Original "Simple" debricking methods for K5-Touch, K4-Mini, & K3-Keyboard

[geekmaster]

I compared firmware between a Paperwhite-wifi and a Paperwhite-3G. The only differences on both main and diags were that the two units had different shadow and guid files, as may be expected. The kernels matched between the two units.

They also had different versions of dropbear SSH on main, but these hacks were added later to allow creating these firmware images.

[stangri]

Originally Posted by geekmaster

I did not use fastboot on my demo K4. I modified ixtab's method described here"
https://www.mobileread.com/forums/sho....php?p=2202022

Instead of dealing with fastboot and its USB complications, I used dd to copy the main kernel to /dev/mmcblk0 with offset, as described in ixtab's README file, just before I copied the main rootfs to /dev/mmcblk0p1 with dd.

That is great for a K4 (and even a K4 demo), but on a K5 you still need fastboot to get diags+ssh on it.

I did not even use MfgTool, but instead eureka's imx_usb_downloader tool, to boot to diags.

I do not see why fastboot wouldn't work on a K4 demo, but I do not have time to try it right now. Try ixtab's method.

Does the kernel dd offset in ixtab's README work for both K4 and K5 because I think it explicitly mentions K5 there.

[ixtab]

Originally Posted by stangri

Does the kernel dd offset in ixtab's README work for both K4 and K5 because I think it explicitly mentions K5 there.

I am not 1000% sure, but yes, it should work on the K4, too.

[geekmaster]

As you can see in the getkernels script, the kernel offsets are the same for all eink kindles.

[geekmaster]

Because the kindle debricking repair images contain a COPY of a guid file that came from the original source kindle, it is no longer "globally unique" as its name implies. I do not know the consequences of having many debricked kindles with the same "Globally Unique IDentifier", but one problem seems to be that a K5 3G that was debricked with firmware from a wifi-only K5 no longer has 3G acess in reported cases.

Perhaps deleting the guid file before registering with amazon may fix this problem, assuming that a missing guid file gets regenerated. This will require further investigation...

If anybody can provide additional useful information about this, please do so here. Thanks.

[NiLuJe]

@geekmaster: It gets rebuilt at boot if it's missing. If not, it's pretty trivial to do it by hand:

dd if=/dev/urandom bs=32 count=1 2>/dev/null | md5sum | awk '{print $1}' > /etc/guid

[geekmaster]

Originally Posted by NiLuJe

@geekmaster: It gets rebuilt at boot if it's missing. If not, it's pretty trivial to do it by hand:

dd if=/dev/urandom bs=32 count=1 2>/dev/null | md5sum | awk '{print $1}' > /etc/guid

I will try that. Hopefully it will restore 3G access on a debricked K5.

Has anyone debricked a 3G K5 and their 3G worked afterwards?

EDIT: I erased the guid file, and rebooted. The ";311" search still does not find any 3G networks. A debricked K3 demo 3G access works fine, and I even saw one do an OTA update over 3G while in demo mode. The K5 demos have a B00F serial (3G model), and internally they contain a 3G modem and SIM card, and the 3G antenna. There should be a way to get it working on 3G...

UPDATE: My 3G works after flashing with 5.0.0 instead of 5.1.2, as reported here:
https://www.mobileread.com/forums/sho....php?p=2292692

[qlob]

Added a reminder to "Charge your kindle" on the 3.0.2 complete mirror.

[askak]

Hi guys,

I tried to debrick my Touch because it seems that it has the filesystem damaged. Well, I tried the ixtab method, I could install, I got into diags mode but I couldn't get ssh to work, it failed with connection time out error.

I searched in the forum and it seems normal since the filesystem was already damaged, but it fools you because you can install it. (ixtab program)

So I have to do it the hard way. And now I'm a bit confused, ok I downloaded the fastboot for linux (it was a bit hidden btw ) and now I need to download a mmcblk0p2_ssh file, to get into diags mode like with ixtab method, but I don't find this file for my kernel 5.1.2. I guess my backup wouldn't work, right?

Also, I have a mmcblk0p1 backup, maybe made after damaging the system, could it be damaged too?, should I download a new one?

Thanks a lot. And sorry if they're very basic questions.

[ixtab]

Originally Posted by askak

Hi guys,

I tried to debrick my Touch because it seems that it has the filesystem damaged. Well, I tried the ixtab method, I could install, I got into diags mode but I couldn't get ssh to work, it failed with connection time out error.

I searched in the forum and it seems normal since the filesystem was already damaged, but it fools you because you can install it. (ixtab program)

So I have to do it the hard way. And now I'm a bit confused, ok I downloaded the fastboot for linux (it was a bit hidden btw ) and now I need to download a mmcblk0p2_ssh file, to get into diags mode like with ixtab method, but I don't find this file for my kernel 5.1.2. I guess my backup wouldn't work, right?

Also, I have a mmcblk0p1 backup, maybe made after damaging the system, could it be damaged too?, should I download a new one?

Thanks a lot. And sorry if they're very basic questions.

The main and diags "(kernel,partition)" pairs are completely orthogonal ("unrelated", if you prefer that term). IOW: the respective kernel and partition must match, but there is no relationship between diags and main - think of it like a dual-boot system, except that it's not Windoze and Linux, but main and diags. So yes, there is no 5.1.x diags kernel. Just install the 5.0.0 diags kernel and the 5.0.1 diags partition.

Concerning the mmcblk0p1 backup: up to you. First get the diags problems fixed and reboot to main. If something is wrong, you can still overwrite the main kernel/partition from diags. OTOH, you could directly overwrite them when you're in diags anyway, to be sure that you're back to a sane configuration. Up to you

HTH

[askak]

Well, everything working again.

But I didn't need to fastboot, actually I tried but failed with <waiting for device> error.This error is related with usb mounting, and I was aware that kindle was getting auto-mounted with Dolphin even though I don't have automounting enabled in the device notifier. Googling about it I found this maybe the filsystem corruption wasn't my fault after all.

So, how I fixed? Days ago I found I could ssh in "normal" way, withouth the diags mode, I think after installing ixtab rescue program, because I dont think I could before. Anyway I thought I could try to dd that way, and it worked!!. I thought I could not work because I get confused with normal linux systems where you can't managed partitions/filsystems that are in use, the typical error you get with gparted. Am I making any sense?

The only error I got when trying to ssh was this and is explained how to fix it that post, and this

sh: /usr/X11R6/bin/xauth: not found

which I still have it.
Also after dd command i got a "Bus error". Downloaded a new mmcblk0p1 by the way.

Sorry for the long post, I hope it makes sense and helps somebody.

[ppoo]

I got stuck at fastboot flash how to fix it ?

test@test-test:~/Kindle/imx_usb_loader$ sudo ./imx_usb fastboot.bin
parse mx50_usb_work.conf
15a2:0052(KindleTouch) bConfigurationValue =1
Interface 0 claimed
report 1, wrote 16 bytes, err=0
report 3, read 4 bytes, err=0
read=56 78 78 56
fastboot.bin
No dcd table, barker=402000d1
dcd_ptr=0x00000000

loading binary file(fastboot.bin) to f8006000, skip=0, fsize=800 type=aa

<<<2048, 2048 bytes>>>
jumping to 0xf8006400
report 1, wrote 16 bytes, err=0
report 3, read 4 bytes, err=0
read=56 78 78 56
jump_mode 2 plug=1 err=0
fastboot.bin
header_max=1000

loading binary file(fastboot.bin) to f8006000, skip=0, fsize=120bc type=aa

<<<73916, 73916 bytes>>>
jumping to 0xf800642c

test@test-test:~/Kindle/imx_usb_loader$ sudo fastboot -i0x1949 flash diags_kernel ./diags_kernel.img 
sending 'diags_kernel' (5002 KB)...
OKAY [  2.960s]
writing 'diags_kernel'...

Update: I also got stuck at fastboot flash diags_kernel too:
C:\fastboot_win_public>fastboot.exe flash diags_kernel diags_kernel.img
downloading 'diags_kernel'...
OKAY [ 2.969s]
writing 'diags_kernel'... <--It stand here

[adi23]

I have debricked my Kindle Touch 3G and the 3G still works.

Originally Posted by geekmaster

I will try that. Hopefully it will restore 3G access on a debricked K5.

Has anyone debricked a 3G K5 and their 3G worked afterwards?

EDIT: I erased the guid file, and rebooted. The ";311" search still does not find any 3G networks. A debricked K3 demo 3G access works fine, and I even saw one do an OTA update over 3G while in demo mode. The K5 demos have a B00F serial (3G model), and internally they contain a 3G modem and SIM card, and the 3G antenna. There should be a way to get it working on 3G...

UPDATE: My 3G works after flashing with 5.0.0 instead of 5.1.2, as reported here:
https://www.mobileread.com/forums/sho....php?p=2292692

[knc1]

Originally Posted by ppoo

I got stuck at fastboot flash how to fix it ?

test@test-test:~/Kindle/imx_usb_loader$ sudo ./imx_usb fastboot.bin
parse mx50_usb_work.conf
15a2:0052(KindleTouch) bConfigurationValue =1
Interface 0 claimed
report 1, wrote 16 bytes, err=0
report 3, read 4 bytes, err=0
read=56 78 78 56
fastboot.bin
No dcd table, barker=402000d1
dcd_ptr=0x00000000

loading binary file(fastboot.bin) to f8006000, skip=0, fsize=800 type=aa

<<<2048, 2048 bytes>>>
jumping to 0xf8006400
report 1, wrote 16 bytes, err=0
report 3, read 4 bytes, err=0
read=56 78 78 56
jump_mode 2 plug=1 err=0
fastboot.bin
header_max=1000

loading binary file(fastboot.bin) to f8006000, skip=0, fsize=120bc type=aa

<<<73916, 73916 bytes>>>
jumping to 0xf800642c

test@test-test:~/Kindle/imx_usb_loader$ sudo fastboot -i0x1949 flash diags_kernel ./diags_kernel.img 
sending 'diags_kernel' (5002 KB)...
OKAY [  2.960s]
writing 'diags_kernel'...

Update: I also got stuck at fastboot flash diags_kernel too:
C:\fastboot_win_public>fastboot.exe flash diags_kernel diags_kernel.img
downloading 'diags_kernel'...
OKAY [ 2.969s]
writing 'diags_kernel'... <--It stand here

Recharge the battery.

[ppoo]

@knc1: I've recharaged it, but it still doesn't work.

I think I've broken u-boot on KT, so I can't use default MfgTool fastboot.bin but eureka's fastboot.bin. Now it can't be write with fastboot flash. I've tried all fastboot command milions times. How to fix it?