Block OTA by removing ota related binaries

[hius07]

Even with the correct update file in the internal storage Update Your Kindle button remains greyed.
So some protection exists, we hope.

[cronot]

Originally Posted by hius07

Even with the correct update file in the internal storage Update Your Kindle button remains greyed.
So some protection exists, we hope.

Point is, with a correct/valid update file on internal storage, even with the Update your Kindle button disabled, the device will most likely update on next reboot.

FWIW, since the previous post I've made a few tests on my freshly jailbroken KT4. Enabling wi-fi with the ota* binaries on stock and running, the root of internal storage would start filling up with an update*.partial file within seconds of enabling an internet connection. Enabled airplane mode, connect USB to PC, deleted the update*.partial file, then ran the script from your extension to rename the ota* services, rebooted, reenabled wi-fi, and no update*.partial file shows up. For good measure, rolled back the renaming to stock, rebooted, and again the update*.partial shows up within seconds of the kindle getting an internet connection. Ran the script for a final time, rebooted, and there's no update.partial file to be seen for quite a while and counting.

But again, I'd be more comfortable if more people would test this.

[hius07]

Good to know, thanks.
What is the full name of this temporary file? Does it have some random symbols?
It's a pity that old good method of the update.bin.tmp.partial folder doesn't work.

[cronot]

Originally Posted by hius07

Good to know, thanks.
What is the full name of this temporary file? Does it have some random symbols?

Nope. Just update.bin.tmp.partial , as usual.

The finished file (if I wait for OTA do download it) has some seemingly random text at the end that kinda looks like a GUID, but with the first part apparently always the same. Here's what those finished files looked like after I let OTA finish downloading update files twice:

update-3692520026-96e812dc-4b7f-4e20-96dd-5cbb7a91af12.bin
update-3692520026-ecfb5355-6007-4b0b-a8d5-1d892719a050.bin

The part after "3692520026" was consistent across finished downloads, so my guess is that "3692520026" is an ID that would uniquely identify a FW version for a given device model. The rest after that really looks like a GUID, and I can't think of a good reason for that to be there.

[cronot]

Originally Posted by cronot

Nope. Just update.bin.tmp.partial , as usual.

Btw, I've just realized what you meant. Yes, I've muddied things by saying "update*.partial" before, sorry. At the time I didn't quite remember the full name, that's why I've written it that way.

[hius07]

Originally Posted by cronot

Nope. Just update.bin.tmp.partial , as usual.

The question is why creating the update.bin.tmp.partial folder doesn't prevent creating temporary download file with the same name on newer firmwares? Can we protect this folder against forced deleting by the system? Maybe, creating some files inside it and chmod them?

[cronot]

Originally Posted by hius07

The question is why creating the update.bin.tmp.partial folder doesn't prevent creating temporary download file with the same name on newer firmwares? Can we protect this folder against forced deleting by the system? Maybe, creating some files inside it and chmod them?

That wouldn't work with the filesystem used (vfat). Any file or folder you create there is chmod'ed to 0777, and trying to change that by chmod yourself yields no change. I think I read somewhere here, someone suggested at some point reformatting that partition or part of the internal storage to ext3 so you can get more fine-grained control over permissions on the exported internal storage, but that's a big change on the underlying system with a lot of room for causing operation problems with the Kindle UI and its inner workings in general. And if we're talking about meddling with partition formatting, then we're talking about only rooted devices, which throws out the window the only advantage the dummy file/folder hack has over disabling the OTA service, which is that it work(ed) on non-rooted devices.

[NiLuJe]

IIRC, @knc1 tried to play with FAT attributes to enforce the partial as ro, and that didn't help either.

(I may be entirely misremembering that. I also don't remember if the fatattr tool is shipped by default).

[j.p.s]

Originally Posted by hius07

The question is why creating the update.bin.tmp.partial folder doesn't prevent creating temporary download file with the same name on newer firmwares? Can we protect this folder against forced deleting by the system? Maybe, creating some files inside it and chmod them?

I think the reason is in the posts by NiLuJe quoted below.

Originally Posted by NiLuJe

Note that the "Prevent OTA updates" button in the Helper extension does just that, so it may help.

It will NOT on 5.12, as this one appears to have taken the bull by the horns and decided to workaround the issue by forcefully removing the block folder and stop supporting SKIP_UPDATE_CHECK .

Originally Posted by NiLuJe

@hius07: https://www.mobileread.com/forums/sh...&postcount=477 & https://www.mobileread.com/forums/sh...1&postcount=80

@j.p.s: You don't even know how right you are ;D. It's indeed a hardcoded rm -rf system() call .

All of that is in one of the ota* *binaries*, I can't remember the exact one OTOH, probably otaupv3 or something.

You'll need a < 5.12 version to compare to, of course .

[cronot]

Originally Posted by NiLuJe

IIRC, @knc1 tried to play with FAT attributes to enforce the partial as ro, and that didn't help either.

I just tried that here just for kicks, even spiced it up by setting system and hidden attributes along with readonly. It didn't matter. It seems that the update.partial file is removed after a reboot, and recreated by the OTA service once it starts downloading stuff, and if you setup the dummy file with the attributes, enable internet and let things run for awhile without rebooting, it seems the OTA service will still happily write to the file completely bypassing the attributes (i.e., the file keeps the system/hidden/ro attributes, but is still clearly written to since its size keeps increasing as OTA is downloading).

Originally Posted by NiLuJe

(I may be entirely misremembering that. I also don't remember if the fatattr tool is shipped by default).

On the kindle, you mean? Yes, just tried it here also, it's part of busybox, so it's there, but again, even if fumbling with attributes worked, at that point we'd be restricting ourselves to rooted devices, and for that I think disabling the OTA service as per the OP is a more robust solution.

[NiLuJe]

I never really looked into it, but I don't recall seeing fatattr calls (unlike the rm one @j.p.s reminded me of ;p).

But what might be happening is something playing with the actual filesystem instead of the fuse proxy, or vice-versa. Do try blocking both /mnt/us/whatever and /mnt/base-us/whatever, see if that changes anything.

That, or they're playing with the attributes in C ;o).

[jp12323]

I extracted the KO2 5.13.3 firmware update file and took a look in IDA at rootfs.img\usr\bin\otav3 file and found the function where they detect a non valid "update.bin.tmp.partial" file:
https://i.imgur.com/mHu1vzU.png
The first if just checks if it can lstat read the update file. The second if statement seems to be where it finds a "non regular file".

I think stat_buf.st_mode & 1 needs to equal 0 for the function to return 0 (aka success). But I don't linux well so idk if we can change the st_mode for our update file, I have 0 clue about vFAT and linux in general.

Also found the function that is in charge of deleting the file:
https://i.imgur.com/HxLh73S.png
If only we could pack a custom ota file, we could probably just nop parts of the function out. Altho idk what side effects there'd be, seems like a messy solution and can't xref the function to the calling function.

This info is prob useless, but just thought I'd post

[jp12323]

Not sure where the edit button is, but I wanted to point out that I'm unsure what value that the return value needs to be to return successfully. Thought it was 0 at first, but realized that the func returns 0 in the first if statement block, when lstat fails

Also take anything I say skeptically, cause idk much, other than windows binary reversing

[lrpirlet]

I am running 5.13.3 on my pw3 kindle... I keep my kindle on airplane mode to avoid the "nice" Amazon "automatic update".

(I think of that as an unbearable intrusion on my private life... I accept to consider that the software on MY kindle is only made available to me... I refuse to admit that it gives ANYONE BUT ME the right to change the said software... you dictator Amazon... but that is another story, excuse the rambling)

Of course, this attitude from Amazon prevent me to get any book from Amazon, unless of course I can control MY KINDLE. I downloaded the "renameotabin.zip" file, unpacked it and copied it in the extentions folder in my kindle...

KUAL now has a new "rename OTA binaries" entry. Inside it, I activated the Rename, the kindle rebooted...

I verified that both the *ota* files are renamed and the no *ota* process exists... I did get out of airplane mode, waited a few minutes, the folder named "update.bin.tmp.partial" was still a folder... So I synchronized the kindle with my account in Amazon, and it did so, but did not try to download any update.bin...

So A BIG THANKS for this. (needless to say, the kindle is back in airplane mode)

[gamzone]

Originally Posted by lrpirlet

I am running 5.13.3 on my pw3 kindle... I keep my kindle on airplane mode to avoid the "nice" Amazon "automatic update".

(I think of that as an unbearable intrusion on my private life... I accept to consider that the software on MY kindle is only made available to me... I refuse to admit that it gives ANYONE BUT ME the right to change the said software... you dictator Amazon... but that is another story, excuse the rambling)

Of course, this attitude from Amazon prevent me to get any book from Amazon, unless of course I can control MY KINDLE. I downloaded the "renameotabin.zip" file, unpacked it and copied it in the extentions folder in my kindle...

KUAL now has a new "rename OTA binaries" entry. Inside it, I activated the Rename, the kindle rebooted...

I verified that both the *ota* files are renamed and the no *ota* process exists... I did get out of airplane mode, waited a few minutes, the folder named "update.bin.tmp.partial" was still a folder... So I synchronized the kindle with my account in Amazon, and it did so, but did not try to download any update.bin...

So A BIG THANKS for this. (needless to say, the kindle is back in airplane mode)

Hello !

Actually, I'm running Firmware 5.12.4 on "G090VB, Kindle Basic 3 (2019) Kids Edition, KT4, KT4KE" and I want to use wifi (for registered my Amazon's account and for send email with pdf/epub to my Kindle).

At this moment, i never use wifi (only airplane mode).

So, someone could help me please ?

For information, actually i already did this :

1) Jailbreak (with "kindlejailbreak")
2) Use "Jailbreak Hotfix"
3) Install "kual-mrinstaller-1.7.N-r18392.tar"
4) Then install "Update_KUALBooklet_44a61b6_install.bin"

And after that, like you said, i did this :
1) Download "renameotabin.zip"
2) Copy with my PC the folder "renameota" in the folder "extensions" of my Kindle
3) Launch on the Kindle the app "Kual", then "Rename OTA binaries" and then "Rename" (ps: because i do not sure to understand why we have a button "Restore").
4) Like you, my Kindle reboot just after I touch "Rename"

and finally....nothing for me !

In fact, before i use Wifi for the first time, someone can explain to me what does the end of the previous message of "lrpirlet" means please ?

PS: Because i do not see *ota* files, neither a " folder named 'update.bin.tmp.partial'" in my Kindle (and I do not want to loose the jailbreak)

Thank you very very much in advance for your help !