[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Python-only cuber

Don't bother with the obsolete cuberHDX.py, please refer to this post my new post for a python-less alternative instead.

Hi there,

With so many complaints about Linux dependencies,

I figured a Python-only version of cuber may be a good idea.

(Windows does have Python ports, right?

You'll still need python-gmpy2, in addition to fairly standard Python stuff.)

So, here it comes.

Both boot images and unlock codes are supported,

depending on what you pass on the command line.

For unlock codes, figure out your manfid and serial

as explained by the OP, and use the following:

> python cuberHDX.py [I]mmssssssss[/I]
Your unlock code is in '[I]mmssssssss[/I].unlock'.

And, then do the fastboot dance from the OP.

For boot images, the procedure is fairly similar:

> python cuberHDX.py [I]your-boot.img[/I]
Your image '[I]your-boot.img[/I]' is now "signed".

Finally, v3 fixes the text/binary issue and SHOULD work also on Windows.

I cannot test as I do not have that OS..

Oh, and thanks go to [MENTION=4450207]vortox[/MENTION] and [MENTION=438903]dpeddi[/MENTION] for the predecessors of this script.

UPDATE:

For those who miss the '-c|--check' option of the original cuber,

you can simply use the openssl command line to verify your unlock code.

(Scroll to the right for the revelation.)

> python cuberHDX.py AA12345678
Your unlock code is in 'AA12345678.unlock'.
> openssl rsautl -verify -inkey unlock.crt -certin -in AA12345678.unlock -hexdump
0000 - 30 78 41 41 31 32 33 34-35 36 37 38 0a 00 00 00 0xAA12345678....
0010 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0020 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0040 - 00 00 00 00 00 00 00 00-00 00 00 93 6a d2 8e da ............j...
0050 - 94 30 8b 2c 38 21 09 2e-bd e1 13 7d dd e0 ba 22 .0.,8!.....}..."
0060 - e0 1d 8d 73 8a a3 f1 ac-5b f5 3d 06 c5 95 ba 2f ...s....[.=..../
0070 - ab fe 86 7c 26 64 3d ee-47 84 1b cb 12 6a 42 27 ...|&d=.G....jB'
0080 - 53 04 14 f6 a4 17 89 fc-8c b6 96 d3 10 de 21 35 S.............!5
0090 - dc 8b c5 6e 4c ec f2 9e-c1 50 72 8a 06 ff 3b 61 ...nL....Pr...;a
00a0 - 1a a3 52 bd c3 04 13 4c-a1 2a 8f 93 88 6b 46 cf ..R....L.*...kF.
00b0 - df 1f 1b f3 a1 7a d1 9d-a2 04 77 8a a3 37 14 c5 .....z....w..7..
00c0 - 08 98 5f ac 5b d7 0f 1f-fa fe 0f e2 a4 65 5f b3 .._.[........e_.
00d0 - f7 8b 9f bf a5 b2 28 84-39 e2 0d 03 6b 82 03 f2 ......(.9...k...
00e0 - 25 dc f1 41 9d 27 75 6f-10 fe 93 0d c7 95 71 67 %..A.'uo......qg
00f0 - 54 2b T+
00f5 - <SPACES/NULS>

You can add the '-raw' flag to the end of the command line

if you also want to see the PKCS padding string...

For boot images, slightly more acrobatics is needed,

for getting the hash and the signature, but it's not too bad.

This assumes 'dd' is available on your platform.

[COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k of=/dev/null
[COLOR="Red"]3634[/COLOR]+0 records in
3634+0 records out
7442432 bytes (7.4 MB) copied, 0.00792165 s, 940 MB/s
[COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k skip=[COLOR="Red"]3633[/COLOR] count=256 iflag=count_bytes of=sig
0+1 records in
0+1 records out
256 bytes (256 B) copied, 0.000197051 s, 1.3 MB/s
[COLOR="Lime"]>[/COLOR] openssl rsautl -verify -inkey production.crt -certin -in sig -hexdump
0000 - ad 84 84 25 a7 89 57 c3-8c 67 6a c3 25 5c b7 2e ...%..W..gj.%\..
0010 - f4 c8 90 ac a2 fb bf 36-91 3c 43 18 f4 08 c4 9e .......6.<C.....
0020 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0040 - 00 00 00 00 00 00 00 00-00 00 00 a4 8f 3e 09 eb .............>..
0050 - 65 3c 1b 3e de 2e b8 0b-6c 37 55 40 40 9e c0 dd e<.>....l7U@@...
0060 - f7 e0 25 7d 32 18 1b 93-dc ee 1e 9f 7c b7 1b 00 ..%}2.......|...
0070 - d8 62 ec 67 b2 46 74 e8-7f 58 3a b7 ff 22 60 cf .b.g.Ft..X:.."`.
0080 - c4 27 07 83 3f d1 01 06-f6 e6 63 b7 77 5e 45 1f .'..?.....c.w^E.
0090 - 6e 85 2f 29 4f d0 89 70-fb d7 3c e2 da 6f e3 06 n./)O..p..<..o..
00a0 - 5a f2 1f 9e ca aa 7d 84-24 f4 56 9d 8f 16 cf 9c Z.....}.$.V.....
00b0 - c1 07 74 c4 b4 1b f4 7f-04 95 cf d4 93 a1 59 e8 ..t...........Y.
00c0 - 34 a6 aa 2a 7a 39 05 50-0f bb 2d 41 71 cf 8b 47 4..*z9.P..-Aq..G
00d0 - 7a e5 70 3c 36 27 e0 c1-a6 14 2b 28 92 f9 d1 c3 z.p<6'....+(....
00e0 - ac 1e 54 05 10 49 00 6d-ed f9 8a 0b f6 e7 4a 29 ..T..I.m......J)
00f0 - 9a 74 27 10 .t'.
00f5 - <SPACES/NULS>
[COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k count=[COLOR="Red"]3633[/COLOR] | sha256sum
3633+0 records in
3633+0 records out
7440384 bytes (7.4 MB) copied, 0.0493471 s, 151 MB/s
ad848425a78957c38c676ac3255cb72ef4c890aca2fbbf36913c4318f408c49e -

The first 'dd' line to '/dev/null' is just to get the size in pages.

You can do the math yourself instead. I'm just lazy...

The other 'dd' lines use that size-1, which may not always work,

since some images contain additional all-zero pages at the end.

In that case you'll need to experiment with the value to skip,

or use a hexdump utility to figure out the offset.

Oh, and you can get all those pesky certificates from

an ancient post of mine (speculating about a bootloader unlock).