Tools Serial Jailbreaking your fw >= 5.6.x Kindle for Dummies

[Bergfux]

Originally Posted by grant3

Take & post a screenshot of your PuTTy window after you have typed "bootm 0xE41000" but before you press "enter"

This should show what kindle was sending over the serial part before you interrupted it

The smart people here might be able to figure out what it means.

Ok here's a screenshot before and after I pressed the enter key.
I hope this will help to solve the problem.

[knc1]

It looks to me that your installed copy of u-boot is corrupt.

What all have you done to this device?
Ah, because u-boot is stored in a hardware write protected area of the eMMC.

[Night Rider]

Originally Posted by Bergfux

Ok here's a screenshot before and after I pressed the enter key.
I hope this will help to solve the problem.

https://www.mobileread.com/forums/at...7&d=1529368474


Same problem here!

Kindle 8th Gen KT3 (G000 K905) with Firmware 5.9.5.
1https://www.mobileread.com/forums/attachment.php?attachmentid=164548&d=1529369084
https://www.mobileread.com/forums/at...7&d=1529368474

[knc1]

Originally Posted by Night Rider

https://www.mobileread.com/forums/at...7&d=1529368474


Same problem here!

Kindle 8th Gen KT3 (G000 K905) with Firmware 5.9.5.
1https://www.mobileread.com/forums/attachment.php?attachmentid=164548&d=1529369084
https://www.mobileread.com/forums/at...7&d=1529368474

Really?
You where able to duplicate the problem, even the time stamp down to the exact same second?

I think all you duplicated was the image that was posted.

[Bergfux]

Originally Posted by knc1

It looks to me that your installed copy of u-boot is corrupt.

What all have you done to this device?
Ah, because u-boot is stored in a hardware write protected area of the eMMC.

When I bought this device it was brand-new.
I just opened it to make the serial connection.
I didn‘t do any hackery stuff on the device before.
Is there maybe a jailbreak protection on newer devices?
I bought it in april this year.

[coplate]

Originally Posted by Bergfux

When I bought this device it was brand-new.
I just opened it to make the serial connection.
I didn‘t do any hackery stuff on the device before.
Is there maybe a jailbreak protection on newer devices?
I bought it in april this year.

I wonder if they removed the diags partition from the KT3 at the same time they added ADB mode?

Edit - nope. but here is the thread the guy reported ADB mode for the KT3, https://www.mobileread.com/forums/sh...8&postcount=74

He says in his posts that he used Diags mode to get to that.

Re-reading in post 79, it looks like he booted to normal mode first, and then touched a certain file, that made diags fall back to ADB?

This is jus a quick read back of that though.

[NiLuJe]

He still had a diags part, I ended up updating the rescue pack to handle it . But yeah, once in, it's significantly different than what we're used to. (and, yeah, adb instead of usbnet).

[knc1]

Originally Posted by Bergfux

When I bought this device it was brand-new.
I just opened it to make the serial connection.
I didn‘t do any hackery stuff on the device before.
Is there maybe a jailbreak protection on newer devices?
I bought it in april this year.

Describe two things:
1) What key did you hold down while waiting for the "press any key" message?
2) The 1.8volt low-voltage serial to USB converter you used and how you hooked it up.
pictures and reference links please.

- - - - -

Neither of these messages are expected.
(And the first one may mean exactly what it says. Answer the two questions above and we can continue from there.)

[Bergfux]

Originally Posted by knc1

Describe two things:
1) What key did you hold down while waiting for the "press any key" message?
2) The 1.8volt low-voltage serial to USB converter you used and how you hooked it up.
pictures and reference links please.

- - - - -

Neither of these messages are expected.
(And the first one may mean exactly what it says. Answer the two questions above and we can continue from there.)

1) To interrupt the boot sequence only the "enter" key works. Any other key won't interrupt it.
2)The serial to USB converter I use is this one https://www.ebay.de/itm/Mini-FTDI-Ad...0AAOSwnHZYU5l1

I've found something interesting on this website:
http://www.xodustech.com/guides/kind...te-demo-unlock

This tutorial shows how to find out the hexa value (0xE41000) for booting into diagsnostic mode.
instead of the entry "bootcmd=bootm 0xE41000" I have the entry "bootcmd=mmc dev ${mmcdev};if mmc rescan; then run testboot; fi;"

Could there be the problem?

[coplate]

Originally Posted by Bergfux

1) To interrupt the boot sequence only the "enter" key works. Any other key won't interrupt it.
2)The serial to USB converter I use is this one https://www.ebay.de/itm/Mini-FTDI-Ad...0AAOSwnHZYU5l1

I've found something interesting on this website:
http://www.xodustech.com/guides/kind...te-demo-unlock

This tutorial shows how to find out the hexa value (0xE41000) for booting into diagsnostic mode.
instead of the entry "bootcmd=bootm 0xE41000" I have the entry "bootcmd=mmc dev ${mmcdev};if mmc rescan; then run testboot; fi;"

Could there be the problem?

this is really great research, they have started changing things on that device considerably.

Can you try running that command 'diags_boot', or running all those command in order, but also run the 'env' command betweejn the steps, to see if anyhting changes.

you see it runs severla commands before it runs 'bootm $loadaddr - $fdt_addr', lt looks like somewhere in those commands it will set the real value that you need to use, and after that 'rum mmcargs_diags' command, "$loadaddr - $fdt_addr" will be the replacement for 0xe41000 on that sprcific device.

[knc1]

The adapter you linked to is for 3.3 volt or 5.0 volt low-voltage interface, the Kindle is 1.8 volt.

Recheck all of your connections, because the interface is picking up those long strings from somewhere if you are not the person typing them.

run the command:
env
capture and post the result.

(I am sticking with my first reply, your u-boot installation is corrupt or incomplete. I.E: The first error message is correct.)

[Bergfux]

Originally Posted by coplate

this is really great research, they have started changing things on that device considerably.

Can you try running that command 'diags_boot', or running all those command in order, but also run the 'env' command betweejn the steps, to see if anyhting changes.

you see it runs severla commands before it runs 'bootm $loadaddr - $fdt_addr', lt looks like somewhere in those commands it will set the real value that you need to use, and after that 'rum mmcargs_diags' command, "$loadaddr - $fdt_addr" will be the replacement for 0xe41000 on that sprcific device.

Hey Guys I have news for you!

I was able to get into diagnostic mode by entering the command:" run diags_boot" in uboot.
The diagnostic mode menu looks different than the menu in this tutorial.
It has a graphical interface and touch is also working. (Maybe a android based subsystem??)
On the "Diagsnostic Mode screen" I enabled the developer mode by click 5 times.
Now on this screen I have several options.
When I select the entry "Reboot or disable Diags" there isn't the option "Exit to login promt" or anything similar to get to the kindle login.
Is there an other way to jailbreak my device, like maybe by the fastboot, USB Download or ADB option? (see in the pictures)

[NiLuJe]

@Bergfux: Yeah, according to what we've been told, either you can connect over ADB straight away, or there's an option in one of the menus that allows you to.

Then you can adb shell and do stuff as usual.

EDIT: Well, it's even in one of your pictures (thanks!): USB Device Mode > ADB .

[Bergfux]

Originally Posted by NiLuJe

@Bergfux: Yeah, according to what we've been told, either you can connect over ADB straight away, or there's an option in one of the menus that allows you to.

Then you can adb shell and do stuff as usual.

EDIT: Well, it's even in one of your pictures (thanks!): USB Device Mode > ADB .

Ok fine

Do you know a tutorial to do this with adb shell?
I‘m not very familiar with this .. 😬

[NiLuJe]

Not really, especially if you're on a platform where there might be some extra USB magic needed (because over here, it's as simple as literally typing "adb shell", and there you go, remote shell ^^).

I imagine XDA probably has something relevant, since ADB is part of the Android SDK (specifically, in the module called "platform tools").