Tutorial Popcorn - Hardware Jailbreak for KV, KT2, PW2 and PW3 (no serial port, no soldering)

[katadelos]

I f*&$ing HATE having to solder to the serial port or doing the needle trick when jailbreaking an older device running a firmware version that isn't compatible with KindleBreak. To reduce the risk of me having a stroke and/or suffering a needless and undignified demise, I created a jailbreak that is less frustrating to carry out.

Prerequisites:

• A PC running Linux (untested on Windows)
• imx_usb_loader (install this using your distro package manager)
• A paperclip or jumper cable

How do I use this?
To use this jailbreak, you will need to open up your device, attach your device to your host PC using a USB cable and activate SDP mode. There's a number of ways that you can do this, with some being easier than others.

Without removing PCB (KT2, PW2, PW3 only)

• KT2: See this thread
• PW2 & PW3: CR501, right side to TP1706
• KT3: See this thread

After removing PCB

• KT2, PW2, PW3: Connect a wire from TP1706 to TM401 and reset the device.
• KV: Connect a wire from TM500 to TM501 and reset the device.

If you have done this correctly, you will see something similar to this when running dmesg on the host PC:

[ 2470.327595] usb 1-13: new high-speed USB device number 7 using xhci_hcd
[ 2470.476311] usb 1-13: New USB device found, idVendor=15a2, idProduct=0063, bcdDevice= 0.01
[ 2470.476319] usb 1-13: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 2470.476324] usb 1-13: Product: SE Blank MEGREZ
[ 2470.476327] usb 1-13: Manufacturer: Freescale SemiConductor Inc 
[ 2470.478445] hid-generic 0003:15A2:0063.0008: hiddev1,hidraw4: USB HID v1.10 Device [Freescale SemiConductor Inc  SE Blank MEGREZ] on usb-0000:00:14.0-13/input0

To run the jailbreak, extract the jailbreak archive to a convenient location on your host PC, open a terminal and run the relevant command for your device:

# For PW2, PW3, KT2, KV
sudo imx_usb -c imx_usb_loader/wario
# For KT3
sudo imx_usb -c imx_usb_loader/heisenberg

Once the jailbreak has finished running, your device will reboot. When the device has rebooted, you'll be able to install the hotfix as usual.

[darkassassinua]

intresting,but we all waiting pw5 jailbreak xd

[encol]

Very interesting!
Thanks for your work!

[irreld]

Cool. I assume this can also be used for rescuing?

[katadelos]

Originally Posted by darkassassinua

intresting,but we all waiting pw5 jailbreak xd

Originally Posted by irreld

Cool. I assume this can also be used for rescuing?

You can use SDP for rescuing/reimaging devices if you build the right functionality into the initramfs, the only annoying thing is that this trick only works up until KT3 (thanks, secure boot ).

[adwait8]

Sorry for being completely out of topic but is there any eta on your pw5 jailbreak?

[ajs256]

The imx_usb command you posted doesn't seem to work. When I run it, it just says "imx_usb.conf not found". I'm not familiar with this tool, so I'm not sure how to fix this on my own.

[katadelos]

Originally Posted by adwait8

Sorry for being completely out of topic but is there any eta on your pw5 jailbreak?

It's difficult to say - hopefully before Summer 2022.

Originally Posted by ajs256

The imx_usb command you posted doesn't seem to work. When I run it, it just says "imx_usb.conf not found". I'm not familiar with this tool, so I'm not sure how to fix this on my own.

Run these commands and post the entire output from both of them:

ls -l
sudo imx_usb -c imx_usb_loader/wario

It sounds like it might be a path related thing?

[ajs256]

Originally Posted by katadelos

Run these commands and post the entire output from both of them:

ls -l
sudo imx_usb -c imx_usb_loader/wario

It sounds like it might be a path related thing?

pi@octopi:~ $ sudo imx_usb -c imx_usb_loader/wario
imx_usb.conf not found
pi@octopi:~ $ ls -l
total 3748
drwxr-xr-x  3 pi pi    4096 Mar 12 16:42 imx_usb_loader
---SNIPPED---
-rw-r--r--  1 pi pi 3808809 Mar 12 17:44 popcorn.tar.xz
---SNIPPED---
pi@octopi:~ $ sudo imx_usb -c imx_usb_loader/wario
[sudo] password for pi:
imx_usb.conf not found
pi@octopi:~ $

I think the flags to the command are wrong in some way...the `-c` flag specifies where to find the config file.

[ajs256]

Do I flash `uboot.bin` or `uImage-popcorn-wario`?

[kdusr]

great, we all waiting pw5 jailbreak

[katadelos]

Originally Posted by ajs256

pi@octopi:~ $ sudo imx_usb -c imx_usb_loader/wario
imx_usb.conf not found
pi@octopi:~ $ ls -l
total 3748
drwxr-xr-x  3 pi pi    4096 Mar 12 16:42 imx_usb_loader
---SNIPPED---
-rw-r--r--  1 pi pi 3808809 Mar 12 17:44 popcorn.tar.xz
---SNIPPED---
pi@octopi:~ $ sudo imx_usb -c imx_usb_loader/wario
[sudo] password for pi:
imx_usb.conf not found
pi@octopi:~ $

I think the flags to the command are wrong in some way...the `-c` flag specifies where to find the config file.

Ah, I think this might be a weird distro specific thing - on Ubuntu, imx_usb will pick up the top level imx_usb.conf from /usr/share/imx-usb-loader/imx-loader.d if it isn't found within the dir pointed to by the --configdir flag.

Try saving this to imx_usb_loader/wario/imx_usb.conf and rerun the imx_usb command:

#vid:pid, config_file
0x15a2:0x0054, mx6_usb_work.conf
0x15a2:0x0061, mx6_usb_work.conf
0x15a2:0x0063, mx6_usb_work.conf
0x15a2:0x0071, mx6_usb_work.conf
0x15a2:0x007d, mx6_usb_work.conf
0x1fc9:0x0128, mx6_usb_work.conf

Originally Posted by ajs256

Do I flash `uboot.bin` or `uImage-popcorn-wario`?

You shouldn't flash either of those files directly - imx_usb_loader/wario/mx6_usb_work.conf handles all of this for you.

[ajs256]

That worked, thank you so much for your help!

[DenS]

Pardon my stupid question, I think I made a mistake. Do I have to connect one wire from the CR501 to the TP1706 and another wire from the TP1706 to the TM401, only then do I restart the Kindle?

[biofiz]

Hello, katadelos, thank you for the jailbreak. With which firmware versions this jailbreak works?