7th generation device, OTA blocking

knc1 · 03-12-2016, 09:28 AM

And the 6th generation PW-2, perhaps others (KT, PW1).

Research required

You will need command line access (serial port, ssh, telnet, kTerm, ...).
Run the following command:

Code:

[root@kindle root]# cd /etc/kdb.src/wario/system/daemon/otaup ; for f in `ls -1` ; do echo $f ; strings $f ; echo ; done ; cd

(When you reach the end of the command line, just keep on typing. Better yet, just cut&paste the above into the command line (without the prompt, I.E: starting with the cd), press enter.)

Post the output of that command in this thread.
Include device nickname and firmware version information with your report.

Quote:

Originally Posted by PW3, 5.6.1.1

Code:

[root@kindle root]# cd /etc/kdb.src/wario/system/daemon/otaup ; for f in `ls -1`
 ; do echo $f ; strings $f ; echo ; done ; cd
DOWNLOAD_PATH_FULLBIN
RG002
<DATA>
/mnt/us/update-full.bin

DOWNLOAD_PATH_LANGUAGE_FORMAT
RG002
<DATA>
/mnt/us/Update_LANG_%lld.bin

DOWNLOAD_PATH_OTA_FORMAT
RG002
<DATA>
/mnt/us/Update_%lld_%lld.bin

DOWNLOAD_PATH_TEMP
RG002
<DATA>
/mnt/us/update.bin

DOWNLOAD_PATH_VERSIONLESS_FORMAT
RG002
<DATA>
/mnt/us/Update_VLS_%lld.bin

PLATFORM_CODE
RG002
<DATA>

TRANSFER_TIMEOUT_SEC
RG002
<DATA>
126000

[root@kindle root]#

Note:
There is (was) a database utility posted by NiLuJe, somewhere around here, that can be used to modify the above database.

OTA blocking might be as simple as setting the transfer timeout to an unreasonably short time.
(Which would require a jailbroken device)
OR
Playing games with the hardcoded /mnt/us filenames used.
(Which would not require a jailbroken device)

knc1 · 03-12-2016, 10:55 AM

I **though** the kdb installed on the Kindle was a 'read only' build.
My memory was wrong, the kdb build provides a complete command set.

My memory was correct, the write operations, although listed, are not functional, since the database is stored in a cramfs filesystem.

Code:

[root@kindle root]# df /etc/kdb.src
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/loop/4               1412      1412         0 100% /etc/kdb.src

[root@kindle root]# losetup /dev/loop/4
/dev/loop/4: 0 /etc/kdb.src.cramfs.img

(Ah, but I can fix that, when/if required.)

Code:

[root@kindle root]# kdb -h
Usage: kdb [OPTION] <command> [<key> [value ...]]
Use kdb to manipulate the Key Database.

libelektra 0.7.0 is used

ARGUMENTS
Commands are explained with kdb -h command
<key> is the name of the key. It can be prefixed
 with environment KDB_ROOT. The slash between will
be inserted.
 export KDB_ROOT="user/test/dir"
 kdb get file/key ... will expand to user/test/dir/file/key
[value ...] hold the value which should be set

COMMANDS
 kdb get [-dlfs] key/name
 kdb set [-t type] [-c "A comment about this key"] [-m mode] [-u uid]
         [-g gid] key/name "the value"
 kdb set [-t type] [-m mode] [-c "A comment"] key/name -- "the value"
 kdb set [-t type] [-b file] key/name
 kdb ls [-lRfvs] [key/dir | key/name]
 kdb ls [-lRfvx] [key/dir | key/name] > keys.xml
 kdb edit [-R] [key/dir | key/name]
 kdb rm key/name
 kdb mv key/src key/dest
 kdb ln key/src key/dest
 kdb export system/some/tree.root > file.xml
 kdb import < file.xml
 kdb import file.xml
 kdb monitor some/key/name
 kdb info

Walking part of the db tree:

Code:

[root@kindle root]# kdb ls
system
user

[root@kindle root]# kdb ls system
system/daemon
system/driver

[root@kindle root]# kdb ls system/daemon
system/daemon/cmd
system/daemon/contentpackd
system/daemon/otaup
system/daemon/phd
system/daemon/pillowd
system/daemon/pmond
system/daemon/powerd
system/daemon/usbnetd
system/daemon/volumd
system/daemon/wand
system/daemon/wifid

Getting the ota update controls as an xml file:

Code:

[root@kindle root]# kdb export system/daemon/otaup >/tmp/root/otaup.xml
[root@kindle root]# cp /tmp/root/otaup.xml /mnt/us

Which gets us a bit more readable output that 'strings' does.

PHP Code:


			
<keyset>
<key name="system/daemon/otaup/DOWNLOAD_PATH_FULLBIN"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/update-full.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_LANGUAGE_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_LANG_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_OTA_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_%lld_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_TEMP"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/update.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_VERSIONLESS_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_VLS_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/PLATFORM_CODE"
        uid="1004" gid="136" mode="0664"
    value="7"/>
<key name="system/daemon/otaup/TRANSFER_TIMEOUT_SEC"
        uid="1004" gid="136" mode="0664"
    value="126000"/>
</keyset>

Which seems to lead to:
Edit as desired.
kdb import the changed *.xml file.

So what to do to it?
Set the download path temp to /dev/null ?

= = = = = =
OK readers, some of you with command line access to a 7th gen device use this kdb export feature to let me see what your firmware version contains for ota update controls.
Please, Please

knc1 · 03-12-2016, 11:36 AM

A temporary work-around to having the database in a read-only file system type.

Make a directory in writable file space:

Code:

[root@kindle root]# mkdir kdb
[root@kindle root]# cd kdb
[root@kindle kdb]# cp -a /etc/kdb.src/* .
[root@kindle kdb]# pwd
/tmp/root/kdb
[root@kindle kdb]# cd ..

Over-mount the cramfs mount point:

Code:

[root@kindle root]# mount --bind /tmp/root/kdb /etc/kdb.src
[root@kindle root]# df /etc/kdb.src
Filesystem           1K-blocks      Used Available Use% Mounted on
tmpfs                    32768      1740     31028   5% /var

Now play with making changes to the OTA update settings:

Code:

[root@kindle root]# kdb get system/daemon/otaup/TRANSFER_TIMEOUT_SEC
126000
[root@kindle root]# kdb set system/daemon/otaup/TRANSFER_TIMEOUT_SEC 60
[root@kindle root]# kdb get system/daemon/otaup/TRANSFER_TIMEOUT_SEC
60

Since the 'bind mount' isn't in /etc/fstab - it will go-away on a re-boot.
The writable copy of the database is in tmpfs - it will also go-away on a re-boot.
Which gives a bit of protection from bricking the Kindle (push the power button to recover).

And when happy with the changes, we can create a replacement cramfs image:

Code:

[root@kindle root]# mkcramfs
usage: mkcramfs [-h] [-e edition] [-i file] [-n name] dirname outfile
 -h         print this help
 -E         make all warnings errors (non-zero exit status)
 -e edition set edition number (part of fsid)
 -i file    insert a file image into the filesystem (requires >= 2.4.0)
 -n name    set name of cramfs filesystem
 -p         pad by 512 bytes for boot code
 -s         sort directory entries (old option, ignored)
 -v         be more verbose
 -z         make explicit holes (requires >= 2.3.39)
 dirname    root of the directory tree to be compressed
 outfile    output file

Isn't it nice that Lab126 provides utilities that have no reason for being on the system?

shamanNS · 03-12-2016, 12:45 PM

PW3, fw 5.6.5:

PHP Code:


			
<keyset>
<key name="system/daemon/otaup/DOWNLOAD_PATH_FULLBIN"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/update-full.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_LANGUAGE_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_LANG_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_OTA_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_%lld_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_TEMP"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/update.bin]]></value>
</key>

<key name="system/daemon/otaup/DOWNLOAD_PATH_VERSIONLESS_FORMAT"
        uid="1004" gid="136" mode="0664">

     <value><![CDATA[/mnt/us/Update_VLS_%lld.bin]]></value>
</key>

<key name="system/daemon/otaup/PLATFORM_CODE"
        uid="1004" gid="136" mode="0664"
    value="7"/>
<key name="system/daemon/otaup/TRANSFER_TIMEOUT_SEC"
        uid="1004" gid="136" mode="0664"
    value="126000"/>
</keyset>

So, it's the same output as on PW3 fw 5.6.1.1.

knc1 · 03-12-2016, 02:19 PM

Thanks.
Now for a 5.7.x sample.

Perhaps Lab126 thinks those constant values are "safe" from meddling in their loop mount, read only, image file.

Maybe a KUAL button for that capture command . . . .

Gabbb · 03-13-2016, 06:12 AM

Quote:

Originally Posted by knc1

Thanks.
Now for a 5.7.x sample.

Perhaps Lab126 thinks those constant values are "safe" from meddling in their loop mount, read only, image file.

Maybe a KUAL button for that capture command . . . .

I'm on 5.7.3. (pw3)

NiLuJe · 03-14-2016, 09:29 AM

@knc1: IIRC, those set of keys (or 'leaves', as elektra calls them, IIRC) haven't changed in quite a while. Some of that ended up in KindleTool code comments

.

I can also confirm that bind-mounting over the cramfs db works, but you have to be careful of the timing and the sanity of the file, since any kind of issue will soft-brick the device (this trick is used by USBNetwork when enabling the per-device MAC support, for instance).
On the plus side, you can be much more granular and just bind-mount a single leaf or a single subtree instead of duplicating the whole tree.

knc1 · 03-14-2016, 10:41 AM

Quote:

Originally Posted by NiLuJe

@knc1: IIRC, those set of keys (or 'leaves', as elektra calls them, IIRC) haven't changed in quite a while. Some of that ended up in KindleTool code comments

.

I can also confirm that bind-mounting over the cramfs db works, but you have to be careful of the timing and the sanity of the file, since any kind of issue will soft-brick the device (this trick is used by USBNetwork when enabling the per-device MAC support, for instance).
On the plus side, you can be much more granular and just bind-mount a single leaf or a single subtree instead of duplicating the whole tree.

It should be an atomic operation - changing the kdb root tree.

Closer would probably be:
export as xml
import xml to the writable clone
then bind mount the clone over the read-only

The system ***should*** have the inode related to any on-going read operation cached at the point the bind mount takes effect.
But then .....
Sometimes we just get un-lucky.

Analogus · 01-13-2017, 08:35 AM

In short: I want to prevent my Voayage on 5.8.7 to be uptdated OTA.
Question: what to do?

I have to confess that I do not understand the infos posted here, and, they rely on an earlier firmware.
Could someone (knc1

?) give me one or two hints what to do?

Thanks

knc1 · 01-13-2017, 08:54 AM

The 'blocker directory name' described in Step #7 of the current multi-device jb is the best that we can do at the moment.

With the newest versions of the 5.8.x firmware, what happens is:
*) Kindle system discovers an OTA update is available.
*) Attempts to save to the user's storage area.
*) Finds the directory name.
*) Suceeds in removing the directory name.
*) Pops up a 'download failed' notice panel.
*) Resets its timer for this entry on the to-do list (about 8 hours later).
It will succeed the next time it tries unless the user takes some action (like put the blocker name back or enables airplane mode).

I think that some of the people here are working on a better method but this is a very loose group of individuals.
Contributors contribute what they already do for themselves.

The other choices are:
*) Keep it in airplane mode.
*) Install the BBB (Block Big Brother) firewall (which hasn't been updated for new Amazon servers - but could be easily, just takes time to read a bunch of log files contributed by owners of the various models).

Note:
Open the credits spoiler of the current jail break directions.
Of the list of people there, there is only one person still active here (guess who).
I do wish I still had the active mind of a 20 year old, but I am over 70 and the aging hasn't been that kind.
So answering questions that I have already seen the answer too is about the best I can do.

Analogus · 01-13-2017, 09:16 AM

Thank you very much as always.

This interim-solutions will help and serve as a last defence line against Amazon.

Edit:
I bow to the age...

03-12-2016, 10:55 AM	#2
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	kdb information I though the kdb installed on the Kindle was a 'read only' build. My memory was wrong, the kdb build provides a complete command set. My memory was correct, the write operations, although listed, are not functional, since the database is stored in a cramfs filesystem. Code: [root@kindle root]# df /etc/kdb.src Filesystem 1K-blocks Used Available Use% Mounted on /dev/loop/4 1412 1412 0 100% /etc/kdb.src [root@kindle root]# losetup /dev/loop/4 /dev/loop/4: 0 /etc/kdb.src.cramfs.img (Ah, but I can fix that, when/if required.) Code: [root@kindle root]# kdb -h Usage: kdb [OPTION] <command> [<key> [value ...]] Use kdb to manipulate the Key Database. libelektra 0.7.0 is used ARGUMENTS Commands are explained with kdb -h command <key> is the name of the key. It can be prefixed with environment KDB_ROOT. The slash between will be inserted. export KDB_ROOT="user/test/dir" kdb get file/key ... will expand to user/test/dir/file/key [value ...] hold the value which should be set COMMANDS kdb get [-dlfs] key/name kdb set [-t type] [-c "A comment about this key"] [-m mode] [-u uid] [-g gid] key/name "the value" kdb set [-t type] [-m mode] [-c "A comment"] key/name -- "the value" kdb set [-t type] [-b file] key/name kdb ls [-lRfvs] [key/dir \| key/name] kdb ls [-lRfvx] [key/dir \| key/name] > keys.xml kdb edit [-R] [key/dir \| key/name] kdb rm key/name kdb mv key/src key/dest kdb ln key/src key/dest kdb export system/some/tree.root > file.xml kdb import < file.xml kdb import file.xml kdb monitor some/key/name kdb info Walking part of the db tree: Code: [root@kindle root]# kdb ls system user [root@kindle root]# kdb ls system system/daemon system/driver [root@kindle root]# kdb ls system/daemon system/daemon/cmd system/daemon/contentpackd system/daemon/otaup system/daemon/phd system/daemon/pillowd system/daemon/pmond system/daemon/powerd system/daemon/usbnetd system/daemon/volumd system/daemon/wand system/daemon/wifid Getting the ota update controls as an xml file: Code: [root@kindle root]# kdb export system/daemon/otaup >/tmp/root/otaup.xml [root@kindle root]# cp /tmp/root/otaup.xml /mnt/us Which gets us a bit more readable output that 'strings' does. PHP Code: <keyset> <key name="system/daemon/otaup/DOWNLOAD_PATH_FULLBIN" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/update-full.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_LANGUAGE_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_LANG_%lld.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_OTA_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_%lld_%lld.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_TEMP" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/update.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_VERSIONLESS_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_VLS_%lld.bin]]></value> </key> <key name="system/daemon/otaup/PLATFORM_CODE" uid="1004" gid="136" mode="0664" value="7"/> <key name="system/daemon/otaup/TRANSFER_TIMEOUT_SEC" uid="1004" gid="136" mode="0664" value="126000"/> </keyset> Which seems to lead to: Edit as desired. kdb import the changed .xml file. So what to do to it? Set the download path temp to /dev/null ? = = = = = =* OK readers, some of you with command line access to a 7th gen device use this kdb export feature to let me see what your firmware version contains for ota update controls. Please, Please Last edited by knc1; 03-12-2016 at 11:19 AM.

03-12-2016, 12:45 PM	#4
shamanNS Guru Posts: 886 Karma: 10113994 Join Date: Feb 2010 Location: Serbia Device: Kindle PW5 [bricked], Kindle PW1	PW3, fw 5.6.5: PHP Code: <keyset> <key name="system/daemon/otaup/DOWNLOAD_PATH_FULLBIN" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/update-full.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_LANGUAGE_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_LANG_%lld.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_OTA_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_%lld_%lld.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_TEMP" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/update.bin]]></value> </key> <key name="system/daemon/otaup/DOWNLOAD_PATH_VERSIONLESS_FORMAT" uid="1004" gid="136" mode="0664"> <value><![CDATA[/mnt/us/Update_VLS_%lld.bin]]></value> </key> <key name="system/daemon/otaup/PLATFORM_CODE" uid="1004" gid="136" mode="0664" value="7"/> <key name="system/daemon/otaup/TRANSFER_TIMEOUT_SEC" uid="1004" gid="136" mode="0664" value="126000"/> </keyset> So, it's the same output as on PW3 fw 5.6.1.1. Last edited by shamanNS; 03-12-2016 at 12:48 PM.

03-12-2016, 02:19 PM	#5
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Thanks. Now for a 5.7.x sample. Perhaps Lab126 thinks those constant values are "safe" from meddling in their loop mount, read only, image file. Maybe a KUAL button for that capture command . . . . Last edited by knc1; 03-12-2016 at 02:21 PM.

01-13-2017, 08:35 AM	#9
Analogus Fanatic Posts: 568 Karma: 2170348 Join Date: Apr 2011 Device: 2x Sony PRS-350; PRS-300 (†), Paperwhite (†), Voyage	Firmware 5.8.7 (on KV)? In short: I want to prevent my Voayage on 5.8.7 to be uptdated OTA. Question: what to do? I have to confess that I do not understand the infos posted here, and, they rely on an earlier firmware. Could someone (knc1 ?) give me one or two hints what to do? Thanks

01-13-2017, 08:54 AM	#10
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	The 'blocker directory name' described in Step #7 of the current multi-device jb is the best that we can do at the moment. With the newest versions of the 5.8.x firmware, what happens is: ) Kindle system discovers an OTA update is available. ) Attempts to save to the user's storage area. ) Finds the directory name. ) Suceeds in removing the directory name. ) Pops up a 'download failed' notice panel. ) Resets its timer for this entry on the to-do list (about 8 hours later). It will succeed the next time it tries unless the user takes some action (like put the blocker name back or enables airplane mode). I think that some of the people here are working on a better method but this is a very loose group of individuals. Contributors contribute what they already do for themselves. The other choices are: ) Keep it in airplane mode. ) Install the BBB (Block Big Brother) firewall (which hasn't been updated for new Amazon servers - but could be easily, just takes time to read a bunch of log files contributed by owners of the various models). Note: Open the credits spoiler of the current jail break directions. Of the list of people there, there is only one person still active here (guess who). I do wish I still had the active mind of a 20 year old, but I am over 70 and the aging hasn't been that kind. So answering questions that I have already seen the answer too is about the best I can do. Last edited by knc1; 01-13-2017 at 08:58 AM.

03-14-2016, 09:29 AM	#7
NiLuJe BLAM! Posts: 13,477 Karma: 26012494 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	@knc1: IIRC, those set of keys (or 'leaves', as elektra calls them, IIRC) haven't changed in quite a while. Some of that ended up in KindleTool code comments . I can also confirm that bind-mounting over the cramfs db works, but you have to be careful of the timing and the sanity of the file, since any kind of issue will soft-brick the device (this trick is used by USBNetwork when enabling the per-device MAC support, for instance). On the plus side, you can be much more granular and just bind-mount a single leaf or a single subtree instead of duplicating the whole tree. Last edited by NiLuJe; 03-14-2016 at 09:31 AM.

01-13-2017, 09:16 AM	#11
Analogus Fanatic Posts: 568 Karma: 2170348 Join Date: Apr 2011 Device: 2x Sony PRS-350; PRS-300 (†), Paperwhite (†), Voyage	Thank you very much as always. This interim-solutions will help and serve as a last defence line against Amazon. Edit: I bow to the age... Last edited by Analogus; 01-13-2017 at 09:46 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Android device, buy now or wait for next generation?	Manilse	Which one should I buy?	4	11-06-2015 09:01 AM
Kindle 7th generation	Vinicius	Kindle Developer's Corner	6	07-10-2015 10:13 AM
Light Case for Kindle Touch 7th Generation (KT2)	JSWolf	Amazon Kindle	4	12-11-2014 08:57 PM
E-book device (E Ink, 2nd-generation) comparison matrix	Alexander Turcic	Which one should I buy?	107	11-16-2011 04:03 AM