Yet another reverse engineering blog

Friday, December 21, 2007

Hacking the Kindle part 3: root shell and runtime system

Root Shell



After I downloaded and extracted the root fs image, I quickly ran the /etc/shadow file though John the Ripper. In a moment it displayed the root password: "fiona" (which is the codename for the Kindle, by the way). Alas, it didn't work when I tried entering into console. Also, adding "init=/bin/sh" or "single" to the kernel boot arguments didn't work either.
So I started to poke around with the firmware update and after some time was able to run a script which mounted the read-write part of root filesystem and dumped the /etc/shadow from it. Unsurprisingly, it had a different password hash. Apparently the root password is changed somewhere before shipping to the end user. So I quickly adapted the script to replace the shadow file on the device with the original one.
You can find that implementation in this update maker zip.
kindle_update_maker-0.1.zip

After replacing the shadow file and a reboot, I was able to get in.

Output of some commands.

[root@kindle root]#ls -la /
drwxr-xr-x 2 root root 592 Oct 30 2007 bin
drwxr-xr-x 1 root root 0 Jan 1 00:00 dev
lrwxrwxrwx 1 root root 7 Oct 30 2007 etc -> opt/etc
drwxr-xr-x 2 root root 3 Oct 30 2007 home
drwxr-xr-x 2 root root 3 Oct 30 2007 initrd
drwxr-xr-x 2 root root 586 Oct 30 2007 lib
lrwxrwxrwx 1 root root 11 Oct 30 2007 linuxrc -> bin/busybox
drwxr-xr-x 5 root root 34 Oct 30 2007 mnt
drwxr-xr-x 10 root root 1024 Nov 5 2007 opt
dr-xr-xr-x 101 root root 0 Jan 1 15:42 proc
drwxr-xr-x 2 root root 506 Oct 30 2007 sbin
drwxr-xr-x 10 root root 0 Jan 1 15:42 sys
drwxrwxrwx 5 root root 0 Jan 1 15:44 tmp
drwxr-xr-x 10 root root 95 Oct 30 2007 usr
drwxr-xr-x 2 root root 55 Oct 30 2007 var

[root@kindle root]# mount
devfs on /dev type devfs (rw)
/dev/bml0/6 on / type squashfs (ro)
/dev/stl0/8 on /opt type ext3 (rw,sync,noatime,nodiratime)
/proc on /proc type proc (rw,nodiratime)
sysfs on /sys type sysfs (rw)
devfs on /dev type devfs (rw)
usbdevfs on /proc/bus/usb type usbdevfs (rw)
devpts on /dev/pts type devpts (rw)
tmpfs on /tmp type tmpfs (rw)
/dev/bml0/7 on /mnt/dc type squashfs (ro)

[root@kindle root]# ps -A f
PID TTY STAT TIME COMMAND
1 ? S 0:01 [swapper]
2 ? SN 0:00 [ksoftirqd/0]
3 ? S< 0:00 [events/0]
4 ? S< 0:00 \_ [khelper]
20 ? S< 0:10 \_ [kblockd/0]
87 ? S 0:02 \_ [pdflush]
89 ? S< 0:00 \_ [aio/0]
86 ? S 0:00 \_ [pdflush]
10 ? S 0:00 [sleepd]
33 ? S 0:00 [khubd]
88 ? S 0:00 [kswapd0]
676 ? S 0:12 [voltd]
678 ? S 0:02 [pnlcd_animate]
681 ? S 0:00 [kseriod]
710 ? S 0:00 [wantph]
709 ? S 0:00 [wanend]
721 ? S 0:00 [mmcdd]
727 ? S 0:00 [hpdetd]
740 ? Ss 0:00 init
1116 tts/2 Ss 0:00 \_ -sh
2344 tts/2 R+ 0:00 \_ ps -A f
831 ? S 0:00 [kjournald]
884 ? S 0:03 /sbin/syslogd -m 0 -b 1 -S -s 250
887 ? S 0:01 /sbin/klogd
976 ? S 0:00 [eink_fb_apt]
974 ? S 0:04 [eink_fb_udt]
975 ? S 0:00 [eink_fb_sst]
1023 ? S 0:07 [f-s-gadget]
1024 ? S 0:00 [f-s-activity]
1063 ? S 0:00 [wdtpmd]
1071 ? S 0:00 /usr/sbin/watchdogd -k 9 -t 30
1079 ? S 0:00 /usr/sbin/netwatchd -d 20 -t 5 -p www.amazon.com
1086 ? S 0:03 /usr/sbin/nomkd -v 80 -r 44 -d 23 cvm
1092 ? S 0:00 crond -l 9 -c /etc/crontab
1097 ? S 0:00 /bin/sh /usr/sbin/tphmonitor
1101 ? S 0:00 \_ /usr/sbin/tphserver -f
1119 ? S 0:00 /bin/sh /usr/sbin/execmonitor
1128 ? S 0:00 \_ /usr/sbin/execserver
1123 ? S 0:00 /bin/sh /opt/amazon/ebook/bin/run_framework
1169 ? S 0:00 \_ /bin/sh /opt/amazon/ebook/bin/start.sh
1173 ? SL 0:18 \_ /usr/java/bin/cvm -Xmx16m -Dsun.boot.library.path=/opt/usr/java/lib:/usr/java/lib -cp :/opt/amazon/ebook/lib/MobiCore-impl.jar:/opt/amazon/ebook/lib/MobipocketCoreReader.jar:/opt/amazon/ebook/lib/ReaderSDK.jar:/opt/amazon/ebook/lib/SearchSDK.jar:/opt/amazon/ebook/lib/framework-api.jar:/opt/amazon/ebook/lib/framework-impl.jar:/opt/amazon/ebook/lib/jdbm.jar:/opt/amazon/ebook/lib/json.jar:/opt/amazon/ebook/lib/kxml2.jar:/opt/amazon/ebook/lib/xyml.jar:/opt/amazon/ebook/booklet/AudiblePlayer.jar:/opt/amazon/ebook/booklet/AudioPlayer.jar:/opt/amazon/ebook/booklet/Browser.jar:/opt/amazon/ebook/booklet/ContentManager.jar:/opt/amazon/ebook/booklet/Demo.jar:/opt/amazon/ebook/booklet/Experimental.jar:/opt/amazon/ebook/booklet/Home.jar:/opt/amazon/ebook/booklet/MobiReader.jar:/opt/amazon/ebook/booklet/PictureViewer.jar:/opt/amazon/ebook/booklet/PrefBooklet.jar:/opt/amazon/ebook/booklet/Search.jar:/opt/amazon/ebook/booklet/XymlBooklet.jar:/opt/amazon/ebook/booklet/msp.jar:/opt/usr/java/lib/libjnisystem.jar -Ddebug=1 -Dcheck_comm_stack=true -Dhttp.keepalive.timeout=60000 -Dhttp.maxConnections=16 -Dallow_demo=false -Dawt_fb_enable=0 -Dextkeyboard=false -Dconfig=/opt/amazon/ebook/config/framework-unix.conf -DENABLE_SEARCH_INDEXING_THREAD=true -Dprintdebugtime=false com.amazon.ebook.framework.Main
(around 30 cvm copies skipped)
2298 ? S 0:00 [mmcqd]

As you can see, /opt is writable and so is /etc which points to it. On factory reset, the writable partition is populated from /usr/default/opt.tar.gz file.

Here's the full listing of the filesystem: list.zip.

Bonus content


The main GUI and most of the back-end code is written in Java. The framework is quite elaborate and can be extended with extra "booklets".
After spending some time investigating it with JAD, I found some undocumented shortcuts, features and easter eggs. Here's a more or less complete list.

Picture viewer


I'm not sure why Amazon didn't make it public (maybe because paging is kinda slow), but there is a basic picture viewer in Kindle.
To activate it:
1) make a folder called "pictures" in the root of Kindle drive or SD card. Kindle also checks for "dcim" made by cameras.
2) put your pictures for a single "book" into a folder inside that. The subfolder name will be used as the "book" name. Supported formats are jpg, png, gif.
3) in Home screen press Alt-Z. A new "book" should appear. Open it to view your pictures.
4) In the local menu you can toggle dithering, resize to fit and full screen mode.

Keyboard shortcuts


Various undocumented/underdocumented keyboard shortcuts. I italicized most interesting ones.

Global keys


Alt-Shift-R reboot Kindle
Alt-Shift-. restart GUI
Alt-Shift-G make screenshot
due to an implementation bug, screenshots can only be stored on SD card, not the main storage. A gif file is saved in the card root.
Shift-Sym start demo
Enabled only if allow_demo=true is passed on the Java commandline. Needs a special demo script present on the SD card.

Home


Alt-Shift-M Minesweeper
Alt-Z rescan picture directories
Alt-T show time

Reader


Alt-B toggle bookmark
Alt-T spell out time
Alt-0 enable/disable slideshow
Alt-1 start slideshow (if enabled)
Alt-2 stop slidehow
Alt-PageForward/PageBackward go to next/prev annotation or one "chunk" (1/20th of a book) forward or backward

Settings


411 show diagnostics data
511 run loopback call test
611 diagnostic data service call
c/e/s
126 Lab126 team members

Font List


J show/hide justification options

Picture viewer


Alt-Shift-0 set current picture as screensaver
F toggle fullscreen mode

Minesweeper


I,J,K,L up,left,down,right
M mark mine
R restart
Space open cell
Scroll move cursor up/down
Alt-Scroll move cursor left/right
H return to Home screen

Text input


Alt-Backspace clear all
Alt-H/Alt-J move cursor
(the following don't work in search field for some reason)
Alt-6 ?
Alt-7 ,
Alt-8 :
Alt-9 "
Alt-0 '

Browser


It seems there is a location capability (GPS?) in the CDMA module. I cannot check it as I'm not in USA but the following shortcuts are programmed inside the browser.
Alt-1 show current location in google maps
Alt-2 find gas station nearby
Alt-3 find restaurants nearby
Alt-4
Alt-5 find custom keyword nearby
Alt-D dump debug info to the log and toggle highlight default item
Alt-Z toggle zone drawing and show log

Audio Player


Alt-F next
Alt-P play/stop

Search commands


These command work in the search field. You can enter only beginning of the command if that's enough for it to be unique.

Public commands (always available)

@help
@web
@wiki/@wikipedia
@store
@time

Semiprivate (available but not mentioned in @help)

;dumpMessages dump current debug log into the "documents" directory
;debugOn set log level=2 and enable private commands
;debugOff set log level=1 and disable private commands

Private commands
Note: following commands are clearly not intended for end users. Some of them may damage your Kindle and void your warranty. Enter at your own risk.

`help list private commands
`7777 set version to TOPmk-xyz-77770 (to disable OTA updates?)
`voltLog <1|0> enable/disable voltage table debug
`batteryLoggingDelay set battery logging delay (in seconds)
`pppStop close WAN PPP connection
`disableIndexing
`logOpenFiles
`startIndexing
`dumpBattery
`indexStatus
`compliance
`einkAdjustments
`allocate [MB]
`log611
`reloadContentRoster
`indexForever
`downloadIndex
`consumeMemory
`terminal
`checkForUpdate
`applyUpdate
`stopIndexing
`processNowNow
`processTodo
`countUnmergedDownloadedIndexes
`dumpIndexStats
`memInfo

78 comments:

Anonymous said...

Thanks, Igor, you _rule_.

Anonymous said...

A masterpiece of reverse engineering. Ranks up there with rld-sfrt IMHO.

Rolf

Flash Sheridan said...

>>>
It seems there is a location capability (GPS?) in the CDMA module. I cannot check it as I'm not in USA but the following shortcuts are programmed inside the browser.
Alt-1 show current location in google maps
<<<

This does search Google Maps, but the location is “Not Avail, Not Avail.” (I tried from Palo Alto, California, just down the street from Lab 126’s old home.)


>>>
Font List
J show/hide justification options
<<<

Very cool, thanks; I’d specifically asked Amazon tech support about that, and they’d disavowed any knowledge of it. (Any sign of a font list, though? I’ve only sign an alternate font once, in Mike Huckabee’s (!) sample chapter.)

Kolenka said...

This makes me curious. I poked around with the ability to use images and it seems it is an incomplete 'manga' feature.

I realized that it mostly looks like the .manga-save is just a text file in a *nix config format with a single variable... and have been thinking that the .manga file that is associated with it is also a *nix config format file.

However, my initial prodding has resulted in having no effect (I am seeing if the .manga file would let me set Author/Title tags, for the hell of it).

I was curious if you might be willing to prod or attempt to provide extra insight on what variables/format this .manga file might have?

Igor Skochinsky said...

@Flash Sheridan
It seems the font style can be only specified when making a book. Try playing with mobigen.
@Kolenka
Alas, the manga_save file is used only to save the last viewed picture.

Kolenka said...

@Igor

Yup, that is what I thought too, but I am interested in the .manga file more, since it seems to be an empty config file placed into the directory by the Alt-Z shortcut when it rescans for images. I was semi-curious if it could contain tag information, and if so if it is a binary (like a severed MOBI header record or something odd like that) or text format (similar to the save file which records the place).

Anonymous said...

Font list is not available because it is expensive to ship fonts. Fonts also take away storage available for books. We should lobby Amazon to let us put our own fonts on the SD card.

Justification setting is strange because authors can decide what justification it can be in mobipocket format. Meaning if the author set the justification tag, you can't change it...

"due to an implementation bug, screenshots can only be stored on SD card, not the main storage. A gif file is saved in the card root." - anyway to submit a bug report on that?

You can just rename Foo.manga to Bar.manga to rename the displayed name.

Kolenka said...

@anonymous:

Yup, figured that much out. But I spend most of my time on the Kindle sorting by Author rather than Title. So the lack of documentation on how/if these can be fully tagged is a downer. I am almost tempted to build the serial cable myself to poke around, but then that would take away time from other off-hours projects I have. :(

Then again, do I really want 15 issues of a web comic I read to be on page 1 of my Kindle? Hrm, decisions, decisions. :)

voutilad said...

Anyone have any ideas behind what a XymlBooklet is?

/opt/amazon/ebook/booklet/XymlBooklet.jar

I've been googling Xyml and I can't seem to find an answer that isn't in Chinese. Not even wikipedia has an entry for xyml.

Igor Skochinsky said...

Xyml is the xml description of GUI used in Kindle.

ghchinoy said...
This comment has been removed by the author.
Kyle said...

I'm considering buying a kindle. I have two questions.

#1 How does the image view order images. If I put 01.png, 02.png, 03.png, etc. in the folder, can I just hit the next button to move forward like pages in a book?

#2 For some pdf documents, I don't want to lose the formatting. If I convert a pdf to a series of png files for each page, will it show up right? I realize I would lose text search. I'm not really concerned about that.

Thanks in advance for any response you can give me.

ghchinoy said...

igor, you do rule,

i was wondering about the screensavers that the kindle uses natively, looks like they might be in
/opt/amazon/ebook/img/ui, /opt/amazon/ebook/prefs/img/cache, or /opt/var/screen_saver? any way to pull those off?

also, i'd love to get my hands on some of the jar's to jad myself (ReaderSDK.jar, xyml.jar, framework-api.jar, framework-impl.jar, XymlBooklet.jar, PrefBooklet.jar) - is the proper procedure to wire up the kindle and pull those off, too?

it'd be really need if we could dump them to the SD card :)

thanks so much, igor!

Ed said...

Kyle: See for yourself.

I used the PDF from this site: Nothing To Hide

I loaded a copied .txt file (I simple copy and pasted the PDF, and removed line breaks) as well as PNG's of the first two pages of the file.

You can go to this page
to see the PNG files and photos of the Kindle.

What I didn't do is crop or do anything fancy to the PNG output. That made the text impossible to read because the borders are set oddly. However, it seems reasonably useful

Kyle said...

Thanks Ed. That looks alright. I could probably scan some of my own books also. The idea of not having to lug around 4 or 5 textbooks appeals to me. Formatting is usually important in textbooks because they very rarely have linear text. They always have those little information sidebars. Judging by your file sizes, a 300 page book would be somewhere around a 100 meg. I think I'm definitely going to get a kindle.

Ed said...

I'm still searching for a way to get digital copies of my textbooks. I've considered setting up some sort of auto-scanning machine - but time and money are short around here ;)

The picture viewer would probably suffice, but it lacks the search features that seem almost necessary. And I'd imagine scanning it as a PDF and then using one of the numerous methods to convert it to prc/mobi/azw wouldn't be worth it due to the sideboxes and funky formatting, as you mentioned.

I wanted to see how Amazon formats textbooks, so I used Foundations of Engineering Geology (link to the much cheaper Kindle Edition here). You can see the actual book via Google Books. Funky formatting doesn't begin to describe this book ;)

The Kindle edition sample for that same page I linked to in Google Books can be see in these photos. I'm not sure I'd want a biology or geology textbook in this form, simply due to the technical images and such - but a sociology or English book would seemingly be perfectly usable on the Kindle.

Kyle said...

I would recommend the opticbook scanner since that seems to be the cheap book scanner that everyone uses. Docupen is an option too, but I haven't tried either one.

You did say money was short. One option I see is Snapter Ice. It's a windows software that allows you to make pdfs from camera snaps. I'm not sure if it's good for ocr though. You can get a free copy if you get 20 friends to open an email link to it though.

Outside of those options, it's slice the binding and mass scan at kinko's. Problem with that is that you don't get the resale value off of the book.

Why is the search feature essential to you? You don't have search in a paper book outside of the index. As long as you bookmark the index, I don't see why you couldn't just use the image viewer and jump to the pages from the index. Am I misunderstanding the image viewer? I thought that it treated the image folder like a book with pages that you could jump to.

Anonymous said...

For me, trying to use the GPS capability gave pages with google either giving an error or not displaying the map. However, the coordinates in the google query box were right...

Stephen S. said...

The Google Map easter egg worked like a charm (well, if charms really worked)...and fast! And shockingly accurate. Thanks!

Anonymous said...

very cool......But how do you go back to the default screen savers after setting your own picture as the screen saver?

Anonymous said...

Anybody try making a phone call on the Kindle yet?

Wondering said...

No one I've run into can answer this, but if anyone can, it's you, Igor.

When you open a book from the Kindle home screen, it automatically takes you to the first part of the text or chapter one.

I would like my kindle to open all books at their Cover, and not at chapter one.

Is there a way to change this default behavior of the Kindle?

Kyle said...

Has anyone tried the `terminal command? It sounds interesting, but possibly dangerous.

pumpkin said...

*big ebook reader projected into the sky, calling roxfan back to iphone-land*

Cyrus said...

Question for you guys. I have not tried Igor's solution just yet as I am yet to receive that Kindle from Amazon, but do I just copy the provided file to get these features? I have only seen pictures of Kindle so far :)

Kyle said...

Cyrus, you don't have to use Igor's files to get these features. These are easter egg features that he found while disassembling some of the kindle code. The amazon team put them in there, but didn't tell anyone. You don't have to do anything to your kindle, and I would definitely recommend against it. You might end up messing something up bad.

Cyrus said...

Hey Kyle

Thanks for the tip. I still don't know when Amazon will be shipping my Kindle. They keep saying out of stock and even though I ordered it a while back still no hope. I guess if I knew how, I could've built Kindle in this waiting period :)

dchevyman4 said...

@Igor You are amazing. I wish I had half the skills you do.

panefsky said...

This is like Apocalypse for me.
Had never thought even about e-book formats.
My congratulations for this nice work!

crazy.neo said...

You should start working on other devices... MP4 players, for example.

Andrew Stone said...

Just as an aside, if you didn't know. Fiona is the name of the daughter of the creator of the Young Lady's Illustrated Primer in Diamond Age by Neal Stephenson. The Primer is an advanced book.

BTW, Very, very cool hack.

Cheers,
Andrew

electronjunkie said...

Thats an awesome hack. Thanks for your contribution to the tinkering community.

Has anyone tried compiling a pdf/ps reader for this thing? Or is that not possible without also installing tons of fonts?

What about other interesting apps like lighttd, ssh, or xterm?

Anonymous said...

pretty amazing

i'd wish more people would blog about similar things, thanks!

Anonymous said...

BADASS!! For those of you getting "not available" coordinates: try turning the wireless switch on, and then doing an ALT-SHIFT-R reboot. Worked for me. I don't know exactly what makes it work--the true reboot, the having the wireless switch on before it boots, the combination, or something else.. if someone wants to investigate..

Chris said...

http://www.amazon.com/Kindle-Amazons-Wireless-Reading-Device/dp/B000FI73MA

Play the video on amazon's kindle page.... Watch the top the left corner of the screen when the video zooms in.... "Fiona hackworth"

The fiona platform is hackworthy? :)

Jon the Geek said...

Is there a way to change the behavior of alt-1 and alt-2 from the browser, so they use "loc:" rather than "near"? That seems to work on maps.google.com with gps coordinates.

Also, it isn't *exactly* finding my location. Could it perhaps be the nearest cellphone tower?

Anonymous said...

Dumb question: who does the demo script run as? If "root", that looks like a really easy attack vector: simply make a "demo" script on the sd card and then run it. :-)

Anonymous said...

Andrew,

I think that Fiona should have been the name of the product. I had the opportunity of meeting the first employee at Lab126 who chose the name when I was working for a chip company. They couldn't say much about the project then, but now I understand the meaning behind the code name ;-)

Dave said...

Igor

Thanks for your work

I am making an adapter for the power supply to charge a second battery without having to put it in the Kindle

Quite simple, just a jack, connected to a five pin plug that the battery connecter can plug into.

On the battery there are five wires, two black, two red, and a white wire.
The black and red are negative and positive with an output of 3.9 volts
The white and red wire also have an output of 3.9 volts
It appears the white wire is negative, but there is resistance between the white and black wire.

Do you have any idea about the white wire?

Am I OK to just use the red and black wires as charging inputs?

Thanks, Dave

Anonymous said...

Wow, nice work, Igor! The location feature that you uncovered is not really GPS (triangulation off of geosynchronous satellites 23K miles up) as some have said but instead gets location from the CDMA mobile phone towers (either triangulation or some CDMA magic.)

Anonymous said...

GPS uses a constellation of 24 satellites in medium earth orbit, approximately 12,600 miles up, and are NOT in geosynchronus orbit. Check out http://en.wikipedia.org/wiki/Global_Positioning_System#Space_segment

At any rate this probably uses the closest cell tower to figure out your position, and not GPS :)

Neodudeman said...

Hacker - (noun) One who uses programming skills to gain access to a computer network or file.
See igorsk.blogspot.com for more details.

William said...
This comment has been removed by the author.
Anonymous said...

hi, igor, great job...dunno what it all means, but i am impressed in what i just read....super talent....is there a way to install a small bit of software, such as 'Mindmaker v1.2' from eliminatorworks.com? if so how, thanks

zofodraziw said...

Perhaps the "Kindle" name proposes burning your books once you have one of these?

David

Lost said...

@igor:

I've just started digging into this today (have root access using your findings), but I was curious as to whether you've discovered any new information concerning the topaz file format.

yurikhan said...

> 1079 ? S 0:00 /usr/sbin/netwatchd -d 20 -t 5 -p www.amazon.com

Achtung! There’s something evil in the process list.

Erik said...

for the curious 'terminal has no noticable effect. could be you have to have one of the other functions on for it to do anything.

Anonymous said...

I see the "J" command for revealing justification in the font list, but it's not working for me. Suddenly my book starting formatting in center justified text mode and I can't seem to get it back to left or full justification.

idle said...

hi,
congratulations for your achievements...
do u know about mobipocket .mbp (notes related to books) format? I have a very long .mbp file of a book that somehow the reader saved one day in such a way that it can't read it anymore... any hint of any kind (structure of this file), would be greatly appreciated.
aWRsZWxvb3BAaG90bWFpbC5jb20=

Anonymous said...

I found a program to unprotect protected mobipocket books:

http://pastebin.com/m40582493

ryan dunn said...

The google maps features don't work, not because I'm not getting a location, but because the location it sends to google maps is in longitude and latitude, and google doesn't seem to understand this information.

perhaps amazon coders are hoping google will realize this data should be functional and start letting them send it.

Some idiot said...

Hm... as someone else asked, how might one restore the old screensavers? Or failing that, purge the user's images? They don't go in the Kindle's "drive" portion of memory, and... the image I selected is quite undesirable, in retrospect.

idle said...

hi,
I finally ended up coding a mobipocket notes (mbp) exporter in order to solve my little problem...
(In case someone wanna give it a try:
http://www.angelfire.com/ego2/idleloop/mbp_reader.html )

Ali said...

You haven't updated on anything for awhile. I'm eager to hear your progress, as I'm a Java developer and would love to try to write booklets for the Kindle. I'm no Linux or hardware hacking aficionado, unfortunately.

Let me know what's up, man.

Aria said...

Igor: You seem to be the only person doing the hacking. Is there any way to load a unicode font to kindle?

tjosephcarter said...

Aria,

I am wondering about fonts as well. I've got a vision problem and have trouble with serif fonts. Caecilia looks like a fine Serif font, but I'd be MUCH happier with Helvetica throughout, I think. I wonder if you can just replace the TTFs with whatever you like in the appropriate size?

This is the one thing I must be able to do before I drop several hundred on a Kindle. If it can be done and works, particularly if a modified firmware can be loaded without waiting for Amazon to add the sans-serif font feature, I'll buy one literally tonight.

Soldering ... I'm not so good at that. I'd need a solution I could just drop on some SD card.

Abhishek said...

Hey Igor - we just started a kindle/books social network at amazonkindle.ning.com and one of the members luckily pointed out that one of the pictures on there of the insides of the kindle is copyrighted by you.
the link is http://amazonkindle.ning.com/photo/photo/show?id=2198514%3APhoto%3A59
it's the one with one side of the kindle case and the chip board.
would it be okay if we continue to feature it or should we remove it. please let us know by leaving a comment.

also - it'd be great if you'd join.

esmetaman said...

It is possible to add new features to read PDFs files?

Anonymous said...

Igor, great work, is there any way to password protect the kindle so that a password is neded to unlock the kindle?

FooSoft said...

I've made a small application for preparing manga images for the Kindle. I figured that it would be kind of a waste if I were the only person using it now that it's all done, so check it out. Feedback would be great too.

You can grab it at http://www.foosoft.net/mangle - I have a Windows executable but you can also build and run it under Linux.

Data160 said...

Hi,
I am quite impressed with the results that you got.
I wonder if you found anything that can allow a kindle overseas to have his time and date correctly set. I am unable to access the whispernet.
Thanks anyway

data160@yahoo.com.br

Anonymous said...

What I really need is a hack to disable the right sided Next Page button! I accidentally hit off that thing all the time and it causes endless frustration. I would be happy to just disable it entirely!

Dave Madfes said...

Awesome, wish I understood 10% of what you all are writing about.

I have a bunch of lectures in mp3 format that are in separate files, in fact each lecture is in three files. I put them in the audio book folder, but the list of files overwhelms my book index on the home page. Is there a way to "combine" them into an indexed audio book?

I'm on a Mac if that makes any difference.

Thanks for any response directly to my email: dave@madfes.com.

Anonymous said...

Damn, now that is a truly impressive, old-school hack. A true and proper hack, too, and in the times where the word "hack" is so often and so idiotically misused.

Alex said...

Hi, Igor.
I'm a reporter with the Los Angeles Times, writing about the Kindle. Would you have a minute to talk with me about your hacks? Many thanks in advance for your time!

Alex Pham

Chimi said...

Anyone know if the core eReader (mobibook I suppose) is in the Kindle source code (Kindle_src_2.1_337560062.tar)? I'd like to port to my Nokia N800 and maybe some other platforms (e.g., G2).

Anonymous said...

When in the picture viewer, I pressed ALT-SHIFT-0 (as in the number zero). I was trying to set it as the screensaver but ALT-SHIFT-o was not working so I tried with a zero instead. This resulted in the numbers 1-9 coming up on the bottom of the screen with lines coming down from them. What is this and how do I get rid of it?

Anonymous said...

Is there any way to unlock book sample files to show the whole book?

I noticed when I browsed the files on my computer that the same files seem to be the same size in KB as the full version so I'm wondering if there's a way to hack them.

Anonymous said...

Here's another code:

In Settings - Type 311 to select the carrier which Kindle is connected to.

Anonymous said...

Great post

anony mous said...

711 in settings shows wifi info :) IT would be cool to access a bashlike terminal on the kindle!

Anonymous said...

Also, f you hit Alt+Any of the letters on the top row yyou can make the numbers. I've only tried this on Kindle 3 however.

n3rd4i said...

hi, how can i add a standard keyboard functionality to this device after hacking it? external keyboard

Anonymous said...

Great! Great! Great!

Lucas said...

Hi

Is it possible to unlock a Kindle with password?
Thx!

gamrman said...

you can also hit alt+711 in settings and get a page that is all about your kindles wireless configurations and stuff related to that.

gamrman said...

i found out you can hit alt+711 in the settings and it will show a screen that tells you all about your kindles wireless configurations and stuff related to that.