yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] jdeandeck:
Ok so i dont know if any of this will help but....

root@ford:/ # idme print
board_id: 0025001050010015
serial: G000H4045445154K
mac_addr: F0272D9D13E0
mac_sec: 3ECQJN1SLTE1HRUQ770F
bt_mac_addr: 84D6D0221452
product_name: 0
productid: 0
productid2: 0
bootmode: 0
postmode: 0
bootcount: 64
manufacturing: PSN=P00082035443042S FSN=3862080402143
unlock_code:
sensorcal: 4800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
register_tag: 715aa2763b01f250
KB:
4b 42 50 46 18 0e 00 00 28 0e
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
DKB:
30 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
device_type_id: A2M4YX06LWP8WI
dev_flags: 0
fos_flags: 0
usr_flags: 0
root@ford:/ #

And

fastboot getvar all
(bootloader)	max-download-size: 134217728
(bootloader)	partition-size:userdata: 17329be00
(bootloader)	partition-type:userdata: unknown
(bootloader)	partition-size:cache: fa00000
(bootloader)	partition-type:cache: unknown
(bootloader)	partition-size:system: 4b000000
(bootloader)	partition-type:system: unknown
(bootloader)	partition-size:TEE2: 500000
(bootloader)	partition-type:TEE2: unknown
(bootloader)	partition-size:TEE1: 500000
(bootloader)	partition-type:TEE1: unknown
(bootloader)	partition-size:LOGO: 380000
(bootloader)	partition-type:LOGO: unknown
(bootloader)	partition-size:MISC: 80000
(bootloader)	partition-type:MISC: unknown
(bootloader)	partition-size:recovery: 1000000
(bootloader)	partition-type:recovery: unknown
(bootloader)	partition-size:boot: 1000000
(bootloader)	partition-type:boot: unknown
(bootloader)	partition-size:UBOOT: 100000
(bootloader)	partition-type:UBOOT: unknown
(bootloader)	partition-size:EXPDB: 1160000
(bootloader)	partition-type:EXPDB: unknown
(bootloader)	partition-size:DKB: 100000
(bootloader)	partition-type:DKB: unknown
(bootloader)	partition-size:KB: 100000
(bootloader)	partition-type:KB: unknown
(bootloader)	off-mode-charge: 1
(bootloader)	secure: yes
(bootloader)	kernel: lk
(bootloader)	product: FORD
(bootloader)	version: 0.5
(bootloader)	unlock_status: false
(bootloader)	unlock_version: 1
(bootloader)	unlock_code: 0x444d63d061775c38
(bootloader)	prod: 1
all: Done!!
finished. total time: 0.012s

if there is anything i can do/donate to help such as Raw image files or logs let me know i have Amazon Fire 5.1.1 rooted after ota, it updated overnight before i could look anything up, my wife got this for xmas, with gapps framework, hidden fireos launcher, and hidden ota's and such, can use fastboot oem append-cmdline "androidboot.unlocked_kernel=true" to run adb as root and remount my file system, and i am going to pull a full mmcblk0 raw binary image tonight hopefully it will work. going to run some file system forensics on the image and hopefully find some hidden or deleted files from when devices where manufactured.
[Fire Android Development] noelcragg:
serial console: no soldering!

In reading threads about other phones and tablets, I somewhere ran across a mention that perhaps the USB port can be used directly as the console. After a bit of experimentation, I got that to work on the Fire.

TTL USB A/B USB MINI/MICRO
SIGNAL PORT PIN PORT PIN
--------- --------- ---------------
+5V 1 1
RX 2 2
TX 3 3
NC 4
GND 5 4

I verified that this works with three USB/serial chipsets: FT232RL, PL-2302/X, and CP2102.
[Fire Android Development] noelcragg:
picture of usb-serial connected to micro usb plug

For those who are more visually-oriented, I've attached a picture showing the attachment of a FT232RL USB-to-TTL-Serial adapter to a 5-pin micro USB plug.
[Fire Android Development] Tomsgt:
anti rollback is the problem with that brick like we all figured but still cool to see it in the output
[Fire Android Development] t3chwizard:
Is it a lost cause at this point?
[Fire Android Development] BeeWall:
I don't think so, because the VM would need a booted system. Otherwise, it would be way too simple to do that.

If someone comes along with the skill to modify the preloader and LK, that might allow for removal of the signature check, and pretty much unlock the bootloader.
[Fire Android Development] DragonFire1024:
I've learned a good many things around here are far from simple :P Well since the idea would be to trick the actual bootloader, couldn't you run, for lack of better terms, a so-called 'boot loop?' Since the idea is to trick it for just a short period, could a timed loop be devised? I'm trying to say...let the M and device system boot side by side. The fake boot just needs enough time to trick the bootloader right? Tag a few seconds onto the end of the fake boot which would essentially stop it from performing anymore tasks, but leave it running in the background until you flash ROM etc. I'm just throwing thoughts out here. It was nice to see someone sorta being on the same page.
[Fire Android Development] DragonFire1024:
So I thought a bit more. There has to be a way to trick the device. For example; If your computer is infected with a virus, you can create a bootable CD or USB drive from the Sophos website. You insert the CD or drive then shutdown your computer. Turn it back on and depending on your operating system version, motherboard and whether or not your computer is custom built, you would press one of the buttons F1-12 which would take you to a menu to choose what you boot from first (USB, CD, Hard Drive etc). In this case, click the option for the the CD rom or USB drive you inserted and click ok/continue. If there's no OK button, try double clicking on the item. The PC would then restart and boot only from the CD or USB drive, overriding Windows and stopping any part of it from ever booting.

Sophos then uses their antivirus program combined with a small Linux operating system called Slax. It then scans the Windows partition(s) of your hard drive for viruses and attempts to remove them and repair the damage they caused. It's very difficult for a Linux OS to be infected with a virus so I guess it's even better at getting rid of them, if you ask Sophos.

Now I only know this works because I unfortunately had a virus not long ago and I had to perform this task, however it failed. I used the USB drive option. I did something wrong or the virus was smarter because everything worked up to the Slax Linux boot screen. Instead of booting to the Sophos antivirus, Slax was fully booted instead. My point is, It operated over the top of Windows, 'tricking' your computer during the boot process and at no point does any Windows process boot.

So would there be a way to somehow plug a micro USB drive, loaded with a temporary bootable ROM or something to that effect, into the device and somehow trick the device into booting only from the USB drive? That's sorta where my virtual machine line of thought rolls in if a drive won't work. Could a virtual machine app be created to essentially act as a boot CD or USB drive? In theory this could work as long as the CD/drive boots first, stops the other part from booting altogether and continues to 'boot' the device from the VM.
[Fire Android Development] fmc000:
You can stop here.

There's no such thing on Android devices, you have the bootloader that can boot in fastboot mode, in recovery mode or in standard mode. In fastboot mode you cannot boot a custom recovery and in the standard recovery mode you cannot flash a different ROM.

So you're basically stuck with the standard FireOS unless you can root it.
[Fire Android Development] DB126:
Sure - if you have an older MBR based device sans EUFI and secure boot. That's not going to work with these pups or any other mobile device with access/boot security baked in to the basic architecture.

Yep. And only a subset of the device's potential capability as the bootloader remains locked.
[Fire Android Development] DragonFire1024:
This may very well be a stupid question, but can't you mount a USB drive onto some Android devices? My XT907 for example:
[Fire Android Development] BeeWall:
However, you can't boot it, and either way it would need to be signed by Amazon.
[Fire Android Development] Ownster:
Unless you are still on the FireOS 5.0.1 bootloader, which not many people are.
[Fire Android Development] blakegriplingph:
To clarify things, it is possible for some Android devices to boot off a flash disk or a memory stick, but that depends on the SoC. Allwinner chips tend to have that functionality, and I think that spurred a Linux scene around those devices.
[Fire Android Development] BeeWall:
And even then, you would need fastboot and a computer every boot.

Thinking about it, if one was so inclined, they could probably make a kernel that, when booted, looks somewhere besides the system partition to boot, so that Lollipop could be booted normally with the stock kernel, and another ROM when booted from fastboot. But that would be a lot of work for only a few people to enjoy.
[Fire Android Development] t3chwizard:
Any progress ladies and gents?
[Fire Android Development] manups4e:
here is a post not anymore useful for fire hdx 8 but maybe for us is still useful (i tried it but i gives me "unlock code error" at the end)

in attach there is the zip with python tools they used..
[Fire Android Development] DB126:
Fire 7 (5th/7th gen) and likely 6th gen HD 8 bootloader is not vulnerable to this type of signature forging.
[Fire Android Development] manups4e:
damn... i have the fire 7 7th.. and they gave me it already updated to 5.3.3.0...
[Fire Android Development] t3chwizard:
I loov my fire 7 5th gen. Even running Lollipop it is still an awesome device.
[Fire Android Development] Robius:
If you are good with code / scripts and want to try your hand at many potential exploits, here's a list of many from 2017 to try on the 7th gen Fire 7" for a root attempt..

Some can't have been patched before it shipped.

http://www.cvedetails.com/vulnerabi...19997/year-2017/opgpriv-1/Google-Android.html
[Fire Android Development] Alaxmofo:
Really noob question probably, but has anybody tried hex to dec converter ? Or vice versa.
[Fire Android Development] Robius:
That's too simple..

Excellent question.
[Fire Android Development] BeeWall:
The OP did.
[Fire Android Development] DragonFire1024:
I came across these in my search for rooting efforts. Probably won't be of any use, but I figure I would post anyways. I know nothing about this level of technology. We are running the MT8163 chipset. I found some .img of a couple other tablets with MT8163s. Maybe they are of use, maybe not.

http://www.stupdroid.com/2017/07/firmware-download-TECLAST-P80H.html

http://ahsantelicom.blogspot.com/2017/05/alba-ac70plv4-mt8163-v-51-100testedread.html
[Fire Android Development] BeeWall:
Are we able to read/write to the preloader? If so, and if anyone here understands arm assembly, we could disassemble preloader or uboot, remove the check, reassemble, and flash it.
[Fire Android Development] zeroepoch:
That won't work since it has to be signed. I tried that on the fire TV 2 and it now goes to a preloader in some ROM and is basically a brick because flash isn't available anymore. I changed one bit in an immediate that was overwritten later anyways during initialization so it shouldn't have caused any issues. That single bit causes it not to load anymore.
[Fire Android Development] t3chwizard:
I feel your pain. The worst kind of brick is when you have soft bricked it to the point where it can't be recovered yet the hardware is perfectly functional. So frustrating.

A while back I did something similar to my ASUS TF300T. In the end it couldn't get into fastboot and I had to swap the motherboard just to get it functional again because ASUS decided NVFlash was no longer necessary after 4.2 update and removed it from the BL. Only way to recover was if I had made an NVFlash blob (which are specific to the main board so you can't use someone else's even if they gave it to you) and now people have come up with a method that allows those on 4.2+ to make blobs so as soon as swapped the boards I made a backup so I wouldn't make the same mistake again.
[Fire Android Development] BeeWall:
Out of curiosity, what verifies that the preloader is signed? Is it some sort of processor ROM?
[Fire Android Development] zeroepoch:
I'm not sure but I would guess it's something in the ROM. In terms of stuff from flash memory the preloader is the first thing loaded. It verifies lk (little kernel which is fast boot in this case) before booting the kernel. If you hacked the preloader somehow you could do anything after that.
[Fire Android Development] Robius:
New security patches out which means new exploits to try.

There is mention of MediaTek chips too.

Android Security Bulletin Released for August 2017; Security Update Rolling Out to Supported Google Devices

https://r.tapatalk.com/shareLink?sh...droid-security-bulletin-updates/&share_type=b
[Fire Android Development] blakegriplingph:
This should apply to the MT8127, but I am not exactly sure: http://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preloader/
[Fire Android Development] BeeWall:
I'm kind of confused about how the "fastboot flash unlock" command would work. According to here,

So how does the command pass the file? Or is it because the command doesn't follow the "fastboot oem {command}" format?
[Fire Android Development] zeroepoch:
Yes that is mostly applicable. In fact it was one of the documents I use to learn about the preloader to develop aftv2-tools to write to the flash from the preloader. That document is more about the boot process than exploiting certain commands it exports.
[Fire Android Development] blakegriplingph:
I know this is slightly off topic, but I've been wondering for months on how to revive a soft-bricked MT8127 device with a similarly locked preloader. I wiped one of my LeapFrog Epic units clean and touched the preloader by accident, and now it only shows up as a USB Serial Device, and I couldn't get it to kick out of that mode.
[Fire Android Development] zeroepoch:
If even one bit of the preloader changed then there isn't much you can do at least that I've been able to figure out. There is a backup preloader or something that functions just like it but all my flash related reads just time out.
[Fire Android Development] blakegriplingph:
So I'm SOL then? :'(

I'm certain it's still possible as I've read of people who managed to revive their devices from a corrupted preloader or something.
[Fire Android Development] savvytechwinner:
Ok, I know I sound like a huge noob saying this but I have to ask.

Would making a scatter file on a Fire Nexus sucseed? And if it did, would it be able to flash on Fire OS?
[Fire Android Development] DB126:
Setting aside implementation logistics how do you propose to do that?
[Fire Android Development] savvytechwinner:
You can create a scatter file using sp flash tool., if someone that was on the Fire Nexus ROM created a scatter file and uploaded it, couldn't we flash it on a regluar fire os device using SP Flash tool
[Fire Android Development] DB126:
AFAIK scatter files are ROM dependent (don't quote me on that ... a little out of my league). Supposedly sp flash tool works on a locked bootloader but me thinks the crippled fastboot environment may present a barrier. Hopefully someone more knowledgeable chimes in.
[Fire Android Development] zeroepoch:
It's very likely not going to work. It's not hard to create a scatter file from what I remember. It's mostly a partition map and if you have adb access you can probably create one from information in /dev. The problem is the download agent which would use the scatter file needs to be signed. That's the tool uploaded to the device to actually do the flashing. On some mediatek devices a generic version will work. On the fire TV 2 at least the generic one was not accepted. I would imagine the tablets are the same.
[Fire Android Development] mrmazak:
I just read through this thread, I didnt see any mention of the known available OEM commands that the fastboot mode accepts.

I did the folowing command and find very few oem commands. Unlockis not even one of them.

c:\android>strings C:\android\amazon_fire\04_uboot.img | findstr /i oem

the listed commands are

oem relock
oem idme
oem p2u
oem reboot-recovery
oem append-cmdline
oem off-mode-charge

then follow that with a search for "flashing" because the new style command cound be "flashing_unlock"

and only result was

flashing not allowed

to me this says that fastboot has not been coded with the commands needed to unlock anyway, even if the "unlock code" string was figured out.
[Fire Android Development] DragonFire1024:
We've noticed in the file /system/priv-app/FireTabletSettings.apk there are some strings that block out the OEM unlock function. I will have to look through the threads, but a user did manage to recreate the string in the APK which would allow OEM unlock, however because the signature is destroyed when edited, trying to fool Amazon into thinking it was an updated app when trying to reinstall, have been unsuccessful. That's about the only thing I've seen that pertains to OEM anything. Otherwise inputting the commands for most OEM anything just return errors along the lines of "can't perform this operation on a locked device."

I've been meaning to test something that might allow some kind of systemless modifications, using APKs from an older FireOS version, but haven't gotten around to trying it yet.

What I do know: at least with Fire Launcher, you can replace and downgrade it to an older version (provided you have an older APK which I do and is mentioned in a post in the HD 8 section), without changing the system partition. Whether or not this will work with other APKs is unknown and something I plan to test at some point now that I have a rooted HD 7 running 5.3.1.0.
[Fire Android Development] mrmazak:
That sounds like the other side of the problem.

Meaning, it is normally a switch in the developers options the needs to be enabled "allow oem unlock" before fastboot can do the unlock.

But you can do "oem unlock" when there is custom rom on a device , so an app on the device Shouldn't effect the listing of command strings found in the uboot. But it could cause an error message like "remote unlock not allowed", if the fastboot had the command programmed in.

At first I was confused as to the listed command for unlock from the op.

I thought how can the command to unlock be "flash **.bin" , unless it was already unlocked. Now I'm coming around to understand, the bootloader must already be unlocked but blocks flashing to the partitions we want untill "unlock_status: true"
[Fire Android Development] DragonFire1024:
Absolutely correct. I'll look later today for the thread I spoke of earlier.

I've been able to modify the contents of simple APKs, like the permissions, for at least one project I've been working on lately, Live Wallpapers. I'm not sure how edits affect the signature, as in I've no idea what part of it is destroyed by such edits and why some APKs can be edited in that fashion and be installed with no issues whatsoever, while others don't install.

In this case, I can't even edit framework-res.apk without getting an error when going to recompile it after said edit. So I'm a bit confused in regards to that. I've tried several tools, like APKtool, APK Editor pro (I've had more success with the latter app) and none of them will or can't recompile without issues. So I'm a bit stumped on this one.
[Fire Android Development] DB126:
Seriously, this has nothing to do with the topic of this thread. Futzing at the ROM level isn't going to lead to a bootloader exploit, toggle fastboot oem flags or enhance understanding of how to mount a successful attack against a low-level vulnerability that has yet to be identified. Discussion really belongs somewhere else (different thread).
[Fire Android Development] MeowDude:
Why not just sidelod TWRP through adb like with the 5th gen and just go from there?
[Fire Android Development] BeeWall:
Bolting TWRP is only possible on 5th gen devices with a 5.0.x bootloader. It is not possible on later versions.
[Fire Android Development] MeowDude:
Errr why does amazon have to lock down their devices so much, there's no reason for it. It might actually take away value from the device.
[Fire Android Development] DB126:
Perhaps to the minute fraction of techies who dabble in such matters. Amazon has it right for the vast number buyers who are happy (or at least tolerant) of being locked into Amazon's ecosystem. Keep in mind the modest price point reflects an assumption of future revenue generated directly/indirectly through the use of Amazon branded devices. No doubt they have copious telemetry supporting their business and technical decisions.
[Fire Android Development] MeowDude:
Never thought about that. Hmmm, hey I'm buying a 2012 Nexus 7, is this a good idea? I really only do casual browsing, music, and youtube on my tablet. Its like 80$ on amazon.
[Fire Android Development] DB126:
2nd gen Nexus 7 is a nice device but may feel a bit long in the tooth by today's standards. Might consider a 3rd gen HDX which has an equivalent (arguably better) panel and can accommodate nearly a dozen custom ROMs. However, a bit of up-front work is required including rooting FireOS and installing a 100% legit vulnerable bootloader that unlocks the fastboot commands needed to install/boot TWRP. Has ~2x the horsepower of a Nexus 7 but does NOT support OTG/SD storage which can be quite limiting on 16 GB configs (~11 GB available). Also, no physical GPS and spotty bluetooth support. Otherwise an excellent platform. Keep in mind the battery any device >3 years old while have begun to internally deteriorate regardless of use. Not sure how easy battery changes are on a Nexus 7; nearly impossible on a HDX (lots of glue). When all is said an done you might be happier with a low end phone/phablet (eg: Moto E) even if not activated.
[Fire Android Development] MeowDude:
I was gonna grab an 8gb LTE Moto G (1st gen), and a 32gb 2012 Nexus 7 (also 1st gen nexus 7). I would probably just run Cyanogenmod 12.1 or 11 on the N7 and Stock 5.1.1 on the Moto G. Alot of people say that these are old, but I don't mind, I mostly do media consumption and I'm coming from an iPad Mini (1st gen) and an iPhone 5S (not good). I miss android, so I'm switching back. 1280x800 is a step up from my 1024x768 iPad (atrocious screen).

EDIT: I should really be PMing this.
[Fire Android Development] DB126:
Sure - and to bring this to a close $80 USD is steep for a 1st gen Nexus 7. But that's your call. I also like/appreciate/use older devices. Finding the sweet spot (intersection between cost/capability) is a personal decision. Good luck!
[Fire Android Development] DragonFire1024:
I had a Moto G for the longest time and I loved it. The only reason why I don't have one anymore, is because it ended up at the bottom of a pool one night. Great device for it's time.
[Fire Android Development] DB126:
Still rocking a Moto mini (2nd gen X variant) and two recently acquired G4s Most models (certainly any that I purchase) can be bootloader unlocked on Motorola's site. Needless to say Moto is my goto handset.
[Fire Android Development] mrmazak:
I see in the strings of the 5.1.1 lk there is a "oem idme"

But when I run the command "fastboot oem idme" response is always "unknown command".

And in strings of boot1 there are headers for all the lines that get populated by adb idme print.

When you ls -l /pcoc/idme the list of files includes "unlock_code"

The file is a 1kb binary file full of null/zero's

Does anyone know if this is any possible avenue to pursue, as I have not seen any of these locations disscussed.