Joe's notes

Kindle Scribe — jailbreak, KOReader and Hermes

Properties1
descriptionThe 1st-gen Scribe on 5.19.3.0.1: Véra jailbreak route, USB passthrough to the agent VM, and the scripts that back up, fill and provision it.

3 min read

Kindle Scribe — jailbreak, KOReader and Hermes

First-generation Kindle Scribe, firmware 5.19.3.0.1. Goal: the device becomes a client for this machine — Hermes pushes the day’s digest and long documents to it, and handwriting and highlights come back — without Amazon’s cloud in either direction.

The step-by-step plan lives outside this workspace at ~/.hermes/plans/2026-11-03_200357-kindle-scribe-setup.md. This note records the facts and the plumbing worth keeping.

Why Véra, and not something else

Jailbreaks are tied to firmware ranges and Amazon patches them; there is no downgrade without an existing jailbreak. Véra’s own configuration lists the Scribe (KS, 1860×2480) for 5.19.3.0.1, so Véra is the method. The public “Models Table” page is stale — it stops at AdBreak/5.18.5.0.1 for the Scribe and would look like a dead end. Trust the wizard, not the table.

Two rules that matter more than the procedure:

  • Do not update the firmware. The version you jailbreak is the version you keep.
  • Fill the storage before starting. Wi-Fi must stay on until the last step, so an OTA could otherwise land mid-jailbreak. An OTA needs hundreds of MB; the jailbreak needs about 70KB.

Getting the device to the agent (USB passthrough)

The Hermes host is a VM (joe-host, VM 101) on Proxmox, so a device plugged into a physical port belongs to the host, not the guest. Attachment is by ID, live, no reboot:

ssh root@192.168.0.200 'lsusb | grep -i kindle'          # 1949:9981 Lab126 Kindle Scribe
ssh root@192.168.0.200 'qm set 101 -usb3 host=1949:9981'
ssh root@192.168.0.200 'qm set 101 -delete usb3'         # detach when done

In the guest the device mounts as mtp://Amazon_Kindle_Scribe_<serial>/, whose root holds a single Internal Storage folder — the real Kindle root is inside it.

Reads work over the FUSE mount; writes do not (Operation not supported). Everything that creates or deletes goes through gio copy / gio remove, which is what kindle_common.copy_to_device() does automatically. Measured on this box: ~18 MB/s bulk write, ~0.5 MB/s on many small files.

Scripts

All in ~/.hermes/scripts/, sharing kindle_common.py:

  • kindle-stage-jailbreak.py — downloads both Véra books for the exact device/firmware (the URLs are deterministic) and copies them to documents/. Validates the BOOKMOBI signature, not the size: the Font Calibration book is only ~10.7KB and is valid.
  • kindle-backup.py — backs up .notebooks, documents, voice, screenshots with streaming sha256 and a manifest; --list, --restore, --import (for a folder copied off on another machine) and --fill to chain backup then fill.
  • kindle-preflight.py — --apply deletes stray root update*.bin then fills to under 100MB free with sparse 1GB fillers recorded in a manifest; --cleanup after the jailbreak removes exactly those, the two books and any new update bins, and reports JAILBROKEN.txt.
  • kindle-provision.py — after KOReader’s SSH server is up: installs the key, proves key-only auth, inventories the device, creates plugins/, patches/, settings/, pushes a smoke-test file and records the device in ~/.hermes/state/kindle-device.json.

What stays manual

Font calibration (Bookerly, bold 0, maximum size, medium spacing, saved as a theme), opening the Véra book, ;kpm update / ;kpm install koreader, and the first toggle of KOReader’s SSH server. These are GUI-only; a script cannot do them and pretending otherwise is how people brick devices.

Scribe notebooks live in Amazon’s store and KOReader cannot read them, so pen capture goes via notebook → PDF export → OCR → Markdown before any native-ink work is attempted.

index · KNOWLEDGE-GRAPH

Graph View

Backlinks