Block OTA by removing ota related binaries

[RandomGiraffe]

Originally Posted by Hzj_jie

Sorry, I should make it more clear at the first place.

First of all, the device needs to be jail broken.
1. ssh to the device through either wifi or usbnet. I do not see a difference here.
2. mntroot rw
3. cd /usr/bin
4. mv otaupd otaupd.bck
5. mv otav3 otav3.bck
6. ps aux | grep ota
You will see four processes here. Ignore the "/usr/java/bin/cvm" and "grep ota".
The second column is the process id, note down the ids of the other two processes, otav3 and otaupd.
7. pkill {the id in the output of the last command}
8. pkill {the other id in the output of the last command}
or instead of pkill, use reboot command to reboot the device. Then you will know if these two processes would be restarted after reboot.

The otav3 seems like "ota" "v3"; I am not sure if it has been changed to v4 recently.

Indeed you do not need to use ssh, if you have koreader, use the terminal simulator in the plugin can do pretty much the same thing.

I have just completed this in kterm on my PW4 itself, all seems to have worked fine so thank you again.

[Hzj_jie]

Not sure about kual, but I can try to include it in koreader.

[hius07]

Originally Posted by Hzj_jie

Not sure about kual, but I can try to include it in koreader.

Just to remind that KOReader can simply run sh-scripts from its filebrowser.

[trcm]

Step 6 can just be this so you get just the correct processes :
# pgrep -fl ota

I added a step 5.5, so that if anything tries to call these binaries, it gets a successful exit code rather than an error :
# echo "/bin/true" > /usr/bin/otav3
# echo "/bin/true" > /usr/bin/otaupd
# chmod +x /usr/bin/otav3 /usr/bin/otaupd

Finally, I commented out (prefixed with '#') these lines in /etc/crontab/root :
- The /usr/sbin/checkpmond line
- All the /usr/sbin/loginfo lines
- The OTAFILE line
- The record_dem_heartbeat_cronjob.sh line

[fedcod]

Trying this right now, Thanks !

[RnJ4]

I looked up in the binary otav3,and made a slight modification. By tweaking a battery related function (sub_1515c), it may always think the device is not ready for update.
I am very unskilled in reverse engineering. So I can't gurantee this will work.
Here is a already modded otav3 binary for PW3:http://www.mediafire.com/file/yhjwvd...1pw/otav3/file

[trcm]

Slightly off-topic, but if you want to use your Kindle without registering it, but worry that ever connecting to wifi will delete your content and dictionaries and unregister you....

# mntroot rw
# touch /var/local/system/DONT_DELETE_CONTENT_ON_DEREGISTRATION
# touch /var/local/java/prefs/reginfo 2>/dev/null || chattr -i /var/local/java/prefs/reginfo
# cat <<EOF > /var/local/java/prefs/reginfo
#Mon Jan 01 00:00:00 GMT+00:00 2000
deviceName=kindle
deviceEmailAddress=kindle@pseudo.url
userName=kindle
userId=amzn1.account.XXXXXXXX1A2B3C4YYYYYYYYYYYYY
givenName=kindle
EOF
# chmod 444 /var/local/java/prefs/reginfo
# chattr +i /var/local/java/prefs/reginfo
# grep -q "firs-ta-g7g.amazon.com" /etc/hosts || echo "127.0.0.1 firs-ta-g7g.amazon.com" >> /etc/hosts
# mntroot ro
# restart framework

We just block the domain for registration, so no need to bother with IP ranges in firewalls, etc.
So, the store viewing still works, dictionary lookups, home&library settings, collections, etc.
But Wikipedia and Translation widgets are sadly still unavailable as Amazon require valid credentials to use those proxied services.

[trcm]

Also, as /etc/profile sets the path with /usr/local/bin/ prefixed, we can easily override some of the '/usr/bin/lipc-get-prop' results, for example :

# grep PATH /etc/profile
export PATH=/usr/local/bin:/bin:/usr/bin:/usr/sbin:/sbin

# cat /usr/local/bin/lipc-get-prop
# lipc-get-prop override script
if [[ "$*" == "com.lab126.amazonRegistrationService isRegistered" ]]; then
	# Lets pretend we're registered
	echo 1
elif [[ "$*" == "com.lab126.legalComplianceService gdprValue" ]]; then
	# If either 0 or 1, then /etc/dem_heartbeat/record_gdpr_usage_collection_heartbeat.sh records metrics
	echo "-1"
elif [[ "$*" == "com.lab126.household activeProfileRole" ]]; then
	# If 'ADULT' then /etc/dem_heartbeat/record_dem_heartbeat.sh records metrics
	echo "NOT_ADULT"
else
	/usr/bin/lipc-get-prop $*
fi

[Hzj_jie]

Originally Posted by trcm

Also, as /etc/profile sets the path with /usr/local/bin/ prefixed, we can easily override some of the '/usr/bin/lipc-get-prop' results, for example :

# grep PATH /etc/profile
export PATH=/usr/local/bin:/bin:/usr/bin:/usr/sbin:/sbin

# cat /usr/local/bin/lipc-get-prop
# lipc-get-prop override script
if [[ "$*" == "com.lab126.amazonRegistrationService isRegistered" ]]; then
	# Lets pretend we're registered
	echo 1
elif [[ "$*" == "com.lab126.legalComplianceService gdprValue" ]]; then
	# If either 0 or 1, then /etc/dem_heartbeat/record_gdpr_usage_collection_heartbeat.sh records metrics
	echo "-1"
elif [[ "$*" == "com.lab126.household activeProfileRole" ]]; then
	# If 'ADULT' then /etc/dem_heartbeat/record_dem_heartbeat.sh records metrics
	echo "NOT_ADULT"
else
	/usr/bin/lipc-get-prop $*
fi

[hius07]

Just a KUAL extension for ota binaries rename/restore.
Reboots automatically, no need to kill the processes manually.

[RandomGiraffe]

Originally Posted by hius07

Just a KUAL extension for ota binaries rename/restore

Just a superstar hius07, thank you.

[RandomGiraffe]

Should this work on 5.13.4?

[25pinjo15]

I'm looking too for the 5.13.3 (jailbroken but with airplane mode off and not registered ) so I could use wifi transfer

edit: I will try blocking only the internet access on the router for that specific device only.

[hius07]

Be careful, the method might be insecure
https://www.mobileread.com/forums/sh...48#post4105248

[cronot]

Originally Posted by hius07

Be careful, the method might be insecure
https://www.mobileread.com/forums/sh...48#post4105248

My guess based on my knowledge of linux and generally on how these things tend to work, is that the script prevents from running the service (otav3, otaupd, etc.) that checks up with Azamon's servers and downloads the firmware. Installing the firmware itself looks like a function of the bootloader, so if it finds an update binary on root, it will install it regardless if it was downloaded by OTA or put there by the user.

So, as long as the user doesn't do something stupid like downloading the newest firmware and manually copy it to the internal storage, this method should be (fingers crossed) safe, at least for preventing OTA updates. But I would agree that more test is needed in order to rule out any unpleasant surprises.