yashsingh1/xdaforums huggingface dataset:
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Before spending more time on your quest, I'd like to understand

what is it that you're after and for which devices?

*ALL* (still working ;^)) 3rd generation HDX tablets can be unlocked.

Even if you figure out *what* changes (which is likely not that difficult),

you'd need to be able to affect the same change in the target device,

which is normally where you start to encounter difficulties, and the

protection mechanisms vary (sometimes significantly) between devices.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] BeeWall:
I have an Amazon fire 5th gen. So far, I have noticed some similarities such as how to find the unlock code, and I am hoping that whatever flag triggers unlock in the hdx also works for this device.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
If you mean this device, then I think you're best bet is to keep

asking/contributing on this thread.

If you mean the fastboot command 'flash unlock <file>' than that "similarity"

is likely to be shared by a whole slew of other Android devices (not all, but

quite a few). BUT, keep in mind that although 'fastboot' is standard Android,

what the bootloader does when it receives that 'flash unlock' command is

what matters, and *that* might vary from one model to another.

For what it's worth, your device is based on a MediaTek chip not Qualcom,

and seems to use UBOOT (as opposed to LK) as bootloader. I don't think

anything you see here is directly applicable (but I could, of course, be wrong).

On the HDX, the unlock code is an RSA-2048 signature on the EMMC-id,

and the only reason we have a "bootloader unlock" is that early versions

of the LK-based aboot on the HDX had a signature verification bug, which

allows us to use fake signatures. Without that flaw, our best bet would be

a quantum computer that will factor 2048-bit RSA by 2030, if we're lucky. (-;

At first, this signature verification bug was used to sign custom kernels,

but after a fairly complete disassembly of the bootloader [MENTION=438903]dpeddi[/MENTION] figured

out how the unlock code is handled (see above) and that the same signature

verification bug could be used here as well. AND, recently [MENTION=5594063]ONYXis[/MENTION] took the blue pill

and verified that once you got root flashing that old vulnerable bootloader to *any* 3rd gen

HDX is possible (if done carefully with the right preparations).

So, for starters, you'd need to (1) figure out the same (i.e. what the bootloader

does with the flash command, what's the derivation process for *your* unlock

code) and then (2) try to find a bug (or workaround) of some sort that fools

the verification in some way. GOOD LUCK! (-;

I'd also suggest you do some more research to get a better grasp of the basics.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] BeeWall:
Thank you. I am a noob, and did not realize/understand differences such as LK, UBOOT, Qualcomm, MediaTek, etc. I have figured out how to find the unlock code, which is similar to hdx. I believe it is 0xssssssmm (or however long the serial is). I thought I saw an LK partition and UBOOT, but I could be wrong. I have looked at that thread, but, as I said, I don't understand much. Could you give me some tips on where to start learning/researching? Thank you!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
As you've undoubtedly heard many times: google is your friend.

Just keep reading threads like that, and if you read something you

don't understand, do your research. A quick lookup on google is

often a good start (and in many cases really all it takes).
[Kindle Fire HDX 7" & 8.9" Original Android Develop] BeeWall:
Do you know where idme writes to, and what it actually does? Google has yielded no useful results. Most of what i can find are the idme bootmode commands, which explain nothing.

EDIT: Found it. /proc/idme/<flag>. Even with root, it is read-only
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
This is the most informative post I had seen so far.

In addition to the same /proc/idme reference you mention, it also shows where idme writes (on that device; the offsets may vary,

but you could probably get the source code from Amazon and check for your particular device), and outlines the procedure for

passing variables from idme to the bootloader.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
The steps described should be enough.

Perhaps later can be improved or can be added a windowa executable or apk that do all, but not now.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] mxzwhx:
Okay,thanks.one more question, I'm currently running [MENTION=5749760]ggow[/MENTION]'s HDX nexus ROM v2.0.4 ,do I have to roll back to Amazon fire os to do that ?or I could just do the unlock steps on currently ROM ?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
No need to revert to stock.

Perhaps you can't use adb shell idme print.

If this step fails ask ggow to include idme in next hdx nexus.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
[MENTION=4101933]mxzwhx[/MENTION]

The unlock procedur incl. "idme print" works fine with hdx nexus (2.0.5).

For creating the unlock signature you need linux. Only fastboot works with Windows

You just need to install the windows driver correctly (only for fastboot connection)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ggow:
Excellent work :)

Definitely make developing custom kernels a whole lot safer.

Thank you.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jeryll:
Thank you very much [MENTION=438903]dpeddi[/MENTION], after a little bit struggling with ubuntu live I managed to unlock my HDX 8.9 too (running Nexus 2.0.5) !!! Yay! Confirmed with idme print, thank you again, excellent work!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jcase:
You should credit Lee Harrison (ralekdev) for discovery and publishing the vuln details.

Also, you can get teh serial and manfid from the bootloader itself, so you can craft it without the need for root

Edit:

Sorry wrong this this morning while in bed, sounds harsh, wasn't suppose to be. Congrats! This also works on FireTV. Its patched in first release of the phone.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] vortox:
Great job [MENTION=438903]dpeddi[/MENTION]
[Kindle Fire HDX 7" & 8.9" Original Android Develop] icedtrip:
Success!! Fantastic job [MENTION=438903]dpeddi[/MENTION]!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] williamhancock328`:
4.5 rollback possible?

Great job unlocking the BL! I'm not sure if it's possible, but can we downgrade the software to 3.1.0?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] andPS2:
great work!

does this work for hdx 7 too?

cm11 will continue to run afterwards correct? (the one with the bootloader bypass)?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
[MENTION=3501296]andPS2[/MENTION]

The bootloader unlock procedur works with HDX 7 (Thor)

And yes, cm11 should then also still work.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] andPS2:
btw for linux u guys need to apt-get install android-tools-adb and android-tools-fastboot for

ubuntu

adb reboot bootloader get into fastboot mode

both could be added to op

p.s. i guess idme is not included in [ROM] cm-11-20150110-UNOFFICIAL-thor

is there another way to check if bootloader was unlocked?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
[MENTION=3501296]andPS2[/MENTION]

Install temporarily the Nexus Rom to use idme print.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] EncryptedCurse:
Neat.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] andPS2:
got it unlocked too

my hdx screen didnt give any output other than fastboot mode

and invalid comment
[Kindle Fire HDX 7" & 8.9" Original Android Develop] mxzwhx:
File is not an Android boot image ,what does that mean ?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] someone0:
I think I saw some bounty for HDX bootloader unlock floating around, maybe the OP should go pick them up.

http://xdaforums.com/showthread.php?t=2580428
[Kindle Fire HDX 7" & 8.9" Original Android Develop] AmazonLeaker:
Have anyone tried this on 14.3.2.8 ?

I know that it would not work but still can there be some one willing to test this, i would have tested it but currently my dual booting Ubuntu broke and I'm bad with Linux.

It would be very greatful if someone can help people with kindles on 14.3.2.8.

Amazon Canada has 4.5.3 update rolled out america would be soon on list i believe....
[Kindle Fire HDX 7" & 8.9" Original Android Develop] andPS2:
but once unlocked u should be able to always flash any bootloader?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
I'll check but from fastboot you should be able to flash any image with android! header (system/recovery) but I doubt you can flash the bootloader from fastboot.

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Droid_1:
I already know my manfid, serial and also installed all the perquisites on linux... But since I never did this before, can anyone give me a hint how to create the unlock.img with the content and encrypt it? I also would appreciate any link for studying the basics :)

Sent from my Nexus HDX 7
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
Notepad

0x9911223344

Where 99 is manfid the rest the serial.. so easy
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Patrick4:
Thank you ! It worked on my HDX 7 however the boot command doesn't seem to work, it downloads the kernel on to the device and hangs. :p
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Unclear...

Well... that depends on what you mean.

First of all, according to our hero,

you cannot just let an OTA from Amazon overwrite your current bootloader, as you'd lose the unlock.

I have no idea if that also means that flashing a custom aboot.mbn -say, built from LK sources- would also risk your unlock.

This would be quite important to understand, since this greatly affects the usefulness of this unlock method.

If this is not a permanent unlock, we saved us the trouble of signing every boot or recovery image,

which is nice, but we're stuck with the bootloader.

In any case, you could always just use "disk destroyer" from an adb shell (after 'su' to root) ;)

dd if=your-aboot.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot bs=64k
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
Can't work as written.

you forget the manfid...
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Have you tried?

Are you sure?

I thought that manfid was short for 'manufacturer ID' ,

and drew -the possibly faulty- conclusion that this value

should be the same for all affected devices; so, just like the

two moduli, I hardcoded 0x11 for ease of use.

Shout if your manfid is different and I'll update the code

to accomodate different ones next time I'm near a computer

(doing this on the HDX would be suboptimal). Alternatively,

feel free to make the fairly trivial change yourselves.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
Manfid is emmc related... i have 0x15

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Fair enough. I was apparently blind... :o Sorry!

I made the change, and it works for my device.

Can you test on yours?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jutley:
Can this be made to work on the Amazon fire phone to unlock the bootloader?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] andPS2:
[MENTION=2376614]jcase[/MENTION] posted earlier in this thread

" Its patched in first release of the phone."
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Nanaki-seto:
I have a kindle fire hd 8.9 rooted and rommed it is a fantastic device not rooted and rommed it is basic and pretty crappy. I can only imagine a rooted hdx.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] mxzwhx:
finally,I got it worked ,my kindle fire hdx8.9 has been officially unlocked ,thanks very much!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
Hi jcase

Which fastboot command can be used to display manfid and serial information ?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jcase:
I believe it was oem emmc info but someone is going to need to look
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Hanzo.Hasashi:
We need a YouTube walkthrough/how to

Kindly fired
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
The command "oem emmc info" did not work, also not even the command "oem emmc-info" :/

It would be good to know this info, so you can unbrick some bricked hdx´s with old bootloader, or i have a thoughtless error ?!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jcase:
Your going to have to look through the available commands, one of them prints a combined serial, that can be broken apart.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ApokrifX:
Didn't work for me... :(

I'm on 14.3.2.4

>C:\Python27\python.exe cuberHDX.py 0x1512345678
Your unlock code is in '0x1512345678.unlock'.

I got 0x1512345678.unlock 256 bytes

And XXX.unlock is 257 bytes for my serial.

I guess, it's normal? :confused:

>fastboot -i 0x1949 devices
XXXXXXXXXXXXXXXX fastboot

>fastboot -i 0x1949 flash unlock XXX.unlock
target reported max download size of 1073741824 bytes
sending 'unlock' (0 KB)...
OKAY [ 0.078s]
writing 'unlock'...
FAILED (remote: Unlock code is NOT correct)
finished. total time: 0.140s

>fastboot -i 0x1949 getvar product
product: APOLLO
finished. total time: 0.021s

>fastboot -i 0x1949 getvar version
version: 0.5
finished. total time: 0.058s

>fastboot -i 0x1949 getvar kernel
kernel: lk
finished. total time: 0.058s

>fastboot -i 0x1949 getvar production
production: 1
finished. total time: 0.057s

>fastboot -i 0x1949 oem device-info
...
(bootloader) Device tampered: false
OKAY [ 0.036s]
finished. total time: 0.038s

>fastboot -i 0x1949 reboot
rebooting...

finished. total time: 0.022s
[Kindle Fire HDX 7" & 8.9" Original Android Develop] rubinho:
This Bootloader Unlock works only with Bootloader Version x.3.1.0 - x.3.2.3. You must downgrade your hdx.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ApokrifX:
Yep, cuber README.md says:

>cuber has been tested working for 3rd-generation Kindle Fire HDX tablets with firmware versions older than 14/13.3.2.4.

While the 1st post said:

My bad, apparently I cannot decipher '<= 1[34].3.2.4' properly!

Could you point to reliable downgrade instructions, please? :o
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Given that we're dealing with 2048-bit RSA, the output should be 256 bytes.

You may have found a bug. Can you craft another number similar to your serial

that you can share and results in a 257-byte output? (If I had to guess, it must be

zero vs. nonzero digits that might make a difference.)

Of course, as you had already been advised, 3.2.4 does NOT accept forged signatures.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ApokrifX:
Should be

u = open(n, 'wb')

not

u = open(n, 'w')
[Kindle Fire HDX 7" & 8.9" Original Android Develop] Clarke33:
If the OP will list donate info, I'll be more than happy to send mine his way.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ceyo14:
you are right. the "wb" fixed it and i just unlocked it.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ceyo14:
For other that might not have understood as easily..., (its been a while since I work with anything) complete as follows. tested on HDX 7 (Thor) Rooted 13.3.1.0

get Python

2.7

for windows and install it

get GMPY2 for Python

2.7

open command prompt to your ADB directory:

adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial

from these 2 results you get your the code we need, insert the last 2 digits of the manfID with your serial

following

like this: mmssssssss

download the attachment on the following post: http://xdaforums.com/showpost.php?p=58864282&postcount=46

Then place the file inside the attachement to C:\Python27 should be C:\Python\cuberHDX.py

open command prompt in: C:\Python27

replace "mmssssssss" with yours below:

python.exe cuberHDX.py 0xmmssssssss

that will put a new 0xmmssssssss.UNLOCK file in the Python27 directory

copy that file to your fastboot directory.

on an ADB prompt type

adb reboot-bootloader

then on a fastboot prompt type

fastboot -i 0x1949 devices
fastboot -i 0x1949 flash unlock 0xmmssssssss.unlock
fastboot -i 0x1949 reboot

thats it.

Gathered all from this thread, just a little clearer I think...

thanks to [MENTION=438903]dpeddi[/MENTION], [MENTION=4450207]vortox[/MENTION], [MENTION=5828306]draxie[/MENTION], [MENTION=4107074]ApokrifX[/MENTION]
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Oh, the pleasures of working with OS:es that treat text and binary differently!

Now I remember.. I haven't touched Windows for several years now.

Thanks for catching this major oversight! I posted a fix as v3..

---------- Post added at 07:17 ---------- Previous post was at 06:57 ----------

Thanks for the detailed tutorial! I'm sure this will be appreciated.

And, thank. you for the fixed script that solves the text/binary issue

for unlock code generation. I posted v3 that fixes the same problem

for boot image signatures as well. Admittedly, the latter is much less

relevant now; nevertheless, would you mind pointing to the full fix (v3)

in my post above?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ceyo14:
[MENTION=5828306]draxie[/MENTION], its done, on my uploaded i just put the b after the w like [MENTION=4107074]ApokrifX[/MENTION] said, i have no idea what it does... I think its easier and should be somewhere in the OP or stickied or something... thanks for the work all of you have done. im glad i never updated the HDX, even though I had the WiFi bug which helped but also didn't help in regards to updating it, glad i set it aside until now.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
I do need a special fastboot cable for that, correct?

Gesendet von meinem LG-V500 mit Tapatalk
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Don't think so.

I just use the USB/charger cable that came with the device.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
When I boot in fastboot, the device won't recognize. Waiting for device...

ADB works as it should. Any ideas? Already installed the driver again, same result.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Are you passing the vendor id (-i 0x1949) on the fastboot command line?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] aquaphun:
Do you have your fastboot drivers installed?

it should look like this in your device manager

Else you can install the universal ADB and Fastboot drivers from Wugfresh Nexus Toolkit

PS: I got the bootloader unlocked with HDX 7'' aka Thor and with 13.3.2.4 on the cm-11-20150110-UNOFFICIAL-thor rom

My Computer is a Win7 x64

Thanks to all the devs!
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
In fastboot, nothing work. Cos the device is not found. ADB works.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] aquaphun:
are your FASTBOOT drivers installed properly? Check your Device manager in windos
[Kindle Fire HDX 7" & 8.9" Original Android Develop] uhraman:
I am on 13.3.2.4 using Nexus 2.0.4 with safestrap (stock firmware on stock slot, rooted, block ota). Could you give details (tutorial) on how to unlock HDX7 Thor? It's really ricky to do anything with this device without help from experts. I am really appreciated that.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] aquaphun:
It should work on the with safestrap while you are on the rom slot, since you only getting your manfid and serial number from the device itself. The real operation will be in the bootloader which are only working on Verson 1x.3.1.0 - 1x.3.2.4

You should maybe wait for an implementation into an easy executable file or toolkit if you don't comprehend those steps.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ApokrifX:
IMO, unlocking bootloader has nothing to do with ROM your run.

Tho, I don’t understand, how come bootloader 13.3.2.4 (Thor) can be unlocked, but 14.3.2.4 (Apollo) cannot?

Am I missing something obvious? :confused:
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
No clue what u mean. I have USB and ADB driver installed. Are there special ones for fastboot as well??
[Kindle Fire HDX 7" & 8.9" Original Android Develop] aquaphun:
Yes I know that the crucial operation will be on the bootloader level and that why it's independent from the rom as I stated above. I just mentioned it because there were statements weich indicated no functionality under x.3.2.4 and under the CM Rom.

@ st@@tz

Yes there are. Check your Device Manager. It should look like my picture I attached.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
Thats the ADB interface, and sure I have the same
[Kindle Fire HDX 7" & 8.9" Original Android Develop] aquaphun:
Have you verified your drivers while the Kindle is in fastboot Mode? since your first question was about a special fastboot cable I highly doubt that you have the proper drivers installed for fastboot Mode.

try to uninstall any current fastboot drivers if your device still doesn't show up in fastboot.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] st@@tz:
Can't believe that **** ?

In fastboot mode there were only a portable device but an ADB interface. Deinstalled, connected, unlocked!

Thx [MENTION=2693695]aquaphun[/MENTION] !
[Kindle Fire HDX 7" & 8.9" Original Android Develop] uhraman:
Stupid question: due to the fact that there is no TWRP recovery for >=13.3.2.4 (Thor) yet, is it correct that after unlocking, at the moment, we cannot install CM11?
[Kindle Fire HDX 7" & 8.9" Original Android Develop] EncryptedCurse:
You can't unlock either if you're on 13.3.2.4.

You need to downgrade.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] ApokrifX:
I might be mistaken, but IMO, recovery has nothing to do with ROM you run.

IMO again, the process should be smth. like this:

"Upgrade" to Kindle OS version < 13.3.2.4/14.3.2.4

Unlock bootloader.

Backup current recovery.

Install recovery via fastboot

(You can backup your current TWRP recovery before upgrade and flash it in fastboot?)

Get new software like CMXX, Or Kindle OS >= 13.3.2.4, remove bootloader, flash via recovery.

Please, correct me if I’m wrong. :o
[Kindle Fire HDX 7" & 8.9" Original Android Develop] uhraman:
I'm quite noob. But if " recovery has nothing to do with ROM you run" why in the TWRP threads, the OP required ROM<13.3.2.4.

Aquaphun above said that for Thor, we could unlock bootloaader even with 13.3.2.4

I consider how to backup current recovery and install a new one after unlock through fastboot? (actually I could google it but with this HDX, it is very risky for noob to do something wrong)
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
The locked boot loader refuse to boot wrongly signed firmware and recovery.

The signature in twrp is considered good by the bootloader until version 3.2.4 .

After that version they fixed the signature bug.

Inviato dal mio KFAPWA utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Original Android Develop] dpeddi:
Hi jcase,

I've checked but I haven't seen any oem emmc.

I have updated 1st post with all fastboot command I've found.

I haven't found cross reference to the struct where serial and manfid is stored. (but maybe I haven't see it)

dpeddi
[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
I've tested this one. It works as expected.

Tried flashing recovery from fastboot afterwards

and it complained about locked hardware.

The unlock method still works fine to unlock again.
[Kindle Fire HDX 7" & 8.9" Original Android Develop] jcase:
I might be thinking of the FireTV, but one of them would certainly output a combined number. Can you post a vuln aboot for me?