Skip to content

Commit 48cdeb3

Browse files
notmareknotmarek
committed
One-click attempt
1 parent d444a1e commit 48cdeb3

5 files changed

Lines changed: 176 additions & 38 deletions

File tree

‎LanguageBreak/.active_content_sandbox/store/resource/cachedResources/index.html‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<meta name="viewport" content="user-scalable=no" />
4+
5+
<head>
6+
<script>
7+
var kindle = window.kindle || top.kindle;
8+
var shouldPartialPreload = 0;
9+
var isAppPreloading =
10+
shouldPartialPreload &&
11+
kindle &&
12+
kindle.bkgrnd &&
13+
kindle.bkgrnd.isAppPreloading();
14+
if (!isAppPreloading) {
15+
var storeContext = parent && parent.storeContext;
16+
if (!storeContext) {
17+
storeContext = { startupMetrics: {} };
18+
}
19+
20+
storeContext.isPartialPreload = true;
21+
storeContext.isStoreLoaded = true;
22+
window.storeContext.isPartialPreload = true;
23+
window.storeContext.isStoreLoaded = true;
24+
}
25+
if (!isAppPreloading) {
26+
storeContext.startupMetrics.startupJs = { start: new Date() };
27+
if (!kindle || typeof kindle === "undefined") {
28+
var kindle = window.kindle || top.kindle;
29+
}
30+
31+
if (kindle.dev.webkitLog) {
32+
kindle.dev.webkitLog("on");
33+
}
34+
storeContext.developer = 1;
35+
}
36+
kindle.appmgr.onback = function (a) {
37+
return true;
38+
};
39+
kindle.appmgr.onforward = function (a, b) {
40+
return true;
41+
};
42+
</script>
43+
</head>
44+
45+
<body>
46+
<h1>LanguageBreak</h1>
47+
Loading :)
48+
<script>
49+
var kindle = window.kindle || top.kindle;
50+
kindle.net.setWirelessPrompt("never");
51+
const chromeConfig = {
52+
appId: "com.lab126.store",
53+
topNavBar: {
54+
template: "title",
55+
title: "LanguageBreak Loader",
56+
},
57+
};
58+
kindle.messaging.sendMessage(
59+
"com.lab126.chromebar",
60+
"configureChrome",
61+
chromeConfig
62+
);
63+
jb();
64+
function jb() {
65+
kindle.device.clearApplicationCache();
66+
kindle.device.clearCache();
67+
kindle.dev.clearApplicationCache();
68+
kindle.dev.clearCache();
69+
kindle.chrome.setSpinnerState("stop", 0, 0);
70+
kindle.net.setWirelessPrompt("never");
71+
top.location.href = "file:///mnt/us/jb.html";
72+
}
73+
</script>
74+
75+
<div id="dialogWrap"></div>
76+
</body>
77+
</html>

‎LanguageBreak/.demo/boot.flag‎

Whitespace-only changes.

‎LanguageBreak/DONT_CHECK_BATTERY‎

Whitespace-only changes.

‎LanguageBreak/jb.html‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta name="viewport" content="user-scalable=no" />
5+
<title>LanguageBreak</title>
6+
<script>
7+
var kindle = window.kindle || top.kindle;
8+
if (kindle) {
9+
const chromeConfig = {
10+
appId: 'com.lab126.store',
11+
topNavBar: {
12+
template: 'title',
13+
title: document.title
14+
}
15+
};
16+
kindle.messaging.sendMessage('com.lab126.chromebar', 'configureChrome', chromeConfig);
17+
}
18+
function jailbreak() {
19+
document.getElementById("log").innerHTML += "<br>Entering demo mode."
20+
/// Enter demo mode
21+
nativeBridge.createDemoModeFlagFile();
22+
nativeBridge.sendLipcEvent("com.lab126.pillow","enterDemoMode", "");
23+
/// Wait a bit so we are sure the flag file is created (the actual lang_picker.js file states that this can take upto 1000ms)
24+
setTimeout(function() {
25+
document.getElementById("log").innerHTML += "<br>Reloading langpicker module."
26+
/// Reload langpicker pillow module so it knows that we are in demo mode
27+
nativeBridge.setLipcProperty("com.lab126.blanket","unload", "langpicker");
28+
nativeBridge.setLipcProperty("com.lab126.blanket","load", "langpicker");
29+
/// Wait a bit so we are sure it's reloaded
30+
setTimeout(function() {
31+
document.getElementById("log").innerHTML += "<br>Exiting demo mode."
32+
/// Exit demo mode -- langpicker already thinks its in demo -- it only checks on load
33+
nativeBridge.deleteDemoModeFlagFile();
34+
nativeBridge.sendLipcEvent("com.lab126.pillow","exitDemoMode", "");
35+
document.getElementById("log").innerHTML += "<br>Changing language to Chinese."
36+
/// Change locale to chinese -- this triggers the actual deletion and thus code execution -- make sure we have an exploit file and a wait file in /mnt/us/documents/dictionaries
37+
nativeBridge.sendLipcEvent("com.lab126.pillow", "changeLocale", "zh-Hans-CN");
38+
/// Change locale back to english -- idk about you but i don't speak chinee -- we can do this because we had a wait file in /mnt/us/documents/dictionaries
39+
// nativeBridge.sendLipcEvent("com.lab126.pillow", "changeLocale", "en-US");
40+
// we do this inside the jailbreak shell script :)
41+
}, 3000);
42+
}, 1000);
43+
}
44+
45+
function elevate() {
46+
/// A bug in pillow allows us to open a dialog with specified html file anywhere on the filesystem -- dialogs have access to the nativeBridge -- which in turn has access to the whole of LIPC
47+
kindle.messaging.sendMessage(
48+
"com.lab126.pillow",
49+
"customDialog",
50+
{ name: "../../../../../../../../mnt/us/jb" }
51+
);
52+
}
53+
</script>
54+
</head>
55+
<body>
56+
<button onclick="elevate()" id="elevate">Jailbreak</button>
57+
<button class="elevated" onclick="nativeBridge.dismissMe()">
58+
Hide me
59+
</button>
60+
<div id="log">
61+
62+
</div>
63+
<script>
64+
var style = document.createElement("style");
65+
style.innerHTML = "";
66+
if (window.nativeBridge) {
67+
/// If we are elavated we will have access to nativeBridge thus we can procceed to run our exploit
68+
nativeBridge.showMe();
69+
document.getElementById("log").innerHTML = "Elevated. Running jailbreak."
70+
jailbreak();
71+
style.innerHTML += "#elevate { display: none; }\n";
72+
} else {
73+
style.innerHTML += ".elevated { display: none; }\n";
74+
}
75+
document.head.appendChild(style);
76+
</script>
77+
</body>
78+
</html>

‎README.MD‎

Lines changed: 21 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,62 @@
1-
Thank you to Bluebotlabs for all the help along the way and GeorgeYellow for bringing the vulnerability to light
1+
# LanguageBreak oneclick
2+
3+
**If it doesn't work do the normal method lol this is really just an experiment**
4+
Thank you to Bluebotlabs for Mesquito and all the help along the way and GeorgeYellow and bulltricks for bringing the vulnerability to light
5+
6+
7+
[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/E1E1QLG4D)
28

39
**Installation**
410

511
**Make sure to read the entirety of the instructions *before* proceeding.**
612

713
**Jailbreak**
814

9-
1. Type ;enter_demo in the Kindle search bar
10-
2. Reboot the device
11-
3. Once in demo mode, skip setting up wifi and enter random values for store registration
12-
4. Skip searching for a demo payload
13-
5. Select the "standard" demo type
14-
6. Press "Done" at the prompt to sideload content.
15-
7. Once the demo is setup, do the "secret gesture" (double finger tap on bottom right of screen then swipe left)
16-
8. Enter the demo configuration menu by typing ;demo into the search bar
17-
9. Select the "Sideload Content" option
18-
10. Copy the contents of the LanguageBreak folder to the Kindle - merging and replacing all files
19-
11. Unplug your kindle and go back to the demo menu
20-
12. Select the "Resell Device" option
21-
13. And press Yes/Resell
22-
14. Now wait for the press power button to start
23-
15. As soon as it appears plug your kindle back to your computer and copy the contents of the LanguageBreak folder into it once again, overwrite files then safely eject
24-
16. Hold the power button as instructed on screen
25-
17. You should be in a language selection menu in a few seconds
26-
18. Choose Chinese (The one above the odd Pseudot language)
27-
19. Your kindle should reboot and you should see some log message on the screen
15+
1. Turn on airplane mode
16+
2. Copy contents of LanguageBreak to the kindle
17+
3. Restart kindle
18+
4. Open the store - press yes to connect to wifi
19+
5. A page with a button saying jailbreak should appear
20+
6. Press the button
21+
7. Wait - there will be text and then the device will reboot - if it doesn't in 3 minutes then restart and try again
22+
8. Your kindle should reboot and you should see some log message on the screen
2823

2924
**Post Jailbreak**
3025

31-
1. After the device has rebooted, type ;uzb into the search bar
32-
2. Connect the device to a PC and copy update_hotfix_languagebreak.bin to the root of the Kindle storage
33-
3. Eject the device and either enter ;dsts or swipe down and select the settings icon to enter the device settings menu
34-
4. Select Update Your Kindle to install the custom hotfix
35-
5. This will take your device out of demo mode and clean up unneeded jailbreak files.
26+
1. Connect the device to a PC and copy update_hotfix_languagebreak-{languageCode of your choice}.bin to the root of the Kindle storage
27+
2. Eject the device and enter the device settings menu
28+
3. Select Update Your Kindle to install the custom hotfix
29+
4. This will do its best to make everything work :)
3630

3731
**Troubleshooting**
3832
Can't seem to get it to work?
3933

40-
Download the update file of the kindle version you are currently on from amazon install it and try again.
34+
try the normal method lol this is really just an experiment
4135

36+
Download the update file of the kindle version you are currently on from amazon install it and try again.
4237

4338
for example you can use this link by replacing the Xs with your version to get a file for you kindle
4439

45-
4640
PW5: https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_paperwhite_11th_5.XX.X.bin
4741

48-
4942
PW4: https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_paperwhite_v2_5.XX.X.bin
5043

51-
5244
PW3: https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_paperwhite_5.XX.X.bin
5345

54-
5546
Kindle 11th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_11th_5.XX.X.bin
5647

57-
5848
Kindle 10th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_10th_5.XX.X.bin
5949

60-
6150
Kindle 8th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_8th_5.XX.X.bin
6251

63-
6452
Scribe: https://s3.amazonaws.com/firmwaredownloads/firmwaredownloads/update_kindle_scribe_5.XX.X.bin
6553

66-
6754
Oasis 10th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_oasis_v2_5.XX.X.bin
6855

69-
7056
Oasis 9th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_oasis_5.XX.X.bin
7157

72-
7358
Oasis 8th Gen: https://s3.amazonaws.com/firmwaredownloads/update_kindle_oasis_5.XX.X.bin
7459

75-
7660
eg version 5.16.2.1.1 for PW4 would be https://s3.amazonaws.com/firmwaredownloads/update_kindle_all_new_paperwhite_v2_5.16.2.1.1.bin
7761

78-
7962
[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/E1E1QLG4D)

0 commit comments

Comments
 (0)