←back to thread

327 points Quizzical4230 | 2 comments | | HN request time: 0.503s | source
Show context
Havoc ◴[] No.46194646[source]
> is available for all but the most up-to-date Kindles

Bought one from eBay to try it out. Silly me connected it to wifi and suddenly it’s up to date and no longer breakable

replies(6): >>46194904 #>>46197074 #>>46197742 #>>46198837 #>>46199395 #>>46205470 #
jsheard ◴[] No.46194904[source]
If you want a cheap rooted eReader I think you're better off getting a Kobo instead, they don't officially support rooting but AFAICT they make basically no effort to prevent it.
replies(7): >>46195120 #>>46195628 #>>46195935 #>>46196824 #>>46197561 #>>46198264 #>>46198713 #
enthdegree ◴[] No.46196824[source]
The latest Kobos use MediaTek SoCs with locked bootloaders. The Kobo Clara BW's MT8113, for example. As far as I know, one of the early bootloaders it, BL1, refuses to execute the next bootloader (BL2) unless its signature is valid. We can get the device into a mode where BL1 waits for upload of a BL2 via USB using an exploit called Kamakiri, but in public there is neither an exploit to get BL1 to boot an arbitrary BL2, nor an authorized BL2 image to upload. See here: https://github.com/bkerler/mtkclient/issues/1332

Kobo devices have root exposed but don't let users boot their own kernels (and the kernel they ship was not compiled with kexec either).

I really don't know the reason so many devices these days don't have an unlock method. It seems predatory. Who knows where in the chain this happens... maybe it's Kobo, or maybe MediaTek won't sell you their SoCs for mass-market devices unless you lock them.

replies(4): >>46197163 #>>46197491 #>>46199272 #>>46209618 #
1. monerozcash ◴[] No.46197163[source]
Can you just access /dev/mem or load a kernel module? Is there a SELinux policy stopping that?

If you can do either of those, it should be trivial to get kexec working by just loading it as a module.

replies(1): >>46197597 #
2. enthdegree ◴[] No.46197597[source]
As far as I know, yes, it's possible. No SELinux. Kernel is a branch from 4.9.something pretty far off mainline with a few proprietary binary blob modules. As far as I know the real impediment here is lack of demand.