yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] Tomsgt:
Me and [MENTION=4381075]hwmod[/MENTION] just spend 3 hours working with the preloader on the Amazon Fire 5th gen 7in tablet. We successfully wrote the none production preloader.img to the device.

adb shell
su
cd data/local/tmp
busybox cat preloader.img > /dev/block/mmcblk0boot0
dd if=/dev/block/mmcblk0boot0 of=preloader_unsecure.img bs=512 count=240
busybox diff preloader_.img preloader_unsecure.img

NOTE When sending files back and forth to the device it is best to work out of /data/local/tmp. we send the preloader.img to /data/local/tmp before running these commands.

Also Busybox must be installed on the rooted device.

The diff command showed that the files matched so we successfully wrote the file.

From here we reboot the device to see what would happen and the device hard brick / only preloader is accessible.

We can access the device in preloader mode with the handshake.py file from aftv2 files link previously but still need to figure out a way to get it booting again. :) its ok i have extra tablets.

More to report soon hopefully along with a full post from [MENTION=4381075]hwmod[/MENTION]

Warning this is very technical and will not be easy to unbrick devices until we can get some bugs worked out.
[Fire Android Development] Awesomeslayerg:
Congrats!! So does this mean soon we can flash partitions and what not correct?
[Fire Android Development] armada786:
Very interesting. Do you know at what step of the preloader you get stuck on? I suppose before it can boot a partition, just wondering where exactly. Also since this is non-production can it be configured to load unsigned images? The preloader description provided earlier seems to suggest it check partitions.
[Fire Android Development] Tomsgt:
When we looked in the update.script that comes with the stock amazon firmware it said that preloader.img is unsecure. We where hoping that once flashed to the partition it would let us boot anything. This wasnt the case since the device will not boot up. Or it could be that this preloader is just looking for a different file / signature then what is on the device now.
[Fire Android Development] hwmod:
These following instructions are for those who have tried writing the "unsecure" version of the "preloader.img".

With this version of the "preloader" It may be possible that now we could use one of the popular flashing tool.

Please try using "SP Flash Tool" first. Then, if that doesn't work, try using this other tool (more technical stuff):

Mediatek DATool (also named "fbtool" or "fastboot" tool)​

following the instruction for the "normal chip" described in paragraph 3.1 of the accompanying README doc.

In the README of the above tool ("fbtool") there are explicit references and different methods for:

"normal chip" (may be the "unsecure preloader.img") and

"secure chip" (may be the "secured preloader_prod.img")

I have attached a revised and updated "MT8127_Android_scatter.txt" file that I first published in post #24.

This "scatter" file is needed to be able to use "SP Flash Tool" or other similar tools.

.:HWMOD:.
[Fire Android Development] Tomsgt:
SP flash Tool returns this Error with the non production preloader.img
[Fire Android Development] hwmod:
I wanted to confirm that it is definitely possible to unconditionally write (non signed code) on any partition except the "preloader". Also it is possible that the same "unbrick" method and partition writes would also work on 5.1.2 and later versions of the FireOS. The "unbrick" thread have been published as I promised, it is a bit technical, prolix and limited by my poor english skills. I hope that with some help some technicality could be smoothed out and some automatism be built to help less skilled users to recover their "bricked" tablets.

.:HWMOD:.
[Fire Android Development] Awesomeslayerg:
I'm guessing we can write a custom recovery partition then,?
[Fire Android Development] Kramar111:
No, it wouldn't work
[Fire Android Development] hwmod:
[MENTION=3497316]retyre[/MENTION] I don't want to seem rude but I know what I need to test and what are my objectives with these test.

I mean ... yes the hack works but it is also useful to make it safe and usable for the majority of users. Do you agree?

By the way all this should work the same also on the HD 10 and other Fire tablets and other devices (Fire TV, FireTV Stick V1, V2 and Basic).

You are correct, by corrupting the 1st stage preloader is enough to enable download mode ([DL]) of the BootROM (the SoC own recovery).

However by zeroing-out other partitions helps understanding other aspects of the environment we work with, the one we want to break.

For example zeroing-out the LK would be easier since that is in the USER_AREA while the PRELOADER is in a hidden area (EMMC_BOOT0).

Actually from my test (only the 7th Gen) I can say that even zeroing-out the LK partition have the same effect, but more testing is needed.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
HD 10 probably the same as the preloader was effectively hidden or taken off the build path once Amazon took over the device. Its fstab path is different from the path its mounted.
[Fire Android Development] bibikalka:
[MENTION=9667509]xyz`[/MENTION], [MENTION=7104332]k4y0z[/MENTION], [MENTION=4381075]hwmod[/MENTION]

Well, I took the corruption idea in a different direction :D

I used these aftv2-tools instructions for Fire HD6 2014:

https://xdaforums.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797

read_mmc.py 0x0780000 0x4000 00.part
read_mmc.py 0x0788000 0x4000 PRO_INFO.part
read_mmc.py 0x0880000 0x4000 PMT.part
read_mmc.py 0x0c80000 0x4000 TEE1.part
read_mmc.py 0x1180000 0x4000 TEE2.part
read_mmc.py 0x1680000 0x4000 UBOOT.part

At first I overwrote UBOOT with zeros. No bootrom, the device would still boot into MTK pre-loader.

Then, I overwrote 00 and PRO_INFO with zeros. And, at this point - there is absolutely no communication! The device does not enter any mode. Just dead, utterly dead! Anyway, just sharing - it is possible to kill the device beyond any measure ! :D

But where is the bootrom ??? I wonder once the battery discharges, will I see the bootrom?

Edit: I checked strings in PMT, and here they are. I am now thinking I overwrote MBR with zeros (what I called "00" above). Perhaps, I should have overwritten PMT with zeroes first ...

1vTPPRELOADER
MBR
PRO_INFO
PMT
TEE1
TEE2
UBOOT
boot
recovery
DKB
MISC
persisbackup
system
cache
userdata
1vTP1TPMPRELOADER
MBR
PRO_INFO
PMT
TEE1
TEE2
UBOOT
boot
recovery
DKB
MISC
persisbackup
system
cache
userdata
1TPM
[Fire Android Development] hwmod:
I don't know all the models. Is the HD6 a phone ?

In such case, probably, you shouldn't have overwritten MBR.

But if you know which is the pad that need to be grounded you should be able to recover.

Also if your phone or tablet has pads named KCOL0 or KCOL1 you can try to short those pads to ground using a 100/200 ohm resistor.

Just trying to give some suggestion, I thought you were trying with Fire 7 tablets like I have.

.:HWMOD:.
[Fire Android Development] bibikalka:
HD6 was the 2014 mtk Amazon tablet, predecessor to "peoples" Fire 7, 2015.

But I do still wonder, could one evoke the bootrom by zeroing out something like PMT? I still have another 2014 fire left!
[Fire Android Development] k4y0z:
Are you sure the 5th gen LK (either the 5.0.1 or the one from 5.6.*) loads on the 7th gen?

If so I might have something to test in a bit then, but it will only work if the 5th gen LK works on the 7th gen.

Yes you are correct, it is hand edited (I changed the unlock_code, since it's device specific :p)

I have had a few issues with the 5.0.1 LK and since it also had the problem of not (reliably) loading the 5.6.* boot-images, I reimplemented it for the newest 5.6.*LK .

So far it works great, and it even sets "androidboot.unlocked_kernel=true" to enable adb-root-shell on stock FireOS (works even with 5.6.3.0).

I will do a bit more testing. And it would still need a patched TWRP to patch the boot-images just like it does for the HD8.

PMT is the GPT/MBR partitioning table.

I'm not sure about PRO_INFO, but if I'd take a guess, it is comparable to the boot1/idme-partition of the fire 7.

It most likely contains device-specific information, such as MAC-addresses and serialnumbers.

I hope you have a backup, If not it might be possible to copy from another device and either modify or have 2 tables with the same info.
[Fire Android Development] bibikalka:
Oh, I do have a back up. But unfortunately, the tablet is utterly dead - no reaction when I plug it into USB. No preloader, no bootrom, nothing ! So I cannot write my backups back ... :( I guess MBR is not to be messed with ...
[Fire Android Development] k4y0z:
Bootrom should still work, even if you overwrote the whole EMMC.

Actually what shorting the pins does, it prohibits access to the EMMC.

What device is this? Fire HD 6 (2014)? According to https://developer.amazon.com/docs/f....html#device-specifications-2014-2015-devices it uses MT8135. AFAIK there is no bootrom-exploit for it yet. Also not sure if it is known what pins to short.
[Fire Android Development] bibikalka:
Ok. But since emmc is now utterly useless - should not it kick into the bottom mode? It's kind of like killing the preloader partition that was reported here. The trouble is i am not seeing any electrical signs of life via usb. Perhaps, I need to disconnect the battery? I have seen some mtk chipsets enter the download mode only when the battery disconnected.

If I got to a bootrom - that'd be something good!
[Fire Android Development] DragonFire1024:
On the HD 10, pro info is empty, or filled with zeros. If you are referring to idme type stuff, it's in the hidden bootloader in the 10.
[Fire Android Development] k4y0z:
Well, maybe it's not useless enough :rolleyes:

You could check if there is still anything on the serial.

You can use a "Mediatek-Debug"-cable for that http://www.stevenhoneyman.co.uk/2014/11/mtk-mediatek-debug-cable.html

It doesn't have to be as sophisticated, and no need to solder.

Also trying to disconnect the battery might help.
[Fire Android Development] DragonFire1024:
So I have managed to find a way to modify an Amazon boot image, however for a much earlier tablet, the 8.9 Jem. The image flashes and holds, but it took some time. It's not a mediatek device, but if we can get a proper device tree, we could probably apply this teqnique to present day devices. Here is what happens when we try to modify an Amazon boot.img

Now this was all done by that xda member to get magisk to work. So I applied the same method to just patch the boot.img aka cmdline and default.prop. And it worked. And the modified image holds. I've only just got this working and haven't even gotten to a point where I can try it on an 7, 8 or 10. I can work on this if it's feasible, but I need some advice and instructions. First I need a device tree and the proper files.

Link is below. It's better you read it because I barely grasp any of it.

https://xdaforums.com/kindle-fire-hd/8-9-inch-help/magisk-poc-boot-img-3-19-18-los-14-1-t3770638
[Fire Android Development] bibikalka:
Oh yes, it's possible to read uart output on fire 7 2015 with this cable. But, it requires a working preloader - and I nuked it! I need to somehow make it talk again.
[Fire Android Development] DragonFire1024:
Ok so I finally got magisk to work with zero errors on the 8.9 using the patch method above. I've also set the cmdline in that boot.img to include androidboot.unlocked_kernel=true. And guess what, the system property lists it as ro.unlocked_kernel=true. Epic win. I have to look for it again, but between this thread and the other I talked about a boot.img unpacker tool 'Android...something or other. Does anyone remember me talking about that tool? I don't have it anymore and it would save me a vast amount of searching if someone finds it before me.
[Fire Android Development] k4y0z:
The device should definitely enter Boot-Rom if you nuked preloader.

Also there should be UART-output even before the preloader I believe.
[Fire Android Development] hwmod:
Yes ... the [DL] mode are always the first string appearing in the console when no access to EMMC. I also tried a PCB with removed EMMC chip, it still works and enters download mode.

[MENTION=7104332]k4y0z[/MENTION] when I said that everything we tried on 5th Gen did also work for the 7th Gen I was referring to the hack and methods you and [MENTION=9667509]xyz`[/MENTION] found not the LITTLE KERNEL (UBOOT).

The reason it will not work as is, are related to different certificates and/or signatures and hashes. Actually I did a couple of test and grabbed the UART logs for you to analyze.

The 7th Gen tablet loads the "LK" correctly and executes it too, the problem are those outlined above. By using the 5th Gen 5.0.1 original preloader on a 7th Gen tablet we get:

- in the case of the 5.0.1 LK it fails the signature match

- in the case of the 5.4.0 LK it fails the decoding

I attached the two UART log so you can see what happens in both cases.

One thing I wish to suggest is that I find extremely useful having two connection with the tablet, one through the normal USB and a second one through the RX/TX UART pads on the PCB.

This makes it easy to have control of each operation performed through the USB, the volume buttons, the "pin shorting" and the likes, I couldn't do without these tools.

.:HWMOD:.
[Fire Android Development] xyz`:
I've read your previous post but don't see where you nuke the preloader. I think what could happen is that the preloader's loading fine, but panics early (before the preloader download mode is initialized) because you zeroed out the gpt. Either way, I don't believe it's possible to brick the bootrom short of writing garbage into efuses (provided they are not locked).
[Fire Android Development] k4y0z:
The first log looks promising, as long as LK loads, with the hack it won't matter if the boot-image is signed correctly.

Please test with the 5.6.3.0 LK, as that's the one I am currently exploiting.

Yes, that's right, but sadly I ripped off my RX/TX-pads, so I have to switch cables every time :/
[Fire Android Development] hwmod:
OK ! Here are the two logs you have requested testing both 5th Gen and 7th Gen version

of the oldest "PL" from version 5.0.1 and the "LK" from version 5.6.3 (most recent version).

The failures of these two test are due to the same reasons as the two previous tests.

The signature mismatch for the 5th Gen and the failed decoding for the 7th Gen.

However, as you said, they will pass once payloads and hacks are set in place.

Is there something working that I can already try even if only for the 5th Gen tablet ?

.:HWMOD:.
[Fire Android Development] k4y0z:
What exactly are you testing? On the 5th gen I know it works with the 5.0.1 preloader and the 5.6.3 LK (both from 5th gen).

On the 7th gen we'd need a combination that at least loads LK.

Which preloader did you test on the 7th gen?

Please test the 7th gen with 5th gen preloader (start with 5.0.1, but try newer ones if that fails) and 5th gen LK (5.6.3)

EDIT:

Wait, so the 5.0.1 from 5th gen together with LK 5.6.3 from 5th gen give you

?
[Fire Android Development] hwmod:
That's what I did ... preloader from 5.0.1 and lk from 5.6.3 both of a 5th Gen tablet used on a 7th Gen tablet.

However, to be sure, I will recheck tomorrow since it's 5:00 in the night here and being tired I might have screwed up some tests.

.:HWMOD:.
[Fire Android Development] diplomatic:
You can't use BL images from another model. Every model has its own set of signing keys.
[Fire Android Development] wolf45801:
Haven't been here for a little anymore progress with the 7th gen fires with TWRP or root
[Fire Android Development] Rortiz2:
No.

Only we have the stock recovery.img and we know the bootrom point.

hwmod has discovered that you can flash the lk of 5.0.1 and boot in TWRP but there are problems with the touch and the screen which I recommend you to wait and not fvck the tablet like me.
[Fire Android Development] wolf45801:
Ok yeah it's my daughter's tablet so I'll be waiting lol
[Fire Android Development] k4y0z:
I have an LK-exploit for the 5th gen 5.6.3 LK, so if that boots, signatures of the boot-images won't matter ;)
[MENTION=4381075]hwmod[/MENTION] check your inbox.
[Fire Android Development] k4y0z:
Making some progress :)
[Fire Android Development] Rortiz2:
Wow! :D

Any progress for the 7th gen? :( :crying:
[Fire Android Development] k4y0z:
Sorry, I don't have a 7th gen to test, but [MENTION=4381075]hwmod[/MENTION] is testing and it looks promising.

But for the 5th gen I will have something for you guys in a bit.
[Fire Android Development] k4y0z:
OK, for anyone willing to test on a 5th gen, I have a preview for you.

bootrom-step.sh will bring you into a hacked fastboot.

fastboot-step.sh will flash TWRP and reboot into it.

After this you should already be able to get an adb root shell.

If you want complete root, you can install Magisk from TWRP.

Only ever install boot-images using TWRP, don't use Magisk-manager to update/install.

This will not disable OTA, you will have to do that yourself

This is a preview only, but I didn't find any issues, if I get back a few positive reports, I will create a separate thread with a complete guide.
[Fire Android Development] diplomatic:
Right...the LK exploit only removes the need for boot/recovery image signatures. But like in a normal BL unlock, all the prior BL stages still need to be verified: preloader, LK, & TZ. So you still can't use LK/PL images from a different device.
[Fire Android Development] k4y0z:
The test [MENTION=4381075]hwmod[/MENTION] did here seems to suggest differently.

It looks like preloader and LK from the 5th gen boot up fine on the 7th gen (albeit without display-support).

And then fail verifying the boot-image.
[Fire Android Development] diplomatic:
Actually, yeah, that may be true. I just checked the firmware from the 5th gen and compared it to 7th gen. They do use the same preloader key, as does the whole HD8 series. But I might have been at least partially right: the LK signing key may be different. There was no preloader img in the 5th gen pkg, so I couldn't check that. But I compared the 6th to 7th and 8th. The 6th and 7th seem to be using the same LK key, but the 8th gen has a different one. So it's possible that the 5th gen might be different too. So if you're going to try a different PL image, you probably have to flash a corresponding LK too.

Carry on.... :)
[Fire Android Development] k4y0z:
There should be a preloader_prod.img in the 5th gen package.

You are correct about the LK being signed differently, that's what [MENTION=4381075]hwmod[/MENTION]s other test suggests (5th gen preloader and 7th gen LK).

So preloader and LK should always come from the same device.
[Fire Android Development] diplomatic:
Oh wth, Amazon's download link is wrong. It points to the HD10 package. And I already had the Ford package on my computer. I just checked and yes, it does have its own LK key. But oddly enough, there's something strange with the preloader key. It looks different than the 7th gen. But then how does the 7th gen PL boot up? Maybe it's just encoded differently somehow...

EDIT: Nevermind.... I thought you guys were working on the HD8. And I got the code names mixed up. Ford is a Fire 7, not an HD 8, duh. It also made no sense to have the 7th gen preloader working on the 5th gen HD8, because they have different chips!
[Fire Android Development] hwmod:
A quick reply .. wow that was too much [MENTION=7104332]k4y0z[/MENTION], everything in one shot ! Almost complete.

First of all I should say that I didn't need to crack open the case nor in the 5th Gen and

neither in the 7th Gen tablets , pressing the left volume button while plugging the USB

cable was enough on both models. That's the first surprise (it might have been due to

the previous state of both my tablets, needs more investigation).

Many things seems to work well on almost all fronts, things that didn't work in previous

test are now working. There are glitches here and there but they were expected since

you don't have a 7th Gen, so you are working blindly on it.

The biggest surprise was seeing the 5th Gen preview you released working also

on the 7th Gen tablet. On the 5th Gen I have the "fire" orange animation looping forever.

I still have no video signal on 7th Gen but now from the TWRP shell I can see all the EMMC partitions that

were not visible previously, so we can write different "boot.img" and other partitionss to find the best fit.

That's all for now, I will test and write more tomorrow, it is already late here.

Once more, congratulations goes to [MENTION=7104332]k4y0z[/MENTION] for the efforts and the time he spent on this.

Have fun,

.:HWMOD:.
[Fire Android Development] k4y0z:
Thats awesome, I assume that's because of the 5.0.1 preloader.

it flashes the boot-image from the 5.6.3 firmware, maybe that's incompatible with the system you are currently using.

Did you test the boot-image I sent you for the 7th gen?

I was hoping it gives you video.

That would mean only in fastboot, you don't have display. (TWRP would just need to be rebuilt with the right kernel).
[Fire Android Development] DragonFire1024:
You can use magisk to update or patch the boot images if we can repatch the patch. Does anyone read my links or are they ignored?

---------- Post added at 05:02 AM ---------- Previous post was at 04:37 AM ----------

I'm thinking if we have the proper files, we can easily adapt this method to present day Amazon tablets. I used this method to instead patch the image after *I* made edits to it. So I edit the ram disk and cmdline and, repack and rename it to patched_boot.img and run the commands in the thread below and you can have a custom img. I need help on what two files I need to make this happen on the 10 and where I may be able to look for them. https://xdaforums.com/kindle-fire-hd/8-9-inch-help/magisk-poc-boot-img-3-19-18-los-14-1-t3770638
[Fire Android Development] hwmod:
No display in general, neither in fastboot mode nor in TWRP nor in normal Android, only the back-light is on, the rest is off.

Yes I tried to change that boot-image after the "bootrom-step.sh" process but no video either

and a new problem appears in that the Linux kernel seems to crash and reboot continuously.

Up to now the original 5.6.1 boot.img you packed in the preview is the one

that gives the most results, not yet complete but on the way to success.

TTY tomorrow.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
The errors we get when unpacking or repacking an Amazon boot image is the same one you get when editing the image from the 8.9. error at magic header (exact wording is off as I don't have the device in front of me right now). So theoretically the same principal to patch the patch, would work on other Amazon tablets provided the setup is in order.
[Fire Android Development] Rortiz2:
Nice!

I guess the lk.bin has been patched up?

Why can not patch Austin's lk.bin?
[Fire Android Development] blakegriplingph:
So, can anyone summarise what has happened lately? Like, can we use SP Flash Tool on this now or is there still any roadblocks to take care of?
[Fire Android Development] DragonFire1024:
Exploit found for mediatek devices. All mediatek devices, but found first on the HD 8. So far there have been issues applying it to various fire 7s. The HD 10 is effected. I can get it to where the exploit can be pushed, but there allegedly isn't one for it yet. Exploits makes the bootloader think it's unlocked effective unlocking it. However there are still restrictions. We've had trouble flashing the system partitions on the HD 10. There are one or two reports of the same issue on the HD 8, even with TWRP. You can't flash a custom boot.img yet but if anyone would listen to me for a second, we may have a way to fix that that.
[Fire Android Development] thoughtlesskyle:
So if what I am seeing is correct the fire 7's bootloader has been compromised (further testing needed it looks like)

Next is an installable twrp correct?

Then we can flash all the normal partitions as usual?