HELP unbrick Kindle Paperwhite 1 - NO USB

[amirseni]

I was given an old Kindle paperwhite 1st gen with 3G, in which the screen was stuck to the boy reading under the tree.

Charged the battery for a very long period of time (24h) on the wall charger with the led on amber and tried powering it on with it connection to the pc running linux.

With constant monitoring of the logs it was obvious that no storage device was found.

I eventually dissasembled the device and soldered the pinouts for the usb and was able to get the boot message. with kernel checksum errors.

Got into uboot->bist
run fastboot on the kpw1

Got the system images from http://ixtab.tk/kindle-touch-images/...pw520_wlan+3g/ (Thanks by the way) and ran the fastboot commands from the pc.

extracted the files then ran

fastboot flash kernel main_kernel.img.gz

after rebooting i was able to get the diag menu.

Exporting USB storage now shows up the Kindle storage. I copy over the extracted pw_3g_5.2.0-mmcblk0p1.img.gz then drop to the login prompt.

I Cannot get root access...
Copied the serial number to the Amazon Kindle root password site https://www.sven.de/kindle/ (Also thanks for providing the service) but the resulting passwords do not work.

So, I can't dd the mmcblk0p1.img without root access.

Following the instruction here https://gist.github.com/TobiasWooldr...ca75190b9a473f which recomends

modifying the mmcblk0p2.img diags partition and editing a upstart script for automatically dd the file does not and the fastboot flashing the file to the diags partition does not work.

Would really appreciate some pointer....

Thanks.

[NiLuJe]

@amirseni: Did you actually flash the custom diags partition through fastboot (and not just only the kernel)?

IIRC, it should be RP-ified, meaning the password is mario.

Check the manual debricking threads, but basically, the process is:

Flash both kernels through fastboot, flash diags part through fastboot, dd main part through SSH in diags. (main part is too large to be flashable through fastboot).

(Do double-check all this, that's OTOH, and theoretical, since I've never had to resort to this ).

EDIT: Heh, my memory's not so bad after all: https://www.mobileread.com/forums/sho...d.php?t=180789 & https://www.mobileread.com/forums/sho...d.php?t=170929 .

TL;DR: The gist you linked to is not completely correct, and sometimes contradicts itself (ie. it correctly tells you that you can't fastboot flash main, yet does so in its example; while it's missing the flash of the diags kernel). The tweak to the diags part to auto-dd the main part, while neat, is potentially more trouble that it's worth, since doing it manually is pretty straightforward, and you can even use netcat to avoid a copy to the userstore. The no-SSH in diags issue is moot because we're using RP-ified diags part images, which do bundle SSH.

EDIT²: Except, the diags image you linked to *aren't* RP-ified, which explains pretty much everything ;p.
So, yup, I'd recommend RP-ifying them manually from a Linux box w/ the RP install script from the latest snapshots. You won't even need to care about the root password at all this way.

EDIT³: See attached script to rp-ify a diags part (be it vanilla or not, it's safe to run multiple times).

[amirseni]

Ok,

will double check and fastboot flash the main kernel and the diag kernel.

I'm not familiar with the term RP-ified, what does it mean and do you have the link for the script.

Thanks

[NiLuJe]

@amirseni: Don't worry about the terminology, that's just me pulling stuff out of my ass ^^, check my latest edits .

[amirseni]

Great,

took at look at the rp-ify.sh,

so it basicaly replaces the /etc/shadow root has to mario and adds dropbear to the diag partition.

Thanks, will give it a go tomorrow.

[NiLuJe]

@amirseni: Yup. The dropbear build being our usual diags-tailored custom one with all the bells & whistles (i.e., passwordless login).

[amirseni]

By the way,

Can someone post the compiled linux fastboot binary.
I can't download from http://www.sudoforlunch.org/fastboot
Keep on getting 404's

[NiLuJe]

@amirseni: Worst case scenario, you can pull it from the Kubrick ISO, although I'm fairly sure it's been posted standalone here multiple times. I just don't have the link on hand right now (might be linked somewhere in the Wiki index?).

EDIT: Or, better, from the Kubrick repo.

EDIT²: And, in case that wasn't clear, because I'm unfamiliar with the link you mentioned: you need a *custom* fastboot build, not the Android mainline one.

[amirseni]

I was using a kindle fastboot compiled for windows.

Prefer to use under linux

[amirseni]

I've compiled the fastboot from https://github.com/yifanlu/Fastboot-Kindle
and got it working

ran the rp ify on the mmcblk0p2 mount and was successfull

fastboot flashed the main kernel diags_kernel the diag partition

rebooted into diag mode and went straight into login prompt and the root password blank or mario do no work.

logged in with framework and password mario.

It seems that /etc/shadow was not modified and cannot find dropbear anywhere on the filesystem.

I think that the diags partition is not being written.

It seems that fastboot flash diags mmcblk0p2 is over too fast. filesize is about 65MB and it is finished running after about 4-5seconds

[NiLuJe]

@amirseni: Even though I'd agree on your conclusion, it shouldn't take much longer than a few seconds to flash the diags partition anyway (around ~3s + ~6s, apparently).

Keep in mind that the passwordless thing is only over SSH, not serial .

That's the bounds of my theoretical knowledge though. I'll just add that fastboot lying and not doing what it was supposed to sounds vaguely familiar, so someone might have an inkling of what's happening.

Also, and this might sound like a stupid question, but I assume you've unmounted the image after running the rp script?

[amirseni]

Yes, unmounted the image beforehand.

Is there someway to check the flash integrity.

[amirseni]

Making progress,

I generated a wordlist with the prefix fiona@@@@ and got the root password with john.

Now i can login to root, but the Kindle FAT drive is volatile. I can write the data, but as soon as I reboot the data is gone.

Any ideas?

[eschwartz]

Sounds like the flash chip may be toast. Something like this could've done it... https://www.mobileread.com/forums/sho...8&postcount=24

Did you ever actually successfully write anything to the flash memory?

[amirseni]

I did manage to flash the main kernel and diag kernel.

on the vfat(kindle) it was always volatile.

Probably thats why fastboot flies when flashing mmcblk0p1.

How does one backup the serial numbers, etc.

Thinking of trying eraseall