←back to thread

327 points Quizzical4230 | 1 comments | | HN request time: 0.226s | source
Show context
Havoc ◴[] No.46194646[source]
> is available for all but the most up-to-date Kindles

Bought one from eBay to try it out. Silly me connected it to wifi and suddenly it’s up to date and no longer breakable

replies(6): >>46194904 #>>46197074 #>>46197742 #>>46198837 #>>46199395 #>>46205470 #
jsheard ◴[] No.46194904[source]
If you want a cheap rooted eReader I think you're better off getting a Kobo instead, they don't officially support rooting but AFAICT they make basically no effort to prevent it.
replies(7): >>46195120 #>>46195628 #>>46195935 #>>46196824 #>>46197561 #>>46198264 #>>46198713 #
enthdegree ◴[] No.46196824[source]
The latest Kobos use MediaTek SoCs with locked bootloaders. The Kobo Clara BW's MT8113, for example. As far as I know, one of the early bootloaders it, BL1, refuses to execute the next bootloader (BL2) unless its signature is valid. We can get the device into a mode where BL1 waits for upload of a BL2 via USB using an exploit called Kamakiri, but in public there is neither an exploit to get BL1 to boot an arbitrary BL2, nor an authorized BL2 image to upload. See here: https://github.com/bkerler/mtkclient/issues/1332

Kobo devices have root exposed but don't let users boot their own kernels (and the kernel they ship was not compiled with kexec either).

I really don't know the reason so many devices these days don't have an unlock method. It seems predatory. Who knows where in the chain this happens... maybe it's Kobo, or maybe MediaTek won't sell you their SoCs for mass-market devices unless you lock them.

replies(4): >>46197163 #>>46197491 #>>46199272 #>>46209618 #
zozbot234 ◴[] No.46199272[source]
According to the github issue it seems to be a simple checksum step, not a true signature verification? If so there is no locked bootloader in any real sense.

If the real impediment is lack of demand or low-level development effort for any given device, that's in principle a solvable issue once projects like pmOS and Mobian choose to focus on some reasonably-available hackable hardware and bring it up to true daily driver state.

replies(1): >>46200330 #
1. enthdegree ◴[] No.46200330[source]
mtkclient does not seem to correctly interpret the usb output of the device past some part of the early boot process. Really, any of those messages formatted by mtkclient are unfaithful to the intended meaning. So yes maybe it is "just a checksum step" or maybe something else entirely. Last year I collected some UART logs on the device during bootup in a zip here:

https://github.com/bkerler/mtkclient/issues/1289