Tools Software Jailbreak for PW2, PW3, PW3W, KT2, KV, KOA and KT3

[knc1]

This post is horribly out-of-date.
The dozens of copies and re-writes of this post, posted on the Internet are no better, usually much worse.

The most up-to-date version of these directions should be here:
https://wiki.mobileread.com/wiki/5_x_Jailbreak
Any user of the directions (does not require a membership in this forum or the wiki) can bring it up-to-date when they find something that needs to be changed.
Any user - there is no single person in charge of keeping it up-to-date.

Of course, anything in the Wiki might disappear without warning, discussion, or consultation at the whim of the Wiki moderator(s).
https://www.mobileread.com/forums/sh...d.php?t=293647

Spoiler:

Software jail break for the 6th, 7th, and 8th generation devices listed in the title.
Software jail break for the 9th generation device (KOA2) still requires some work.
The KOA2 "hotfix" package does not auto-reinstall the jail break. No ETA on a resolution.

Step #1 below describes how to learn what nickname your device has here based on its serial number.

Will this jail break work on my current firmware?
If the third field of your firmware version number: 5.8.7.0.1 is larger than 7 this jail break will not work on your device.
That means it will not work on: 5.8.8, 5.8.9, 5.8.10, ..., 5.8.99999999.
Please do not even think of asking if this message still means what is written. The message is kept current.

There is a single, complex, special case for 5.8.9.0.1 firmware version. If you get a Kindle with that firmware version, please just post in this thread before you do anything to it, your device **might** be one of the rare exceptions.

If jailbroken on an earlier firmware version, the jailbreak is known to survive the update to either 5.8.8, 5.8.9, 5.8.9.2, 5.8.10, 5.8.11.
Untested with an update to 5.9.2
It should survive an update to any firmware version. It is designed to be viral.

None of our add-ins are protected across updates, you must always re-install them.

The G090LK, G090LL (Black and White, PW-3, 32GB, Wifi only) models along with the corresponding two Wifi+3G versions are partially supported.
See: https://www.mobileread.com/forums/sh...d.php?t=291336

Testing (touchscreen devices listed in title):
Attached below is a "Dummy" installation package which will test the jail break installed on your device.
If it runs, your JB is complete. If it fails to run, your JB is missing or damaged.
This dummy install package will not install anything, only write a report document in the top level of visible USB storage (dummy_updatetest.log, example attached below).
If this test package fails to write its report, follow these directions exactly and completely Step #0 to and including Step #8.

Spoiler:

1. Download the attached archive.
2. Open the archive.
   The archive contains a single directory, "Dummy", all contents are in that directory.
3. From the archive contents in the "Dummy" directory, move the file: Update_dummy_0.0.N.bin to the /mrpackages directory of your Kindle.
   If you do not have a /mrpackages on the visible root of your kindle, you either have a damaged JB or the JB was never installed.
4. Trigger the test package installation either from KUAL or from the main search bar:

   ;log mrpi

   command. Only expect the search bar command version of triggering MrPI to work on the devices it was intended to work on, the 8th. generation devices.

PW-2 users running firmware 5.4.4.2 or older, go directly to:
PW-2 Early firmware versions, jail break

For prior (grayscale) Kindle models, see:
Legacy devices, jail breaks

Credits:

Spoiler:

• NiLuJe - for discovering the initial factory update could be recovered. PW-2
• knc1 - for posting the 'HowTo' and recovering the KT-2 and PW-3 initial updates.
• Forum members - several members who recovered and provided initial update images for the KV.
• knc1 - recognition that the factory initial update could be re-installed on any (matching) customer model.
• Branch Delay - the original software jb for version 5.6.5 and the generic jb for initial factory images.
• Branch Delay, NiLuJe, Geekmaster - initial testing of the method.
• Geekmaster - archivist of the off-site Kindle recovery resources.
• knc1, Geekmaster, NiLuJe, kindlefere - server resources.
• NiLuJe, Ryccardo, eschwartz - recognizing and testing of the source of the hung Kindles problem.
• Forum member - who recovered the image required to create Oasis support.
• eeeee - who recovered the image required to create updated, PW-3 and PW-3W support.
• ktwombley - who recovered the image required to create KT3 support.
• eschwartz - now the maintainer of Branch Delay's factory image jail break.
• eschwartz, NiLuJe, others - New menu launcher for Oasis (KOA) and other models.
• The first public announcement was made by Hackaday, see:
  https://hackaday.com/2016/07/09/a-ja...-every-kindle/
  Which can take credit for many of this thread's views.

A long list of a lot of work done over a period of more than a year. Work that is continuing.
This downgrade attack did not happen over-night nor was it the work of any one person.

Release Policy:
It is our policy to use a 'single point of maintenance' model for our released items, with one exception:

• NiLuJe's snapshots, use: (filter prefix: tools, show threads).
  Users should always check the snapshot thread for the most recent build of our after-market add-ins.

Make Ready:
Consider the following bullet list a "Step #0" that can be done in any order.

• For some firmware versions, your Kindle must be registered with Amazon to access the required menus.
  • The general rule to cover all versions, is: If not yet registered, do that now.
    Read the rest of this specific section before connecting to the Internet.
  • Some of the more recent firmware versions are very aggressive about doing an OTA (Over The Air) update.
    Which will currently update to a version that can not be jail broken.
  • Currently the best way to avoid OTA updates is to add the OTA blocker directory (folder) name to the top level of visible USB storage.
    The blocker directory is named: update.bin.tmp.partial
    Use that exact name, no additional extension, no contents.
• Remove any device passcode or parental control passcode you may have set.
• If you have an ad supported (Special Offers) model consider unsubscribing it at your Kindle account.
  If you do unsubscribe from special offers, be sure to give your Kindle enough time on-line for Amazon's servers to update its local status files.
• Is your Kindle fully charged?
  Get started with that now, put it on a wall charger to be certain.
• Only do one step at a time.
  They are intended and designed to be done one at a time.
  At the completion of a step, if the file you previously put at the top level of visible USB storage is still there, remove it.
• Your Kindle should remain off-line (in airplane mode) during this procedure.

Step-by-Step:

1. Positively identify the nickname of your Kindle model from the serial number.
   Use four of the first six characters, older Kindles: xxxx xx, newer Kindles: xx xxxx in this table:
   Serial Number Nicknames
   The factory images **are not** model locked, your care taken with this step is your Kindle's only protection! If not found in the table, STOP HERE and tell us.
2. Prepare your Kindle for running an earlier version of the firmware.
   The Kindles have two user storage areas, the one seen over the USB cable and a hidden one.
   The process that wipes the hidden one will also wipe what can be seen over the USB cable.
   
   Spoiler:

   • Make backup copies of the contents of /documents
     You are about to wipe them all out, if you have them pushed to your Kindle's cloud, you should be covered.
     You should not need copies of the contents of /system - the 'system' should re-build them for you.
   • Do not copy the contents of /documents back to the Kindle until after you have returned to the same firmware version that you copied them from.
     The indexer might go crazy if you try anything else than 'back to same place, with same version running'.
   • You are about to lose all personalization of your kindle.
     You can't reach that hidden directory they are stored in and it is this database that causes most of the problems, so it MUST go.
   • Home -> Menu -> Settings -> Menu -> Reset
     Or whatever the path is on your current firmware version.
     This is the infamous "Reset (to factory defaults)" menu choice, but in this case it is a requirement, a must use entry.
     
     This is the ONLY TIME you should ever use the Reset menu entry in the lifetime of the device because it wipes out the jail break survival code that is about to be added in step 6 below.
   
   NEVER AGAIN USE THE "Reset" MENU ENTRY.
   Never, ever, unless you intended to wipe out the jailbreak survival code. Which you really, really, need.
   
   If you should happen to trigger the "Reset" action by accident (nobody does it intentionally after reading the above), you can find a package on coplate's snapshots thread that will restore the jailbreak survival code you just destroyed.
   The special purpose package linked above is placed in the root of visible USB storage and run using UYK menu entry.
   It is intended to install without MrPI even on customer firmware builds as recent as the 5.8.10 version.
   
3. Download your model's initial factory firmware image to your computer from one of these (IPv4 only) links.
   The *.md5 validation file may be used to confirm that the download was complete and correct.
   • Primary (Confirmation panel but no wait delay.)
     
     Spoiler:

     • KOA
       factory_KOA_5.7.4_initial
       factory_KOA_5.7.4_md5
     • KV
       factory_KV_5.5.0_initial
       factory_KV_5.5.0_md5
     • KT3
       factory_KT3_5.8.0_initial
       factory_KT3_5.8.0_md5
       
     • KT2
       factory_KT2_5.6.0_initial
       factory_KT2_5.6.0_md5
     • PW3
       factory_PW3_5.7.4_initial
       factory_PW3_5.7.4_md5
     • PW2
       factory_PW2_5.4.3.2_initial
       factory_PW2_5.4.3.2_md5
   • Secondary
     
     Spoiler:

     • KOA
       factory_KOA_5.7.4_initial
       factory_KOA_5.7.4_md5
     • KV
       factory_KV_5.5.0_initial
       factory_KV_5.5.0_md5
     • KT3
       factory_KT3_5.8.0_initial
       factory_KT3_5.8.0_md5
       
     • KT2
       factory_KT2_5.6.0_initial
       factory_KT2_5.6.0_md5
     • PW3
       factory_PW3_5.7.4_initial
       factory_PW3_5.7.4_md5
     • PW2
       factory_PW2_5.4.3.2_initial
       factory_PW2_5.4.3.2_md5
4. After validating the downloaded file, transfer the initial factory image from your computer to your Kindle.
   Do not panic if the update is not immediate, it usually takes 10 minutes or longer.
   If there is not a very noticeable delay and when you check USB storage the file has disappeared, that means this method will not work on the firmware version currently installed on your Kindle.
   
   Spoiler:

   1. Connect Kindle to PC with the USB cable.
   2. Place the downloaded update_*.bin file in the topmost, visible level of USB storage (alongside of /documents).
   3. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   4. Remove the USB cable.
   5. Home -> Menu -> Settings -> Menu -> Update Your Kindle
   6. Confirm
   7. Wait
   
   ** The PW-2 is a special case at this point in the directions **
   1. Use the prior 'universal jailbreak' from this post:
      Old Universal Jail Break
   2. After completing those directions, skip the next two steps here and continue with Steps #7 and #8 below.
5. Download and install the current version of Branch Delay's factory firmware jail break.
   This step installs two files, our signature certificate and a 'Jail Broken' document.
   If the 'Jail Broken' document is not on your Kindle in the /documents folder after the completion of this step, then the certificate is not on it either!
   If this happens to you, stop here and post about the problem, there is no reason to continue if the JB is now missing.
   
   The current version is attached to its release post, see:
   Factory Image Jail Break
   
   Spoiler:

   1. Connect Kindle to PC with the USB cable.
   2. Place the downloaded file (an archive - as is) in the topmost, visible level of USB storage (alongside of /documents).
   3. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   4. Remove the USB cable.
   5. Home
   6. Search bar, enter:
      

      ;installHtml

      Press 'return'
      Yes, the semi-colon is part of the search bar command string.
6. Download and install the current 'hotfix'
   The current version is attached to its release post, see:
   Jail Break Survival Code
   
   Spoiler:

   1. Unarchive the release archive package.
   2. Connect Kindle to PC with the USB cable.
   3. Place the Update_jailbreak_hotfix_*_install.bin in the topmost, visible level of USB storage (alongside of /documents).
   4. Eject and/or Safely Remove (term depends on OS) the Kindle, USB storage.
   5. Remove the USB cable.
   6. Home -> Menu -> Settings -> Menu -> Update Your Kindle
   7. Confirm
   8. Wait
7. You can now update your Kindle to a newer firmware version, the jailbreak will survive.
   • Current firmware version by OTA:
     Allow the Kindle to connect to the Internet and wait.
     It will update over the air to the current firmware version
     OR:
   • Manual download from Amazon and install a selected firmware version.
     • To prevent OTA updates, add the OTA blocker directory (folder) name to the top level of visible USB storage.
       The blocker directory is named: update.bin.tmp.partial
       Use that exact name, no additional extension, no contents.
     • You can get any released firmware version from the Amazon download server.
       The following gives direct links to the Amazon USA download server for selected firmware versions.
       
       Note that older versions in some countries, such as Germany, use different builds than the ones in this list.
       In those cases, use instead the download link(s) you would normally use.
       The technique of only changing the numerical version in those URLs to select older versions is expected to work the same as on the USA servers.
       
       It has also been discovered that most recent versions are no longer geographically different.
       The change **might** have happened at about the same time Amazon changed their download organization (@ fw-5.8.5 in this list).
       
     • Amazon
       
       Spoiler:

       • KOA
         customer_KOA_5.7.4_update
         customer_KOA_5.8.1_update
         customer_KOA_5.8.2_update
         customer_KOA_5.8.5_update
         customer_KOA_5.8.7.0.1_update
       • KV
         customer_KV_5.7.4_update
         customer_KV_5.8.1_update
         customer_KV_5.8.2_update
         customer_KV_5.8.5_update
         customer_KV_5.8.7.0.1_update
       • KT3
         customer_KT3_5.8.1.1_update
         customer_KT3_5.8.2_update
         customer_KT3_5.8.5_update
         customer_KT3_5.8.7.0.1_update
       • KT2
         customer_KT2_5.7.4_update
         customer_KT2_5.8.1_update
         customer_KT2_5.8.2_update
         customer_KT2_5.8.5_update
         customer_KT2_5.8.7.0.1_update
       • PW3
         customer_PW3_5.7.4.1_update
         customer_PW3_5.8.1_update
         customer_PW3_5.8.2_update
         customer_PW3_5.8.5_update
         customer_PW3_5.8.7.0.1_update
       • PW2
         customer_PW2_5.7.4_update
         customer_PW2_5.8.1_update
         customer_PW2_5.8.2_update
         customer_PW2_5.8.5_update
         customer_PW2_5.8.7.0.1_update
8. All of the models covered in this thread must use one of the two following installation methods for update_*.bin name format packages.
   The KOA and KT3 owners must use the new installation methods.
   The other device models may use either the old or the new installation methods.
   
   Spoiler:

   1. Any of our after-market add-ins, with an update_*.bin format filename requires the use of the Mobileread Package Installer (MrPI).
      • Get the MR Package Installer from the KUAL and KUAL extensions section of:
        https://www.mobileread.com/forums/sh...d.php?t=225030
      • This is an "un-archive to top level of visible USB storage" package.
        Be sure that the un-archive tool you use has options set to create directories.
      • KOA and KT3 owners:
        You must run the installer with your new, search bar command: ;log mrpi
        Other models covered in this thread may do the same or may run it from KUAL.
   2. Nearly all of our after-market add-ins require an application launcher.
      • Get the KUAL package from the KUAL and KUAL extensions section of:
        https://www.mobileread.com/forums/sh...d.php?t=225030
      • Beginning with version 2.6.40 of the release, the archive contains three (3) different builds of KUAL.
        The 'keyboard' version, the '(old) touchscreen' version, and the new 'KOA, KT3' version.
      • This is not a substitute for reading the README.txt file included in the archive bundle, but ...
        • KOA and KT3 owners:
          You must use the update_*.bin format package of KUAL and you must use the MrPi installer to install it.
        • Other devices:
          The archive still contains the previous 'document' style of KUAL, used by just placing the (correct) KUAL document into the /documents folder of USB storage.
          Note: The new (update_*.bin format KUAL) will run on all touchscreen devices running firmware 5.1.2 or newer.
      • "Nearly all applications require an application launcher" - I was expecting someone to ask . . . .
        KUAL is one of the applications that does not required an application launcher.
        It has a mime type associated with it that tells the system how to run it, when it is selected.
   
   These update_*.bin package name format packages must be re-installed after each firmware update.
   The MrPI application can handle multiple update_*.bin packages at the same time, just put them all in /mrpackages and trigger MrPI.

[geekmaster]

We have at least three confirmations that this method works reliably, including my PW2 (running FW 5.7.4) yesterday, a KV last night, and today another PW2 (running FW 5.8.1) that have jailbreak installed over USB. Announcement was delayed due to some previous brick-causing issues, which we believe have been resolved. As always, follow provided instructions CAREFULLY, and all should be fine (but proceed at your own risk).

Spoiler:

EDIT: [No longer relevant] I think the "10 downloads per week" and "500MB maximum file size" (hence multi-part ZIPs) were temporary due to the bandwidth over-consumption during the "simple debricking" initial craze (before kubrick automated the procedure, with these images built-in). As you can see, one of the new downloads is over 700MB, and no problems so far. Though if you download too many files too quickly, mediafire will want "captcha" confirmation that you are not a bot, and its "captcha" system seems to be broken today. If you experience difficulties with mediafire downloads, use an alternate download link (which may incur server costs for the link donor).

[oblox]

One confirmed PW3 (Wifi) on latest firmware downgraded!

Great work guys.

[jstm]

Great Worked in my PW2 with 5.8.1, now in 5.4.2 Thanks , now to the jailbreak

[dalvick]

oh yeah, great job, thank you

I m trying this for my KT2

edit : yes, that worked

[kimush]

Worked like a charm in PW2
thank you

[knc1]

As mentioned in the original top post of this thread, the second step has been simplified, see:
https://www.mobileread.com/forums/sho...92&postcount=7
and then scroll up through the posts to the first post of that thread for the JB archive that replaces my "Step Two" and the 5.6.5 software jailbreak.

I will be updating the top post of this thread sometime later today.

[knc1]

Top post updated.
Professional documentation writers and other critics - flame away.

[rashkae]

Question, will these images install on the wrong device if user user loads wrong file, (potentially bricking it.), or are the Kindles still able to reject innapropriate images?

[knc1]

Originally Posted by rashkae

Question, will these images install on the wrong device if user user loads wrong file, (potentially bricking it.), or are the Kindles still able to reject innapropriate images?

Nice catch -
I did forget to include that warning in V-2 (it is in V-1)
I will get that fixed, sometime, RSN.

In answer to your question:
The initial factory update packages **are not** model locked.
Then can be installed on the 'wrong' model.

We have been there, done that, and found that it wasn't fatal.
Some hardware features will not work with a cross-install - -
But it can be corrected by installing the correct update file.

- - - -

Thanks for the feedback -
It reminded me that I didn't mention that a "Kindle Hacker" might want to stay with the initial factory install because it has MANY software features installed that do not make it into the 'consumer' models.
I.E: More fun things to play with.

[geekmaster]

Originally Posted by rashkae

Question, will these images install on the wrong device if user user loads wrong file, (potentially bricking it.), or are the Kindles still able to reject innapropriate images?

Yes, it will install and BRICK your kindle if it is a (serial number based) version mismatch. No the kindles do NOT reject these factory updates.

That is a side effect of how they work and what allows us to do this in the first place. You must take care -- others have bricked their kindles trying the wrong version, which is WHY it took so long for this to get released to the general public. My post started an avalanche of activity when I successfully used it on my PW2, quickly confirmed by other devs, and which resulted in this new way to jaibreak FINALLY being released. A ton of work UP FRONT, and a flurry of activity at the end. And our "Fourth of July" (American Independence Day) holiday weekend kept us going with a tight deadline. And here we are with a brand new easy-to-use set of tools.

Thanks everybody (especially knc1 and anybody else who put in the long hours up front), letting us enjoy these last few days getting this ready to release. This weekend was just the gravy on top of this "Amazon-Independence Day" holiday feast.

[travak]

Originally Posted by geekmaster

Yes, it will install and BRICK your kindle if it is a (serial number based) version mismatch. No the kindles do NOT reject these factory updates.

I think I've managed to do this. Started from 5.8.1.

• Serial begins with G090G1, matched to Kindle PaperWhite 3 (2015) WiFi
• Downloaded update_PW3_5.6.1.1_initial.bin under PW3 from the pastebin
• Connected Kindle to PC, placed file in drive root, safely removed, unplugged USB cable, home > menu > settings > menu > update > confirmed
• Kindle flickers a bunch, reboots a bunch, then settles on "Your Kindle Needs Repairing"

During boot loop USB is accessible short-term; any suggestions or am I SOL?

[geekmaster]

Originally Posted by travak

I think I've managed to do this. Started from 5.8.1.

• Serial begins with G090G1, matched to Kindle PaperWhite 3 (2015) WiFi
• Downloaded update_PW3_5.6.1.1_initial.bin under PW3 from the pastebin
• Connected Kindle to PC, placed file in drive root, safely removed, unplugged USB cable, home > menu > settings > menu > update > confirmed
• Kindle flickers a bunch, reboots a bunch, then settles on "Your Kindle Needs Repairing"

During boot loop USB is accessible short-term; any suggestions or am I SOL?

It depends on how far the install proceeded. This new images have a lot more opportunities for intervention. With short term USB access it may be possible to push something in, but we need to study these details more to find such things. It was only a short amount of study to find the jailbreak, so debricking should be an option I think, though I will not be able to participate in that avenue of research, and other devs have outside plans too. We need some fresh young blood to step up and take over for us old folks...

[Branch Delay]

Originally Posted by travak

I think I've managed to do this. Started from 5.8.1.

• Serial begins with G090G1, matched to Kindle PaperWhite 3 (2015) WiFi
• Downloaded update_PW3_5.6.1.1_initial.bin under PW3 from the pastebin
• Connected Kindle to PC, placed file in drive root, safely removed, unplugged USB cable, home > menu > settings > menu > update > confirmed
• Kindle flickers a bunch, reboots a bunch, then settles on "Your Kindle Needs Repairing"

During boot loop USB is accessible short-term; any suggestions or am I SOL?

Create a DO_FACTORY_RESTORE file on root of USB when it mounts. Reboot a few times after. Probably should have more warnings in the guide as downgrading may prove to be a risky procedure.

[geekmaster]

Originally Posted by Branch Delay

Create a DO_FACTORY_RESTORE file on root of USB when it mounts. Reboot a few times after.

That is an option that has not sunk into my brain yet -- not available when I was (hyper)active here years ago. Thanks for the suggestion.