Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
How to Unbrick a Kindle Paperwhite

How to unbrick an Amazon Kindle Paperwhite™

This guide instructs you in how to unbrick an Amazon Kindle Paperwhite. The consequences of following it are your own responsibility. This method (opening the Kindle and using the serial interface) should be a last resort and should only be considered if other methods fail

The Guide

  1. Pry open Kindle using a prying tool
  2. Unscrew the screen and remove it from the base. Note that there's a screw hidden under the adhesive at the top in the middle
  3. Solder tin wire to serial ports on the bottom
  4. Attach tin wire to USB TTY device (order is ground, RX, TX, from the kindle's perspective, where GND is the smallest pad) and plug USB TTY device into your computer
  5. Open Putty on your computer in serial mode, with the serial port specified as your USB device and baud configured to 115200
  6. Reboot kindle
  7. When the kindle is booting, there exists a brief window where sending data to it over the serial line will cause it to enter it's bootloader. To achieved this I repeatedly pressed enter on my computer's keyboard as my kindle started booting
  8. Now that we're in the bootloader, run 'bist fastboot' to put your Kindle into fastboot mode
  9. On a Mac, build -- if you get this building on anything else, please send me a pull request :)
  10. Download Paperwhite images from
    gunzip pw_5.2.0-*.img.gz
  1. Modify the pw_5.2.0-mmcblk0p2.img on something which can mount ext3 using the guide below
  2. In bist, run 'fastboot' (if it isn't running already)
  3. Make sure Kindle Paperwhite is plugged in to your Mac by USB as well
  4. On your Mac, run ./fastboot (Be careful not to run fastboot, as that may use an installed Android fastboot binary). This will list the paritions on your Kindle Paperwhite
  5. We want to overwrite diags_kernel, main_kernel, system and diags
  6. We now want to run
    ./fastboot flash system pw_5.2.0-mmcblk0p1.img
    ./fastboot flash kernel pw_5.2.0-main_kernel.img
    ./fastboot flash diags pw_5.2.0-mmcblk0p2.img

to flash all of our images to the Kindle Paperwhite EXCEPT for the main system image

  1. Run the following to reboot your Kindle and get into Diags mode
    ./fastboot setvar bootmode diags
    ./fastboot reboot
  1. Once your kindle's booted to diags mode, start USB mode

  2. Rename pw_5.2.0-mmcblk0p1.img to mmcblk0p1.img and copy it to your kindle

  3. Safely unmount your kindle

  4. Reboot your kindle into diagnostics mode again from the "Exit, Reboot or Disable Diags" menu

  5. If you're watching your Kindle's serial output as it boots, you should see something like

    /dev/loop/0: 84 files, 44940/174079 clusters
    info filesystems:installdata:KINDLEFIX looking for /mnt/us/mmcblk0p1.img ...:
    info filesystems:installdata:KINDLEFIX found mmcblk0p1.img, trying to install:I
  1. This indicates that it's flashing the system partition. It will take a while, during which the Kindle will only show the Amazon Kindle screen

  2. Once diags mode has booted, open "Exit, Reboot or Disable Diags", hit disable diagnostics, then hit continue. This will reboot your kindle.

  3. Hooray! Your kindle is now unbricked.

  4. Optionally delete the mmcblk0p1.img on your Kindle over USB. If you leave it there, every time the diags tool is run, it'll flash it to the system partition.

How to modify pw_5.2.0-mmcblk0p2 to automatically dd pw_5.2.0-mmcblk0p1 to the system partition

Unfortunately pw_5.2.0-mmcblk0p1 is too big for fastboot (or, fastboot doesn't like it for some reason). This causes us a little bit of grief because we need to use some other means to get it onto our kindle

We'd usually use the 'dd' tool on the kindle over ssh to copy this file to its respective partition; however, Amazon has removed the diagnostic partition's ssh application, so we can't use that to copy the file to the kindle and dd it.

Instead, we'll just mangle the diagnostic image to 'dd' the file after it's done initializing filesystems.

To do this,

  1. Back up then mount the diagnostic image to some directory
    cp pw_5.2.0-mmcblk0p2.img pw_5.2.0-mmcblk0p2.img.bak
    mkdir mmcblk0p2
    root@debian:~# mount -t ext3 pw_5.2.0-mmcblk0p2.img mmcblk0p2/
  1. Open its /etc/upstart/diags file (the diagnostics boot script)
    vim mmcblk0p2/etc/upstart/diags
  1. At the end of init_filesystems function, before the "#end script" comment, add
    f_log I filesystems installdata "KINDLEFIX looking for /mnt/us/mmcblk0p1.img ..."
    if [ -e /mnt/us/mmcblk0p1.img ] ; then
      f_log I filesystems installdata "KINDLEFIX found mmcblk0p1.img, trying to install" I
      dd if=/mnt/us/mmcblk0p1.img of=/dev/mmcblk0p1 bs=4K
      f_log I filesystems installdata "KINDLEFIX Install successful" I
  1. Unmount mmcblk0p2
    umount mmcblk0p2/
  1. Now when we flash pw_5.2.0-mmcblk0p2.img, it'll automatically check the userstore directory for a file named 'mmcblk0p1.img' and flash it to the system partition


If you find this useful or find an error, feel welcome to leave a comment below or email - thanks!

Copy link

SoonerLater commented Aug 8, 2017


Ah, so one must be able to reboot the device in order to follow this method correct? Unfortunately I cannot even do that.

If you have the case open, you remove a battery lead, then reconnect the lead. That will make it reboot (or try to).

Copy link

vinixwu commented Oct 16, 2017


If you have the case open, you remove a battery lead, then reconnect the lead. That will make it reboot (or try to).

I tried that on my totally bricked kpw2, nothing is displayed on Putty when I reconnected the battery.

Copy link

SoonerLater commented Jan 8, 2018

I kinda forgot to follow up. As it turned out (for me, anyway), all I had to do was pull the battery to get it to reboot. Whatever it was stuck on before (an update, I believe) got unstuck when I powered it backup.

(1) remove bezel (only glued-on) using an exacto razor and plastic pry tools

(2) remove eleven screws holding the frame to the back. Note: one is hidden by adhesive at top center.

(3) Flip over the frame and remote the three screws holding the battery.

Since I didn't have to solder wires to the serial ports or attach a USB TTY device ( ( I didn't buy one or attempt to use one. However, for the benefit of anyone still reading... here is where the wires were supposed to be attached and what they are:

EDITED: 2017-01-08 1613 UTC to link to corrected photo (original was mis-labeled).

Copy link

sropelato commented May 7, 2018

Thanks a lot for the great tutorial! We couldn't get the Fastboot-Kindle to run on macOS High Sierra and, as a workaround, switched to an older MacBook with OS X El Capitan. The issue with the missing device_info.xml file could be resolved by opening the 'device setting' menu in the diags tool and selecting something like 'read from device_info.xml'. This generated the missing file and the we were able to successfully switch off the diagnostics mode.

Copy link

guenter1952 commented Jul 17, 2018

just my one cent: My device, DP75SDI 7. Gen., has on top a 3G-antenna and there is no screw in the middle.

Copy link

pedroferreiramamede commented Jul 26, 2018

Hi, can I do this in a Paperwhite 1? The imgs are the same?

Copy link

lucianor1979 commented Dec 12, 2018

Hello everybody! i don´t have Mac so i need to follow this tutorial on windows or linux. does anyone can help me?

Copy link

ramast commented Dec 18, 2018

For linux, you can download the mentioned library

And run "make linux".
You will see few warnings but if all went well you should have a "fastboot" file ready for you to use

Copy link

ramast commented Dec 18, 2018

Also once you are in USB mode you could try copying amazon's official update bin files to your device (main directory) and reboot
Kindle should detect the file and perform an automatic update.

Copy link

ramast commented Jan 31, 2019

I've made an update to the the file that cover compiling fastboot on linux as well as offering an alternative method for unbricking (booting into usb mode and placing amazon's offical update file)
I am however unable to perform pull request. This is my version, please feel free to copy it over if u like

Copy link

guillo78 commented Apr 2, 2019

Hi! Does it work in Kindle 7th generation model number WP63GW? Thanks!

Copy link

vivekprm commented Apr 16, 2019

Thanks for the steps. My kindle is broken stuck on start screen. Tried to reset but nothing worked. Contacted customer care but didn't get much help.

So decided to follow this tutorial. How did you soldier the pins to kindle? Connection points on kindle are so small that it's difficult to soldier it cleanly.. Can you make a video of it or any suggestion?

Copy link

szeder commented Apr 18, 2019

Does anyone happen to have an alternate link to the Paperwhite images? That site seems to be down or the domain expired, or something like that...

Copy link

znedw commented May 8, 2019

+1 for a mirror for these links if anyone has the files laying around, please :)

Copy link

ritiek commented Jun 8, 2019

Are the image files common for all Kindle Paperwhites - PW1, PW2, PW3 (and PW4)?

Copy link

vicyus commented Jul 1, 2019

me agradaría muchísimo crear colecciones en mi kindle paperwhite sin registrarlo en amazon si alguien pudiera explicarme

Copy link

Charlyo commented Oct 18, 2019

Are there any other traces of the serial port inside the kindle?? I did manage to brake them both... 🤦‍♂️

Copy link

MrSlimbrowser commented Apr 20, 2020

Big thanks over here aswell! I used the method ramast suggested since the other 4 files are offline and it was unclear if those files are the same for all kindle models. Booting into diags mode and using the official update file seemed safe and worked perfectly.
Same little advice over here: Using a virtual machine in vmware didn't work for me, the kindle kept leaving fastboot mode as soon as I plugged in the usb. Debian 10 on my laptop worked right away

Copy link

legn commented May 12, 2020


Any Idea about whats happening here

Just reboot: 0

DIAGS rebooting system due to diagnostic exit...

The system is going down NOW![ 118.082501] unregistered gadget driver 'g_file_s storage'

Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
[ 120.094495] imx2-wdt imx2-wdt.0: Device shutdown: Expect reboot!
[ 120.100553] Restarting system.

U-Boot 2009.08-lab126 (Sep 04 2013 - 15:37:40)

CPU: Freescale i.MX6 family TO0.0 at 996 MHz
Temperature: 39 C, calibration data 0x5664e65f
mx6sl pll1: 996MHz
mx6sl pll2: 528MHz
mx6sl pll3: 480MHz
mx6sl pll8: 50MHz
ipg clock : 66000000Hz
ipg per clock : 66000000Hz
uart clock : 80000000Hz
cspi clock : 60000000Hz
ahb clock : 132000000Hz
axi clock : 198000000Hz
emi_slow clock: 22000000Hz
ddr clock : 396000000Hz
usdhc1 clock : 198000000Hz
usdhc2 clock : 198000000Hz
usdhc3 clock : 198000000Hz
usdhc4 clock : 198000000Hz
Board: Pinot WFO
Boot Reason: [ POR ]
Boot Device: NAND
Board Id: 02722011336703U9
S/N: B05A22033372036A
I2C: ready
DRAM: 256 MB
Using default environment

In: serial
Out: serial
Err: serial
Quick Memory Test 0x80000000, 0xfff0000
POST done in 59 ms
Battery voltage: 3980 mV

Hit any key to stop autoboot: 0

Booting kernel from Legacy Image at 80800000 ...

Image Name: Linux-3.0.35-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2420480 Bytes = 2.3 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK

Starting kernel ...

[ 0.094233]
[ 0.254688] LPDDR2 MfgId: 0x1 [Samsung]
3.0.35-lab126 #1 Wed Sep 4 16:00:40 PDT 2013 armv7l
Press [ENTER] for recovery menu... 0 //dev/mmcblk0p4:
CHS=4/16/102976 size=3374317568 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 16 16 6590448
CHS: 0/1/1 -
Partition p2:
Partition p3:
Partition p4:
IP-Config: no devices to configure
kinit: Mounted root (ext3 filesystem) readonly.
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
info system:emiting_event:mounted_proc:
info system:emiting_event:mounted_sys:
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
info firsttime:mount_rw:time=5720:Mounting root RW for first boot
info firsttime:mount_ro:time=6330:Mounting root RO
info system:emiting_event:mounted_dev:
info system:emiting_event:mounted_tmpfs:
modprobe: FATAL: Could not load /lib/modules/3.0.35-lab126/modules.dep: No such file or directory

init.exe: system pre-start process (628) terminated with status 1
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!! !
crit hardware:bad_id:id=02722011336703U9:bad board ID, defaulting to yoshi !!!!!

Copy link

skrobul commented Aug 29, 2020

So, the domain is dead and there are no images available anymore. But... I was able to recover using official firmware images and booting into diags mode.

It took me a bit to understand what the recovery process is based on the steps above but once I understood it, I was able to make it work for me. Basically, it was:

  1. Figure out how to boot device into "diags" mode
  2. While booted in diags mode, selected "Erase MMC", followed by "Recreate partitions" and bunch of reboots in between.
  3. Once the partitions is recreated, used "Export FAT" option in the recovery menu to connect my PW2 to computed with USB cable and transfer the update_XXXX.bin to that partition (save file as update.bin). Please note that Load MMC through USB did not work correctly.
  4. When the firmware is on FAT partition, then you can boot into diags recovery menu again and select U. If the partition table is correct, then it will start flashing (takes few minutes but there are nice progress bars).

In my case, at some point the update did not proceed and I've noticed that it was complaining that mmcblk0p1 did not have a journal. I've used Load MMC through USB menu, connected kindle to my computer and noticed that indeed first partition was formatted as ext2 rather than ext3 with journal. So I fixed it with simple tune2fs -j /dev/sda1 and repeated the Update step and it worked this time.

Also, in case you need the missing images from, I have found some of them on chinese website -
Not sure which versions they are, but the diags worked on PW2.

  • diags_kernel - flashed as diags_kernel
  • kernel - flashed as kernel
  • mmcblk0p2.img - flashed as diags

I didn't touch boot0.img and boot1.img - not sure what they are for, probably bootloader.

Copy link

ritrelo commented Jan 28, 2021

No one got working links to the diag kernel ? I think i screwed my PW diags partition

Copy link

skrobul commented Jan 28, 2021

@ritrelo see my comment above, the 2nd link seems to have the kernel

Copy link

ritrelo commented Jan 28, 2021

@skrobul Thanks for the quick reply. I thought those were for PW2 im looking for PW1. you think they would work? I thought PW1 was closer to K5 than to PW2. Im afraid of following your steps because I think I screwed up my diags partition and im afraid of "Erase MMC" but I might give it a shot

Copy link

skrobul commented Jan 28, 2021

@ritrelo to be honest, I don't know and I don't have the device to check anymore, but here are some ideas:

  • is it possible to dump existing kernel partition so you could restore it if needed?
  • lists a couple of URLs. the Mediafire links still work. They are simply listed as Paperwhite without model specification.

Copy link

FranciscoDaunas commented Mar 19, 2021

Hi, I just got two pw2 where the previous owner though it would be great idea to try de command erase. I’m trying to fix them I’m at the point where I have compiled the tool both in mac and linux(raspbian) and I got the images. I can get the kindle to fastboot and says:
Usb speed: High
Connected to host
Battery voltage .....( keep printing the battery voltage)

I assume that this means it is waiting to get a handshake from the ./fastboot called from the computer. However, when ever y call ./fastboot flash diag , I get In both linux and mac

I have the usb connected and serial connected on the same device. I have tried using the options for -i vendor id and -s serial but non seems to work. The vendor id just sits in and -s said invalid. I’m connecting through a FTDI232 board, so seria to USB. If anyone could help me I would appreciate it a lot

Copy link

reza12345678901 commented May 26, 2021

I have kindle oasis 3. My device is stuck on tree screen display. I did 40 sec pressing the power button but nothing happened. Please help.

Copy link

mpcabete commented Sep 10, 2021

hey, I am trying to debrick my kindle, I just flashed it with the images provided in the tutorial description, enabled diagnostic mode with "./fastboot setvar bootmode diags" and rebooted it. when it reboots it doesn't enter diagnostic mode tho, in the serial port debug it shows the following errors:
[ 1.706780] mxc_dvfs_core_probe
[ 1.714340] DVFS driver module loaded
[ 1.737446] regulator_init_complete: max77696_ldo10: incomplete constraints, leaving on
[ 1.752691] regulator_init_complete: max77696_ldo7: incomplete constraints, leaving on
[ 1.770048] regulator_init_complete: max77696_ldo6: incomplete constraints, leaving on
[ 1.785257] regulator_init_complete: max77696_buck6: incomplete constraints, leaving on
[ 1.793485] regulator_init_complete: max77696_buck5: incomplete constraints, leaving on
[ 1.802204] regulator_init_complete: max77696_buck2dvs: incomplete constraints, leaving on
[ 1.810556] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 1.819790] regulator_init_complete: max77696_buck1dvs: incomplete constraints, leaving on
[ 1.838984] mmc0: unrecognised EXT_CSD revision 7
[ 1.843696] mmc0: error -22 whilst initialising MMC card
[ 1.851483] max77696-rtc max77696-rtc.0: setting system clock to 2021-09-10 18:31:36 UTC (1631298696)
[ 1.883644] KERNEL: I pmic:charger chgina::charger connected
[ 1.930832] MAX77696 Main Charger Driver 1.0.0 Installed
[ 1.969526] MAX77696 Energy Harvester Driver 1.0.0 Installed
[ 1.987266] Freeing init memory: 1036K
3.0.35-lab126 #1 Tue Sep 3 03:12:16 PDT 2013 armv7l
[ 2.067505] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.096435] mmc0: unrecognised EXT_CSD revision 7
[ 2.101166] mmc0: error -22 whilst initialising MMC card
[ 2.298024] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.334487] mmc0: unrecognised EXT_CSD revision 7
[ 2.339236] mmc0: error -22 whilst initialising MMC card
[ 2.416651] add wake up source irq 104
[ 2.569644] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.628923] mmc0: unrecognised EXT_CSD revision 7
[ 2.633651] mmc0: error -22 whilst initialising MMC card
[ 3.546991] KERNEL: I pmic:fg battery id check::wario_battery_valid=1


It is a generation 6 kindle paperwhite.
Can someone help me?

Copy link

netcom27 commented Nov 7, 2022

Hello! Could you please explain to a laic what step 8 actually is? I have a general IT knowledge, let's say average+, but the only coding I did what HTML in Junior High so bear with me. I have PuTTy, what do i need to do now? Download all the codes from this repository, paste them in the notebook and rename the file to the listed names and put them in the same folder as PuTTy is?

On a Mac build... -> what does it literary mean. I paste the code from fastboot.c to a notebook and save it as "fastboot.c" file that i put in my PuTTy folder so it can be loaded while I type "./fastboot".

Copy link

MrSlimbrowser commented Nov 7, 2022

Fastboot.c is a source code file. To build means to compile these source code files into an executable program.
I don't have a mac but you likely have to download the whole repository (and extract it if zipped), open a terminal, change to that folder (probably with "cd /path" command) and then run "make". It should output a whole lot of stuff which hopefully does not contain an error message and then an executable "fastboot" should show up somewhere (either in the same folder or a bin or output subfolder) that you then can use.
Hope this is somewhat helpful 😅

Copy link

netcom27 commented Nov 7, 2022

Fastboot.c is a source code file. To build means to compile these source code files into an executable program. I don't have a mac but you likely have to download the whole repository (and extract it if zipped), open a terminal, change to that folder (probably with "cd /path" command) and then run "make". It should output a whole lot of stuff which hopefully does not contain an error message and then an executable "fastboot" should show up somewhere (either in the same folder or a bin or output subfolder) that you then can use. Hope this is somewhat helpful 😅

Thank you sir! I have both Mac and Windows (no linux unfortunately) but the guide seems to be more Mac-focused so I'll try that. Thank you very much :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment