A little background information first. A while back Igor Skochinsky found serial console connector on Kindle 1 and reverse engineered scripts that Kindle uses to update it’s firmware. Since Amazon is paying for it’s wireless traffic they don’t push full firmware dumps as updates but rather compressed linux patches that only change the things that need to be changed and are relatively small. In Kindle 2 same scripts were used. The only thing that changed was device ID. This was to safeguard against installing update for wrong Kindle device rather than to prevent custom update installation altogether. Kindle DX was a similar story.

However it all changed when Kindle 2 International came out. There was a device ID change as well but updates still failed to install. Using debug commands that still worked (you need to type then in the home screen search box – they are quite harmless will not break your Kindle):

• ;debugOn
• ;dumpMessages

Amonng other housekeeping messages it returned the folloing lines:

091021:102422 EXT3 FS on mmcblk0p1, internal journal
091021:102422 system: I _otaupexec:def:processing update /mnt/us/update_tool.bin
091021:102422 system: I _otaupexec:def:version is “FC02″
091021:102422 system: I _otaupexec:def:update image checksum OK
091021:102422 system: E _otaupexec:def:signature does not exist for “tool.sh”
091021:102422 system: E _otaupexec:def:signature verification failed

So it looked like Amazon was signing update packages now. Worst case scenario would have been usage of asymmetric encryption keys like RSA that would be impossible to break until we have working full-scale quantum computers. Best case would be Amazon using something simple – like tar file scrambling that they are using to “encrypt” the whole update file.

I was trying to break into the Kindle via serial console that can be exposed by sliding the top plastic cover off the device but fried my Kindle in the process.

While I was waiting for the new device to arrive, mobileread.com member clarknova suggested using a tarbomb to break into the new Kindle. He assumed that new Kindle would still use the old code to extract files from the update before verifying the signatures. It proved to be true. A tarbomb exploits the fact that linux tar would extract anything that is given to it and might put it somewhere where package receiver didn’t intent it to go. For example older versions would honor relative paths, so if tarball contained file ../../etc/rc5.d/S00kill-code and most likely user would try to unpack the file in /home/username, the malicious file would go into /etc/rc5.d/ and get executed on the startup. While version of tar that is installed on Kindle discards parent directory references, it allows to unpack a symlink that points anywhere in the filesystem. This allowed to craft an update that would still fail to install but in the process would deposit a startup script that would unlock further access to Kindle internals.

Unfortunately Amazon did use the asymmetric encryption to sign the packages. Fortunately there is a very nice way around. Kindle doesn’t use just one key to verify the signature – it enumerates all key files in /etc/uks directory and if any of the keys yields a positive signature validation – the file passes the test. So Jean-Yves Avenard created a tarbomb that would add extra public key to that directory. He also modified Igor’s script to use corresponding private key to sign all the files in the package.

Nice thing about this mod is that it doesn’t change any files in Kindle filesystem, it just adds. So it will not cause checksum conflicts when installing official Amazon updates in the future. However if you use this jailbreak mod to install other updates like Unicode Font Hack, screensaver, savory, etc that DO change files then standard rules apply – official updates will fail and you’ll need to revert the hacks, install official update manually and then reinstall the hacks. Although I doubt that we’ll see many official Amazon updates anytime soon. I’ll make a separate post on this topic at some other time.

I’m pretty sure that in the next version of the device (International Kindle DX perhaps or whatever comes next), Amazon will fix this vulnerability and serial console might be required to install things on Kindle or perhaps some other security exploit. But for now here are specifics:

You can download the “jailbreak” update here. I’ve tested it on my Kindle and it works perfectly. It also contains the updated script to create your own packages. However I would strongly advise you to do it only if you really-really need to, really-really know that you are doing and are willing to brick your device. Several people were known to irreversible brick their Kindle eBook readers by experimenting with them. I bricked two so far trying to create unicode font hack – one US Kindle 2 a while back another Kindle 2 International recently.

So if you are not sure about what are you doing – stick to pre-canned hacks from verified sources that have been tested to work and have uninstallers available. These are relatively safe though again there is always a chance of something going wrong and hacking the Kindle absolutely does void the warranty.

I’ve tested the pre-canned screensaver hack that can be downloaded here and it does work perfectly.

To avoid having to jailbreak Kindle multiple times and creating potentially conflicting hacks I recommend to all Kindle modders out there to use Jean-Yves Avenard’s packager and private/public key pair for creating Internaional Kindle hacks. I’m going to use it for Unicode Font Hack myself.

Right after publishing this post I’m going to reorganize the Unicode Font Hack a bit and release a new version for all Kindle versions including the international one. Stay tuned!

Related Posts

• June 22, 2009 -- Kindle DX Screensaver Hack (4)
• March 11, 2009 -- Kindle 1 Screensaver Hack (5)
• March 9, 2009 -- Kindle 2 Screensaver Hack (34)
• October 5, 2009 -- Solution for cracked Kindle problem (1)

RS-232 to TTL converter for Kindle

If you were wondering why there were no posts lately – I’ve been busy trying to come up with a way to install Unicode Font Hack on Kindle 2 International. Rather than ordering ready-made USB-RS232-TTL converter I’ve decided to have some fun with little hardware project and create one myself.

Unfortunately I’ve short-circuited something within Kindle when connecting wires to the serial console and pretty much bricked the unit. This is yet another reminder to people that you shouldn’t try to hack something like Kindle unless you are willing to brick it.

Right now I’m waiting for the next specimen to arrive as I’m determined to make Unicode Font Hack to work and make International Kindle truly international.

I bricked one Kindle a while back when I was creating the original Unicode Font Hack and succeeded on the second attempt. I hope that with international Kindle this will also be the case…

Related Posts

• October 30, 2009 -- Unicode Font Hack v0.2, now for Kindle International too! (41)
• October 30, 2009 -- Kindle anti-brick hack (5)
• March 1, 2009 -- Kindle 2 Disassembled (0)
• September 18, 2008 -- Hacking the kindle. (0)

from iKindle3GS.EU

iReaderReview reports interesting piece of news. Someone has started a project to hack the Kindle for use with European wireless networks.  It looks like they’ve already managed to switch the modem and add a SIM card, but haven’t yet figured out the software end of the mod.

If you want to make your Kindle’s hardware compatible with European networks, the process seems fairly straightforward.  Just take the device apart, add the above mentioned pieces to the puzzle, and zip it back up.  But be warned: you won’t actually be able to use wireless until someone releases the requisite software hack.

A fun fact from the project: the hardware is designed in a way that adding your own SIM card is ridiculously easy.  Some would even argue that the Kindle was actually meant to be modded for Europe.  I find it unlikely that Amazon had hackers in mind, but they probably did design the device with Europe somewhat in mind.  Once the Kindle does hit Europe, the hardware will be more or less ready to go without any real changes in the manufacturing process.

Related Posts

• October 12, 2009 -- International Kindle may come to Canada and New Zealand soon (5)
• September 25, 2009 -- iRex Gets Verizon As 3G Carrier (1)
• September 23, 2009 -- Sony Reader Touch/Pocket vs. Kindle (2)
• August 28, 2009 -- iRex Reader Will Also Use Barnes & Noble’s Platform (0)

Currently I’m releasing hack with two different fonts: Liberation that comes from RedHat Linux and Droid that comes from Google Android project. Both fonts are open-source and they are the best ones I could find that suit the needs of this hack. Finding good fonts was much harder than creating the hack itself.

Instructions and download links can be found here. Please-please-please-please-please do be very-very-very-very-very careful if you decide to experiment with adding your own fonts to the hack. If you find good free or reasonably priced fonts that work – please let me know – I’ll test them and make more versions of the hack available here and give you proper credit. Please spread the word about this hack as it will increase chances of someone finding better fonts that can be used with it.

Here are some screenshots of what Kindle 2 with hacked fonts looks like:

…

I would like to thank John, Ted and some other folks for helping me test this patch. Another big thank you goes to Igor who created the python script that creates Kindle 2 update packages.

I’ll now shift my attention to figuring out creating custom recovery mode updates. Once this is done – I’ll have much more freedom in messing with fonts and other settings without fear of bricking my Kindle 2.

Related Posts

• June 21, 2009 -- Unicode Font Hack for Kindle DX (9)
• June 19, 2009 -- Unicode on Kindle DX via PDF (6)
• April 2, 2009 -- Cyrillic Kindle – Beta testers needed! (40)
• September 5, 2010 -- Mangle: Manga Meets the Kindle (3)

Before you continue with instructions below, please understand that you are doing it at your own risk and this can potentially void your warranty. On the bright side, the update seems small, straightforward and reversable and several people (myself included – see pictures below) have successfully applied it to their devices.

Important thing to remember is that this update changes some configuration files. Official Amazon updates verify file checksums before installing. So while you have this hack installed updates that would try to change the same file will fail. Solution is to reverse this hack (instructions below), apply Amazon update and then reapply the hack.

Before proceeding you may want to take a look at “Updating Kindle Software Post” and make sure that you have the most recent software on your Kindle.

To enable custom screensavers:

1. Download kindle_screensaver_hack-0.3.zip. This seems to the latest version now and I’ll try to keep this post updated with more versions as they become available.
2. Unpack it.
3. Connect your Kindle to your PC via USB. Go to the Kindle drive (usually K:\)
4. If you don’t see system folder, you need to configure Windows to show hidden files and folders. Otherwise go the next step.
5. Go to the \system folder and create screen_saver subfolder in it.
6. Copy all of the images you want your screensaver to randomly cycle tough. Both PNG and JPEG formats are OK. While Kindle will resize images it’s best to resize them to 600×800 beforehand. Definitely don’t try putting 10 megapixel photos from your camera there as screensaver would then take long time to load and image will not display right. Good freeware tool to edit images is Paint.NET
7. Copy Update_kindle2_user_screen_savers.bin that you’ve unpacked in step 2 to the root directory of your Kindle 2.
8. Unplug the USB cable.
9. Press “Menu”, select “Settings”, press “Menu”, select “Update Your Kindle”.
10. It normally should take under a minute to update and reboot your Kindle. And you’re done!

If you did everything right you should see the following in at the bottom of your settings screen.

…

…

To revert to standard screensavers:

1. Connect your Kindle to your PC via USB. Go to the Kindle drive (usually K:\)
2. Copy Update_kindle2_restore_default_screen_savers.bin to the root directory of your Kindle 2.
3. Unplug the USB cable.
4. Press “Menu”, select “Settings”, press “Menu”, select “Update Your Kindle”.
5. It normally should take under a minute to update and reboot your Kindle. And you’re done!
6. If you want to disable custom screensavers for good rather than temporarily disable the hack to install Amazon Update, you may want to delete the \system\screen_saver directory you’ve created before. Be extra careful not to delete anything else in the \system directory!

Wikimedia.org may be a good place to stock up on nice copyright-free images.

If you try this hack, please take a minute to post your experience in the comments as I”m sure most people who read this post will be interested in them.

Related Posts

• October 30, 2009 -- Jailbreaking the International Kindle (7)
• June 22, 2009 -- Kindle DX Screensaver Hack (4)
• March 11, 2009 -- Kindle 1 Screensaver Hack (5)
• October 5, 2009 -- Solution for cracked Kindle problem (1)

• Some basic tools and skills to use them (don’t try this if you don’t know what are you doing;
• “A” tip and pigtail for it (available from RadioShack)
• USB cable that will be converted into charger (any USB cable that you can spare will do)
• Optionally, a shrink-tube if you want it to look neat.

In the end you’ll have a cable that can be used to charge your Kindle1 from any PC or Mac with USB port or any other universal USB power adapters available on the market. Please use these instructions at your own risk.

Related Posts

• September 9, 2009 -- Make Your Own Kindle Case That Doubles as a Stand (0)

It took Microsoft Zune more than a year to put a Unicode font in the firmware (even considering that Zune is a Windows Mobile-based device, and Windows Mobile had proper Unicode support for ages). This is why I don’t believe we would see Unicode support in official firmware updates from Amazon and Kindle community would be better off helping themselves.

Related Posts

• September 4, 2009 -- Kindle 2 Hacked to Run Ubuntu (1)
• April 7, 2009 -- ePub and PDF support (8)

• Battery used is 3.7V 1530mAh Li-Pol battery model number S11S01A. It weights 1.1 oz which is 10% of total weight of the device. It has slightly less capacity than iPhone 3G battery which is 1400mAh. Freescale MC13783VK5 is used as a battery power management chip.
• There is no protective cover on the display. So if you scratch it or break it repairs would be quite expensive.
• Main processor used is MCIMX31LVKN5C M91E CTAH0850V. It is ARM-11 CPU that runs at 533 Mhz and is manufactured by 90nm process. This is an upgrade from Kindle 1 which used 400 Mhz Marvell PXA255 CPU marked with LUPXA255A0 G7171929.2 0744 KR C400.
• RAM is represented by 128MB DDR Samsung K4X1G323PC chip. This is an upgrade compared to 64MB RAM found in Kindle 1.
• Flash memory is 2GB moviNAND. Major upgrade from 256MB built in Kindle 1, but as we know it comes at a cost of not having external SD slot.
• There is unused space on the PCB for SIM card. This hints to possibility of international versions of Kindle.

We’ll probably get much more comprehensive coverage on Kindle 2 once Igor from Reversing Everything gets his hands on one.

Related Posts

• June 15, 2009 -- Kindle DX Disassembled (0)
• August 28, 2010 -- New Kindle 3 Review (hands-on) (44)
• October 30, 2009 -- Unicode Font Hack v0.2, now for Kindle International too! (41)
• October 30, 2009 -- Kindle anti-brick hack (5)

So here you go: you can now send and receive emails using your Amazon Kindle anywhere there is WhisperNet (read Sprint) coverage absolutely free of charge courtesy of Amazon :)

Related Posts

• November 25, 2009 -- Instapaper + Kindle Problems Find A (Free) Solution (5)
• October 12, 2009 -- Browser And Blogs Update for Mexico, Hong Kong and Japan (4)
• March 12, 2009 -- Kindle 2 Features I would love to see (15)
• March 2, 2009 -- 23K+ Free Kindle Books at munseys.com (0)

• Minesweeper can be started by pressing Alt-Shift-M in the home screen.
• Picture viewer is hidden within Kindle 2. To activate it connect Kindle via USB cable to your PC and create “pictures” folder in Kindle USB disk. Create subfolders there and copy pictures. Subfolders will become “book” names and pictures will be pages. JPG, PNG and GIF files are known to be supported. Once you’ve copied the files, disconnect the USB cable and press Alt-Z in the home screen – you should see your picture folders among books now.
• You can take screenshots of almost any screen in Kindle by pressing ALt-Shift-G. Screenshots are stored as GIF files in the /documents folder
• Symbol shortcuts. When entering text folling shortcuts work:
  • Alt-6 – ? (question mark)
  • Alt-7 – , (comma)
  • Alt-8 – : (colon)
  • Alt-9 – ” (double quotes)
  • Alt-0 – ‘ (apostrophe)
• Search commands. Typing @help in the search string will display other supported search commands like @dict, @url etc.
• Hidden settings. While in settings type one of the following:
  • 411 – shows diagnostic data
  • 611 – shows current radio diagnostics data and keeps refreshing it

Sadly, all location based Google maps services in the browser seem to be disabled.

Related Posts

• October 4, 2009 -- Copy-paste for search and notes (5)
• June 11, 2009 -- …First Kindle DX review (8)
• February 25, 2009 -- Received my Kindle 2 (0)

Based on his post in order to see Kindle boot sequence you will have to do some additional electrical wiring. That’s how crude final connected version looks like.

If you want to hack you Kindle you’ll need several things:

- Some electrical engineering education… Or be a hacker in your soul.

- a TTL-RS232 or TTL-USB converter.

- a 20-pin 0.5mm pitch flat flex cable with a connector.

- Strong desire to do it.

Or you can keep it simple and send your Kindle to Igor and ask him to hack it :)

Read his entire post on connecting Kindle to a hacking device.

In the next post I’ll try to cover more aspects on kindle hack process I read about in Igor’s blog. It will include some hidden features and easter eggs you have in your Kindle.

If you have tried hacking Kindle and successfully done so please send details to me. I would love to post about them.

Related Posts

• July 9, 2010 -- Kindle Reading Speed Study: Badly Misunderstood (11)
• June 29, 2010 -- Kindle in the Airports (1)
• June 24, 2010 -- Kindle vs nook: What Do You Get? (12)
• June 16, 2010 -- Kids Books Going Digital (0)

One way of opening a device up is by offering a software development kit (SDK), I was reading k.indled today and the question came, If Kindle had an SDK, What would you do with it?

One thing I would do is add support for the .epub format, I’m not sure if it would be possible because I am no programmer, but I feel that Kindle must support .epub one day, its the industry standard and I think this will get a lot more publishers on board, especially the ones who have a lot of technical content which isn’t easy to render on the Kindle.

I think Amazon will have to eventually open up the Kindle and they should do it sooner rather than later, having an ‘app store’ similar to the iPhone app store I think would go a long way in helping the Kindle attain mainstream acceptance, and it could open up a while host of other uses for the Kindle.

What would you create with a Kindle SDK?

Source: k.indled

Related Posts

• September 28, 2009 -- Opening the Kindle to Third Party Developers (1)
• January 21, 2010 -- Kindle SDK (KDK) to be available next month (10)

From the F-Origin press release:

The functionality and flexibility in design provided by zTouch is the perfect solution for ebooks and other products that utilize PVI’s ePaper displays. zTouch enables users to control book navigation and numerous management functions, such as turning pages, making selections or simply making edits or comments via touch and through gestures and hand writing recognition. The ease of use and high-functionality of zTouch are an ideal match for eBooks by PVI.

From the separate PVI press release:

When a user touches the display, proprietary software calculates the location and intensity of the touch with input from the sensors. There is no additional layer of materials on top of the display as there is in traditional touch technologies; as such, there is no impact to the reflective qualities of the display. This technology requires no ITO (the most fragile component in traditional touch panels), hence exhibits superior robustness. Unlike capacitive touch panels which requires the touch medium be conductive (such as a finger), this force sensing technology works with either stylus or fingers

You can read the full accompanying press release from PVI’s perspective on their website and you can read up on the zTouch 3.0 Technology [PDF warning] with this product information guide provided by F-Origin.

What does this mean? will the next Kindle offer a touch screen interface as standard? The Kindle isn’t mentioned by name by either PVI or F-Origin in the press releases, but its hard to see this technology not making it onto any future incarnation of the Kindle. These certainly are interesting developments and would strongly suggest that Amazon is working on a Kindle v2.

Source: Teleread

Related Posts

• June 2, 2009 -- eInk Corporation Acquired by PVI for $215 million (0)
• August 19, 2008 -- PVI expects 10x growth in EPD market over next three years (0)
• August 30, 2010 -- Kindle 3 Positive Reviews Summary (0)
• April 28, 2010 -- Changing the Feel of Kindle (1)

Frank sent me an email about his experiences with the Kindle and how had modified it to create a better reading experience. Here is what Frank thinks about his Kindle:

The Kindle met 95% of my expectations for a perfect reading device. I spend 3 – 5 days each week either on a plane or waiting on a flight. The Kindle has reduced my carry on weight by at least 5lbs of reading material. I am very satisfied with the display and easy access to obtaining reading material but the holder and all aftermarket cases left a lot to be desired. Not only were they uncomfortable to hold but made it impossible avoid that giant next page key and the device easily falls out, especially when reading in bed.

Not satisfied with 95%, I made my own personal cover with a metal clip and a flexible binding that allows the cover to be folded back flat allowing the Kindle to be held on either side.

Thanks for the email Frank!

If you have an image that you would like to submit for Kindle Photo of the Day, then please get in touch! you can send the image via email to - please make sure you include your name and a link to your site.

Related Posts

• March 4, 2008 -- Hand Made Kindle Case Mod Made to Look Like a Book (4)

As it turns out, not only can you read books on your Kindle, you can now eat it!

LilPeaPod from Team Sugar spent her Sunday afternoon cooking up this geeky cake delight and what a result. At first glance it actually looks like a Kindle device, we think it’s a shame it has to be eaten!

Looks delicious! We love the “Kindle Kake”! Check out the cake gallery.

Source: TeamSugar

Related Posts

• July 9, 2010 -- Kindle Reading Speed Study: Badly Misunderstood (11)
• June 29, 2010 -- Kindle in the Airports (1)
• June 24, 2010 -- Kindle vs nook: What Do You Get? (12)
• June 16, 2010 -- Kids Books Going Digital (0)

Believe it or not the above picture is not that of a fine old book, but rather a modified case cover for the Kindle! This beautiful piece was made by a user on the mobileread Kindle forum, it features a hand made leather book case, marbleized paper for the end papers, gold leaf to give the impression of gilded pages and a felt-lined holder which keeps the Kindle securely in place. You still don’t believe me do you? in that case I suggest you scroll down the page and have a look at other the images.

Whilst it does look pretty, a few readers on the forums have pointed out that there seem to be some usability issues. For instance on this particular case-mod the cover does not fold back upon itself which may cause readers to use both hands whilst reading content, however the creator of the case mod assured them that it is not a big issue. I guess the only way of telling if it affects usability is by actually using it.

This case-mod simply blows the standard case you get with the Kindle out of the water, or for that matter any other case out there. I think a commercial venture which would offer this to Kindle owners would be an excellent idea, apparently this case-mod it has already fooled some people into thinking that it is a real book!

Now here are some more picture for you to drool over:

Source: user artsci on mobileread Kindle forums

Related Posts

• September 9, 2009 -- Make Your Own Kindle Case That Doubles as a Stand (0)
• July 17, 2009 -- Amazon to Replace Broken Kindles After Lawsuit (14)
• May 21, 2008 -- Kindle Photo of the Day #20: Frank’s Kindle (0)
• December 16, 2007 -- Kindle Being Lent Out By Librarys (1)