yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] DragonFire1024:
Downgrade is what they accomplished on the earlier fire 7s. If amazon used the same bootloader from the 8.9 on the HD 10, then there's a chance the second one can be replaced. I know the preloader verifies it too. But if these are unsigned images or engineering images on a production device as I keep seeing over and over, it may not matter. I have all the stock .imgs for the mt8173 all blank and unsigned from the factory level. If we can rebuild any of them, then we don't need to worry about signatures.

Yes I will upload both of them tomorrow. I will finally have a day off and will be at home.

---------- Post added at 04:30 AM ---------- Previous post was at 04:28 AM ----------

Re download mode. There is a way and something to do with usbdl. There are a few mentions of a button combination to press to get there, but it doesn't mention the whole string. It mentions the power button and if I recall 2 other buttons, which are commented or scrambled.

---------- Post added at 04:34 AM ---------- Previous post was at 04:30 AM ----------

Also we have ACM mode now with persist.sys.usb.config=mtp,adb,acm

It's definitely some kind of factory enabled value and If you have the mtk preloader drivers indstalled, the PC loads that driver too. So we have adb, preloader, and acm...I'll download drivers for that one tomorrow.

Mind you the device is fully booted when recognized as a preloader device.
[Fire Android Development] hwmod:
Here are the "Android CDC Drivers" handling the ACM (Abstract Control Mode) in Windows.

In Linux they are normally already packaged with the standard kernel modules.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
Yes. I've tried even the oldest tricks I can find with no luck. I've also only ever seen this on Amazon tablets.

---------- Post added at 04:44 AM ---------- Previous post was at 04:43 AM ----------

Any idea what this mode does?
[Fire Android Development] Droidriven:
That it interesting, does that model of Kindle Fire have MTK hardware? I ask because you're getting MTK preloader showing while booted?

It seems you've gotten a step toward some kind of engineering/developer mode, if it's some kind of latent developer mode that is still there buried but has only had the vital links to access it removed, it seems that if you fill in the blanks you might get fully into that engineering/developer mode. Which could lead to unlocking and flashing/modifying any partition you need via adb/fastboot/dl mode, including unlocking bootloader.

It also seems to me that you need a modified kernel, an insecure kernel, without it, you probably won't get full adb/fastboot functionality or any modifications while in dev mode to actually stick.

Those are just my thoughts on what I've been reading in the code and conversation.
[Fire Android Development] DragonFire1024:
Yes the latter fire tablets are MediaTek. I know earlier ones were not (I own nearly one or more of most Amazon tablets including the 8.9). I have found very little information on what ACM is, aside from what we've already posted here. It definitely is a proprietary function on a vendor level, definitely above amazon. I will have to look over the init files more and see if anything else related to ACM but so far nothing.

I do know it has to do do with emulation, specifically it would emulate the USB port as a different port. This could be useful if they use a special cable to get into whatever mode they need to be in. Beyond that, your guess is as good as anyone else's.

---------- Post added at 06:01 AM ---------- Previous post was at 05:58 AM ----------

P.S. the preloader driver may also be useful. In my opinion we may have gotten a level closer to whatever amazon has done, not even mattering. Also noted, none if Amazon's drivers loaded so only mtk and windows drivers are being used as of ACM.
[Fire Android Development] Droidriven:
Yes, the Kindle that I have requires a specific "fastboot cable" to get into fastboot or it's version of it anyway, it's useless without the cable. Amazon's android is weird.
[Fire Android Development] DragonFire1024:
I'm glad that's not a problem anymore. Not that I don't have about 20 cables lying around lol.

---------- Post added at 06:09 AM ---------- Previous post was at 06:08 AM ----------

Also I wonder what effect this ACM mode has on the tablet while in fastboot or recovery, if anything.
[Fire Android Development] Droidriven:
A JTAG/RIFF might get you somewhere. Or maybe some kind of jumper/testpoint trick of some kind.

Or maybe a Linux distro would get you deeper into acm.

https://www.kernel.org/doc/Documentation/usb/acm.txt

https://stackoverflow.com/questions/31434092/android-cdc-acm-as-device

https://osmocom.org/projects/quectel-modems/wiki/Android_USB_Gadget/6#acm-CDC-astract-control-model

Those are to try and understand what acm can be used to do instead of what it is.
[Fire Android Development] diplomatic:
Hmm, that's interesting. But I don't think this is any kind of download mode. You have activated the USB CDC interface, which I guess is a standard Android feature for some kind of serial link over USB. In order to get into d/l mode, you actually need to be talking to the preloader or the boot ROM. Right now you are in the OS. The Mtk VCOM drivers are simply what implements the CDC ACM protocol on the host. (You can use a generic Windows USB serial driver if you want.) The PL's download mode is implemented with the CDC protocol as well. That's why it's the same driver. So I'm not sure what the purpose of this is in Android. I suppose you can write an app that uses it....
[Fire Android Development] DragonFire1024:
ACM was found in MTK init build files in the root along with options if the device is in eng mode which appears to only half work. You are correct about the serial link, which also mentions emulating ports as well. I still have a lot more to read so hopefully I'll uncover more.

---------- Post added at 06:36 AM ---------- Previous post was at 06:32 AM ----------

With root I can load a Linux distro on the tablets. Since they are loop devices, I can also access the standard sdcard and file system through the distro. Something to do over the next 2 days.
[Fire Android Development] DragonFire1024:
Today in beefdeed (mmcblk0boot1)

-This is important if true:

[Error] lk verification fail, none-prod signed lk on locked production device..%s %s: verify lk image with eng key %s. .%

-This could be the 2nd bootloader's fingerprint:

Build Time: %s..20171 124_202528.%s Ver=%s %s@(%s)..16036fe.build.14-ur=%s %s@(%s)..16036fe.build.14-use1b-b-12.%s

This is another USB config. This one may have some potential:

persist.uartconsole.enable=1
[Fire Android Development] Rortiz2:
Has anyone tried this comand:

fastboot flashing get_unlock_ability

Good for something? If I execute it in my BQ M8 the output is this:

(bootloader) unlock_ability = 16777216
OKAY [ 0.011s]
finished. total time: 0.012s

And if I execute this command in my fire 7 it restarts and stays black:

fastboot reboot emergency
rebooting into emergency download (EDL) mode...
OKAY [ 0.007s]
finished. total time: 0.007s

And I also have a list of hidden commands that can be executed in the fire. They are not hidden but they are a little weird:

C:\Users\rorle\Desktop\strings\lk.bin: oem relock
C:\Users\rorle\Desktop\strings\lk.bin: oem idme
C:\Users\rorle\Desktop\strings\lk.bin: oem
C:\Users\rorle\Desktop\strings\lk.bin: oem flags
C:\Users\rorle\Desktop\strings\lk.bin: oem p2u
C:\Users\rorle\Desktop\strings\lk.bin: oem reboot-recovery
C:\Users\rorle\Desktop\strings\lk.bin: oem off-mode-charge
C:\Users\rorle\Desktop\strings\lk.bin: oem key
C:\Users\rorle\Desktop\strings\lk.bin: oem flags command is restricted on locked hw
C:\Users\rorle\Desktop\strings\lk.bin: oem flags [<type> <modifier>] <value>
C:\Users\rorle\Desktop\strings\strings.exe: GetOEMCP

There's all the outputs:

fastboot oem relock
...
OKAY [ 0.007s]
finished. total time: 0.008s
fastboot oem p2u
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.006s
fastboot oem reboot-recovery
...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 0.007s
fastboot oem off-mode-charge
...
FAILED (remote: not support on security)
finished. total time: 0.006s
fastboot oem key
...
FAILED (remote: argument size is wrong
)
Total time: 0.005s
fastboot oem flags
...
FAILED (remote: oem flags command is restricted on locked hw)
finished. total time: 0.008s
[Fire Android Development] DragonFire1024:
In new fire tablets, all the OEM commands have been removed. I've tried all the know commands like the above mentioned abd no juice. We can't even flash imgs in fastboot anymore.

I wonder if amzn_fos (the variable in the binaries that I believe is Amazon's back door) works in fastboot.

I didn't know about fastboot emergency.
[Fire Android Development] Rortiz2:
I did a search of amzn_fos in the lk.bin of suez but there's nothing

But i found this:

amzn_verify_limited_unlock

But I have no idea what it is.

About the emergency mode I also did not know it existed but if I connect the tablet in emergency mode to the computer it detects this:

PS: Sorry, its in Spanish but detects the fire as a preloader
[Fire Android Development] DragonFire1024:
If you do persist.sys.usb.config=mtp,adb,acm then you also get preloader driver enabled.

What about fos_flags. What about anything amz, amzn or fos

EDIT: I commented about the limited unlock variable in January...2018. https://xdaforums.com/showpost.php?p=77861625&postcount=846
[Fire Android Development] Rortiz2:
Well, they must have something of importance because they mean FireOs Flags. But I'm not sure they can help to unlock the bootloader.

By the way I found this:

androidboot.veritymode=disabled[DM-VERIFY] disabled by fos_flags on eng devices

Does it mean that in devices with compilation eng the dm verity is disabled by fos_flags?
[Fire Android Development] Droidriven:
Yes, that seems to mean that dm-verity is disabled on eng devices, I'm assuming that it would "have" to be disabled on eng devices, otherwise, it wouldn't be able to do some of the tasks that are used on eng devices.
[Fire Android Development] DragonFire1024:
Preloader info:

....@.......................MTK_BLOADER_INFO_v00
.......preloader_suez.bin.......................
_suez.bin.......................................
....V116".D3..p.MTK_BIN.......................JH
MTK_BIN.......................JH8G1e............

USBDL...Google search says SUSBDL.

x) relocate size (0x%x) fail..%s usbdl_send_da:
DA (0x%x), SIG (0x%x), relocate size (0x%x) fail
0x%x), relocate size (0x%x) fail..%s usbdl_send_
da: invalid da parameters..download.c.%s usbdl_v
arameters..download.c.%s usbdl_verify_da: DA val
idation disabled..%s usbdl_verify_da: DA init ke
..%s usbdl_verify_da: DA init key fail..%s usbdl
_verify_da: DA (0x%x) relocate size (0x%x) fail.
0x%x) relocate size (0x%x) fail..%s usbdl_verify
_da: DA validation fail..%s usbdl_verify_da: DA
on fail..%s usbdl_verify_da: DA authenticated..%
s usbdl_send_da: clean invalid da..%s usbdl_jump
clean invalid da..%s usbdl_jump_da: %x..%s dram

Download mode keys :

)_power_ctl enable . .Enter mtk_kpd_gpio_set! ..
le . .Enter mtk_kpd_gpio_set! ..after set KP ena
ble: KP_SEL = 0x%x !..power key is pressed..key
%x !..power key is pressed..key %d is pressed..d
ownload keys are pressed..[RPMB] Key was program
pressed..

RSA-PSS Unlock Signature:

ol 0x%x..[%s] Can't read IDME (error %d)...UNLOC
KING.[%s] : Device is unlocked with RSA-PSS unlo
ce is unlocked with RSA-PSS unlock signature..[%
s] Can't decode unlock code from IDME...[%s] Rea
unlock code from IDME...[%s] Read empty unlock c
ode...[%s] Can't allocate memory to read IDME...
allocate memory to read IDME...[%s] Error: RSA-
PSS signature length is wrong %d , expected 256.
ngth is wrong %d , expected 256.VERIFY_PSS_UNLOC
K.[%s] Error: failed on sha256...[%s] Error: fai
iled on sha256...[%s] Error: fail to do pss deco
de for unlock data...[%s] Error: fail to pass RS
ta...[%s] Error: fail to pass RSA-PSS verificati
on...[%s] Succeed to pass the unlock RSA-PSS ver
d to pass the unlock RSA-PSS verification...[%s]
:preloader failed to allocate memory for device
d to allocate memory for device infor..

Fnally done reading LK and LK2. Here are the zips of each.
[Fire Android Development] hwmod:
USB Interface modes

Other findings related to the current USB mode of the interface.

In Linux there exists an utility command named "usb_modeswitch" which allow switching the interface through the existing modes.

Switching the USB mode changes the idVendor and idProduct bound to the interface to signal the new capabilities to the underlying OS.

I used the following command line from inside the "/var/log" folder of my "Fedora Linux" (changed the 1949 with 0e8d and then with 0bb4):

cat messages-* | grep idVendor | grep 1949 | cut -d ":" -f 5 | cut -d "," -f 2,3 | sort | uniq

and I got the following results/combinations of idVendor and idProduct:

idVendor=0bb4 associated with idProduct values of 0001, 0c01
idVendor=0e8d associated with idProduct values of 0003, 2000, 2006, 2007
idVendor=1949 associated with idProduct values of 0001, 0221, 0222, 0271, 0272, 0331, 0332, 0333, 0334, 0338, 2005, 2048

I have found out that there is also a "Gadget" mode of the interface, normally this is used to make the device visible as an ISO CD (Huawei does this too),

this is another aspect of the interface I wrote down in the list of things to investigate, it could be as easy as mounting the "Gadget" and writing firmware to it.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
In the init files in root of the HD 10, they list the alphanumerical code next to the USB mode. I wasn't sure what that was so I didn't play around with them. Gadget mode I believe is gs3 on the 10 (I have to look at the USB props again but I'm pretty sure it's gs3). I've tried that, rndis, eem and acm. The only immediate difference was with acm. I think that's because I had the preloader drivers already installed. I notice one thing some of these modes have in common, they all involve some kind of emulation. Emulate Ethernet, different ports etc. I can understand the trying to clean tracks, but why so much emulation?
[Fire Android Development] hwmod:
The "idVendor=0e8d" is the identifier for Mediatek while the "idVendor=1949" is the identifier for Lab126.

The "idProduct" is the value that indicates the type of interface and its related capabilities to client software, that value should be an HEX number of 4 digits.

I guess so much emulation is due to the reasons outlined in my previous post, each peripheral

is independent from the others and each have its own specific firmware, driver and protocols.

I believe in these cases "protocol conversion" is a more adequate term than "emulation".

Also, don't forget that each piece of the puzzle is designed to enforce secrecy layers.

.:HWMOD:.
[Fire Android Development] DragonFire1024:
I don't have them in front of me at the moment, but the preloader drivers are mentioned a few times in the init files. I forget which actions or etc they were being used for, but they are mentioned as being needed for a specific function(s).

I have two working fire 10s. One is a testing tablet and on the latest 5.3.X update. I notice the fosflags.sh script is in /system/bin now. I thought that was weird. Also in the Amazon Device Settings app, the basic user builds aren't present, but the debug and eng ones are still there. Also in that app, is a setting, which also appears in secure settings, global, called 'check_allow_mount'. It's defaot set to 0, and I usually set it to 1.
[Fire Android Development] DragonFire1024:
So I don't know if this is supposed to happen or not. I've had USB.config at mtp,adb,acm on my test HD 10 since I found the prop. Yesterday I again tried to flash a room, which again errored out again for weird reasons. Most of the time I did a wipe off everything in flash fire, except internal storage. It wasn't until several script fixes and flashes later that I realized at no time since I've had to reactivate adb in developer options. In fact the only time I had to reconfirm was the last reset/flash I did. I had tried adb twice and was denied (at setup wizard welcome screen) and a few seconds after letting it sit, the confirmation came up. This however isn't very helpful with the SuperSU grant/prompt issue as the data wipe resets it's preferences, even with addon.d so you can't disable the setup wizard on boot. That would be a bonus if we could do that at the time it spends on the second fire logo/loading screen so if gapps was flashed before, it's setup wizard could take over. Has anyone tried older SuperSU versions?
[Fire Android Development] Rortiz2:
But what happens if you put it in prompt? Do not ask for the superuser request?

We could modify the supersu apk so that by default came the grant mode but I don't know if this will work.
[Fire Android Development] DragonFire1024:
Tried that right away and the prompt never comes. Also if it's a matter of just waiting for all boot to complete, that might explain the delay in adb at first.
[Fire Android Development] Robius:
Sounds like you guys should do a join.me session.
[Fire Android Development] k4y0z:
Boot modes

I found a way to enter different boot-modes on the fire, the following modes can be accessed using a modified handshake.py (from aftv2-tools):

METAMETA (Meta Mode)

ADVEMETA (Advanced Meta Mode)

FACTFACT (Factory Mode)

FACTORYM (ATE Factory Mode)

FASTBOOT (Fastboot mode)

I have only been successful using this with USB-2.0-ports.

Enter the desired bootmode by appending it to the command:

./handshake2.py FACTFACT

Run the command and then plugin the device (which must be powered off)

I'm not sure what exactly these modes do. Maybe someone want's to try these on a stock ROM.
[Fire Android Development] DragonFire1024:
I might just be blind...but how do we run the command if the device is off?
[Fire Android Development] k4y0z:
The command runs on the PC and talks to the Preloader.
[Fire Android Development] DragonFire1024:
I understand that. But that is a python command. You can't just open an adb window and type './' it doesn't work. A little more instruction would be helpful.
[Fire Android Development] k4y0z:
The python-script needs to run on your PC, not on the tablet.

It uses the same method as described by [MENTION=4381075]hwmod[/MENTION] in https://xdaforums.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
[Fire Android Development] DragonFire1024:
Again i am aware it runs on the PC. I jump from thread to thread all the time trying to figure stuff out because instructions aren't properly given in just one post...ever it seems. You can't do ./ in a command window on a PC unless you are in a linux type environment. So that's a lot of instruction just thrown out right there.
[Fire Android Development] k4y0z:
I haven't tested it on Windows, but it should work as well.

You may have to run it like this:

handshake2.py FACTFACT

or

.\handshake2.py FACTFACT
[Fire Android Development] Droidriven:
Install a linux distro on a live USB in persistance mode with as much persistant space as you want/need/can get on the USB that you install it on. Then boot into your BIOS on PC and change the boot priority to boot from USB first then save changes and exit then reboot, it should boot the Live USB.

Or, install Oracle VirtualBox, then download the linux distribution of your choice(Debian, Ubuntu, Mint, etc..with whatever desktop environment you want, KDE, Mate, XFCE, etc..), then install the linux distro in VirtualBox.

You can do any and all necessary tasks with a live USB/CD or with a virtual machine running a linux distro. With a virtual machine, you can also set up an android build environment to sync with repo then download source and build recoveries, ROMs and kernels.
[Fire Android Development] DragonFire1024:
Thank you. Already have an ubuntu vm up and running. However I have had a problem getting it to connect to any tablet or phone I plug in. I've tried a few things, but none seem to work.
[Fire Android Development] Droidriven:
Linux should natively connect to android without any special setup.

What VM are you using?

Have you gone to the Linux forum and asked for help troubleshooting the issue?
[Fire Android Development] k4y0z:
I'm not sure a VM is a good choice for this, since the preloader doesn't stay active for very long.

If you wan't to use a linux I suggest you boot a live-system from a USB-stick or install a dual-boot system.
[Fire Android Development] DragonFire1024:
I thought so. I just went ahead and reinstalled everything and pulled up a guide for reference. I missed some things. I'll know when it finishes.

---------- Post added at 11:44 PM ---------- Previous post was at 11:42 PM ----------

I've got plenty of RAM and storage. I've never had a problem in a VM before...provided I install it properly. If not, I think I still have Kali on a USB stick.
[Fire Android Development] Droidriven:
You might need to setup/configure libusb and udev rules.
[Fire Android Development] k4y0z:
Memory or storage won't be an issue here but passing the USB-Device through to a VM might not be fast enough to talk to the preloader.

The handshake won't even work on my laptop using a current debian because the preloader disconnects to quickly. Although I suspect USB-3.0 might be an issue here.

On my desktop using USB-2.0 and an older fedora it works flawlessly.
[Fire Android Development] DragonFire1024:
That's all the time you get. You can download 'sp flash tool'. If you have root, you can set the USB persist prop to this by running from a root shell (may work from adb if not root)

adb shell setprop persist.sys.usb.config mtp,adb,acm

Power off the tablet and disconnect it from the PC. Power it back on and then plug into PC. New drivers should pop up if on windows, one beings the MediaTek preloader drivers. If you see that, disconnect from the PC and power down the tablet.

Open sp flash tool. At this point you need a scatter file for your cpu (mtXXXX etc). If you can find one, continue. I have one for the HD 10 mt8173.

With the scatter file loaded in sp flash tool, make sure the tablet is still powered. Plug it into your PC. You may need to tap DOWNLOAD (ONLY TAP THAT). You will get exactly 17 seconds of a connection to the tool, if you have the scatter files. Then it will disconnect telling you there was a hardware failure on the device or the cable was disconnected, of course neither of which is true. That's what happens on my HD 10. That will be the maximum time you get.
[Fire Android Development] k4y0z:
You don't need the setprop to talk to the preloader or boot-rom.

Just run the handshake while pluging in the device.

Where you able to get the handshake2.py working?

You can actually talk to either the boot-rom or the preloader selectively, but switching boot-modes will only work with the preloader.

To talk to the boot-rom directly you can hold the left volume-button (or both) while pluging in. It should load a different driver than the preloader.

Sadly a scatter-file isn't enough (AFAIR [MENTION=4381075]hwmod[/MENTION] has created one for the mt8127)

The file is also not only cpu-specific but device-specific, since it contains the partitioning, but it can be created when you know the partitioning.

In preloader mode it seems to need a custom download agent (DA-File).

In boot-rom mode it requires an auth-file since the boot-rom is secured.

Some preloader-versions allow direct read/write using aftv2-tools without the use of a download-agent.

I believe the Boot-mode selection (handshake2.py) should work also on the preloaders that don't support read/write.

The boot-rom doesn't seem to support read/write and reports security version 0x05.