Kindle 2 Hacks

The Kindle 2 was released in early 2009 and is one of many e-ink based readers. The e-ink technology is currently only capable of displaying grey-scale representation of media.

Kindle 2 is based on a ARM6 processor and is running Linux with a Java-based front-end. Wireless connectivity is provided by a cellular network, including roaming for international use of the device.

Kindle 2 international specifications

• Display: E-Ink Vizplex 6" imaging film, 600x800 pixel, 167 dpi, 16-level grey-scale
• Processor: Freescale i.MX31 Mario ARM1136JF-S 400 MHz, 128 MB DRAM, 8 MB Flash
• Storage: 2 GB internal memory, approx 1.4 GB usable for content
• Connectivity: AnyDATA DPT-600W HSPA mini PCI-E module, USB 2.0 interface, SIM-card holder
  • UMTS 850/1900/2100 MHz, GSM/GPRS/EDGE 850/900/1800/1900 MHz
• Battery: 3.7V 1530 mAh Lithium-polymer battery, 31 grams
• Size and weight: 203.2x134.6x9.1 mm, 289.2 grams
• Designed by LAB126
• Shipping software version: 2.2 (375490138)

Tricks

Recovery mode

To enable the recovery mode, reboot and hold the Home-botton when the screen is flashing from black to white.

Connect via USB to a computer and manage the files on the device. Press R to reboot.

Reference:

• Kindle 2 Recovery mode
• Kindle2 Hack List Top 25

Log dump

When a custom package is installed (see below) it has to be removed else a firmware update will exit with an error. Use the commands below to create a log file on the USB-drive with information about the error.

Press HOME and any keyboard key to bring up the search field, enter the following:

;debugOn 
;dumpMessages

Connect via USB to a computer and check the log file on the Kindle drive.

An example:

ota_install: C def:patch:patchinfo="/opt/amazon/ebook/config/netfront.ini":checksum failure

References:

• Uninstall packages - thread

Force reboot

Sometimes it's not possible to use the menu to reboot the Kindle. Hold the slider for 15 seconds to force a reboot of the device.

Hacks

Applying Hacks

The modifications found below is installed by utilizing the Kindle update process and signing the packages with the correct certificate.

Download a hack, connect the Kindle to a computer, and extract the Update_kindle2_XXXX.bin from the package. Notice the format of the filename, Update_kindle2 is an indicator that this is a Kindle2 update. Also note that the Kindle2 programmed to look in the root of the USB-drive for any file starting with this suffix when the Update my kindle function is issued. If found during boot-up, the content of the update file will be installed/executed.

A note about official firmware updates, firmware updates perform a checksum on vital system files and if one check fails the update will halt. Therefore an uninstall package is usually provided together with the main package.

Creating Packages

Python application to create and sign Kindle firmware update packages.

Note that for the Kindle2 international there are some packages that are self-sign and installs without any further change, and there are packages that require the freekindle-k2i pre-installed. Freekindle will install a new RSA key (our) to the Kindle, the update will fail with Error 004 but this is normal.

In most cases, it's possible to re-compile old packages using a updated Packager if a new Kindle firmware update is released. The RSA key has to be extracted first from the new update.

Python is required to run Packager, use OSX, Linux, cygwin, or ActivePython.

• Extract package
  Extract the package for the Kindle 2 International
  ./kindle_update_tool.py e update_ufh_droid_install-k2i.bin
  Extract the content
  tar zxvf update_ufh_droid_install-k2i.bin.tgz
  Remove all the files you don't need anymore
  rm *.sig *.dat *.tgz

• Create package - self-signed
  For Kindle 2:
  ./kindle_update_tool.py m --k2 --sign --ex ufh_droid_install-k2 install-droid.sh droid.ttf
  For Kindle 2 international:
  ./kindle_update_tool.py m --k2i --sign --ex ufh_droid_install-k2i install-droid.sh droid.ttf
  For Kindle DX:
  ./kindle_update_tool.py m --dx --sign --ex ufh_droid_install-dx install-droid.sh droid.ttf

Downloads:

• Packager v0.5 - includes freekindle-k2i only
• Packager v0.6 - includes freekindle-all
• Packager v0.7 - includes freekindle-all

References:

• How to create packages for Kindle 2 international
• Kindle 2 international packager
• How to create packages for Kindle w/ firmware 2.3
• Kindle 2 International packager, now even easier
• How to create packages for Kindle 2 international

List

Kindle exec.sh recovery

This install a hook that will execute a exec.sh script located in /documents/system/ in case the GUI front-end is failing to spawn. This is a great way to recover from a bad install or experimentation. USBNetwork could also be used in this case.

Downloads:

• Kindle Anti-brick - K2i requires freekindle pre-installed (RSA keys)

References:

• Kindle Anti-brick Hack

USB Network

USBNetwork makes it possible to send data traffic over USB to a computer and further out to the Internet, and also allows access to the Kindle Store if the Kindle is pre-registered via the cellular network. Remote access via telnet and ssh/scp is also included.

Works on Kindle 1, Kindle 2, Kindle 2 international, and Kindle DX.

Network details:

• Computer: 192.168.2.1 (add the new IP or change the current in network settings)
• Kindle: 192.168.2.2

Login details:

• Telnet: User: framework - Password: <none>
• SSH: User: root - Password: <blank>

Downloads:

• usbnetwork v0.6 - thread post
• usbnetwork v0.7 - Now includes uninstaller - thread post
• usbnetwork (for 2.3) v0.9 - Update for firmware v2.3 for K2, K2i and DX - thread post
• usbnetwork (for 2.3) v0.10 - Dropbear SSH now with SCP - thread post

References:

• USBNetwork package by ebs and jyavenard - thread
• Kindle's USB tethering Final part - Oct. 2009

Savory Document Processor

This background daemon will automatically convert any epub, lit, odt, rtf, oebzip, fb2 and pdf file into mobi-format that the Kindle can display.

Put the documents in the /documents/ directory on the Kindle. When the conversion is done the original file will be moved to /documents/savory-archive/. Unplug the USB cable to let the daemon resume and identify the new files.

To install, put the savory-image-00x.ext3 file on the root of the Kindle drive in addition to the suitable update_Savory-0.0x-kx.bin file.

Downloads:

• Savory v0.07 - K2i supported
• Savory v0.08 - Installer and Uninstaller only

References:

• Native PDF and Mobile ePub conversion for the Kindle 2 International
• Official Savory page
• Savory code project page

Unicode Font Hack

A regular Kindle will only display Latin characters, meaning Cyrillics and Asian Glyphs will not render properly. Also, the normal font can be a bit narrow and hard to read on the Kindle display. The font replacements below will target some of these issues.

The default fonts on the Kindle:

• Caecilia LT 65/75/66/76 - Serif, used for the main reading font
• Helvetica LT 65/75/66/76 - San-Serif, used for menus and top bar
• KindleBlackbox - Mono-spaced, same use as San-Serif above

The difference between Sans-Serif and Serif respectively, Wikipedia images:

Some of the font packs below replace Serif with San-Serif fonts, while other keep the typeface (San-Serif, Serif, Mono) as is but change the font style (Droid, Helvetica, Georgia).

Downloads: For firmware v2.3:

• Georgia - Serif font, replaces Serif and uses Calibri for Sans-Serif and Mono - thread post w/images
• Georgia2 - Serif font, bit narrower, darker and larger, and bold doesn't pop as much, replaces Serif and uses FreeSans for Sans-Serif and Mono - thread post w/images
• Helvetica2 - Sans-Serif font, bit larger, replaces Serif and uses FreeSans for Sans-Serif and Mono -thread post w/images
• Helvetica Bold&Large - Sans-Serif font, large and bold, replaces Serif with bold&large and uses regular Helvetica for Sans-Serif, Kindle default for Mono - thread post
• GNU FreeFont - Sans-Serif, Serif and Mono font, Latin and Cyrillic support - kindleblog w/images
• GNU FreeFont San-Serif - Sans-Serif and Mono font, replaces Serif with Sans-Serif, same for Sans-Serif, and FreeFont Mono, Latin and Cyrillic support - kindleblog w/images
• Droid - Sans-Serif and Serif font, Latin and Cyrillic support, Regular, Bold, Italic, Bold-Italic styles, no Asian support - kindleblog w/images
• Droid San-Serif - Replaces Serif with Droid Sans-Serif, Latin and Cyrillic support, all styles, no Asian support - kindleblog w/images
• Droid Asian - Fallback font for Cyrillic, Chinese, and Japanese support, Latin text will have Droid Sans-Serif Regular style only - kindleblog w/images
• Universal uninstaller: UFC Universal Uninstaller - Restores the normal Kindle fonts, no need to use the font package uninstaller
  • Additional list of even more fonts
  • PDF showing some of the different fonts

References:

• KindleBlog Unicode fonts hack
• K Design Works - Kindle Fonts - ted-san
• Font hacks for the Kindle 2, Kindle International and Kindle DX
• Alternate Kindle 2 Font Hack

Screensaver Hack

This changes the default image shown in sleep mode and makes it possible to display a custom PNG image of your choice.

Install the package and put the images into the new /system/screen_saver/ directory. The preferred image size is 600x800px for Kindle2/2i and 824x1200px for KindleDX.

Downloads:

• Kindle2 Screen Saver Hack v0.3
• Kindle2 Screen Saver Hack v0.4
• KindleDX Screen Saver Hack v0.4
• Kindle2/2i/DX Screen Saver Hack v0.1 - latest

References:

• Kindle DX Screen Saver Hack v0.1
• Kindle 2 Screen Saver Hack Wiki

Change Screensaver Timeout

By default the system will be put into sleep mode after 10 minutes of inactivity. The screensaver will then be activated and the wireless disabled.

To change the timeout value, edit the /etc/powerd.conf file and change the t1_timeout: value. To access the file, use either USBNetwork or install the package below.

Downloads:

• Screensaver Timeout v0.1 - for 2.2, 2.2.1
• Screensaver Timeout v0.2 - for 2.3, includes uninstaller (Compiled by me, untested)

References:

• Any way to disable screensaver

JTAG console

A JTAG serial console is can be used to directly send commands to- and read outs from the processor (control and debug). Helpful for understanding and experimentation.

References:

• Hacking the Kindle part 1: getting the console
• Kindle DX serial console

Firmwares

Official firmwares:

• Kindle2 v2.3 update - for K2 US 2.0, 2.0.1, 2.0.2, 2.0.3, and 2.0.4
• Kindle2 v2.3 update - for K2i global 2.2, 2.2.1, and 2.2.2
• KindleDX v2.3 update - for DX

References:

• Kindle1 1.2 Instructions
• Kindle2 2.3 Instructions

References

• Keyboard shortcuts
• KindleTips - Ultimate Kindle 2 Shortcuts and Tricks
• Internal pictures of an open Kindle 2 international
• Amazon Kindle 2 International Version UK Review
• Avenard file index