Differences

This shows you the differences between two versions of the page.

--- projects:kindlepw5 [2022/10/02 15:38] – created trimen
+++ projects:kindlepw5 [2024/06/14 16:17] (current) – trimen
@@ Line 1: / Line 1: @@
+<html>
+  <head>
+    <meta http-equiv="refresh" content="0; url=https://wiki.taktpraha.cz/projects/kindlehax">
+  </head>
+</html>
 =======Kindle hacking=======
 =====PW5:=====
 ====Goals:====
-<del>HW UART</del>\\
+-<del>HW UART</del>\\
-U-Boot CLI\\
+-U-Boot CLI\\
-<del>UART Linux shell</del>\\
+-<del>UART Linux shell</del>  (require jailbreak)\\
-Reverse engineering of unlocking mechanism\\
+-Reverse engineering of unlocking mechanism\\
+-eMMC interposer (v2 needed!!)\ \
-===Summary===
+====Overview====
 In the new Kindle PW5, Amazon started using different CPU from previous models. Kindle PW5 is using Mediatek MT8113, bundled with 512Mb RAM.\\
-All production devices are locked, which means you cannot use u-boot CLI because on a locked device there is forced execution of fastboot command followed by boot command when you try to access u-boot CLI.\\
+All production devices are locked, which means you cannot use u-boot CLI because on a locked device there is forced execution of the fastboot command followed by the boot command when you try to access u-boot CLI.\\
-With the u-boot in fastboot mode, it is possible to obtain some kind of magic string via getvar command that can probably be used to generate unlock key. Unfortunately, that cannot be verified (yet), because there are some source codes missing.\\
+With the u-boot in fastboot mode, it is possible to obtain some magic string via getvar command that can probably be used to generate unlock key. Unfortunately, that cannot be verified (yet), because there are some source codes missing.\\
 Amazon also removed debug UART connector from the PCB.\\
 On the production devices, the UART Linux shell is disabled.\\
+**28-10-2022:**\\
+If u-boot fails to load the kernel from eMMC, it enters fastboot.\\
+**03-11-2022:**\\
+If is used another eMMC on which the content of the previous is copied the ROM bootloader fails to load u-boot.\\
-===Getting UART===
+====Getting UART====
-I suspected that there have to be UART somewhere, so I ordered yet another Kindle and started probing test pads on the bottom side of the PCB. This, unfortunately, led nowhere and only a couple of I2C buses were discovered that way. \\
+I suspected that there has to be UART somewhere, so I ordered yet another Kindle :) and started probing test pads on the bottom side of the PCB. This, unfortunately, led nowhere and only a couple of I2C buses were discovered that way. \\
-The next step was to look into source codes released by Amazon in favor of the GPL license.\\
+The next step was to look into [[https://www.amazon.com/gp/help/customer/display.html?nodeId=200203720 | source codes]] released by Amazon thanks to the GPL license.\\
 In the u-boot source, there is code for [[https://datasheets.maximintegrated.com/en/ds/MAX20342.pdf|MAX20342]] which is a USB type C detector IC for detecting different types of chargers, it also features USB C debug accessory mode (DAM) ([[https://www.usb.org/sites/default/files/USB%20Type-C%20Spec%20R2.0%20-%20August%202019.pdf|USB Type C specification pg. 314]]) in which <del>all</del> some data pins can be used for non-USB purposes such as JTAG debugging. \\
 In the datasheet for MAX20342 is stated that the IC will enter DAM if it senses 5.1kΩ pull-up resistors on CC1 and CC2 pins and 30/150kΩ pull-down resistors on one of the SBU pins.\\
-Upon entering DAM mode MAX20342 connects USB D+ and D- pins of the connector to UART of the MT8113.\\
+Upon entering DAM mode MAX20342 connects the USB D+ and D- pins of the connector to the UART of the MT8113.\\
+Configuration registers can disable this feature, but right now, they are at factory default (ver. 5.14.2)\\
 Be aware of the **1.8V logic levels** of the UART and **don't try to connect 3.3V logic levels UART converted** as you can damage your Kindle.\\
 There is a photo of such contraption:\\
--On the PCB there is FT232 USB to UART converter and buck type regulator to generate 1.8V for powering the VCCIO pin of the converter.\\
+-On the PCB there is the FT232 USB to UART converter and buck regulator to generate 1.8V for powering the VCCIO pin of the converter.\\
--I tried the CP2104 and CH340 converters as well, but they are struggling to run with 1.8V power for IO pins.
+-I also tried the CP2104 and CH340 converters, but they are struggling to run with 1.8V power for IO pins.
-Fotka desky převodníku.
+{{https://trimen.org/kindle/ftdi.jpg?nolink&800}}
-===Getting UART Linux shell===
+====Getting UART Linux shell====
 Currently, I have no method to enable the UART shell on the production device.
 The only possible way is to jailbreak your Kindle by the method provided by [[https://www.mobileread.com/forums/showthread.php?t=346037|MobileRead forum member katadelos]]\\
@@ Line 65: / Line 77: @@
 </code>
+*note: there is most likely a better way, like spawning /bin/sh on UART directly, but let's keep things simple.
+==== Internal photos: ====
+{{https://trimen.org/kindle/kindle_open.jpg?nolink&1000}}
+{{https://trimen.org/kindle/kindle_wo_shield.jpg?nolink&1000}}
+{{https://trimen.org/kindle/kindle_cpu_det.jpg?nolink&1000}}
+{{https://trimen.org/kindle/pcb_top.jpg?nolink&1000}}
+{{https://trimen.org/kindle/pcb_bot.jpg?nolink&1000}}
+====eMMC interposer:====
+In order to be able to easily modify, read out, and backup content of the eMMC chip, I created an interposer with the connector on which the board with the eMMC chip is placed.\\
+Pinout was chosen to match the PINE64 eMMC module and [[https://pine64.com/product/usb-adapter-for-emmc-module |reader]]. Unfortunately, the connector used on the PINE64 eMMC module and reader is hard to get, so I used the same pitch, but different dimensions connector. As I check it, it should be possible to place chosen connector to the reader PCB.
+Files are available at GitLab [[https://git.taktpraha.cz/trimen/keib|KEIB]]
+**31-10-2022:**\\
+PCBs arrived along with the reballing stencils and balls.
+**03-11-2022:**\\
+I assembled and tested the boards, but I wasn't able to get PW5 running with the interposer installed. When I tried it, the Mediatek ROM bootloader just printed output and went to shutdown. I suspect that the signal integrity might be causing this. But there will be probably another catch as when I tried to make a copy of stock eMMC binary content to the new larger eMMC (just dd it) the bootloader also refused to boot properly. (with larger eMMC soldered directly on board)\\
+I wasn't able to find much information about the Mediatek ROM bootloader. Links [[https://mediatek.gitlab.io/aiot/doc/aiot-dev-guide/sw/yocto/board-bringup.html|here]] and [[https://forum.xda-developers.com/t/unlock-root-twrp-unbrick-fire-tv-stick-2nd-gen-tank.3907002/page-56|here]].\\
+From what I was able to get together you need access to UART0 and UART1 in order to use the tool for flashing. UART0 is outputted through a USB C connector, but UART1 is inaccessible. It might be somewhere on the bottom test pads.
+The ROM bootloader output:
+<code>
+F0: 102B 0000
+F3: 4000 0036 [0200]
+F3: 4000 0036
+F6: 380C 0000
+F1: 5003 FF1E [0001]
+F1: 5003 FF1E
+: 1005 0000
+F3: 4000 0036 [0200]
+F3: 4000 0036
+F6: 380C 0000
+F1: 5003 FF1E [0001]
+F1: 5003 FF1E
+: 1005 0000
+F6: 380C 0000
+: 1005 0000
+F6: 380C 0000
+: 102A 0003
+: 0007 8000
+: 1005 0000
+BP: 0800 0288 [0003]
+EC: 0000 0000 [0001]
+T0: 0000 014C [000F]
+System halt!
+F0: 102B 0000
+F3: 4000 0036 [0200]
+F3: 4000 0036
+F6: 380E 00A8
+F1: 5003 FF1E [0001]
+F1: 5003 FF1E
+: 1005 0000
+F3: 4000 0036 [0200]
+F3: 4000 0036
+F6: 380E 00A8
+F1: 5003 FF1E [0001]
+F1: 5003 FF1E
+: 1005 0000
+F6: 380E 00A8
+: 1005 0000
+F6: 380E 00A8
+: 102A 0003
+: 0007 8000
+: 1005 0000
+BP: 0800 0288 [0003]
+EC: 0000 0000 [0001]
+T0: 0000 019D [000F]
+System halt!
+</code>
+I think the first section is without any eMMC and the second section is with blank/other than stock eMMC as the output was the same.
+====Boot log:====
+<code>
+�������������������������������������������������������������������������������������������������������������������������������������� MPU [LOCK
+[TZ_EMI_MPU] MPU [0x43000000-0x4302FFFF]
+Device APC domain init setup:
+Domain Setup (0x0)
+Domain Setup (0x0)
+Domain Setup (0x0)
+Device APC domain after setup:
+Domain Setup (0x11111111)
+Domain Setup (0x10111111)
+Domain Setup (0x2111111)
+Device APC slave permission init setup:
+[ATF](0)[0.000521]mmap:
+[ATF](0)[0.000782] VA:0x10f000  PA:0x10f000  size:0x2000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.001773] VA:0xc000000  PA:0xc000000  size:0x600000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.002807] VA:0x10006000  PA:0x10006000  size:0x100000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.003863] VA:0x10000000  PA:0x10000000  size:0x400000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.004918] VA:0x10400000  PA:0x10400000  size:0x50000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.005963] VA:0x10480000  PA:0x10480000  size:0x10000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.007007] VA:0x11000000  PA:0x11000000  size:0x4000000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.008073] VA:0x15000000  PA:0x15000000  size:0x1000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.009107] VA:0x43001000  PA:0x43001000  size:0x17000  attr:0x2  granularity:0x40000000
+[ATF](0)[0.010152] VA:0x43027000  PA:0x43027000  size:0x1000  attr:0x8  granularity:0x40000000
+[ATF](0)[0.011185] VA:0x43000000  PA:0x43000000  size:0x30000  attr:0xa  granularity:0x40000000
+[ATF](0)[0.012230] VA:0x44400000  PA:0x44400000  size:0x10000  attr:0x18  granularity:0x40000000
+[ATF](0)[0.013285]
+NOTICE:  [ATF](0)[0.015451]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e
+NOTICE:  [ATF](0)[0.016333]BL31: Built : 17:35:52, Jul 23 2021
+NOTICE:  [ATF](0)[0.017023]BL31_BASE=0x43001000, BL31_TZRAM_SIZE=0x2f000
+NOTICE:  [ATF](0)[0.017820]BL31: v1.6(release):aud-release_2021_03_25-5-g13a167e
+NOTICE:  [ATF](0)[0.018703]BL31: Built : 17:35:52, Jul 23 2021
+E/TC:0 mtk_rng_init:16 mtk rng initialized
+E/TC:0 crypto_init:12 Crypto initialization
+NOTICE:  [ATF](0)[0.048534]NS-SCR_EL3_EFIN=0x4
+NOTICE:  [ATF](0)[0.049051]S-SCR_EL3_EFIN=0x0
+U-Boot 2019.04-ga324c90 (Dec 04 2021 - 04:06:37 +0000), Build: jenkins-bootloader-malbec-1019
+Model: MT8110 BELLATRIX
+DRAM:  512 MiB
+MMC:   mmc@11230000: 0
+idme_initialize
+phase: [map:ffffff1fffffffff] [maxlen:37] [final:12]
+Idme version is 2.x and set related function to V2.x
+IDME table version 2.1
+Board ID is P002EQ0220240C81
+   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
+## Loading loadables from FIT Image at 41000000 ...
+   Trying 'fbios' loadables subimage
+     Description:  FBIOS Image
+     Type:         Firmware
+     Compression:  uncompressed
+     Data Start:   0x410000cc
+     Data Size:    176204 Bytes = 172.1 KiB
+     Architecture: ARM
+     OS:           Unknown OS
+     Load Address: 0x5f9a0000
+     Hash algo:    sha256
+     Hash value:   7df4454257f15542af45973d66681030ef317eb5f952c370dee59b10187da537
+   Verifying Hash Integrity ... sha256+ OK
+   Loading loadables from 0x410000cc to 0x5f9a0000
+## Loading loadables from FIT Image at 41000000 ...
+   Trying 'sbios' loadables subimage
+     Description:  SBIOS Image
+     Type:         Firmware
+     Compression:  uncompressed
+     Data Start:   0x4102b1e8
+     Data Size:    54728 Bytes = 53.4 KiB
+     Architecture: ARM
+     OS:           Unknown OS
+     Load Address: 0x5f980000
+     Hash algo:    sha256
+     Hash value:   21f85d3804f83dedf8f04d3bfbebe592ddc0e90164593122664ed520a22b7c37
+   Verifying Hash Integrity ... sha256+ OK
+   Loading loadables from 0x4102b1e8 to 0x5f980000
+hibernation: Not from hibernation
+Core : b69d31e 2020/07/08 01:35:32 (Licensed to Amazon Fulfillment Services,Inc.)
+SBIOS: v2.0 2021/07/07 14:17:22
+TTBR:5f9ec059
+Core: b69d31e 2020/07/08 01:35:32
+Platform: v2.0 2021/07/07 14:17:22
+max bank = 1
+In:    serial@11002000
+Out:   serial@11002000
+Err:   serial@11002000
+Hardware Board: DVT(DOE3)
+amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5
+Secure Info: secure_cpu: 1, production: 1, unlocked: 0
+Hit any key to stop autoboot:  0
+## Loading kernel from FIT Image at 41000000 ...
+   Using 'conf-mt8110-malbec' configuration
+   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
+   Trying 'kernel' kernel subimage
+     Description:  Kernel
+     Type:         Kernel Image
+     Compression:  uncompressed
+     Data Start:   0x410000c4
+     Data Size:    6501600 Bytes = 6.2 MiB
+     Architecture: ARM
+     OS:           Linux
+     Load Address: 0x40008000
+     Entry Point:  0x40008000
+     Hash algo:    sha256
+     Hash value:   975bab5256b1383732bef9b98b20ad7e5220c2c1a996b20bb64dd30231b34ee6
+   Verifying Hash Integrity ... sha256+ OK
+## Loading ramdisk from FIT Image at 41000000 ...
+   Using 'conf-mt8110-malbec' configuration
+   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
+   Trying 'ramdisk' ramdisk subimage
+     Description:  ramdisk
+     Type:         RAMDisk Image
+     Compression:  uncompressed
+     Data Start:   0x41633690
+     Data Size:    1667584 Bytes = 1.6 MiB
+     Architecture: ARM
+     OS:           Linux
+     Load Address: 0x44080000
+     Entry Point:  unavailable
+     Hash algo:    sha256
+     Hash value:   65d072008e55511d1e418b64a9a21fe0bd0ef5b9f6b85eefbc0d1fb7b63c2b7b
+   Verifying Hash Integrity ... sha256+ OK
+   Loading ramdisk from 0x41633690 to 0x44080000
+## Loading fdt from FIT Image at 41000000 ...
+   Using 'conf-mt8110-malbec' configuration
+   Verifying Hash Integrity ... fireos-production:sha256,rsa2048:fireos-production+ OK
+   Trying 'fdt-mt8110-malbec' fdt subimage
+     Description:  Flattened Device Tree blob mt8110-malbec.dtb
+     Type:         Flat Device Tree
+     Compression:  uncompressed
+     Data Start:   0x417ca9a0
+     Data Size:    48136 Bytes = 47 KiB
+     Architecture: ARM
+     Load Address: 0x44000000
+     Hash algo:    sha256
+     Hash value:   1d22d5f38132d2b1e64524471ff23c9cc792a585a8c757f546b1085f1ed5103d
+   Verifying Hash Integrity ... sha256+ OK
+   Loading fdt from 0x417ca9a0 to 0x44000000
+   Booting using the fdt blob at 0x44000000
+   Loading Kernel Image ... OK
+ERROR: reserving fdt memory region failed (addr=5f000000 size=400000)
+   Using Device Tree in place at 44000000, end 4400ec07
+amzn_verify_onetime_unlock_code: Verify one time unlock cert fail, ret = -5
+   secure_cpu: 1, production: 1, unlocked: 0
+   OK to initialize idme device tree
+   Applied falcon mmc driver
+Starting kernel ...
+[    0.000000] <0>-(0)[0:swapper]Booting Linux on physical CPU 0x0
+[    0.000000] <0>-(0)[0:swapper]Linux version 4.9.77-lab126 (builder@eink-builds) (gcc version 4.9.1 (GCC) ) #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022
+[    0.000000] <0>-(0)[0:swapper]CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
+[    0.000000] <0>-(0)[0:swapper]CPU: div instructions available: patching division code
+[    0.000000] <0>-(0)[0:swapper]CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
+[    0.000000] <0>-(0)[0:swapper]OF: fdt:Machine model: MT8110 Bellatrix device
+[    0.000000] <0>-(0)[0:swapper]earlycon: uart8250 at MMIO32 0x11002000 (options '')
+[    0.000000] <0>-(0)[0:swapper]bootconsole [uart8250] enabled
+[    0.085483] <0>.(0)[1:swapper/0]'atag,devinfo' is not found
+[    0.430893] <1>.(1)[1:swapper/0]mt8512-cpufreq mt8512-cpufreq: failed to initialize dvfs info for cpu0
+[    0.445620] <1>.(1)[1:swapper/0]mtu3 11211000.usb: couldn't get extcon device
+[    0.449118] <1>.(1)[1:swapper/0]lm3692x 0-0037: unable to request PWM
+[    0.450066] <1>.(1)[1:swapper/0]lm3692x 0-0037: Cannot read/clear faults
+[    0.450911] <1>.(1)[1:swapper/0]lm3692x 0-0037: Fail writing initialization values
+[    0.452368] <1>.(1)[1:swapper/0]lm3692x 0-0036: unable to request PWM
+[    0.453302] <1>.(1)[1:swapper/0]lm3692x 0-0036: Cannot read/clear faults
+[    0.454195] <1>.(1)[1:swapper/0]lm3692x 0-0036: Fail writing initialization values
+[    0.459708] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_00=0x40
+[    0.460899] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_01=0x00
+[    0.462083] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_02=0x00
+[    0.463267] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_03=0x30
+[    0.464496] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_04=0x00
+[    0.465678] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_05=0x00
+[    0.466860] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_06=0x00
+[    0.468041] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_07=0x00
+[    0.469223] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_08=0x00
+[    0.470405] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_09=0x00
+[    0.471588] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_10=0x00
+[    0.472770] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_11=0x00
+[    0.473974] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_12=0x00
+[    0.475157] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: BD71827_REG_INT_STAT_13=0x00
+[    0.476115] <1>.(1)[1:swapper/0]rohm-bd71828 1-004b: Reboot Reason: POWER_OFF            System Powered Off
+[    0.500859] <1>.(1)[1:swapper/0]mtk-imgrz 15004000.imgrz: mtk_imgrz_probe is earlier than SMI
+[    0.503821] <1>.(1)[6:kworker/u4:0]OF: /rdma@15007000: could not get #mbox-cells for /gce@10238000
+[    0.505881] <0>.(0)[1:swapper/0]mtk-jdec 15003000.jdec: mtk_jdec_probe is earlier than SMI
+[    0.507213] <0>.(0)[1:swapper/0]mtk_png_probe called
+[    0.507856] <0>.(0)[1:swapper/0]imgresz_probe is earlier than SMI
+MMC v5.1
+phase: [map:ffffff1f_ffffffff] [maxlen:37] [final:12]
+MMC's timing interface is HS200
+SBIOS info
+storage_type: MMC
+erase_size: 1024
+capacity: 15273600 * 512Byte
+[    0.626807] <1>.(1)[112:kworker/1:2]mtk_png_probe called
+[    0.628035] <1>.(1)[112:kworker/1:2]driver registered as /dev/video6
+[    0.632298] <0>.(0)[1:swapper/0]memory-ssmr: [INIT FAIL]: cma is not inited
+[    0.633188] <0>.(0)[1:swapper/0]memory-ssmr: SSMR sanity fail
+[    0.638266] <0>.(0)[1:swapper/0]idt_wireless_power 0-0061: p922x_parse_dt: Device have associated DT data
+[    0.646425] <1>.(1)[1:swapper/0][mtk_svs] no "calibration-data" from dts? disable mon mode
+.9.77-lab126 #1 SMP PREEMPT Tue Feb 1 07:34:01 UTC 2022 armv7l
+BOOTING DEFAULT.
+IP-Config: no devices to configure
+kinit: Mounted root (ext3 filesystem) readonly.
+info sytem:mounted_proc::
+info system:mounted_sys::
+info system:sy00::
+info system:mounted_dev::
+info milestone:4.21:49.1:49.1
+info milestone:4.27:49.2:49.2
+info milestone:4.32:49.3:49.3
+info milestone:4.39:49.4:49.4
+info milestone:4.42:49.5:49.5
+info sytem:mounted_tmpfs::
+info milestone:4.58:sy50:sy50
+info system:start:time=4620:time=4620
+info hardware:no_wan:: WiFi only device. No WAN found
+info system:config:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N:platform=bellatrix,board=malbec,rev=02,proto=Y,wifi=Y,wan=N
+info milestone:4.83:sy51:sy51
+lipc-send-event[321]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
+lipc-send-event[321]: C def:dbusi::Failed to init dbus
+lipc-send-event[321]: E def:open::Failed to open LIPC
+lipc-send-event[321]: E def:fail:source=com.lab126.hal, event=powerButtonPressed:Sending event failed
+lipc-send-event[393]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
+lipc-send-event[393]: C def:dbusi::Failed to init dbus
+lipc-send-event[393]: E def:open::Failed to open LIPC
+lipc-send-event[393]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
+lipc-send-event[419]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
+lipc-send-event[419]: C def:dbusi::Failed to init dbus
+lipc-send-event[419]: E def:open::Failed to open LIPC
+lipc-send-event[419]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
+info milestone:5.68:sy99:sy99
+info system:done:time=5720:time=5720
+crond[430]: crond (busybox 1.28.3) started, log level 8
+init.exe: sshd main process (429) terminated with status 127
+init.exe: sshd main process ended, respawning
+init.exe: recevent pre-start process (433) terminated with status 1
+Welcome to Kindle!
+kindle login: info milestone:5.97:sc01:sc01
+info system_fs_loopbacks:mountingfs:Mounting compressed directories filesystem images:Mounting compressed directories filesystem images
+info milestone:5.99:sc02:sc02
+info milestone:6.03:/usr/share/X11/xkb:/usr/share/X11/xkb
+info system_fs_loopbacks:mounted:Image /usr/share/X11/xkb.sqsh mounted:Image /usr/share/X11/xkb.sqsh mounted
+info milestone:6.13:3:3
+info milestone:6.14:sc05:sc05
+info milestone:6.16:/usr/java/lib/fonts:/usr/java/lib/fonts
+info system_fs_loopbacks:mounted:Image /usr/java/lib/fonts.sqsh mounted:Image /usr/java/lib/fonts.sqsh mounted
+info milestone:6.27:4:4
+info milestone:6.28:sc05:sc05
+info milestone:6.31:/etc/kdb.src:/etc/kdb.src
+info system_fs_loopbacks:mounted:Image /etc/kdb.src.sqsh mounted:Image /etc/kdb.src.sqsh mounted
+info milestone:6.42:5:5
+info milestone:6.43:sc05:sc05
+info milestone:6.45:/usr/lib/locale:/usr/lib/locale
+info system_fs_loopbacks:mounted:Image /usr/lib/locale.sqsh mounted:Image /usr/lib/locale.sqsh mounted
+info milestone:6.57:6:6
+info milestone:6.58:sc05:sc05
+info milestone:6.60:/usr/share/keyboard:/usr/share/keyboard
+info system_fs_loopbacks:mounted:Image /usr/share/keyboard.sqsh mounted:Image /usr/share/keyboard.sqsh mounted
+info milestone:6.81:7:7
+info milestone:6.82:sc05:sc05
+info milestone:6.85:/opt/var/local:/opt/var/local
+info system_fs_loopbacks:mounted:Image /opt/var/local.sqsh mounted:Image /opt/var/local.sqsh mounted
+info milestone:6.96:8:8
+info milestone:6.97:sc05:sc05
+info milestone:6.99:sc07:sc07
+info system:emiting_event:mounted_fs_loopbacks:mounted_fs_loopbacks
+debug sytem:event_emitted:mounted_fs_loopbacks:mounted_fs_loopbacks
+info milestone:7.05:fs75:fs75
+info system:emiting_event:loaded_modules_dependencies:loaded_modules_dependencies
+debug sytem:event_emitted:loaded_modules_dependencies:loaded_modules_dependencies
+info system:emiting_event:loaded_fuse:loaded_fuse
+debug sytem:event_emitted:loaded_fuse:loaded_fuse
+info modules:modprobe:loading module falcon:loading module falcon
+info milestone:7.14:fs00:fs00
+info system:emiting_event:loaded_falcon:loaded_falcon
+debug sytem:event_emitted:loaded_falcon:loaded_falcon
+info hardware:no_wan:: WiFi only device. No WAN found
+info system:emiting_event:loaded_ppp_async:loaded_ppp_async
+debug sytem:event_emitted:loaded_ppp_async:loaded_ppp_async
+info filesystems_keys:not applicable for this device type::
+info modules:modprobe:loading module opt3001:loading module opt3001
+info system:emiting_event:loaded_opt3001:loaded_opt3001
+debug sytem:event_emitted:loaded_opt3001:loaded_opt3001
+info system:emiting_event:loaded_fakekey:loaded_fakekey
+debug sytem:event_emitted:loaded_fakekey:loaded_fakekey
+info filesystems_var_local:File system errors checked. Return code 0:LocalVars: clean, 1436/65536 files, 41835/262144 blocks:LocalVars: clean, 1436/65536 files, 41835/262144 blocks
+info filesystems_var_local:No file system errors::
+info filesystems_var_local:runfixup:Running /var/local/system/fixup:Running /var/local/system/fixup
+info jb_bridge:main:: i can fix this (r18869)
+info jb_bridge:main:: these are not the droids you're looking for
+info filesystems_var_local:DB PARAMS:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB.:FreePageSize:0 bytes. AvailableSpaceInVarLocal:207202 KB.
+info milestone:7.70:fs23:fs23
+info system:emiting_event:mounted_varLocal:mounted_varLocal
+debug sytem:event_emitted:mounted_varLocal:mounted_varLocal
+info milestone:7.79:vi00:vi00
+info touch:detect:TOUCH_ID=0:TOUCH_ID=0
+info milestone:7.89:vi99:vi99
+info touch:id_release:release touch id pins:release touch id pins
+info touch:detect:install Parade touch driver:install Parade touch driver
+info display:started:time=7930:time=7930
+info system:emiting_event:display_ready:display_ready
+debug sytem:event_emitted:display_ready:display_ready
+info milestone:8.32:fs25:fs25
+info prereg:PRAGMA_QUICK_CHECK_PASSED:: sts=0
+info userstore:run:time=8600,action=start:time=8600,action=start
+info userstore:start:found_shutdown_flag:found_shutdown_flag Found SHUTDOWN flag file
+err mntus:loopback_not_mounted:: loopback device is not set-up
+[   10.563776] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_hid_send_output_user_and_wait_: HID output cmd execution timed out
+[   10.565273] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_request_pip2_send_cmd: nonhid_cmd->user_cmd() Error = -62
+[   10.566663] <0>.(0)[775:modprobe]pt_i2c_adapter 2-0024: [1] pt_pip2_get_version: Error Sending PIP2 VERSION Cmd rc=-62
+[   11.006268] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001
+[   12.484323] <1>.(1)[775:modprobe]pt_i2c_adapter 2-0024: [1] _pt_wait_for_fw_exit_boot_mode: PIP 1.7 no support for ext STATUS, sleep 1001
+info system:emiting_event:mounted_userstore:mounted_userstore
+debug sytem:event_emitted:mounted_userstore:mounted_userstore
+info milestone:12.55:fs50:fs50
+info milestone:12.68:fs90:fs90
+info filesystems_setup:Create Symlink /app/bin/KPPMainApp to /app/bin/KPPMainAppV1::
+info battery:charged:cap=,mV=,mAH=:cap=,mV=,mAH=
+info system:emiting_event:battery_ready:battery_ready
+debug sytem:event_emitted:battery_ready:battery_ready
+info filesystems_setup:Update file absent or failed to backup::
+info milestone:12.91:fs99:fs99
+info pt5:update:Parade TT4 Touch IC detected:Parade TT4 Touch IC detected
+info pt5:update:pt5 fw ver=33 file version=33:pt5 fw ver=33 file version=33
+info system:emiting_event:loaded_touch:loaded_touch
+debug sytem:event_emitted:loaded_touch:loaded_touch
+info milestone:13.63:sys99:sys99
+info system_setup:system_setup_after_shpm done::
+info system:emiting_event:dbus_ready:dbus_ready
+debug sytem:event_emitted:dbus_ready:dbus_ready
+info dbus:check-update:status=2:status=2 dbus_ready sent
+info perfd:starting...::
+info demd:starting...::
+info battstressd:starting...::
+info hardware:no_wan:: WiFi only device. No WAN found
+info milestone:14.69:dy01:dy01
+info milestone:14.78:tt25:tt25
+info milestone:14.96:pm25:pm25
+warn system:bt_stack.conf exist::
+info milestone:15.29:dy02:dy02
+warn system:bt_did.conf exist::
+info milestone:15.28:dy03:dy03
+info milestone:16.00:xx00:xx00
+info X:load:time=16050:time=16050
+info X:xorg.conf:Generating xorg.conf:Generating xorg.conf
+info usbnet:kh_msg:: toggling sshd status
+info usbnet:kh_msg:: stopping sshd
+err usbnet:kh_msg:: failed to stop sshd
+info stopVoiceView:entered:arg=deleteAsrFlags:arg=deleteAsrFlags
+info X:xorg.conf:xorg.conf generated:xorg.conf generated
+info stopVoiceView:Deleting ASR Flags::
+info milestone:18.25:xx50:xx50
+info X:starting:time=18290:time=18290
+warn usbnet:kh_msg:: removing stale sshd pidfile
+info usbnet:kh_msg:: starting sshd
+info usbnet:kh_msg:: tweaking iptables config
+info milestone:20.68:xx99:xx99
+info X:started:time=20720:time=20720
+info system:emiting_event:x_setup_ready:x_setup_ready
+debug sytem:event_emitted:x_setup_ready:x_setup_ready
+info bootactions:starting...::
+info bootactions:waiting:for:for lipc...
+info asr_setup:Not in asr mode::reason=flag file not present. shutting down asr_setup::
+info system:emiting_event:bootactions_ready:bootactions_ready
+debug sytem:event_emitted:bootactions_ready:bootactions_ready
+info register_oobe:registering...::
+info locale:read:lang=en_GB.utf8,lc_all=en_GB.utf8:lang=en_GB.utf8,lc_all=en_GB.utf8 Retrieved Language
+info system:emiting_event:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0
+debug sytem:event_emitted:langpicker_ready:langpicker_ready LANG_PICKER_SCREEN_SHOWN=0
+info starting:ffsd...::
+info register_oobe:done...::
+info lab126_gui:KPP OOBE flag found...Showing KPP Progress Bar::
+err unable:to:start:start ffsd mode ZTS
+info ffsd:stopped...::
+info asr_bt_reboot:asr_bt_reboot begin on started winmgr_ready::
+info milestone:24.18:pi00:pi00
+info milestone:24.42:pi99:pi99
+info system:emiting_event:contentpack_font_ready:contentpack_font_ready
+debug sytem:event_emitted:contentpack_font_ready:contentpack_font_ready
+info linkss:start:: starting linkss
+info linkss:kh_msg:::checking screensavers...
+info linkss:kh_msg:: end of screensavers parsing
+info linkss:kh_msg:: mounting custom screensavers
+info milestone:26.48:fr00:fr00
+info milestone:26.61:fr50:fr50
+info milestone:26.74:fr51:fr51
+info framework:starting:time=27830:time=27830
+info framework:commandLine:HEAP = -Xmx49m -Xms49m  -XX:MaxNewSize=4m -XX:SurvivorRatio=3 -XX:TargetSurvivorRatio=80 -Xss100k -XX:ReservedCodeCacheSize=3m -XX:+InitialGenPreTouch -XX:CompileThreshold=5000 -XX:CodeCacheMinimumFreeSpace=10l
+info hardware:no_wan:: WiFi only device. No WAN found
+info framework:##### Starting Java SE8 VM ::
+info hardware:no_wan:: WiFi only device. No WAN found
+[   30.302367] <1>.(1)[3220:mtk_wmtd][WMT-CONSYS-HW][E]consys_emi_coredump_remapping(1361):No need to remapping again
+[   30.561775] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_calibration_restore(3626):Did not restore calibration data. Buf=0x0, size=0
+[   30.563368] <0>.(0)[3220:mtk_wmtd][WMT-IC][E]mtk_wcn_soc_do_calibration(3846):Re-cal because restore fail(-6)
+info milestone:66.14:fr99:fr99
+info framework:started:time=66260,delta=39560:time=66260,delta=39560
+warn framework_setup:cannot get ffsdStatus::
+info framework_setup:ffs Status=::
+info framework_setup:ffsd is not active or ffs is complete::
+info blanket_f:loading blanket module:usb:usb
+info system:emiting_event:framework_ready:framework_ready
+debug sytem:event_emitted:framework_ready:framework_ready
+info bootactions:stopped...::
+info bridge:start:: hello there! (r17398)
+info bridge:start:: restoring rp from backups
+info fastmetrics:starting...::
+info stored:started::
+info bridge:start:: so uncivilized
+info stored:read_in_counters:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5:REBOOTS=0, REBOOT_LIMIT=1, RESTARTS=0, RESTART_LIMIT=5
+info clickstreamHeartbeatMetricsFramework:Skipping metrics recording, as it is the same day::
+info monitor:writing_file:file=/var/run/upstart/stored.restarts:file=/var/run/upstart/stored.restarts
+Retrieved 461 keys for system/daemon/pmond/
+Welcome to Kindle!
+kindle login:
+</code>
+====Misc.:====
+TODO,  to do,  to do, to do, to do, to do, to dooooo  :D\\
+-OpenVPN\\
+-fw_printenv\\
+-package manager\\
+For now, that's all.
+btc:12k6h1Zo1ZBw5mQSpGBTkHPpU2mQL8aLGj
+monero:48murcuRUGMLa2TNF6fJjWhzngfUP7RXufU6SHqXqwfW73b4nhYsY4mUHci5kFTTRmfZPTK22iESuGiz2v8eXn8jE8MDYtT
+https://www.buymeacoffee.com/trimen
-=== Internal photos: ===
-Fotka desky
-Fotka desky bez krytu
-For now that's all.