yashsingh1/xdaforums huggingface dataset:
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Hashbang173:
Maybe a commit could be made that could be cherry-picked before compiling?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] r3pwn:
I'm not exactly sure what you mean, but I know that the LG G3 has a script that gets run after the boot image is made to patch it utilizing their exploit. In order to ever have a chance of getting official CM, this type of script is needed.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
I don't think we'll ever get official cm releases here, or at least I'm (we) not ready :

- We have to make a very (but still) few patches to the cm tree (even a few more since I switched to 4.5.2 binaries).

- CM display(-caf) hardware libs are not usable on our devices. I needed some weeks to find the correct(s) tags/commits/parts from codeaurora sources and merge that to the tree. For now I'm also using audio/media from codeaurora, but we could maybe switch this last ones to cm.

- Currently CM is built using amz 4.5.2 prebuilt kernel since this what I targeted for a future root exploit (and for now the kernel sources >= 3.2.4 are not working here). Even the current prebuilt kernel need to be patched/hacked for dtb stuff to be found by our old bootloader.

That's said I'll try to add this to build time as soon as this is ready.

Also since we talk about CM, I just fixed a major bug with gralloc which prevented YouTube and other apps to work ! Then ROM is now 100% usable ! :D (Except telephony which I didn't try as I do not have an lte version). By the way [MENTION=4450207]vortox[/MENTION], did you had the time to test it ? :)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Flashing /boot partition

[MENTION=4450207]vortox[/MENTION],

Were you able to flash a new boot.img to the /boot partition?

On locked hardware I found that the /boot partition was not flashable even by using dd with root permissions.

However the recovery partition I could flash via dd.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
[MENTION=503571]Cpasjuste[/MENTION],

I don't know if this helps or not...

Because kernel sources > .3.1.0 are simply not working... I modified the .3.1.0 source code so it is compatible with 13.3.2.4 binaries. It also includes the fixes required for properly working WiFi.

You can build it with the standard 4.6 and 4.7 toolchains. I have also fixed up the source to build with the sabermod 4.7 toolchain.

kernel source: https://github.com/ggow/kernel_amazon_hdx
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
Thanks ggow. I'm giving a shot again to 4.5.2 "sources" then I'll take a look.

---------- Post added at 12:06 PM ---------- Previous post was at 12:03 PM ----------

If its the case you can still use the recovery as a boot partition. Else if your impatient you should take a look at the exploit vortox found. It seems easy to implement but I won't loose my time as I don't know how to test it on my unlocked one ^^

Edit : my bad, your firmware is too high. You should call amz for a downgrade, some had success it seems !

Edit2: just took a look at your kernel patches, you did a monstrous job :)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
I didn't try that,I will later today.

It is a command line utility, so some one could integrate it in the build process.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
I can finally boot the latest kernel from sources ! I still have a problem with the dtb to be manually happened and with the WiFi module but its a cool step :)

---------- Post added at 01:56 PM ---------- Previous post was at 01:55 PM ----------

Can't wait to do that !
[Kindle Fire HDX 7" & 8.9" Original Android Develop] r3pwn:
Even if the boot partition is locked from userland, it would be very difficult to block access to it from recovery. So you guys should be okay.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
True !
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
dd works fine on the boot partition in the recovery :D
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
[MENTION=4450207]vortox[/MENTION] do you need help with programming ?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] GM_Alex:
Is this also possible for the latest Fire OS Version 4.5.2? Sorry if I ask twice but I couldn't find it above in the thread.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Excellent :)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] r3pwn:
No, the deadline stops somewhere after .1, I believe.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
Thank you for the offer, but the coding is done and I'm starting to write the guide for the tool :)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] SiulGM:
Hi! Will it work on 3.2.1? Thank you!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] cerveca:
There you go...
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Tumbtack:
Excited!

You guys are doing incredibly work, and I cannot even begin to express my gratitude. Was just wondering though, can we expect to see an aosp lollipop ROM eventually with this? 5.0.3 is just around the corner!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] epicfailol:
Wouldn't this be a pretty risky way of flashing roms? As far as I know you can't get into fastboot during the bootup so if you mess up a flash and the device becomes unbootable, it gets bricked
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Demonoid111:
I think its possible to enter recovery during the bootup process by pressing down on a key combo. From recovery, any possible brick could be fixed.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jimyv:
well

just having root access on this device is dangerous..in the hands of the ignorant. This is just one step closer to getting us where we need to be.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
Just a little update so you know that [MENTION=4450207]vortox[/MENTION] did a great job and the signed recovery for Thor hdx with firmware <= 3.2.4 should be available soon. I'll try to update my CM ROM in the same time so the recovery will be useful right away !
[Kindle Fire HDX 7" & 8.9" Original Android Develop] epicfailol:
What are the big differences between this recovery and safestrap?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Hashbang173:
Pretty sure this recovery can flash custom boot.img's (kernel) if there signed properly, so custom ROM's that need a custom kerenl like CM should work.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Yes [MENTION=4450207]vortox[/MENTION], excellent work - thank you!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
Hi !

The first signed recovery is there, thanks to [MENTION=4450207]vortox[/MENTION] for the exploit ! Please some experienced users test it :)

Happy new year !

http://xdaforums.com/kindle-fire-hdx/development/recovery-twrp-2-8-1-0-thor-t2986004
[Kindle Fire HDX 7" & 8.9" Original Android Develop] D0ubl3_X:
[MENTION=4732871]r3pwn[/MENTION]

Now that we can finally boot custom kernels is it possible to read the unlock_code from IDME?

Or is the IDME storage location locked down after bootloader?

Maybe it's now possible to get a full unlock?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] r3pwn:
To be honest, I'm not sure. I have no idea. I don't even have this device, I'm just trying to help in every way possible. vortox helped me out with setting up the bootloader in IDA and if I see anything, I tell him.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] gbgadgets:
As far as I know, IDME is a binary in the system partition. The program can be executed with root privileges. If you simply run idme help from a adb root shell, you can see the allowable commands for the program (like idme print...which shows the current values of a specific list of parameters/flags/memory). However, I don't think IDME is part of the check for the unlock_code, I think it is used to 'write'(print) a value to the 'unlock_code' parameter/flag in memory. I think since root access was achieved, there has always been the option to 'brute-force' this to try and print a valid unlock_code, but I think that is nearly impossible. I don't think this current signature check related to writing the recovery partition has any impact on the unlock_code or formally unlocking the bootloader.

I have used idme to change the board_id and it seems to work just fine. I was looking into the factory_provision_tool binary as well as the scripts that are in /persist directory like 'blow_fuse.sh' and 'prov.sh'. All of this to no real avail in getting anywhere.

Knowing more details about what all [MENTION=4450207]vortox[/MENTION] found and did with the signature checking for writing recovery might add some clues as to whether the unlock code checking in the bootloader is still worth pounding away at.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
I think to remember when unlocking my device I used something like "fastboot oem unlock_idme #####". Unfortunately I do not have the logs anymore of the complete procedure.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
The unlock command should be "fastboot flash unlock code.img" and check of the code.img should be vulnurable, too. I will release more details in the near future. I'm busier than anticipated at the moment.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
At least I can assure you this was not how mine was unlocked. Like I said it was unlocked via a fastboot oem command.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] GSLEON3:
You thinking of the bootmode change via idme?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
Unfortunately I have 0 knowledge of idme or unlocking methods :x

I can just remember he hasked for a few commands output then maybe built a hashed string with that which I think I entered via something like "fastboot oem unlock_idme 'hash'"

Maybe [MENTION=5749760]ggow[/MENTION] would have a better memory than me :/
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
I've been looking at the .3.1.0 and the .3.2.4 bootloader and I have never seen an "oem unlock" command. There are 3 oem commands "oem device-info", "oem relock" and "oem idme". But to use "oem idme" you have to be unlocked.

Whereas "flash unlock code.img" works. This command checks the provided code and if correct writes it modified into idme.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Cpasjuste:
Well, I trust you more than my memory [emoji14]
[Kindle Fire HDX 7" & 8.9" Original Android Develop] GSLEON3:
Have you x-referenced the dkernel image in later builds? The update process uses two separate boot images. Of course boot.img & dkernel.img.

This (if you have the patience to sift thru it) has some good insight & observations: http://xdaforums.com/showthread.php?p=28828452 some of it is absolutely applicable. One of the things I started looking for were the bit indicators that sbl uses at boot to blow specific qfuses.

I believe that the key needed to access the bootloader in any meaningful way is a combination of things. The second boot image for one (dkernel), sbl & the NON-HLOS & of course the device ID in combination with a SHA256 hash. HOWEVER, if we can determine what fuses are blown on an unlocked device, then compare it to a locked device, we may be able to bypass it by loading the qfuse params as part of an update package, if the pertinent parts can be resigned.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] GSLEON3:
I am starting to get a feel again. I think what we have here is dkernel is installed to enable yaffs2 support. Then the tarball includes a not from flash micro os, thzat is booted to, taking control from the production bootloader, & the yaffs2 are written to allow the flash commands for fastboot. It is a pain because they seem to be using some TI pioneered tech alongside the Qualcomm SoC. The appsboot.mbn in the fwupdate tarball definitely contains some things stripped out of the flash meemory appsboot (emmc_appsboot.mbn). If you look at the duplicate files in fwupdate, it starts to make sense. It appears like they may be using a payload OS to handle updating.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] r3pwn:
In the newer builds, they (Amazon) uses a binary (and a shell script) to blow anti-rollback qfuses. Have you looked at those?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] salvo22:
have unlocked the bootloader HDX 7 thor?:fingers-crossed:
[Kindle Fire HDX 7" & 8.9" Original Android Develop] EncryptedCurse:
Besides for a few select people, no one has an unlocked bootloader or the know-how to do so.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] XxD34THxX:
I assume the same is for the HDX 8.9(Apollo). I'm on root and haven't updated it. Then I see a thread that says bootloader may have been unlocked and then that the person who did it is not letting us know how. :/
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Surge1223:
Is there still active work on this? I have made a loader for ida to load and decode bootloaders, I'm wondering if someone would be willing to test it on Kindle bootloaders. I'll push the source for the loader to git eventually but I want to make sure it works on bootloaders others than Samsungs implementations since Samsung alters their lk (aboot).

I would prefer to have someone who already has ida installed with ida python working.

Contact me directly on hangouts @ surge1223@gmail.com if interested.

Thanks.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
I've just disassembled the emmc_appsboot.mbn ok 14.3.1.0 firmare.

As already discovered idme_write is called by fastboot oem relock, and "fastboot verify unlock unlock.img"

unlock.img should be signed, and should be vulnerable.

both store (or invalidate) unlock_code to idme.

Since idme is writable by firmware I think Cpasjuste issued

adb shell "idme unlock_code hash"

This don't need to be signed at all.

it should be interested if he can do a

adb shell idme print

it should print all idme variables and he can restore his raw unlock_code

The certificate should start at 0x38458 and is different from the cert for signing image

the value to encrypt should be formatted as 0x%02x%08x and the two parameter should be retrieved by mmc (perhaps mmc serial/ and some more)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
the "unlock_code" to be signed should be 0x%02x%08x mid (manufacture id), psn (production serial number)

mid = cat /sys/block/mmcblk0/device/manfid

psn = cat /sys/block/mmcblk0/device/serial
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Antagonist42:
That makes more sense when I've found my mid for another device, was too many bytes long in total ;) I can recheck my old files now I can see what they may be :D

Bashing away at my HTC Desire C
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
bootloader unlocked ;)

http://xdaforums.com/kindle-fire-hd...bootloader-unlock-procedure-software-t3030281
[Kindle Fire HDX 7" & 8.9" Original Android Develop] XxD34THxX:
Well, I'm to late. Sorry Surge, I had a lot of trouble with gmail last night and I came home at 12, I had work, then in 6 I wake up. Been a long week. BUT I shall do this act of putting a REAL ROM(custom BL and Kernal) on the HDX once a nightly is out. :D:D:D:D:D:D:D

I'd like to thank the people who do this for us and thank them for all of the hard work they have done.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Hi Surge1223, could I try your loader out?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Phate123:
I would be interested, too. I have bricked my HDX and I don't have the vulnerable bootloader. So I'm quite interested in unlocking the bootloader of newer devices. ;)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ONYXis:
[MENTION=5749760]ggow[/MENTION] I think you need contact [MENTION=4939386]Surge1223[/MENTION] directly as he wrote.

We need unlock for >13.3.2.6 devices.

Thanks for you work. guys.

Sorry for not very useful post)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Thanks ONYXis,

I contact Surge via hangouts and he has sent me the loader.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] EncryptedCurse:
The bootloader is unlockable on FireOS 4 — at least on the HD 6 and 7. The OP even indicates that it's utilizing the very same RSA exploit from vortox and dpeddi.

It's got me wondering whether it still actually works on our devices as well, and people have been just avoiding trying due to the assumption.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
It's fixed in .3.2.4, so it's (probably) fixed in every higher version.

I wondered too. Those devices use MediaTek SoCs and the bug was in the Qualcomm bootloader. The bug was fixed on the HDX even before those tablets were announced, yet they are still vulnurable.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ONYXis:
[MENTION=4450207]vortox[/MENTION], [MENTION=438903]dpeddi[/MENTION], friends, I previously asked about this...

Why I could not do something like this from a running system

adb shell dd if=/sdcard/images-from_3.2.3/sbl1.mbn of=/dev/block/.....
adb shell dd if=/sdcard/images-from_3.2.3/emmc_appsboot.mbn of=/dev/block/.....
adb shell dd if=/sdcard/images-from_3.2.3/rpm.mbn of=/dev/block/.....
adb shell dd if=/sdcard/images-from_3.2.3/tz.mbn of=/dev/block/.....
adb shell dd if=/sdcard/images-from_3.2.3/sdi.mbn of=/dev/block/.....
adb shell dd if=/sdcard/images-from_3.2.3/boot.img of=/dev/block/.....
adb reboot bootloader
unlock procedure
fastboot flash recovery twrp.img

How could blow fuse in this case?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] lekofraggle:
I could be wrong, but I am not sure adb can run dd that way on a running system. If it can, you may be on to something.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] AlexZap:
You'd need busybox installed. dd is built into it.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ONYXis:
dd works, this is main method of installing recovery - for example - http://xdaforums.com/kindle-fire-hdx/development/recovery-twrp-recovery-2-8-1-0-apollo-t2991155

but need to know if any chance do not brick) [MENTION=5749760]ggow[/MENTION], what are thinking bout this? or needs to be kamikaze ?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Glad you mentioned me in the post, i may not have seen this otherwise - I'm almost 100% certain this will result in a brick.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ONYXis:
But how? i assuming that this fuseblown-process started at sbl1...

But, I am not dev, of course.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
- The issue is not just fuse...

- I remember looking at this in the past, there are a number of things that have changed in the bootloader images between the jelly bean and kitkat updates. The format of the header for boot and recovery images have changed. I suspected also the format of the header that sbl1 bootloader expects for aboot partition may have also changed.

And another thing is you can't dd .mbn files as they are packed and if you did - that alone would result in a brick.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ONYXis:
ok. let's dd partitions backup from working 3.2.3 device.

And few years ago I did smth like this ))) - http://xdaforums.com/galaxy-s3/orig-development/util-sboot-checker-simple-downgrade-t2081748

and we could do this (overwrite all bootloaders chain )at old base by rollback to 3.2.8...

I see , too risky)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Yes, the whole boot chain is locked down as if protecting gold in fort knox.

I wouldn't risk this method - on our hdx's it's a sure fire brick.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] DB126:
lol at the unintended pun - "sure fire brick".
[G3 Q&A, Help & Troubleshooting] maikeru-chan:
I have a F400K G3 (Korean Olleh). It's rooted and bumped. I flashed the bumped TWRP image via Flashify and rebooted recovery via Flashify. It works. But when I try boot to recovery from a complete shutdown. It just boots into safe mode. I did exactly what was stated in the Bump thread (Power+V. Down, when logo appears, release then press again quickly) and also tried substituting V. Down button with V. Up, but it still wont boot to recovery. It just keeps going into safe mode. The video provided in the thread was using an AT&T model so maybe it differs from every variant. I want to know if I'm doing something wrong or the instructions are wrong.

Thank you.
[G3 Q&A, Help & Troubleshooting] DelBoy:
You tried without releasing? Just keep holding buttons

---------- Post added at 11:38 AM ---------- Previous post was at 11:37 AM ----------

Do you get to that factory reset screen?
[G3 Q&A, Help & Troubleshooting] maikeru-chan:
I have tried it as well without releasing. Does the same thing. And it never shows the reset screen. It just goes directly to the boot animation. Rebooting from Flashify also doesn't show the reset screen but it does get to TWRP. But I need to boot it from complete shutdown because I'm gonna test a Flashable zip ROM without root so rebooting using Flashify would be impossible.
[G3 Q&A, Help & Troubleshooting] maikeru-chan:
Bump.

Seriously. Anyone?
[G3 Q&A, Help & Troubleshooting] daveaus:
I am subscribing because I have the exact same problem. I have tried every key combination I could find for the G2 and G3 but no luck...
[G3 Q&A, Help & Troubleshooting] Deleted member 4783640:
This is exactly the kind of problems you get when using stuff like Flashify. The holding of the buttons etc you mentioned should work. Are you sure you aren't connected using a micro usb?
[G3 Q&A, Help & Troubleshooting] maikeru-chan:
No, I am not connected to USB. If I reflash the recovery using ADB will it work? But I do have some worries because I'm using KitKat bootloader on a Lollipop Stock-based ROM (here) and I think I may get some errors.

It's not very important right now because I have root now and can reboot to recovery using Flashify.
[G3 Q&A, Help & Troubleshooting] rixz59:
I think all korean models cant enter recovery via hardware keys, mine is F400L and have the same problem.
[G3 Q&A, Help & Troubleshooting] docsavage7966:
Untouched LG G3

I have a completely untouched LG G3 uk version only official software no root etc and mine won't go into hard reset mode. I have tried 3 or 4 times it always goes into safe mode :(
[G3 Q&A, Help & Troubleshooting] rhtash:
same issue

f400k.

able to boot into recovery by softwares

but unable with hard keys.

last night was installing bliss pop. but stuck on boot animation. now wont go to recovery watsoever.

help.
[G3 Q&A, Help & Troubleshooting] maikeru-chan:
Turn off the phone completely. Press and hold Power and Volume Down. When the LG logo appears, release. After a split second, press volume down and volume up. White screen asking you to reset will appear. Press Yes two times using Volume buttons.
[G3 Q&A, Help & Troubleshooting] xDreDz:
UP!!!

Any remedies? I justed from stock to cm12 LG g3 F400L..

Cant go to recovery mode. Cant flash anything..
[G3 Q&A, Help & Troubleshooting] interturbo:
Same prob,always going to safemode.f400k rooted,cloudy2.5
[G3 Q&A, Help & Troubleshooting] maxi65:
i've Lg g3 F4ooL and using Resrruction remic 5.5.5

I stuck in a Bootloop and my device is also not booting into Recovery or safe Mode.

Lg flash Tool is also not Connecting to my device in Downloadmode.

I think There is NO solution At ALl :D :D
[G3 Q&A, Help & Troubleshooting] DroneXoX:
Has anyone solved this issue?
[G3 Q&A, Help & Troubleshooting] misbah711:
to get in recovery on F460s, worked on mine, Press Vol-up + Power, as the logo appears release the keys and press Vol-up + Vol-down, you will boot into recovery.﻿
[G3 Q&A, Help & Troubleshooting] vineet381:
I have the same issue, cant go into recovery using hard buttons on F400K. Any one able to succeed in this?