wiki/TestDisk Now, back to our storage image file. Note the relatively large size of the gzip'd backup file. The gzip compression is better than that at compressing zeros. So there are things written to the storage area that might be of interest.
For how to take UPDATE~1.BIN apart, see the procedure used here: https://www.mobileread.com/forums/sh...d.php?t=262234 Thanks Lab126! Last edited by knc1; 11-11-2017 at 03:53 AM. |
07-01-2015, 11:19 AM | #2 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Initial factory update
The Cliff's Notes version:
Code:
core2quad recovered $ mv _PDATE~1.BIN update-1.bin core2quad recovered $ mkdir package core2quad recovered $ /var1/Kindle/kpw/pw-fw5.6/kt/kindletool extract update-1.bin package Extracting update package 'update-1.bin' to 'package'. Bundle FB02 (Fullbin [signed?]) Bundle Type Recovery MD5 Hash a3f36b512e4e991152a7761f4a0df35d Magic 1 2048630901 Magic 2 1897089723 Minor 1 Header Rev 2 Platform Wario Board Unspecified x update-J6011-wario_muscat-033.dat x imx60_wario/u-boot.bin x imx60_wario/u-boot.bin.sig x imx60_wario/uImage x imx60_wario/uImage.sig x rootfs.img.gz x rootfs.img.gz.sig x data.stgz x data.stgz.sig x update-J6011-wario_muscat-033.dat.sig Code:
core2quad recovered $ ls -l package/* -rw-r--r-- 1 mszick mszick 373060162 2015-04-15 11:12 package/data.stgz -rw-rw-r-- 1 mszick mszick 256 2015-04-15 11:12 package/data.stgz.sig -rw-r--r-- 1 mszick mszick 246713230 2015-04-15 10:42 package/rootfs.img.gz -rw-rw-r-- 1 mszick mszick 256 2015-04-15 11:12 package/rootfs.img.gz.sig -rw-r--r-- 1 mszick mszick 306 2015-04-15 10:44 package/update-J6011-wario_muscat-033.dat -rw-rw-r-- 1 mszick mszick 256 2015-04-15 11:12 package/update-J6011-wario_muscat-033.dat.sig package/imx60_wario: total 2976 -rw-r--r-- 1 mszick mszick 275028 2015-04-15 09:41 u-boot.bin -rw-rw-r-- 1 mszick mszick 256 2015-04-15 11:12 u-boot.bin.sig -rw-r--r-- 1 mszick mszick 2752512 2015-04-15 10:08 uImage -rw-rw-r-- 1 mszick mszick 256 2015-04-15 11:12 uImage.sig https://www.mobileread.com/forums/sho...d.php?t=262234 KindleTool also unpacks the *.stgz (signed, tar, g-zip'd) files. Both of those, plus the contents of the rootfs, each put into a reasonably named place of the recovered tree: Spoiler:
Last edited by knc1; 07-01-2015 at 02:37 PM. |
Advert | |
|
07-02-2015, 09:48 AM | #3 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Note:
The factory install of 'main' installs: /MNTUS_EXEC I haven't gotten serial port access to the device yet to see if they leave it there or if they delete it before shipping. |
07-25-2015, 09:51 PM | #4 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Note:
There is a suspicion that the model ID has moved 2 characters deeper into the serial number. I.E: Characters 3...6 rather characters 1...4 First post updated, but final verification of this change is still in-progress. Last edited by knc1; 07-26-2015 at 07:37 AM. |
07-26-2015, 08:16 PM | #5 |
BLAM!
Posts: 13,477
Karma: 26012492
Join Date: Jun 2010
Location: Paris, France
Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E
|
Yup, if anybody with a PW3 could share the first *8* characters of their S/N, along with the country it was shipped to, and whether it's a WiFi or 3G device, that would be very helpful .
|
Advert | |
|
07-29-2015, 06:10 PM | #6 |
Member
Posts: 17
Karma: 10
Join Date: Dec 2010
Device: kindle 3
|
|
07-29-2015, 06:43 PM | #7 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
|
07-29-2015, 10:52 PM | #8 |
BLAM!
Posts: 13,477
Karma: 26012492
Join Date: Jun 2010
Location: Paris, France
Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E
|
Yup, still not enough data to do it right (that'll probably require a real OTA anyway), but I should be able to rig something up that should *mostly* work...
|
08-13-2015, 08:37 AM | #9 |
Enthusiast
Posts: 42
Karma: 20
Join Date: Aug 2015
Device: kindle pw4
|
pw3 Italy, wifi with special offers, G090 G105 xxxx xxxx
|
08-13-2015, 09:07 AM | #10 |
BLAM!
Posts: 13,477
Karma: 26012492
Join Date: Jun 2010
Location: Paris, France
Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E
|
@all: Thanks, the 5.6.5 update answered my remaining questions (and confirmed my hunches, yay!).
|
08-21-2015, 09:59 AM | #11 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Some of us have a tendency to keep anything binary that passes by our way.
A possible note of interest for the future: For the KT2, PW3 and KV - The complete, initial, factory install of "main" bootloader, kernel, and filesystem is safely tucked away on a private network server (at least one, probably two). I (we) don't yet know if the "downgrade attack" protection applies to installing the **initial** factory update package. Something that is planned to be tested in the near future (RSN tm). We have to thank Lab126 for shipping those to us. Edit: A note for anyone trying to reformat the FAT32 user storage partition (KT2, PW3, KV) - It uses a 8192 byte block size, not 512 byte. That probably has to do with eMMC erase block alignment. And the cluster size is 16 - I.E: This FAT32 storage only assigns/frees clusters sized for a pair of (4096) erase blocks. Last edited by knc1; 08-21-2015 at 10:14 AM. |
08-28-2015, 03:22 PM | #12 |
Guru
Posts: 876
Karma: 10113994
Join Date: Feb 2010
Location: Serbia
Device: Kindle PW5 [bricked], Kindle PW1
|
Concerning future prospect(s) of easy/"closed case" jailbreak, I'm guessing there is no reason to leave my PW3 on initial/fw 5.6.1.1?
|
08-28-2015, 05:03 PM | #13 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
|
01-10-2016, 01:38 PM | #14 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Jim.FTX adapter in PW-3
Or so I hope.
Image 1: The PW-3 underside, the loose adapter, and the tool which will do the damage. It is a square-end, end-mill, for a Dremel tool. Claimed to be for soft metals. Image 2: The horizontal rib by the battery cut-out is cut down to about half its height. The outer horizontal rib is cut down to approximately flush. The center rib - that is a bit tricky - - That "raised area" is actually the back of the e-ink display. Stay away from cutting into that entire surface (both of the sides of the 'step'). Just cut the rib in that area 'close' but not flush. The rest of the rib is cut approximately flush. Image 3: Which gives a 'home' for the adapter board, which is going to be a very close fit. Zoom in on that picture and you will see just how close things are going to be. The "Plan" is to sort-of pot that board in the opening (and maybe regain some of the e-ink frame's stiffness in the process of filling that area with a potting compound). Last edited by knc1; 01-10-2016 at 01:53 PM. |
02-07-2016, 03:08 PM | #15 |
Going Viral
Posts: 17,212
Karma: 18210809
Join Date: Feb 2012
Location: Central Texas
Device: No K1, PW2, KV, KOA
|
Whoot!
It fits, the PW-3 still works, the adapter still works. Time to close it up (and about time to, it has taken me 7-1/2 months to find the free time to do this job). Will post all the details of how it got this way from like it was in the prior post when time allows. Last edited by knc1; 02-07-2016 at 03:13 PM. |
Thread Tools | Search this Thread |
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
YouTube (German) PW2 and PW3 - Shows contrast when both set to Caecilia | Richard529 | Amazon Kindle | 24 | 06-27-2015 09:58 PM |
3G PW2 now or wait for eventual PW3 release? | Pangolin | Amazon Kindle | 34 | 05-01-2014 01:01 PM |
New info on Kindle Paperwhite 3 (PW3) | avinatbezeq | News | 59 | 03-27-2014 03:50 AM |
Lighter higher resolution Kindle PW3 coming in 2014 Q2 | Stingo | News | 125 | 03-22-2014 07:12 PM |