home

Kindle hacking

PW5:

Goals:

  • HW UART
  • U-Boot CLI
  • UART Linux shell (require jailbreak)
  • Reverse engineering of unlocking mechanism
  • eMMC interposer (v2 needed!!)\ \

Overview

In the new Kindle PW5, Amazon started using different CPU from previous models. Kindle PW5 is using Mediatek MT8113, bundled with 512Mb RAM.

All production devices are locked, which means you cannot use u-boot CLI because on a locked device there is forced execution of the fastboot command followed by the boot command when you try to access u-boot CLI.

With the u-boot in fastboot mode, it is possible to obtain some magic string via getvar command that can probably be used to generate unlock key. Unfortunately, that cannot be verified (yet), because there are some source codes missing. Amazon also removed debug UART connector from the PCB. On the production devices, the UART Linux shell is disabled.

28-10-2022: If u-boot fails to load the kernel from eMMC, it enters fastboot.
03-11-2022: If is used another eMMC on which the content of the previous is copied the ROM bootloader fails to load u-boot.

Getting UART

I suspected that there has to be UART somewhere, so I ordered yet another Kindle :) and started probing test pads on the bottom side of the PCB. This, unfortunately, led nowhere and only a couple of I2C buses were discovered that way.

The next step was to look into [source codes](https://www.amazon.com/gp/help/customer/display.html?nodeId=200203720) released by Amazon thanks to the GPL license.

In the u-boot source, there is code for [MAX20342](https://datasheets.maximintegrated.com/en/ds/MAX20342.pdf) which is a USB type C detector IC for detecting different types of chargers, it also features USB C debug accessory mode (DAM) [USB Type C specification pg. 314](https://www.usb.org/sites/default/files/USB%20Type-C%20Spec%20R2.0%20-%20August%202019.pdf) in which all some data pins can be used for non-USB purposes such as JTAG debugging.

In the datasheet for MAX20342 is stated that the IC will enter DAM if it senses 5.1kΩ pull-up resistors on CC1 and CC2 pins and 30/150kΩ pull-down resistors on one of the SBU pins.

Upon entering DAM mode MAX20342 connects the USB D+ and D- pins of the connector to the UART of the MT8113.

Configuration registers can disable this feature, but right now, they are at factory default (ver. 5.14.2)

Be aware of the 1.8V logic levels of the UART and don't try to connect 3.3V logic levels UART converted<![fetch.jpg](/images/384174147 =100%x*) as you can damage your Kindle.

There is a photo of such contraption:

  • On the PCB there is the FT232 USB to UART converter and buck regulator to generate 1.8V for powering the VCCIO pin of the converter.
  • I also tried the CP2104 and CH340 converters, but they are struggling to run with 1.8V power for IO pins.

fetch.jpg

Getting UART Linux shell Currently, I have no method to enable the UART shell on the production device. The only possible way is to jailbreak your Kindle by the method provided by MobileRead forum member katadelos In order to enable the UART root shell, you need to do two things:

  • Modify /etc/shadow file to enable the root account.