yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] t3chwizard:
Wow this is impressive stuff
[Fire Android Development] DragonFire1024:
Just saw the graph. I couldn't resist noticing the 'amzn_verify_unlock' and 'Amzn_verify_un'. Yet there just happens to be a few bin files with similar names and presumably functions: 'amzn_dha_tool' 'amzn_dha_hmac'. This chart also appears to show a lot of what I see in the lk.
[Fire Android Development] DragonFire1024:
Screen shot one shows they unlock the device which is confirmed by the lk. It also says there's an image file on the ramdisk with a mention of a factory image. This is from the HD 10, and by the looks of work on a thread over in that section, the HD 8 and 7 have the same partitions. With the tool present in all three devices, I think this would say the same things on them. One guy has dissected a few HD 8 tablets and may have found a way in?

https://xdaforums.com/hd8-hd10/general/discussion-root-progress-fire-hd-8-t3743024/page62
[Fire Android Development] DragonFire1024:
Screen shot shows device being unlocked. Mentions amzn_verify_limited_unlock.
[Fire Android Development] DragonFire1024:
So I downloaded installed and ran 'liveboot' on my HD 10 with some interesting items in the log (provided). Particualrly the lines mentioning HAL. Some lines appear to show codes strikingly similar to the supposed unlock code in fastboot. An example below:.

--------- beginning of main
D( 235) Msensor deamon statr!!!!!!!!!!!! (MsensorDaemon)
D( 235) Msensor deamon statr : /sys/bus/platform/drivers/msensor/daemon don't exist (MsensorDaemon)
I( 267) Read FOS flags:0x0 (FOSFLAGS)
I( 232) loaded HAL id=amzn_dha path=/system/lib64/hw/amzn_dha.mt8173.so hmi=0x7fb123ed68 handle=0x7f8288bd28 (HAL)

The hmi value changes throughout the log. But I'm willing to bet the amzn_dha_tool is the door we need.
[Fire Android Development] sd_shadow:
no, just need something to work with

new ideas, new exploit...
[Fire Android Development] hwmod:
Mediatek DA protocol reverse engineering docs

I would like to have more time to help with this, however at the moment I can just point you in the right directions (hopefully) and share docs I have gathered in my previous test ... (I also have a hard bricked Fire 7 5th Gen). The following PDF contains a raw description of the Mediatek DA protocol, this is where to start:

https://osmocom.org/projects/baseband/wiki/MTKRomloader

Download the attached PDF (lower left "Attachments" button). I have quickly tested using Python and this code and I can happily say our (almost dead) Fire 7 5th Gen still support this same protocol.

I attached two high-res (3264x1836) pictures of my bricked FIRE 7 5th Gen before soldering the UART cables on it, I used a FT232 break out board, soldering these small pads was a nightmare. The "bootloader" serial speed is 921600 bps.

I have more links to other more detailed and well written information on the Mediatek DA protocol, the "little kernel" and the "preloader" but I need to find them on my other PC since I am not on my desktop currently. I will try to post links here a.s.a.p.

I left my testing research on the Fire 7 5th Gen almost two months ago due to a pile of work and no time left.

Hope somebody can help with this "unbrick contest", so many people baffled by this forced locking.

Have fun,

.:HWMOD:.

[IMG="UART pads TX & RX for serial debug on the FIRE 7 5th Gen mainboard"]https://www.anony.ws/i/2016/02/25/20160201_173821.jpg[/IMG]

[IMG="2- UART pads TX & RX, RST pad, VCHG & DP/DM pads on the FIRE 7in 5th Gen mainboard"]https://www.anony.ws/i/2016/02/25/20160225_150815.jpg[/IMG]

External Links to the photos:

http://http://www.anony.ws/image/Jchh

http://http://www.anony.ws/image/Jctw
[Fire Android Development] hwmod:
MediaTek documents & tools

Here are the links to the relevant documents and tools I promised to post:

Mediatek DATool (also named fbtool or fastboot tool)

This tool can be used to upload "Preloader" and "Little Kernel" to SRAM and then execute them, RSA keys must be generated to be allowed to upload code (secured chips). This is something similar to the MTK SP FlashTool but at lower level and everything must be run from command line (Linux/Mac required).

From "Sturmflut's blog":

MediaTek details: SOC startup

MediaTek details: Little Kernel

MediaTek details: Partitions and Preloader

These documents describe in detail the various operations that can be performed on the SOC and give details about the initialization steps, the memory map, the different boot modes that can be invoked and explain how to engage the SOC for read & write operations (16 & 32 bits) and how to transfer code to SRAM and jump to it.

The interesting BOOT modes I could select on a working Fire 7 5th Generation tablet are:

FASTBOOT, RECOVERY_BOOT, DOWNLOAD_BOOT, META_BOOT, ADVMETA_BOOT, FACTORY_BOOT, ATE_FACTORY_BOOT

the SOC recognizes other BOOT modes but these don't seem so interesting for our "unbrick" scope:

ALARM_BOOT, NORMAL_BOOT, SW_REBOOT, KERNEL_POWER_OFF_CHARGING_BOOT, LOW_POWER_OFF_CHARGING_BOOT

The DA protocol can be engaged with the SOC by sending a so called "Start" sequence made up of the following four hexadecimal bytes: 0xa0 - 0x0a - 0x50 - 0x05, for each bye sent the SOC answers back with the XOR value of the sent bytes: 0x5f - 0xf5 - 0xaf - 0xfa.

The above sequence allows entering a special mode where the SOC accepts a list of command identified by "one byte" code, for example:

0xa2 = Read data from SOC memory (16bit length parameter)

0xd2 = Write data to SOC memory (16bit length parameter)

0xd1 = Read data from SOC memory (32bit length parameter)

0xd4 = Write data to SOC memory (32bit length parameter)

You can find the complete list of commands in the "MediaTek details: Partitions and Preloader" document linked above.

There is really a lot of information to read and try out but I believe this is the only alternative I have up to now that could lead to a successful "unbrick". As said previously, I have not much spare time but I will try to answer questions (if I know).

Have fun,

.:HWMOD:.
[Fire Android Development] hwmod:
MT8127 scatter file

I forgot to upload this one ... my first attempt to build a scatter file for our MT8127 SOC.

WARNING !!! This file has not been tested to be completely correct.

It is a work in progress aiming to help with bricked Fire 7 5th Gen.

Don't use the attached file on a working Fire 7 5th Gen tablet.

I will not be responsible for damages or new bricks.

Have fun,

.:HWMOD:.
[Fire Android Development] t3chwizard:
I'll see if I can get some more people involved. Not giving up lol.
[Fire Android Development] seishuku:
I'm rather surprised that this subject isn't getting more focus on... a $50 tablet is a lot more interesting to me than a $600 handset. lol
[Fire Android Development] fax1988:
Joy of life is frustrating , So come on
[Fire Android Development] Tomsgt:
I would love to see a working scatter file. wouldn't you need the stock amazon firmware extracted and put in a bin file for it to work. right now the stock firmware is in a recovery flashable bin not a scatter flashable bin.
[Fire Android Development] t3chwizard:
How would we go about extracting such a file?
[Fire Android Development] ipdev:
I have a ford with a month left in my 90 day warranty. (fire os 5.1.1.) Currently running cm12.1 & have soft bricked it a few times. (Amazon seems to have figured this out since you can d/l & side load the os from them.?)

More than willing to brick this one. (For the next 3 weeks. Bad pixel in bottom corner and planning on using the warranty.)

How can I help?
[Fire Android Development] hwmod:
List of stock firmware flashable components/partitions

I hope I correctly understood your question ...

The current stock firmware for versions 5.0.1 up to 5.1.2 are simple ZIP archives with a ".bin" extension, they contains the needed flashable ".bin" for the relevant partitions. Example unzipped list for the stock 5.1.1 archive (update-kindle-global-37.5.4.1_user_541112720.bin):

unzip -l update-kindle-global-37.5.4.1_user_541112720.bin
Archive: update-kindle-global-37.5.4.1_user_541112720.bin
signed by SignApk
Length Date Time Name
--------- ---- ---- ----
0 04-15-15 20:14 system.patch.dat
124608 04-15-15 20:14 META-INF/com/amazon/android/check-binary
1524 04-15-15 20:14 META-INF/com/amazon/android/target.blocklist
4500 04-15-15 20:14 META-INF/com/amazon/android/target.build.prop
45 04-15-15 20:14 META-INF/com/amazon/android/target.system.devicepath
303 04-15-15 20:14 META-INF/com/amazon/android/target.system.map
40 04-15-15 20:14 META-INF/com/amazon/android/target.system.map.sha1
130 04-15-15 20:14 META-INF/com/android/metadata
500328 04-15-15 20:14 META-INF/com/google/android/update-binary
2490 04-15-15 20:14 META-INF/com/google/android/updater-script
4452352 04-15-15 20:14 boot.img
29819 04-15-15 20:14 file_contexts
409060 04-15-15 20:14 images/lk.bin
1248962 04-15-15 20:14 images/logo.bin
123392 04-15-15 20:14 images/preloader.img
123392 04-15-15 20:14 images/preloader_prod.img
1064448 04-15-15 20:14 images/tz.img
245 04-15-15 20:14 ota.prop
1102876672 04-15-15 20:14 system.new.dat
338 04-15-15 20:14 system.transfer.list
4500 04-15-15 20:14 system/build.prop
1452 04-15-15 20:14 META-INF/com/android/otacert
1824 04-15-15 20:14 META-INF/MANIFEST.MF
2075 04-15-15 20:14 META-INF/CERT.SF
1553 04-15-15 20:14 META-INF/CERT.RSA
-------- -------
1110974052 25 files

If the combination of a correct "Scatter.txt" file and the "MTK SP Flash Tool" (in USB mode) could ever work the files we need would be:

preloader.img OR preloader_prod.img

lk.bin (U-Boot / Little Kernel)

boot.img (Linux Kernel)

Unfortunately, I believe, Amazon has purposely blocked this path through USB with several [ANTI-ROLLBACK] checks.

My hope is that the UART/Serial path has been left open for using the "MTK SP Flash Tool" (in serial/uart mode) and/or manual patching through the DA protocol using the "fbtool" linked in one of my previous post in this same thread or other self built tool (yet to be developed) based on the DA protocol.

Please tell in case I misunderstood your original question.

Have fun,

.:HWMOD:.

---------- Post added at 12:25 PM ---------- Previous post was at 12:22 PM ----------

See my previous post ! The released stock firmware are just ZIP files.

Have fun,

.:HWMOD:.
[Fire Android Development] t3chwizard:
I'm kind of confused by what you are saying. From what I read it seems like "if it was possible here is the way to do it, but I do not think it is", is that correct?
[Fire Android Development] hwmod:
Yes that's correct !

Let me retry to explain my guesses (sorry for my poor english):

- it seems that Amazon have locked down the use of "MTK SP Flash Tool" (in USB mode)

- I believe (not sure yet) that it will be possible to use "MTK SP Flash Tool" (in UART mode)

in both cases a correct "Scatter.txt" file is needed for "MTK SP Flash Tool" to work properly.

In case I were wrong and both path/solutions were locked down by Amazon there is still hope that the DA protocol will allow us to load binary code in SRAM and execute it. For example loading/executing "lk.bin" plus a recovery like TWRP (a similar approach to ADB side-loading) while skipping the [ANTI-ROLLBACK] code.

.:HWMOD:.
[Fire Android Development] t3chwizard:
Ah okay. I understand now.
[Fire Android Development] t3chwizard:
[MENTION=5594845]spudowiar[/MENTION] could you take a look at this?
[Fire Android Development] mightymouseguy:
Sweeten the pot

Any update gang? I'd love to sweeten the pot with a decent dollar value google play gift card, as I too have a device that is stuck in a bootloop and can only get into fastboot mode (and would much rather give money to you guys:good::good: than just buy another tablet )
[Fire Android Development] t3chwizard:
Idk if this means the BL was unlocked for the 7 HD, but it apparently has TWRP support now. http://www.androidpolice.com/2016/0...-gen-and-huawei-honor-7-receive-twrp-support/

I'm guessing it is now at the same point our device is in, but I could be mistaken.
[Fire Android Development] sd_shadow:
the 3rd Generation HD 7, just recently got a bootloader unlocking method

http://xdaforums.com/kindle-fire-hd/7-development/unlock-kfsowi-bootloader-unlock-t3262770

there is no reason to believe it will work with any other Fire

it was a odd device to start with...
[Fire Android Development] t3chwizard:
Darn that's a shame. Still keeping up hope though.
[Fire Android Development] Shagerty:
Hey there this info might help, https://javigon.com/2012/08/27/the-bootloader-understanding-modifying-building-and-installing/
[Fire Android Development] DragonFire1024:
I have seen the OEM command on the HD 10 in one of the partitions using IDA pro. I'll have to look at them again and find out which one and if there's anything new, I'll post what I find. Won't be for several hours, but I'll see what running them through binwalk does (if I have time).
[Fire Android Development] darkensx:
just incase anyone trys the commands from hwmod

they don't seem to work on 5.1.2 now unless theres some unique way to issue said commands like the mention pads or some kind of prerequisite the cutoff would be 5.1.1 as these produce the famous "unknown command" error on 5.1.2 but again someone with better knowledge on this should be able to confirm if 5.1.1 is the cutoff or if 5.1.2 is able to utilize these commands
[Fire Android Development] DragonFire1024:
I'll have to try my HD 10 later. I'll also post the string of commands I found.
[Fire Android Development] darkensx:
Should have probably mentioned I'm using the 7" Amazon fire 2015 gen 5 I believe.. production version
[Fire Android Development] k4y0z:
androidboot.unlocked_kernel=true has been known and is what I used to root 5.1.1:

https://xdaforums.com/amazon-fire/orig-development/root-t3272362

sadly the fastboot command "oem append-cmdline" has been removed in 5.1.2
[Fire Android Development] darkensx:
So I guess the objective would be to see if there's anyway to either 1. (Very doubtful) have a working downgrade method to 5.1.1 if these commands do indeed unlock the bootloader. 2 find a way to re implement removed commands. Or 3 find another method altogether.
[Fire Android Development] hwmod:
Note that I already said that "androidboot.unlocked_kernel=true" is not new:

I wanted to say that the fact that multiple "oem append-cmdline" cumulates is something new and interesting, at least is new to me !

Also, it is true that Amazon covered that hole in later kernels, however consider that the kernel still accepts paramters on "cmdline" and

possibly there are other ways to inject those parameters in the "cmdline" like:

- fastboot -c "<kernel-parameters>"

- reboot [-p] [command]

and that it could be done also in the "recovery" mode since the "recovery" is also a kernel+ramdisk that may accept prameters.

Another command that is accepted by newer 7th Gen tablet is for example:

nothing is achieved with that yet but the command is accepted and processed:

fastboot -c "androidboot.unlocked_kernel=true" reboot emergency
rebooting into emergency download (EDL) mode...
OKAY [ 0.003s]
finished. total time: 0.053s

I am just sharing/collecting ideas here with the hope we can find a hole to escalate privileged operations.

Have fun !

.:HWMOD:.
[Fire Android Development] DragonFire1024:
I was able to do <fastboot oem -c reboot-bootloader> a few months ago it accepted the command but visually I don't think 8t did anything.
[Fire Android Development] darkensx:
Not to sound stupid but I'm sure either someone has notice this or maybe its not useful but I'll point it out in case the latter two are false. using root explorer and going to /sys/block/mmcblk0boot0 actually list files before I delve deeper normally on devices I've tried this on produced either a blank folder or loop to a bunch of folders. Now there's two files that I think might be locking our access if this is where the bootloader typically resides correct me if I'm wrong.. there is a ro file containing "1" in plain text without quotes I assume a flag and force_ro also with "1" flag if these can be changed somehow I wonder would this either allowed access to the bootloader or unlock it perhaps? Maybe someone knows what its about or for or even if it useful at all
[Fire Android Development] DragonFire1024:
I've seen that and similar files before. The thing is, you can change the values and etc, but those default back to default upon reboot. The boot image flashes default values at each reboot and a reboot is required most of the time for such changes to take effect. If you can get a unpacked and repacked altered ram disk boot.img to boot on the device, with a locked bootloader, then you are all good to go
[Fire Android Development] darkensx:
How often is that doable on a locked bootloader?
[Fire Android Development] DragonFire1024:
Not sure. Maybe there isn't a way. But after I rediscovered how to edit the framework and settings APKs with tricks from as far back as 2012 and 2013, there might be a way to do the same with the boot.img. if there is a method that can accomplish this, we may need to search that far back.
[Fire Android Development] DB126:
Referenced files are a completely different beast and have nothing in common with framework & settings APK hacks that expose UI tweaks but otherwise do not grant privileged access.
[Fire Android Development] DragonFire1024:
Right i get that. I was in no way making the assumption. I'm simply saying if Amazon just shifted stuff around and disguised Android as FireOS without actually removing the former code, then perhaps they used the same mentality with regards to "deleting" the unlock code/bin and other areas. if that's the case, they could simply be hiding in plain site.
[Fire Android Development] DB126:
Me thinks not but I suppose the premise is based on ones perception on how Amazon skinned Android. Skins are just that and do not obviate core security features.
[Fire Android Development] k4y0z:
The referenced "files" aren't flashed in any way, those are flags that can be set when you are root.

And they allow overwriting boot0 from a running-system with root-privileges.

This has been discussed here https://xdaforums.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747

There is no way of altering the boot.img with a locked bootloader (unless there is some kind of exploit that hasn't been found yet)

[MENTION=4381075]hwmod[/MENTION] maybe it's worth taking another look at kexec https://xdaforums.com/amazon-fire/orig-development/kexec-module-ford-t3270272

If we got that working that would allow booting custom kernel/recovery even with locked bootloader.

When I was working on the project I was actually able to boot a custom kernel unfortunately it crashed very early because the cpu-cores weren't set up correctly.
[Fire Android Development] hwmod:
Interesting Android permissions

Based on the findings of [MENTION=8165603]DragonFire1024[/MENTION] about the two utilities "amzn_dha_tool" and "amzn_dha_hmac" I wanted to add extra info maybe useful to run those commands.

There is n Android permission named: AMZN_KEY which will probably allow runnin these two command from a package environment haing this permission enabled.

Also, I am not really an expert on Android permission, but reading documents, it seems the INTERACT_ACROSS_USERS and INTERACT_ACROSS_USERS_FULL permissions are the permissions needed to be able to use "chmod" and "chown" commands across users. I don' think they may be used for the "root" users directly, howevere if this information reveals to be true it may be another step in the right direction.

Is there somebody with more Android knowledges that can confirm or deny this information ?

Thank you for the help !

.:HWMOD:.

---------- Post added at 07:03 PM ---------- Previous post was at 06:49 PM ----------

I agree, from what I remember I hear some time ago "kexec" should be considered one of the preferred paths to gain root but it requires full immersion in programming the kernel and it's modules. But my knowledge on that is really minimal. It's worth a revisit and learn more about "kexec" for me. I am going to read more about it.

My doubts are ... if it is impossible to execute a custom kernel, and it is impossible to insert a module in the currently running how would that be useful (me think) ?

I am sure you have far more knowledge of me about "kexec" module and maybe you could throw a simple explanation on how it works and how it could be useful.

Thank you in advance.

.:HWMOD:.
[Fire Android Development] k4y0z:
Well when I was playing with it it was possible to insert a kernel-module, that's also how we disable selinux on the custom roms that are currently available (https://github.com/chaosmaster/ford_selinux_permissive)

kexec is part of the linux-kernel and allows booting to another kernel from an already running linux-kernel.

So the idea was to boot the stock kernel with a modified system.image that would just load a custom kernel or a recovery.

Unfortunately kexec wasn't compiled in the stock-kernel, therefore I created a kernel-module that could just be inserted at runtime and it worked to a point.

You can see the bootlog in the mentioned thread, unfortunately it crashed very early during boot (presumably because of SMP)
[Fire Android Development] Kramar111:
del
[Fire Android Development] DragonFire1024:
https://github.com/chenxiaolong/DualBootPatcher

This might be helpful as a reference. I had put in a fork and pull for the HD 10 in hopes something could come of it, but the developer is apparently not developing it anymore.
[Fire Android Development] hwmod:
Booting in "Safe Mode" (works on both 5th and 7th Gen)

Today by pure casualty, between some rebooting process, I found a way to boot my 7th Gen tablet in a so called "Safe Mode".

I did realize that because in the lower left corner I had a "Safe Mode" text that I am sure I had never seen before.

After some trial I was able to reproduce the steps to achieve that 100% of the times on both 5th & 7th Gen Fire tablets by following these actions:

- power off the tablet by pressing the "power" button until the "Power off" dialog appears asking "Do you want to shut down your Fire?" then tap on "OK"

- power on the tablet by pressing the "power" button and keep pressing the button until the white "Amazon" logo appears then release the button

- as soon as the "Amazon" logo is replaced by the orange "fire" logo press and keep pressing the "volume up" button until the boot is complete

At the end of the boot process you will see the "Safe Mode" text overlay in the lower left corner.

To exit the "Safe Mode" and return to normal operation just reboot the tablet in the standard way.

It seems that in "Safe Mode" none of the user installed application are executed nor visible.

I don't know if enabling this mode would be useful for rooting/unlocking but I hope so !

Maybe there are other more interesting "boot modes" by combining keys/behaviors.

Have fun !

.:HWMOD:.
[Fire Android Development] DB126:
"Safe mode" is a standard Android capability that has been around since Jelly Bean if not before. There are several ways to invoke Safe Mode. Perhaps the easiest on FireOS is to long press the power button then long press "ok" in the shutdown confirmation dialog. Google for additional details.
[Fire Android Development] k4y0z:
I was just going to write that, see here

Although I still believe factory-boot mode might be interesting, still haven't had a chance to test a factory-cable yet.
[Fire Android Development] DB126:
Historically it has produced no beneficial results; Amazon killed that starting with the 3rd gen HDX.