Register Guidelines E-Books Search Today's Posts Mark Forums Read

Go Back   MobileRead Forums > E-Book Readers > Amazon Kindle > Kindle Developer's Corner

Notices

Reply
 
Thread Tools Search this Thread
Old 02-27-2023, 06:41 AM   #1
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Lightbulb Potential New Exploit For Jailbreaking?

I tried to post this before but it was deleted or something, I'm not sure why? Perhaps this was misunderstood, this isn't a Jailbreak or anything that allows Piracy, it is merely a potential entrypoint which I found on the Kindle Store.

I have discovered how to modify the Kindle Store displayed on the Kindle, this means that I can inject custom HTML+JS.
You may wonder: So what? It's just a website

Well, being the Kindle Store, this actually contains many... many functions which can be used to manipulate the Kindle which are NOT available in the experimental browser.

For example, via the store, I was able to launch apps and communicate with LIPC messages to an extent, I believe that this could be the gateway to a new jailbreak

The reason I'm posting this here is because I don't really know where to go from here lol, I'm relatively new to the jailbreaking scene for Kindles and I was wondering if anyone would like to help me with this project?

See attachments for info, the applicaiton error one was an earlier version, I can now properly launch other applications
Attached Thumbnails
Click image for larger version

Name:	Early prototype.png
Views:	696
Size:	34.6 KB
ID:	199985   Click image for larger version

Name:	KChess in Store.png
Views:	642
Size:	17.4 KB
ID:	199987   Click image for larger version

Name:	Working test.png
Views:	602
Size:	25.8 KB
ID:	199988  
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 07:14 AM   #2
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
I wonder if I can somehow execute code through a WAF...
Bluebotlabs is offline   Reply With Quote
Advert
Old 02-27-2023, 07:26 AM   #3
Kusuri
Connoisseur
Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.Kusuri ought to be getting tired of karma fortunes by now.
 
Posts: 99
Karma: 909418
Join Date: Aug 2021
Location: Germany
Device: PW4+Fire 7", Onyx Boox Nova Air
how did you do it? a Man-In-The-Middle Attack by hijacking your wifi AP? hosts file? or what exactly did you do?

the question would be if the Kindle Store App / Tab has system rights or access to directorys you would need. i know / heard that a jailbreak adds developer keys to a specific file so it opens up the kindle for thirdparty code.. but since i don't know how exactly this is done someone else would have to look into this.

but the thing is - if you can just run javascript, the question is if its just in the context of a normal browser or if it is having "special" access to commands. can you give us more informations about how you did it, what you did etc?
Kusuri is offline   Reply With Quote
Old 02-27-2023, 08:10 AM   #4
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Quote:
Originally Posted by Kusuri View Post
how did you do it? a Man-In-The-Middle Attack by hijacking your wifi AP? hosts file? or what exactly did you do?

the question would be if the Kindle Store App / Tab has system rights or access to directorys you would need. i know / heard that a jailbreak adds developer keys to a specific file so it opens up the kindle for thirdparty code.. but since i don't know how exactly this is done someone else would have to look into this.

but the thing is - if you can just run javascript, the question is if its just in the context of a normal browser or if it is having "special" access to commands. can you give us more informations about how you did it, what you did etc?
How I did it - I am keeping this private at the moment until I fine-tune it a bit more, but it is pretty unreliable at the moment and needs a bunch of network tweaks xD

Javascript - Yep, the store runs in a special context in which certain Javascript functions normally nonexistent can be used

So far I can:
- Launch apps
- Change screen orientation

Untested, but in theory I can also:
- Communicate with LIBC protocol to send messages to other processes

Last edited by Bluebotlabs; 02-28-2023 at 12:55 PM.
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 08:13 AM   #5
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
also, this is all done on a non-jailbroken device since I am on latest firmware lol
Bluebotlabs is offline   Reply With Quote
Advert
Old 02-27-2023, 08:35 AM   #6
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Thumbs up Update: More JS Investigation

List of things I can access, still discovering what most of these are:

- version (returns 1)
- download
- dev (Device-Specific stuff such as "refresheyness" of the e-ink display
- popup
- bkgrnd
- device
- winmgrUtils
- bluetooth (Query and adjust Bluetooth settings)
- chrome (Browser specific stuff, weird that it's named chrome)
- dconfig
- nat (Query and adjust network settings)
- appmgr (Direct access to the appmgr, currently known: start(), back())
- todo (Does anyone know what this is?)
- gestures
- messaging (libc access)
- uitest
- localprefs
- storeName

I'm currently working on some JS code to properly+recursively dump more information
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 09:23 AM   #7
Quoth
the rook, bossing Never.
Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.Quoth ought to be getting tired of karma fortunes by now.
 
Quoth's Avatar
 
Posts: 12,276
Karma: 89531599
Join Date: Jun 2017
Location: Ireland
Device: All 4 Kinds: epub eink, Kindle, android eink, NxtPaper11
Doesn't the Kindle Suduko also use fact that the Web browser has stuff in it so the Amazon Kindle Store works "better"?
Quoth is offline   Reply With Quote
Old 02-27-2023, 09:30 AM   #8
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Interestingly, unless I include a large portion of the original code, the Kindle complains that the store failed to load, so it probably relies on a JS function call of sorts, I'll investigate this further but the code is heavily obfuscated so it's a pain to go through
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 09:35 AM   #9
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Quote:
Originally Posted by Quoth View Post
Doesn't the Kindle Suduko also use fact that the Web browser has stuff in it so the Amazon Kindle Store works "better"?
No, the web browser itself doesn't have anything in it apart from some Kindle patches

This is specific to the store and potentially other build-in Web Applications (WAFs)
The browser normally doesn't have these JavaScript functions available to it
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 12:08 PM   #10
luketheduke
Connoisseur
luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.
 
luketheduke's Avatar
 
Posts: 86
Karma: 25554
Join Date: Sep 2022
Device: PW3, PW2, KT2, 2xKT, 2xK3G
Quote:
Originally Posted by Kusuri View Post
how did you do it? a Man-In-The-Middle Attack by hijacking your wifi AP? hosts file? or what exactly did you do?
IIRC, you can modify the `store.html` file (is that what its called?) located in `/mnt/us/` somewhere.

MITM would probably not work due to the kindle using HTTPS.

Last edited by luketheduke; 02-27-2023 at 12:20 PM.
luketheduke is offline   Reply With Quote
Old 02-27-2023, 12:10 PM   #11
luketheduke
Connoisseur
luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.luketheduke knows what's going on.
 
luketheduke's Avatar
 
Posts: 86
Karma: 25554
Join Date: Sep 2022
Device: PW3, PW2, KT2, 2xKT, 2xK3G
Quote:
Originally Posted by Bluebotlabs View Post
I wonder if I can somehow execute code through a WAF...
Used to be able to with `nativeBridge.dbgCmd`. Removed awhile ago, though.
luketheduke is offline   Reply With Quote
Old 02-27-2023, 12:20 PM   #12
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Quote:
Originally Posted by luketheduke View Post
IIRC, you can modify the `store.html` file (is that what its called?) located in `/mnt/us/` somewhere.

I can't say, but you're a little far off...
don't forget, I had to do a bunch of networking stuff too, but it isn't ARP spoofing

Last edited by Bluebotlabs; 02-28-2023 at 01:01 PM.
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 12:21 PM   #13
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Quote:
Originally Posted by luketheduke View Post
Used to be able to with `nativeBridge.dbgCmd`. Removed awhile ago, though.
Is there any sort of WAF documentation anywhere?
Bluebotlabs is offline   Reply With Quote
Old 02-27-2023, 12:40 PM   #14
JSWolf
Resident Curmudgeon
JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.JSWolf ought to be getting tired of karma fortunes by now.
 
JSWolf's Avatar
 
Posts: 76,055
Karma: 134368292
Join Date: Nov 2006
Location: Roslindale, Massachusetts
Device: Kobo Libra 2, Kobo Aura H2O, PRS-650, PRS-T1, nook STR, PW3
Quote:
Originally Posted by Bluebotlabs View Post
List of things I can access, still discovering what most of these are:

- version (returns 1)
- download
- dev (Device-Specific stuff such as "refresheyness" of the e-ink display
- popup
- bkgrnd
- device
- winmgrUtils
- bluetooth (Query and adjust Bluetooth settings)
- chrome (Browser specific stuff, weird that it's named chrome)
- dconfig
- nat (Query and adjust network settings)
- appmgr (Direct access to the appmgr, currently known: start(), back())
- todo (Does anyone know what this is?)
- gestures
- messaging (libc access)
- uitest
- localprefs
- storeName

I'm currently working on some JS code to properly+recursively dump more information
Could you modify things so downloads from Amazon only arrive in single file KF8 and not KFX?
JSWolf is offline   Reply With Quote
Old 02-27-2023, 12:45 PM   #15
Bluebotlabs
Connoisseur
Bluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheeseBluebotlabs can extract oil from cheese
 
Bluebotlabs's Avatar
 
Posts: 83
Karma: 1170
Join Date: Sep 2022
Location: Why do you want to know?
Device: Bricked PW5
Quote:
Originally Posted by JSWolf View Post
Could you modify things so downloads from Amazon only arrive in single file KF8 and not KFX?
no, that's not really how it works
Bluebotlabs is offline   Reply With Quote
Reply

Tags
exploit, jailbreak

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Local root exploit in Calibre splat Calibre 29 11-05-2011 10:03 PM
Adobe Reader 9 new exploit in the wild doctorow News 2 02-20-2009 03:38 PM
iLiad Huge exploit found in 2.7 arivero iRex Developer's Corner 86 11-26-2006 04:49 PM
Adobe Acrobat subject to remote exploit Alexander Turcic News 3 09-16-2006 05:29 AM
Serious exploit in Greasemonkey 0.4 Alexander Turcic Lounge 2 07-19-2005 04:59 AM


All times are GMT -4. The time now is 10:26 PM.


MobileRead.com is a privately owned, operated and funded community.