Tutorial Popcorn - Hardware Jailbreak for KV, KT2, PW2 and PW3 (no serial port, no soldering)

[beyonik]

Originally Posted by 4649ceynou

Unfortunately it didn't work on my PW4 (G000 PP13 0191 00JT)
Just to make sure I didn't do it the wrong way, after a reset the kindle was not registered, there was no book and then I tried the hotfix first with UYK and it failed, same for the kual hotfix.
;log mrpi exists if that means anything

To restore UYK functionality on >= 5.15.1.1 you have to run the modified popcorn payload as that drops the modified keystore file, but if you have mrpi already then you can just install KUAL by using MRPI.

PW4 should be supported by the patched hotfixes I posted, so if you ran the modified popcorn payload and then used those then it should be all good.

[4649ceynou]

Originally Posted by beyonik

To restore UYK functionality on >= 5.15.1.1 you have to run the modified popcorn payload as that drops the modified keystore file, but if you have mrpi already then you can just install KUAL by using MRPI.

PW4 should be supported by the patched hotfixes I posted, so if you ran the modified popcorn payload and then used those then it should be all good.

Nevermind sorry, I didn't read the title of the thread, clicked on a link mentioning 5.15.1.1 and immediately posted here after trying to install the hotfixes you made, didn't know about hardware jailbreak.

That said, mrpi does seem to function but I get no kual document after, installing python does generate the python folders in the root directory, so maybe I need to wait for a coplate update?

[4649ceynou]

Originally Posted by 4649ceynou

Nevermind sorry, I didn't read the title of the thread, clicked on a link mentioning 5.15.1.1 and immediately posted here after trying to install the hotfixes you made, didn't know about hardware jailbreak.

That said, mrpi does seem to function but I get no kual document after, installing python does generate the python folders in the root directory, so maybe I need to wait for a coplate update?

Nvm again, I don't understand much but after lurking a bit more the forums I saw that you could apply the hotfixes(yours) and install kual with mrpi, now it's working I got the kual document, again thank you.

[ye379]

woohoo! confirmed working on my PW3. since i couldn't get my virtualbox workingby recognising the kindle on my mac, i switched over to a windows pc and used @ygjsz's MFGTool.exe.

To use @beyonik's updates, i renamed/moved his/her's uImage-popcorn-wario file into the MFGTool's Profiles/Linux/OS\ Firmware/kernel.bin.

After jailbreak, just do the usual copying the update_jb_hotfix.bin onto the mounted Kindle drive and do a update-your-kindle. after reboot, do the same with the update_kual_hotfix.bin and then you're basically done!

thanks everyone! i now have a jailbroken 5.15.1.1 (note the extra .1) 7th gen paperwhite!

[invernomuto]

Originally Posted by beyonik

To restore UYK functionality on >= 5.15.1.1 you have to run the modified popcorn payload as that drops the modified keystore file, but if you have mrpi already then you can just install KUAL by using MRPI.

PW4 should be supported by the patched hotfixes I posted, so if you ran the modified popcorn payload and then used those then it should be all good.

Hi Beyonic! thanks for your work!
I tried on my device: PaperWhite 5 (2021) (Unknown Variant 1PX) (1PX -> 0x6FF), but it seems that it is still not supported.

[2023-04-27 @ 13:44:44 +0159] :: [MRPI r18983] - Beginning the processing of package 'update_jb_hotfix.bin' (jb hotfix) . . .

Package 'update_jb_hotfix.bin' (jb hotfix) is not targeting your device [6FF vs. 11

thanks again for your effort

[beyonik]

Originally Posted by invernomuto

Hi Beyonic! thanks for your work!
I tried on my device: PaperWhite 5 (2021) (Unknown Variant 1PX) (1PX -> 0x6FF), but it seems that it is still not supported.

[2023-04-27 @ 13:44:44 +0159] :: [MRPI r18983] - Beginning the processing of package 'update_jb_hotfix.bin' (jb hotfix) . . .

Package 'update_jb_hotfix.bin' (jb hotfix) is not targeting your device [6FF vs. 11

thanks again for your effort

Hello!

This won't work for your device sadly, afaik popcorn doesn't support PW5 for multiple reasons (one of them being that the platform PW5 runs on is Bellatrix, and popcorn supports Wario / Heisenberg), so the modified files I gave have no use for you at this time.

Unless you find a way to run a kernel payload and replace the squashfs keystore, this won't be of any help to you as you won't be able to install images signed with the developer certificate (such as the jailbreak / KUAL hotfixes) even if the images supported your device.

[cbergmann]

Originally Posted by ye379

woohoo! confirmed working on my PW3. since i couldn't get my virtualbox workingby recognising the kindle on my mac, i switched over to a windows pc and used @ygjsz's MFGTool.exe.

To use @beyonik's updates, i renamed/moved his/her's uImage-popcorn-wario file into the MFGTool's Profiles/Linux/OS\ Firmware/kernel.bin.

After jailbreak, just do the usual copying the update_jb_hotfix.bin onto the mounted Kindle drive and do a update-your-kindle. after reboot, do the same with the update_kual_hotfix.bin and then you're basically done!

thanks everyone! i now have a jailbroken 5.15.1.1 (note the extra .1) 7th gen paperwhite!

Hi I got JB on my KT3 when it was on 5.15.1. That worked under windows with @ygjsz's MFGTool.exe and shorting the pins on the back and rebooting.

Unfortunately keeping the device in airplane mode is not an option as its main purpose is to show a home assistant status page with onlinescreensaver. Therefore the device updated to 5.15.1.1 yesterday. I now blocked the device in my firewall and only let it access the needed internal server for downloading the png file.

I Think that I now have to reapply the JB from scratch. After factory reset I can short the relevant pins to get it to boot and get it recognized by MFGTool from #60. When hitting start there I can then see the popcorn seemingly beeing applied successfully. After reboot the device is recognized as USB drive and I put the update_jb_hotfix.bin file from Post #73 onto the device. After ejecting and removing the cable the update is not immediately rejected and deleted so I can hit UYK. Unfortunately the update fails with a error and instructs me to restart by pushing the button. I suspect that I have to use the uImage-popcorn-wario file from #72 but this is for wario and my KT3 is a heisenberg.

Is there are new Variant of the uImage for the heisenberg platform that I just missed or can I somehow help on creating one?

Kind regards
Clemens

[beyonik]

Originally Posted by cbergmann

Hi I got JB on my KT3 when it was on 5.15.1. That worked under windows with @ygjsz's MFGTool.exe and shorting the pins on the back and rebooting.

Unfortunately keeping the device in airplane mode is not an option as its main purpose is to show a home assistant status page with onlinescreensaver. Therefore the device updated to 5.15.1.1 yesterday. I now blocked the device in my firewall and only let it access the needed internal server for downloading the png file.

I Think that I now have to reapply the JB from scratch. After factory reset I can short the relevant pins to get it to boot and get it recognized by MFGTool from #60. When hitting start there I can then see the popcorn seemingly beeing applied successfully. After reboot the device is recognized as USB drive and I put the update_jb_hotfix.bin file from Post #73 onto the device. After ejecting and removing the cable the update is not immediately rejected and deleted so I can hit UYK. Unfortunately the update fails with a error and instructs me to restart by pushing the button. I suspect that I have to use the uImage-popcorn-wario file from #72 but this is for wario and my KT3 is a heisenberg.

Is there are new Variant of the uImage for the heisenberg platform that I just missed or can I somehow help on creating one?

Kind regards
Clemens

Hi!

You are indeed correct, the patched hotfix files alone are not enough and you will also need to use a modified payload to replace the keystore first. I only made a wario version as I only own a PW3, but I'm pretty confident I could get it working on heisenberg with little change. Unfortunately, I will only be able to get around to doing this in a couple days, after which I will update this post.

[cbergmann]

thank you so much. I am not in a hurry. This project sat in my drawer for months so I could surely wait some more days. I also have to configure the dashboard to be displayed so I am not stuck at all.
Don't hesitate to reach out if you need something to help you with this.

Kind regards
Clemens

[chaud227]

Sorry if it's been covered in this post, I'm getting bits and pieces but not the full picture. I have a Kindle PW3 that has been jailbroken for a couple of years via a serial tutorial I followed on here, the device is currently on 5.12.2. I'm wanting to update to the latest version for epub support (I have korreader but it'd still be nice). What would the update process look like for me? I see the couple of hotfixes you shared but I'm not quite sure what to do with them to be able to update safely and if there's anything else I'd need to do.

[j.p.s]

Originally Posted by chaud227

Sorry if it's been covered in this post, I'm getting bits and pieces but not the full picture. I have a Kindle PW3 that has been jailbroken for a couple of years via a serial tutorial I followed on here, the device is currently on 5.12.2. I'm wanting to update to the latest version for epub support (I have korreader but it'd still be nice). What would the update process look like for me? I see the couple of hotfixes you shared but I'm not quite sure what to do with them to be able to update safely and if there's anything else I'd need to do.

Kindle firmware does not support EPUB.

amazon will convert EPUB files sent to amazon by various means to a format supported by kindles and make that converted file available for download.

[Tokarak]

Something which tripped me up is that if you have `./imx_usb_loader/wario` in your `.` working directory, then you must call the `imx_usb` command from the same `.` working directory. This is because the config file in `./imx_usb_loader/wario` is relative to `.`.

[Pedja]

Hi everyone!
A Kindle PW4 updated to the last version (5.16.2.1) got to my hands and I was wondering if this method would work with it and if so could someone point me to which points do I have to bridge on the PW4 motherboard?

Thanks!

[nicnic2001]

I get SE Blank showing up but then when running imx_usb it just does nothing. dmesg says usb disconnect, the screen flashes on Kindle and thats it. Why wouldn't it be booting to where it shows the serial number on dmesg etc. I wanted to use fastboot-kindle.

Any help appreciated.

[sonnius]

Originally Posted by beyonik

Hi!

You are indeed correct, the patched hotfix files alone are not enough and you will also need to use a modified payload to replace the keystore first. I only made a wario version as I only own a PW3, but I'm pretty confident I could get it working on heisenberg with little change. Unfortunately, I will only be able to get around to doing this in a couple days, after which I will update this post.

@beyonik,

I've tried to unpack the heisenberg payload and adding the uks.sqsh image, unfortunately I was not able to re-pack it succesfully, did you manage to create an updated payload for KT3/heisenberg devices on 5.1.15.1.1?

Thanks!