KPW2 - 5.6.1.0.6 - Rooting/Jailbreaking

[eschwartz]

Note: Use the [CODE][/CODE] bbcode tags to render code correctly, properly spaced and all. (added above)

As you noticed, regular text gets broken up -- actually it happens when you go too long without writing a space, because it can't handle really-really-long "words".

[Compuguide]

Recently my trusty old jail broken Kindle Keyboard K3 developed two small permanent blemishes on the screen. The device still works perfectly, but they became irritating, so I decided to upgrade to the PW2.
Like many others, I was disappointed to discover that it was running 5.6.1.0.6 and couldn't be JB'd.
So discovering this thread is fantastic, many thanks, raz572, for your hard work.
Now I'm off to order my MicroFTX and preparing to give my PW2 some major surgery 8-)

[knc1]

Nice write-up, thanks.

- - - - -

A note to the site surfer -
This **should** work on all 5.5.x/5.6.x firmwares and perhaps earlier versions (this is not something that is checked here for every FW version).

There are two bits of "magic" in this thread that might change with other devices / other firmwares:

1) Generating the proper password(s)
But ... NiLuJe maintains his KindleTool for any changes noticed in new devices.

2) The starting address to be used with the u-boot, bootm command.
That:

What you want to do next is restart the PW2, stop uboot by spamming keys, then going into diagnostics mode by typing:

 
bootm 0xE41000

On another device and/or firmware version, to confirm that address -

Set your serial port terminal emulator to capture everything to a file and then re-boot the kindle.
Somewhere in the file of boot-up messages you will find that address mentioned.

or -

Interrupt the boot process to get the u-boot prompt and enter the 'list environment' (which includes listing the u-boot scripting) command.
You will find what starting address(es) are used in the scripting.

Note: you may first have to enter the 'bist' command to get to the fully functional copy of u-boot before you can list the u-boot environment.

- - - - -

Tech note:
The "0xE41000" starting address is at least partially determined by the SoC design.
The i.MX6 SoloLite (a single core processor, which the Kindles now use) uses "0xE41000" and the i.MX6 Dual and Quad (dual core and quad core processors) use a different starting address.
The Kindles using earlier SoC designs may also be different.

- - - - -

Marketing note:
Don't expect the dual or quad core SoC to show up in the grayscale Kindles -
With this Amazon custom Linux OS, the grayscale Kindles would then out perform the much more expensive color (Android) Kindle e-readers/tablets.
A definite embarrassment for the other Kindle engineering department.

- - - - -

Brain Fart:
Anyone got a good board re-work station and a spare KV?
I am pretty sure the i.MX6Quad SoC is pin compatible and that the 5.6.x firmware is already a multi-processor build.

[raz572]

Thank you for fixing the code eschwartz .

Also, thank you for the writeup knc1. Sorry, I don't have a good rework station or any other Kindle devices

This just about covers the writeup portion of this thread. After reading a bit about Duokan, I don't think I want it anymore . Everything else, save for the Collections Manager and Duokan, is fully functional on this PW2. Hopefully this can serve as a brief, minor resource for those with PW2s that cannot root easily, but may want to look into the serial route, which hasn't proven to be much more difficult.

It was a good project and worth the experience, and not terribly intensive, either. I'd recommend it to anyone with at least a little bit of time, a bit of Linux experience, and some soldering experience.

Happy reading!

[MaCXyLo]

research @ the moment for a elegant way to do this stuff...

Way1:
noticed that the kindle's are up2date if they arrived to the customer.
i think, they use the RFID/NFC Chip inside to update this stuff...
http://www.ebay.com/itm/271748490865
a friend tells me, that this technology is used.

Way2:
did anyone try to do some tcpdumps of the device's (over wifi)?
Can someone share the captures if he doesn't can interpret this?

Way3:
Someone here with firmware reverse engineering skills?
http://www.techspot.com/drivers/driv...rmation/17550/

Kind Regards!

[knc1]

Originally Posted by MaCXyLo

research @ the moment for a elegant way to do this stuff...

Way1:
noticed that the kindle's are up2date if they arrived to the customer.
i think, they use the RFID/NFC Chip inside to update this stuff...
http://www.ebay.com/itm/271748490865
a friend tells me, that this technology is used.

Way2:
did anyone try to do some tcpdumps of the device's (over wifi)?
Can someone share the captures if he doesn't can interpret this?

Way3:
Someone here with firmware reverse engineering skills?
http://www.techspot.com/drivers/driv...rmation/17550/

Kind Regards!

1) Yes, you can find it glued to the inside of the back cover.

2) Why? What are you looking for?
Of course I did, how do you think I came up with the network address blocks to be blocked with the BBB filter?

3) Someone?
Heck, that is a prerequisite for being a developer of consumer device, system modifications.

Again, what are you looking for?
We probably already documented it somewhere here.

Why the link to an off-site, non-Amazon source of the update file?
As you can see right up front - they don't even get the name of the OS correct.
**ALWAYS** get your system update file from the vendor's (Amazon's) official site.
And if really curious, grab the corresponding source release also.

[noanylove]

Does this mean there is a way to jailbreak 5.6.x without open case?

[knc1]

Originally Posted by noanylove

Does this mean there is a way to jailbreak 5.6.x without open case?

No.
Not yet, probably never.

[noanylove]

Feel sad about this. The open case jailbreaking method requires more advance ability, and I'm not sure if I'm able to open the case and close it again.

[Akirainblack]

Originally Posted by noanylove

Feel sad about this. The open case jailbreaking method requires more advance ability, and I'm not sure if I'm able to open the case and close it again.

That is the easy bit. The soldering is the hard part

[dhdurgee]

Originally Posted by noanylove

Feel sad about this. The open case jailbreaking method requires more advance ability, and I'm not sure if I'm able to open the case and close it again.

I'm afraid that if you are looking for a software-only jailbreak you are going to need to look to eBay and find an earlier model kindle at a reasonable price. I did so a few weeks ago and picked up a K3W for under $30 shipped even though I received a current model kindle basic for Christmas. I had to wait a few weeks for one with a good price, but it was worth the wait.

Dave

[knc1]

The KT is also a good choice of used Kindles -
Same IR touch screen (no front light) as the KT2 **AND** the last model that still had audio support.

[dhdurgee]

Originally Posted by knc1

The KT is also a good choice of used Kindles -
Same IR touch screen (no front light) as the KT2 **AND** the last model that still had audio support.

Do we have a list somewhere of all the kindle models, their features and the jailbreaking status? I know that the current models are problematic, but I don't know which particular older models would be a good match for those who know exactly what features they want in a kindle. I would think such a table ought to be a "sticky" reference somewhere for those in need of the information.

Dave

[knc1]

Did you try the master wiki index where each of the models are listed?
(See link in the Sticky thread entitled: "Where do I start?")

Does it need a section in each model's index that links to a wiki page for that specific information?
Well, its a Wiki - start typing.

[fctools]

Originally Posted by raz572

Update 8

More cool packages:

1) Collections Manager
2) Calibre/Kindle Collections
3) BackdoorLock
4) K5 Rescue
5) PW2 Coward's Rescue Pack
6) Duokan 2014 Nope. Not working. Can't get this one to install no matter what I do.

and the final, probably my favorite one

7) KO Reader

I followed your excellent instructions and installed BackdoorLock successfully but all the rest I tried, I try to open them and KUAL closes and it simply goes back to the main screen