Serial number.

[MadChipmunk]

Hello, is there a way to get serial number if the screen is stuck and I don't have box? Maybe it's possible to get it from software? Or it's encrypted?

[Asawi]

I have very little experience of Kindles, but if your Kindle is registered at Amazon I think the serial number is to be found in your account. (I did own a Kindle for a short time and registered it, but don't remember how things looked.)

[akleiw]

Hi! If you've got Kindle Keyboard, press Home, Menu, Down x 5 times, Center. You should be now in the settings page displaying S/N. Press ALT+Shift+H to take a screenshot, then connect the device to a computer and look for a GIF file in the Kindle documents directory.

[geekmaster]

Originally Posted by akleiw

... If you've got Kindle Keyboard, press Home, Menu, Down x 5 times, Center ...

My experience with navigating menus *blind* is that different kindles have different options greyed out, so this may not work.

A more reliable way to get the serial number (text and barcode) with a broken screen is to press Shift-Alt-period (press and hold Shift and Alt keys, press '.', release all keys). This screen displays the serial number in two locations so it *might* be readable even with a "classic" broken screen.

You can take a screen snapshot with Shift-Alt-G (think GIF), or Shift-Alt-H, or (with the launchpad hack installed) triple-shift (press and release shift three times in quick succession).

[Sir Alex]

@MadChipmunk, Use my KDT tool. Simply connect Kindle to computer and launch KDT, it will show your SN.

[geekmaster]

@Sir Alex: The KDT tool does not work for me. I have multiple kindles and they each have a different IP address (set in the usbnet/etc/config files). Perhaps KDT *assumes* that all kindles use the default 192.168.2.2 address. Unfortunately, I see nowhere in KDT that lets me change this address to what my kindle is using.

@akleiw: If you can telnet or ssh into the kindle (from any Operating System), you can simply do:
cat /proc/cpuinfo
to get the serial number.

EDIT: I just discovered that this only works on the Kindle 3. Version 2 firmware does not display the serial number in the "cpuinfo". Also, the root password on version 2 firmware appears to require 4 characters of the md5sum instead of 3 characters as needed by version 3 firmware.

You can use that to get the root (recovery) password:
echo fiona$(grep eri /proc/cpuinfo|cut -c12-27|md5sum|cut -c8-10)

[NiLuJe]

Also, the Kindle follows the USB protocol, and the appropriate USB descriptor for S/Ns is correctly filled in. It's easy enough to get to under Linux, and it's doable on Windows, although I have no idea how (probably hidden somewhere in the device manager).

[geekmaster]

Originally Posted by NiLuJe

... (probably hidden somewhere in the device manager).

Now that I know what to look for, I found the following locations in Windows to obtain the kindle serial number(s):

"Device Manager / Kindle Internal Storage USB Device / Details / Device Instance Id" contains the serial number.

Also, all of the kindles that have been plugged in will have the same information stored in a registry key:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\De viceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}".

Here is an example kindle registry key for a DXG (S/N B009-):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\##?#USBSTOR#Disk&Ven_Kindle&Prod_Int ernal_Storage&Rev_0100#B009A1A011XXXXXX&0#{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

This DOS command will show all the kindles that have been plugged in:
reg query HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasse s\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}|find "B00"
In the command output, the kindle serial number will be between "&Rev_0100#" and "&0#{", as can be seen in the above example key.

P.S. The web page editor seems to insert a space inside long strings (which does not belong there), so ignore them above.

[Sir Alex]

Originally Posted by geekmaster

The KDT tool does not work for me. I have multiple kindles and they each have a different IP address (set in the usbnet/etc/config files). Perhaps KDT *assumes* that all kindles use the default 192.168.2.2 address. Unfortunately, I see nowhere in KDT that lets me change this address to what my kindle is using.

You tried to connect Kindle as USBNetwork device? My tool works in USB mode and not required any IP's It uses USB descriptor to find SN. Also it shows your Kindle root(recovery) password.

[geekmaster]

@Sir Alex: I just learned about the USB descriptor after NiLuJe's last post in this thread. I keep my kindles in usbnet mode, and I use scp (or WinSCP when I need to copy files using Windows). I will switch one to USB Drive mode and try KDT again...

Yes, KDT works from USB Drive mode. That explains why it did not work for me. I just learned something new.

I have a question though. You show a recovery password with an extra character. To login over Wi-Fi, the root password is fiona+3 characters (not 4).

I have seen inconsistent information in the forums. Does the recovery password have an extra 4th character from the serial number MD5 (that the root password does not use)?

[Sir Alex]

Originally Posted by geekmaster

I have a question though. You show a recovery password with an extra character. To login over Wi-Fi, the root password is fiona+3 characters (not 4).

I have seen inconsistent information in the forums. Does the recovery password have an extra 4th character from the serial number MD5 (that the root password does not use)?

Yes, recovery password is fiona+4. I used it in my Kindle 4 (not touch) as root password. In K3 I'm not tried to root so I can't verify it. But I think it same in both cases, fiona+4

[geekmaster]

On my kindle 3G and kindle 3 Wi-Fi (with version 3.3 firmware), the root password only works with 3 characters after fiona. I tried 4, but that does not work.

My DX and DXG do not have Wi-Fi, and with it turned off in usbnet/etc/config, they accept any password (or none) over USB.
...
I just changed my DXG usbnet config to "WiFi = True" and rebooted. The DX and DXG are running 2.5.8 firmware. In my case, I cannot login to my DXG with SSH, using either 3 or 4 digits after fiona. The password provided by KDT does not work in this case for root login.

Hmm...

[geekmaster]

Now I am curious if upgrading my DX and/or DXG to the version 3 firmware hack would change how many characters are needed after fiona...

I suppose I will need to make a serial cable to see if the recovery password and root password are different on version 3 firmware.

[geekmaster]

I just extracted the passwd and shadow files from my DXG running 2.5.8, and ripped it with John the Ripper. It found fionaXXX (3 hex digits after fiona). That is the same password as my command above gives.

I can log in with that password with usbnet/etc/config K3_WIFI="false" (which allows any password to work over USB), but when I set that to "true", I cannot ssh in using either the 3 or the 4 hex digit fiona password. I need to telnet in and change K3_WIFI back to "false".

Does the usbnet Wi-Fi "true" option only work with *real* Wi-Fi hardware (which the DXG does not have)? It would be nice to restrict USB sessions to using the real password even if no Wi-Fi hardware.

After I telnet in, from a kindle command prompt, I can do a login command, and for root, it only accepts the 3 hex digit fiona password (from the md5sum, or from the John crack).

Attached is my wordlist with all possible 3 and 4 hex digit "fiona" passwords. John found my password in 0.00 seconds using this list.

unshadow passwd shadow
john passwd --wordlist=fiona_wordlist

Of course, it may be faster to cut the digits from the md5sum of the serial number.

[NiLuJe]

@geekmaster: K3_WIFI="true" should be calling (& trusting) login/pam/whatever to do the auth, so that's weird (granted, I may have borked the patch, I only tested this via sharedkey auth ^^).