Anyone want to help make a new JB for 5.15.1.

[Averagekindlefan]

I’m going to find a chain for webkit, can someone help implement
I have a jailbroken pw5 se, running 5.15.1. Can someone help test on a 5.15.1 non jb kindle. I am thinking of either uaf or oob write for the 1st part.

[naulels]

Originally Posted by Averagekindlefan

I’m going to find a chain for webkit, can someone help implement
I have a jailbroken pw5 se, running 5.15.1. Can someone help test on a 5.15.1 non jb kindle. I am thinking of either uaf or oob write for the 1st part.

any risk?

[Averagekindlefan]

Originally Posted by naulels

any risk?

Not much, probably <1% brick chance. WebKit seems promising. The version is ancient, and from 2010.

[darkassassinua]

If u already have instruction and files - provide me in dm, i`ll post it on 4pda.to,maybe i found few folks to test it

[reminon]

Seems more risky that it would allow an update to be downloaded, unless you plan to self host or can block all the update servers.

[Averagekindlefan]

Originally Posted by reminon

Seems more risky that it would allow an update to be downloaded, unless you plan to self host or can block all the update servers.

I will make a version for 5.15.1 and another for 5.15.1.1+. It might be possible to bypass the airplane mode dialog by using mesquite and breaking out of the waf sandbox, and completely bypass any hurdles with the ota updates. If someone has access to the private build of mesquito that allows higher privileged wafs, pls dm me. I will attempt to virtualize the kindle fw in QEMU, so I can test without a physical device. and making bricks impossible during testing

[Averagekindlefan]

Originally Posted by darkassassinua

If u already have instruction and files - provide me in dm, i`ll post it on 4pda.to,maybe i found few folks to test it

need help with finding webkit exploit. the webkit is so old i cant even find one.

[Averagekindlefan]

webkit ver is from 2009-10. 531.2 is the ver. all the exploits i could find were atleast 3 years newer. maybe i could use mesquite and break out of the sbx

[Averagekindlefan]

If I could chroot into another kindle rootfs that would be fun XD

[Averagekindlefan]

i'll try to find interesting things in the 5.15.1 and 5.15.1.1 ota pkgs.

[solidgun]

Subscribing here to get in line for the 5.15.1 JB updates.

[s2kaka]

My kindle is on 15.1.1. FW
Looking for JB for it
Thanks

[a632079]

My device is PW5, FW is 5.15.1.1. I could join this test.
Waiting for your good news, thx.

[dcs]

Originally Posted by Averagekindlefan

webkit ver is from 2009-10. 531.2 is the ver. all the exploits i could find were atleast 3 years newer. maybe i could use mesquite and break out of the sbx

I've done some security research on the Kindle for Amazon's bug bounty program. As you say you're not going to find any working exploits for Amazon's webkit implementation since its so old. You're better off looking into old Webkit CVEs and writing your own exploit.

I wouldn't bother emulating the device in QEMU. The kindle ships with gdb/gdbserver on the device which you can use to debug the browser, assuming you have set up telnet/ssh access.

After that you will need to escape the (relatively weak) browser sandbox and escalate to root. If you have specific questions feel free to reach out but I'm not looking into the kindle much anymore and may not be very timely to respond. Good luck!

[Bluebotlabs]

Originally Posted by dcs

I've done some security research on the Kindle for Amazon's bug bounty program. As you say you're not going to find any working exploits for Amazon's webkit implementation since its so old. You're better off looking into old Webkit CVEs and writing your own exploit.

I wouldn't bother emulating the device in QEMU. The kindle ships with gdb/gdbserver on the device which you can use to debug the browser, assuming you have set up telnet/ssh access.

After that you will need to escape the (relatively weak) browser sandbox and escalate to root. If you have specific questions feel free to reach out but I'm not looking into the kindle much anymore and may not be very timely to respond. Good luck!

Not just that, but Amazon's webkit also contains a ton of custom patches to mitigate a lot of webkit explits (KindleDrip, anyone?)
edit: ok fine, maybe not KindleDrip, but I've lost track of the exploits you honestly can't blame me LOL