KT2 [Solved] How to unbrick a frozen KT2 (with a broken kernel)

[nicolasmart]

Hello everyone!

Backstory

Spoiler:

After jailbreaking my KT2 on 5.12.2.1.1, I wanted to downgrade to an older version, one that had the older UI design and ran much snappier than the newer ones. I followed the guide over here but then upon rebooting the device - it just... did nothing. Completely frozen. Plugging the cable in still made the light on the bottom light in orange. Pressing and holding for 10+ seconds caused the orange light to blink but screen remained frozen.

Upon connection to a computer via USB all that happened was a "dead" device appearing for a second or two and then disconnecting by itself. Practically unusable.

[  900.499414] usb 1-13: new low-speed USB device number 5 using xhci_hcd
[  900.650646] usb 1-13: New USB device found, idVendor=1949, idProduct=dead, bcdDevice= 2.00
[  900.650653] usb 1-13: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[  900.650656] usb 1-13: Product: USB Charger 
[  900.654342] input: USB Charger  as /devices/pci0000:00/0000:00:14.0/usb1/1-13/1-13:1.0/0003:1949:DEAD.0006/input/input35
[  900.711857] hid-generic 0003:1949:DEAD.0006: input,hidraw4: USB HID v1.11 Device [USB Charger ] on usb-0000:00:14.0-13/input0
[  902.103236] usb 1-13: USB disconnect, device number 5

I was stuck with this:

(a screen that looks like diags but actually it was just the afterimage of the last shown thing; clicking did nothing, obviously the device wasn't in diags but rather in a broken boot cycle because somehow the kernel got corrupted)

Huge thanks to @katadelos for guiding me on how to solve this issue!




Solution

What I ended up doing was disassemble the device and short the test pad TM401 (which activates BOOT_MODE_0) by actually connecting a wire between TP1706 (which gives us 3.3V of power, you can use a different source for that as well) and the left side of the rectangular diode right below the D1505 marking (which seems to be directly connected to the desired TM401) as shown on the image below:


While the wire is connected, you should restart the device by either shorting the reset pins to ground or pressing and holding the power button for 20 seconds.

Once I did that, the device appeared as SE Blank MEGREZ:

[ 2470.327595] usb 1-13: new high-speed USB device number 7 using xhci_hcd
[ 2470.476311] usb 1-13: New USB device found, idVendor=15a2, idProduct=0063, bcdDevice= 0.01
[ 2470.476319] usb 1-13: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 2470.476324] usb 1-13: Product: SE Blank MEGREZ
[ 2470.476327] usb 1-13: Manufacturer: Freescale SemiConductor Inc 
[ 2470.478445] hid-generic 0003:15A2:0063.0008: hiddev1,hidraw4: USB HID v1.10 Device [Freescale SemiConductor Inc  SE Blank MEGREZ] on usb-0000:00:14.0-13/input0

Then I simply used imx_usb_loader to boot this u-boot binary and the terminal output looked as following:

Spoiler:

nicolasmart@ubuntu:~/Desktop/KindleXubuntu/imx_usb_loader$ sudo ./imx_usb ./uboot-2009_08_lab126-wario_usb_fastboot.bin 
[sudo] password for nicolasmart: 
config file <.//imx_usb.conf>
vid=0x066f pid=0x3780 file_name=mx23_usb_work.conf
vid=0x15a2 pid=0x004f file_name=mx28_usb_work.conf
vid=0x15a2 pid=0x0052 file_name=mx50_usb_work.conf
vid=0x15a2 pid=0x0054 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0061 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0063 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0071 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x007d file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0080 file_name=mx6ull_usb_work.conf
vid=0x1fc9 pid=0x0128 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0076 file_name=mx7_usb_work.conf
vid=0x1fc9 pid=0x0126 file_name=mx7ulp_usb_work.conf
vid=0x15a2 pid=0x0041 file_name=mx51_usb_work.conf
vid=0x15a2 pid=0x004e file_name=mx53_usb_work.conf
vid=0x15a2 pid=0x006a file_name=vybrid_usb_work.conf
vid=0x066f pid=0x37ff file_name=linux_gadget.conf
vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x0525 pid=0xb4a4 file_name=mx6_usb_sdp_spl.conf
vid=0x1fc9 pid=0x012b file_name=mx8mq_usb_work.conf
vid=0x1fc9 pid=0x0134 file_name=mx8mm_usb_work.conf
vid=0x1fc9 pid=0x013e file_name=mx8mn_usb_work.conf
vid=0x3016 pid=0x1001 file_name=mx8m_usb_sdp_spl.conf
config file <.//mx6_usb_work.conf>
parse .//mx6_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0063
Interface 0 claimed
HAB security state: development mode (0x56787856)
== work item
filename ./uboot-2009_08_lab126-wario_usb_fastboot.bin
load_size 0 bytes
load_addr 0x00000000
dcd 1
clear_dcd 0
plug 1
jump_mode 3
jump_addr 0x00000000
== end work item
No DCD table

loading binary file(./uboot-2009_08_lab126-wario_usb_fastboot.bin) to 00980000, skip=0, fsize=1d35c type=aa

<<<119644, 119644 bytes>>>
succeeded (security 0x56787856, status 0x88888888)
jumping to 0x00980400
do_command err=-4, last_trans=0
do_command err=-4, last_trans=0
do_command err=-4, last_trans=0
do_command err=-4, last_trans=0
do_command err=-4, last_trans=0
config file <.//mx6_usb_work.conf>
parse .//mx6_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0063.........................
Could not open device vid=0x15a2 pid=0x0063
nicolasmart@ubuntu:~/Desktop/KindleXubuntu/imx_usb_loader$

(don't worry about the 'could not open device' error, it didn't affect the process in any way)

After running imx_usb_loader the device was recognized as an Amazon Kindle and it even showed the serial number:

[ 2491.260357] usb 1-13: new high-speed USB device number 8 using xhci_hcd
[ 2491.409288] usb 1-13: New USB device found, idVendor=1949, idProduct=d0e0, bcdDevice= 0.01
[ 2491.409294] usb 1-13: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 2491.409297] usb 1-13: Product: Kindle
[ 2491.409300] usb 1-13: Manufacturer: Amazon
[ 2491.409303] usb 1-13: SerialNumber: 062060XXXXXXXXXX (X for redacted)

All that was left to do was run TobiasWooldridge's fork of Fastboot-Kindle to flash the uImage (kernel) of the factory 5.6.0. That resulted in the following terminal log:

nicolasmart@ubuntu:~/Desktop/KindleXubuntu/Fastboot-Kindle$ sudo ./fastboot flash kernel uImage 
downloading 'kernel'...
OKAY [  0.082s]
writing 'kernel'...
OKAY [  0.169s]
finished. total time: 0.251s
nicolasmart@ubuntu:~/Desktop/KindleXubuntu/Fastboot-Kindle$ sudo ./fastboot reboot
rebooting...

finished. total time: 0.000s
nicolasmart@ubuntu:~/Desktop/KindleXubuntu/Fastboot-Kindle$

Then the screen cleared and booted right into Kindle 5.6.0. It even preserved all of my books and settings, along with the jailbreak and its tweaks. All that was left to do was to reassemble the device and just like that I had a fully functioning jailbroken KT2 on the original firmware that it came with.


Huge thanks once again for all of the support and I hope I helped somebody!

Original post:

Spoiler:

Hey everyone! Long time no see!

I’ve waited for 6 years to jailbreak my 7th Gen Kindle. I remember being so disappointed when I missed pretty much every software jailbreak. Until now. Obviously I was super happy to see the new KindleBreak jailbreak that supports anything below 5.13 and KT2 is already EOL at 5.12.2.1.1

So I jailbroke it, installed a few tweaks, including KUAL, USB Networking, the 2 Rescue Packs and what not, after which I decided to downgrade to 5.6.0

I followed the guide over here. Extracted the 5.6.0 factory firmware uImage and rootfs using KindleTool, put it in /mnt/us and followed the steps. It seemingly worked but once I typed “reboot” the device basically froze permanently. Windows doesn’t recognize it as a device at all, I suppose it’s only charging. The screen it froze on is diags but obviously clicking does nothing as it’s just an afterimage that was never cleared because it doesn’t boot. Plugging the cable in does make the light on the bottom light in orange. Pressing and holding for 10+ seconds causes the orange light blinks but screen remains frozen and device never appears in Device Manager.

Did I completely kill the thing? Should I even bother disassembling and reconnecting the battery or does it miss some crucial part of the kernel/bootloader?

Thanks in advance!

[NiLuJe]

A PW2 is not a KT2, and I can never remember if the KT2 isn't the very device that introduced the new partition layout...

In any case: outside of possibly a serial recovery, it's dead, Jim.

[nicolasmart]

Update: Maybe it's not completely dead. For some reason it now makes Windows play the hardware inserted sound upon connecting via USB, however it disconnects again shortly after and I have no clue what it's being detected as.

I will try connecting it to Ubuntu tho to see what happens and if imx_usb_loader will be able to make it boot my desired uBoot.

[nicolasmart]

Updated first post with the solution found by @katadelos

[nicnic2001]

I am trying to use uboot_2009-08-lab126_wario_usb_fastboot.bin with imx_usb_loader on a KT2 after getting "Product: SE Blank MEGREZ" but after that I get a USB disconnect on dmesg and that's it. Can't use fastboot. Any ideas?