Serial Jailbreaking FW >= 5.6.1.1

knc1 · 08-11-2017, 04:05 PM

This post is not complete or ready to use!

A note to anyone who might not do this all in one day:
The battery charger is off while running "Diags" - after 4 days, I just got a 'Battery Critical' screen and it rebooted to 'main' to run the charger.

Abstract
This updated tutorial on serial jailbreaking illustrates the use of the newer Diag system menu.
The procedure has been slightly simplified.
Some of the materials have been repackaged and are used differently.
tl;dr: The Cliff's Notes version
- log into diags
- (optional) run /mnt/us/mkbackup.sh
- run /mnt/us/unjail.sh
- reboot
  (wait)
- in main searchbar, enter:
  ;log mrpi
  (wait)
your done - jail broken and everything you had in /my_packs is installed.

Spoiler:

Reference Materials
This tutorial is based on the earlier tutorial:
Serial Jailbreaking FW >= 5.6 for Dummys
Includes the setting up of PuTTY under Windows and making the connection to the serial port.
Also includes links to methods of connection other than the use of hot solder.

Installation and setup of the MiniCom terminal emulator under Linux (also available for MacOSx and *BSD).
MinCom Setup

Additional information may be found in the Master Index, see:
Hardware Index

You will need to use the above reference materials to create the serial port connection and get a serial port terminal emulator working.
Collecting Required Materials
- You will need some of the usual add-in packages, gathered from NiLuJe's snapshots thread:
  - KindleTool
    Scroll through the package listings to near the bottom, pick the build that will run on your PC.
  - MR Package Installer
    At the time of this writing it was in the: "KUAL and KUAL Extensions" section.
  - KUAL
  The text of that post above the package listing tells you how to deal with the *.xz compressed archives if you are using a Windows PC.
  If you have a Linux/BSD/MacOSx based PC of relatively recent vintage, the system provided archive handler should 'just work'.
- You will need the actual jail break (signature certificate) from Branch Delay's post and a package from coplate's snapshots thread:
  - Unlike prior directions, we only need the actual certificate, which I have compressed and attached below as a single file zip archive.
  - coplate's Master Survival Code
    This one does not require MrPI to install, it uses the UYK (Update Your Kindle) built-in function.
Password Discovery
The next preparation step is to find out what the administrator's (root) password is when running the 'Diags' system.

Unpack the KindleTool package for your system.
If you put it in your current directory, you can check if it is working (and see its built-in help) by just entering:
Code:
```
knc1:PW3-Serial> ./kindletool
```
That should have produced a long list of instructions and no error messages.
Meaning you are ready to find the 'Diags' system password for root.

You will need the serial number of your Kindle found:
- On the label of its box
- On its entry in your Amazon account "Manage Devices" web page
- In the "Device Info" panel of the Settings menu.
- From an entry in the 'Diags' system menu. (I know, we aren't that far along yet.)
Note: The serial number is UPPER CASE letters and Numbers (only - not the dots that I have obscured my serial number with).
Code:
```
knc1:PW3-Serial> ./kindletool info G090G1.....
Device uses the new device ID scheme
Platform is Wario or newer
Root PW            fionaed4
Recovery PW        fionaed48
```
The first password is for user: root in the 'Diags' system.
That is all the need for KindleTool in this exercise, but hang on to it, you may need it in the future.
Entering u-boot
At this point, you need to have your Kindle talking to your PC over the serial port.

Are you ready? This next step can pass you by in a hurry if not prepared.
Serial port adapter is connected?
Terminal emulator window open, window is selected?
Finger is hovering near the 'enter' key of the keyboard?

All yes? Continue:

If the Kindle is off, turn it on by pressing the power button.
If the Kindle is on, press and hold the power button until you get a pop-up panel. On that panel, touch: "Restart".

Finger hovering over 'Enter' key, watch for:
Code:
```
U-Boot 2009.08-lab126 (Jan 16 2017 - 03:44:52)

CPU: Freescale i.MX6 family TO0.0 at 996 MHz
Temperature:   34 C, calibration data 0x59e5245f
* * * lots more * * *
```
Just as soon as you see that header, press and hold the 'Enter' key, until you see:
Code:
```
Hit any key to stop autoboot:  0 
uboot > 
uboot > 
uboot > 
* * * However many times your keyboard repeated 'Enter' while you held it. * * *
```
You can release the 'Enter' key now.

That prompt is from u-boot, the system bootloader.
u-boot is fussy, it will only talk to you over the serial port, which is why we hooked up the serial port.

A question mark entered at the prompt will show a list of available commands.
The menus for this version and build of u-boot are here:
u-boot menus
Safety Net
Just in case a re-boot is required, or happens accidentally and we fail to catch the u-boot prompt:
Code:
```
u-boot >idme bootmode diag
```
If things do get away from us, it will at least return to the diag system, not the main system.

Booting the Alternate System
The Kindles (since the K4) are dual boot systems.
The 'Main' system (which is what you normally see) starts in memory at address: 0x041000
The 'Diag' system (which is what we want now) starts in memory at address: 0xE41000
And if those values ever change, you could persuade u-boot into telling you what they are at this point.

Boot up the alternate ('Diag') system from its memory location:

Code:

uboot > bootm 0xE41000
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   Linux-3.0.35-lab126
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2634732 Bytes =  2.5 MB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...
* * * a whole lot of stuff output * * *
system: I mntroot:def:Making root filesystem writable
[    9.981878] EXT3-fs (mmcblk0p2): using internal journal
[   10.368287] g_ether gadget: high speed config #1: CDC Ethernet (ECM)
[   10.591710] KERNEL: I pmic:charger chgina::charger disconnected
sock_init 1888

diag>

Note: You might have to press 'Enter' (once this time) to get the system to show its prompt (its a Unix thing).

The Diag Menus
This 'Diag' system is menu driven. The menu can be operated from the touch screen or from the serial port.
What has happened in the prior section, is that when u-boot gave up control to the Linux kernel, it also handed over the serial port, which Linux is now using as the "Operator's Console Port". Another (mainframe) Unix thing.

We only need the top level of the menu system, entering: ? will list the choices:
Code:
```
diag>?
get_input_from_stdin Received [?]
diag>   MUSCAT_WFO - System Diags -  94
   ~~~~  1.1.30.291999  ~~~~ 
     pcbId:0670309164410CQB
(DS INFO)-Device Setting  
(TOUCH PLATE)-Touch Plate Test     
(OTS)-Operator test suite     
(o)-Misc individual diagnostics     
(WIFI NART)-nART factory test     
(USB EXPORT)-USB device mode     
(o)-Reboot or Disable Diags     
(POWER SUSPEND)-Lock screen     
(X)-Exit
```
Accessing USB Storage
Export the USB storage over the USB cable to your PC (similar to normal operation).
Put a known good USB cable between the Kindle and your PC and then enter:
Code:
```
diag>usb export

get_input_from_stdin Received [USB EXPORT]
* * * snip * * *
   USB device exported
    
   Once you are done
   Eject the USB device from the PC then

   Battery capacity  94
 
(C)-to continue  
(X)-Exit
```
That 'exported' message will repeat at regular intervals.
Populating USB Storage
Most of this section's context is in the pictures.
1. At the top of visible USB storage, make two new directories (folders):
  
  The directory added with the name of: "unjail" will be where we organize the files to be used.
  The directory added with the name of: "update.bin.partial.tmp" should block any new update downloads.
2. Add the new "Master HotFix" to the topmost level:
  
  This will not have any effect until we re-boot the device into the 'Main" operating system.
3. Populate the Kindle:/unjail directory.
  
  I have added the KUAL and MrPI archives from NiLuJe's snapshots thread.
  I have unarchived them into corresponding folders.
  The highlighted packages are not required to be installed at this time, but they are recommended.
  The actual jail-breaking script was still a WIP when this screenshot was taken.
4. Install MrPI
  1. Enter the MrPI sub-directory and select the two directories contained there:
  2. Copy them and paste them in the top level of visible USB storage:
    
    Which makes the top level now contain copies of those two directories (folders).
5. Populate USB with KUAL
  The next step has two, alternative, procedures.
  Read carefully, you should only follow the pair with applies to your model of Kindle.
  - For 8th. generation devices (KT3 and KOA):
    The 8th. generation devices must use the booklet form of KUAL, which has to be installed by MrPI.
  - From:
  - To:
  - For all older models:
    All earlier Kindle models may still use the document form of KUAL.
  - From:
  - To:
6. Place KUAL's configuration file.
  Both the booklet and the document form of KUAL use the same configuration file.
  - From:
  - To:
A work in progress

knc1 · 08-11-2017, 10:24 PM

The following presumes your PC is running some flavor of Linux.

There are a few PC system commands used here but the users of MacOSx and any *BSD should not have any trouble translating them.

Check your system's USB serial handling.

Clear the kernel's message buffer.

Code:

knc1:~> sudo dmesg -c
* * * All of the old messages * * *
## to see that it is now empty: ##
knc1:~> dmesg 
* * * Nothing * * *

Plug in the USB cable.

Discover what device the system just assigned to it.

Code:

knc1:~> dmesg 

[38539.539322] usb 4-5.7: new full-speed USB device number 7 using ehci-pci
[38539.653972] usb 4-5.7: New USB device found, idVendor=0403, idProduct=6001
[38539.653975] usb 4-5.7: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[38539.653977] usb 4-5.7: Product: TTL232RG-VREG1V8
[38539.653979] usb 4-5.7: Manufacturer: FTDI
[38539.653980] usb 4-5.7: SerialNumber: FTZ6UQSB
[38539.656520] ftdi_sio 4-5.7:1.0: FTDI USB Serial Device converter detected
[38539.656551] usb 4-5.7: Detected FT232RL
[38539.656896] usb 4-5.7: FTDI USB Serial Device converter now attached to ttyUSB0

Check the ownership and permissions of that device.

Code:

knc1:~> stat /dev/ttyUSB0

  File: /dev/ttyUSB0
  Size: 0         	Blocks: 0          IO Block: 4096   character special file
Device: 6h/6d	Inode: 68428       Links: 1     Device type: bc,0
Access: (0660/crw-rw----)  Uid: (    0/    root)   Gid: (   16/ dialout)
Access: 2017-08-12 07:14:30.967526088 -0500
Modify: 2017-08-12 07:14:30.967526088 -0500
Change: 2017-08-12 07:14:30.967526088 -0500
 Birth: -

Allow yourself to use those device assignments.
- Discover your group membership.
  Code:
```
knc1:~> id
uid=1000(knc1) gid=100(users) groups=100(users),469(vboxusers)
```
  You are not a member of the 'dialout' group.
- Ensure your user name is set in the environment.
  Code:
```
knc1:~> echo $USER
knc1
```
- Add yourself to the 'dialout' group.
  Code:
```
knc1:~> sudo usermod -a -G dialout $USER
```
- Check that you are now a member of the 'dialout' group.
  Code:
```
knc1:~> grep dialout /etc/group
dialout:x:16:knc1
```
Install minicom if not already installed.
Your package manager's command will be similar to one of these:
- knc1:~> sudo zypper install minicom
- knc1:~> sudo yum install minicom
- knc1:~> sudo app-get install minicom

Configure minicom's system-wide defaults

Start minicom in its setup mode.

Code:

knc1:~> sudo minicom -s

Which will display minicom's top level menu.
The default settings will be set to match the Kindle and serial adapter cable above.
Use the keyboard arrow keys to maneuver in this top level menu.

Code:

            +-----[configuration]------+
            | Filenames and paths      |
            | File transfer protocols  |
            | Serial port setup        |
            | Modem and dialing        |
            | Screen and keyboard      |
            | Save setup as dfl        |
            | Save setup as..          |
            | Exit                     |
            | Exit from Minicom        |
            +--------------------------+

To match the Kindle's serial line and the system USB serial setup shown above, make your configuration look like:

Filenames and paths

Code:

    +-----------------------------------------------------------------------+
    | A - Download directory : /ken/PW3                                     |
    | B - Upload directory   : /ken/PW3                                     |
    | C - Script directory   :                                              |
    | D - Script program     : runscript                                    |
    | E - Kermit program     : /usr/bin/kermit -l %l -b %b                  |
    | F - Logging options                                                   |
    |                                                                       |
    |    Change which setting?                                              |
    +-----------------------------------------------------------------------+

The settings for 'A' and 'B' should be either empty or set to match your own usage.
The other entries shown are not used here.
'Esc' to exit.

File transfer protocols

Code:

+------------------------------------------------------------------------------+
|     Name             Program                 Name U/D FullScr IO-Red. Multi  |
| A  zmodem     /usr/bin/sz -vv -b              Y    U    N       Y       Y    |
| B  ymodem     /usr/bin/sb -vv                 Y    U    N       Y       Y    |
| C  xmodem     /usr/bin/sz -X -vv              Y    U    N       Y       N    |
| D  zmodem     /usr/bin/rz -vv -b              N    D    N       Y       Y    |
| E  ymodem     /usr/bin/rb -vv                 N    D    N       Y       Y    |
| F  xmodem     /usr/bin/rx -vv                 Y    D    N       Y       N    |
| G  kermit     /usr/bin/kermit -i -l %l -b %b  Y    U    Y       N       N    |
| H  kermit     /usr/bin/kermit -i -l %l -b %b  N    D    Y       N       N    |
| I  ascii      /usr/bin/ascii-xfr -dsv         Y    U    N       Y       N    |
| J    -                                                                       |
| K    -                                                                       |
| L    -                                                                       |
| M  Zmodem download string activates... D                                     |
| N  Use filename selection window...... Yes                                   |
| O  Prompt for download directory...... No                                    |
|                                                                              |
|   Change which setting? (SPACE to delete)                                    |
+------------------------------------------------------------------------------+

These are the original defaults.
None of them are used (yet).
But keep in mind that they are here, the Kindle's u-boot build does support file transfer over the serial port.
'Esc' to exit.

Serial port setup

Code:

    +-----------------------------------------------------------------------+   
    | A -    Serial Device      : /dev/ttyUSB0                              |   
    |                                                                       |   
    | C -   Callin Program      :                                           |   
    | D -  Callout Program      :                                           |   
    | E -    Bps/Par/Bits       : 115200 8N1                                |   
    | F - Hardware Flow Control : No                                        |   
    | G - Software Flow Control : No                                        |   
    |                                                                       |   
    |    Change which setting?                                              |   
    +-----------------------------------------------------------------------+

This is the most critical one, it needs to match the system device setting and the requirements of the Kindle serial line.
The 'C' and 'D' fields are not used here.
The other fields should be set as shown, including the disabling of all flow control.
Note: In the event that your serial line should have poor signal quality, try: 115200 8N2, in some cases that extra stop bit helps the hardware stay in-sync.
'Esc' to exit.

Modem and dialing

Code:

 +--------------------[Modem and dialing parameter setup]---------------------+
 |                                                                            | 
 | A - Init string .........                                                  | 
 | B - Reset string ........                                                  | 
 | C - Dialing prefix #1.... ATDT                                             | 
 | D - Dialing suffix #1.... ^M                                               | 
 | E - Dialing prefix #2.... ATDP                                             | 
 | F - Dialing suffix #2.... ^M                                               | 
 | G - Dialing prefix #3.... ATX1DT                                           | 
 | H - Dialing suffix #3.... ;X4D^M                                           | 
 | I - Connect string ...... CONNECT                                          | 
 | J - No connect strings .. NO CARRIER            BUSY                       | 
 |                           NO DIALTONE           VOICE                      | 
 | K - Hang-up string ...... ~~+++~~ATH^M                                     | 
 | L - Dial cancel string .. ^M                                               | 
 |                                                                            | 
 | M - Dial time ........... 45      Q - Auto bps detect ..... No             | 
 | N - Delay before redial . 2       R - Modem has DCD line .. No             | 
 | O - Number of tries ..... 10      S - Status line shows ... DTE speed      | 
 | P - DTR drop time (0=no). 1       T - Multi-line untag .... No             | 
 |                                                                            | 
 | Change which setting?     Return or Esc to exit. Edit A+B to get defaults. |
 +----------------------------------------------------------------------------+

Set 'A' and 'B' to empty strings as shown.
We don't want to send anything to the Kindle in case it is listening when we start up minicom.
Note that 'R' has been changed.
The rest of the options are not significant to using minicom with a Kindle serial port.
'Esc' to exit.

Screen and keyboard

Code:

              +-----------------[Screen and keyboard]-----------------+        
              | A - Command key is         : ^A                       |         
              | B - Backspace key sends    : BS                       |         
              | C - Status line is         : enabled                  |         
              | D - Alarm sound            : Yes                      |         
              | E - Foreground Color (menu): WHITE                    |         
              | F - Background Color (menu): BLACK                    |         
              | G - Foreground Color (term): WHITE                    |         
              | H - Background Color (term): BLACK                    |         
              | I - Foreground Color (stat): WHITE                    |         
              | J - Background Color (stat): BLACK                    |         
              | K - History Buffer Size    : 2000                     |         
              | L - Macros file            : .macros                  |         
              | M - Edit Macros                                       |         
              | N - Macros enabled         : Yes                      |         
              | O - Character conversion   :                          |         
              | P - Add linefeed           : No                       |         
              | Q - Local echo             : No                       |         
              | R - Line Wrap              : No                       |         
              | S - Hex Display            : No                       |         
              | T - Add carriage return    : No                       |         
              |  Change which setting?  (Esc to exit)                 |        
              +-------------------------------------------------------+

The 'A' setting you might want to change, shown is the built-in default.
'Esc' to exit.

Save setup as dfl
Select this one when ready to save the system wide defaults.

Save setup as

Code:

                   +-----------------------------------------+                  
                   |Give name to save this configuration?    |                  
                   |>                                        |                  
                   +-----------------------------------------+

This allows you to save the configuration that is set as a named file in your home directory.
Later, you can pass that name as the first argument to minicom when you start it.
Since in this example the defaults are now set to match this specific purpose, this feature is not needed here.

Exit
Meaning: Exit from the configuration menu into minicom screen.
To reach 'command mode' while in the terminal, enter the command key (default ctrl-a).
To get out of minicom from the terminal: ctrl-a x
Exit from Minicom
This one does what the label says.

You should not have to use 'sudo' to run and use minicom now.
(But you might, depends on your Linux distribution.)

The setup here is to match the current system device assignment (/dev/ttyUSB0).
Note that system device assignment in Linux is dynamic, if this setup stops working, the device setting is the first thing you should check.

While in the terminal mode, you can reach the command menu by using the ctrl-a z key combination.

Code:

     +-------------------------------------------------------------------+
     |                      Minicom Command Summary                      |
     |                                                                   |
     |              Commands can be called by CTRL-A <key>               |
     |                                                                   |
     |               Main Functions                  Other Functions     |
     |                                                                   |
     | Dialing directory..D  run script (Go)....G | Clear Screen.......C |
     | Send files.........S  Receive files......R | cOnfigure Minicom..O |
     | comm Parameters....P  Add linefeed.......A | Suspend minicom....J |
     | Capture on/off.....L  Hangup.............H | eXit and reset.....X |
     | send break.........F  initialize Modem...M | Quit with no reset.Q |
     | Terminal settings..T  run Kermit.........K | Cursor key mode....I |
     | lineWrap on/off....W  local Echo on/off..E | Help screen........Z |
     | Paste file.........Y  Timestamp toggle...N | scroll Back........B |
     | Add Carriage Ret...U                                              |
     |                                                                   |
     |             Select function or press Enter for none.              |
     +-------------------------------------------------------------------+

Pressing 'Enter' here returns you to terminal mode.
The two command combinations you will be most interested in while running minicom:

ctrl-L :: toggle capture on/off - the capture file name can be set from this menu.

Code:

                   +-----------------------------------------+            
                   |Capture to which file?                   |            
                   |> minicom.cap                            |            
                   +-----------------------------------------+

ctrl-Q :: Exit from minicom without sending anything to the Kindle's serial line.

Usage
Use the '-o' start-up option to prevent minicom from sending anything to the Kindle.
Using that option gives you some protection from stray changes in the minicom configuration.
Code:
```
knc1:~> minicom -o
Cannot create lockfile for /dev/ttyUSB0: Permission denied
```
That is the error message I am getting when trying to run minicom under my username.
It should not be happening, but I haven't figured out how to fix it (yet).

You should be able to run minicom using sudo without any harm to anything.
Code:
```
knc1:~> sudo minicom -o
```

knc1 · 08-12-2017, 11:29 AM

Another placeholder.
Perhaps put the PuTTy setup here.

knc1 · 08-13-2017, 11:41 AM

From u-boot version and build:

Code:

U-Boot 2009.08-lab126 (Jan 16 2017 - 03:45:24)

Code:

uboot > ?
?       - alias for 'help'
base    - print or set address offset
bist    - start Built In Self Test
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
go      - start application at address 'addr'
help    - print online help
idme    - idme    - Set nv ram variables

loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
setenv  - set environment variables
version - print monitor version

Code:

uboot > printenv
bootdelay=1
baudrate=115200
loadaddr=0x80800000
rd_loadaddr=(0x80800000 + 0x300000)
bootcmd=bootm 0x41000
failbootcmd=panic
loglevel=5
bootcmd_diags=bootm 0xE41000
bootcmd_factory=bist halt
bootcmd_fastboot=bist fastboot
stdin=serial
stdout=serial
stderr=serial
post_hotkeys=0
bootargs=

Environment size: 287/1020 bytes

Code:

uboot > bist
* * * snip * * *
bist > ?
?       - alias for 'help'
autoscr - DEPRECATED - use "source" command instead
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
check   - perform MMC CRC32 check
clk     - Clock sub system
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
diag    - perform board diagnostics
echo    - echo args to console
fastboot- Fastboot
fsr     - fsr  - FSR test commands

go      - start application at address 'addr'
hall    - hall    - hall test

halt    - halt board
haptic  - haptic  - HAPTIC test commands

help    - print online help
i2c     - I2C sub-system
idme    - idme    - Set nv ram variables

iminfo  - print header information for application image
imxotp  - One-Time Programable sub-system
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
loopw   - infinite write loop on address range
lpm     - Exercise Low Power modes in iMX6SL
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
panic   - panic halt
pmic    - pmic    - PMIC utility commands

printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
setenv  - set environment variables
sleep   - delay execution for some time
source  - run script from memory
sspi    - SPI utility commands
version - print monitor version
vni     - vni    - vni pmic test

vnimmc  - display MMC mfgid
wan4v2  - wan4v2    - WAN module 4V2 control

bist >

Code:

bist > printenv
baudrate=115200
loadaddr=0x80800000
rd_loadaddr=(0x80800000 + 0x300000)
testmem=mtest 0x80000000 0x803E0000 0 1 2; mtest 0x80500000 0x8FFFFFFF 0 1 2
bootcmd=bootm 0x41000
failbootcmd=panic
loglevel=5
bootcmd_diags=bootm 0xE41000
bootcmd_fastboot=fastboot
stdin=serial
stdout=serial
stderr=serial
post_hotkeys=0
bootdelay=-1

Environment size: 324/1020 bytes

knc1 · 08-14-2017, 08:36 AM

Perhaps network booting a Kindle here.

http://wiki.emacinc.com/wiki/Installing_TFTP_server
http://wiki.emacinc.com/wiki/Setting...FS_File_Server
http://wiki.emacinc.com/wiki/Booting...oot_Filesystem

http://wiki.emacinc.com/wiki/Loading...o_eMMC_Devices
https://en.wikipedia.org/wiki/MultiMediaCard

#14 4 4 4

knc1 · 08-14-2017, 08:38 AM

Don't worry, I'll think of a topic for this one also.
Serial ports on embedded devices are useful things.

knc1 · 08-14-2017, 08:38 AM

And maybe one more, before somebody breaks the flow by posting here.

08-14-2017, 08:36 AM	#5
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Perhaps network booting a Kindle here. http://wiki.emacinc.com/wiki/Installing_TFTP_server http://wiki.emacinc.com/wiki/Setting...FS_File_Server http://wiki.emacinc.com/wiki/Booting...oot_Filesystem http://wiki.emacinc.com/wiki/Loading...o_eMMC_Devices https://en.wikipedia.org/wiki/MultiMediaCard #14 4 4 4 Last edited by knc1; 08-14-2017 at 08:39 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Tools Serial Jailbreaking your fw >= 5.6.x Kindle for Dummies	grant2	Kindle Developer's Corner	563	12-13-2022 08:12 PM
So! Jailbreaking... what next?	zerodB	Kindle Developer's Corner	6	07-31-2016 10:10 AM
Jailbreaking and such	sam555	Kindle Developer's Corner	5	04-19-2016 08:33 PM
Will jailbreaking 5.6.1 ever be possible?	bonacker	Kindle Developer's Corner	2	12-20-2014 08:50 AM
Jailbreaking	jbcohen	Amazon Kindle	3	11-30-2010 09:25 AM

08-11-2017, 04:05 PM	#1
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Serial Jailbreaking FW >= 5.6.1.1 This post is not complete or ready to use! A note to anyone who might not do this all in one day: The battery charger is off while running "Diags" - after 4 days, I just got a 'Battery Critical' screen and it rebooted to 'main' to run the charger. Abstract This updated tutorial on serial jailbreaking illustrates the use of the newer Diag system menu. The procedure has been slightly simplified. Some of the materials have been repackaged and are used differently. tl;dr: The Cliff's Notes version log into diags (optional) run /mnt/us/mkbackup.sh run /mnt/us/unjail.sh reboot (wait) in main searchbar, enter: ;log mrpi (wait) your done - jail broken and everything you had in /my_packs is installed. Spoiler: Reference Materials This tutorial is based on the earlier tutorial: Serial Jailbreaking FW >= 5.6 for Dummys Includes the setting up of PuTTY under Windows and making the connection to the serial port. Also includes links to methods of connection other than the use of hot solder. Installation and setup of the MiniCom terminal emulator under Linux (also available for MacOSx and BSD). MinCom Setup Additional information may be found in the Master Index, see: Hardware Index You will need to use the above reference materials to create the serial port connection and get a serial port terminal emulator working. Collecting Required Materials* You will need some of the usual add-in packages, gathered from NiLuJe's snapshots thread: KindleTool Scroll through the package listings to near the bottom, pick the build that will run on your PC. MR Package Installer At the time of this writing it was in the: "KUAL and KUAL Extensions" section. KUAL The text of that post above the package listing tells you how to deal with the .xz compressed archives if you are using a Windows PC. If you have a Linux/BSD/MacOSx based PC of relatively recent vintage, the system provided archive handler should 'just work'. You will need the actual jail break (signature certificate) from Branch Delay's post and a package from coplate's snapshots thread: Unlike prior directions, we only need the actual certificate, which I have compressed and attached below as a single file zip archive. coplate's Master Survival Code This one does not require MrPI to install, it uses the UYK (Update Your Kindle) built-in function. Password Discovery* The next preparation step is to find out what the administrator's (root) password is when running the 'Diags' system. Unpack the KindleTool package for your system. If you put it in your current directory, you can check if it is working (and see its built-in help) by just entering: Code: knc1:PW3-Serial> ./kindletool That should have produced a long list of instructions and no error messages. Meaning you are ready to find the 'Diags' system password for root. You will need the serial number of your Kindle found: On the label of its box On its entry in your Amazon account "Manage Devices" web page In the "Device Info" panel of the Settings menu. From an entry in the 'Diags' system menu. (I know, we aren't that far along yet.) Note: The serial number is UPPER CASE letters and Numbers (only - not the dots that I have obscured my serial number with). Code: knc1:PW3-Serial> ./kindletool info G090G1..... Device uses the new device ID scheme Platform is Wario or newer Root PW fionaed4 Recovery PW fionaed48 The first password is for user: root in the 'Diags' system. That is all the need for KindleTool in this exercise, but hang on to it, you may need it in the future. Entering u-boot At this point, you need to have your Kindle talking to your PC over the serial port. Are you ready? This next step can pass you by in a hurry if not prepared. Serial port adapter is connected? Terminal emulator window open, window is selected? Finger is hovering near the 'enter' key of the keyboard? All yes? Continue: If the Kindle is off, turn it on by pressing the power button. If the Kindle is on, press and hold the power button until you get a pop-up panel. On that panel, touch: "Restart". Finger hovering over 'Enter' key, watch for: Code: U-Boot 2009.08-lab126 (Jan 16 2017 - 03:44:52) CPU: Freescale i.MX6 family TO0.0 at 996 MHz Temperature: 34 C, calibration data 0x59e5245f * * * lots more * * * Just as soon as you see that header, press and hold the 'Enter' key, until you see: Code: Hit any key to stop autoboot: 0 uboot > uboot > uboot > * * * However many times your keyboard repeated 'Enter' while you held it. * * * You can release the 'Enter' key now. That prompt is from u-boot, the system bootloader. u-boot is fussy, it will only talk to you over the serial port, which is why we hooked up the serial port. A question mark entered at the prompt will show a list of available commands. The menus for this version and build of u-boot are here: u-boot menus Safety Net Just in case a re-boot is required, or happens accidentally and we fail to catch the u-boot prompt: Code: u-boot >idme bootmode diag If things do get away from us, it will at least return to the diag system, not the main system. Booting the Alternate System The Kindles (since the K4) are dual boot systems. The 'Main' system (which is what you normally see) starts in memory at address: 0x041000 The 'Diag' system (which is what we want now) starts in memory at address: 0xE41000 And if those values ever change, you could persuade u-boot into telling you what they are at this point. Boot up the alternate ('Diag') system from its memory location: Code: uboot > bootm 0xE41000 ## Booting kernel from Legacy Image at 80800000 ... Image Name: Linux-3.0.35-lab126 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2634732 Bytes = 2.5 MB Load Address: 80008000 Entry Point: 80008000 Verifying Checksum ... OK Loading Kernel Image ... OK OK Starting kernel ... * * * a whole lot of stuff output * * * system: I mntroot:def:Making root filesystem writable [ 9.981878] EXT3-fs (mmcblk0p2): using internal journal [ 10.368287] g_ether gadget: high speed config #1: CDC Ethernet (ECM) [ 10.591710] KERNEL: I pmic:charger chgina::charger disconnected sock_init 1888 diag> Note: You might have to press 'Enter' (once this time) to get the system to show its prompt (its a Unix thing). The Diag Menus This 'Diag' system is menu driven. The menu can be operated from the touch screen or from the serial port. What has happened in the prior section, is that when u-boot gave up control to the Linux kernel, it also handed over the serial port, which Linux is now using as the "Operator's Console Port". Another (mainframe) Unix thing. We only need the top level of the menu system, entering: ? will list the choices: Code: diag>? get_input_from_stdin Received [?] diag> MUSCAT_WFO - System Diags - 94 ~~~~ 1.1.30.291999 ~~~~ pcbId:0670309164410CQB (DS INFO)-Device Setting (TOUCH PLATE)-Touch Plate Test (OTS)-Operator test suite (o)-Misc individual diagnostics (WIFI NART)-nART factory test (USB EXPORT)-USB device mode (o)-Reboot or Disable Diags (POWER SUSPEND)-Lock screen (X)-Exit Accessing USB Storage Export the USB storage over the USB cable to your PC (similar to normal operation). Put a known good USB cable between the Kindle and your PC and then enter: Code: diag>usb export get_input_from_stdin Received [USB EXPORT] * * * snip * * * USB device exported Once you are done Eject the USB device from the PC then Battery capacity 94 (C)-to continue (X)-Exit That 'exported' message will repeat at regular intervals. Populating USB Storage Most of this section's context is in the pictures. At the top of visible USB storage, make two new directories (folders): The directory added with the name of: "unjail" will be where we organize the files to be used. The directory added with the name of: "update.bin.partial.tmp" should block any new update downloads. Add the new "Master HotFix" to the topmost level: This will not have any effect until we re-boot the device into the 'Main" operating system. Populate the Kindle:/unjail directory. I have added the KUAL and MrPI archives from NiLuJe's snapshots thread. I have unarchived them into corresponding folders. The highlighted packages are not required to be installed at this time, but they are recommended. The actual jail-breaking script was still a WIP when this screenshot was taken. Install MrPI Enter the MrPI sub-directory and select the two directories contained there: Copy them and paste them in the top level of visible USB storage: Which makes the top level now contain copies of those two directories (folders). Populate USB with KUAL The next step has two, alternative, procedures. Read carefully, you should only follow the pair with applies to your model of Kindle. For 8th. generation devices (KT3 and KOA): The 8th. generation devices must use the booklet form of KUAL, which has to be installed by MrPI. From: To: For all older models: All earlier Kindle models may still use the document form of KUAL. From: To: Place KUAL's configuration file. Both the booklet and the document form of KUAL use the same configuration file. From: To: A work in progress Last edited by knc1; 08-17-2017 at 09:36 AM. Reason: to be continued

08-12-2017, 11:29 AM	#3
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Another placeholder. Perhaps put the PuTTy setup here. Last edited by knc1; 08-13-2017 at 11:41 AM.

08-14-2017, 08:38 AM	#6
knc1 Going Viral Posts: 17,212 Karma: 18210809 Join Date: Feb 2012 Location: Central Texas Device: No K1, PW2, KV, KOA	Don't worry, I'll think of a topic for this one also. Serial ports on embedded devices are useful things.

Advert

Advert