yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] TheGoliath:
It doesn't work. Flashing isn't recognized (and I personally don't know, how to convert the binary file to a zip).
[MENTION=4381075]hwmod[/MENTION] Is it possible for me to flash the recovery again? With your method or so? Cause I'm not able to flash it via fastboot and thus I'm locked out. You are the master of this thread and I think you have a better understanding of that. So what am I missing out?

Thanks in advance
[Fire Android Development] DB126:
You can't update the recovery partition on an Amazon 5th/7th gen device with a locked bootloader. Period, end of story.
[Fire Android Development] k4y0z:
[MENTION=4381075]hwmod[/MENTION]s method should work to write the recovery.

According to https://xdaforums.com/amazon-fire/development/partitions-list-t3236213

the correct address for recovery should be 0x2560000

Do a read_mmc on that address first.

Compare it with whatever you flashed there before (And save as a backup).

And then flash an amazon-signed recovery, you can get it from the "bin"-file,

which is nothing else than a zip-file (just rename it).
[Fire Android Development] TheGoliath:
Okay, thank you. I tried to flash TWRP before and then had a bad flash, trying to get magisk working * facepalm*

But gonna try out
[Fire Android Development] TheGoliath:
Hello guys.

I just wanted to try the method with my recovery. Now I have the problem, that the tablet is trying to bootup instead of staying in the USBDL mode.

sudo dmesg | tail
[28594.272862] usb 1-2: USB disconnect, device number 14
[28617.281542] usb 1-2: new high-speed USB device number 15 using xhci_hcd
[28617.524977] cdc_acm 1-2:1.1: ttyACM0: USB ACM device
[28620.112390] usb 1-2: USB disconnect, device number 15
[28643.121395] usb 1-2: new high-speed USB device number 16 using xhci_hcd
[28643.365443] cdc_acm 1-2:1.1: ttyACM0: USB ACM device
[28645.952476] usb 1-2: USB disconnect, device number 16
[28668.951287] usb 1-2: new high-speed USB device number 17 using xhci_hcd
[28669.204316] cdc_acm 1-2:1.1: ttyACM0: USB ACM device
[28671.791662] usb 1-2: USB disconnect, device number 17

sudo ./handshake.py
Waiting for preloader...
Found port = /dev/ttyACM0
Traceback (most recent call last):
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 265, in open
self.fd = os.open(self.portstr, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)
FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "./handshake.py", line 89, in <module>
dev = serial.Serial(port, BAUD)
File "/usr/lib/python3.7/site-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/lib/python3.7/site-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'

Any advices/help?

Thanks in advance.

Felix
[Fire Android Development] k4y0z:
in handshake.py on line 85 there is a delay, you could try decreasing it.

time.sleep(0.25)

change it to something like

time.sleep(0.1)

If that doesn't work either, you could also try deleting the line completely.

It might also be possible to keep it in USB-DL-mode using the serial console.
[Fire Android Development] TheGoliath:
Doesn't work either. (and how should I keep it up via the serial console?
[Fire Android Development] k4y0z:
I'm not sure, that was just a guess, often you can hit CTRL+C or Enter or some other key to stop the bootloader from loading.

Since the serial-port is detected, but then lost it just seems like it is a timing issue with sending the handshake.

You could also comment out the line 87

print("Found port = " + port)

Although I don't believe that is enough.
[Fire Android Development] TheGoliath:
Gonna try to trim the code down tomorrow to get the bootloader/preloader to handshake. And then I should probably flash the boot.img or what image should I use?
[Fire Android Development] k4y0z:
I have attached a modified version of handshake.py with the port fixed to /dev/ttyACM0

That gets rid of all the port-detection code.

It is untested though.

I thought you want to restore the recovery?
[Fire Android Development] TheGoliath:
Yes I wanted to restore the recovery. But where do I find it? I'm possible blind cuz I can't find it in the update.bin file

---------- Post added at 23:45 ---------- Previous post was at 23:40 ----------

Btw, it's just spamming my console. It doesn't handshake when it should handshake. (Does it always try to handshake or only after a few seconds? Cause maybe I'm missing the timewindow. (and my battery got drained really quick (probably cause it hasn't been loaded for ages) So sometimes the charging screen says hello to me)

cheers
[Fire Android Development] k4y0z:
It's possible the recovery isn't included in every update, alternatively someone could dump theirs from a working system (I don't currently have mine at hand).

You could also flash the boot.img (kernel) to the boot-partition (0x1560000). if your system-partition isn't messed up, this could get your fire booting again.

Though you'd still not have a working recovery.

The modified version simply tries to open the serial port (/dev/ttyACM0) and do the handshake in a loop.

It should stop once the handshake is completed. I can't currently test it though.

It probably doesn't hurt to charge the fire.
[Fire Android Development] DragonFire1024:
The recovery is in the boot.img i believe. Amazons setup for a stock ROM is weird and i dont fully grasp how they do updates in their bins. You may need to pull or have someone dd a stock boot.img from the same tablet model. I have a Fire 7, rooted but no TWRP. I can dd you one tomorrow but you may lose the ability to reflash TWRP if you are one of the lucky ones to have it.
[Fire Android Development] DB126:
TWRP is not flashed on 5th gen Fire 7 devices with a vulnerable bootloader. It is booted (ie: image loaded into memory and executed) from fastboot. Device in question reportedly has a 5.2.x gen aboot which can not be downgraded to boot a custom recovery.

To date no one has successfully replaced a borked stock recovery on any Fire 7" device regardless of generation. It is likely the contents of the recovery partition are intact. Me thinks a portion of the preloader was compromised as a result of actions previously described.
[Fire Android Development] k4y0z:
Flashing the recovery was never the issue, it's just, that a recovery which isn't signed by amazon will simply not boot.

And as [MENTION=6922463]TheGoliath[/MENTION] has mentioned, he previously flashed TWRP (which obviously won't boot)

The preloader is most definitely not broken, since he can still get into fastboot and also the serial device shows up, when connected.

BTW: I still think flashing through fastboot could still be an option.

Some commands to try:

fastboot flash recovery recovery.img
fastboot flashing recovery recovery.img
[Fire Android Development] DB126:
Fine - a flash was attempted but likely not executed. Unfortunately, some component in the boot chain became borked as occurred on numerous occasions during early FlashFire shake downs. Signed/unsigned isn't the issue IMO with bootloader 5.1+ (happy to be proven wrong).
[Fire Android Development] k4y0z:
I don't think the boot-chain is borked since fastboot is working.

That means the preloader executed sucessfully and passed all rollback-protections.

It then loaded LK (which implements fastboot) and since it is stuck there neither loading boot nor recovery both (boot and recovery) must be broken.

Attaching a serial-console as described here would definitely help clear things up.
[Fire Android Development] DB126:
Seen this movie before. Just going to step back and watch the rerun. Perhaps missed an important scene on the first viewing.
[Fire Android Development] DragonFire1024:
Weird this was just mentioned. I literally was just reading about that fastboot command and exploit right before you wrote back. I don't have my OTG adapter with me so I can't check, nor am I sure, but I tried this a while ago and I recall it spitting out a rejection message that was different than what we usually see which is '....not allowed on locked hardware'. When I tried this method it grabbed the file I had in the adb folder, processed it and I got an 'OK' then it said 'permission denied.' Doubt it means anything. But it was a little curiosity.
[Fire Android Development] TheGoliath:
Yes. I'd probably need the recovery. I also got two other fire 7 in my room here. (one 5th gen and one 7th gen). The 5th gen is running with LOS 12.1 and stock recovery. So I should be able to pull the image, right?

---------- Post added at 10:42 ---------- Previous post was at 10:40 ----------

How can I get the serial console running while having such a little timewindow so even a small python command with no time.sleep can't even run? :D

---------- Post added at 10:45 ---------- Previous post was at 10:42 ----------

Handshake succeeded after like 1000 trys.

---------- Post added at 10:48 ---------- Previous post was at 10:45 ----------

Generally one question. Until which block should I read? Currently missing one parameter out here.

sudo ./read_mmc.py $((0x2560000)) $((0xHEXGOESHERE))

EDIT.:

Fetched the recovery.img via the Official TWRP App ("Backup existing recovery")
[Fire Android Development] DB126:
A few notes:

- every 'healthy' Fire 7 has a stock recovery on board as a custom recovery can not be flashed/installed (locked bootloader)

- flashify (available in the Play Store) can also flash/save recovery images

- restoring Amazon's stock recovery is exceptionally difficult even on devices with an unlocked bootloader; TMK it has never been done on a Fire 7
[Fire Android Development] TheGoliath:
Then let's try it. I just need to compare the "wrong" flashed recovery on the fire with the one I've used and downloaded. They should match. If that's the case, I'll try to flash the recovery via [MENTION=4381075]hwmod[/MENTION]s method nontheless nobody trusts me to get it working. It is worth a try, right? I mean, we are able to flash the lk.bin without having to verify anything. Thus we should be able to flash the recovery, too. Right? Or what speaks against it?

EDIT.: I was able to flash the twrp recovery to the recovery partition via flashify in olden times (I was young). So you are able to flash the recovery partition in strange ways but you aren't able to pass amazons checks (obv) and thus you need to reflash the old recovery.
[Fire Android Development] DB126:
If your device is currently unusable and/or considered dispensable then go for it. Best/worst case outcomes are far apart on the spectrum. If comfortable with the poles then there is nothing to loose.
[Fire Android Development] TheGoliath:
Yes. It is unusable (as I'm not getting it to boot anything except fastboot (as the system and recovery are broken though))

I just want to get the address I should use for my bounds. (I mean the hex from which address to which address I should read or write to)

If anybody can tell me, I'd appreciate it a lot. (Maybe [MENTION=7104332]k4y0z[/MENTION]?)

I'm currently doing the read_mmc via

sudo ./read_mmc.py $((0x2560000)) $((0x1000)) recovery.img.part

But dunno if this is right
[Fire Android Development] k4y0z:
I believe the serial-console as described there is completely independent from the ttyACM0 you're getting from the preloader.

Awesome, was it with the modified script or the original?

Since your recovery is broken anyways, it's probably enough to read a few bytes to compare. Just to make sure it is the correct partition (although I'm pretty confident the address is correct).

The partition is 16MB in size, reading it completely would take very long.

Something like that would be fine I guess. just do a

hexdump -C recovery.img.part

and compare it with what you flashed there before (TWRP).

You could also cut the TWRP to the same size and do a diff

head -c $((0x1000)) TWRP.img > TWRP.img.part
diff TWRP.img.part recovery.img.part
[Fire Android Development] TheGoliath:
It worked with your script. I've skipped the verify path so I'm currently writing the original recovery cause I trust in your thoughts about the recovery address :P

Gonna be finished in 1 hour I think

The problem though. I can't read anything. I tried the command (for reading the uboot partition) but I don't get a file.

Handshake succeeded again (so I may have written anything but no change. So the script didn't finish after 3 hours so I killed it and tried to reboot (which also didnt work))

Any ideas? Currently sitting here with my handshaked tablet (it is handshaked cause it doesn't bootloop anymore)

And one thing. I had to use an usb 2 port for handshaking. Otherwise it wouldn't have worked.
[Fire Android Development] DragonFire1024:
You can still get into fastboot? What about trying to flash the official update.zip through there?

flashing:
update ZIP Flash all partitions from an update.zip package.
[Fire Android Development] k4y0z:
If reading doesn't work, writing probably won't either.

Also, did you disconnect after reading/writing as described in Post 1?

./read32.py 0 1

Maybe pressing some button-combination will work?

You should definitely try to get reading to work first, even if it's just a few Bytes.

what do you mean by "usb 2 port"? An active USB-Hub with separate power?
[Fire Android Development] DragonFire1024:
Or USB 2.0 vs 3.0.
[Fire Android Development] TheGoliath:
I mean an usb 2.0 port. trying to disconnect/getting out of the usbdl mode was only possible by removing the battery wires and rebooting again.

Amazon doesn't include the android-info.txt or whatever the file is. So the update won't start though
[Fire Android Development] k4y0z:
Have you also tested:

fastboot flash recovery recovery.img
fastboot flashing recovery recovery.img

Another idea

fastboot boot recovery.img

This is the method used on <=5.0.1 to boot TWRP, maybe it will work with signed recovery or boot.img?
[Fire Android Development] TheGoliath:
Yes I've tried those commands.

goliath@Mars » sudo fastboot boot recovery.img
Downloading 'boot.img' OKAY [ 0.649s]
booting FAILED (remote: 'unknown command')
Finished. Total time: 0.660s

Trying to get something bootin isn't possible cuz of the crippled bootloader (stfu amazon).

The only way to get things working is e.g. with flashing stuff via fastboot (fastboot update update.zip) which will probably won't work cause fastboot is still crippled and the other option is to get the ****ing usbdl mode working properly.

cheers

EDIT.:

(bootloader) max-download-size: 134217728
(bootloader) partition-size:userdata: 34509be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-size:LOGO: 380000
(bootloader) partition-type:LOGO: unknown
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-size:boot: 1000000
(bootloader) partition-type:boot: unknown
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-size:EXPDB: 1160000
(bootloader) partition-type:EXPDB: unknown
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) off-mode-charge: 1
(bootloader) secure: yes
(bootloader) kernel: lk
(bootloader) product: FORD
(bootloader) version: 0.5
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0xbb3ae7dbfa73cfb4
(bootloader) prod: 1
all: Done!!
Finished. Total time: 0.015s

if anybody is interested or it may help.
[Fire Android Development] k4y0z:
I would again suggest to connect a serial console to debug why USB-DL istn't working.

Also you can try different button-combinations in hopes of getting USB-DL to cooperate.
[Fire Android Development] DragonFire1024:
And sorry if I repeat myself. But do you have updated SDK tools? And if so...try

fastboot flashing update ZIP

It would be ZIP = filename.zip (idk if .bin works)
[Fire Android Development] k4y0z:
[MENTION=6922463]TheGoliath[/MENTION]

I just got my hands back on a fire and wanted to test reading the recovery.

I initially faced the same problems you did (handshake didn't work properly and no data-readout).

After I found a reliable way to get the device to handshake I still couldn't read/write anything.

Holding the volume-key closer to the audio-jack while plugging it in gave me a handshake every time with the unmodified handshake.py.

However still no read/write.

Then I switched to a different computer and it worked right away.

Maybe you should try as well, using a different PC.
[Fire Android Development] helpjohn123:
hi guys, i put in pyphon and downloaded aftv, went to aftv folder opened command promt and i cant handshake please what am i doing wrong, windows 7.

so i go into aftv and open cmd and put in

pip install pyserial

it gives me successfully installed pyserial-3.4

then put in .\handshake.py

i get access denied

whats the next step plz
[Fire Android Development] Rortiz2:
It's ./handshake.py

no .\handshake.py
[Fire Android Development] helpjohn123:
hi guys, been doing this on windows, after handshake

read_mmc.py 0x1460000 407040 UBOOT_501_backup.part done this all went ok

checked hex

88 16 88 58 38 34 06 00 4C 4B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

then done this write_mmc.py 0x1460000 lk_511.bin

all went ok

.\read32.py 0 1 again went ok, still black screen, pulled battery wire, anything else to try thanks
[Fire Android Development] TheGoliath:
Thank you. Got holidays now so gonna try today I think.

Meanwhile, which operating system did you use in those two cases?

Used Arch Linux in the first place but I can switch over to an (****ty) windows 10 pc I didn't turn on for ages, or 3 other archlinux machines
[Fire Android Development] k4y0z:
I used Debian in the case that didn't work and a pretty out of date Fedora in the other case.

I'm not sure it's the OS fault though, it might be hardware-related.
[Fire Android Development] Master Melab:
How is the anti-rollback enforced on this device? Why are Fire TV tools being used here?
[Fire Android Development] DB126:
- please don't quote the giant OP

- this thread is very old and applies to firmware builds that are rarely seen in the wild

- nothing done here will help with more contemporary brick situations
[Fire Android Development] shmygovaty:
Hello everyone.

I have this tablet. I do not know what happened with it, but it is not turning on.

If I read correctly it is because someone wanted to downgrade it.

So I decided to try unbrick this device. It brought me here.

I am doing all of this under Windows.

So, I installed everything what it needed. And there is what happened.

Handshake.py was successfully completed. After that I am trying to do

write_mmc.py 0x1460000 lk.bin

But nothing happened. It just freezes, like...trying to do something, but nothing. I could to exit, but I can no impose any command.

I was trying to wait, but still nothing.

So...is it possible, that it will be the same under linux? Or I should to try my luck?

Or it is the end of tablet?

After I take out cable - it said, that

write_mmc.py 0x1460000 lk.bin

ERROR: Serial protocol mismatch
[Fire Android Development] hwmod:
This procedure only works if one tried to downgrade from version 5.1.1 to version 5.0.1 of the Fire OS.

In those versions it was still possible to write to the EMMC user areas using those tools.

Amazon has seemingly removed this feature in later versions of the Fire OS.

The error you see when removing the cable is normal.

.:HWMOD:.
[Fire Android Development] shmygovaty:
Then if it not works, it meant that I have another version of firmware? More higher?

It seems, that nothing could save this tablet?
[Fire Android Development] k4y0z:
You could try using a Linux-system.

Also try using a USB-2.0 port.

And also definitely try read_mmc first before writing anything.
[Fire Android Development] TheGoliath:
Meanwhile,

didn't work with any other system though. Tried my self-built PC, my other laptops and their usb ports but nothing worked as expected.

Even the handshake only succeeded with the properly modified handshake scripts.

Cheers,

TheGoliath
[Fire Android Development] Mokuro93:
downgrade from 5.6.0 to 5.3.1

Hello,

I have the same problem with shmygovaty, I briked the device by a downgrade from 5.6.0 to 5.3.1.

The first command (./handshake.py) works, but the others no (it keep without info).

Any idea for the solution??

Thanks
[Fire Android Development] shmygovaty:
I found the solution one of my problems.

I found out, that battery was unpluged. So I plug it and tablet turned on.

But in loop.

I am trying to install some stock firmwares carefully - not using old versions. I will try to write, if it will be successful
[Fire Android Development] Mokuro93:
This not works for me. The batery is connected, the tablet not show nothing, but if connect it in the computer (windows) can see a loop of connect and disconnect. :(
[Fire Android Development] shmygovaty:
I have a question.

It will not flash firmare, while battery is not charged.

But when I plug in churge, it is running in loop.

I just want to know, if it will it be charged?
[Fire Android Development] Mokuro93:
Scatter file

I trying other method...

Any can load a scatter-loading file from amazon fire tablet 5th gen?

Thanks
[Fire Android Development] DB126:
There is no known solution to a FireOS downgrade that results in a bootloader rollback (ie: 5.6->5.3.1). That device is effectively a write-off.

[MENTION=8998270]shmygovaty[/MENTION]'s issue is different; ROM looping vs. black screen. The former is at least attempting to start FireOS; yours never gets past early stages of a low level boot. Sorry for the bad news.

---------- Post added at 01:49 AM ---------- Previous post was at 01:45 AM ----------

No scatter file for Fire 7 - nor would it helpful even if available.

---------- Post added at 01:55 AM ---------- Previous post was at 01:49 AM ----------

Device will likely charge (slowly) even while looping. Max power draw on a Fire 7 does not exceed the capabilities of the underlying charging circuit.
[Fire Android Development] shmygovaty:
Yes, device charged for night.

But with installation of any firmware it told that

E: Failed to verify whole-file signature

E: signature verification failer

Installation aborted

What does that mean and how to solve this problem?

Also I found some firmare - 37.5.9.5 - it was loaded till 93% and then hang...if put off USB it shows, that it upgrading...but it is not way how it should be.

or I missed something?
[Fire Android Development] DB126:
Make sure you are attempting to install 5th (not 7th) gen firmware from stock recovery. Sideloading via generic adb will usually result in failure.
[Fire Android Development] shmygovaty:
Yes, I am installing 5-th gen firmware from stock recovery.

What do you mean that, sideloadning via generic adb will usuallly result in failure?

I do not understand. It is going till 93% and stucks....each time with each firmware...how is that possible? I gonna try with another version of ADB, but also - maybe thought fastboot it is possible to flash? Or no?

Ok, fine. I retryed many times to sideload firmware - and Miracle - it worked...I do not understand how....now he is optimizing system storage and application...so we will see, if it really worked.

Thank you for your responses)
[Fire Android Development] Mokuro93:
In the manage device panel appear in COM/LPT ports one like MediaTek PreLoader USB VCOM.

Make any difference this? Or is useless point and is bricked to forever?

Thanks for the info.