Tutorial Brand new PaperWhite 4 (2018) factory image JailBreaking

[coplate]

Hello all,


Important to note, that apparently this does only work with the factory version that ships on your device.


I am prepared to put the details out for the factory image jailbreak for the PaperWhite 4.

I am not interested at this time in maintaining these instructions as software versions change, so I will simply write my method, and allow others who want to maintain it, or add it to the wiki to feel free to do so.


Because of that my instructions will not be in depth.
It does follow the same flow as the existing factory image jailbreak for older devices, the current wiki article is here: https://wiki.mobileread.com/wiki/5_x_Jailbreak


The process should be identical to the method used on PW3 and KOA2. Though my step #s will not match

Step 0: start up brand new Kindle, and skip the wifi screen, choosing to finish setup later.

Step 1: download factory image to your computer, and load onto the Kindle

I will host the factory image for a while, and let it get mirrored out to the internet here:
5.10.0.1
The md5sum is

2643277e8316ff412fc748ede22c08c6  update_kindle_all_new_paperwhite_v2_5.10.0.1_factory.bin

5.10.0.2
The md5sum is

be5cc7a210bfa4fc81d4a03e62647714  update_kindle_all_new_paperwhite_v2_5.10.0.2_factory.bin

-- Note here: if you are familiar with USBNet, it appears that amazon's usbnet is functional in this build, and you can do the rest of the work manually if you would prefer, instead of following the rest of this tutorial, but of course, you're on your own if you choose to go that route. --


Step 2: use "Update Your Kindle" in the Settings menu
This step will have your kindle processing and on the tree screen for a long time, perhaps 30 minutes, do NOT reboot or try anything during this time.
Make sure your kindle is fully powered up before you do this.

Step 3: create the update blocking folder
After that, please create an empty folder on the kindle USB drive named 'update.bin.tmp.partial'

Step 4: JailBreak your Kindle
After that, you can run the jailbreak using the K5 Factory JailBreak (Factory FW) from here https://www.mobileread.com/forums/sh...d.php?t=225030

AKA "installHTML". See existing documentation on running this.
Instructions on how to use are here: https://www.mobileread.com/forums/sh...d.php?t=275887

Step 5: Install the Hotfix/Bridge to keep the JailBreak after update
After that, you can install the Hotfix from here
https://www.mobileread.com/forums/sh...postcount=1597

NiLuJe was amazing and got this working really fast.
It is only currently packaged for devices with Serials G000T6, G000PP, G000T1, G000T2.
(WiFi 8GB and 32GB, LTE 32GB US & EU)

Version JailBreak-1.15.N-FW-5.x-hotfix.zip
Post Edit date after Nov 18, 2018


Step X: update to newer FW or do whatever else you want on your jailbroken Kindle.


Note that most software will probably not be updated for this yet...

Most of my stuff should be PW4 ready . -- NiLuJe


This should give you the basic setup if I did not break anything.

There is always a chance that you could brick your device, so be prepared.

----

If you've come this far, here's a quick recap of what the process should look like, with a few of the basic tools mostly everyone should need added during step X :

TL;DR: Factory Image -> Factory JB -> Hotfix -> MRPI -> KUAL Booklet w/ Coplate's patch -> Everything else

Note that a firmware update will put you back to the step just after MRPI (i.e., you'll have to reinstall anything custom, KUAL included).

If you're confused about the apparent circular dependency between KUAL & MPRI, see this post, as well as the JailBreak Wiki page mentioned at the beginning of this post.

----

This had initially only been tested on WiFi 8GB and WiFi 32GB with serials that start with G000T6 and G000PP.

This had initially only been tested on devices that shipped with 5.10.0.1 (3337430015).

----

Use at your own risk, YMMV.

----

EDIT: Clarification regarding what factory versions will work on which devices:
Apparently, they have added in more 'downlgrade' protection, in addititon.

This means that if you have upgraded to 5.10.0.2, or have a device that shipped with that, then you cannot downgrade to 5.10.0.1; You have to use the factory version that matches your installed code exactly.

This post is based on what the people who had with 5.10.0.2 reported, and I have updated my device to that version and confirmed.

181120:161817 OTAController[1270]: E FB02Bundle:FB02BundleValidationFailed:reason=IncompatibleVersion,deviceVersion=3341680009,bundleVersion=3337430015:IncompatibleVersion version
181120:161817 OTAController[1270]: E BundleValidator:validateBundle:valid=false,filename=/mnt/us/update_kindle_all_new_paperwhite_v2_5.10.0.1_factory.bin:Removing update file

This means that people will have to have a factory image that matches or exceeds their current version, so as new stock comes through, we will have to figure something out.

[PeaceBrigade]

Hey there, you said kindles that shipped on that firmware. Does that then exclude those of us who were stupid enough to upgrade to 5.10.1.2?

Or is it possible to simply downgrade to the previous version through the firmware link you provided.

I suspect I am completely out of luck but one can desperately hope anyways...

Thanks for your efforts regardless.

[NiLuJe]

Nope, as usual in Kindle 5.x land: when we mention a specific FW version or a specific FW version range: we mean it!

If you happen to get a PW4 with a different S/N, give me a shout. I'll at least expect a 3G (or would that be 4G now?) variant to show up fairly soonish .

Stuff from my snapshots thread *should* be PW4-ready, the only real question mark left is to see if USBNet is as finicky as it was on the KOA2. The hardware is a bit different, so, who knows . (For reference, that involved a kernel crash when switching *back* to USBMS).

The very latest KOReader nightly *should* also be PW4-ready (but if someone tries, I'd like to hear about it, in particular to check if the frontlight behaves properly).

[hius07]

Great job, guys! Thank you your efforts!

[PeaceBrigade]

I haven't terribly kept up with the scene since I jailbroke my PW2 a million years ago, is it common for jailbreaks to be developed longer down the road for up to date firmware versions, or is everything mostly relying on untouched out of the box exploits?

[dhdurgee]

Originally Posted by PeaceBrigade

I haven't terribly kept up with the scene since I jailbroke my PW2 a million years ago, is it common for jailbreaks to be developed longer down the road for up to date firmware versions, or is everything mostly relying on untouched out of the box exploits?

The flaws that were being exploited in earlier firmware releases have been corrected in the latest firmware releases. Until new flaws that can be exploited are discovered in these newer releases only the untouched units can take advantage of customization.

Dave

[NiLuJe]

i.e.,

Originally Posted by NiLuJe

First rule of fight club: don't let it phone home ;p.

[makue]

Wow, what a tremendous piece of art!

Everything ran w/o any problems. Only thing were the warnings installing the mrpi packages "mounting ro failed" or similar. But beside those everything works so far: the librariansync, the USBNetwork and of course the ScreenSaver.

Simply perfect and so Amazon was in a position again to sell me new stuff, this time a Kindle PW4 which I'd never bought knowing there is no jailbreak for it.

[NiLuJe]

@makue: Huh. I wouldn't mind taking a look at the MRPI logs (extensions/MRInstaller/log/mrinstaller.log), because those warnings definitely look fishy .

EDIT: And a look at /proc/mounts for anyone with shell access .

[makue]

Ok, here we are

[NiLuJe]

@makue: Huh. I don't remember if that ever happened anywhere else, but the fact that I doubled this check and made the warning message somewhat cheeky would point towards yes...

There should be (much) more information in the system logs, but that would imply following along in a shell (showlog -f) during an MRPI session...

[coplate]

Originally Posted by PeaceBrigade

I haven't terribly kept up with the scene since I jailbroke my PW2 a million years ago, is it common for jailbreaks to be developed longer down the road for up to date firmware versions, or is everything mostly relying on untouched out of the box exploits?

There were a lot more exploits, and more people with serious skills researching them back in the day.

I don't know if there are many people off the boards reserching it right now, but this 'factory image' (right-out-of-the-box) has been the only method found for a very long time now.


It's always possible someone will find a method, and I am very hopeful someone will find the magic to trigger the ADB / fastboot / diags mode on this. But I have concluded that it probably won't be me.

I'm just going to sit back and enjoy my paperwhite now, get some actual reading done. :-)

[Jokera]

Thank you everything worked great. I am trying now to install KOReader. Do I need to use the patched version of the Booklet variant? If yes, do I follow the PW3 or KOA2 instructions?

[marrco]

a few minor issues here. After loading factory image when searching for ;u... a list with many books appeared, in various languages. When first connected to wifi about 30 dictionaries were downloaded. Turned off wifi, at every reboot a message appeared on screen:



re-enabling wifi some packages were downloaded. Now my kindle has a new menu (dictionaries/Chinese sort order) and lots of more fonts. See /dev/loop/8 and 9

everything works fine. usbnet is rock solid and screensaver works fine in cover mode.

[root@kindle root]# cat /proc/mounts
/dev/root / ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
none /proc proc rw,nosuid,nodev,noexec,relatime 0 0
none /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /dev tmpfs rw,relatime,mode=755 0 0
tmpfs /dev/shm tmpfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
tmpfs /var tmpfs rw,relatime,size=32768k 0 0
tmpfs /mnt/kfxcache tmpfs rw,relatime,size=256000k 0 0
/dev/loop/2 /usr/share/X11/xkb squashfs ro,noatime,nodiratime 0 0
/dev/loop/3 /usr/java/lib/fonts squashfs ro,noatime,nodiratime 0 0
/dev/loop/4 /etc/kdb.src squashfs ro,noatime,nodiratime 0 0
/dev/loop/5 /usr/lib/locale squashfs ro,noatime,nodiratime 0 0
/dev/loop/6 /usr/share/keyboard squashfs ro,noatime,nodiratime 0 0
/dev/loop/7 /opt/var/local squashfs ro,noatime,nodiratime 0 0
/dev/mmcblk1p3 /keys ext3 ro,noatime,nodiratime,errors=continue,user_xattr,acl,barrier=1,data=ordered 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
/dev/mmcblk1p9 /var/local ext3 rw,relatime,errors=continue,barrier=1,data=ordered 0 0
/dev/loop/0 /mnt/base-us vfat rw,noexec,noatime,nodiratime,fmask=0000,dmask=0000,allow_utime=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
fsp /mnt/us fuse.fsp rw,nosuid,nodev,noatime,user_id=0,group_id=0,allow_other 0 0
/dev/loop/8 /var/local/font/mnt/ja_font squashfs ro,noatime,nodiratime 0 0
/dev/loop/9 /var/local/font/mnt/zh-Hans_font squashfs ro,noatime,nodiratime 0 0
tmpfs /var/linkss tmpfs rw,relatime,size=4096k 0 0
tmpfs /usr/share/blanket/screensaver tmpfs rw,relatime,size=4096k 0 0
tmpfs /chroot/dev/log tmpfs rw,relatime,mode=755 0 0
tmpfs /chroot/dev/random tmpfs rw,relatime,mode=755 0 0
tmpfs /chroot/dev/urandom tmpfs rw,relatime,mode=755 0 0
tmpfs /chroot/dev/shm tmpfs rw,relatime 0 0
none /chroot/sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /chroot/var/cache tmpfs rw,relatime,size=32768k 0 0
tmpfs /chroot/var/lock tmpfs rw,relatime,size=32768k 0 0
tmpfs /chroot/var/run tmpfs rw,relatime,size=32768k 0 0
/dev/loop/4 /chroot/etc/kdb.src squashfs ro,noatime,nodiratime 0 0
/dev/mmcblk1p9 /chroot/var/local ext3 rw,relatime,errors=continue,barrier=1,data=ordered 0 0
fsp /chroot/mnt/us fuse.fsp rw,nosuid,nodev,noatime,user_id=0,group_id=0,allow_other 0 0
/dev/root /chroot/etc/fonts ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/root /chroot/etc/gtk-2.0 ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/root /chroot/etc/pango ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/root /chroot/etc/resolv.d ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/root /chroot/usr/share ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/root /chroot/usr/ssl ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/loop/6 /chroot/usr/share/keyboard squashfs ro,noatime,nodiratime 0 0
/dev/loop/3 /chroot/usr/java/lib/fonts squashfs ro,noatime,nodiratime 0 0
/dev/loop/2 /chroot/usr/share/X11/xkb squashfs ro,noatime,nodiratime 0 0
/dev/root /chroot/usr/lib/pango ext3 ro,noatime,nodiratime,barrier=1,data=ordered 0 0
/dev/loop/5 /chroot/usr/lib/locale squashfs ro,noatime,nodiratime 0 0
[root@kindle root]# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root               429.4M    358.2M     49.2M  88% /
tmpfs                   245.6M    168.0K    245.5M   0% /dev
tmpfs                   245.6M         0    245.6M   0% /dev/shm
tmpfs                    32.0M    484.0K     31.5M   1% /var
tmpfs                   250.0M         0    250.0M   0% /mnt/kfxcache
/dev/loop/2             384.0K    384.0K         0 100% /usr/share/X11/xkb
/dev/loop/3              81.0M     81.0M         0 100% /usr/java/lib/fonts
/dev/loop/4             128.0K    128.0K         0 100% /etc/kdb.src
/dev/loop/5             768.0K    768.0K         0 100% /usr/lib/locale
/dev/loop/6              14.1M     14.1M         0 100% /usr/share/keyboard
/dev/loop/7               1.6M      1.6M         0 100% /opt/var/local
/dev/mmcblk1p3          987.0K     21.0K    864.0K   2% /keys
/dev/mmcblk1p9          239.9M     18.4M    208.8M   8% /var/local
/dev/loop/0               6.2G    690.6M      5.6G  11% /mnt/base-us
fsp                       6.2G    690.6M      5.6G  11% /mnt/us
/dev/loop/8              13.9M     13.9M         0 100% /var/local/font/mnt/ja_font
/dev/loop/9              36.0M     36.0M         0 100% /var/local/font/mnt/zh-Hans_font
tmpfs                     4.0M         0      4.0M   0% /var/linkss
tmpfs                     4.0M         0      4.0M   0% /usr/share/blanket/screensaver
tmpfs                   245.6M    168.0K    245.5M   0% /chroot/dev/log
tmpfs                   245.6M    168.0K    245.5M   0% /chroot/dev/random
tmpfs                   245.6M    168.0K    245.5M   0% /chroot/dev/urandom
tmpfs                   245.6M         0    245.6M   0% /chroot/dev/shm
tmpfs                    32.0M    484.0K     31.5M   1% /chroot/var/cache
tmpfs                    32.0M    484.0K     31.5M   1% /chroot/var/lock
tmpfs                    32.0M    484.0K     31.5M   1% /chroot/var/run
/dev/loop/4             128.0K    128.0K         0 100% /chroot/etc/kdb.src
/dev/mmcblk1p9          239.9M     18.4M    208.8M   8% /chroot/var/local
fsp                       6.2G    690.6M      5.6G  11% /chroot/mnt/us
/dev/root               429.4M    358.2M     49.2M  88% /chroot/etc/fonts
/dev/root               429.4M    358.2M     49.2M  88% /chroot/etc/gtk-2.0
/dev/root               429.4M    358.2M     49.2M  88% /chroot/etc/pango
/dev/root               429.4M    358.2M     49.2M  88% /chroot/etc/resolv.d
/dev/root               429.4M    358.2M     49.2M  88% /chroot/usr/share
/dev/root               429.4M    358.2M     49.2M  88% /chroot/usr/ssl
/dev/loop/6              14.1M     14.1M         0 100% /chroot/usr/share/keyboard
/dev/loop/3              81.0M     81.0M         0 100% /chroot/usr/java/lib/fonts
/dev/loop/2             384.0K    384.0K         0 100% /chroot/usr/share/X11/xkb
/dev/root               429.4M    358.2M     49.2M  88% /chroot/usr/lib/pango
/dev/loop/5             768.0K    768.0K         0 100% /chroot/usr/lib/locale
[root@kindle root]#

[weak]

Originally Posted by dhdurgee

[...] only the untouched units can take advantage of customization.

How untouched does the device need to be? I have connected my PW4 with my amazon account and side loaded my collection, but the firmware is still at 5.10.0.1. Will it still work?