Root Shell
After I downloaded and extracted the root fs image, I quickly ran the /etc/shadow file though John the Ripper. In a moment it displayed the root password: "fiona" (which is the codename for the Kindle, by the way). Alas, it didn't work when I tried entering into console. Also, adding "init=/bin/sh" or "single" to the kernel boot arguments didn't work either.
So I started to poke around with the firmware update and after some time was able to run a script which mounted the read-write part of root filesystem and dumped the /etc/shadow from it. Unsurprisingly, it had a different password hash. Apparently the root password is changed somewhere before shipping to the end user. So I quickly adapted the script to replace the shadow file on the device with the original one.
You can find that implementation in this update maker zip.
kindle_update_maker-0.1.zip
After replacing the shadow file and a reboot, I was able to get in.
Output of some commands.
[root@kindle root]#ls -la /
drwxr-xr-x 2 root root 592 Oct 30 2007 bin
drwxr-xr-x 1 root root 0 Jan 1 00:00 dev
lrwxrwxrwx 1 root root 7 Oct 30 2007 etc -> opt/etc
drwxr-xr-x 2 root root 3 Oct 30 2007 home
drwxr-xr-x 2 root root 3 Oct 30 2007 initrd
drwxr-xr-x 2 root root 586 Oct 30 2007 lib
lrwxrwxrwx 1 root root 11 Oct 30 2007 linuxrc -> bin/busybox
drwxr-xr-x 5 root root 34 Oct 30 2007 mnt
drwxr-xr-x 10 root root 1024 Nov 5 2007 opt
dr-xr-xr-x 101 root root 0 Jan 1 15:42 proc
drwxr-xr-x 2 root root 506 Oct 30 2007 sbin
drwxr-xr-x 10 root root 0 Jan 1 15:42 sys
drwxrwxrwx 5 root root 0 Jan 1 15:44 tmp
drwxr-xr-x 10 root root 95 Oct 30 2007 usr
drwxr-xr-x 2 root root 55 Oct 30 2007 var
[root@kindle root]# mount
devfs on /dev type devfs (rw)
/dev/bml0/6 on / type squashfs (ro)
/dev/stl0/8 on /opt type ext3 (rw,sync,noatime,nodiratime)
/proc on /proc type proc (rw,nodiratime)
sysfs on /sys type sysfs (rw)
devfs on /dev type devfs (rw)
usbdevfs on /proc/bus/usb type usbdevfs (rw)
devpts on /dev/pts type devpts (rw)
tmpfs on /tmp type tmpfs (rw)
/dev/bml0/7 on /mnt/dc type squashfs (ro)
[root@kindle root]# ps -A f
PID TTY STAT TIME COMMAND
1 ? S 0:01 [swapper]
2 ? SN 0:00 [ksoftirqd/0]
3 ? S< 0:00 [events/0]
4 ? S< 0:00 \_ [khelper]
20 ? S< 0:10 \_ [kblockd/0]
87 ? S 0:02 \_ [pdflush]
89 ? S< 0:00 \_ [aio/0]
86 ? S 0:00 \_ [pdflush]
10 ? S 0:00 [sleepd]
33 ? S 0:00 [khubd]
88 ? S 0:00 [kswapd0]
676 ? S 0:12 [voltd]
678 ? S 0:02 [pnlcd_animate]
681 ? S 0:00 [kseriod]
710 ? S 0:00 [wantph]
709 ? S 0:00 [wanend]
721 ? S 0:00 [mmcdd]
727 ? S 0:00 [hpdetd]
740 ? Ss 0:00 init
1116 tts/2 Ss 0:00 \_ -sh
2344 tts/2 R+ 0:00 \_ ps -A f
831 ? S 0:00 [kjournald]
884 ? S 0:03 /sbin/syslogd -m 0 -b 1 -S -s 250
887 ? S 0:01 /sbin/klogd
976 ? S 0:00 [eink_fb_apt]
974 ? S 0:04 [eink_fb_udt]
975 ? S 0:00 [eink_fb_sst]
1023 ? S 0:07 [f-s-gadget]
1024 ? S 0:00 [f-s-activity]
1063 ? S 0:00 [wdtpmd]
1071 ? S 0:00 /usr/sbin/watchdogd -k 9 -t 30
1079 ? S 0:00 /usr/sbin/netwatchd -d 20 -t 5 -p www.amazon.com
1086 ? S 0:03 /usr/sbin/nomkd -v 80 -r 44 -d 23 cvm
1092 ? S 0:00 crond -l 9 -c /etc/crontab
1097 ? S 0:00 /bin/sh /usr/sbin/tphmonitor
1101 ? S 0:00 \_ /usr/sbin/tphserver -f
1119 ? S 0:00 /bin/sh /usr/sbin/execmonitor
1128 ? S 0:00 \_ /usr/sbin/execserver
1123 ? S 0:00 /bin/sh /opt/amazon/ebook/bin/run_framework
1169 ? S 0:00 \_ /bin/sh /opt/amazon/ebook/bin/start.sh
1173 ? SL 0:18 \_ /usr/java/bin/cvm -Xmx16m -Dsun.boot.library.path=/opt/usr/java/lib:/usr/java/lib -cp :/opt/amazon/ebook/lib/MobiCore-impl.jar:/opt/amazon/ebook/lib/MobipocketCoreReader.jar:/opt/amazon/ebook/lib/ReaderSDK.jar:/opt/amazon/ebook/lib/SearchSDK.jar:/opt/amazon/ebook/lib/framework-api.jar:/opt/amazon/ebook/lib/framework-impl.jar:/opt/amazon/ebook/lib/jdbm.jar:/opt/amazon/ebook/lib/json.jar:/opt/amazon/ebook/lib/kxml2.jar:/opt/amazon/ebook/lib/xyml.jar:/opt/amazon/ebook/booklet/AudiblePlayer.jar:/opt/amazon/ebook/booklet/AudioPlayer.jar:/opt/amazon/ebook/booklet/Browser.jar:/opt/amazon/ebook/booklet/ContentManager.jar:/opt/amazon/ebook/booklet/Demo.jar:/opt/amazon/ebook/booklet/Experimental.jar:/opt/amazon/ebook/booklet/Home.jar:/opt/amazon/ebook/booklet/MobiReader.jar:/opt/amazon/ebook/booklet/PictureViewer.jar:/opt/amazon/ebook/booklet/PrefBooklet.jar:/opt/amazon/ebook/booklet/Search.jar:/opt/amazon/ebook/booklet/XymlBooklet.jar:/opt/amazon/ebook/booklet/msp.jar:/opt/usr/java/lib/libjnisystem.jar -Ddebug=1 -Dcheck_comm_stack=true -Dhttp.keepalive.timeout=60000 -Dhttp.maxConnections=16 -Dallow_demo=false -Dawt_fb_enable=0 -Dextkeyboard=false -Dconfig=/opt/amazon/ebook/config/framework-unix.conf -DENABLE_SEARCH_INDEXING_THREAD=true -Dprintdebugtime=false com.amazon.ebook.framework.Main
(around 30 cvm copies skipped)
2298 ? S 0:00 [mmcqd]
As you can see, /opt is writable and so is /etc which points to it. On factory reset, the writable partition is populated from /usr/default/opt.tar.gz file.
Here's the full listing of the filesystem: list.zip.
Bonus content
The main GUI and most of the back-end code is written in Java. The framework is quite elaborate and can be extended with extra "booklets".
After spending some time investigating it with JAD, I found some undocumented shortcuts, features and easter eggs. Here's a more or less complete list.
Picture viewer
I'm not sure why Amazon didn't make it public (maybe because paging is kinda slow), but there is a basic picture viewer in Kindle.
To activate it:
1) make a folder called "pictures" in the root of Kindle drive or SD card. Kindle also checks for "dcim" made by cameras.
2) put your pictures for a single "book" into a folder inside that. The subfolder name will be used as the "book" name. Supported formats are jpg, png, gif.
3) in Home screen press Alt-Z. A new "book" should appear. Open it to view your pictures.
4) In the local menu you can toggle dithering, resize to fit and full screen mode.
Keyboard shortcuts
Various undocumented/underdocumented keyboard shortcuts. I italicized most interesting ones.
Global keys
Alt-Shift-R reboot Kindle
Alt-Shift-. restart GUI
Alt-Shift-G make screenshot
due to an implementation bug, screenshots can only be stored on SD card, not the main storage. A gif file is saved in the card root.
Shift-Sym start demo
Enabled only if allow_demo=true is passed on the Java commandline. Needs a special demo script present on the SD card.
Home
Alt-Shift-M Minesweeper
Alt-Z rescan picture directories
Alt-T show time
Reader
Alt-B toggle bookmark
Alt-T spell out time
Alt-0 enable/disable slideshow
Alt-1 start slideshow (if enabled)
Alt-2 stop slidehow
Alt-PageForward/PageBackward go to next/prev annotation or one "chunk" (1/20th of a book) forward or backward
Settings
411 show diagnostics data
511 run loopback call test
611 diagnostic data service call
c/e/s
126 Lab126 team members
Font List
J show/hide justification options
Picture viewer
Alt-Shift-0 set current picture as screensaver
F toggle fullscreen mode
Minesweeper
I,J,K,L up,left,down,right
M mark mine
R restart
Space open cell
Scroll move cursor up/down
Alt-Scroll move cursor left/right
H return to Home screen
Text input
Alt-Backspace clear all
Alt-H/Alt-J move cursor
(the following don't work in search field for some reason)
Alt-6 ?
Alt-7 ,
Alt-8 :
Alt-9 "
Alt-0 '
Browser
It seems there is a location capability (GPS?) in the CDMA module. I cannot check it as I'm not in USA but the following shortcuts are programmed inside the browser.
Alt-1 show current location in google maps
Alt-2 find gas station nearby
Alt-3 find restaurants nearby
Alt-4
Alt-5 find custom keyword nearby
Alt-D dump debug info to the log and toggle highlight default item
Alt-Z toggle zone drawing and show log
Audio Player
Alt-F next
Alt-P play/stop
Search commands
These command work in the search field. You can enter only beginning of the command if that's enough for it to be unique.
Public commands (always available)
@help
@web
@wiki/@wikipedia
@store
@time
Semiprivate (available but not mentioned in @help)
;dumpMessages dump current debug log into the "documents" directory
;debugOn set log level=2 and enable private commands
;debugOff set log level=1 and disable private commands
Private commands
Note: following commands are clearly not intended for end users. Some of them may damage your Kindle and void your warranty. Enter at your own risk.
`help list private commands
`7777 set version to TOPmk-xyz-77770 (to disable OTA updates?)
`voltLog <1|0> enable/disable voltage table debug
`batteryLoggingDelayset battery logging delay (in seconds)
`pppStop close WAN PPP connection
`disableIndexing
`logOpenFiles
`startIndexing
`dumpBattery
`indexStatus
`compliance
`einkAdjustments
`allocate [MB]
`log611
`reloadContentRoster
`indexForever
`downloadIndex
`consumeMemory
`terminal
`checkForUpdate
`applyUpdate
`stopIndexing
`processNowNow
`processTodo
`countUnmergedDownloadedIndexes
`dumpIndexStats
`memInfo
