[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
Hello and Merry Christmas,

I have managed to bypass the downgrade check (without any involvement from Amazon) and initiate recovery from 4.5.1 to 3.2.6. Unfortunately it failed while in recovery mode. It was saying something like updating system files and then the progress bar disappeared and it showed "Error". Fortunately the tablet reset and booted into 4.5.1.

Before this I flashed the 4.5.1 image and that without problems.

LE Got bricked after flashing 4.1.1!!! Do NOT try to downgrade with the public OTAs!!

Now it presents itself as "Qualcomm HS-USB QDLoader 9008". I guess I could use QPST Configuration, but I don't know what I should do.

We should try to fiddle with it before I it goes to RMA.

It is pretty simple to bypass the check. After decompiling DeviceSoftwareOTA.apk, DeviceSoftwareOTAContracts.apk and KindleSettings.apk I learned that the OTA check goes like this:

........* ensureSideloadCanBeInstalled

................* verifySideloadWithRecoveryCheck

........................* verifySideloadMetadata

................................* SideloadSanityChecker.check

........................................* verifySideloadExists

........................................* verifySideloadContainsMetadata

................................* SideloadMetadataChecker.check

........................................* verifySideloadVersion (reads ro.build.version.number from /system/build.prop, I think)

........................................* verifySignatureTransition

........................................* verifySideloadProduct

........................................* SideloadPVTChecker.checkPVTGetsUserBuild

................................* OSUpdateBinaryChecker.check

........................................* pullCheckBinary (from META-INF/com/amazon/android/check-binary)

........................................* runCheckBinary (check-binary -v updateFile)

........................* verifySideloadPackage

................................* RecoverySystemWrapper.verifyPackage

........................................* android.os.RecoverySystem.verifyPackage (checks signature, can't bypass this afaik)

........* installSideload

................* SideloadVerifier.verifySideloadWithoutRecoveryCheck

........................* verifySideloadMetadata

........................* SideloadDeviceStateChecker.check (check remaining battery and free space)

................* SideloadEncryptionHandler.moveFileToCacheIfSDCardEncrypted

................* installOSUpdate

........................* android.os.RecoverySystem.installPackage (writes recovery params and restarts in recovery mode)

The trick here is that the signature is checked very late into the process, so you can replace the build number and pass that check.

Now the signature check will fail as the OTA has been tampered. The great thing is that you can also replace the check-binary from META-INF.

I used a sh script and tried to read from /data and other root-owned filed from /. Unfortunately the script runs under an unprivileged user, so you can't do much.

At this point I was lost, but a friend of mine suggested using check-binary to replace the OTA with an older, signed version. I first tried with the current installed version (4.5.1) as I was afraid that this might break with and update that wasn't designed for downgrading. The device restarted and went through the process without any glitch.

Obviously I had to try with an older OTA even with the risk of bricking the tablet. As 3.2.7 wasn't anywhere to be found, I fetched 3.2.6 and went though the process again. The outcome was presented in the first paragraph.

If you have any ideas (or a 3.2.7 OTA), please share.

Sorry for the long post and the stupid dots that I used for indenting.

PS. If your device downloads a new OTA automatically you can delete it by running factory restore.