Kindle 3 Teardown

With the arrival of my Kindle 3, I had an urge to make it do something it wasn't designed for. And surely anything with that much of a glossy UI would be backed by some form of Linux. So it was a matter of time.
The data found here is through experimenting with the Linux terminal on the Kindle (Once unlocked)
Some handy info: (TO BE ADDED)
'cat /proc/cpuinfo'

Processor : ARMv6-compatible processor rev 3 (v6l)
BogoMIPS : 255.59
Features : swp half thumb fastmult vfp edsp java
CPU implementer : 0x41
CPU architecture: 6TEJ
CPU variant : 0x1
CPU part : 0xb36
CPU revision : 3
Cache type : write-back
Cache clean : cp15 c7 ops
Cache lockdown : format C
Cache format : Harvard
I size : 16384
I assoc : 4
I line length : 32
I sets : 128
D size : 16384
D assoc : 4
D line length : 32
D sets : 128

Hardware : Amazon MX35 Luigi Board
Revision : 35020
Serial : "B00AA0A00XXXXXXX"
BoardId : "SP1B000000000000"
'cat /proc /meminfo'
MemTotal: 256568 kB
MemFree: 109880 kB
Buffers: 16808 kB
Cached: 52716 kB
SwapCached: 0 kB
Active: 87324 kB
Inactive: 46724 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 20 kB
Writeback: 0 kB
AnonPages: 64524 kB
Mapped: 16356 kB
Slab: 5780 kB
SReclaimable: 3060 kB
SUnreclaim: 2720 kB
PageTables: 1380 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 128284 kB
Committed_AS: 1138624 kB
VmallocTotal: 581632 kB
VmallocUsed: 1624 kB
VmallocChunk: 580008 kB
'ifconfig'
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:6 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:328 (328.0 B) TX bytes:328 (328.0 B)

ppp0 Link encap:Point-to-Point Protocol
inet addr:10.1XX.X.X P-t-P:10.64.64.64 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:7 errors:0 dropped:0 overruns:0 frame:0
TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:112 (112.0 B) TX bytes:64 (64.0 B)

wlan0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:392 errors:0 dropped:0 overruns:0 frame:0
TX packets:217 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:32216 (31.4 KiB) TX bytes:3002 (2.9 KiB)
'uname -a'
Linux kindle 2.6.26-rt-lab126 #5 Wed Sep 15 19:25:13 PDT 2010 armv6l unknown
'ps -A'
PID TTY TIME CMD
1 ? 00:00:01 init.sysvinit
2 ? 00:00:00 kthreadd
3 ? 00:00:00 posixcputmr/0
4 ? 00:00:00 sirq-high/0
5 ? 00:00:00 sirq-timer/0
6 ? 00:00:00 sirq-net-tx/0
7 ? 00:00:00 sirq-net-rx/0
8 ? 00:00:00 sirq-block/0
9 ? 00:00:00 sirq-tasklet/0
10 ? 00:00:00 sirq-sched/0
11 ? 00:00:00 sirq-hrtimer/0
12 ? 00:00:00 sirq-rcu/0
13 ? 00:00:00 desched/0
14 ? 00:00:00 events/0
15 ? 00:00:00 khelper
67 ? 00:00:00 kblockd/0
72 ? 00:00:00 mxc_spi.0
75 ? 00:00:00 mxc_spi.1
93 ? 00:00:00 kmmcd
101 ? 00:00:00 pmic_spi/0
173 ? 00:00:00 pdflush
174 ? 00:00:00 pdflush
175 ? 00:00:00 kswapd0
176 ? 00:00:00 aio/0
177 ? 00:00:00 nfsiod
213 ? 00:00:00 kondemand/0
224 ? 00:00:02 mmcqd
255 ? 00:00:00 rpciod/0
270 ? 00:00:00 kjournald
372 ? 00:00:00 udevd
632 ? 00:00:00 kjournald
888 ? 00:00:33 eink_fb_bt
890 ? 00:00:00 eink_fb_pt
966 ? 00:00:00 syslog-ng
1086 ? 00:00:00 file-storage-ga
1374 ? 00:00:00 loop0
1410 ? 00:00:00 fsp
1506 ? 00:00:00 lifeguard
1578 ? 00:00:00 lifeguard
1990 ? 00:00:00 recEvent
1992 ? 00:00:00 AR6K Async
2015 ? 00:00:00 ksdiorqd
2041 ? 00:00:00 wpa_supplicant
2237 ? 00:00:00 dbus-daemon
2283 ? 00:00:00 pmond
2333 ? 00:00:00 powerd
2485 ? 00:00:00 wifid
2493 ? 00:00:00 cmd
2529 ? 00:00:01 wand
2667 ? 00:00:00 usb-watchdog
2731 ? 00:00:00 dbus-monitor
2733 ? 00:00:00 usb-watchdog-he
2752 ? 00:00:00 phd
2825 ? 00:00:00 mcsd
2881 ? 00:00:00 volumd
3064 ? 00:00:00 audioServer
3115 ? 00:00:00 ttsd
3231 ? 00:00:00 crond
3263 ? 00:00:00 tmd
3264 ? 00:00:00 lipc-daemon
3323 ? 00:00:00 testd
3392 ? 00:00:00 browserd
3468 ? 00:00:00 start.sh
3612 ? 00:00:00 start.sh
3613 ? 00:00:00 exe
3639 ? 00:01:33 cvm
3642 ttymxc/0 00:00:00 getty
3745 ? 00:00:00 sh
6499 ? 00:00:00 ksuspend_usbd
6501 ? 00:00:00 khubd
6588 ? 00:00:00 pppd
6831 ? 00:00:22 myts.arm
6834 pts/0 00:00:00 sh
7076 pts/0 00:00:00 ps
'ping fints-g7g.amazon.com' (DataCentre)
PING fints-g7g.amazon.com (87.238.83.84): 56 data bytes
64 bytes from 87.238.83.84: seq=0 ttl=248 time=393.460 ms
64 bytes from 87.238.83.84: seq=1 ttl=248 time=412.146 ms
64 bytes from 87.238.83.84: seq=2 ttl=248 time=431.885 ms
64 bytes from 87.238.83.84: seq=3 ttl=248 time=414.278 ms
64 bytes from 87.238.83.84: seq=4 ttl=248 time=433.994 ms
64 bytes from 87.238.83.84: seq=5 ttl=248 time=395.067 ms
64 bytes from 87.238.83.84: seq=6 ttl=248 time=372.576 ms
64 bytes from 87.238.83.84: seq=7 ttl=248 time=1190.185 ms
64 bytes from 87.238.83.84: seq=8 ttl=248 time=291.142 ms

--- fints-g7g.amazon.com ping statistics ---
9 packets transmitted, 9 packets received, 0% packet loss
round-trip min/avg/max = 291.142/481.637/1190.185 ms

The 3G Connection... Free 3G globally, with no subscription... What does that actually mean?
How it works:
1) Kindle is given a DHCP address from Vodafone in the 10.x.x.x range.. A popular LAN domain
2) Kindle can ONLY communicate via HTTP proxy on fints-g7g.amazon.com
3) All other DNS requests made by the system will be dropped, unless via HTTP proxy in browser
4) Amazon Proxy server only allows outgoing to HTTP (80) and HTTPS (443)
5) Only ping requests will return from fints-g7g.amazon.com (and its static IP)
6) The kindle authenticates with the Proxy server using a key stored in every connecting packet (X-FSN key)
To summarise:
The Kindle is NOT accessible over the web (could have guessed that)
The kindle is locked down to browser web access only via the proxy server
All requests must pass through the Proxy Server for ultimately... dropping :(
All communications will require the X-FSN key to be in the packet headers

What can be done?
Well, In my next update and Document the process will be documented on how to utilise these tight knit rules to overcome the 'hurdle.' This is an educational tool, and should not be used in practice.

0 comments: