=======Kindle hacking======= =====PW5:===== ====Goals:==== -HW UART\\ -U-Boot CLI\\ -UART Linux shell (require jailbreak)\\ -Reverse engineering of unlocking mechanism\\ -eMMC interposer (v2 needed!!)\ \ ====Overview==== In the new Kindle PW5, Amazon started using different CPU from previous models. Kindle PW5 is using Mediatek MT8113, bundled with 512Mb RAM.\\ All production devices are locked, which means you cannot use u-boot CLI because on a locked device there is forced execution of the fastboot command followed by the boot command when you try to access u-boot CLI.\\ With the u-boot in fastboot mode, it is possible to obtain some magic string via getvar command that can probably be used to generate unlock key. Unfortunately, that cannot be verified (yet), because there are some source codes missing.\\ Amazon also removed debug UART connector from the PCB.\\ On the production devices, the UART Linux shell is disabled.\\ **28-10-2022:**\\ If u-boot fails to load the kernel from eMMC, it enters fastboot.\\ **03-11-2022:**\\ If is used another eMMC on which the content of the previous is copied the ROM bootloader fails to load u-boot.\\ ====Getting UART==== I suspected that there has to be UART somewhere, so I ordered yet another Kindle :) and started probing test pads on the bottom side of the PCB. This, unfortunately, led nowhere and only a couple of I2C buses were discovered that way. \\ The next step was to look into [[https://www.amazon.com/gp/help/customer/display.html?nodeId=200203720 | source codes]] released by Amazon thanks to the GPL license.\\ In the u-boot source, there is code for [[https://datasheets.maximintegrated.com/en/ds/MAX20342.pdf|MAX20342]] which is a USB type C detector IC for detecting different types of chargers, it also features USB C debug accessory mode (DAM) ([[https://www.usb.org/sites/default/files/USB%20Type-C%20Spec%20R2.0%20-%20August%202019.pdf|USB Type C specification pg. 314]]) in which all some data pins can be used for non-USB purposes such as JTAG debugging. \\ In the datasheet for MAX20342 is stated that the IC will enter DAM if it senses 5.1kΩ pull-up resistors on CC1 and CC2 pins and 30/150kΩ pull-down resistors on one of the SBU pins.\\ Upon entering DAM mode MAX20342 connects the USB D+ and D- pins of the connector to the UART of the MT8113.\\ Configuration registers can disable this feature, but right now, they are at factory default (ver. 5.14.2)\\ Be aware of the **1.8V logic levels** of the UART and **don't try to connect 3.3V logic levels UART converted** as you can damage your Kindle.\\ There is a photo of such contraption:\\ -On the PCB there is the FT232 USB to UART converter and buck regulator to generate 1.8V for powering the VCCIO pin of the converter.\\ -I also tried the CP2104 and CH340 converters, but they are struggling to run with 1.8V power for IO pins. {{https://trimen.org/kindle/ftdi.jpg?nolink&800}} ====Getting UART Linux shell==== Currently, I have no method to enable the UART shell on the production device. The only possible way is to jailbreak your Kindle by the method provided by [[https://www.mobileread.com/forums/showthread.php?t=346037|MobileRead forum member katadelos]]\\ In order to enable the UART root shell, you need to do two things:\\ - Modify /etc/shadow file to enable the root account. root:!:10933:0:99999:7::: to root::10933:0:99999:7::: - Modify /etc/init/console.conf (start at line ~66) #We determine to execute getty, which prompts for the login password using the values in the /proc/cmdline file #The locked variable is used lock the prompt if [ "$prodVersion" = "0" -o "$unlockedKernel" = "true" -o "$secureCpu" = "0" ]; then #Unlocked Prompt if: unlockedKernel or not prod or not secure cpu exec getty -L $BAUD /dev/$UART 2>> $STDERR else exec getty -L $BAUD /dev/$UART -i -n -l /etc/upstart/custom-login 2>> $STDERR fi to #We determine to execute getty, which prompts for the login password using the values in the /proc/cmdline file #The locked variable is used lock the prompt if [ "$prodVersion" = "0" -o "$unlockedKernel" = "true" -o "$secureCpu" = "0" ]; then #Unlocked Prompt if: unlockedKernel or not prod or not secure cpu exec getty -L $BAUD /dev/$UART 2>> $STDERR else #exec console on locked device exec getty -L $BAUD /dev/$UART 2>> $STDERR fi *note: there is most likely a better way, like spawning /bin/sh on UART directly, but let's keep things simple. ==== Internal photos: ==== {{https://trimen.org/kindle/kindle_open.jpg?nolink&1000}} {{https://trimen.org/kindle/kindle_wo_shield.jpg?nolink&1000}} {{https://trimen.org/kindle/kindle_cpu_det.jpg?nolink&1000}} {{https://trimen.org/kindle/pcb_top.jpg?nolink&1000}} {{https://trimen.org/kindle/pcb_bot.jpg?nolink&1000}} ====eMMC interposer:==== In order to be able to easily modify, read out, and backup content of the eMMC chip, I created an interposer with the connector on which the board with the eMMC chip is placed.\\ Pinout was chosen to match the PINE64 eMMC module and [[https://pine64.com/product/usb-adapter-for-emmc-module |reader]]. Unfortunately, the connector used on the PINE64 eMMC module and reader is hard to get, so I used the same pitch, but different dimensions connector. As I check it, it should be possible to place chosen connector to the reader PCB. Files are available at GitLab [[https://git.taktpraha.cz/trimen/keib|KEIB]] **31-10-2022:**\\ PCBs arrived along with the reballing stencils and balls. **03-11-2022:**\\ I assembled and tested the boards, but I wasn't able to get PW5 running with the interposer installed. When I tried it, the Mediatek ROM bootloader just printed output and went to shutdown. I suspect that the signal integrity might be causing this. But there will be probably another catch as when I tried to make a copy of stock eMMC binary content to the new larger eMMC (just dd it) the bootloader also refused to boot properly. (with larger eMMC soldered directly on board)\\ I wasn't able to find much information about the Mediatek ROM bootloader. Links [[https://mediatek.gitlab.io/aiot/doc/aiot-dev-guide/sw/yocto/board-bringup.html|here]] and [[https://forum.xda-developers.com/t/unlock-root-twrp-unbrick-fire-tv-stick-2nd-gen-tank.3907002/page-56|here]].\\ From what I was able to get together you need access to UART0 and UART1 in order to use the tool for flashing. UART0 is outputted through a USB C connector, but UART1 is inaccessible. It might be somewhere on the bottom test pads. The ROM bootloader output: F0: 102B 0000 F3: 4000 0036 [0200] F3: 4000 0036 F6: 380C 0000 F1: 5003 FF1E [0001] F1: 5003 FF1E 00: 1005 0000 F3: 4000 0036 [0200] F3: 4000 0036 F6: 380C 0000 F1: 5003 FF1E [0001] F1: 5003 FF1E 01: 1005 0000 F6: 380C 0000 02: 1005 0000 F6: 380C 0000 03: 102A 0003 04: 0007 8000 05: 1005 0000 BP: 0800 0288 [0003] EC: 0000 0000 [0001] T0: 0000 014C [000F] System halt! F0: 102B 0000 F3: 4000 0036 [0200] F3: 4000 0036 F6: 380E 00A8 F1: 5003 FF1E [0001] F1: 5003 FF1E 00: 1005 0000 F3: 4000 0036 [0200] F3: 4000 0036 F6: 380E 00A8 F1: 5003 FF1E [0001] F1: 5003 FF1E 01: 1005 0000 F6: 380E 00A8 02: 1005 0000 F6: 380E 00A8 03: 102A 0003 04: 0007 8000 05: 1005 0000 BP: 0800 0288 [0003] EC: 0000 0000 [0001] T0: 0000 019D [000F] System halt! I think the first section is without any eMMC and the second section is with blank/other than stock eMMC as the output was the same. ====Boot log:==== �������������������������������������������������������������������������������������������������������������������������������������� MPU [LOCK [TZ_EMI_MPU] MPU [0x43000000-0x4302FFFF] Device APC domain init setup: Domain Setup (0x0) Domain Setup (0x0) Domain Setup (0x0) Device APC domain after setup: Domain Setup (0x11111111) Domain Setup (0x10111111) Domain Setup (0x2111111) Device APC slave permission init setup: [ATF](0)[0.000521]mmap: [ATF](0)[0.000782] VA:0x10f000 PA:0x10f000 size:0x2000 attr:0x8 granularity:0x40000000 [ATF](0)[0.001773] VA:0xc000000 PA:0xc000000 size:0x600000 attr:0x8 granularity:0x40000000 [ATF](0)[0.002807] VA:0x10006000 PA:0x10006000 size:0x100000 attr:0x8 granularity:0x40000000 [ATF](0)[0.003863] VA:0x10000000 PA:0x10000000 size:0x400000 attr:0x8 granularity:0x40000000 [ATF](0)[0.004918] VA:0x10400000 PA:0x10400000 size:0x50000 attr:0x8 granularity:0x40000000 [ATF](0)[0.005963] VA:0x10480000 PA:0x10480000 size:0x10000 attr:0x8 granularity:0x40000000 [ATF](0)[0.007007] VA:0x11000000 PA:0x11000000 size:0x4000000 attr:0x8 granularity:0x40000000 [ATF](0)[0.008073] VA:0x15000000 PA:0x15000000 size:0x1000 attr:0x8 granularity:0x40000000 [ATF](0)[0.009107] VA:0x43001000 PA:0x43001000 size:0x17000 attr:0x2 granularity:0x40000000 [ATF](0)[0.010152] VA:0x43027000 PA:0x43027000 size:0x1000 attr:0x8 granularity:0x40000000 [ATF](0)[0.011185] VA:0x43000000 PA:0x43000000 size:0x30000 attr:0xa granularity:0x40000000 [ATF](0)[0.012230] VA:0x44400000 PA:0x44400000 size:0x10000 attr:0x18 granularity:0x40000000 [ATF](0)[0.013285] NOTICE: [ATF](0)[0.015451]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e NOTICE: [ATF](0)[0.016333]BL31: Built : 17:35:52, Jul 23 2021 NOTICE: [ATF](0)[0.017023]BL31_BASE=0x43001000, BL31_TZRAM_SIZE=0x2f000 NOTICE: [ATF](0)[0.017820]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e NOTICE: [ATF](0)[0.018703]BL31: Built : 17:35:52, Jul 23 2021 E/TC:0 mtk_rng_init:16 mtk rng initialized E/TC:0 crypto_init:12 Crypto initialization NOTICE: [ATF](0)[0.048534]NS-SCR_EL3_EFIN=0x4 NOTICE: [ATF](0)[0.049051]S-SCR_EL3_EFIN=0x0 U-Boot 2019.04-ga324c90 (Dec 04 2021 - 04:06:37 +0000), Build: jenkins-bootloader-malbec-1019 Model: MT8110 BELLATRIX DRAM: 512 MiB MMC: mmc@11230000: 0 idme_initialize phase: [map:ffffff1fffffffff] [maxlen:37] [final:12] Idme version is 2.x and set related function to V2.x IDME table version 2.1 Board ID is P002EQ0220240C81 Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK ## Loading loadables from FIT Image at 41000000 ... Trying 'fbios' loadables subimage Description: FBIOS Image Type: Firmware Compression: uncompressed Data Start: 0x410000cc Data Size: 176204 Bytes = 172.1 KiB Architecture: ARM OS: Unknown OS Load Address: 0x5f9a0000 Hash algo: sha256 Hash value: 7df4454257f15542af45973d66681030ef317eb5f952c370dee59b10187da537 Verifying Hash Integrity ... sha256+ OK Loading loadables from 0x410000cc to 0x5f9a0000 ## Loading loadables from FIT Image at 41000000 ... Trying 'sbios' loadables subimage Description: SBIOS Image Type: Firmware Compression: uncompressed Data Start: 0x4102b1e8 Data Size: 54728 Bytes = 53.4 KiB Architecture: ARM OS: Unknown OS Load Address: 0x5f980000 Hash algo: sha256 Hash value: 21f85d3804f83dedf8f04d3bfbebe592ddc0e90164593122664ed520a22b7c37 Verifying Hash Integrity ... sha256+ OK Loading loadables from 0x4102b1e8 to 0x5f980000 hibernation: Not from hibernation Core : b69d31e 2020/07/08 01:35:32 (Licensed to Amazon Fulfillment Services,Inc.) SBIOS: v2.0 2021/07/07 14:17:22 TTBR:5f9ec059 Core: b69d31e 2020/07/08 01:35:32 Platform: v2.0 2021/07/07 14:17:22 max bank = 1 In: serial@11002000 Out: serial@11002000 Err: serial@11002000 Hardware Board: DVT(DOE3) amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5 Secure Info: secure_cpu: 1, production: 1, unlocked: 0 Hit any key to stop autoboot: 0 ## Loading kernel from FIT Image at 41000000 ... Using 'conf-mt8110-malbec' configuration Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK Trying 'kernel' kernel subimage Description: Kernel Type: Kernel Image Compression: uncompressed Data Start: 0x410000c4 Data Size: 6501600 Bytes = 6.2 MiB Architecture: ARM OS: Linux Load Address: 0x40008000 Entry Point: 0x40008000 Hash algo: sha256 Hash value: 975bab5256b1383732bef9b98b20ad7e5220c2c1a996b20bb64dd30231b34ee6 Verifying Hash Integrity ... sha256+ OK ## Loading ramdisk from FIT Image at 41000000 ... Using 'conf-mt8110-malbec' configuration Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK Trying 'ramdisk' ramdisk subimage Description: ramdisk Type: RAMDisk Image Compression: uncompressed Data Start: 0x41633690 Data Size: 1667584 Bytes = 1.6 MiB Architecture: ARM OS: Linux Load Address: 0x44080000 Entry Point: unavailable Hash algo: sha256 Hash value: 65d072008e55511d1e418b64a9a21fe0bd0ef5b9f6b85eefbc0d1fb7b63c2b7b Verifying Hash Integrity ... sha256+ OK Loading ramdisk from 0x41633690 to 0x44080000 ## Loading fdt from FIT Image at 41000000 ... Using 'conf-mt8110-malbec' configuration Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK Trying 'fdt-mt8110-malbec' fdt subimage Description: Flattened Device Tree blob mt8110-malbec.dtb Type: Flat Device Tree Compression: uncompressed Data Start: 0x417ca9a0 Data Size: 48136 Bytes = 47 KiB Architecture: ARM Load Address: 0x44000000 Hash algo: sha256 Hash value: 1d22d5f38132d2b1e64524471ff23c9cc792a585a8c757f546b1085f1ed5103d Verifying Hash Integrity ... sha256+ OK Loading fdt from 0x417ca9a0 to 0x44000000 Booting using the fdt blob at 0x44000000 Loading Kernel Image ... OK ERROR: reserving fdt memory region failed (addr=5f000000 size=400000) Using Device Tree in place at 44000000, end 4400ec07 amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5 secure_cpu: 1, production: 1, unlocked: 0 OK to initialize idme device tree Applied falcon mmc driver Starting kernel ... [ 0.000000] <0>-(0)[0:swapper]Booting Linux on physical CPU 0x0 [ 0.000000] <0>-(0)[0:swapper]Linux version 4.9.77-lab126 (builder@eink-builds) (gcc version 4.9.1 (GCC) ) #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022 [ 0.000000] <0>-(0)[0:swapper]CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d [ 0.000000] <0>-(0)[0:swapper]CPU: div instructions available: patching division code [ 0.000000] <0>-(0)[0:swapper]CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] <0>-(0)[0:swapper]OF: fdt:Machine model: MT8110 Bellatrix device [ 0.000000] <0>-(0)[0:swapper]earlycon: uart8250 at MMIO32 0x11002000 (options '') [ 0.000000] <0>-(0)[0:swapper]bootconsole [uart8250] enabled [ 0.085483] <0>.(0)[1:swapper/0]'atag,devinfo' is not found [ 0.430893] <1>.(1)[1:swapper/0]mt8512-cpufreq mt8512-cpufreq: failed to initialize dvfs info for cpu0 [ 0.445620] <1>.(1)[1:swapper/0]mtu3 11211000.usb: couldn't get extcon device [ 0.449118] <1>.(1)[1:swapper/0]lm3692x 0-0037: unable to request PWM [ 0.450066] <1>.(1)[1:swapper/0]lm3692x 0-0037: Cannot read/clear faults [ 0.450911] <1>.(1)[1:swapper/0]lm3692x 0-0037: Fail writing initialization values [ 0.452368] <1>.(1)[1:swapper/0]lm3692x 0-0036: unable to request PWM [ 0.453302] <1>.(1)[1:swapper/0]lm3692x 0-0036: Cannot read/clear faults [ 0.454195] <1>.(1)[1:swapper/0]lm3692x 0-0036: Fail writing initialization values [ 0.459708] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_00=0x40 [ 0.460899] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_01=0x00 [ 0.462083] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_02=0x00 [ 0.463267] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_03=0x30 [ 0.464496] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_04=0x00 [ 0.465678] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_05=0x00 [ 0.466860] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_06=0x00 [ 0.468041] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_07=0x00 [ 0.469223] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_08=0x00 [ 0.470405] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_09=0x00 [ 0.471588] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_10=0x00 [ 0.472770] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_11=0x00 [ 0.473974] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_12=0x00 [ 0.475157] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_13=0x00 [ 0.476115] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: Reboot Reason: POWER_OFF System Powered Off [ 0.500859] <1>.(1)[1:swapper/0]mtk-imgrz 15004000.imgrz: mtk_imgrz_probe is earlier than SMI [ 0.503821] <1>.(1)[6:kworker/u4:0]OF: /rdma@15007000: could not get #mbox-cells for /gce@10238000 [ 0.505881] <0>.(0)[1:swapper/0]mtk-jdec 15003000.jdec: mtk_jdec_probe is earlier than SMI [ 0.507213] <0>.(0)[1:swapper/0]mtk_png_probe called [ 0.507856] <0>.(0)[1:swapper/0]imgresz_probe is earlier than SMI MMC v5.1 phase: [map:ffffff1f_ffffffff] [maxlen:37] [final:12] MMC's timing interface is HS200 SBIOS info storage_type: MMC erase_size: 1024 capacity: 15273600 * 512Byte [ 0.626807] <1>.(1)[112:kworker/1:2]mtk_png_probe called [ 0.628035] <1>.(1)[112:kworker/1:2]driver registered as /dev/video6 [ 0.632298] <0>.(0)[1:swapper/0]memory-ssmr: [INIT FAIL]: cma is not inited [ 0.633188] <0>.(0)[1:swapper/0]memory-ssmr: SSMR sanity fail [ 0.638266] <0>.(0)[1:swapper/0]idt_wireless_power 0-0061: p922x_parse_dt: Device have associated DT data [ 0.646425] <1>.(1)[1:swapper/0][mtk_svs] no "calibration-data" from dts? disable mon mode 4.9.77-lab126 #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022 armv7l BOOTING DEFAULT. IP-Config: no devices to configure kinit: Mounted root (ext3 filesystem) readonly. info sytem:mounted_proc:: info system:mounted_sys:: info system:sy00:: info system:mounted_dev:: info milestone:4.21:49.1:49.1 info milestone:4.27:49.2:49.2 info milestone:4.32:49.3:49.3 info milestone:4.39:49.4:49.4 info milestone:4.42:49.5:49.5 info sytem:mounted_tmpfs:: info milestone:4.58:sy50:sy50 info system:start:time=4620:time=4620 info hardware:no_wan:: WiFi only device. No WAN found info system:config:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N info milestone:4.83:sy51:sy51 lipc-send-event[321]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory) lipc-send-event[321]: C def:dbusi::Failed to init dbus lipc-send-event[321]: E def:open::Failed to open LIPC lipc-send-event[321]: E def:fail:source=com.lab126.hal, event=powerButtonPressed:Sending event failed lipc-send-event[393]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory) lipc-send-event[393]: C def:dbusi::Failed to init dbus lipc-send-event[393]: E def:open::Failed to open LIPC lipc-send-event[393]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed lipc-send-event[419]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory) lipc-send-event[419]: C def:dbusi::Failed to init dbus lipc-send-event[419]: E def:open::Failed to open LIPC lipc-send-event[419]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed info milestone:5.68:sy99:sy99 info system:done:time=5720:time=5720 crond[430]: crond (busybox 1.28.3) started, log level 8 init.exe: sshd main process (429) terminated with status 127 init.exe: sshd main process ended, respawning init.exe: recevent pre-start process (433) terminated with status 1 Welcome to Kindle! kindle login: info milestone:5.97:sc01:sc01 info system_fs_loopbacks:mountingfs:Mounting compressed directories filesystem images:Mounting compressed directories filesystem images info milestone:5.99:sc02:sc02 info milestone:6.03:/usr/share/X11/xkb:/usr/share/X11/xkb info system_fs_loopbacks:mounted:Image /usr/share/X11/xkb.sqsh mounted:Image /usr/share/X11/xkb.sqsh mounted info milestone:6.13:3:3 info milestone:6.14:sc05:sc05 info milestone:6.16:/usr/java/lib/fonts:/usr/java/lib/fonts info system_fs_loopbacks:mounted:Image /usr/java/lib/fonts.sqsh mounted:Image /usr/java/lib/fonts.sqsh mounted info milestone:6.27:4:4 info milestone:6.28:sc05:sc05 info milestone:6.31:/etc/kdb.src:/etc/kdb.src info system_fs_loopbacks:mounted:Image /etc/kdb.src.sqsh mounted:Image /etc/kdb.src.sqsh mounted info milestone:6.42:5:5 info milestone:6.43:sc05:sc05 info milestone:6.45:/usr/lib/locale:/usr/lib/locale info system_fs_loopbacks:mounted:Image /usr/lib/locale.sqsh mounted:Image /usr/lib/locale.sqsh mounted info milestone:6.57:6:6 info milestone:6.58:sc05:sc05 info milestone:6.60:/usr/share/keyboard:/usr/share/keyboard info system_fs_loopbacks:mounted:Image /usr/share/keyboard.sqsh mounted:Image /usr/share/keyboard.sqsh mounted info milestone:6.81:7:7 info milestone:6.82:sc05:sc05 info milestone:6.85:/opt/var/local:/opt/var/local info system_fs_loopbacks:mounted:Image /opt/var/local.sqsh mounted:Image /opt/var/local.sqsh mounted info milestone:6.96:8:8 info milestone:6.97:sc05:sc05 info milestone:6.99:sc07:sc07 info system:emiting_event:mounted_fs_loopbacks:mounted_fs_loopbacks debug sytem:event_emitted:mounted_fs_loopbacks:mounted_fs_loopbacks info milestone:7.05:fs75:fs75 info system:emiting_event:loaded_modules_dependencies:loaded_modules_dependencies debug sytem:event_emitted:loaded_modules_dependencies:loaded_modules_dependencies info system:emiting_event:loaded_fuse:loaded_fuse debug sytem:event_emitted:loaded_fuse:loaded_fuse info modules:modprobe:loading module falcon:loading module falcon info milestone:7.14:fs00:fs00 info system:emiting_event:loaded_falcon:loaded_falcon debug sytem:event_emitted:loaded_falcon:loaded_falcon info hardware:no_wan:: WiFi only device. No WAN found info system:emiting_event:loaded_ppp_async:loaded_ppp_async debug sytem:event_emitted:loaded_ppp_async:loaded_ppp_async info filesystems_keys:not applicable for this device type:: info modules:modprobe:loading module opt3001:loading module opt3001 info system:emiting_event:loaded_opt3001:loaded_opt3001 debug sytem:event_emitted:loaded_opt3001:loaded_opt3001 info system:emiting_event:loaded_fakekey:loaded_fakekey debug sytem:event_emitted:loaded_fakekey:loaded_fakekey info filesystems_var_local:File system errors checked. Return code 0:LocalVars: clean, 1436/65536 files, 41835/262144 blocks:LocalVars: clean, 1436/65536 files, 41835/262144 blocks info filesystems_var_local:No file system errors:: info filesystems_var_local:runfixup:Running /var/local/system/fixup:Running /var/local/system/fixup info jb_bridge:main:: i can fix this (r18869) info jb_bridge:main:: these are not the droids you're looking for info filesystems_var_local:DB PARAMS:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB.:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB. info milestone:7.70:fs23:fs23 info system:emiting_event:mounted_varLocal:mounted_varLocal debug sytem:event_emitted:mounted_varLocal:mounted_varLocal info milestone:7.79:vi00:vi00 info touch:detect:TOUCH_ID=0:TOUCH_ID=0 info milestone:7.89:vi99:vi99 info touch:id_release:release touch id pins:release touch id pins info touch:detect:install Parade touch driver:install Parade touch driver info display:started:time=7930:time=7930 info system:emiting_event:display_ready:display_ready debug sytem:event_emitted:display_ready:display_ready info milestone:8.32:fs25:fs25 info prereg:PRAGMA_QUICK_CHECK_PASSED:: sts=0 info userstore:run:time=8600,action=start:time=8600,action=start info userstore:start:found_shutdown_flag:found_shutdown_flag Found SHUTDOWN flag file err mntus:loopback_not_mounted:: loopback device is not set-up [ 10.563776] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_hid_send_output_user_and_wait_: HID output cmd execution timed out [ 10.565273] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_request_pip2_send_cmd: nonhid_cmd->user_cmd() Error = -62 [ 10.566663] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_pip2_get_version: Error Sending PIP2 VERSION Cmd rc=-62 [ 11.006268] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001 [ 12.484323] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001 info system:emiting_event:mounted_userstore:mounted_userstore debug sytem:event_emitted:mounted_userstore:mounted_userstore info milestone:12.55:fs50:fs50 info milestone:12.68:fs90:fs90 info filesystems_setup:Create Symlink /app/bin/KPPMainApp to /app/bin/KPPMainAppV1:: info battery:charged:cap=,mV=,mAH=:cap=,mV=,mAH= info system:emiting_event:battery_ready:battery_ready debug sytem:event_emitted:battery_ready:battery_ready info filesystems_setup:Update file absent or failed to backup:: info milestone:12.91:fs99:fs99 info pt5:update:Parade TT4 Touch IC detected:Parade TT4 Touch IC detected info pt5:update:pt5 fw ver=33 file version=33:pt5 fw ver=33 file version=33 info system:emiting_event:loaded_touch:loaded_touch debug sytem:event_emitted:loaded_touch:loaded_touch info milestone:13.63:sys99:sys99 info system_setup:system_setup_after_shpm done:: info system:emiting_event:dbus_ready:dbus_ready debug sytem:event_emitted:dbus_ready:dbus_ready info dbus:check-update:status=2:status=2 dbus_ready sent info perfd:starting...:: info demd:starting...:: info battstressd:starting...:: info hardware:no_wan:: WiFi only device. No WAN found info milestone:14.69:dy01:dy01 info milestone:14.78:tt25:tt25 info milestone:14.96:pm25:pm25 warn system:bt_stack.conf exist:: info milestone:15.29:dy02:dy02 warn system:bt_did.conf exist:: info milestone:15.28:dy03:dy03 info milestone:16.00:xx00:xx00 info X:load:time=16050:time=16050 info X:xorg.conf:Generating xorg.conf:Generating xorg.conf info usbnet:kh_msg:: toggling sshd status info usbnet:kh_msg:: stopping sshd err usbnet:kh_msg:: failed to stop sshd info stopVoiceView:entered:arg=deleteAsrFlags:arg=deleteAsrFlags info X:xorg.conf:xorg.conf generated:xorg.conf generated info stopVoiceView:Deleting ASR Flags:: info milestone:18.25:xx50:xx50 info X:starting:time=18290:time=18290 warn usbnet:kh_msg:: removing stale sshd pidfile info usbnet:kh_msg:: starting sshd info usbnet:kh_msg:: tweaking iptables config info milestone:20.68:xx99:xx99 info X:started:time=20720:time=20720 info system:emiting_event:x_setup_ready:x_setup_ready debug sytem:event_emitted:x_setup_ready:x_setup_ready info bootactions:starting...:: info bootactions:waiting:for:for lipc... info asr_setup:Not in asr mode::reason=flag file not present. shutting down asr_setup:: info system:emiting_event:bootactions_ready:bootactions_ready debug sytem:event_emitted:bootactions_ready:bootactions_ready info register_oobe:registering...:: info locale:read:lang=en_GB.utf8,lc_all=en_GB.utf8:lang=en_GB.utf8,lc_all=en_GB.utf8 Retrieved Language info system:emiting_event:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0 debug sytem:event_emitted:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0 info starting:ffsd...:: info register_oobe:done...:: info lab126_gui:KPP OOBE flag found...Showing KPP Progress Bar:: err unable:to:start:start ffsd mode ZTS info ffsd:stopped...:: info asr_bt_reboot:asr_bt_reboot begin on started winmgr_ready:: info milestone:24.18:pi00:pi00 info milestone:24.42:pi99:pi99 info system:emiting_event:contentpack_font_ready:contentpack_font_ready debug sytem:event_emitted:contentpack_font_ready:contentpack_font_ready info linkss:start:: starting linkss info linkss:kh_msg:::checking screensavers... info linkss:kh_msg:: end of screensavers parsing info linkss:kh_msg:: mounting custom screensavers info milestone:26.48:fr00:fr00 info milestone:26.61:fr50:fr50 info milestone:26.74:fr51:fr51 info framework:starting:time=27830:time=27830 info framework:commandLine:HEAP = -Xmx49m -Xms49m -XX:MaxNewSize=4m -XX:SurvivorRatio=3 -XX:TargetSurvivorRatio=80 -Xss100k -XX:ReservedCodeCacheSize=3m -XX:+InitialGenPreTouch -XX:CompileThreshold=5000 -XX:CodeCacheMinimumFreeSpace=10l info hardware:no_wan:: WiFi only device. No WAN found info framework:##### Starting Java SE8 VM :: info hardware:no_wan:: WiFi only device. No WAN found [ 30.302367] <1>.(1)[3220:mtk_wmtd][WMT-CONSYS-HW][E]consys_emi_coredump_remapping(1361):No need to remapping again [ 30.561775] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_calibration_restore(3626):Did not restore calibration data. Buf=0x0, size=0 [ 30.563368] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_do_calibration(3846):Re-cal because restore fail(-6) info milestone:66.14:fr99:fr99 info framework:started:time=66260,delta=39560:time=66260,delta=39560 warn framework_setup:cannot get ffsdStatus:: info framework_setup:ffs Status=:: info framework_setup:ffsd is not active or ffs is complete:: info blanket_f:loading blanket module:usb:usb info system:emiting_event:framework_ready:framework_ready debug sytem:event_emitted:framework_ready:framework_ready info bootactions:stopped...:: info bridge:start:: hello there! (r17398) info bridge:start:: restoring rp from backups info fastmetrics:starting...:: info stored:started:: info bridge:start:: so uncivilized info stored:read_in_counters:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5 info clickstreamHeartbeatMetricsFramework:Skipping metrics recording, as it is the same day:: info monitor:writing_file:file=/var/run/upstart/stored.restarts:file=/var/run/upstart/stored.restarts Retrieved 461 keys for system/daemon/pmond/ Welcome to Kindle! kindle login: ====Misc.:==== TODO, to do, to do, to do, to do, to do, to dooooo :D\\ -OpenVPN\\ -fw_printenv\\ -package manager\\ For now, that's all. btc:12k6h1Zo1ZBw5mQSpGBTkHPpU2mQL8aLGj monero:48murcuRUGMLa2TNF6fJjWhzngfUP7RXufU6SHqXqwfW73b4nhYsY4mUHci5kFTTRmfZPTK22iESuGiz2v8eXn8jE8MDYtT https://www.buymeacoffee.com/trimen