yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] DragonFire1024:
Ok more on a non destructive way to bootrom. It appears it can be done through a terminal, though not sure how to do it. There is a system/bin called 'input' which when executed you have the option to programmatically enter keyboard keys amongst other things like a joystick or mouse:

u0_a32@suez:/ $ input
Usage: input [<source>] <command> [<arg>...]

The sources are:
mouse
keyboard
joystick
touchnavigation
touchpad
trackball
stylus
dpad
touchscreen
gamepad

The commands and default sources are:
text <string> (Default: touchscreen)
keyevent [--longpress] <key code number or name> ... (Default: keyboard)
tap <x> <y> (Default: touchscreen)
swipe <x1> <y1> <x2> <y2> [duration(ms)] (Default: touchscreen)
press (Default: trackball)
roll <dx> <dy> (Default: trackball)
u0_a32@suez:/ $

You can grab a list of the available keyboards with the command a few of my posts back. (won't list the output as it's too long). But any keyboard listed there, already has a driver installed (that includes mtk-kpd. I'm at work and don't have time right now but see a few posts back for that list on the HD 10.) On here mtk-kpd is located at /dev/input/event0 (might be event 1, I forget off hand. I listed it a few posts back).

Here is a list of commands we can run to figure out the mtk-kpd values. It's in Japanese, but the shell commands are not. I believe if we can locate the key code event values for the 3 key combination, we can use the 'input' script to programmatically boot to bootrom, dl mode or whatever. https://blog.csdn.net/fybon/article/details/17439039

I may have it wrong and this may program the keys into the hardware instead. Either way, we still need the key values.
[Fire Android Development] DragonFire1024:
https://labs.mediatek.com/zh-cn/download/k7elHAAc this looks like it can be useful.
[Fire Android Development] DragonFire1024:
Wow. So I unlocked my Fire 7 that was rooted. I decided to look at /sys/fs/selinux/booleans and see what device_unlocked says since I added TWRP. On my Fire 7:

su
getsebool -a
device_unlocked --> on
root@ford: /#

So it seems device_unlocked does actually indicate an unlocked bootloader or at least the appearance of one. There has to be a way to exploit this. We can already change the booleans. The problem is it doesn't persist. You reboot, it goes back to off.

[MENTION=4381075]hwmod[/MENTION]

[MENTION=9667509]xyz`[/MENTION]

[MENTION=8132642]diplomatic[/MENTION] anyone with any ideas?
[Fire Android Development] Rortiz2:
Fire 7 (AUSTIN) Unlocked:

root@austin:/ # getsebool -a
getsebool -a
device_unlocked --> off
root@austin:/ #

That means that those booleans have nothing to do with the Bootloader Unlock..
[Fire Android Development] DragonFire1024:
Weird. On my Ford it says device unlocked on...since I added TWRP. Very bizarre.
[Fire Android Development] Rortiz2:
Yes and on my austin says device unlocked off... Since I added TWRP

Enviado desde mi Mi A2 mediante Tapatalk
[Fire Android Development] DragonFire1024:
Does ro.boot.unlocked_kernel=yes?
[Fire Android Development] Rortiz2:
I do not know. Right now I'm not at home. When I can, I look at it.

Enviado desde mi Mi A2 mediante Tapatalk
[Fire Android Development] DragonFire1024:
One more thing. If a persist property is considered 'legitimate', it passes into /data/property where it sits until you wipe the dalvik and cache. It then goes onto /dev/_properties_ am I correct? I'll let you know why I ask, depending on the answer.
[Fire Android Development] DragonFire1024:
I found hardware signature keys.

https://github.com/Goayandi/vendor_.../security/chip_config/s/key/CHIP_TEST_KEY.ini
[Fire Android Development] Rortiz2:
Yes, but I do not understand where you want to go with these properties.

PS: I still have not been able to look at ro.boot.unlocked_kernel = yes
[Fire Android Development] DragonFire1024:
I'm trying to determine what properties (build prop or setprop) I add that are persisting or working or have at least been accepted into the system.
[Fire Android Development] t3chwizard:
Guys I'm beyond confused reading this thread now. What's the progress so far? Saw someone mentioning an unlock in other threads and linked a newer reply here but I'm still confused. Is there an unlock guide for the Fire 7 2015? I don't wanna end up bricking my device by following random posts in this thread.

Hopefully someone can summarize for me because there's so much it's overwhelming.
[Fire Android Development] Rortiz2:
LOL:

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] t3chwizard:
It's been a long week, thanks lol
[Fire Android Development] DragonFire1024:
Just an observation. According to the HD 10, mt8173 source code, Amazon didn't remove the kernel commandline. It never had one: https://github.com/Goayandi/device_mediatek-mt8173/blob/aosp-7.0/mt8173/BoardConfig.mk

---------- Post added at 06:04 PM ---------- Previous post was at 05:22 PM ----------

Also the reason why we can't set boot mode, at least in terms of setprop...the kernel intentionally sets them all to unknown or 0 in android. But this too wasn't done by Amazon. https://android.googlesource.com/platform/system/core/+/8886112^!/
[Fire Android Development] Droidriven:
Yeah, AmazonOS is very different from the typical android OS.
[Fire Android Development] DragonFire1024:
What I found interesting too is the fact amazon left the datool module in the kernel. It looks like some of it was edited to zero out the values...but it doesn't look like all of them were. I could be reading this wrong, but it looks like this is how they block the use of flash tool. Instead of zeroing it out like they did most of the other values, it looks like it was just reassigned another USB property. This really is a surprise to see this module here. They removed nearly every other one...gps etc. What is unknown that's above bootrom? This also says tty_usb can write to data on the device in bootrom. This is from Amazon's source.

#include <arpa/inet.h>
#include "tty_usb.h"
#define TGT_TYPE_UNKNOWN 0
#define TGT_TYPE_BROM 1
#define TGT_TYPE_PRELOADER 2

static int _target_type = TGT_TYPE_UNKNOWN;
static int _match_usb_br(usb_ifc_info *ifc)
{
_target_type = TGT_TYPE_UNKNOWN;
if(ifc->vid == 0x0E8D && ifc->pid ==0x0003)
{
_target_type = TGT_TYPE_BROM;
return 0;
}
return -1;
}

static int _match_usb_pl(usb_ifc_info *ifc)
{
_target_type = TGT_TYPE_UNKNOWN;
if((ifc->vid == 0x0E8D && ifc->pid == 0x2000) ||
(ifc->vid == 0x0E8D && ifc->pid == 0x3000))
{
_target_type = TGT_TYPE_PRELOADER;
return 0;
}
return -1;
}

static int _match_usb_auto(usb_ifc_info *ifc)
{
if(_match_usb_br(ifc)==0)
return 0;
if(_match_usb_pl(ifc)==0)
return 0;
return -1;
}

tty_usb_handle *tty_usb_open_br(void)
{
return tty_usb_open(_match_usb_br);
}

tty_usb_handle *tty_usb_open_pl(void)
{
return tty_usb_open(_match_usb_pl);
}

tty_usb_handle *tty_usb_open_auto(void)
{
return tty_usb_open(_match_usb_auto);
}

bool tty_usb_is_target_brom(void)
{
return (_target_type==TGT_TYPE_BROM);
}

void tty_usb_w8(tty_usb_handle *h, uint8_t data)
{
tty_usb_write(h, &data, 1);
}

uint8_t tty_usb_r8(tty_usb_handle *h)
{
uint8_t data;
tty_usb_read(h, &data, 1);
return data;
}

int tty_usb_w8_echo(tty_usb_handle *h, uint8_t data)
{
tty_usb_w8(h, data);
if(tty_usb_r8(h)!=data) return -1;
return 0;
}

void tty_usb_w16(tty_usb_handle *h, uint16_t data)
{
data = htons(data);
tty_usb_write(h, &data, 2);
}

uint16_t tty_usb_r16(tty_usb_handle *h)
{
uint16_t data;
tty_usb_read(h, &data, 2);
return ntohs(data);
}

int tty_usb_w16_echo(tty_usb_handle *h, uint16_t data)
{
tty_usb_w16(h, data);
if(tty_usb_r16(h)!=data) return -1;
return 0;
}

void tty_usb_w32(tty_usb_handle *h, uint32_t data)
{
data = htonl(data);
tty_usb_write(h, &data, 4);
}

uint32_t tty_usb_r32(tty_usb_handle *h)
{
uint32_t data;
tty_usb_read(h, &data, 4);
return ntohl(data);
}

int tty_usb_w32_echo(tty_usb_handle *h, uint32_t data)
{
tty_usb_w32(h, data);
if(tty_usb_r32(h)!=data) return -1;
return 0;
}
[Fire Android Development] supercouto:
The VDD1 seems to be blocked for connection (coated on the green stuff)... do you connect to the resistors?
[Fire Android Development] Sai Nyan Linn:
Amazon fire 5th

Fire Os 5.3.6.4

Bootloader unlock need. Please
[Fire Android Development] Sai Nyan Linn:
amazon 5th generation is need root ...

amazon 5th generation is need root ...

this is not bootloader unlcok fail or need " unlock.bin "

---------- Post added at 01:01 PM ---------- Previous post was at 12:50 PM ----------

amazon fire 5th generation bootloader unlock need please
[Fire Android Development] Rortiz2:
Really. Did you search before asking? :facepalm:

Is it so hard to use this?

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860

....
[Fire Android Development] jdk0248:
How do I short a pin? When I do a quick google search, it says I would connect two pins together. Do I just pick two and connect them with something conductive? If so, it wasn't very clear in the guide. Also, what do you mean by "I use a 100ohm resistor to ground (shield) to be on the safe [side]"? You took a resistor and connected one side to the VDD1 pin and the other side to... what? One of the other two pins? Something you would ground yourself on before touching a motherboard (kitchen sink, etc.)?

Please be very specific as I am new to this type of thing.
[Fire Android Development] Rortiz2:
Use a clip or a needle.
[Fire Android Development] jdk0248:
Please be more specific

I have no idea what you mean by “use a clip or a needle.” “Use” is a very vague word, do you mean connect two of the pins with the pin/needle?

As I said in my first post,

Please Be More Specific!!!
[Fire Android Development] Droidriven:
Yes, use any kind of material that is conductive(paperclip, length of wire, a needle, etc..) and touch it to the correct pins.
[Fire Android Development] Rortiz2:
Lol, you can always use google or the search tool...

Yes, I meant connect two pins with the pin/needle...
[Fire Android Development] DB126:
Wow - pretty demanding given you are the one that needs assistance. Google is your friend (including YouTube) or refer to the dozens of photos posted in these forums. Might have to invest a few hours researching. That's how things work around here.

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] jdk0248:
Details!

Touch them individually? Connect them? Connect them to the metal shield I cut open to access the pins? I need lots of detail of possible, please.
[Fire Android Development] Rortiz2:
Can you search in the fucinkg forum?

Oh my god, only connect them to a metal, the shield would be fine.
[Fire Android Development] DB126:
Wants to be spoon fed ... :rolleyes:
[Fire Android Development] Droidriven:
We do not spoonfeed, we do not lead members by the hand and we do not do the thinking for you, regardless of how much you don't understand. In your case, you are so completely lost that it is obvious that you just won't understand no matter how many of your questions we answer.

You don't know anything about electricity, do you? Electricity requires contact between two points in order for the electricity to flow. The conductor that you use(paperclip, wire, needle) has two ends, so what does that tell you?

It is thoroughly explained in detail in the guide, if you can't understand the guide or any of the answers that you have been given, then you need to leave your device(s) alone and forget about modifying/flashing them. If you can't even understand the simplest instructions then that severely limits our ability to help you.

If this member can't read the full guide or our answers and get at least a most basic understanding, then maybe we should overlook this members questions and let them continue reading and researching, if they can't do that then there is no hope for them.
[Fire Android Development] t3chwizard:
I always say that if someone can't follow a guide they shouldn't be modifying their device to begin with. Too risky unless you can follow instructions IMO. I don't want to cause someone to brick their device. I agree with you completely.
[Fire Android Development] Litleck:
I'm trying to root my amazon fire 7 but each time I short the cmd pin to gnd it just says a serial mismatch error. I want to try VDD1 but I'm unable to find it on mine. Can you or someone else help me find it?

Thanks.
[Fire Android Development] DragonFire1024:
If its on the side facing us and not covered up by the rest of the heat shield frame, there are three unlabeled points below the small, fully exposed mediatek chip. Those appear to be the only ones on this side of the board besides tx and rx which is your Wi-Fi.
[Fire Android Development] k4y0z:
It seems you have a 5th gen (ford), why not just use the downgrade method?

TX/RX is not the WiFi :rolleyes:
[Fire Android Development] DB126:
Texas prescription?
[Fire Android Development] DragonFire1024:
What is it then?
[Fire Android Development] k4y0z:
UART...
[Fire Android Development] amart79196:
One thing that is of the utmost importance.

Do NOT SOLDER TO THE PADS ON THE MOTHERBOARD. They are very fragile and will rip off with the easiest bit of effort. There is not a hole where the pad was and now that trace is broken rendering the tablet useless. When it breaks, the possibility of repair is almost impossible without very good luck, a very steady hand, and excellent magnification of sight. Even with that, the chances of seeing the damage and what you would need to do in time and efforts far outweighs the price to just go and buy a new motherboard.

If you need to solder, only do it to the metal box cover brackets and then just move with your hand to one of the spots that have been highlighted by the OP in the picture that is attached in the OP post. Apply pressure by hand to one of those spots ONLY. Do not solder.
[Fire Android Development] Michajin:
I am not sure why anyone would solder anything... this device can be unlocked with a simple short. This thread is old...
[Fire Android Development] amart79196:
Posted in the wrong thread. This was supposed to go in the ford thread. https://xdaforums.com/showpost.php?p=77501192&postcount=365

Not sure what the system put it here, but when i click on "reply" to that thread, it puts the posts here in this thread. Oh well.
[Fire Android Development] XRed_CubeX:
Hi everyone, I am looking for ideas on how to unlock the bootloader on a meizu m5c, I have searched all over the internet on how to do it, try to modify sececfg, seccfg of other devices but nothing has served.

This is my situation:

I have a Meizu m5c with android 6.0 and MT6737M, the chipset is almost the same as a meizu device, Meizu M2 which has been successfully unlocked, asking for help they also advised me to try to flash the meizu m2 firmware on the m5c and unlock , however I did the reverse to understand if it can be done because the meizu m5c cannot be unbrick unlike the meizu m2. The meizu m2 didn't start as expected so I reset it as before.

No other meizu has mt6737m.

The situation is that meizu limits unlocking to all devices and people must use LKs taken from engineer roms or from decompiled sources but there has never been a guide for meizu m5c.

Most of the meizu have been unlocked and I have several unlocked too: M2, M3s.

Meizu in her bootloader (Lk or little kernel) removes the "fastboot oem unlock" command to make sure that nobody unlocks the bootloader.

I heard that amonet (exploit that did great things in amazon devices) allows unlocking but they told me that you need to solder and have the UART cable.

I don't have any experience in soldering nor in the use of UART cable but I don't want to risk physically breaking the device because I don't really have experience in soldering.

This is the situation for the meizu m5c, if you have any ideas please tell me that I will always be ready to try.
[Fire Android Development] DB126:
Off topic here; this forum/thread is for Amazon devices.
[Fire Android Development] XRed_CubeX:
Forgive me, I hadn't noticed, by searching on google it wasn't written that it was for fire but in any case the thread title is too generic. However, the problem is always that
[Fire Android Development] Zacharybinx34:
The thing I can't figure out is what do I connect my the other end of paperclick to once it's touching that pin? Does it matter?

No matter what, I get "ERROR: Serial Protocol mismatch."
[Fire Android Development] GrumpyUnk:
Did I miss something along the way?

Shorting a pin to ground is the mechanical connection of the pin to the shield(as a given ground plane) for one option. Other than that you will have to find a pin labeled GND(sometimes).

I'm sure you got an answer a long time ago, but I felt like typing.
[Fire Android Development] hwmod:
YES ! We can write to the "recovery" partition as many time we need but as said by Kramar111 the recovery code itself is not going to work without a bootloader "unlock". I successfully wrote the TWRP to the "recovery" partition, it didn't work, but I could rollback and write the original "recovery" again.

This allow us to "unbrick" many devices and will let us start testing all our ideas knowing that we can rollback almost any situation except writing the to the "preloader" partition. This is a good for future development.

.:HWMOD:.
[Fire Android Development] Kramar111:
[MENTION=4381075]hwmod[/MENTION]

Can you access to EMMC thru handshake on fw 5.1.2 and higher? ;)
[Fire Android Development] hwmod:
I do not have version 5.1.2 or higher, however from the tests that I have done with [MENTION=4246643]Tomsgt[/MENTION] on a 5.1.2 tablet he owns it seems that is absolutely feasible. The fact we are using code developed for the AFTV2 seems to indicate this will be possible on all the current line of Mediatek SoC. That means also on other Amazon devices equipped with such type of SoC like the HD8/HD10 which use the MT8135.

.:HWMOD:.
[Fire Android Development] dorkydroid:
i tried it last night, but couldn't seem to get it past the handshake. i'm guessing mine must be a different kind of brick. i know it shows up in the device manager as mt65xx preloader, but only for a few seconds and then it disappears and reappears randomly. hoping to get this tablet up and running again soon. i thought mine was running 5.1.1 but must have been a different build...
[Fire Android Development] Awesomeslayerg:
It's easier to do it on a Linux distribution. Soumds like you don't have the drivers installed
[Fire Android Development] gwhite5:
Just pointing things out...

The lk.bin has some strings of interest.

There must be a function called amzn_unlock_verify which checks the unlock code, and gives you the 'unlock code error'. The function itself has these formats to print to UART:

%s: Failed to convert RSA key

%s: Failed to get unlock code

%s: Invalid signature size: %d

%s: RSA decryption failed

%s: Unlock code verified

%s: Invalid unlock code

%s: Insufficient memory

I'm doubting you'll be able to generate your own unlock key – they encrypt it with RSA – but what's interesting is that Amazon have support for unlocking the bootloader in the first place.
[Fire Android Development] Awesomeslayerg:
https://www.reddit.com/r/Android/comments/4luifx/qualcomm_trustzone_keymaster_keys_are_extracted/

Just gonna leave this here
[Fire Android Development] armada786:
This is impressive, but is it really relevant? This is a MediaTek chipset not Qualcomm.
[Fire Android Development] Awesomeslayerg:
I forgot the fire has a mediate chip
[Fire Android Development] gwhite5:
I've updated my thread on XDA here about this.
[Fire Android Development] hwmod:
Does somebody ...

Know how to build/create an "auth_sv5.auth" file ?

Or have info about it's content and format?

Or have link to documentation ?

Thank you in advance,

.:HWMOD:.
[Fire Android Development] Awesomeslayerg:
No updates?
[Fire Android Development] Tomsgt:
I had a thought about downgrading the device. I have test and can force write a older preloader to the device with root access and adb. so if i can do this why not try and force a older preloader and bootloader and boot image to the device along with recovery then reboot to recovery and flash a older firmware version like 5.1.1 and see if we can et twrp again. its just a thought but i think it would work.
[Fire Android Development] bibikalka:
Sure, and upon the very first boot the older preloader will check your versions of TEE1 and UBOOT, will notice that they are older than the ones that it already ran, and will refuse to boot ! Not to say that it'll find it's own version to be older than what was run before, so it'll quit too!

Now, if one could find a preloader that did not have anti-rollback protections, that would be something. I've attempted to request an old version here :

http://xdaforums.com/showpost.php?p=67683514&postcount=6

But it may already have the anti-rollback stuff in it, so tough luck ...

Update: Here is what you'll get when you write an older preloader on top of the newer one that already ran at least once (see the brick causing text in red):

http://xdaforums.com/showpost.php?p=67348911&postcount=52
[Fire Android Development] hobbit19:
The tablet runs on the MTK

it must be flash

SP flash tool http://spflashtool.com/

We need to demand from Amazon sourсe Uboot

GPL

---------- Post added at 05:03 PM ---------- Previous post was at 04:59 PM ----------

I think we will have no problems

if we patch uboot

I think we will have no problems

if we patch

flash all the sections at once

http://dev.pyra-handheld.com/index....353d73a724d3e87/arch/arm/boot/dts/mt8135.dtsi

also we can search other tablets

* Firmware with mt8135

http://www.51cubestore.com/cube-tal...nch-retina-2048-1536-13-0-mp-android-4-2.html
[Fire Android Development] hwmod:
Similar tablets having the same MT8127 SoC and features

It seems too risky to use binary code of different processors even if they are very similar.

It is not just about the processor it is the complete hardware that must match.

However, if one would try that path, I suggest to use the preloader of a tablet that AT LEAST

has the same MT8127 SoC. I can give the name/model of a couple of them for example:

Digiland DL1010Q

Cube U27GT

These tablets have similar features and hardware, however I wouldn't bet on binary compatibility.

It will be easy to find/download the firmware by searching in Google, they both contains a

MT8127_Scatter.txt file, so they are the best match to compare to our Fire 7 5Gen and

they seems both unlocked, I mean they don't have the [ANTI-ROLLBACK] code.

.:HWMOD:.
[Fire Android Development] hobbit19:
yes

I am a little mistake

8135 in hd8 / hd10

but we need sourсe uboot

* then we will be able to make all models unlock

flashed uboot

another model is dangerous

do we need to study

and we very much needed source

we should all demand it from Amazon

---------- Post added at 01:10 PM ---------- Previous post was at 01:05 PM ----------

https://forums.lenovo.com/t5/Lenovo...ock-Rom-Firmware-for-Tab3-7-quot/td-p/3314965
[Fire Android Development] mkhcb:
Wait so 5.1.1 can have TWRP? My Fire, that I got from Prime day came pre-loaded with 5.1.1 and I was careful to not update and disable updates. I am now on CM 12.1, with root and xposed. I would love an unlocked bootloader for peace of mind cause if I enter a bootloop, I'll have to sideload Fire OS again and then go through the whole flashing process with FlashFire.

Any thoughts on how I can get TWRP onto my device as a default recovery?

May we apply a similar method to this: http://xdaforums.com/galaxy-nexus/themes-apps/app-bootunlocker-nexus-devices-version-t1731993

<--- unlocks the bootloader without fastboot, all that apk needs is SU access.

Worked well on the OnePlus One and on the Nexus.

This method: http://xdaforums.com/oneplus-one/development/mod-reset-unlock-tamper-bit-t2820912 ... unlocks the bootloader when you flash the file... may someone make something like that, to use with flashfire?
[Fire Android Development] sd_shadow:
twrp only works with 5.0.X
[Fire Android Development] Kramar111:
Fire have completely different partitions and scatter was already published by [MENTION=4381075]hwmod[/MENTION] in other thread