How to jailbreak 5.6.1.0.2 (serial port) step by step

[volkaoth]

mh, it seems I have problem with root-access.
I can obtain root-access in diag-mode but as soon as i reboot I cannot get root again...

so I fail somewhere by step 7 or 8 in 'HowTo-get-root-access

but when I am in diagmode again, the root pw is the one I chose ...
don't know what mistake i am doing ...

so i could run the jb.sh in diag-mode, but it sounds like that's not what i want...

[knc1]

Originally Posted by volkaoth

mh, it seems I have problem with root-access.
I can obtain root-access in diag-mode but as soon as i reboot I cannot get root again...

OK, that is a known situation, no need to panic.

Originally Posted by volkaoth

so I fail somewhere by step 7 or 8 in 'HowTo-get-root-access

but when I am in diagmode again, the root pw is the one I chose ...
don't know what mistake i am doing ...

You are not making a mistake, the Kindles are dual-boot systems.

Originally Posted by volkaoth

so i could run the jb.sh in diag-mode, but it sounds like that's not what i want...

That will not work - different systems (Like a single computer that runs either WinSomething or WinXP - picked at boot time).

**BUT**
You can access the file system of the **other** bootable system from the one you happen to be in at the moment.

- - - - - - -

Let us first confirm that you are really in the 'Diag Mode' system -
* - put the device in 'Diag Mode'
* - login over the serial port
* - enter:

whoami

and paste here in a 'code' '/code' block (see above).
* - enter:

mount

and paste here in a 'code' '/code' block.

[volkaoth]

Ok,
I am in Diag mode and I am 'root'
# whoami

 root

# mount

rootfs on / type rootfs (rw)
/dev/root on / type ext3 (rw,noatime,nodiratime,barrier=0,data=writeback)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /dev type tmpfs (rw,relatime,mode=755)
tmpfs on /dev/shm type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /var type tmpfs (rw,relatime,size=0k)
/dev/mmcblk0p3 on /var/local type ext3 (rw,relatime,errors=continue,barrier=0,data=writeback)
fsp on /mnt/us type fuse.fsp (rw,nosuid,nodev,noatime,user_id=0,group_id=0)
/dev/loop/0 on /mnt/base-us type vfat (rw,noexec,noatime,nodiratime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,sho)

[knc1]

Hmm...
I expected the output of the 'mount' command to show which partition was mounted as: '/' (in diags, it would be mmcblk0p2).

Let us assume that is what is mounted as /dev/root and '/'.
(Their initramfs system did that before switching the root system.)

Now the problem about not being able to login to the 'main' system as 'root' is that username does not have a password assigned to it (in the 'main' file system, only in the 'diags' file system).

The directions you linked to use a temporary mount point for the main system of /mnt/mmc
But they do not mention if that mount point already exists or if it does, if it is in use for something.

So create a mount point in /tmp (that is ramfs, the created mount point will go away when the system is re-booted).

mkdir /tmp/main

Then mount the main file system at that point:

mount /dev/mmcblk0p1 /tmp/main

That should allow access to the 'main' system's password file as:
/tmp/main/etc/passwd

The entry for 'root' currently prohibits logins -
It needs to be text edited to allow a password to be used

At which point, my memory fails me - and I don't have a version of that firmware running on anything.

Hmm...
Compare how /etc/passwd and /etc/shadow entries for 'root' are (those are the working ones for 'diags mode');
with the entries in /tmp/main/etc/passwd and /tmp/main/etc/shadow.

Then hope someone with a better memory than mine can pick up this thread and continue.

[volkaoth]

system: I mntroot:def:Making root filesystem writeable
[   10.696857] EXT3-fs (mmcblk0p2): using internal journal
sock_init 1888

its as you expected

so far I have mounted tmp and waiting orders (I make it just easy for me...)

the next step i didn't get it completely

*the problem is the missing root-pw in main-mode
*normaly it should be rewritten with the diag-root-pw
-> so I have to change it manually somewhere in a file or copy it form diag to normal-mode?

cant that be handled with 'chroot'?
like: reset-your-ubuntu-password-easily-from-the-live-cd/

[knc1]

Should be worth trying (since your 'root' you don't need the 'sudo'):
**Back up the passwd and shadow files first** (copy them into /var/local maybe?)

mount /dev/mmcblk0p1 /tmp/main
chroot /tmp/main
passwd root

Presuming that the passwd command is available

But you can also set 'root' in etc/passwd to not require a password with a text editor (you should have busybox vi available).

REPEAT:
I don't have this firmware version to look at, but
root:!: ..... Should be 'locked' (no shell login)
root:: ...... Should be 'no password required'
root:*: .... Should indicate encrypted password stored in etc/shadow file

[barkas]

Or just copypaste the encrypted password from your kubuntu machine over.

[knc1]

Originally Posted by barkas

Or just copypaste the encrypted password from your kubuntu machine over.

That might be a bit short on the details -
To make that work, you still have to edit etc/passwd and then copy the kubuntu etc/shadow entry across.

But keep in mind that the Kindle probably does not support the encryption method used in your kubuntu file system.

- - - - -

So I stand by my first recommendation -
use the 'root' entries in etc/shadow and etc/passwd from the diags file system (which you know is working, since you just logged in with it) for the main file system.

[volkaoth]

good morning, back in action!

summerized I have 3 possibilities to solve the root-password problem:

1. examine both files from diag-mode (partition mmcblk0p2) and rewrite these files in normal-mode (partition mmcblk0p1) so they look like the ones in diag.mode
2. try setting a root pw for normal-mode with chroot - then i have to login root with pw later on
3. copy the '/etc/passwd' and '/etc/shadow' from my kubuntu under the assumption kindle and kubuntu using the same encryption

why not simply copy '/etc/passwd' and '/etc/shadow' from diag-mode to normal-mode?

[NiLuJe]

Using diag's shadow entry for root is exactly the solution we recommend, as knc1 pointed out .

[knc1]

Originally Posted by volkaoth

- - - - - -
why not simply copy '/etc/passwd' and '/etc/shadow' from diag-mode to normal-mode?

If all of the other user names, user ids, group names and group ids are the same - nothing.

But rather than verify all of that, just copy the single line **ENTRY** for the user named 'root' from one pair of files to the other.
OR
just delete the '!' second argument in etc/passwd so that no password is required - you can set a new password later, once you are jailbroken.

[volkaoth]

ok, thanks

i got it so far.
I have root-access in main with no password!

btw. to check the partition on '/' I tried to mount diag again with no localisation:

 mount /dev/mmcblk0p2

the answer was

/dev/mmcblk0p2 is allready mounted on / or busy

is seems that running diagmode need many power, got low battery warning
have to charge first befor i can continue with JB

[knc1]

Originally Posted by volkaoth

ok, thanks

i got it so far.
I have root-access in main with no password!

btw. to check the partition on '/' I tried to mount diag again with no localisation:

 mount /dev/mmcblk0p2

the answer was

/dev/mmcblk0p2 is allready mounted on / or busy

is seems that running diagmode need many power, got low battery warning
have to charge first befor i can continue with JB

you are almost there.
a battery recharge, run the jb.sh script, done.

diag mode might not be running the battery charge controller.
or you didn't have the usb cable plugged in all of this time.

when you get a chance, try this:

mountpoint -d / 
cat /proc/partitions

The first command should (if busybox supports it) return the major and minor device number.
The second command should show the size and name for that major:minor pair.

Your idea was a good one, if the intended partition was already mounted (it was) -
But the directions to revert the over-mount of '/' might lead to confusing the new user if it wasn't.
(and of course, Linux might also get confused - but a re-boot should have fixed that. )

[volkaoth]

almost done ... but little confused
I have root-access and I executed jb.sh successfully (according to the terminal)

but - NOTHING CHANGED

after rebooting I get no 'jailbreak' - logo and
I am not able to install KUAL(v2.5) and MRPI ...

the command 'mountpoint' is not supported

here is cat /proc/partitions

[root@kindle root]# cat /proc/partitions
major minor  #blocks  name

   7        0    3192824 loop0
   7        2        564 loop2
   7        3      72272 loop3
   7        4         36 loop4
   7        5       2084 loop5
   7        6      14876 loop6
 179        0    3866624 mmcblk0
 179        1     460800 mmcblk0p1
 179        2      65536 mmcblk0p2
 179        3      65536 mmcblk0p3
 179        4    3192832 mmcblk0p4
 179       16       2048 mmcblk0boot1
 179        8       2048 mmcblk0boot0
[root@kindle root]#

and very helpful for an overview is df -k

[root@kindle root]# df -k
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root               447909    289956    135453  68% /
tmpfs                   127728       100    127628   0% /dev
tmpfs                   127728         0    127728   0% /dev/shm
tmpfs                    32768       392     32376   1% /var
/dev/loop/2               2536      2536         0 100% /usr/share/X11/xkb
/dev/loop/3             105604    105604         0 100% /usr/java/lib/fonts
/dev/loop/4               1412      1412         0 100% /etc/kdb.src
/dev/loop/5               9324      9324         0 100% /usr/lib/locale
/dev/loop/6              22720     22720         0 100% /usr/share/keyboard
/dev/mmcblk0p3           63461     17444     42741  29% /var/local
/dev/loop/0            3188640     76192   3112448   2% /mnt/base-us
fsp                    3188640     76192   3112448   2% /mnt/us
[root@kindle root]#

[volkaoth]

and about charging.

it seems to be possible to do all while using a wallcharger over USB.

what I have done for now - maybe this is my error source