Tutorial WatchThis - Software Jailbreak for any Kindle <= 5.14.2

[Slights]

Originally Posted by dhdurgee

You should be able to as your firmware is <= 5.14.2

Dave

Thanks Dave! I have a pw4 (I think; it's the 10th gen) but it looks like the lowest firmware under the pw4 folder from the download link is 5.13.4, should I just be using that?

[dhdurgee]

Originally Posted by Slights

Thanks Dave! I have a pw4 (I think; it's the 10th gen) but it looks like the lowest firmware under the pw4 folder from the download link is 5.13.4, should I just be using that?

If you actually are running 5.12.2 then you should be able to use KindleBreak, which is simpler than this one to run. You can find information on that in the Open Sesame thread.

Dave

[neo_free]

Hello, i new in this
can i login to my amazon account after jailbreak? or is it better not to?

[mbrisco]

Originally Posted by neo_free

Hello, i new in this
can i login to my amazon account after jailbreak? or is it better not to?

If you do renameotabin to block updates, then it’s safe. I’ve logged into my Amazon account after jailbreak without any problems yet.

[Darthagnon]

I, too, am one of those people who mistook 5.12.2 for 5.12.2.2 and tried unsuccessfully to jailbreak with WatchThis instead of KindleBreak (wish the OpenSesame megathread hadn't archived that).

Now I'm stuck on the demo menu. As WatchThis didn't work, I removed the binaries, but I still can't exit the demo menu, as it comes up with an application error. Trying to do a factory reset, but it complains about the battery being too high. Do I just have to wait a few weeks, and then use KindleBreak?

Could we add a PSA to the original post that 5.12.2 IS NOT THE SAME AS 5.12.2.2? I thought the menu had just concatenated a number.

[Darthagnon]

Resolved! Waiting overnight was enough time for the KT2 on 5.12.2 (not 5.12.2.2) to factory reset, now for KindleBreak. Really glad it didn't brick!

[muggleMode]

Originally Posted by NiLuJe

Reboot, then reinstall the JB hotfix.

what are the steps to reinstall the JB hotfix?
just put the "Update_hotfix_watchthis_custom.bin" in the root of the device?

[luketheduke]

Originally Posted by muggleMode

what are the steps to reinstall the JB hotfix?
just put the "Update_hotfix_watchthis_custom.bin" in the root of the device?

You should just be able to drop the hotfix in the root of the device and go to settings and update.

If that doesn't work you can try to put it in the mrpackages folder and run ;log mrpi in the search bar.

[muggleMode]

Originally Posted by luketheduke

You should just be able to drop the hotfix in the root of the device and go to settings and update.

If that doesn't work you can try to put it in the mrpackages folder and run ;log mrpi in the search bar.

i install the jailbreak on my PW5 perfectly
accidentally update to the latest version (5.15.1)
got this error when i try to reinstall JB hotfix

"Update Error
An invalid update file has been loaded on your device"

when I disconnect the cable after copying the file to the root folder it gives me that error, and then it deletes the file...

and when i try to install something with ;log mrpi
i got white screen after the installation and had to hold to power button to restart the device

I'm going to turn on airplane mode and wait for the next jailbreak. there are no solutions I already gave up.

[luketheduke]

Originally Posted by muggleMode

i install the jailbreak on my PW5 perfectly
accidentally update to the latest version (5.15.1)
got this error when i try to reinstall JB hotfix

"Update Error
An invalid update file has been loaded on your device"

when I disconnect the cable after copying the file to the root folder it gives me that error, and then it deletes the file...

and when i try to install something with ;log mrpi
i got white screen after the installation and had to hold to power button to restart the device

I'm going to turn on airplane mode and wait for the next jailbreak. there are no solutions I already gave up.

I'm sorry to hear that.
What happens when you type

;log mrpi

into the search bar and press enter?

[muggleMode]

Originally Posted by luketheduke

I'm sorry to hear that.
What happens when you type

;log mrpi

into the search bar and press enter?

still have the "Hush little baby..." message

but when i try to install something with the ;log mrpi

i got blank screen after the installation and have to hold to power button to restart the device.

[Chrona93]

Originally Posted by katadelos

AKA CVE-2022-23224, CVE-2022-23225, CVE-2022-23226 - full writeup with technical details to be released after 5.14.3 has been widely rolled out.

Thank you to NiLuJe, yparitcher and darkassassinua for adding KOReader support for PW5, repackaging all of the hacks and testing this jailbreak

This vulnerability is released in good faith and in the hope that other security researchers will utilise the access that it provides to assist Amazon/Lab126 in improving their security posture.

If you're concerned about the security of your device and do not wish to jailbreak, install firmware version 5.14.3 from this link - I've been working with Amazon to create a fix and can confirm that this version has been hardened against this vulnerability.

Additional thanks to everyone at Amazon/Lab126 who contributed towards this .

Finally, I encourage Amazon/Lab126 to provide a method of unlocking their devices that doesn't involve the need of a 0-day, both for security researchers and for technical users who are interested in modifying their devices. We know that your employees lurk here, use tools that we've created internally and that our ideas have been implemented by you more than once, so help us help you - I promise that we don't bite

Device Compatibility

Spoiler:

This jailbreak is compatible with Kindle devices running the following firmware versions:

KT3, KT4, KOA1, KOA2, KOA3, PW3, PW4, PW5:
5.14.2
5.14.1 (5.14.1.1 on PW5)
5.13.7
5.13.6
5.13.5
5.13.4

KV:
5.13.6
5.13.5
5.13.4

KT2, PW2:
5.12.2.2

You must use the exploit payload that matches your device/firmware combination exactly.

Download Link
watchthis-jailbreak-r03.zip

Installation

Setup

1. Factory reset the device Make sure to use the "en_GB" or "English (United Kingdom)" locale when setting the language.
2. Type ;enter_demo in the Kindle search bar after performing a factory reset
3. Reboot the device
4. Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted.
5. Skip searching for a demo payload
6. Select the "standard" demo type
7. Press "Done" at the prompt to sideload content. Do not sideload the jailbreak at this stage.
8. Once the demo is setup, skip the misconfiguration lockout using the "secret gesture" (double finger tap on bottom right of screen then swipe left)
9. Enter the demo configuration menu by typing ;demo into the search bar
10. Select the "Sideload Content" option

Jailbreak

1. Connect the device to a PC and:
2. Create the directory .demo at the root of the Kindle storage
3. Copy ${YOUR_DEVICE}-${YOUR_FW_VERSION}.zip to .demo/
4. Copy demo.json to .demo/
5. Create an empty folder at .demo/goodreads. Do not put any files in this folder.
6. Press "Done" at the prompt to install the jailbreak script
7. Exit the demo menu and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
8. If an application error occurs, hard reboot the device by holding the power button, enter the demo menu again and select Sideload Content -> Done once more without connecting to USB
9. Select "Help & User Guides" then "Get started"
10. If jailbreaking KT2 or PW2, select the store button instead
11. The device will reboot
12. The jailbreak script will run during the next boot

Post Jailbreak

1. After the device has rebooted, type ;uzb into the search bar
2. Connect the device to a PC and copy Update_hotfix_watchthis_custom.bin to the root of the Kindle storage
3. Eject the device and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
4. Select Update Your Kindle to install the custom hotfix
5. This will take your device out of demo mode, rebuild the application registry and clean up unneeded jailbreak files.

Troubleshooting

• Alternative Demo Mode entry method:
  • Create an empty file named DONT_CHECK_BATTERY at the root of the Kindle USB storage
  • Activate demo mode by typing ;demo into the search bar
  • Once in demo mode, skip setting up wifi and enter dummy values for store registration when prompted
• If you need to reset your device whilst in Demo Mode, enter ;uzb in the search bar to enable USB storage mode then create an empty file named "DO_FACTORY_RESTORE" at the root of the Kindle storage. Once this has been created, reboot the device.
• Video demonstration of secret gesture

You should now have a freshly jailbroken Kindle

I have a new Paperwhite 5 with firmware 5.14.0.1. Where do I find a download for firmware 5.14.1.1 or one of the other versions listed here? All I can find are links to Amazon's page which just gives me 5.14.1.

Is there an archive of all Kindle firmware versions somewhere?

[voratio]

All the firmware files are on Amazon's servers, the problem is they just happily point you to the latest.

To get a specific version, go to the Amazon firmware page. Locate the link for your Kindle model, click on it to start downloading the latest firmware (right now, it's 5.15.1). In your browser's download section/button, right-click on the file as it's downloading and copy the link for it, then stop the download. Open a new tab, paste the link and edit numbers from the firmware version at the end to the firmware version that you want (5.14.1.1, for example) and press Enter to start downloading the file.

[breakmeouttahere]

i inherited a kindle kt3 lately and i thought oh boy does amazon suck, but what the heck - i have no idea what im doing, but OP surely does - i will jailbreak it! well, yeah the guide is pretty comprehensive, up until things start to go wrong and you realize you really have no idea what youre doing, so right now im stuck (i think) in like a new installment, but cant even enter ;demo mode, cause of the whatever shipping requirement. it basically says, my battery is charged too much. so what the heck do i do? wait a month so it depletes a bit? and even if this works out somehow, this is just my first question, cause the jailbreak didnt work the first time i tried either (no clue why and dont even ask me how i got unstuck that time). and what does it mean to just create a file and name it this or that anyway? do i just DO_FACTORY_RESTORE.h3m orr?

[breakmeouttahere]

okay, scratch the bit about being stuck, now im stuck in a different way. so im at
9. Select "Help & User Guides" then "Get started" yeah okay, sure, now im reading the manual?
10. If jailbreaking KT2 or PW2.. im not, so
11. The device will reboot. nope im reading the manual