USBnetwork & Paperwhite (Mac OS X)

[jforner]

Hey all,

So I desperately needed help figuring out how to gain root access on my Paperwhite to replace some screensavers. I asked a lot of people, but they seemed to direct me back to the readme files which were -- in honesty -- confusing. So, I decided just to go ahead and try it my own way. Luckily, it all worked out. For those confused by the whole process, hopefully this helps you. I was using a Mac, and a Paperwhite on 5.3.1 firmware.

Spoiler:

1. First, you'll need to jailbreak your Paperwhite. You can grab the jailbreak, and the instructions for it, right here. Follow it through.

2. Next we have to install USBnetwork. Get it here. Plug your Kindle into your Mac, and drag and drop "update_usbnet_0.6.N_install.bin" to the root directory. Now on your Kindle go to [Menu] -> Settings -> [Menu] -> Update Your Kindle. Once done, eject and unplug your Paperwhite.

3. Now we need to test if it's installed correctly. On your Paperwhite, tap the search icon at the top. Type in ";un" without the quotations. It'll go back to the home screen thereafter. Now plug your Kindle into your Mac. If it doesn't show up as a device like it normally does, it's worked!

4. What it is now is a network device of sorts. Head to System Preferences, and you should see it listed as a RNDIS/Ethernet Gadget. Now, on this click on advanced > Configure IPv4 > Manually. In "IPv4 Address", use: 192.168.15.1. Leave everything else as it is. Click ok, and then apply.

5. Now we should make sure your Mac can "see" your Kindle. I advise at this point to turn off the Kindle's WiFi. Go to Terminal, and type ping 192.168.15.244. If you start seeing numbers with ms after them, it's all good. Nearly there. Close Terminal.

6. Now it's finally time to gain root access. For this, you'll need an FTP client. Transmit is a good one, and it has a free trial. Grab it here. Once opened, click SFTP at the top. Now the following: Server = 192.168.15.244 Username = root Password = *leave blank* Initial Path = /

7. Click connect, and you should be in!

[knc1]

Or -
Leave the terminal open and use ssh to have a shell on the kindle.

The ssh client is pre-installed in your Mac if running OSx.

In a terminal:
man ssh

will open the manual.

[rabscallion]

Hello,

I wonder if you can help. I've installed the jailbreak - which is fine and the USB network 0.7 version, which also seems fine.

From here i'm stuck . Following the instructions, basically when I re-connect the Kindle it still shows up as a normal device- therefore preventing me accessing via system preferences or 'transmit.'

Any help gratefully appreciated

[twobob]

you dont say WHAT device you have,

"Kindle" is not enough info...

I'm just gonna guess at PW and say type ;un into the search bar on your home screen and try again...

its in the README I believe

[rabscallion]

Hi Two Bob,

Sorry, it is a PW. I've tried the 'un' thing, I did follow the description from jforner and his PW as above. i've got the same problem - Waterstones screen saver when I'd rather have other's like my on my old JB Kindle.

I was hoping they might have an idea or two on what I could try. I can follow the instructions, I think but don't have the tech knowledge to troubleshoot it. I get to 3 and it basically fails the has it installed correctly. I don't suppose it's the 0.7 version rather than the described 0.6 affecting the 5.3.1 PW Kindle?

The root directory now contains the linkss, python and usbnet folders, but otherwise all seems as before.

Thanks for replying though. I'll keep trying.

[twobob]

indeed. My point was simply that it needs "turning on" to do anything.

that is the command on a PW

;un

hope that helps

The semicolon is not an accident btw - it is part of the command.

[rabscallion]

OK,.... I did wink when I said I can follow instructions. I thought the colon was a spacer thing. Got it now! I'll keep going - Thanks a lot - that's good of you to take the time.

Fantastic work/info by everyone - made my day to sort this. Thanks jforner and Twobob.

[RadicalxEdward]

Super straight forward and worked great for me. Not sure why the server is 192.168.15.244 if the kindle is supposed to be 192.168.15.1 but it works. Thank you very much.

[knc1]

Originally Posted by RadicalxEdward

Super straight forward and worked great for me. Not sure why the server is 192.168.15.244 if the kindle is supposed to be 192.168.15.1 but it works. Thank you very much.

The connection has two ends and two IP addresses, one for each end.

Just look at a (working) USB cable - see, two connectors - how could a machine tell them apart if both ends had the same number?
Really.
Not a joke.

[Analogus]

I have:
Voyage FW 5.8.7


With this tutorial I got READING-access for the file system. I use a MAC, Transmit as client and Telnet.

I wanted to edit some file in opt/amazon/ebook/...
I struggled with write-access until I figured out to use Telnet:

I startet Telnet in a Terminal-window 'telnet 192.168.15.244'.
Then read the info comming at the beginning:
'Rootfs is mounted read-only. Invoke mntroot rw...'
Ok, typing in the terminal 'mntroot rw' solved the problem! Hurra - writing-access. Problem solved.

Until now... I want to edit this path:
/urs/java/lib/fonts/...
Doing the Voodoo above --> no writing-access. This behaviour is very frustrating for me!
Edit: problem not solved but clear why: different folder do have limmited space, very limmited space...

Any ideas and hints?


Thank you!

[knc1]

Originally Posted by Analogus

I have:
Voyage FW 5.8.7


With this tutorial I got READING-access for the file system. I use a MAC, Transmit as client and Telnet.

I wanted to edit some file in opt/amazon/ebook/...
I struggled with write-access until I figured out to use Telnet:

I startet Telnet in a Terminal-window 'telnet 192.168.15.244'.
Then read the info comming at the beginning:
'Rootfs is mounted read-only. Invoke mntroot rw...'
Ok, typing in the terminal 'mntroot rw' solved the problem! Hurra - writing-access. Problem solved.

Until now... I want to edit this path:
/urs/java/lib/fonts/...
Doing the Voodoo above --> no writing-access. This behaviour is very frustrating for me!

Any ideas and hints?


Thank you!

It is the sort of filesystem that it is, not what you are doing.

Linux and MacOSx has the same system heritage, including their file system plan.
Windows is a multi-root file system, each device is the root of its own file system.
*nix systems are a single-root file system, each device holds a file system of its own that can take part in any (other than root**) location of the file tree.

You can see the similarities at the level of the command line (a terminal in MacOSx, kTerm on the Kindle).

**IF** the *nix file tree was entirely on a single device, then changing the r/w permission of that single storage device would change entire tree.

But such a permission of the physical device mounted (anywhere) does not propagate to other devices mounted elsewhere in the tree.

Might sound complex, but that is the simple overview.

One other thing needed to answer your question -
Linux (and probably MacOSx) implements a layered storage system.
One of the (optional, per mount) layers that can be used is a layer that (logically) translates a file into a logical device.
Which allows the contents of that file to be another file system.
The file == a physical storage device
The contents == the file system written on a physical device.

Now, from the above, the script (it is, you can read it):
mntroot rw
mntroot ro
only effects the root of the file system's mount point.
Its effect does not propagate to other devices mounted into the tree.

Now, the answer to your question -
run the command (either MacOSx or Kindle):

mount

Some point along the path:
/usr/java/lib/fonts
will be found to be another file system, with a different backing store (which might be a file remember).

Depending on the Kindle model / Firmware version -
that will be either a cramfs or a squashfs type file system.
A property of those file types is that they do not support write operations.
They can be created, they can be read, but they can't be written (delete is a type of write).

Capture the output of the above command on the Kindle system your interested in -
cut&paste it between 'code' tags here -
someone here will read it and tell you what you have to do to modify files in that part of the tree.

** an over-simplification, but good enough for this purpose.

[Analogus]

First of all the code when typing in MOUNT in the telnet terminal:

Welcome to Kindle!

#################################################
#  N O T I C E  *  N O T I C E  *  N O T I C E  # 
#################################################
Rootfs is mounted read-only. Invoke mntroot rw to
switch back to a writable rootfs.
#################################################
[root@kindle root]# mntroot rw
system: I mntroot:def:Making root filesystem writeable
[root@kindle root]# mount
rootfs on / type rootfs (rw)
/dev/root on / type ext3 (rw,noatime,nodiratime,barrier=0,data=writeback)
none on /proc type proc (rw,nosuid,nodev,noexec,relatime)
none on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,relatime,mode=755)
tmpfs on /dev/shm type tmpfs (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /var type tmpfs (rw,relatime,size=32768k)
tmpfs on /mnt/kfxcache type tmpfs (rw,relatime,size=256000k)
/dev/loop/2 on /usr/share/X11/xkb type squashfs (ro,noatime,nodiratime)
/dev/loop/3 on /usr/java/lib/fonts type squashfs (ro,noatime,nodiratime)
/dev/loop/4 on /etc/kdb.src type squashfs (ro,noatime,nodiratime)
/dev/loop/5 on /usr/lib/locale type squashfs (ro,noatime,nodiratime)
/dev/loop/6 on /usr/share/keyboard type squashfs (ro,noatime,nodiratime)
/dev/loop/7 on /opt/var/local type squashfs (ro,noatime,nodiratime)
/dev/mmcblk0p3 on /var/local type ext3 (rw,relatime,errors=continue,barrier=0,data=writeback)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
fsp on /mnt/us type fuse.fsp (rw,nosuid,nodev,noatime,user_id=0,group_id=0,allow_other)
/dev/loop/8 on /var/local/font/mnt/ja_font type cramfs (ro,noatime,nodiratime)
/dev/loop/9 on /var/local/font/mnt/zh-Hans_font type cramfs (ro,noatime,nodiratime)
tmpfs on /var/linkss type tmpfs (rw,relatime,size=4096k)
tmpfs on /usr/share/blanket/screensaver type tmpfs (rw,relatime,size=4096k)
/dev/loop/0 on /mnt/base-us type vfat (rw,noexec,noatime,nodiratime,fmask=0000,dmask=0000,allow_utime=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
tmpfs on /chroot/dev/log type tmpfs (rw,relatime,mode=755)
tmpfs on /chroot/dev/random type tmpfs (rw,relatime,mode=755)
tmpfs on /chroot/dev/urandom type tmpfs (rw,relatime,mode=755)
tmpfs on /chroot/dev/shm type tmpfs (rw,relatime)
none on /chroot/sys type sysfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /chroot/var/cache type tmpfs (rw,relatime,size=32768k)
tmpfs on /chroot/var/lock type tmpfs (rw,relatime,size=32768k)
tmpfs on /chroot/var/run type tmpfs (rw,relatime,size=32768k)
/dev/loop/4 on /chroot/etc/kdb.src type squashfs (ro,noatime,nodiratime)
/dev/mmcblk0p3 on /chroot/var/local type ext3 (rw,relatime,errors=continue,barrier=0,data=writeback)
fsp on /chroot/mnt/us type fuse.fsp (rw,nosuid,nodev,noatime,user_id=0,group_id=0,allow_other)
/dev/root on /chroot/etc/fonts type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/root on /chroot/etc/gtk-2.0 type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/root on /chroot/etc/pango type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/root on /chroot/etc/resolv.d type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/root on /chroot/usr/share type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/root on /chroot/usr/ssl type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/loop/6 on /chroot/usr/share/keyboard type squashfs (ro,noatime,nodiratime)
/dev/loop/3 on /chroot/usr/java/lib/fonts type squashfs (ro,noatime,nodiratime)
/dev/loop/2 on /chroot/usr/share/X11/xkb type squashfs (ro,noatime,nodiratime)
/dev/root on /chroot/usr/lib/pango type ext3 (ro,noatime,nodiratime,barrier=0,data=writeback)
/dev/loop/5 on /chroot/usr/lib/locale type squashfs (ro,noatime,nodiratime)
[root@kindle root]#

Second: thank you as always for your detailed answer!

CRAMFS is found two times somewhere around line 30, tmpfs a couple of times.

What I intendet to to is do overwrite the 4 OpenDyslexic-fonts with renamed fonts (MinionPro) I really use. I don't like those kindergarten-fonts and the font-hack is not working well on 5.8.7 (I'm able to change Bookerly to whatever I want. but Bookerly is my most favorite font. I want to change OpenDysexic but that never worked.)

[knc1]

Here is what you have to replace:

/dev/loop/3 on /usr/java/lib/fonts type squashfs (ro,noatime,nodiratime)

That is actually a file on the main file system.
Somewhere (in fstab or in the start-up scripting) is a command to mount that file on loop3.

You take a copy of that file -
Mount it on your work station -
Copy out the contents (as 'root' to preserve ownership and permissions) -
Change the files you want to change -
Re-create the squashfs file system with the squashfs utilities (it is a create, read, no write system) -
Put you new file (containing the new file system contents) where it will always be available (/var/local - IIRC) -
Make some scripting (NOT automated - you want to be able to rescue this thing) that will over-mount whatever is mounted on /dev/loop/3 with your new squashfs file -
restart cvm (and the framework, if restarting cvm does not do that itself).
If it bricks, re-boot, and just don't run your custom script again until you fix whatever is broken.

Note:
I don't know if your MacOS X system supports the squashfs file system -
You may have to run a Linux VM on your Mac to do the above.

[Analogus]

Thank you.

THIS will take it's time. As you can guess I am no MAC/LUNIX/UNIX-man and no developer at all.

I remember now I did such 'cramfs'-thing on SONY-readers years ago. But someone made a special jailbreak and copying this cramfs-file (I didn't/don't know what I technically did...) onto the reader went over the normal user-storage-area on the reader with a special mount-command in a file on the normal user-area (thanks to that jailbreaking-man).

[knc1]

I missed a step - use:

losetup /dev/loop/3

and it should output the path and name of the file that is mounted there.
(The one that contains the squashfs file system.)

- - - - -

All the same principles are involved, just use the squashfs utilities instead of the cramfs utilities.
(Amazon has switched from cramfs to squashfs in a recent firmware change.)

- - - - -

You don't have to be a developer, these are all just normal system commands for users of the command line.