Kindle hacking

-HW UART
-U-Boot CLI
-UART Linux shell (require jailbreak)
-Reverse engineering of unlocking mechanism
-eMMC interposer (v2 needed!!)\ \

In the new Kindle PW5, Amazon started using different CPU from previous models. Kindle PW5 is using Mediatek MT8113, bundled with 512Mb RAM.
All production devices are locked, which means you cannot use u-boot CLI because on a locked device there is forced execution of the fastboot command followed by the boot command when you try to access u-boot CLI.
With the u-boot in fastboot mode, it is possible to obtain some magic string via getvar command that can probably be used to generate unlock key. Unfortunately, that cannot be verified (yet), because there are some source codes missing.
Amazon also removed debug UART connector from the PCB.
On the production devices, the UART Linux shell is disabled.
28-10-2022:
If u-boot fails to load the kernel from eMMC, it enters fastboot.
03-11-2022:
If is used another eMMC on which the content of the previous is copied the ROM bootloader fails to load u-boot.

I suspected that there has to be UART somewhere, so I ordered yet another Kindle :) and started probing test pads on the bottom side of the PCB. This, unfortunately, led nowhere and only a couple of I2C buses were discovered that way.
The next step was to look into source codes released by Amazon thanks to the GPL license.
In the u-boot source, there is code for MAX20342 which is a USB type C detector IC for detecting different types of chargers, it also features USB C debug accessory mode (DAM) (USB Type C specification pg. 314) in which all some data pins can be used for non-USB purposes such as JTAG debugging.
In the datasheet for MAX20342 is stated that the IC will enter DAM if it senses 5.1kΩ pull-up resistors on CC1 and CC2 pins and 30/150kΩ pull-down resistors on one of the SBU pins.
Upon entering DAM mode MAX20342 connects the USB D+ and D- pins of the connector to the UART of the MT8113.
Configuration registers can disable this feature, but right now, they are at factory default (ver. 5.14.2)
Be aware of the 1.8V logic levels of the UART and don't try to connect 3.3V logic levels UART converted as you can damage your Kindle.

There is a photo of such contraption:
-On the PCB there is the FT232 USB to UART converter and buck regulator to generate 1.8V for powering the VCCIO pin of the converter.
-I also tried the CP2104 and CH340 converters, but they are struggling to run with 1.8V power for IO pins.

Currently, I have no method to enable the UART shell on the production device. The only possible way is to jailbreak your Kindle by the method provided by MobileRead forum member katadelos

In order to enable the UART root shell, you need to do two things:
- Modify /etc/shadow file to enable the root account.

root:!:10933:0:99999:7:::

to

root::10933:0:99999:7:::

- Modify /etc/init/console.conf (start at line ~66)

#We determine to execute getty, which prompts for the login password using the values in the /proc/cmdline file
#The locked variable is used lock the prompt

if [ "$prodVersion" = "0" -o "$unlockedKernel" = "true" -o "$secureCpu" = "0" ]; then
    #Unlocked Prompt if: unlockedKernel or not prod or not secure cpu
    exec getty -L $BAUD /dev/$UART 2>> $STDERR
else
    exec getty -L $BAUD /dev/$UART -i -n -l /etc/upstart/custom-login 2>> $STDERR
fi

to

#We determine to execute getty, which prompts for the login password using the values in the /proc/cmdline file
#The locked variable is used lock the prompt

if [ "$prodVersion" = "0" -o "$unlockedKernel" = "true" -o "$secureCpu" = "0" ]; then
    #Unlocked Prompt if: unlockedKernel or not prod or not secure cpu
    exec getty -L $BAUD /dev/$UART 2>> $STDERR
else
#exec console on locked device
    exec getty -L $BAUD /dev/$UART 2>> $STDERR
fi

*note: there is most likely a better way, like spawning /bin/sh on UART directly, but let's keep things simple.

In order to be able to easily modify, read out, and backup content of the eMMC chip, I created an interposer with the connector on which the board with the eMMC chip is placed.
Pinout was chosen to match the PINE64 eMMC module and reader. Unfortunately, the connector used on the PINE64 eMMC module and reader is hard to get, so I used the same pitch, but different dimensions connector. As I check it, it should be possible to place chosen connector to the reader PCB.

Files are available at GitLab KEIB

31-10-2022:
PCBs arrived along with the reballing stencils and balls. 03-11-2022:
I assembled and tested the boards, but I wasn't able to get PW5 running with the interposer installed. When I tried it, the Mediatek ROM bootloader just printed output and went to shutdown. I suspect that the signal integrity might be causing this. But there will be probably another catch as when I tried to make a copy of stock eMMC binary content to the new larger eMMC (just dd it) the bootloader also refused to boot properly. (with larger eMMC soldered directly on board)

I wasn't able to find much information about the Mediatek ROM bootloader. Links here and here.

From what I was able to get together you need access to UART0 and UART1 in order to use the tool for flashing. UART0 is outputted through a USB C connector, but UART1 is inaccessible. It might be somewhere on the bottom test pads.

The ROM bootloader output:

F0: 102B 0000
F3: 4000 0036 [0200]
F3: 4000 0036
F6: 380C 0000
F1: 5003 FF1E [0001]
F1: 5003 FF1E
00: 1005 0000
F3: 4000 0036 [0200]
F3: 4000 0036
F6: 380C 0000
F1: 5003 FF1E [0001]
F1: 5003 FF1E
01: 1005 0000
F6: 380C 0000
02: 1005 0000
F6: 380C 0000
03: 102A 0003
04: 0007 8000
05: 1005 0000
BP: 0800 0288 [0003]
EC: 0000 0000 [0001]
T0: 0000 014C [000F]
System halt!


F0: 102B 0000
F3: 4000 0036 [0200]
F3: 4000 0036
F6: 380E 00A8
F1: 5003 FF1E [0001]
F1: 5003 FF1E
00: 1005 0000
F3: 4000 0036 [0200]
F3: 4000 0036
F6: 380E 00A8
F1: 5003 FF1E [0001]
F1: 5003 FF1E
01: 1005 0000
F6: 380E 00A8
02: 1005 0000
F6: 380E 00A8
03: 102A 0003
04: 0007 8000
05: 1005 0000
BP: 0800 0288 [0003]
EC: 0000 0000 [0001]
T0: 0000 019D [000F]
System halt!

I think the first section is without any eMMC and the second section is with blank/other than stock eMMC as the output was the same.

�������������������������������������������������������������������������������������������������������������������������������������� MPU [LOCK
[TZ_EMI_MPU] MPU [0x43000000-0x4302FFFF]

Device APC domain init setup:

Domain Setup (0x0)
Domain Setup (0x0)
Domain Setup (0x0)
Device APC domain after setup:
Domain Setup (0x11111111)
Domain Setup (0x10111111)
Domain Setup (0x2111111)

Device APC slave permission init setup:

[ATF](0)[0.000521]mmap:
[ATF](0)[0.000782] VA:0x10f000  PA:0x10f000  size:0x2000  attr:0x8  granularity:0x40000000
[ATF](0)[0.001773] VA:0xc000000  PA:0xc000000  size:0x600000  attr:0x8  granularity:0x40000000
[ATF](0)[0.002807] VA:0x10006000  PA:0x10006000  size:0x100000  attr:0x8  granularity:0x40000000
[ATF](0)[0.003863] VA:0x10000000  PA:0x10000000  size:0x400000  attr:0x8  granularity:0x40000000
[ATF](0)[0.004918] VA:0x10400000  PA:0x10400000  size:0x50000  attr:0x8  granularity:0x40000000
[ATF](0)[0.005963] VA:0x10480000  PA:0x10480000  size:0x10000  attr:0x8  granularity:0x40000000
[ATF](0)[0.007007] VA:0x11000000  PA:0x11000000  size:0x4000000  attr:0x8  granularity:0x40000000
[ATF](0)[0.008073] VA:0x15000000  PA:0x15000000  size:0x1000  attr:0x8  granularity:0x40000000
[ATF](0)[0.009107] VA:0x43001000  PA:0x43001000  size:0x17000  attr:0x2  granularity:0x40000000
[ATF](0)[0.010152] VA:0x43027000  PA:0x43027000  size:0x1000  attr:0x8  granularity:0x40000000
[ATF](0)[0.011185] VA:0x43000000  PA:0x43000000  size:0x30000  attr:0xa  granularity:0x40000000
[ATF](0)[0.012230] VA:0x44400000  PA:0x44400000  size:0x10000  attr:0x18  granularity:0x40000000
[ATF](0)[0.013285]
NOTICE:  [ATF](0)[0.015451]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e
NOTICE:  [ATF](0)[0.016333]BL31: Built : 17:35:52, Jul 23 2021
NOTICE:  [ATF](0)[0.017023]BL31_BASE=0x43001000, BL31_TZRAM_SIZE=0x2f000
NOTICE:  [ATF](0)[0.017820]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e
NOTICE:  [ATF](0)[0.018703]BL31: Built : 17:35:52, Jul 23 2021
E/TC:0 mtk_rng_init:16 mtk rng initialized
E/TC:0 crypto_init:12 Crypto initialization
NOTICE:  [ATF](0)[0.048534]NS-SCR_EL3_EFIN=0x4
NOTICE:  [ATF](0)[0.049051]S-SCR_EL3_EFIN=0x0


U-Boot 2019.04-ga324c90 (Dec 04 2021 - 04:06:37 +0000), Build: jenkins-bootloader-malbec-1019

Model: MT8110 BELLATRIX
DRAM:  512 MiB
MMC:   mmc@11230000: 0
idme_initialize
phase: [map:ffffff1fffffffff] [maxlen:37] [final:12]
Idme version is 2.x and set related function to V2.x
IDME table version 2.1
Board ID is P002EQ0220240C81
   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
## Loading loadables from FIT Image at 41000000 ...
   Trying 'fbios' loadables subimage
     Description:  FBIOS Image
     Type:         Firmware
     Compression:  uncompressed
     Data Start:   0x410000cc
     Data Size:    176204 Bytes = 172.1 KiB
     Architecture: ARM
     OS:           Unknown OS
     Load Address: 0x5f9a0000
     Hash algo:    sha256
     Hash value:   7df4454257f15542af45973d66681030ef317eb5f952c370dee59b10187da537
   Verifying Hash Integrity ... sha256+ OK
   Loading loadables from 0x410000cc to 0x5f9a0000
## Loading loadables from FIT Image at 41000000 ...
   Trying 'sbios' loadables subimage
     Description:  SBIOS Image
     Type:         Firmware
     Compression:  uncompressed
     Data Start:   0x4102b1e8
     Data Size:    54728 Bytes = 53.4 KiB
     Architecture: ARM
     OS:           Unknown OS
     Load Address: 0x5f980000
     Hash algo:    sha256
     Hash value:   21f85d3804f83dedf8f04d3bfbebe592ddc0e90164593122664ed520a22b7c37
   Verifying Hash Integrity ... sha256+ OK
   Loading loadables from 0x4102b1e8 to 0x5f980000
hibernation: Not from hibernation
Core : b69d31e 2020/07/08 01:35:32 (Licensed to Amazon Fulfillment Services,Inc.)
SBIOS: v2.0 2021/07/07 14:17:22
TTBR:5f9ec059
Core: b69d31e 2020/07/08 01:35:32
Platform: v2.0 2021/07/07 14:17:22
max bank = 1
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Hardware Board: DVT(DOE3)
amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5
Secure Info: secure_cpu: 1, production: 1, unlocked: 0
Hit any key to stop autoboot:  0 
## Loading kernel from FIT Image at 41000000 ...
   Using 'conf-mt8110-malbec' configuration
   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
   Trying 'kernel' kernel subimage
     Description:  Kernel
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x410000c4
     Data Size:    6501600 Bytes = 6.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    sha256
     Hash value:   975bab5256b1383732bef9b98b20ad7e5220c2c1a996b20bb64dd30231b34ee6
   Verifying Hash Integrity ... sha256+ OK
## Loading ramdisk from FIT Image at 41000000 ...
   Using 'conf-mt8110-malbec' configuration
   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
   Trying 'ramdisk' ramdisk subimage
     Description:  ramdisk
     Type:         RAMDisk Image
     Compression:  uncompressed
     Data Start:   0x41633690
     Data Size:    1667584 Bytes = 1.6 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x44080000
     Entry Point:  unavailable
     Hash algo:    sha256
     Hash value:   65d072008e55511d1e418b64a9a21fe0bd0ef5b9f6b85eefbc0d1fb7b63c2b7b
   Verifying Hash Integrity ... sha256+ OK
   Loading ramdisk from 0x41633690 to 0x44080000
## Loading fdt from FIT Image at 41000000 ...
   Using 'conf-mt8110-malbec' configuration
   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
   Trying 'fdt-mt8110-malbec' fdt subimage
     Description:  Flattened Device Tree blob mt8110-malbec.dtb
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x417ca9a0
     Data Size:    48136 Bytes = 47 KiB
     Architecture: ARM
     Load Address: 0x44000000
     Hash algo:    sha256
     Hash value:   1d22d5f38132d2b1e64524471ff23c9cc792a585a8c757f546b1085f1ed5103d
   Verifying Hash Integrity ... sha256+ OK
   Loading fdt from 0x417ca9a0 to 0x44000000
   Booting using the fdt blob at 0x44000000
   Loading Kernel Image ... OK
ERROR: reserving fdt memory region failed (addr=5f000000 size=400000)
   Using Device Tree in place at 44000000, end 4400ec07
amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5
   secure_cpu: 1, production: 1, unlocked: 0
   OK to initialize idme device tree
   Applied falcon mmc driver

Starting kernel ...

[    0.000000] <0>-(0)[0:swapper]Booting Linux on physical CPU 0x0
[    0.000000] <0>-(0)[0:swapper]Linux version 4.9.77-lab126 (builder@eink-builds) (gcc version 4.9.1 (GCC) ) #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022
[    0.000000] <0>-(0)[0:swapper]CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
[    0.000000] <0>-(0)[0:swapper]CPU: div instructions available: patching division code
[    0.000000] <0>-(0)[0:swapper]CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] <0>-(0)[0:swapper]OF: fdt:Machine model: MT8110 Bellatrix device
[    0.000000] <0>-(0)[0:swapper]earlycon: uart8250 at MMIO32 0x11002000 (options '')
[    0.000000] <0>-(0)[0:swapper]bootconsole [uart8250] enabled
[    0.085483] <0>.(0)[1:swapper/0]'atag,devinfo' is not found
[    0.430893] <1>.(1)[1:swapper/0]mt8512-cpufreq mt8512-cpufreq: failed to initialize dvfs info for cpu0
[    0.445620] <1>.(1)[1:swapper/0]mtu3 11211000.usb: couldn't get extcon device
[    0.449118] <1>.(1)[1:swapper/0]lm3692x 0-0037: unable to request PWM
[    0.450066] <1>.(1)[1:swapper/0]lm3692x 0-0037: Cannot read/clear faults
[    0.450911] <1>.(1)[1:swapper/0]lm3692x 0-0037: Fail writing initialization values
[    0.452368] <1>.(1)[1:swapper/0]lm3692x 0-0036: unable to request PWM
[    0.453302] <1>.(1)[1:swapper/0]lm3692x 0-0036: Cannot read/clear faults
[    0.454195] <1>.(1)[1:swapper/0]lm3692x 0-0036: Fail writing initialization values
[    0.459708] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_00=0x40 
[    0.460899] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_01=0x00 
[    0.462083] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_02=0x00 
[    0.463267] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_03=0x30 
[    0.464496] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_04=0x00 
[    0.465678] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_05=0x00 
[    0.466860] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_06=0x00 
[    0.468041] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_07=0x00 
[    0.469223] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_08=0x00 
[    0.470405] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_09=0x00 
[    0.471588] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_10=0x00 
[    0.472770] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_11=0x00 
[    0.473974] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_12=0x00 
[    0.475157] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_13=0x00 
[    0.476115] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: Reboot Reason: POWER_OFF            System Powered Off
[    0.500859] <1>.(1)[1:swapper/0]mtk-imgrz 15004000.imgrz: mtk_imgrz_probe is earlier than SMI
[    0.503821] <1>.(1)[6:kworker/u4:0]OF: /rdma@15007000: could not get #mbox-cells for /gce@10238000
[    0.505881] <0>.(0)[1:swapper/0]mtk-jdec 15003000.jdec: mtk_jdec_probe is earlier than SMI
[    0.507213] <0>.(0)[1:swapper/0]mtk_png_probe called
[    0.507856] <0>.(0)[1:swapper/0]imgresz_probe is earlier than SMI
MMC v5.1
phase: [map:ffffff1f_ffffffff] [maxlen:37] [final:12]
MMC's timing interface is HS200
SBIOS info
storage_type: MMC
erase_size: 1024
capacity: 15273600 * 512Byte
[    0.626807] <1>.(1)[112:kworker/1:2]mtk_png_probe called
[    0.628035] <1>.(1)[112:kworker/1:2]driver registered as /dev/video6
[    0.632298] <0>.(0)[1:swapper/0]memory-ssmr: [INIT FAIL]: cma is not inited
[    0.633188] <0>.(0)[1:swapper/0]memory-ssmr: SSMR sanity fail
[    0.638266] <0>.(0)[1:swapper/0]idt_wireless_power 0-0061: p922x_parse_dt: Device have associated DT data
[    0.646425] <1>.(1)[1:swapper/0][mtk_svs] no "calibration-data" from dts? disable mon mode
4.9.77-lab126 #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022 armv7l
BOOTING DEFAULT.
IP-Config: no devices to configure
kinit: Mounted root (ext3 filesystem) readonly.
info sytem:mounted_proc::
info system:mounted_sys::
info system:sy00::
info system:mounted_dev::
info milestone:4.21:49.1:49.1
info milestone:4.27:49.2:49.2
info milestone:4.32:49.3:49.3
info milestone:4.39:49.4:49.4
info milestone:4.42:49.5:49.5
info sytem:mounted_tmpfs::
info milestone:4.58:sy50:sy50
info system:start:time=4620:time=4620
info hardware:no_wan:: WiFi only device. No WAN found
info system:config:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N
info milestone:4.83:sy51:sy51
lipc-send-event[321]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[321]: C def:dbusi::Failed to init dbus
lipc-send-event[321]: E def:open::Failed to open LIPC
lipc-send-event[321]: E def:fail:source=com.lab126.hal, event=powerButtonPressed:Sending event failed
lipc-send-event[393]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[393]: C def:dbusi::Failed to init dbus
lipc-send-event[393]: E def:open::Failed to open LIPC
lipc-send-event[393]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
lipc-send-event[419]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[419]: C def:dbusi::Failed to init dbus
lipc-send-event[419]: E def:open::Failed to open LIPC
lipc-send-event[419]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
info milestone:5.68:sy99:sy99
info system:done:time=5720:time=5720
crond[430]: crond (busybox 1.28.3) started, log level 8

init.exe: sshd main process (429) terminated with status 127
init.exe: sshd main process ended, respawning
init.exe: recevent pre-start process (433) terminated with status 1



Welcome to Kindle!

kindle login: info milestone:5.97:sc01:sc01
info system_fs_loopbacks:mountingfs:Mounting compressed directories filesystem images:Mounting compressed directories filesystem images
info milestone:5.99:sc02:sc02
info milestone:6.03:/usr/share/X11/xkb:/usr/share/X11/xkb
info system_fs_loopbacks:mounted:Image /usr/share/X11/xkb.sqsh mounted:Image /usr/share/X11/xkb.sqsh mounted
info milestone:6.13:3:3
info milestone:6.14:sc05:sc05
info milestone:6.16:/usr/java/lib/fonts:/usr/java/lib/fonts
info system_fs_loopbacks:mounted:Image /usr/java/lib/fonts.sqsh mounted:Image /usr/java/lib/fonts.sqsh mounted
info milestone:6.27:4:4
info milestone:6.28:sc05:sc05
info milestone:6.31:/etc/kdb.src:/etc/kdb.src
info system_fs_loopbacks:mounted:Image /etc/kdb.src.sqsh mounted:Image /etc/kdb.src.sqsh mounted
info milestone:6.42:5:5
info milestone:6.43:sc05:sc05
info milestone:6.45:/usr/lib/locale:/usr/lib/locale
info system_fs_loopbacks:mounted:Image /usr/lib/locale.sqsh mounted:Image /usr/lib/locale.sqsh mounted
info milestone:6.57:6:6
info milestone:6.58:sc05:sc05
info milestone:6.60:/usr/share/keyboard:/usr/share/keyboard
info system_fs_loopbacks:mounted:Image /usr/share/keyboard.sqsh mounted:Image /usr/share/keyboard.sqsh mounted
info milestone:6.81:7:7
info milestone:6.82:sc05:sc05
info milestone:6.85:/opt/var/local:/opt/var/local
info system_fs_loopbacks:mounted:Image /opt/var/local.sqsh mounted:Image /opt/var/local.sqsh mounted
info milestone:6.96:8:8
info milestone:6.97:sc05:sc05
info milestone:6.99:sc07:sc07
info system:emiting_event:mounted_fs_loopbacks:mounted_fs_loopbacks
debug sytem:event_emitted:mounted_fs_loopbacks:mounted_fs_loopbacks
info milestone:7.05:fs75:fs75
info system:emiting_event:loaded_modules_dependencies:loaded_modules_dependencies
debug sytem:event_emitted:loaded_modules_dependencies:loaded_modules_dependencies
info system:emiting_event:loaded_fuse:loaded_fuse
debug sytem:event_emitted:loaded_fuse:loaded_fuse
info modules:modprobe:loading module falcon:loading module falcon
info milestone:7.14:fs00:fs00
info system:emiting_event:loaded_falcon:loaded_falcon
debug sytem:event_emitted:loaded_falcon:loaded_falcon
info hardware:no_wan:: WiFi only device. No WAN found
info system:emiting_event:loaded_ppp_async:loaded_ppp_async
debug sytem:event_emitted:loaded_ppp_async:loaded_ppp_async
info filesystems_keys:not applicable for this device type::
info modules:modprobe:loading module opt3001:loading module opt3001
info system:emiting_event:loaded_opt3001:loaded_opt3001
debug sytem:event_emitted:loaded_opt3001:loaded_opt3001
info system:emiting_event:loaded_fakekey:loaded_fakekey
debug sytem:event_emitted:loaded_fakekey:loaded_fakekey
info filesystems_var_local:File system errors checked. Return code 0:LocalVars: clean, 1436/65536 files, 41835/262144 blocks:LocalVars: clean, 1436/65536 files, 41835/262144 blocks
info filesystems_var_local:No file system errors::
info filesystems_var_local:runfixup:Running /var/local/system/fixup:Running /var/local/system/fixup
info jb_bridge:main:: i can fix this (r18869)
info jb_bridge:main:: these are not the droids you're looking for
info filesystems_var_local:DB PARAMS:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB.:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB.
info milestone:7.70:fs23:fs23
info system:emiting_event:mounted_varLocal:mounted_varLocal
debug sytem:event_emitted:mounted_varLocal:mounted_varLocal
info milestone:7.79:vi00:vi00
info touch:detect:TOUCH_ID=0:TOUCH_ID=0
info milestone:7.89:vi99:vi99
info touch:id_release:release touch id pins:release touch id pins
info touch:detect:install Parade touch driver:install Parade touch driver
info display:started:time=7930:time=7930
info system:emiting_event:display_ready:display_ready
debug sytem:event_emitted:display_ready:display_ready
info milestone:8.32:fs25:fs25
info prereg:PRAGMA_QUICK_CHECK_PASSED:: sts=0
info userstore:run:time=8600,action=start:time=8600,action=start
info userstore:start:found_shutdown_flag:found_shutdown_flag Found SHUTDOWN flag file
err mntus:loopback_not_mounted:: loopback device is not set-up
[   10.563776] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_hid_send_output_user_and_wait_: HID output cmd execution timed out
[   10.565273] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_request_pip2_send_cmd: nonhid_cmd->user_cmd() Error = -62
[   10.566663] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_pip2_get_version: Error Sending PIP2 VERSION Cmd rc=-62
[   11.006268] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001
[   12.484323] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001
info system:emiting_event:mounted_userstore:mounted_userstore
debug sytem:event_emitted:mounted_userstore:mounted_userstore
info milestone:12.55:fs50:fs50
info milestone:12.68:fs90:fs90
info filesystems_setup:Create Symlink /app/bin/KPPMainApp to /app/bin/KPPMainAppV1::
info battery:charged:cap=,mV=,mAH=:cap=,mV=,mAH=
info system:emiting_event:battery_ready:battery_ready
debug sytem:event_emitted:battery_ready:battery_ready
info filesystems_setup:Update file absent or failed to backup::
info milestone:12.91:fs99:fs99
info pt5:update:Parade TT4 Touch IC detected:Parade TT4 Touch IC detected
info pt5:update:pt5 fw ver=33 file version=33:pt5 fw ver=33 file version=33
info system:emiting_event:loaded_touch:loaded_touch
debug sytem:event_emitted:loaded_touch:loaded_touch
info milestone:13.63:sys99:sys99
info system_setup:system_setup_after_shpm done::
info system:emiting_event:dbus_ready:dbus_ready
debug sytem:event_emitted:dbus_ready:dbus_ready
info dbus:check-update:status=2:status=2 dbus_ready sent
info perfd:starting...::
info demd:starting...::
info battstressd:starting...::
info hardware:no_wan:: WiFi only device. No WAN found
info milestone:14.69:dy01:dy01
info milestone:14.78:tt25:tt25
info milestone:14.96:pm25:pm25
warn system:bt_stack.conf exist::
info milestone:15.29:dy02:dy02
warn system:bt_did.conf exist::
info milestone:15.28:dy03:dy03
info milestone:16.00:xx00:xx00
info X:load:time=16050:time=16050
info X:xorg.conf:Generating xorg.conf:Generating xorg.conf
info usbnet:kh_msg:: toggling sshd status
info usbnet:kh_msg:: stopping sshd
err usbnet:kh_msg:: failed to stop sshd
info stopVoiceView:entered:arg=deleteAsrFlags:arg=deleteAsrFlags
info X:xorg.conf:xorg.conf generated:xorg.conf generated
info stopVoiceView:Deleting ASR Flags::
info milestone:18.25:xx50:xx50
info X:starting:time=18290:time=18290
warn usbnet:kh_msg:: removing stale sshd pidfile
info usbnet:kh_msg:: starting sshd
info usbnet:kh_msg:: tweaking iptables config
info milestone:20.68:xx99:xx99
info X:started:time=20720:time=20720
info system:emiting_event:x_setup_ready:x_setup_ready
debug sytem:event_emitted:x_setup_ready:x_setup_ready
info bootactions:starting...::
info bootactions:waiting:for:for lipc...
info asr_setup:Not in asr mode::reason=flag file not present. shutting down asr_setup::
info system:emiting_event:bootactions_ready:bootactions_ready
debug sytem:event_emitted:bootactions_ready:bootactions_ready
info register_oobe:registering...::
info locale:read:lang=en_GB.utf8,lc_all=en_GB.utf8:lang=en_GB.utf8,lc_all=en_GB.utf8 Retrieved Language
info system:emiting_event:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0
debug sytem:event_emitted:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0
info starting:ffsd...::
info register_oobe:done...::
info lab126_gui:KPP OOBE flag found...Showing KPP Progress Bar::
err unable:to:start:start ffsd mode ZTS
info ffsd:stopped...::
info asr_bt_reboot:asr_bt_reboot begin on started winmgr_ready::
info milestone:24.18:pi00:pi00
info milestone:24.42:pi99:pi99
info system:emiting_event:contentpack_font_ready:contentpack_font_ready
debug sytem:event_emitted:contentpack_font_ready:contentpack_font_ready
info linkss:start:: starting linkss
info linkss:kh_msg:::checking screensavers...
info linkss:kh_msg:: end of screensavers parsing
info linkss:kh_msg:: mounting custom screensavers
info milestone:26.48:fr00:fr00
info milestone:26.61:fr50:fr50
info milestone:26.74:fr51:fr51
info framework:starting:time=27830:time=27830
info framework:commandLine:HEAP = -Xmx49m -Xms49m  -XX:MaxNewSize=4m -XX:SurvivorRatio=3 -XX:TargetSurvivorRatio=80 -Xss100k -XX:ReservedCodeCacheSize=3m -XX:+InitialGenPreTouch -XX:CompileThreshold=5000 -XX:CodeCacheMinimumFreeSpace=10l
info hardware:no_wan:: WiFi only device. No WAN found
info framework:##### Starting Java SE8 VM ::
info hardware:no_wan:: WiFi only device. No WAN found
[   30.302367] <1>.(1)[3220:mtk_wmtd][WMT-CONSYS-HW][E]consys_emi_coredump_remapping(1361):No need to remapping again
[   30.561775] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_calibration_restore(3626):Did not restore calibration data. Buf=0x0, size=0
[   30.563368] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_do_calibration(3846):Re-cal because restore fail(-6)
info milestone:66.14:fr99:fr99
info framework:started:time=66260,delta=39560:time=66260,delta=39560
warn framework_setup:cannot get ffsdStatus::
info framework_setup:ffs Status=::
info framework_setup:ffsd is not active or ffs is complete::
info blanket_f:loading blanket module:usb:usb
info system:emiting_event:framework_ready:framework_ready
debug sytem:event_emitted:framework_ready:framework_ready
info bootactions:stopped...::
info bridge:start:: hello there! (r17398)
info bridge:start:: restoring rp from backups
info fastmetrics:starting...::
info stored:started::
info bridge:start:: so uncivilized
info stored:read_in_counters:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5
info clickstreamHeartbeatMetricsFramework:Skipping metrics recording, as it is the same day::
info monitor:writing_file:file=/var/run/upstart/stored.restarts:file=/var/run/upstart/stored.restarts
Retrieved 461 keys for system/daemon/pmond/


Welcome to Kindle!

kindle login: 

TODO, to do, to do, to do, to do, to do, to dooooo :D
-OpenVPN
-fw_printenv
-package manager

For now, that's all.

btc:12k6h1Zo1ZBw5mQSpGBTkHPpU2mQL8aLGj monero:48murcuRUGMLa2TNF6fJjWhzngfUP7RXufU6SHqXqwfW73b4nhYsY4mUHci5kFTTRmfZPTK22iESuGiz2v8eXn8jE8MDYtT https://www.buymeacoffee.com/trimen