yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] k4y0z:
I posted a preview a few posts back.

It includes flashable TWRP 3.2.3-0.

It's only for the 5th gen.

It partially works on the 7th gen, but no screen-support.
[Fire Android Development] k4y0z:
Could you test with the attached lk-payload with both boot-images?

This payload forces uart-logging of the kernel, so we can see, why the patched 7th-gen boot-img doesn't work.

I assume the display must be initialized by the bootloader :/

You could also try different tz-versions.
[Fire Android Development] mateo121212:
could twrp be used to sideload supersu system mode root? then re flash 7th gen PL,LK,boot.img and reovery?

setting up VM now to test the idea if i can.
[Fire Android Development] Rortiz2:
Its not a bad idea. BTW: Don't use VM, use live usb.
[Fire Android Development] k4y0z:
I suppose it could, as long as the 7th gen doesn't have dm-verity enabled.

You get an adb-root shell in TWRP.
[Fire Android Development] mateo121212:
thanks for the info.
[Fire Android Development] blakegriplingph:
I see. Can this exploit be potentially used to disable the signature enforcement on SP Flash Tool images whenever you flash scatter packages onto a device? I either have to sign them or use SP Flash Tool 5.1532 just to bypass enforcement.

Also, do you by any chance know about sbchk? That seems to have some connection to boot-time signature enforcement.
[Fire Android Development] mateo121212:
I was able to get root and there isn't dm-verity.
[Fire Android Development] wolf45801:
So you was able to get root on the 7th gen? Could you tell me how you did it
[Fire Android Development] mateo121212:
I Saw this:

Then I had this idea:

After I got to twrp I pushed su 2.82 sr5 to sd card using adb Then using the twrp commands in adb I installed the zip

I made a second copy of amonet folder and edited main.py to only flash 7th gen 5.6.3.0 preloader,lk,tz and boot

I rebooted into brom mode and flashed preloader,lk,tz,boot. Rebooted into a working root.

I have not fixed my recovery yet. I read someone got the 7th gen recovery. Once I find that I will try to flash with Flashfire so I will have working recovery

EDIT: if I get the recovery I will write something up for this. Unless they figure out the issues for the 7th gen. Then this would be pointless.
[Fire Android Development] thoughtlesskyle:
so for some reason I can't get into the bootrom mode

when I hold the left volume button while plugging it in it takes me to recovery, holding the right one takes me to fastboot

I can boot twrp via fastboot so I have to be close if not exactly on the right preloader version

any ideas?
[Fire Android Development] Rortiz2:
Can you make a little guide please?
[Fire Android Development] mateo121212:
Right now my bl files are 5.6.3.0 and my system is 5.6.3.2 without a working recovery. If your cool with starting from scratch to get to twrp if u mess up and bootloop or something. I probly could write something up later when I collect the info and files together.
[Fire Android Development] Rortiz2:
The only thing I want is root. Can you explain me how to recover the stock bl and preloader of the 7th gen.

Enviado desde mi Mi A2 mediante Tapatalk
[Fire Android Development] mateo121212:
I will make a guide when I get the chance to get the files and commands used together. I had to use twrp over adb to push and install root since sideload requires the screen. I will end up attaching the modified amonet files that will help you revert back.

I will start from the beginning in the guide.
[Fire Android Development] k4y0z:
You don't have to edit main.py, you can just replace the files.

On my 5th gen recovery is automatically restored on the first boot with an unpatched boot img.

You can actually start sideload using

adb shell twrp sideload

find more interesting options using

adb shell twrp

Note: Don't use the twrp commands for anything that changes boot-partition, since this TWRP-version is designed to work with the exploit, and will patch them accordingly.

You can instead use dd if you wish.

Have you disabled modemmanager and have you tried using sudo?
[Fire Android Development] DragonFire1024:
When I get home today I'm going to uploaded my mediatek img kit. Now that some of you have TWRP and are working on other things, this may be handy. It contains everything you need to make a mtk factory image for the whole thing. The templates are of course for the mt8173, but the scripts to create and sign images should be universal and if not should only require slight modifications to adapt to your tablets. This kit creates mediatek stock images not ones that's are generically signed by your own signatures.
[Fire Android Development] mateo121212:
1.

i edited main.py to make a script that just reflashed partitions back to stock. i commented out lk-payloader, renamed preloader.bin in main.py to preloader.img to match what is available, i also edited the microloader entry to install regular unpatched boot.img instead. once i have recovery it can be flashed in this manner also leaving a clean system. is it allright if add the modded files to the guide im writing up?

2.

When i attepmt to boot recovery no matter how menny times ive booted into the system the recovery is still hanging on the amazon logo and rebooting to system. tried with adb and button combo.

3.

i tried that method and things went wonky. easier option is to put su on internal storage before you start and use

adb shell twrp install /sdcard/su.zip

didnt plan ahead and had to push it instead

thank you k4y0z for your hard work!
[Fire Android Development] k4y0z:
You could also reflash boot in in fastboot-step before rebooting to recovery, that would be much quicker.

Just replace the boot.img that is already there.

Sure, if it's just the modified files, or wait for the release.

recovery-image should be created by /system/bin/install-recovery.sh.

If it isn't, your boot-image probably doesn't match the system-image. (Since it's created from the boot-image)
[Fire Android Development] mateo121212:
i was under the impression if i did that twrp would patch it and mess it up while installing SU. i seem to remeber seeing that it patched the boot.img every time it flashes anything if i flash the 7th gen boot b4 the recovery. EDIT: recover was hosed by system mode root. Figured out how to fix.

i also couldnt get fastboot to recognize after restoring everything but boot. the edited main.py in amonet folder removes the fastboot step compleatly. it takes less than 5 mins to flash boot.img using main.py

1st method, 5th gen amonet preview folder with edited bin folder and edited main.py

or

2nd method, just give em bin folder and main.py to put into a copy of amonet

probably the case. my system is 5.6.3.2 where as the BOOT/PL/LK/TZ is from 5.6.3.0 as that was the newest set i could find handy to do the job tonight.
[Fire Android Development] Rortiz2:
Can you share the edited amonet? Thanks.

Enviado desde mi MI A2 mediante Tapatalk.
[Fire Android Development] mateo121212:
sent a pm
[Fire Android Development] Rortiz2:
Thanks!

Enviado desde mi Mi A2 mediante Tapatalk
[Fire Android Development] DragonFire1024:
Wait so if in bootrom, you can bypass enforcement on that version? If that's the case, I have a scatter file for the HD 10. The only reason sp doesn't do anything for me is because I get that warning when I try to download. So theoretically I could flash recovery if that enforcement is bypassed?

When you sign the imgs, what do you use? I have a factory kit for the mt8173 (HD 10 has this) and contains everything from templates to imgs or ways to sign and make them.
[Fire Android Development] blakegriplingph:
I am actually referring to the LeapFrog Epic running off an MT8127 with some secure boot functionality built in. SP Flash Tool spews out an error if I flash an unsigned image to it, specifically 6045 saying the images being flashed lacks the necessary header. I could remedy that by signing them images using the tool [MENTION=8132642]diplomatic[/MENTION] provided, but that more or less adds to the hassle. Add to the fact that the image signatures are being checked on tablet bootup from what I can tell.
[Fire Android Development] k4y0z:
Yes correct, TWRP would patch the image, but you can flash boot.img in fastboot mode.

Just reboot normally after you have flashed SuperSU in TWRP.

It should go into hacked fastboot because microloader is still flashed (Don't press any button combo).

Then from hacked fastboot you can flash boot/recovery images, and then again do bootrom-step with the 7th gen files (Only preloader, tz, lk).

I think I'd prefer option 2, then you can link to the thread and people get the newest files.

Here is the release:

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860/

[MENTION=6568249]mateo121212[/MENTION] I have also added a function dump_binary in main.py. you could use this to dump original boot.img before flashing microloader into it, and then restore it in fastboot-step.
[Fire Android Development] mateo121212:
Thank you. I will adapt root method for new files. I have not been able to get it to reboot to fastboot after twrp. With previous files.Will check if anything's changed in that regard. I have had to do button combos or re-shorting the point.
[Fire Android Development] k4y0z:
I have attached a TWRP, that will not patch the boot/recovery-images for use with the 7th gen.

EDIT:

Updated twrp-nopatch to work with version 1.2 of the unlock-package.

Also included shell command reboot-amonet to reboot into hacked fastboot.
[Fire Android Development] mateo121212:
Thank you. Will play around with it tomorrow going to bed for the night.

That twrp can't flash all partitions right?
[Fire Android Development] k4y0z:
You should be able to flash all partitions using adb shell.

To flash boot0 (preloader) You may have to:

echo "0" > /sys/block/mmcblk0boot0/force_ro

You can't reset RPMB from TWRP though.
[Fire Android Development] k4y0z:
I have also attached 7th gen 5.6.3.0 recovery.img created from 5.6.3.0 boot.img.
[Fire Android Development] hwmod:
Why not ? Isn't that enough to zero it out with `dd if=/dev/zero of=/dev/block/mmcblk0rpmb` ?

I am surely missing something here.

.:HWMOD:.
[Fire Android Development] k4y0z:
That won't work. you can't access the RPMB from TWRP.

Try reading it out, it will not contain what you would expect.
[Fire Android Development] thoughtlesskyle:
Can somebody post a screenshot or picture of what the tablet looks like on Bootrom mode
[Fire Android Development] k4y0z:
It looks like a powered off tablet :D

Check here to see how to detect it using lsusb or dmesg
[Fire Android Development] DragonFire1024:
here are links to the MediaTek Kit I have been talking about. sorry it took so long. Included are blank img templates, scripts to make boot.img, signing scripts. Some of the other stuff is only good for mt8173 (HD 10), but hopefully you guys can adapt it to your tablets.

evb-utils-master: https://drive.google.com/file/d/1i_xcl1RQwHJVLBvX3uDVFlcddcaLp8mf/view?usp=sharing
[Fire Android Development] thoughtlesskyle:
Yeah I was doing it slightly wrong, I needed to sudo and then run the script before I plugged it in holding volume down. Worked like a charm
[Fire Android Development] DragonFire1024:
Not that it makes too much of a difference, but I found some shell commands to make selinux permissive straight at boot by using su.d and all you need is root. just open a terminal, make sure to su, and copy and paste each of the lines below, hitting enter after each one:

su
mount -o remount,rw /system
mkdir /system/su.d
echo "#!/system/bin/sh" > /system/su.d/permissive.sh
echo "setenforce 0" > /system/su.d/permissive.sh
echo "0" > /sys/fs/selinux/enforce
chmod 755 /system/su.d/permissive.sh

I actually thought this was pretty neat. https://xdaforums.com/showpost.php?p=59026701&postcount=11
[Fire Android Development] k4y0z:
FYI: There is now also unlock for the 7th gen in addition to the 5th gen: https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] DragonFire1024:
Well this may or may not be anything. A few months ago I discovered a booleans in /sys/fs/selinux/booleans called 'device_unlocked'. You can set the bool, but the value persists to 'off' (of course) when you reboot. In a terminal:

su
setsebool device_unlocked on
getsebool device_unlocked
on

Reboot and it will be set to 'off'. Well thanks to the su.d shell commands/script I found here on xda, I can now make that persists on reboot. In a terminal:

su
mount -o remount,rw /system
mkdir /system/su.d
echo "#!/system/bin/sh" > /system/su.d/unlocked.sh
echo "setsebool device_unlocked on" > /system/su.d/unlocked.sh
echo "on" > /sys/fs/selinux/booleans/device_unlocked
chmod 755 /system/su.d/unlocked.sh

No need to reboot. Now the question is...what is it?
[Fire Android Development] DragonFire1024:
Now this is most interesting. I believe we may have something here:
[Fire Android Development] DragonFire1024:
Some of the values in that screen shot seem to change after rebooting.
[Fire Android Development] DragonFire1024:
Been playing around in proc. I love cat. I may have some new info I have no idea. So far I've been able to get results from almost every 'cat /proc/xxx' I've done so far. I was under the assumption these files contained nothing. They contain a lot of stuff much of which I don't understand. To be honest I didn't even know you could do this.
[Fire Android Development] DragonFire1024:
u0_a32@suez:/ $ cat /proc/boot_mode
MTK BOOT MODE : NORMAL BOOT
u0_a32@suez:/ $

Also found 'mtk_kpd' as see in the numerous commands in various binaries. It's in /proc/bus/input/devices.

---------- Post added at 07:48 AM ---------- Previous post was at 07:17 AM ----------

Been seeing this in the logs.

u0_a32@suez:/ $ su
root@suez:/ # cat /proc/last_kmsg
ram console header, hw_status: 0, fiq step 0.
header may be corrupted, dump the raw buffer for reference only
DBGC@@[LAST PC] CORE_0 PC = 0x0( + 0x0), FP = 0x0, SP = 0x0
[LAST PC] CORE_1 PC = 0x0( + 0x0), FP = 0x0, SP = 0x0
[LAST PC] CORE_2 PC = 0x100000000802100 ( + 0x0)
[LAST PC] CORE_3 PC = 0x402000000000008 ( + 0x0)

deepidle status = 0x0
root@suez:/ #

I have been seeing a lot of zeros. But that could be because of my selinux scripts.

---------- Post added at 08:34 AM ---------- Previous post was at 07:48 AM ----------

Well this may not be the whole puzzle but bits and pieces are coming together. There was always a few lines in the binaries talking about a key combination to set off a panic that would rebooting the device into the given provided mode. cat proc provides both. Clear as day. What boot mode would specify bootrom/download or factory?

su
idme bootmode xxx

Then according to proc, if you hold those three keys down, the device will panic into the mode set for whatever we set it.

cat /proc/device-tree/keypanic/keys_down
KEY_VOLUMEDOWN
KEY_VOLUMEUP
KEY_POWER
cat /proc/device-tree/keypanic/compatible
amzn

This is just the tip of the iceberg. Im going to do a dump and I think you'll be very pleased. There's a lot of hex code here and a lot of modes and various oddities.
[Fire Android Development] hwmod:
You can read more about the BOOT MODE and the list of allowed/known values here: MediaTek details: Partitions and Preloader

I already linked these document long time ago, the developer has published two other interesting documents on Mediatek SoC and hardware.

You can find the other links by following in the same page of the link I sent here above or in some of my old post.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
I really wish we knew or had a way to find out what device_unlocked does in /sys/fs/selinux/booleans. My script persists it in the on position even across reboots. Anyways I am convinced there is a way to get into brom mode without opening up the tablet.

Edit: using the same script, I can also set selinux to permissive and it will persist across reboots. From what I can tell they both persist permanently. The only log entries I have if them are when the variable was initially changed with the script.
[Fire Android Development] blakegriplingph:
Think you have one for the MT8127 though? I'd like to see if it's possible to hack fastboot and sbchk on my LeapFrog Epic.
[Fire Android Development] DragonFire1024:
No sorry. I can't even recall how I managed to find this one.
[Fire Android Development] DragonFire1024:
Edit: never mind.

Ok so might have gone about device_unlocked the wrong way. According to various papers, the values for selinux booleans are different between Android and Linux, but mean the same thing.

Linux: selinux bool values - on/off

Android: selinux bool values - true/false

Let's say device_unlocked means what we want it to mean. Maybe part of the reason we don't really see anything beyond a single log entry is because instead of on/off the value should be true/false?
[Fire Android Development] DragonFire1024:
These are new numbers. At least I've never seen them.

u0_a32@suez:/ $ cat /proc/chip/info
hw_code : 8172 (8172)
hw_subcode : 8A00 (8a00)
hw_ver : CB00 (cb00)
sw_ver : 0003 (0003)
reg : 8172 8A00 CB00 0101
u0_a32@suez:/ $

Hold on...8172?!?!

---------- Post added at 09:28 AM ---------- Previous post was at 08:58 AM ----------

Found the evasive mtk_kpd.

u0_a32@suez:/ $ cd /proc/device-tree/soc/keypad@10010000
u0_a32@suez:/proc/device-tree/soc/keypad@10010000 $ su
root@suez:/sys/firmware/devicetree/base/soc/keypad@10010000 # ls
clock-names
clocks
compatible
interrupts
mediatek,kpd-hw-dl-key0
mediatek,kpd-hw-dl-key1
mediatek,kpd-hw-dl-key2
mediatek,kpd-hw-factory-key
mediatek,kpd-hw-init-map
mediatek,kpd-hw-map-num
mediatek,kpd-hw-pwrkey
mediatek,kpd-hw-recovery-key
mediatek,kpd-key-debounce
mediatek,kpd-pwkey-gpio-din
mediatek,kpd-pwrkey-eint-gpio
mediatek,kpd-sw-pwrkey
mediatek,kpd-use-extend-type
name
reg
root@suez:/sys/firmware/devicetree/base/soc/keypad@10010000 #

None of them return any values when doing a cat.
[Fire Android Development] DragonFire1024:
And here we go. /dev/input/event1. Very bottom. mtk-kpd.

root@suez:/ # getevent -lp
add device 1: /dev/input/event7
name: "amazon_touch"
events:
KEY (0001): BTN_TOUCH
ABS (0003): ABS_PRESSURE : value 0, min 0, max 4095, fuzz 0, flat 0, resolution 0
ABS_MT_TOUCH_MAJOR : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
ABS_MT_WIDTH_MAJOR : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
ABS_MT_POSITION_X : value 0, min 0, max 1199, fuzz 0, flat 0, resolution 0
ABS_MT_POSITION_Y : value 0, min 0, max 1919, fuzz 0, flat 0, resolution 0
ABS_MT_TRACKING_ID : value 0, min 0, max 0, fuzz 0, flat 0, resolution 0
input props:
<none>
add device 2: /dev/input/event6
name: "mtk-tpd"
events:
KEY (0001): BTN_TOUCH
ABS (0003): ABS_X : value 0, min 0, max 1200, fuzz 0, flat 0, resolution 1200
ABS_Y : value 0, min 0, max 1920, fuzz 0, flat 0, resolution 1920
ABS_PRESSURE : value 0, min 0, max 255, fuzz 0, flat 0, resolution 0
ABS_MT_SLOT : value 0, min 0, max 9, fuzz 0, flat 0, resolution 0
ABS_MT_TOUCH_MAJOR : value 0, min 0, max 100, fuzz 0, flat 0, resolution 0
ABS_MT_TOUCH_MINOR : value 0, min 0, max 100, fuzz 0, flat 0, resolution 0
ABS_MT_POSITION_X : value 0, min 0, max 1200, fuzz 0, flat 0, resolution 0
ABS_MT_POSITION_Y : value 0, min 0, max 1920, fuzz 0, flat 0, resolution 0
ABS_MT_TRACKING_ID : value 0, min 0, max 10, fuzz 0, flat 0, resolution 0
ABS_MT_PRESSURE : value 0, min 0, max 255, fuzz 0, flat 0, resolution 0
input props:
INPUT_PROP_DIRECT
add device 3: /dev/input/event5
name: "m_acc_input"
events:
REL (0002): REL_X REL_HWHEEL REL_DIAL
ABS (0003): ABS_X : value 76, min -32768, max 32767, fuzz 0, flat 0, resolution 0
ABS_Y : value 229, min -32768, max 32767, fuzz 0, flat 0, resolution 0
ABS_Z : value 9864, min -32768, max 32767, fuzz 0, flat 0, resolution 0
ABS_WHEEL : value 2, min 0, max 64, fuzz 0, flat 0, resolution 0
input props:
<none>
add device 4: /dev/input/event4
name: "m_alsps_input"
events:
REL (0002): REL_Y REL_Z
ABS (0003): ABS_X : value 191, min -32768, max 32767, fuzz 0, flat 0, resolution 0
ABS_WHEEL : value 2, min 0, max 64, fuzz 0, flat 0, resolution 0
input props:
<none>
add device 5: /dev/input/event3
name: "hwmdata"
events:
REL (0002): REL_Y REL_Z
input props:
<none>
add device 6: /dev/input/event2
name: "hall_sensors"
events:
SW (0005): SW_LID
input props:
<none>
add device 7: /dev/input/event0
name: "ACCDET"
events:
KEY (0001): KEY_VOLUMEDOWN KEY_VOLUMEUP KEY_HANGEUL KEY_NEXTSONG
KEY_PLAYPAUSE KEY_PREVIOUSSONG KEY_STOPCD KEY_SEND
input props:
<none>
add device 8: /dev/input/event1
name: "mtk-kpd"
events:
KEY (0001): KEY_VOLUMEDOWN KEY_VOLUMEUP KEY_POWER
input props:
<none>
root@suez:/ #
[Fire Android Development] DragonFire1024:
Reading all I can for the next few hours, it looks like dlmode is possible without poking around the tablet but would also require root access. I'm pretty sure it requires modifying the values of the hardware keys with a hex editor to replace mediateks stock hardware keys and may require installing a driver. I'm hoping if will be easier than that.
[Fire Android Development] k4y0z:
Getting into bootrom when you already have ROOT is easy, you just have to brick the preloader...
[Fire Android Development] Rortiz2:
Yes. Just use this command:

adb Shell su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro; cat /dev/zero > /dev/block/mmcblk0boot0; echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0"
[Fire Android Development] DragonFire1024:
Great. But I am trying to do this to try and get an unlock without causing more damage than needed. if I brick the tablet it gets me no where. My point is I'm pretty sure you don't have to brick anything to get there. Without an unlock yet it seems pretty pointless to keep bricking myself.

Edit: I'll write more later about this, but is it normal for ro.bootmode to be running as a system_server/service?
[Fire Android Development] Rortiz2:
I don't know. If you want i can check It on my fire 7.
[Fire Android Development] DragonFire1024:
Going to need a special tool to get the data and root to use it. This tool tries to extract data from the memory of processes and dumps it in the form of a bin. Just download the binary https://github.com/friendlyJLee/pmdump/blob/master/pmdump_prebuilt_bin/pmdump.android.arm , place it in /data/local and give it rwxr-xr-x.

Open a terminal, CD to /data/local and su.

Usage:

The data will be saved as a bin in data/local. You can just open it on a text editor. The scrambled text is nothing. Be warned though. You're going to be mad when you realize exactly how much personal data Amazon is collecting on you and what they know. After all I've seen and done with these tablets, even I was floored.

When are setup, in a terminal do 'ps' and you'll see the processes. You want system_service or system_server (it's one of the two). You will have to open it on your PC in like notepad++ and search for ro.bootmode. I literally found it on accident when I stopped in between a fast random scroll and there it was.
[Fire Android Development] Rortiz2:
Ok, so I copied the file to data/local and set the correct permissions.

Now what command I have to execute?

PS: I am on lineage. There's any problem?
[Fire Android Development] DragonFire1024:
Open terminal emulator in Data/local. Run ps. Look for system_service. Note the PID and then:

./pmdump --raw <PID number>

Then look in data/local for the file and put it on pc, open in notepad++. Search for ro.bootmode.