必要な設定ファイルと格納場所を作ります。手っ取り早く作るにはUnknown.bundleにあるcarrier.plistをベースにします。その他、version.plist、info.plistも母艦にコピーします。母艦でProerty List Editor等を使って、carrier.plistにAPN設定とキャリアロゴ表示、FaceTimeアクティベーション（成功事例は未確認）に必要な情報を追記します。info.plistは必要に応じて変更します。作業の前には必ずバックアップをとりましょう。
サポートSIMに日本通信（ドコモFOMA網）のPLMN（Public Land Mobile Network）コードを追記します。Unknown.bundleのcarrier.plistにはオフィシャルサポートするキャリアのPLMNコードが全て記載されていますので、その最初でも最後でも構いませんので追記します。
Unknown.bundle以外で使用する場合はinfo.plistの修正も必要になります。info.plistをProperty List Editor等で開いてCFBundleExecutableキーを”Unknown”から適当な名称（例：bmobile）に変更します。またCFBundleIdentifierを”com.apple.Unknown”を”com.apple.bmobile”等に変更します。
Kindle JailBreakにFreeDownloadハックが登場しています。Kindle Software Version 3.1で動作確認済みですが3.0.xでは未確認です。Kindleが内部ブラウザからダウンロードできるのは拡張子が”.azw”、”.prc”、”.mobi”、”.txt”に限定されており、PDF等の他の拡張子をもつファイルはダウンロードすることが出来ませんが、このハックを使えば可能になります。
解凍して自分の機種にあったインストーラーをKindle3のUSBストレージのroot（”/mnt/us/”）に置き、Settingsメニューから”Update Your Kindle”を実行します。完了するとKindleのHOME画面が起動します。USBストレージのrootに”ENABLE_HACK_UPDATES”というファイルがあるはずです。このファイルの存在チェックにより適用するアップデータの提供元がAmazonなのかサードパーティなのかをコントロールします。存在する場合はハックを適用するようになります。解除する場合はこのファイルを削除してKindleを再起動します。またハックを適用したい場合は中身はブランクのこれと同じファイル名を用意して再起動するだけです。
参考までにyifanlu氏のkindle-JailBreak 0.3のハックを適用したところのシリアル接続で取得したログです。
#################################################
# N O T I C E * N O T I C E * N O T I C E #
#################################################
Rootfs is mounted read-only. Invoke mntroot rw to
switch back to a writable rootfs.
#################################################
[root@kindle root]#
[root@kindle root]#
[root@kindle root]# system: I start.sh:stop:signal=15,exitval=143:CVM stopped using SIGTERM
INIT: Switching to runlevel: 3
system: I K05framework:def:stopping booklet framework
com.lab126.powerd failed to access property state (0x3 lipcErrNoSuchSource)
system: I K06browserd:def:Stopping Browser Daemon
system: I K10cron:def:stopping crond
start-stop-daemon: lseek: Invalid argument
Stopping lipc-daemon: system: I K10tmd:def:Stopping Transfer Manager Daemon
system: I K15audio:def:stopping audio server
system: I K17ttsd:def:stopping TTS daemon
system: I K20volumd:def:stopping Volume daemon
system: I K25phd:def:Stopping Phone-Home Daemon
system: I K30cmd:def:stopping CMD daemon
system: I K30wifid:def:stopping wifid
Stopping Power Management Daemon: stopped /usr/bin/wpa_supplicant (pid 18951)
system: W wpa_supplicant:def:wpa supplicant stopped
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
..unloading all
system: I wifi:def:loadAR6000 finished, args=(unloadall)
system: I K76mcsd:def:stopping MCS server
Stopping Process Monitoring Daemon: system: I K85dbus:def:stopping system message bus
system: I mntroot:def:Making root filesystem read-only
system: I S50updater:def:updater started
system: I S50updater:def:Waiting for wand to shutdown
system: I S50updater:def:wand shutdown complete
system: I S50updater:def:read bundle line [/mnt/us/update_jailbreak_0.3_k3w_install.bin]
system: I S50updater:def:Applying update /mnt/us/update_jailbreak_0.3_k3w_install.bin
system: I S50updater:def:Size of update: 3751 bytes
system: I S50updater:def:Version before update: 031-S1-055870
system: I _otaupexec:def:processing update /mnt/us/update_jailbreak_0.3_k3w_install.bin
4+0 records in
4+0 records out
system: I _otaupexec:def:version is “FC02”
32+0 records in
32+0 records out
57+1 records in
57+1 records out
system: I _otaupexec:def:update image checksum OK
57+1 records in
57+1 records out
jailbreak.sig
payload.sig
loader.sig
update loader.sig .dat
update loader.sig .dat.sig
system: I mntroot:def:Making root filesystem writeable
ota_install: I def:update::backup Amazon keys, just in case
ota_install: I def:update::create jailbreak init script
ota_install: I def:update::copy the keys
ota_install: I def:update::start script
system: I jailbreak:def:update providers changed, switching keys
system: I mntroot:def:Making root filesystem writeable
ota_install: I def:update::done
system: I _otaupexec:def:update complete
system: I S50updater:def:OTA update successful for /mnt/us/update_jailbreak_0.3_k3w_install.bin
system: I S50updater:def:Version after update: 031-S1-055870
system: I S50updater:def:Deleting OTA bundle file “/mnt/us/update_jailbreak_0.3_k3w_install.bin”
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
Load Board Data from /opt/ar6k/target/AR6002/hw2.0/bin/lab126_15dBm_nodiv_WWR_CTL.bin
Updating MAC address
BMI Set App Start (address: 0x913950)
BMI Bit-Wise (OR) modify Register (address: 0x500410, orig:0x8, new: 0x9, mask:0x1)
BMI Write compressed Memory (address: 0x502070, filename: /opt/ar6k/target/AR6002/hw2.0/bin/athwlan.bin.z77)
BMI Write Memory (address: 0x52d6d0, filename: /opt/ar6k/target/AR6002/hw2.0/bin/data.patch.hw2_0.bin)
BMI Write Memory (address: 0x500418, value: 0x52d6d0)
BMI Done
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70cmd:def:starting CMD daemon
system: I S70wifid:def:starting wifid
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 92%
Wed Feb 23 08:57:44 2011 INFO:battery charge: 92%
Starting lipc-daemon: system: I S90tmd:def:Starting Transfer Manager Daemon
system: I S90cron:def:starting crond
system: I S94browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=7064150:boot time before framework starts, in milliseconds
start.sh: starting framework
system: I mntroot:def:Making root filesystem read-only
system: I S96boot_finished:def:Boot finished script received framework booted event
system: I S96boot_finished:fwboot:time=7104190:boot time after framework starts, in milliseconds
system: I loginfo:devhw:boardID=SP1B:Shasta PVT device – rev 1
system: I loginfo:devhwphy::USB PHY built by unknown
system: I loginfo:devsworig::Original System Software Version: 031-S1-055870
Sat Feb 5 19:07:33 PST 2011
system: I loginfo:devswota::OTA Kindle 3.1 (~~otaVersion~~)
com.lab126.wan failed to access property localTimeOffset (0x3 lipcErrNoSuchSource)
system: W loginfo:ltofailwandoff:cannot retrieve local time offset – wand not running
com.lab126.powerd failed to set value for property wakeUp (0x8 lipcErrNoSuchProperty)
system: I ckimage:def:skipping kernel check
system: I governor:def:switching to ondemand governor
system: I tinyrot:def::Rotating file /var/log/messages with max size 256
/usr/sbin/tinyrot : Signaling syslog
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 348kb
system: I tinyrot:def:Removing /var/local/log/messages_00000283_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 319kb
system: I tinyrot:def:Removing /var/local/log/messages_00000284_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 291kb
system: I tinyrot:def:Removing /var/local/log/messages_00000285_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 272kb
system: I tinyrot:def:Removing /var/local/log/messages_00000286_*.gz to save storage space
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 228kb
system: I start.sh:stop:signal=15,exitval=143:CVM stopped using SIGTERM
INIT: Switching to runlevel: 3
system: I K05framework:def:stopping booklet framework
com.lab126.powerd failed to access property state (0x3 lipcErrNoSuchSource)
system: I K06browserd:def:Stopping Browser Daemon
system: I browserd:def:Stopping Browser Daemon
Killed
system: I browserd:def:Starting Browser Daemon
system: I usbnetwork:def:usbnet is already stopped
system: I K10cron:def:stopping crond
start-stop-daemon: lseek: Invalid argument
Stopping lipc-daemon: system: I K10tmd:def:Stopping Transfer Manager Daemon
system: I K15audio:def:stopping audio server
system: I K17ttsd:def:stopping TTS daemon
system: I K20volumd:def:stopping Volume daemon
system: I K25phd:def:Stopping Phone-Home Daemon
system: I K30cmd:def:stopping CMD daemon
system: I K30wifid:def:stopping wifid
Stopping Power Management Daemon: stopped /usr/bin/wpa_supplicant (pid 12001)
system: W wpa_supplicant:def:wpa supplicant stopped
system: I wifi:def:WiFi Device mac =
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
..unloading all
system: I wifi:def:loadAR6000 finished, args=(unloadall)
system: I K76mcsd:def:stopping MCS server
Stopping Process Monitoring Daemon: system: I K85dbus:def:stopping system message bus
system: I mntroot:def:Making root filesystem read-only
system: I S50updater:def:updater started
system: I S50updater:def:Waiting for wand to shutdown
system: I S50updater:def:wand shutdown complete
system: I S50updater:def:read bundle line [/mnt/us/update_jailbreak_0.4_k3w_install.bin]
system: I S50updater:def:Applying update /mnt/us/update_jailbreak_0.4_k3w_install.bin
system: I S50updater:def:Size of update: 3660 bytes
system: I S50updater:def:Version before update: 031-S1-055870
system: I _otaupexec:def:processing update /mnt/us/update_jailbreak_0.4_k3w_install.bin
4+0 records in
4+0 records out
system: I _otaupexec:def:version is “FC02”
32+0 records in
32+0 records out
56+1 records in
56+1 records out
system: I _otaupexec:def:update image checksum OK
56+1 records in
56+1 records out
jailbreak.sig
payload.sig
loader.sig
update loader.sig .dat
update loader.sig .dat.sig
system: E _otaupexec:def:signature verification failed on “/tmp/.update-tmp.13468/update loader.sig .dat”
system: E _otaupexec:def:signature verification failed
system: E S50updater:def:OTA update failed (1)
system: I S50updater:def:Deleting OTA bundle file “/mnt/us/update_jailbreak_0.4_k3w_install.bin”
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac = 28:EF:01:44:C9:C4
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
Load Board Data from /opt/ar6k/target/AR6002/hw2.0/bin/lab126_15dBm_nodiv_WWR_CTL.bin
Updating MAC address
BMI Set App Start (address: 0x913950)
BMI Bit-Wise (OR) modify Register (address: 0x500410, orig:0x8, new: 0x9, mask:0x1)
BMI Write compressed Memory (address: 0x502070, filename: /opt/ar6k/target/AR6002/hw2.0/bin/athwlan.bin.z77)
BMI Write Memory (address: 0x52d6d0, filename: /opt/ar6k/target/AR6002/hw2.0/bin/data.patch.hw2_0.bin)
BMI Write Memory (address: 0x500418, value: 0x52d6d0)
BMI Done
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70wifid:def:starting wifid
system: I S70cmd:def:starting CMD daemon
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S82usbnet:def:usbnet is disabled
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 76%
Sun Mar 6 20:58:22 2011 INFO:battery charge: 76%
system: I S90cron:def:starting crond
Starting lipc-daemon: system: I S90tmd:def:Starting Transfer Manager Daemon
system: I browserd:def:Stopping Browser Daemon
Killed
system: I S94browserd:def:Starting Browser Daemon
system: I browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=7815080:boot time before framework starts, in milliseconds
start.sh: starting framework
system: I mntroot:def:Making root filesystem read-only
system: I S96boot_finished:def:Boot finished script received framework booted event
system: I S96boot_finished:fwboot:time=7852200:boot time after framework starts, in milliseconds
system: I loginfo:devhw:boardID=SP1B:Shasta PVT device – rev 1
system: I loginfo:devhwphy::USB PHY built by unknown
system: I loginfo:devsworig::Original System Software Version: 031-S1-055870
Sat Feb 5 19:07:33 PST 2011
system: I loginfo:devswota::OTA Kindle 3.1 (~~otaVersion~~)
com.lab126.wan failed to access property localTimeOffset (0x3 lipcErrNoSuchSource)
system: W loginfo:ltofailwandoff:cannot retrieve local time offset – wand not running
com.lab126.powerd failed to set value for property wakeUp (0x8 lipcErrNoSuchProperty)
system: I ckimage:def:skipping kernel check
system: I governor:def:switching to ondemand governor
system: I tinyrot:def::Rotating file /var/log/messages with max size 256
/usr/sbin/tinyrot : Signaling syslog
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 555kb
Custom Passwords
複数のパスワードを設定することが可能です。たとえば、特定アプリだけ違うパスワードを設定しておくことができます。やりすぎな気がしますが。。。まず、画面を開くと現在設定しているPassword（サンプルとして”1234″）とそのLockアプリが表示されますので、”Add New Passowrd”をタップして別のPassword（サンプル”7890″）を設定します。
No Enter Button
“Lock These Settings”がオンになっていると、設定.appからLockdown Proを選択するときにSafety Wordの入力が必要になります。その際に”No Enter Button”がオンになっているとSafety Wordの入力を終えた時点で自動的にEnterされたと見なされます。面倒ですがオフのままのほうが良いと思います。
アップデートの失敗
WIFI版専用アップデータをダウンロードし、Kindle3のUSBストレージにコピー。KindleからSettings>Update Your Kindleを実行します。今回のアップデートは2回に分けて適用されますが、”stage 1 of 2″で失敗してしまいました。レンガになることなく、3.0.3のままで通常起動はしますので、3.1にアップデートできない状態です。
アップデートで失敗する原因
通常のKindleとの相違点をひとつづつ取り除きながら、Update Your Kindleを繰り返します。まずDuokanを外しても症状は変わらず。次にusbnetworkハックをアンインストールしても同じく失敗しました。シリアル接続してアップデートのログをとっていましたので、確認したところ（最初からログで原因を分析すればよかったのですが面倒なので想像の範囲で原因を推測していました）どうやら適用したハックが原因ではなかったようです。
ログを見ると必ずつぎの部分で失敗し、その後、通常の3.0.3のブートが開始されています。
ota_install: I def:patch:patchinfo=”/opt/amazon/screen_saver/600×800/23_feedback_600.gif”:patching file
bspatch: /opt/amazon/screen_saver/600×800/23_feedback_600.gif: No such file or directory
ota_install: C def:patch:patchinfo=”/opt/amazon/screen_saver/600×800/23_feedback_600.gif”:patch failure
system: E otaup:def:image update failed
webupdate: I def:webupdate::attempting to remove update file : update-06-536720111-558700031.bin
webupdate: C def:webupdate::failed to apply update : update-06-536720111-558700031.bin
