Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save ramast/58633c352ad78e240c2ecc96965d48ed to your computer and use it in GitHub Desktop.
Save ramast/58633c352ad78e240c2ecc96965d48ed to your computer and use it in GitHub Desktop.
How to Unbrick a Kindle Paperwhite

How to unbrick an Amazon Kindle Paperwhite™

This guide instructs you in how to unbrick an Amazon Kindle Paperwhite. The consequences of following it are your own responsibility. This method (opening the Kindle and using the serial interface) should be a last resort and should only be considered if other methods fail

The Guide

  1. Pry open Kindle using a prying tool

  2. Unscrew the screen and remove it from the base. Note that there's a screw hidden under the adhesive at the top in the middle

  3. Solder tin wire to serial ports on the bottom

  4. Attach tin wire to USB TTY device (order is ground, RX, TX, from the kindle's perspective, where GND is the smallest pad) and plug USB TTY device into your computer

  5. Open Putty on your computer in serial mode, with the serial port specified as your USB device and baud configured to 115200

  6. Reboot kindle

  7. When the kindle is booting, there exists a brief window where sending data to it over the serial line will cause it to enter it's bootloader. To achieved this I repeatedly pressed enter on my computer's keyboard as my kindle started booting

  8. Now that we're in the bootloader, run 'bist fastboot' to put your Kindle into fastboot mode

  9. On a Mac, build (On Linux, you can compile by running make linux) -- if you get this building on anything else, please send me a pull request :)

  10. In bist, run 'fastboot' (if it isn't running already)

  11. Make sure Kindle Paperwhite is plugged in to your Mac/Linux by USB as well

  12. On your Mac, run ./fastboot (Be careful not to run fastboot, as that may use an installed Android fastboot binary). This will list the paritions on your Kindle Paperwhite

  13. From this point you have two choices, either install amazon's offical paperwhite system update (method described below) or continue these steps.

  14. We want to overwrite diags_kernel, main_kernel, system and diags

  15. We now want to run

    ./fastboot flash system pw_5.2.0-mmcblk0p1.img
    ./fastboot flash kernel pw_5.2.0-main_kernel.img
    ./fastboot flash diags pw_5.2.0-mmcblk0p2.img

to flash all of our images to the Kindle Paperwhite EXCEPT for the main system image

  1. Run the following to reboot your Kindle and get into Diags mode
    ./fastboot setvar bootmode diags
    ./fastboot reboot
  1. Once your kindle's booted to diags mode, start USB mode

  2. Rename pw_5.2.0-mmcblk0p1.img to mmcblk0p1.img and copy it to your kindle

  3. Safely unmount your kindle

  4. Reboot your kindle into diagnostics mode again from the "Exit, Reboot or Disable Diags" menu

  5. If you're watching your Kindle's serial output as it boots, you should see something like

    /dev/loop/0: 84 files, 44940/174079 clusters
    info filesystems:installdata:KINDLEFIX looking for /mnt/us/mmcblk0p1.img ...:
    info filesystems:installdata:KINDLEFIX found mmcblk0p1.img, trying to install:I
  1. This indicates that it's flashing the system partition. It will take a while, during which the Kindle will only show the Amazon Kindle screen

  2. Once diags mode has booted, open "Exit, Reboot or Disable Diags", hit disable diagnostics, then hit continue. This will reboot your kindle.

  3. Hooray! Your kindle is now unbricked.

  4. Optionally delete the mmcblk0p1.img on your Kindle over USB. If you leave it there, every time the diags tool is run, it'll flash it to the system partition.

How to modify pw_5.2.0-mmcblk0p2 to automatically dd pw_5.2.0-mmcblk0p1 to the system partition

Unfortunately pw_5.2.0-mmcblk0p1 is too big for fastboot (or, fastboot doesn't like it for some reason). This causes us a little bit of grief because we need to use some other means to get it onto our kindle

We'd usually use the 'dd' tool on the kindle over ssh to copy this file to its respective partition; however, Amazon has removed the diagnostic partition's ssh application, so we can't use that to copy the file to the kindle and dd it.

Instead, we'll just mangle the diagnostic image to 'dd' the file after it's done initializing filesystems.

To do this,

  1. Back up then mount the diagnostic image to some directory
    cp pw_5.2.0-mmcblk0p2.img pw_5.2.0-mmcblk0p2.img.bak
    mkdir mmcblk0p2
    root@debian:~# mount -t ext3 pw_5.2.0-mmcblk0p2.img mmcblk0p2/
  1. Open its /etc/upstart/diags file (the diagnostics boot script)
    vim mmcblk0p2/etc/upstart/diags
  1. At the end of init_filesystems function, before the "#end script" comment, add
    f_log I filesystems installdata "KINDLEFIX looking for /mnt/us/mmcblk0p1.img ..."
    if [ -e /mnt/us/mmcblk0p1.img ] ; then
      f_log I filesystems installdata "KINDLEFIX found mmcblk0p1.img, trying to install" I
      dd if=/mnt/us/mmcblk0p1.img of=/dev/mmcblk0p1 bs=4K
      f_log I filesystems installdata "KINDLEFIX Install successful" I
  1. Unmount mmcblk0p2
    umount mmcblk0p2/
  1. Now when we flash pw_5.2.0-mmcblk0p2.img, it'll automatically check the userstore directory for a file named 'mmcblk0p1.img' and flash it to the system partition

Alternative method using amazon update file

  1. Download latest version of your amazon paperwhite's update file

  2. Run the following to reboot your Kindle and get into Diags mode

    ./fastboot setvar bootmode diags
    ./fastboot reboot
  1. Once your kindle's booted to diags mode, start USB mode and mount your kindle
  2. Copy the update file to your kindle and call it update.bin
  3. Safely unmount your kindle
  4. Reboot your kindle into diagnostics mode again, you should see the system installing your update file
  5. When it finish, go to "Exit, Reboot or Disable Diags" menu and hit disable diagnostics, then hit continue. This will reboot your kindle.
  6. Hooray! Your kindle is now unbricked.


If you find this useful or find an error, feel welcome to leave a comment below or email - thanks!

Copy link

todos esses processos são possíveis a partir de um Mint 19 de um usuário iniciante?

Copy link

MrSlimbrowser commented Apr 20, 2020

Awesome! Had the opportunity to unbrick a kindle paperwhite 6th gen using the alternative method and amazons update file, it works perfectly fine again. Thanks a lot :)
Edit: By the way.. don't waste time using a a virtual machine.. using vmware and ubuntu the fastboot part didn't work for some reason, the kindle just leaves fastboot mode right after plugging in the usb. Using debian 10 on my laptop it worked immediately

Copy link

ramast commented Apr 21, 2020

You're welcome .Glad you found it useful.

Edit: Shout out to original author @TobiasWooldridge
This is all based on his work.

Copy link

@MrSlimbrowser, @ramsat, and @TobiasWooldridge
Which kind of TTL cable should be used. I bought the CP2104 TTL/UART USB. But the wiring is not clear for connecting it to the computer. PIN 5 is for (V IN) on the CP2104. What is it being connected to after soldering wire to it. Where did the potentiometer go after adjustment?
Thanks in advance.

Copy link

ramast commented Aug 31, 2020

I am guessing you are referring to this guide ?

I've used a normal 5V TTL adaptor and used TTL logic level converter like that one to convert between 5 and 1.6V

Copy link

Is there a way to do this without the cable? When I plug my kindle into my laptop, it recognizes a device being connected. What about linux unbrick tools? I have linux installed. Should I try that first?

Copy link

ramast commented Dec 28, 2020

If you are able to access your device's storage then you didn't brick it I think.
Did you try hard reboot (press power button for 10 seconds) ?

Copy link

hey, I am trying to debrick my kindle, I just flashed it with the images provided in the tutorial description, enabled diagnostic mode with "./fastboot setvar bootmode diags" and rebooted it. when it reboots it doesn't enter diagnostic mode tho, in the serial port debug it shows the following errors:
[ 1.706780] mxc_dvfs_core_probe
[ 1.714340] DVFS driver module loaded
[ 1.737446] regulator_init_complete: max77696_ldo10: incomplete constraints, leaving on
[ 1.752691] regulator_init_complete: max77696_ldo7: incomplete constraints, leaving on
[ 1.770048] regulator_init_complete: max77696_ldo6: incomplete constraints, leaving on
[ 1.785257] regulator_init_complete: max77696_buck6: incomplete constraints, leaving on
[ 1.793485] regulator_init_complete: max77696_buck5: incomplete constraints, leaving on
[ 1.802204] regulator_init_complete: max77696_buck2dvs: incomplete constraints, leaving on
[ 1.810556] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 1.819790] regulator_init_complete: max77696_buck1dvs: incomplete constraints, leaving on
[ 1.838984] mmc0: unrecognised EXT_CSD revision 7
[ 1.843696] mmc0: error -22 whilst initialising MMC card
[ 1.851483] max77696-rtc max77696-rtc.0: setting system clock to 2021-09-10 18:31:36 UTC (1631298696)
[ 1.883644] KERNEL: I pmic:charger chgina::charger connected
[ 1.930832] MAX77696 Main Charger Driver 1.0.0 Installed
[ 1.969526] MAX77696 Energy Harvester Driver 1.0.0 Installed
[ 1.987266] Freeing init memory: 1036K
3.0.35-lab126 #1 Tue Sep 3 03:12:16 PDT 2013 armv7l
[ 2.067505] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.096435] mmc0: unrecognised EXT_CSD revision 7
[ 2.101166] mmc0: error -22 whilst initialising MMC card
[ 2.298024] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.334487] mmc0: unrecognised EXT_CSD revision 7
[ 2.339236] mmc0: error -22 whilst initialising MMC card
[ 2.416651] add wake up source irq 104
[ 2.569644] emmc: I def:mmcpartinfo:vendor=toshiba, host=mmc0:
[ 2.628923] mmc0: unrecognised EXT_CSD revision 7
[ 2.633651] mmc0: error -22 whilst initialising MMC card
[ 3.546991] KERNEL: I pmic:fg battery id check::wario_battery_valid=1


It is a generation 6 kindle paperwhite.
Can someone help me?

Copy link

I have "Kindle Paperwhite (11th Generation) - 2021 release" and it is in permanent boot loop. Amazon, to their credit ,refunded it so another could be purchased. Now I'm left with this bricked one. Hate to just leave it for parts, and would prefer to try to unbrick it. I have experience with a serial TTL cable flashing BIOS chips on other devices and although mine is only for 5v and 3.3v, it looks like one that supports 1.8v can be had for $9, assuming CH340C chip is ok.

I have this one.

Looks like this one should work. Agree?

My other (main) hurdle is in finding the RX, TX and GND points on the board. The back came off easily, but I see no obvious connection points, nor can I find a guide documenting them for the latest PW. Do you know if those points are present, and if so, which they are?

I've attached a picture of what I see (I've not flipped it to see, what is between board and screen). The pads to the left are large enough to solder too, but nothing that looks like the pictures I've seen in guides.

Behind Back:

Left of USB-C port:

Upper Right:

Copy link

@MarkMorrow I also have one that's stuck in a bootloop. Were you able to figure anything out?

Copy link

mnaeem600 commented May 20, 2022 via email

Copy link

For an 11th generation (2021 edition)? Have any documentation?

Copy link

MarkMorrow commented May 21, 2022

@MarkMorrow I also have one that's stuck in a bootloop. Were you able to figure anything out?

I was not. from what I've been able to gathered there are no pads for a serial (TTL) connection on the 11th gen (2021) PW5. That is the board I'd provided pictures of. Good info on
Not sure which thread there I was reading, but there was hope that by later in 2022 there will be a way to flash, though perhaps not via a serial adapter.

Copy link

netcom27 commented Nov 7, 2022

Hello! Could you please explain to a laic what step 8 actually is? I have a general IT knowledge, let's say average+, but the only coding I did what HTML in Junior High so bear with me. I have PuTTy, what do i need to do now? Download all the codes from this repository, paste them in the notebook and rename the file to the listed names and put them in the same folder as PuTTy is?

On a Mac build... -> what does it literary mean. I paste the code from fastboot.c to a notebook and save it as "fastboot.c" file that i put in my PuTTy folder so it can be loaded while I type "./fastboot".

Copy link

Asdikaa commented Mar 11, 2024

Hi! Does anyone have the image files for the pw 1?

Copy link

stx3plus1 commented Mar 26, 2024

any idea on why this version of fastboot gets an implicit function error? im not really the c person...
edit: just declare a function before main lol, it isnt even compatible with macos since apple did an apple and broke this version of fastboot, might try fix it

Copy link

anyone know what to do i get this error
U-Boot 2014.04 (Aug 19 2020 - 22:59:03)

CPU: Freescale i.MX6SL rev1.3 at 792 MHz
CPU: Temperature 40 C, calibration data: 0x5a95255f
Reset cause: POR
FRED::: EXTCSD177=0, 179=48FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2
Board: Heisenberg
Board Id: P0011807723701B2
S/N: *******************
I2C: ready
DRAM: MR5=0x1,MR6=0x4 512 MiB
WARNING: Caches not enabled

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment