yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] DragonFire1024:
The HD 10 has a hidden bootloader. There is LK and LK2 according to the build files. All partition line up except for LK2, which was moved after the build, and is mounted as a different partition that doesn't identify it as a LK. I narrowed it down and was able to determine where it was. I don't know if you recall the old 8.9 amazon tablets. They had a bootloader titled 'beefdeed'. (Yes it's true Google it. There are only 2 or 3 results). HD 10 has 'beefdeed2'. I don't think it's a coincidence. And I don't think it's a coincidence both tablets were rooted, though the 8.9 eventually got TWRP. My point is, and do correct me if I am wrong, but the 'dd' command not only pulls but writes, so it's it wrong to say if it can't write it won't pull?
[Fire Android Development] k4y0z:
beefdeed2 are the magic bytes for the idme-partition and contains some device-specific information such as MAC-addresses and serial-number.

It resides in /dev/block/mmcblk0boot1 (mmcblk0boot0 is the preloader).

The data can be printed using (needs root)

idme print

Yes, dd works both ways. (if = input file, of = output file), some devices may be read-only.
[Fire Android Development] Rortiz2:
In windows 10 64bits:

handshake2.py FACTFACT

Worked. Of course you need to download phython for windows.
[Fire Android Development] DragonFire1024:
Correct on all accounts. However the build file specifies mmcblk0boot1 as being just LK2. I've posted it a few times in this thread. If I recall correctly, the mmcblk0boot1 contained that and a quite a bit more. I will have to take a look at it again but if I'm thinking of the same thing, there are commands in there.

Edit: so we won't know if it's writable until we try? So let's assume it is for a moment. If we can edit that information from doing a dd, we can write an unlock code to it. Or change other information such as the flags, specifically fos_flags. I think fos_flags with the correct corresponding values will make adb root permanently if they are set right. However I think for fos_flags to work properly, the files related to them need deodexed.
[Fire Android Development] k4y0z:
Great, did you try the other boot-modes as well?

Did it actually change boot-mode (FASTBOOT would be best to try, as it's obvious if that worked)

But it should also print in the bottom-left corner of the display.

If I remember correctly mmcblk0boot0 and mmcblk0boot1 were writable.

But you can already do all that using

idme <var_name> <value>

the unlock_code written there will still to be valid to unlock LK

it would be more interesting to find out where the unlock_code displayed by

fastboot getvar unlock_code

is generated from, if we were able to change it, that could possibly lead to an unlocked bootloader.

It might be directly generated from chip-id or similar, which would make it nearly impossible to change.
[Fire Android Development] DragonFire1024:
None of that may matter anymore https://xdaforums.com/hd8-hd10/orig-development/fire-hd-8-2018-downgrade-unlock-root-t3894256
[Fire Android Development] k4y0z:
That is awesome news!

Since it's a boot-rom exploit it should theoretically be possible to port this to any MTK-device and it can't be fixed with a software-update.
[Fire Android Development] NFSP G35:
Exciting news! I hope this will be something that can port to my 2017 HD8s as well
[Fire Android Development] Droidriven:
Hehe, I figured it would end up being some kind of trick involving a jumper/short/direct interface to the hardware and a good head for Linux. I mentioned those exact two things in an earlier post here, lol.
[Fire Android Development] DragonFire1024:
I like this very much. It seems we were all right at one point no matter how crazy or dumb any of our ideas or theories were.
[Fire Android Development] Droidriven:
Agreed, I'll say this, I honestly didn't have faith in the idea in the beginning, but it worked out. I guess you made a believer out of me, lol.
[Fire Android Development] Rortiz2:
Factory mode fire 7 7th gen

Hi!

I have been testing handshake2.py with my Fire 7 and these have been the results:

If I do handshake2.py FACTFACT it returns me this error:

>>> handshake2.py FACTFACT
File "<stdin>", line 1
handshake2.py FACTFACT ^
SyntaxError: invalid syntax

But if I only double click on handshake.py and I connect the fire, it reboots to Factory Mode, and the computer it detects as:

If I re-run handshake2.py while the fire is in the factory mode it stays like this:

How can I use the other modes without giving me that error.

Thanks.
[Fire Android Development] k4y0z:
Try running

python handshake2.py <MODE>

If that doesn't work you can change the default mode in the script in line 69:

command = str.encode('FACTFACT')

I am currently trying to port [MENTION=9667509]xyz`[/MENTION] boot-rom-exploit to the fire 7/mt8127.

Once this works we should be able to downgrade to the 5.0.1 preloader/lk that allowed loading of twrp via fastboot boot :)
[Fire Android Development] Rortiz2:
The second method worked like a charm. I tried meta mode and it stays here: :( Now it only reboots to recovery mode...
[Fire Android Development] k4y0z:
What is the exact message on the display, I can only read part of it.

You should be able to use

handshake2.py AT+NBOOT

To do a normal boot.
[Fire Android Development] Rortiz2:
I could not get to read it because it went out and left the Amazon logo 2 seconds. If I remember correctly I would say Yellow State and something related to the boot. But I have ignored it. If you want, try again to restart in META MODE.

The command AT+NBOOT Just restart again in recovery ... I'm desperate...:(
[Fire Android Development] k4y0z:
HMM, weird that never happend on mine.

You could try the following:

Unplugging battery

Factory reset from recovery

sideload stock-rom through recovery
[Fire Android Development] Rortiz2:
Ok I make factory reset in recovery, rebooted and now it stays in this screen:

Any ideas?

I try to reinstall the firmware?
[Fire Android Development] k4y0z:
OK, at least it looks like it doesn't boot straight into recovery anymore.

Maybe give it some more time or try another reset.

You can of course try to reinstall the firmware through recovery.
[Fire Android Development] Rortiz2:
After waiting 20 mins the fire has started. So if you reboot a fire 7 7th gen to meta mode you will brick it and you need to perform a factory reset for recover it.

PS: The port of the exploit that you are doing, will work for the 7 gen?
[Fire Android Development] k4y0z:
Good to know, at least it's not a complete brick.

The exploit is SOC-specific so it will only work with devices using MT8127.

The original implementation is for MT8163 I believe.

What SOC does the 7 gen use?
[Fire Android Development] Rortiz2:
MT8127 XD
[Fire Android Development] k4y0z:
Then I suppose it would.

Still not there yet though...
[Fire Android Development] Rortiz2:
Yes, I confirm that is MT8127:
[Fire Android Development] k4y0z:
Just wanted to share this little teaser with regards to porting to mt8127 :) :

[2019-01-29 01:27:18.010153] Init crypto engine
[2019-01-29 01:27:18.033124] Disable caches
[2019-01-29 01:27:18.033970] Disable bootrom range checks
[2019-01-29 01:27:18.046269] Load payload from ../brom-payload/build/payload.bin = 0x45DC bytes
[2019-01-29 01:27:18.050556] Send payload
[2019-01-29 01:27:18.517219] Let's rock
[2019-01-29 01:27:18.517782] Wait for the payload to come online...
[2019-01-29 01:27:19.128051] all good
[2019-01-29 01:27:19.128550] Check GPT
[2019-01-29 01:27:19.419147] gpt_parsed = {'KB': (2048, 2048), 'DKB': (4096, 2048), 'EXPDB': (6144, 35584), 'UBOOT': (41728, 2048), 'boot': (43776, 32768), 'recovery': (76544, 32768), 'MISC': (109312, 1024), 'LOGO': (110336, 7168), 'TEE1': (117504, 10240), 'TEE2': (127744, 10240), 'system': (137984, 2457600), 'cache': (2595584, 512000), 'userdata': (3107584, 12162271), '': (0, 1)}
[2019-01-29 01:27:19.419246] Check boot0
[2019-01-29 01:27:19.623339] Check rpmb
[2019-01-29 01:27:19.832288] b'AMZN\x01\x00\x00\x00\x02\x00\x020\x02\x00]4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

So at least downgrade should be within reach (which for the Fire 7 5th gen would mean getting teathered TWRP).
[Fire Android Development] hwmod:
Wow [MENTION=764232]k4y[/MENTION]Oz all in one day, great advances also on the front of the 7th Gen.

Very good for the 7th Gen owners, they will probably be able to recover their device from brick state soon.

.:HWMOD:.
[Fire Android Development] k4y0z:
Check here

https://xdaforums.com/amazon-fire/development/downgrade-fire-7-2015-softbrick-t3894671

This should theoretically be applicable to other mt8127-hardware as well.

Might need different lk/preloader images.
[Fire Android Development] DragonFire1024:
I have a mediatek kit for the HD 10 that has a lot of goodies some of which are universal, but couldn't be used on any of the tablets until now. I'm pretty sure the stock images, signed, unsigned loaded and blank and the tools for them and other things are cross compatible/universal. Unfortunately the prelaoders, bootloaders and other hardware related stuff is only for mt8173. My point is, with said kit you can just flash over the other images and and start over. Look at it like this: even without the kit, these tablets any pretty much any other media tek device in existence can never be permanently bricked again. This exploit is literally God mode.

Edit: you guys are part of history. As it stands, this is most likely the biggest android exploit ever discovered and we found it right here :D
[Fire Android Development] hwmod:
[MENTION=7104332]k4y0z[/MENTION] thank you so much, everything seems to work as expected. I already revived two tablets that were soft bricked.

After loading the TWRP recovery I installed OS 5.0.1 on both of them. That was another great achievement.

This finding is the "Holy Grail" tool of the Mediatek hardware and the impact of this will be unbelievable.

Just imagine ... no more bricked tablets and older bricked devices can be revived and given new life.

This will work for all the Fire TV models, for Fire TV Stick any version and for Lenovo, Xiaomi, Asus...

Now developers will be able to try whatever they want without the fear of destroying it.

This will have several indirect impacts on this market that cannot yet be measured.

Also, I am looking positively to what has happened in these past few days but I see that

there are a few people that are not so happy and they are trying to minimize the work

and the achievements of [MENTION=295159]xyz[/MENTION] and yours.

I just wanted to say I appreciate your work and the time you and others have put on this.

Keep up improving and expanding what you have achieved, it is awesome.

.:HWMOD:.

---------- Post added at 04:17 AM ---------- Previous post was at 04:09 AM ----------

[MENTION=8978978]Rortiz2[/MENTION] that will happen after one wipes the "dalvik-cache", it is normal, the tablet software is regenerating all the "odex" copies of the applications.

That "optimization" process is also called frequently "odexing" and it will take a lot of time to complete, usually between 10 and 20 minutes,

depending on the number of default/standard applications installed in the tablet firmware.

It happens frequently to me too, it is due to the kind of testing we do, entering and leaving other boot mode like the META and ADVANCED META modes.

If you like experimenting and see what is possible to do in META mode I suggest you give a try to this Mediatek tool for Windows:

SP_META_Tool_Ver. 1.1812.0.0 (Google will show other version of this tool, however I found this version working best for FIre 7 5th Gen tablets)

It is a bit difficult the first time one uses it, but once it connects to the tablet things become easier. Though not every component is present in our Fire tablet.

It includes many testing and unusual calibration tools for every component (Touchscreen, Bluetooth, WiFi, Gyroscope, GPS and other Sensors).

I could easily engage META mode testing sessions with 5th Gen tablets while I have had less success with 7th Gen tablets.

.:HWMOD:.
[Fire Android Development] thoughtlesskyle:
Fire HD8

Been a long time and never touched a mediaTek device so I don't know enough to be the person who unlocks it.

However I looked at the HD8 unlock thread and if we have an older Amazon Fire (mines from the first year it was released) and have a twrpable version is it possible that we could use the same exploit that the Fire 8 did to get unlocked

Here are my research and findings

In the last screenshot they say that this is exploitable on any mediatek device it just takes figuring out the logic to exploit it

in the first screenshot he says that if we are able to get into the boot-rom download mode which is hidden behind a shield on our device

the 2nd screenshot shows that if you are on older firmware you can get into that boot rom without needing to get to the test pads.

So if I am reading this right if somebody figures out the logic this is something that can be done?
[Fire Android Development] k4y0z:
For the Fire 2015 I have already figured it out ;)

https://xdaforums.com/ama...brick-t3894671

For the Fire 2017 it will take some brave people to try things, since I don't own this device, but since it is basically the same hardware it should work there as well :)
[Fire Android Development] Droidriven:
Too bad this will only work for the fire devices with mtk processor.
[Fire Android Development] zeroepoch:
This was going to be what I would have suggested for a pure SW approach. I never added this support to aftv2-tools because I was trying to use the preloader not the bootrom :) Hopefully one of those modes works to get into the bootrom on some MTK devices.
[Fire Android Development] t3chwizard:
[MENTION=8165603]DragonFire1024[/MENTION] Is it possible for you to make a guide with specific instructions for the KFFOWI on how to safely use the newfound exploit? I don't want to do it blindly and end up bricking the device because of a simple mistake I made when attempting it. Since it seems you know what you're talking about, you'd probably be able to make a good how-to guide for the process.
[Fire Android Development] k4y0z:
Are you missing anything in my guide? https://xdaforums.com/amazon-fire/development/downgrade-fire-7-2015-softbrick-t3894671

You can't really brick anything.

The safest approach would probably be sidloading the old ROM as [MENTION=6680544]bibikalka[/MENTION] has described here:

https://xdaforums.com/showpost.php?p=78797229&postcount=19

That way you wouln't have to open the tablet and mess with the hardware.

I don't think anyone has tested it yet, so please post your results!
[Fire Android Development] thoughtlesskyle:
So wait did I miss the steps for the bootloader unlock in there?
[Fire Android Development] Droidriven:
No, the guide includes instructions to downgrade the firmware/bootloader and then flash TWRP, I'm assuming this means that either the bootloader is unlocked during the downgrade or that the downgraded firmware/bootloader is already unlocked, you wouldn't be able to flash TWRP as the guide describes if it required a method for unlocking the bootloader before flashing TWRP.
[Fire Android Development] thoughtlesskyle:
I didn't know we could hard flash twrp, down grading allowed a fastboot boot of it that's why I didn't think the BL unlocked
[Fire Android Development] Droidriven:
Don't worry about it, just follow the guide exactly word for word and you shouldn't have any issues. Whether the bootloader unlocks during the process or not doesn't matter, the instructions work, that is what matters.
[Fire Android Development] k4y0z:
It is not an unlock (yet) but you can boot (not flash) TWRP and then root or install a custom ROM from there.

That is correct.
[Fire Android Development] t3chwizard:
Is the guide just describing how to revert back to 5.0.1 to use TWRP?
[Fire Android Development] k4y0z:
Yes, pretty much.
[Fire Android Development] wolf45801:
Has anyone had success on using the exploit on the 7th floor

Gen fire yet?
[Fire Android Development] DragonFire1024:
it would be really nice if this could be applied to the HD 10 really really nice.
[Fire Android Development] t3chwizard:
Oh ok well it's still progress next we aim for the unlock lol
[Fire Android Development] k4y0z:
Working on it ... :)
[Fire Android Development] DragonFire1024:
This is the key to doing all this without prying open the case. Now that we are past the crazy cat lady mode, can someone please take a look at this? There has to be a way to do this by pressing a key order.

On that page is where we can do this by pressing the correct combination of keys, with the power button. There is so much here i think it's worth a look now. https://xdaforums.com/amazon-fire/development/bootloader-unlock-ideas-t3289721/page66
[Fire Android Development] Droidriven:
I think the link you posted is for this thread, not a differeng thread.
[Fire Android Development] hwmod:
I have been finally able to reproduce current tricks on the 7th Gen. tablets, also in a near future it might be possible to boot from micro SD card (Ubuntu/Debian).

Unfortunately there are touch screen difference between 5th and 7th Gen which forces me to blindly work strictly from the shell even for the TWRP (using 5.0.1 preloader).

However it is confirmed the new [MENTION=9667509]xyz`[/MENTION] hack works everywhere. It just need the exact reference addresses, the correct driver and conditional handling depending on models.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
That's awesome news. The HD 10 is ready to go and in standby to receive a working exploit and a means to execute it.
[Fire Android Development] Rortiz2:
Can you make a guide when you finish?

Thanks!
[Fire Android Development] k4y0z:
That's good news, so the preloader/LK from the 5th gen work, it's just the display that stays dark?

Did you see this?

https://xdaforums.com/hd8-hd10/development/2017-fire-hd-10-unbricking-anti-rollback-t3896616
[Fire Android Development] DragonFire1024:
What does this have to do with unlocking? As I said I'll do all this myself if I have to but I need to know where to start. Anyone's help would be appreciated....
[Fire Android Development] DragonFire1024:
Some here appear to have a hard time sharing, unless they benefit from it in some form or another. I've been at this for over a year, and modding for two and to get right at the edge only to feel robbed isn't something I'm willing to accept. No one here has to like me, but to coincidentally get every other tablet unlocked except for just this one...maybe I should play the lottery. I would rather someone tell me what needs to be done rather than telling me I can't do it or that I'm incapable of even trying. This is only fun when everyone has the same goal(s). In my opinion and in some cases, that doesn't appear to be the picture being painted lately.

Delete duplicate

---------- Post added at 10:01 AM ---------- Previous post was at 09:31 AM ----------

What else can we do in bootrom? If this is supposed to effect all mediatek devices, what makes it so complicated to adapt this to the HD 10? I own one of every model of the amazon tablets from the 7 all the way to the 10. It really can't be that hard since the same thing on all these tablets is being exploited.
[Fire Android Development] DB126:
Humble suggestion - stop the whining and wait for material to become public. It may be weeks or months as folks have other lives not centered around Amazon toys. Eventually someone will post the details you crave. Patience is a virtue.
[Fire Android Development] DragonFire1024:
I'm well aware that everyone has a real life they need to attend to. Im also aware that in the time since such was discovered, it took less time adapting to more than a few devices than I've seen in a very long time. Normally I would agree with an assessment.
[Fire Android Development] k4y0z:
Wait, so you're saying you have touchscreen-issues on the 5th gen?

So far only the brom-exploit is ported on mt8127 there shouldn't be any touchscreen-issues on 5th gen.

On 7th gen it is very likely when using the preloader/lk from the 5th gen, but currently can't do anything about it, that would need the LK-exploit.

Good find, please share a photo with the location marked :)

Sounds interesting, I will take a look. What exactly would these AES-Keys be used for?
[Fire Android Development] hwmod:
Pins to use to prevent the BootROM from booting the EMMC code

The touchscreen issues I am talking about are those already known, the need to press the power button a couple of times because

the tablet is initialized with only the back light on but no signal on the screen. Not a bad issue, normal users will not do that often,

so it is a low priority quirk.

Here is the photo of the relevant pads and test points that can be used to keep the "bootrom" from booting from the EMMC.

CMD is what we have been using up to now, but it seems to me it requires more tries, sometime too many.

CKE should be the preferred one because it is the EMMC "clock enable" line, but that also showed some missed tentative..

VDD1 is currently my preferred pin to short. It never missed a shot, also being it a voltage line I use a 100ohm resistor to ground (shield) to be on the safe.

.:HWMOD:.
[Fire Android Development] hwmod:
Fire 7 7th Gen (Austin) extracted recovery image

Here is the "recovery" image of the Fire 7" 7th Gen (Austin) having version 5.4.0 of the FireOS.

Useful to build a first version of TWRP for these tablets. Once we have that everything would be easier.

Have fun,

.:HWMOD:.
[Fire Android Development] Rortiz2:
Thanks!

For compile the recovery can the omnirom 5.1 sources be used?
[Fire Android Development] hwmod:
[MENTION=8978978]Rortiz2[/MENTION], the last TWRP I compiled was ore than 5 years ago, for the Huawei Mediapad tablets so my knowledge is at least a bit rusty.

However I recently refreshed my information by reading some news directly from the developers and YES I noticed that the Omnirom

device tree suggested. CM/LineageOS comes as second alternative. I am tempted to do this for the Fire 7 tablet but I haven't the time.

I have to be realistic and leave the idea.

.:HWMOD:.
[Fire Android Development] k4y0z:
As long as there is no unlock, you would't be able to boot TWRP on the 7th gen though
[Fire Android Development] hwmod:
Could you please elaborate your assertion ...

If it was done on the HD 8 why wouldn't it be possible to do the same on the Fire 7 " 7Gen ?

I mean by loading preloader and lk from 5.0.1 version on the 7th Gen wouldn't that already be enough to allow it ?

.:HWMOD:.
[Fire Android Development] k4y0z:
Well yes, it's possible, but it hasn't been done yet, it needs an exploit for the LK.

I am currently trying to exploit the 5th gen LK

If the preloader/lk from the 5th gen work on the 7th gen that would be fine,

but it was my assumption they didn't work correctly (No display etc), so they are pretty useless on the 7th gen.

I don't have a 7th gen, so I can't test it myself.