Unbrick a PW3 (Fastboot)

[MadMAXXX]

Hello,
iam new in this Forum and need help by unbrick a PW3 (2015).

I got a PW3 (G090 G1) and tryed to Jailbreak it. I failed

I used the Dummies Tutorial (Serial Port) and get a Rapair Screen after erasing the root password. Unfortunatly i erase the MMC while playing around get it back to life.

I read about the fastboot and flashing the kernel, system and diags. So i get the Kindle in the fastboot mode and install the driver on my Windows PC. Fastboot is working and i also can read the serial nr over fastboot.

So far so good, but i cant get the images out of the update_kindle_5.6.1.1.bin.
(5.6.1.1 ist the SW version that was installed on the PW3)
I used the kindletool to extract the .bin but failed at unpack the fwo_rootfs.img to create the images for flasing.

Can someone help me creating the images by a step by step tut or a link where i can get this images?

Sorry for my bad english.

Regards Max

[knc1]

Originally Posted by MadMAXXX

- - - - -
So far so good, but i cant get the images out of the update_kindle_5.6.1.1.bin.
- - - - -
Sorry for my bad english.

Regards Max

I guess you haven't looked up the translation of the word: all yet.
ALL means: all, as in everything.

Including the information stored outside of the partitioned area of the eMMC storage and the bootstrap application.

The Amazon Update packages do not include the information outside of the partitioned area, with a few exceptions.

= = = =

Note: there is one, possibly two exceptions to the above statement, depending on the firmware version of the "Erase All" command.

1) U-Boot, that is re-written to the flash from the copy running in RAM.
2) The device serial number and board ID is also re-written to the flash by only some versions of the firmware.

= = = =

First off, tell us about the update package you are trying to take apart - -

Where did you get the update image file of 5.6.1.1 for the PW-3?
Amazon does not post an update package of the initial firmware a device ships with.

They do post update packages of 5.6.1.1 for other device models.
Leaving the eMMC blank would be a better choice than using an image file for the wrong device.

= = = =

O.T:
Where in the directions does it say to erase the root password?

The directions do say to erase a single character from the root entry in the password file, and gives before and after pictures of that process.

[MadMAXXX]

Originally Posted by knc1

I guess you haven't looked up the translation of the word: all yet.
ALL means: all, as in everything.

Including the information stored outside of the partitioned area of the eMMC storage and the bootstrap application.

The Amazon Update packages do not include the information outside of the partitioned area, with a few exceptions.

= = = =

Note: there is one, possibly two exceptions to the above statement, depending on the firmware version of the "Erase All" command.

1) U-Boot, that is re-written to the flash from the copy running in RAM.
2) The device serial number and board ID is also re-written to the flash by only some versions of the firmware.

= = = =

Ok, i do understood that i erased all and not everything is in a update.
Is there a chance to get my Kindle back to life?

Originally Posted by knc1

First off, tell us about the update package you are trying to take apart - -

Where did you get the update image file of 5.6.1.1 for the PW-3?
Amazon does not post an update package of the initial firmware a device ships with.

They do post update packages of 5.6.1.1 for other device models.
Leaving the eMMC blank would be a better choice than using an image file for the wrong device.

I also got that the firmware i tryed to take apart is the wrong one. Do i have to take the 5.6.5? Anyway, I got the same problem with this one.
http://www.amazon.de/gp/help/custome...deId=201605570

Originally Posted by knc1

O.T:
Where in the directions does it say to erase the root password?

The directions do say to erase a single character from the root entry in the password file, and gives before and after pictures of that process.

I did exactly what the Tut is telling and deleted the "x" in the password file.
I now also do understand that this is not to delete the password.

[MadMAXXX]

Hi,
to extract the *.bin i used the kindletool 1.6.4 but the support for the PW3 were added in 1.6.5. Could that be the problem i cant unpack the fwo_rootfs.img?

[knc1]

Originally Posted by MadMAXXX

Hi,
to extract the *.bin i used the kindletool 1.6.4 but the support for the PW3 were added in 1.6.5. Could that be the problem i cant unpack the fwo_rootfs.img?

Use the KindleTool found here (It is the most recent):
https://www.mobileread.com/forums/sho...d.php?t=225030
You will need a non-Microsoft archiver to unpack it, something like a very recent 7Zip, WinZip, or RAR.

How to get older versions of the update packages from the Amazon server is a FGA, see:
https://www.mobileread.com/forums/sho...postcount=1301

Keep in mind that Amazon does not post an update package of the initial version a model ships with - your only choice is something newer (with a few exceptions - none of which will help you with this problem).

Note also that it is extremely rare for an Amazon update package to include the 'diags' system, they only update the 'main' system.
(Mostly because 'diags' is written to the flash chip before the chip is put on the board, and then never changed.)
So you will need to get a copy of that.

= = = =

but you can do nothing until you get the tools to work.
So -
Get the update package from Amazon that you want to use (record the link) -
Get the KindleTool package you are going to use (record the link) -
Try following the directions -
Post what happens -

if things fail include the names and links in your post.
That way a person has a chance of duplicating your problem - which is a requirement to any sane answer.

if things seem to work, then we can deal with how to find and transfer the image files.

= = = =

EDIT:
Hmm...
The German PW-3, 5.6.5 now posted is 26Mbyte smaller than the English(us) PW-3, 5.6.5 that was posted last September.

I haven't tried unpacking and comparing both of them (yet) -
But I know the Linux-32bit build of KindlTool, does unpack the (us) one.

Will have to wait for MadMAXXX to report on the Windows build of KindleTool.

EDIT 2:
The English(us) version of the PW-3 is one of those we (NiLuJe and I) recovered the original factory, 5.6.1.1 firmware package (and it does not have diags in it).
Ah, Crap! See my following post.

[knc1]

Originally Posted by MadMAXXX

- - -
Unfortunatly i erase the MMC while playing around get it back to life.
- - -

Originally posted by Geekmaster on this erase all subject.

[MadMAXXX]

Originally Posted by knc1

Hmm...
The German PW-3, 5.6.5 now posted is 26Mbyte smaller than the English(us) PW-3, 5.6.5 that was posted last September.

I haven't tried unpacking and comparing both of them (yet) -
But I know the Linux-32bit build of KindlTool, does unpack the (us) one.

Will have to wait for MadMAXXX to report on the Windows build of KindleTool.

I extract the rootfs.img out of the german 5.6.5 (link in previous post) with the most recent kindletool for linux x86 on a VM and also for MinGW. Both kindletool version extract the rootfs.img. (If you extract in linux its called rootfs.img and if you extract in Windows (MinGW) its called fwo_rootfs.img)

But still the same problem i got at beginning! Its not possible to open the rootfs.img. I tryed to mount in DAEMON Tools and to unpack with WinRAR, 7Zip and IsoBuster with no success. The error i get is always the same "unknown format or demaged file"

[knc1]

Originally Posted by MadMAXXX

I extract the rootfs.img out of the german 5.6.5 (link in previous post) with the most recent kindletool for linux x86 on a VM and also for MinGW. Both kindletool version extract the rootfs.img. (If you extract in linux its called rootfs.img and if you extract in Windows (MinGW) its called fwo_rootfs.img)

But still the same problem i got at beginning! Its not possible to open the rootfs.img. I tryed to mount in DAEMON Tools and to unpack with WinRAR, 7Zip and IsoBuster with no success. The error i get is always the same "unknown format or demaged file"

You lost me on that one.
I thought you wanted to recover your erased Kindle.

That does not require that you "open" the rootfs.img file, it is "ready to go" (onto mmcblk0p1) - that is why it is called an "image".

The purpose of using an unmodified image of the system is to get a "known good" system written to flash.
One that can be read back and compared to the image file if problems are suspected.

But if you must, I guess you must . . . .
(One useful thing you might want to do is jailbreak the image before flashing.)
On Linux VM, do:

sudo mkdir /mnt/tmp-p1  (the name does not matter)
sudo mount /path/to/rootfs.img /mnt/tmp-p1

Note that the mount command is allowed to determine for itself that this is a loop mount and the file type of the image file (ext3).
You may or may not get a warning about the missing /lost&found (I.E: /mnt/tmp-p1/lost&found) directory.

Remember:
The image is mounted read-write -- you can screw it up before flashing it.
You must umount it when your done with it, repeat: MUST.
The ext3 driver will take care of flushing buffers for you (there is no 'safely remove' command for this loop mount).

You failed to mention **which** flavor of Linux (which distribution, name and version) you have running in your VM.
It may make a difference and I can not see over your shoulder.

You have also failed to mention **HOW** you get your PW-3 into fastboot mode.
That may make a difference also.

BIG NOTE: the rootfs.img is too large for the Kindle implementation of fastboot to transfer.
Which is why you must run the Kindle in 'diags' system to flash rootfs.img.
Ah, but you don't (yet) have a 'diags' kernel and root filesystem - so we will have to follow a procedure that I don't find documented in the 'simple debricking' thread.

You have not mentioned flashing the main kernel (which is also in the Update that you unpacked).

You have not mentioned flashing the u-boot image (which is also in the Update that you unpacked) - but you should not need that, since you have the Kindle running fastboot.

Bigger Note:
Post back here when done playing with the above since the 'main' rootfs.img file will be the LAST thing you have to flash, not the first or only.

[MadMAXXX]

Originally Posted by knc1

You failed to mention **which** flavor of Linux (which distribution, name and version) you have running in your VM.
It may make a difference and I can not see over your shoulder.

I use openSUSE 12.3

Originally Posted by knc1

You have also failed to mention **HOW** you get your PW-3 into fastboot mode.
That may make a difference also.

I connected the serial port and startet Putty. At first i got a black screen without information. After pressing Enter i will get the "uboot >" on screen.
with "bist fastboot" i get into the fastboot mode.

uboot > bist fastboot


U-Boot 2009.08-lab126 (Apr 15 2015 - 07:39:13)

CPU: Freescale i.MX6 family TO0.0 at 996 MHz
Temperature:   32 C, calibration data 0x5805095f
mx6sl pll1: 996MHz
mx6sl pll2: 528MHz
mx6sl pll3: 480MHz
mx6sl pll8: 50MHz
ipg clock     : 66000000Hz
ipg per clock : 66000000Hz
uart clock    : 80000000Hz
cspi clock    : 60000000Hz
ahb clock     : 132000000Hz
axi clock   : 198000000Hz
emi_slow clock: 22000000Hz
ddr clock     : 396000000Hz
usdhc1 clock  : 198000000Hz
usdhc2 clock  : 198000000Hz
usdhc3 clock  : 198000000Hz
usdhc4 clock  : 198000000Hz
MMC:  FSL_ESDHC: 0,FSL_ESDHC: 1,FSL_ESDHC: 2
Board: Muscat WFO
Boot Reason: [ POR ]
Boot Device: NAND
Board Id: "xxx"
S/N: "xxx"
I2C:   ready
DRAM:  512 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
POST done in 0 ms
Battery voltage: 3932 mV

running cmd: fastboot
Entering fastboot mode...
Battery voltage: 3925 mV
Battery voltage: 3923 mV
USB speed: HIGH
Connected to USB host!
USB speed: HIGH
Connected to USB host!
Battery voltage: 3995 mV

Ok, i started totally wrong on this "unbrick"!

Can you please explain what i have to do first? What do i have to flash first/last?

Actually i thought i can follow this Tut (link below) but i do not have the right files. On beginning i thought i can extract all files i will need from the update package but you disabused me.
https://gist.github.com/TobiasWooldr...ca75190b9a473f

[knc1]

Originally Posted by MadMAXXX

- - - - -
Ok, i started totally wrong on this "unbrick"!

Can you please explain what i have to do first? What do i have to flash first/last?

Actually i thought i can follow this Tut (link below) but i do not have the right files. On beginning i thought i can extract all files i will need from the update package but you disabused me.
https://gist.github.com/TobiasWooldr...ca75190b9a473f

openSUSE -
Nice choice, very complete but a little bit different than the others, so is good to know.
Very much a "professional use" distribution, but that is good, keep your VM install after we are done, you will find uses for it.
You didn't mention if 32 or 64 bit version, but I'll ask if it becomes neccessary to know.

I will presume you are using minicom for your terminal emulation.

Thanks for the capture of the u-boot messages, I can tell where the system is at from that.
I will be asking for more of them (because we are working with a very new model - I will need them to spot differences).

To get a good overview of what we will be doing is the "simple" (yeah, right!) debricking thread:
(sticky) "Where Do I Start?" - (section) Debricking ->
https://www.mobileread.com/forums/sho...d.php?t=170929

We can't follow it exactly because:
*) Its old, last updated in the days of the very first touch screen device (K5).
*) It assume you have a working 'diags' system.
You do not, you erased both the 'main' and the 'diags' systems.
(Kindles (5.+) are dual boot systems, you killed both of them. )
*) But on the good side, you seem to have a complete, working, u-boot install.
Actually, both of them (there are two (2) u-boot builds installed).

There is also a current thread here where someone has erased even more than you did, that device can not even run its own dynamic RAM.
That one can also be recovered, but it is going to be a real job to get it running again.

Yours is in much better shape - its only missing (both) operating systems.

So far, of the things to be done:

• Get a serial port connection working (done).
• Get both the small and the full u-boot builds running (done).
• Get the KindleTool utility running (done).
• Locate the desired Update package (done).
• Un-package it (done).
• Get the Fastboot server running under your Linux VM -
  Not mentioned, but I expect you can if you haven't already.
  Don't be too concerned, you can switch out of the VM and use the Windows Fastboot install if you have to.
• Install (flash) something more advanced than u-boot, that can handle installing the main operating system, system image.

This last point is where we start inventing the directions as we go along.

Continued in next post - -

[knc1]

Continued from prior post above.

There are two builds of u-boot installed on your device:
A small memory footprint one (which is the first one that runs) -
A large memory footprint one (bist - Built In Self Test).

Since I have to invent these directions as we go (and I don't want to disassemble my PW-3 just to fix yours ) . . . . .

I want a file with everything we can possible learn at this point.

Please do the following:

• Get the setup to the point where you can see the u-boot> prompt.
• Use the 'settings' menu(s) of the terminal emulator (minicom?) to enable a capture file (log file).
• Ensure the 'normal' USB-to-PC cable is disconnected from the Kindle.
• Press and hold the power button on the Kindle for at least 30 seconds.
  This will trigger a full POR (Power On Reset) and re-boot.
• When the u-boot> prompt appears again on the terminal emulator, do:
  • Enter: help (or just ?)
  • Enter: printenv
  • Enter: bist
• When the bist prompt appears, do:
  • Enter: help (or just ?)
  • Enter: printenv
• Use the terminal emulator settings menu(s) to disable the capture (log) file.
• Open the capture file with a plain text editor (gedit, geany, whatever openSUSE provides).
• Search for your device's serial number, replace all except the first 6 characters with XXXXX s.
• Save the modified capture file.
• Enter: gzip whatever-filename-you-used
  This will compress the capture file and append a '.gz' to its filename.
• On your next post to this thread, select the 'advanced editor' (quick reply -> go advanced)
• Type whatever might be helpful (we are writing for future lost souls).
• Scroll down, past the text entry box to the 'manage attachments'
• Use the 'manage attachments' to upload the compressed capture file (with the obscured serial number).
• Thanks.

For comparison, here is a list of the bist commands from a very early PW-2:
https://www.mobileread.com/forums/sho...5&postcount=29

[MadMAXXX]

For the serial communication i will use PuTTY on Windows 7 x64.

Attached the Log File you asked for.

[knc1]

Originally Posted by MadMAXXX

For the serial communication i will use PuTTY on Windows 7 x64.

Attached the Log File you asked for.

Looking good.

See this part?

Hit any key to stop autoboot:  0 
Wrong Image Format for bootm command 
ERROR: can't get kernel image!

If there had been a kernel image to boot -
it would have auto-booted it.
You would have had to "press any key" within 1 second of start-up to have stopped the auto-boot.

There are enough commands available that we could load the initial filesystem image over the serial port line.
Which would take approximately forever.

= = = background = = =

There are two ways that a Linux kernel can be laid out - -

With the kernel as one file and the initial (ram)filesystem as a second file.
(look in your VM's /boot directory to see those examples)

The other way is for those two file to be combined into a single file image.

Amazon/Lab126 builds the kernel/initial filesystem image the second way, as a single file. (Which makes their initramfs code GPLv2 - O.T. at this point.)

= = = =

The initial (ram) filesystem embedded within the kernel image include the "recovery menu".
Although I haven't seen it yet, I expect it to offer an easier way to get the 'main' filesytem image loaded.

So the next step will be to flash the 'main' kernel using fastboot.

At the top directory level where you un-packaged the update package, you should see a directory:
imx60_wario
Inside of that directory there will be a file named:
uImage (or maybe uimage).

**THAT** is the main kernel+initramfs image.

(There is also a copy of the u-boot binary in that directory - you don't need it - the one installed is in fine shape.)

So this step will be to use fastboot to flash that image file.
Yuck - I have forgotten the command - I will have to look it up and that may take awhile - don't hold your breath.

After that - then just re-booting the Kindle should load and run the just installed kernel.
That will (or **should**) fail to find the run-time main filesystem and abort into the "recovery menu".

Note: I don't recall where/when in this boot sequence the firmware checks /var/local and /mnt/us for the proper format.
If it seems to take forever to get to the "recovery menu" - that is expected, the system is re-creating the third and fourth partitions for us.

Keep a capture file setup on the serial port line - just in case something goes wrong or does not work like I expect it to.
Also, because I will need to see what choices that menu has to offer.

[knc1]

Well, not what I was looking for, but might be useful information . . . .

The fastboot commands recognized by the u-boot in 5.6.5 firmware:

Spoiler:

"getvar"     /* Read a config/version variable from the bootloader. */

"version-bootloader"    /* Version string for the Bootloader. */

"version"    /* Version of FastBoot protocol supported. */

"product"    /* Name of the product */

"serialno"   /* Product serial number */

"secure"     /* If the value is "yes", this is a secure
                bootloader requiring a signature before
                it will install or boot images. */
             // Hardcoded as "no"
                
"setvar"     /* Set a config variable in the bootloader. */

"download"   /* Write data to memory which will be later used
                by "boot", "ramdisk", "flash", etc.  The client
                will reply with "DATA%08x" if it has enough
                space in RAM or "FAIL" if not.  The size of
                the download is remembered. */
                
"verify"     /* Send a digital signature to verify the downloaded
                data.  Required if the bootloader is "secure"
                otherwise "flash" and "boot" will be ignored. */

"flash"      /* Write the previously downloaded image to the
                named partition (if possible). */

"eraseall"   // No description provided

"erase"      /* Erase the indicated partition (clear to 0xFFs) */

"check"      // Test crc32 of a partition

"boot"       /* The previously downloaded data is a boot.img
                and should be booted according to the normal
                procedure for a boot.img */

"continue"   /* Kick out to the bootloader prompt */

"reboot"     /* Reboot the device. */

"powerdown"  /* Power off the device. */

"pass"       /* Flash pass pattern on (green) LED */

"fail"       /* Flash fail pattern on (red) LED */

Note: the "ramdisk" download is not supported.

[MadMAXXX]

Do I have to flash the uImage to the primary kernel (cmd "kernel") or to the main system (root) partition (cmd "system") ?

The fastboot (Windows Version) commands:

Spoiler:

>fastboot ?

usage: fastboot [ <option> ] <command>

commands:
  getvar <variable>                        display a bootloader or idme variable

  setvar <variable> <value>                sets an idme variable
  download <filename>                      download data to memory for use with

                                             future commands
  verify <partition> [ <filename> ]        verify downloaded data. required if
                                             bootloader is secure
  flash <partition> [ <filename> ]         flash downloaded data
  eraseall                                 wipe the entire flash memory
  erase <partition>                        erase a flash partition
  check <partition>                        crc32 hash test the flash memory
  boot [ <filename> ]                      boot downloaded data
  continue                                 exit fastboot and return to
                                             bootloader
  reboot                                   reboot the device
  powerdown                                shuts down the device
  pass                                     sets LED to green
  fail                                     sets LED to red

variables:
  version-bootloader                       (read only) version string for the
                                             bootloader
  version                                  (read only) version of fastboot
                                             protocol supported
  product                                  (read only) name of the product
  serialno                                 (read only) fastboot serial number
  secure                                   (read only) if "yes" boot images
                                             must be signed
  serial                                   (read write) serial number
  accel                                    (read write) accelerometer
                                             calibration data
  mac                                      (read write) MAC address
  sec                                      (read write) manufacturing code
  pcbsn                                    (read write) PCB serial number
  bootmode                                 (read write) diags, fastboot,
                                             factory, reset, or main (default)
  postmode                                 (read write) slow, factory, or
                                             normal (default)

partitions:
  bootloader                               bootloader, 376KiB
  prod                                     overlaps bootloader, 120KiB
  bist                                     bist, 256KiB
  userdata                                 userdata, 5KiB
  userpartition                            userpartition
  mbr                                      master boot record
  kernel                                   primary kernel
  diags_kernel                             diags kernel
  system                                   main system (root) partition
  diags                                    secondary system (diags) partition
  data                                     user data

options:
  -s <serial number>                       specify device serial number
  -i <vendor id>                           specify a custom USB vendor id