Can we setup a DNS server to fake amazon's server and remote apply the jailbreak?

[zfu]

As 5.6.1.x can not do jailbreak by apply the update pack from /mnt/us/xxx.bin..
Can we set up a DNS server..
Kindle will check update, download and apply xxx.bin from the fake update server..

As amazon's file server not https....

http://s3.amazonaws.com/G7G_Firmware...le_5.4.3.2.bin

[NiLuJe]

Won't make our packages magically signed by Amazon's keys .

[knc1]

Our Kindle "jail break" provides the device with **our** developer keys, we do not (because we can not) sign our update packages with Amazon's keys.

Unlike Sony, Amazon has not (yet) leaked their signing key, forcing us to use our own.

[Akirainblack]

I've been wondering, how do you decrypt the image files without the key?
I can't find any documentation about how KindleTool works. But that may be because I'm blind. I've searched this forum and the Wiki.
If that info has to come via PM then fair enough.

[knc1]

Originally Posted by Akirainblack

I've been wondering, how do you decrypt the image files without the key?
I can't find any documentation about how KindleTool works. But that may be because I'm blind. I've searched this forum and the Wiki.
If that info has to come via PM then fair enough.

They use a public key system - that is the key (no pun intended; key == crucial; here) phrase to google for.

That is: two keys (a key pair), one public (for decrypting) present on every Kindle and one private (for encrypting) stored in Amazon's I.P. security vault.

Just read the source of KindleTool for the details of how it works.
It has the Amazon public keys embedded in it for handling Amazon packages and our key-pair for handling our packages.
That is: no Amazon private key == can not create Amazon signed packages.

[Akirainblack]

Fair enough, I hadn't realised they used a key pair, which is why I asked.
I have to deal with encryption on a daily basis in my job due to sensitive data so am fully aware of how they work.
Thank you for explaining how you guys do it.
Plus looking through the source, my other idea would take an eternity (brute force the key) due to the length of the key.

[zfu]

ok, ignore me..
The update package signed by the amazon private magic cert/keys..

[knc1]

Originally Posted by Akirainblack

Fair enough, I hadn't realised they used a key pair, which is why I asked.
I have to deal with encryption on a daily basis in my job due to sensitive data so am fully aware of how they work.
Thank you for explaining how you guys do it.
Plus looking through the source, my other idea would take an eternity (brute force the key) due to the length of the key.

Ah, then I can use buzz words -

If you can brute force that RSA key, then Ron Rivest, Adi Shamir, and Leonard Adleman would like to know about it.
So would any number of National Governments.

PS: Amazon still offers free accounts on their Super Computer (the 9th most powerful Super Computer in the world, IIRC - see top 500 list to check) -
which might interest anyone serious about trying.
http://en.wikipedia.org/wiki/RSA_problem

- - - - -

There are actually two (2) updater mechanisms in the Kindle firmware.

One put there in the very early days when Amazon thought that they would support (and encourage) third party add-ins as active documents.
That is the one we use for our packages here.

The other one, for the OTA updates, remains the sole domain of Amazon (we haven't even tried to disturb that one).

That all means that our packages can **only** be installed by owner action.
No chance that they can be forced onto a Kindle via the OTA updater (which just earns you an error code 3, IIRC).

[NiLuJe]

We do use the OTA updater, it's the factory one bundled in the initrd shell that we don't (since the pubkeys are buried in there too, messier to make it like ousr) .

[knc1]

Originally Posted by NiLuJe

We do use the OTA updater, it's the factory one bundled in the initrd shell that we don't (since the pubkeys are buried in there too, messier to make it like ousr) .

I was trying to keep it simple.
But of course your correct.

and there are links here to projects that have replaced the factory kernel (and embedded initrd) if a reader cares to dig enough.

But what's the point? We don't need to disturb it, so we don't.