[UPDATE1]【速報】Kindle Software Version 3.1が早くもJailBreakされる

先日、Kindle3に向けたSoftware Version3.1がリリースされ、一昨日アマゾンからOTA配信を開始する旨の公式アナウンスがあったばかりです。「JailBreak済みKindle3WIFI版のソフトウェアを3.1にアップデートしてみた」でまとめた後にアップデータによるハックは出来ないためスーパーハッカーのJailBreakハックを待つしかないことを確認しところに、昨日、当ブログのコメント欄にJailBreak可能であるとの情報を知らせていただきました。（情報Thx＞7942さま）

早速、JailBreakハックを適用してみましたのでご報告いたします。結論から言うと、JailBreakされ以前と同じusbnetworkハックを適用することができました。今のところ問題ありませんが、確認できたことは順次追記していく予定です。

注意喚起情報
シリアル接続できない方のKindle JailBreakハックは非常に危険ですのでリスクについて理解されている方のみ読み進めてください。参考：Kindle Jailbreak（Hack）の注意点に関する個人的メモ（未定稿）

まずJailBreakするためのアップデータをダウンロードします。使用上の注意はコチラを参照してください。必ず読んでください。
Kindle 3.1 Jailbreak

アップデータは上記フォーラムにもリンクがありますがコチラかダウンロード可能です。
Kindle Jailbreak

解凍して自分の機種にあったインストーラーをKindle3のUSBストレージのroot（”/mnt/us/”）に置き、Settingsメニューから”Update Your Kindle”を実行します。完了するとKindleのHOME画面が起動します。USBストレージのrootに”ENABLE_HACK_UPDATES”というファイルがあるはずです。このファイルの存在チェックにより適用するアップデータの提供元がAmazonなのかサードパーティなのかをコントロールします。存在する場合はハックを適用するようになります。解除する場合はこのファイルを削除してKindleを再起動します。またハックを適用したい場合は中身はブランクのこれと同じファイル名を用意して再起動するだけです。

今回のJailBreakハックはリリースされたばかりですがバージョンが既に0.1から0.3まで上がっています。徐々に機能が改善されており、今後も上がる可能性がありますので、急がない方はもう少し様子を見たほうが良いかもしれません。

念の為にSoftware Version 3.0.3で適用できていたusbnetworkハックを適用してみたところ、JailBreakハックなしでは失敗していたものの、無事成功し動作しました。

参考：【Kindle3要JB】USB／WIFI接続からrootでログインするハック

参考までにyifanlu氏のkindle-JailBreak 0.3のハックを適用したところのシリアル接続で取得したログです。
#################################################
# N O T I C E * N O T I C E * N O T I C E #
#################################################
Rootfs is mounted read-only. Invoke mntroot rw to
switch back to a writable rootfs.
#################################################
[root@kindle root]#
[root@kindle root]#
[root@kindle root]# system: I start.sh:stop:signal=15,exitval=143:CVM stopped using SIGTERM
INIT: Switching to runlevel: 3
system: I K05framework:def:stopping booklet framework
com.lab126.powerd failed to access property state (0x3 lipcErrNoSuchSource)
system: I K06browserd:def:Stopping Browser Daemon
system: I K10cron:def:stopping crond
start-stop-daemon: lseek: Invalid argument
Stopping lipc-daemon: system: I K10tmd:def:Stopping Transfer Manager Daemon
system: I K15audio:def:stopping audio server
system: I K17ttsd:def:stopping TTS daemon
system: I K20volumd:def:stopping Volume daemon
system: I K25phd:def:Stopping Phone-Home Daemon
system: I K30cmd:def:stopping CMD daemon
system: I K30wifid:def:stopping wifid
Stopping Power Management Daemon: stopped /usr/bin/wpa_supplicant (pid 18951)
system: W wpa_supplicant:def:wpa supplicant stopped
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
..unloading all
system: I wifi:def:loadAR6000 finished, args=(unloadall)
system: I K76mcsd:def:stopping MCS server
Stopping Process Monitoring Daemon: system: I K85dbus:def:stopping system message bus
system: I mntroot:def:Making root filesystem read-only
system: I S50updater:def:updater started
system: I S50updater:def:Waiting for wand to shutdown
system: I S50updater:def:wand shutdown complete
system: I S50updater:def:read bundle line [/mnt/us/update_jailbreak_0.3_k3w_install.bin]
system: I S50updater:def:Applying update /mnt/us/update_jailbreak_0.3_k3w_install.bin
system: I S50updater:def:Size of update: 3751 bytes
system: I S50updater:def:Version before update: 031-S1-055870
system: I _otaupexec:def:processing update /mnt/us/update_jailbreak_0.3_k3w_install.bin
4+0 records in
4+0 records out
system: I _otaupexec:def:version is “FC02”
32+0 records in
32+0 records out
57+1 records in
57+1 records out
system: I _otaupexec:def:update image checksum OK
57+1 records in
57+1 records out
jailbreak.sig
payload.sig
loader.sig
update loader.sig .dat
update loader.sig .dat.sig
system: I mntroot:def:Making root filesystem writeable
ota_install: I def:update::backup Amazon keys, just in case
ota_install: I def:update::create jailbreak init script
ota_install: I def:update::copy the keys
ota_install: I def:update::start script
system: I jailbreak:def:update providers changed, switching keys
system: I mntroot:def:Making root filesystem writeable
ota_install: I def:update::done
system: I _otaupexec:def:update complete
system: I S50updater:def:OTA update successful for /mnt/us/update_jailbreak_0.3_k3w_install.bin
system: I S50updater:def:Version after update: 031-S1-055870
system: I S50updater:def:Deleting OTA bundle file “/mnt/us/update_jailbreak_0.3_k3w_install.bin”
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
Load Board Data from /opt/ar6k/target/AR6002/hw2.0/bin/lab126_15dBm_nodiv_WWR_CTL.bin
Updating MAC address
BMI Set App Start (address: 0x913950)
BMI Bit-Wise (OR) modify Register (address: 0x500410, orig:0x8, new: 0x9, mask:0x1)
BMI Write compressed Memory (address: 0x502070, filename: /opt/ar6k/target/AR6002/hw2.0/bin/athwlan.bin.z77)
BMI Write Memory (address: 0x52d6d0, filename: /opt/ar6k/target/AR6002/hw2.0/bin/data.patch.hw2_0.bin)
BMI Write Memory (address: 0x500418, value: 0x52d6d0)
BMI Done
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70cmd:def:starting CMD daemon
system: I S70wifid:def:starting wifid
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 92%
Wed Feb 23 08:57:44 2011 INFO:battery charge: 92%
Starting lipc-daemon: system: I S90tmd:def:Starting Transfer Manager Daemon
system: I S90cron:def:starting crond
system: I S94browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=7064150:boot time before framework starts, in milliseconds
start.sh: starting framework
system: I mntroot:def:Making root filesystem read-only
system: I S96boot_finished:def:Boot finished script received framework booted event
system: I S96boot_finished:fwboot:time=7104190:boot time after framework starts, in milliseconds
system: I loginfo:devhw:boardID=SP1B:Shasta PVT device – rev 1
system: I loginfo:devhwphy::USB PHY built by unknown
system: I loginfo:devsworig::Original System Software Version: 031-S1-055870
Sat Feb 5 19:07:33 PST 2011
system: I loginfo:devswota::OTA Kindle 3.1 (~~otaVersion~~)
com.lab126.wan failed to access property localTimeOffset (0x3 lipcErrNoSuchSource)
system: W loginfo:ltofailwandoff:cannot retrieve local time offset – wand not running
com.lab126.powerd failed to set value for property wakeUp (0x8 lipcErrNoSuchProperty)
system: I ckimage:def:skipping kernel check
system: I governor:def:switching to ondemand governor
system: I tinyrot:def::Rotating file /var/log/messages with max size 256
/usr/sbin/tinyrot : Signaling syslog
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 348kb
system: I tinyrot:def:Removing /var/local/log/messages_00000283_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 319kb
system: I tinyrot:def:Removing /var/local/log/messages_00000284_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 291kb
system: I tinyrot:def:Removing /var/local/log/messages_00000285_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 272kb
system: I tinyrot:def:Removing /var/local/log/messages_00000286_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 228kb

—-[UPDATE 2011/3/6追記]
Kindle JailBreakハックが0.3から0.4へバージョンアップしています。オフィシャルとカスタムアップデータをユーザ側でコントロール（/mnt/us/ENABLE_HACK_UPDATES）する必要がなくなりました。バージョン0.3適用済みでもそのままバージョン0.4で上書きしても構わないようです。詳しくはコチラを参照してください。参考までに適用ログです。

system: I start.sh:stop:signal=15,exitval=143:CVM stopped using SIGTERM
INIT: Switching to runlevel: 3
system: I K05framework:def:stopping booklet framework
com.lab126.powerd failed to access property state (0x3 lipcErrNoSuchSource)
system: I K06browserd:def:Stopping Browser Daemon
system: I browserd:def:Stopping Browser Daemon
Killed
system: I browserd:def:Starting Browser Daemon
system: I usbnetwork:def:usbnet is already stopped
system: I K10cron:def:stopping crond
start-stop-daemon: lseek: Invalid argument
Stopping lipc-daemon: system: I K10tmd:def:Stopping Transfer Manager Daemon
system: I K15audio:def:stopping audio server
system: I K17ttsd:def:stopping TTS daemon
system: I K20volumd:def:stopping Volume daemon
system: I K25phd:def:Stopping Phone-Home Daemon
system: I K30cmd:def:stopping CMD daemon
system: I K30wifid:def:stopping wifid
Stopping Power Management Daemon: stopped /usr/bin/wpa_supplicant (pid 12001)
system: W wpa_supplicant:def:wpa supplicant stopped
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
..unloading all
system: I wifi:def:loadAR6000 finished, args=(unloadall)
system: I K76mcsd:def:stopping MCS server
Stopping Process Monitoring Daemon: system: I K85dbus:def:stopping system message bus
system: I mntroot:def:Making root filesystem read-only
system: I S50updater:def:updater started
system: I S50updater:def:Waiting for wand to shutdown
system: I S50updater:def:wand shutdown complete
system: I S50updater:def:read bundle line [/mnt/us/update_jailbreak_0.4_k3w_install.bin]
system: I S50updater:def:Applying update /mnt/us/update_jailbreak_0.4_k3w_install.bin
system: I S50updater:def:Size of update: 3660 bytes
system: I S50updater:def:Version before update: 031-S1-055870
system: I _otaupexec:def:processing update /mnt/us/update_jailbreak_0.4_k3w_install.bin
4+0 records in
4+0 records out
system: I _otaupexec:def:version is “FC02”
32+0 records in
32+0 records out
56+1 records in
56+1 records out
system: I _otaupexec:def:update image checksum OK
56+1 records in
56+1 records out
jailbreak.sig
payload.sig
loader.sig
update loader.sig .dat
update loader.sig .dat.sig
system: E _otaupexec:def:signature verification failed on “/tmp/.update-tmp.13468/update loader.sig .dat”
system: E _otaupexec:def:signature verification failed
system: E S50updater:def:OTA update failed (1)
system: I S50updater:def:Deleting OTA bundle file “/mnt/us/update_jailbreak_0.4_k3w_install.bin”
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac = 28:EF:01:44:C9:C4
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
Load Board Data from /opt/ar6k/target/AR6002/hw2.0/bin/lab126_15dBm_nodiv_WWR_CTL.bin
Updating MAC address
BMI Set App Start (address: 0x913950)
BMI Bit-Wise (OR) modify Register (address: 0x500410, orig:0x8, new: 0x9, mask:0x1)
BMI Write compressed Memory (address: 0x502070, filename: /opt/ar6k/target/AR6002/hw2.0/bin/athwlan.bin.z77)
BMI Write Memory (address: 0x52d6d0, filename: /opt/ar6k/target/AR6002/hw2.0/bin/data.patch.hw2_0.bin)
BMI Write Memory (address: 0x500418, value: 0x52d6d0)
BMI Done
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70wifid:def:starting wifid
system: I S70cmd:def:starting CMD daemon
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S82usbnet:def:usbnet is disabled
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 76%
Sun Mar 6 20:58:22 2011 INFO:battery charge: 76%
system: I S90cron:def:starting crond
Starting lipc-daemon: system: I S90tmd:def:Starting Transfer Manager Daemon
system: I browserd:def:Stopping Browser Daemon
Killed
system: I S94browserd:def:Starting Browser Daemon
system: I browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=7815080:boot time before framework starts, in milliseconds
start.sh: starting framework
system: I mntroot:def:Making root filesystem read-only
system: I S96boot_finished:def:Boot finished script received framework booted event
system: I S96boot_finished:fwboot:time=7852200:boot time after framework starts, in milliseconds
system: I loginfo:devhw:boardID=SP1B:Shasta PVT device – rev 1
system: I loginfo:devhwphy::USB PHY built by unknown
system: I loginfo:devsworig::Original System Software Version: 031-S1-055870
Sat Feb 5 19:07:33 PST 2011
system: I loginfo:devswota::OTA Kindle 3.1 (~~otaVersion~~)
com.lab126.wan failed to access property localTimeOffset (0x3 lipcErrNoSuchSource)
system: W loginfo:ltofailwandoff:cannot retrieve local time offset – wand not running
com.lab126.powerd failed to set value for property wakeUp (0x8 lipcErrNoSuchProperty)
system: I ckimage:def:skipping kernel check
system: I governor:def:switching to ondemand governor
system: I tinyrot:def::Rotating file /var/log/messages with max size 256
/usr/sbin/tinyrot : Signaling syslog
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 555kb