PW2 / 5.12.2.2: jb.sh v1.3.7 writes JAILBROKEN marker but KPM and sh_integration are not functional

[Silviajunliu]

PW2 / 5.12.2.2: jb.sh v1.3.7 writes JAILBROKEN marker but KPM and sh_integration are not functional

Summary

On a Kindle Paperwhite 6th Generation / PW2-class device running firmware 5.12.2.2 (3791510038), WinterBreak2 successfully triggers jb.sh v1.3.7 and writes the JAILBROKEN document, but the post-jailbreak environment does not appear to work:

• ;kpm return·s no results
• ;log mrpi returns no results
• a test .sh placed in /documents does not appear as a runnable library item and does not execute
• USB-visible storage only shows documents/JAILBROKEN.txt and libkh/bin/fbink; no visible KPM/MRPI/MKK markers

The device still boots normally and is currently kept in Airplane Mode. I have stopped rerunning WinterBreak2/Hotfix to avoid repeated writes.

Device / host

• Device: Kindle Paperwhite 6th Generation / PW2-class device
• Firmware: 5.12.2.2 (3791510038)
• Host: macOS 26.5.2 (25F84)
• Connection mode: USB mass storage mounted at /Volumes/Kindle
• Battery during attempts: 100%
• Airplane Mode: enabled except when triggering browser-based jailbreak

Files / versions used

WinterBreak2

• Release used: WinterBreak2 v1.1.0
• Downloaded archive: wb2.zip
• Local SHA-256 recorded for downloaded zip: 9e85970902a1f2af6b4c3243755d80595dd36404b85083f8be8c65a69d04cfdf
• Zip contents observed: winterbreak2/dialoger.html
• Local SHA-256 recorded for dialoger.html: 9d42a3c880bc6e6a7013a2f59e2d5e8525b369880384384d1c3d856fe7a6bbd5

jb.sh

The old PW2 browser could not reliably use HTTPS for https://kindlemodding.org/jb.sh, so I switched the WinterBreak2 payload to use a local HTTP server from the Mac.

• Downloaded jb.sh from https://kindlemodding.org/jb.sh on the Mac
• Local SHA-256 recorded: 65a63528fbe9515950cc3aa0d931749548680f37898a3819a4ebc0a740588942
• The Kindle requested the file from the local server successfully (GET /jb.sh ... 200)
• dialoger.html was changed to run:

curl -L http://<mac-lan-ip>:8000/jb.sh | RUN_MODE=1 JB_HEADER="Winterbreak2 Local JB" sh

What happened

1. Initial WinterBreak2 trigger using the upstream HTTPS command failed on this old device/browser path.
2. After changing the payload to use HTTP, the Kindle displayed Powered by jb.sh, v1.3.7, and messages including Restarting GUI / Error dialog is fine.
3. The local HTTP server received multiple GET /jb.sh requests. After 6 requests / repeated Application Error dialogs, I stopped the local server to prevent repeated reruns.
4. After reconnecting over USB, documents/JAILBROKEN.txt existed and contained:

You are jailbroken!
(jb.sh v1.3.7)
https://kindlemodding.org
https://hackerdude.tech

Winterbreak2 Local JB

5. /Volumes/Kindle/libkh/bin/fbink exists.
6. However, ;kpm from Kindle search returns no results.
7. ;log mrpi from Kindle search returns no results.
8. A test shell script placed at /documents/codex_sh_test.sh did not appear in the Kindle library and did not produce its expected result file, suggesting sh_integration is not active.
9. Temporary staging files were cleaned afterward. The device is currently left with the visible JAILBROKEN.txt marker and libkh/bin/fbink only.

Hotfix attempt before local jb.sh rerun

Before trying local HTTP jb.sh, I attempted the Universal Hotfix after the initial jailbreak marker appeared:

• File: Update_hotfix_universal.bin / Hotfix 2.5.0
• SHA-256 recorded after copy to Kindle: 94d5c05254b70c4905392515411f620168ac238db62c7dcbc48a1e31d5de6c59
• First attempt left about 302 MB free and resulted in Update Error 007
• I then adjusted free space to about 696-700 MB and retried with the same verified file
• Second attempt also resulted in Update Error 007
• The .bin was consumed/removed after the update attempt; no visible KPM/MRPI/MKK markers appeared

Current visible state over USB

/Volumes/Kindle/documents/JAILBROKEN.txt
/Volumes/Kindle/libkh/bin/fbink

Visible free space after cleanup:

/dev/disk4s1  3213 MB total, 104 MB used, 3109 MB available

Questions

1. Does this look like jb.sh completed the initial jailbreak marker step but failed to register sh_integration / KPM on this PW2 firmware?
2. Is there a supported way to repair or rerun only the sh_integration/KPM registration without repeating the whole WinterBreak2 browser trigger?
3. For PW2 / firmware 5.12.2.2, should I use a different WinterBreak2 artifact or Hotfix package than the current wb2.zip v1.1.0 + jb.sh v1.3.7 path?
4. Are repeated GET /jb.sh requests / repeated Application Error dialogs expected on this device, or does that indicate the browser trigger is looping?

I can provide additional non-sensitive directory listings or photos of the on-device jb.sh output if useful.