Hey everybody! Recently I had the opportunity of poking around a friend’s Kindle Touch to see if I could disable the ads on the “Special Offers” version. And I’m glad to say it was a success, and it’s not that hard if you know your way around a Unix shell. EDIT: This no longer works for the newer Kindle Touch updates! Therefore, I am not allowing comments as I was being bombarded with the same question. First, copy your screensaver (in PNG format with a size of 600x800px) to your Kindle as “screensaver.png”. Now what we need to do is to jailbreak your KT. Yifan Lu was gracious enough to provide us with a jailbreak a couple of days ago. I won’t dive too far into it, but he provides a MP3 whose description in the metadata is a simple shell script. Yes, when the Kindle plays an MP3, it executes any shell script in the metadata. Not only does it execute the script, it does it at root. Huge security risk? Most likely.

  1. So to jailbreak, first visit Yifan’s KT jailbreak page and download the jailbreak AND the “Simple usbnet update”. Once you have both downloaded extract the “jailbreak.mp3” file from the jailbreak zip to your Kindle’s “music” folder via USB. Also extract the installer .bin file to the root folder of the Kindle and rename it “update.bin”.
  2. Disconnect your KT and then go to Menu->Experimental->MP3 Player and then hit the big “Press to Jailbreak!” button. You device will start the jailbreaking process.
  3. Once the jailbreaking process is done, go to Menu->Settings->Menu->Update Your Kindle. Your device will apply the homebrew update that will install SSH.
  4. The update also installed a package called “usbnet”. I was not sure how to use it, so I did not mention it in this post. If you know how to use it, let me know in the comments.
  5. Now you’ll want to find the IP address of your Kindle. I did this by looking at the DHCP client table in my router and matching the Kindle’s MAC address (found in Menu->Settings->Menu->Device Info) to its IP.
  6. Before we start the SSH server you will need to set a root password. This can be done by returning to the main menu, then tap on the search bar, type un password PASSWORD where PASSWORD is what you want your password to be. NOTE: Please make this a secure password. I know the Kindle runs everything as root through metadata, but it’s still a good idea to give it a secure password.
  7. Now we can start the SSH server. Hit the search bar again, but this time type un. The SSH server is now started and we can get to disabling those pesky ads.
  8. Open up your favorite SSH client and connect to your Kindle’s IP address with the username root and whatever password you set up before.
  9. Type mntroot rw so we can get some write access. Then type the following lines:
rm -f -R /mnt/us/system/.assets/*
chmod -W /mnt/us/system/assets/
mkdir /mnt/base-us/ad_backup
cp -f /usr/share/blanket/ad_screensaver/* /mnt/base-us/backup/
rm -f /usr/share/blanket/ad_screensaver/screen*.png
cp -f /mnt/base-us/screensaver.png /usr/share/blanket/ad_screensaver/screensaver-unregistered.png
cp -f /mnt/base-us/screensaver.png /usr/share/blanket/ad_screensaver/screensvr.png
rm -f /usr/share/blanket/ad_screensaver/banner*.gif

And that’s it! Your ad-supported Kindle is now free of corporate interference! Now go and support Amazon a little for making such an awesome device by buying some books. No, but really, this is purely for demonstration of how Amazon failed to prevent something so simple.

EDIT 12/21/2011 So I fixed the MP3 installer. Well, I completely rewrote it. It turns out that I was really being an idiot and packaged it up completely wrong, for which I apologize. Here is a link to the new version, which also has a built-in uninstaller. Also, this time to replace the screensaver, you only have to drop in one file (I dropped in a sample for you to use). If you have problems, hit me up in the comments.