yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] bibikalka:
I see. So is the current consensus is that the bootloader itself is refusing to boot TEE1 & UBOOT ? But then the full downgrade overwrites the preloader as well, and it still won't boot ... So it seems like there is some other area where the history is stored ? Could there be efuses on such a cheap chipset ? Or is this residing somewhere in the user area, which can be overwritten ? Amazon must have an easy recovery, and they won't be testing the preloader versions, they would just blast their working image on the tablet, and be done.

I double checked the update scripts, there were some interesting "if" statements regarding the preloader image:

# check if production device
if ("0025001000000015" == read_file_str("/proc/idme/board_id") ||
"0025001000010015" == read_file_str("/proc/idme/board_id") ||
"0025001010000015" == read_file_str("/proc/idme/board_id") ||
"0025001010010015" == read_file_str("/proc/idme/board_id") ||
"0025001020000015" == read_file_str("/proc/idme/board_id"))
then
ui_print("Copying preloader.img to boot partition 0 for unsecure device...");
package_extract_file("images/preloader.img", "/dev/block/platform/mtk-msdc.0/mmcblk0boot0");
else
ui_print("Copying preloader_prod.img to boot partition 0 for secure device...");
package_extract_file("images/preloader_prod.img", "/dev/block/platform/mtk-msdc.0/mmcblk0boot0");
endif;

It's obviously a test prone to bricking, but if one writes the preloader.img for unsecure device to any regular Fire, will it boot ? And what does it do ??? While the devices are still under warranty, it's a good chance to find out as much as possible :D
[Fire Android Development] Kramar111:
ANTI-ROLLBACK working here

Why your's method http://xdaforums.com/amazon-fire/general/howto-install-fireos-5-1-1-root-gapps-t3265594 work? Because no reboot between sideload 5.1.2 & downgrade main partitions to 5.0.1.

Some memory area ("anti-rollback") don't change. And it's no mmcblk0rpmb (mmcblk0rpmb not changed between firmware upgrade). (We can't see real content)

I think Amazon have signed DA (Download Agent) for SP Flash Tool which does all the work.

Exactly

No. It's tested here http://xdaforums.com/showpost.php?p=67070022&postcount=70

read US20140250290.pdf from http://xdaforums.com/showpost.php?p=65123096&postcount=6
[Fire Android Development] bibikalka:
OK. So the question is where is this version counter for ANTI-rollback ??? If it's sitting in the user accessible area, then why not just transplant "healthy" partitions from a different device ? It's only a small number of things to try, since most partitions are clearly irrelevant. The relevant ones could be:

1 -> 2048 (PARTNAME=KB)

2 -> 4096 (PARTNAME=DKB)

3 -> 6144 (PARTNAME=EXPDB)

...

7 -> 109312 (PARTNAME=MISC)

...

I was thinking about this a while ago, but there was no way to write the data to the bricked Fire (and now there is !!!):

http://xdaforums.com/amazon-fire/help/understand-5-1-1-bootloader-bricking-fix-t3301991

http://xdaforums.com/fire-hd/help/trying-to-undo-bricking-5-2-2u2-t3301374

Anyway, on something like 5.1.2->5.1.1 brick there is not much to lose now. Who knows, perhaps this would help ? On Fire HD 2014, the most promising partition seemed "DKB". But perhaps that was just a coincidence ...
[Fire Android Development] Zuly05:
HELP!

Hi guys, I need your help. My amazon fire (7in 2015 5th gen) won't turn on after downgrade (5.1.2 to 5.1.1). How can I solver that? Please. Thank you
[Fire Android Development] olegi4a:
Another question is whether the opportunity to record section "recovery" in this manner? How to do it?
[Fire Android Development] DB126:
Device is bricked with no I known solution at present. Ask Amazon for an exchange if still under warranty.
[Fire Android Development] hwmod:
I have already tried to zero out these partitions (KB, DKB, EXPDB and MISC) but nothing changes related to this kind of "brick".

mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 3 TEE: 3002 LK: 4
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] PL version mismatch!
[ANTI-ROLLBACK] L: 3 R: 2

In the messages above we can see this is a "brick" of type "PL version mismatch!" (PL = PRELOADER, not yet recoverable).

This is a different "brick" type from the 5.1.1 to 5.0.1 downgrade "LK version mismatch!" (LK = UBOOT, possibly recoverable).

The only change I noticed is by zeroing out the TEE1 & TEE2 partitions, with that, no more [ANTI-ROLLBACK] messages.

However the device remains "bricked", the "preloader" initialization process gives up with the following console messages:

[VERIFY_LK] Succeed to pass the LK verification.
[PART] load "3" from 0x0000000001460200 (dev) to 0x81E00000 (mem) [SUCCESS]
[PART] load speed: 2955KB/s, 408548 bytes, 135ms
0:dram_rank_size:40000000
DRAM size is 0x40000000
[PART] 8 image doesn't exist
[PART] 9 image doesn't exist
[BLDR] Error: fail to load mtee image
[BLDR] fail to load mtee image
[PLFM] preloader fatal error...
mtk_arch_reset at pre-loader!
reset

The following are the md5 sums of each released version of the "tz.img" images:

85d89a0fb393c3f95750f2baa7b4e21d tz_522053820_501.img
3c8c044ae8c57501ce55a380c64958a5 tz_541112720_511.img
3c8c044ae8c57501ce55a380c64958a5 tz_542168620_512.img
3c8c044ae8c57501ce55a380c64958a5 tz_542169020_5121.img
3c8c044ae8c57501ce55a380c64958a5 tz_544271020_514.img

From the above we can see the only change in the "tz.img" did happen from 5.0.1 to 5.1.1, later versions are exactly the same.

.:HWMOD:.
[Fire Android Development] bibikalka:
This is dumb, but does load "3" mean PL version "3" ? If so, what is this address : 0x0000000001460200 (dev) Is it possible to read it, or to write it ???

Also, there are more interesting strings :

http://xdaforums.com/showpost.php?p=65123096&postcount=6

[ANTI-ROLLBACK] Processing anti-rollback data

[ANTI-ROLLBACK] Failed to read block 0

Then :

[ANTI-ROLLBACK] Updating RPMB block...

Does it read anti-rollback from block 0 ? Or what is RPMB block ? Actually, is there a way to disassemble the preloader, and see where it's reading the data from ???
[Fire Android Development] Kramar111:
/dev/block/mmcblk0rpmb

512 KB

contain 1024 "1" (LE, in the end of the each 512 byte sector)

but maybe we can't see real content
[Fire Android Development] hwmod:
The string "load 3" means load UBOOT partition (SYS4), in this case the partition number start counting from "0".

Yes it is possible to write to the UBOOT partition on version 5.1.2 and lower, it contains the "Little Kernel" (LK).

Recall that hexadecimal 0x01460000 is the start address of UBOOT partition in the EMMC_USER region.

Add 0x200 (512 bytes) of the MTK header block and that's the address 0x01460200 you asked about.

If you look later on, in the log I posted above after zeroing out TEE1 & TEE2:

[PART] 8 image doesn't exist
[PART] 9 image doesn't exist

PART 8 is the TEE1 partition (SYS9 address 0x03960000)

PART 9 is the TEE2 partition (SYS10 address 0x03E60000)

TEE1 & TEE2 seems to have the same content, maybe a backup copy of sensitive data (encryption keys & such).

The RPMB partition is the "Replay Protected Memory Block" which is one of the possible protections Amazon uses.

I extracted the following RPMB related strings using the Linux command "strings preloader_prod.img | grep RPMB":

[ANTI-ROLLBACK] Updating RPMB block...
[ANTI-ROLLBACK] Unable to update RPMB block (wc)
[ANTI-ROLLBACK] Unable to update RPMB block (write)
[ANTI-ROLLBACK] RPMB block updated
[RPMB] RPMB Provisioned
[RPMB] failed to read block 0: %d
[RPMB] RPMB size is less than %d bytes!
[RPMB] Invalid magic, re-creating...
[RPMB] Failed to initialize anti-rollback block
[RPMB] Anti-rollback block initialized
[RPMB] Valid anti-rollback block exists
[RPMB] RPMB provisioning disabled
RPMB key is successfully programmed!!

These strings reveal a lot of things and answer many questions. Yes "block 0" is from RPMB partition.

Most interesting thing I can see here is the message that says "[RPMB] Invalid magic, re-creating...".

And yes, it seems that the RPMB partition is part of the [ANTI-ROLLBACK] protection scheme.

Maybe zeroing out the RPMB partition could reveal interesting things, maybe the system will recreate it, maybe not.

I can't try it on my "bricked" tablet and don't want to risk the second tablet I have to be able to continue investigating.

.:HWMOD:.
[Fire Android Development] bibikalka:
I guess 2 questions here. What does this RPMB contain on a healthy tablet ? It's definitely readable with root :

http://xdaforums.com/showpost.php?p=65123096&postcount=6

Does it contain meaningful data in this state?

Then, I guess how would one corrupt it ? Just zeros, or copy from a different tablet ? Is it writable ?

There could be a couple of bricks to explore this, so we may wait for people with yellowish screens or something who don't mind bricking and exchanging with Amazon :D
[Fire Android Development] hwmod:
Fire 7 inch 5 Gen stock 5.0.1 firmware and Scatter file for SP_FT

It is not possible to use SP Flash Tool on our Fire 7 device. Not yet ... we miss a working "authentication" file.

However I decided to publish some corrections to a previously posted Scatter file for the MT8127 device.

The attached archive contains the revised Scatter file, a small shell script to prepare the "PRELOADER"

for flashing the device using the SP Flash Tool and the minimal 5.0.1 files needed to recover the tablet.

Even if this stuff is not usable yet, the Scatter file can be loaded and parsed correctly in SP Flash Tool v5.

So this might be of help to others letting them continue the investigation and report/share their findings.

.:HWMOD:.
[Fire Android Development] nicstoun:
Please made video how made this ..about python and windows is not easy :(

Thank you

DD:\aftv2>read_mmc.py 0x1460000 795*512 UBOOT_501_backup.part

Traceback (most recent call last):

File "D:\aftv2\read_mmc.py", line 338, in <module>

size = int(int(sys.argv[2], 0) / BLOCK_SIZE) # num blocks

ValueError: invalid literal for int() with base 0: '795*512'
[Fire Android Development] nicstoun:
Can you test this real on bricked tablet ?
[Fire Android Development] roem21@gmail.com:
please show movie

i work failed..

plz show youtube

http://xdaforums.com/kindle-fire/help/please-help-amazon-kindle-fire-7-5gen-t3410733/post67598472#post67598472
[Fire Android Development] hwmod:
The video shows the process and the mmc writes were completed correctly !

If you can post a console log from serial output maybe we can see why it

does not boot and may be able to tell more about the type of "brick".

.:HWMOD:.
[Fire Android Development] roem21@gmail.com:
How can I find the serial log? Do I need a soldering ?
[Fire Android Development] zakiyy:
Is there any way to reviVe COMPLETE dead one using WINDOWS?? please GUIDE !! No sptool for this MODEL??
[Fire Android Development] DB126:
No - there is no known technique to resuscitate a completely dead 5th gen Fire short of board replacement.
[Fire Android Development] jdeandeck:
So i have been tinkering with this and my fire that updated to 5.1.4 and i thought i sideloaded 5.1.2 but did 5.1.1 on accident and was wondering if anyone knows or has a partition list along with the sizes and byte locations for the 5.1.4 update. And also i can find the antirollback info but most of what i see is jibberish eg pl %s or something how do you see the numbers that tell you what brick type you have? And thanks to everyone for this thread.
[Fire Android Development] hwmod:
No, you don't really need opening and soldering inside the tablet

but you will need an USB-to-Serial adapter (FT232RL or similar).

See this post:

http://xdaforums.com/showpost.php?p=65588189&postcount=18

Also read post #15 and #16 of the same thread for more info on how to do that.

.:HWMOD:.
[Fire Android Development] jdeandeck:
So if the I hold vol down and power while it is plugged in I get idproduct 0003 maybe this is mtk recovery or other preloader, BTW I accidentally downgraded from 514 to 511. I do not have serial console and can get handshake but have several protocol error messages currently an away from PC to copy my outputs but hopefully this is a glimmer of hope for me at least, and hopefully everyone.

Edit... so lsusb gives MediaTek Inc. MT6227 phone.... after some searching found out that usb_modeswitch can find the device but when i tried it there is no USB description data provided
[Fire Android Development] Kramar111:
It's BootROM (BROM).

Stage before preloader.

But we don't have authentication file to use it with SP Flash Tool.
[Fire Android Development] jdeandeck:
So i found a few other threads around about a mt6227 phone, would the protocol for them work some how
[Fire Android Development] nickles95:
Hi. My tablet originally came with 5.1.1, and as soon as i got it I put the fire nexus rom on it. A few months ago I think I did something wrong in flashfire updating the rom and the device is stuck at the fire nexus boot animation, I can get into fastboot but not recovery, and it has been off ever since. I had assumed that without recovery access it was permanently bricked, but I recently found this thread and it gave me hope. I have successfully done through the handshake part of the instructions and it responded, but considering my case is not the exact result of the problem described in the title I'm hesitant about proceeding forward. Will these instructions help in my case? Should I do anything different? is there a way to just write the stock recovery and have that work? Thanks in advance.
[Fire Android Development] SylvainFrom60:
Hi,

After sideload from 5.1.2 to 5.1.1 on my Fire 7 5th, I try to restore the tablet.

Im on Win 10 64Bits

Drivers, python and pyserial installed.

The handshake step is ok!

but after, when i try to read I have an error:

C:\adb\aftv2-tools>read_mmc.py $((0x1460000)) $((0x100000)) UBOOT_501_backup.part

Traceback (most recent call last):

File "C:\adb\aftv2-tools\read_mmc.py", line 337, in <module>

addr = int(int(sys.argv[1], 0) / BLOCK_SIZE) # block addr

ValueError: invalid literal for int() with base 0: '$((0x1460000))'

do you why i have this error?

thanks
[Fire Android Development] transplanting:
Macos - "serial protocol mismatch" error from read_mmc.py

I am trying your recovery method after I bricked my 5th gen Fire by trying to downgrade it from 5.1.3 to 5.1.2 (FAIL), but I am unable to use your recovery procedure :(

I am running El Capitan v10.11.5 on a macbook pro, and when I run the read_mmc.py script on my macbook pro, I get a "Serial protocol mismatch error from read_mmc.py.

Here is my command output:

# ./handshake.py
Waiting for preloader...
Found port = /dev/cu.usbmodem1421
Handshake complete!
# ./read_mmc.py $((0x1460000)) $((0x100000)) UBOOT_501_backup.part
Addr: 0x1460000
ERROR: Serial protocol mismatch
#

I have installed the stock version of python3 from python.org

# python3 --version
Python 3.5.2
#

Any ideas on what is wrong??
[Fire Android Development] sd_shadow:
this only works if device was on 5.1.1
[Fire Android Development] SylvainFrom60:
do you think i can return my tablet to amazon (bought in december 2015) after brick with sideload from 5.1.2 to 5.1.1 ?
[Fire Android Development] sd_shadow:
no, warranty is only 90 days
[Fire Android Development] bibikalka:
Root through this ?

I was wondering if one could build a small ROM to write into /system partition via the AFTV2 tools (~16 Mb, no more).

Then one would boot this new /system, and it'll have an option to re-install FireOS fully (via Flashfire ?). This would be a slow but reasonable way to root the newer FireOS devices which don't have a working Kingroot yet ...

Workable ?
[Fire Android Development] SylvainFrom60:
I need wait (f*** me for bad manip :( ).

do you think that a method can be found, to repair downgrade from 5.1.2 to 5.1.1 ?

Thanks.
[Fire Android Development] rickatnight11:
I downgraded a tablet from 5.1.4 to 5.1.2 (details here; it worked for another tablet) and seem to have hit this same bricked state. Hooked up to my Fedora 24 machine, dmesg shows it repeatedly connecting with:

[Jul19 12:00] usb 5-3: new full-speed USB device number 93 using ohci-pci
[ +0.151086] usb 5-3: New USB device found, idVendor=0e8d, idProduct=2000
[ +0.000013] usb 5-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ +0.000007] usb 5-3: Product: MT65xx Preloader
[ +0.000005] usb 5-3: Manufacturer: MediaTek
[ +0.537303] cdc_acm 5-3:1.1: ttyACM0: USB ACM device
[ +0.027443] usbcore: registered new interface driver cdc_acm
[ +0.000011] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[ +2.224641] usb 5-3: USB disconnect, device number 93

[ +19.603510] usb 2-3: new high-speed USB device number 70 using ehci-pci
[ +0.116008] usb 2-3: New USB device found, idVendor=0e8d, idProduct=2000
[ +0.000014] usb 2-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ +0.000005] usb 2-3: Product: MT65xx Preloader
[ +0.000006] usb 2-3: Manufacturer: MediaTek
[ +0.083023] cdc_acm 2-3:1.1: ttyACM0: USB ACM device
[ +2.586722] usb 2-3: USB disconnect, device number 70

[Jul19 12:01] usb 2-3: new high-speed USB device number 71 using ehci-pci
[ +0.116000] usb 2-3: New USB device found, idVendor=0e8d, idProduct=2000
[ +0.000013] usb 2-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ +0.000007] usb 2-3: Product: MT65xx Preloader
[ +0.000005] usb 2-3: Manufacturer: MediaTek
[ +0.083029] cdc_acm 2-3:1.1: ttyACM0: USB ACM device
[ +2.586918] usb 2-3: USB disconnect, device number 71

Is there any hope for this device?
[Fire Android Development] sd_shadow:
if you can't get to recovery, no
[Fire Android Development] alexmixaylov:
if you disconnect the battery, then you can flash
[Fire Android Development] planet_sammy:
Hi,

I have bricked my Kindle Fire with Version 5.1.3 -> 5.1.2 (Black Screen and no Recovery Mode).

I've tested the "Connection" and "Read" function with python scripts in Post #1.

Everything works fine.

I'll read all recent posts and actually the result is that downgrading doesn't work... but it is possible to rollback to version 5.1.3, or is it blocked by preloader?

I can't find the orginal Firmware 5.1.3 from Amazon, did anyone have a link?

Can I write the UBOOT Code (lk.bin) from Version 5.1.2?

Sammy
[Fire Android Development] sd_shadow:
there is no official link to 5.1.3 firmware

5.1.3 can be downgraded to 5.1.2
[Fire Android Development] planet_sammy:
Yes, but at the moment I have no access to the recovery mode (see post before).

Can I install the 5.1.2 Firmware directly with python scripts?

Sammy
[Fire Android Development] sd_shadow:
only devices that were on 5.1.1 can be recovered
[Fire Android Development] bibikalka:
You probably had 5.3.1, not 5.1.3. It would not have bricked it was the latter !

Your choice now is to wait until Amazon posts the official 5.3.1 ROM, from which we could pull the 5.3.1 bootloaders. It still remains to be seen if the preloader version allows downgrading. If not, then even 5.3.1 bootloaders wont help. At this point your best option is to contact Amazon.
[Fire Android Development] planet_sammy:
Is it possible to read the old bootloader version (5.3.1 or 5.1.3)?
[Fire Android Development] sd_shadow:
if you can not boot to recovery, there is no fix
[Fire Android Development] planet_sammy:
Oh, I have checked the version (now at home) ...and I took the wrong version of update (that I found on german website with an update tutorial)... a have installed 5.1.1.

Sh***T. :mad:

That's the reason (bricked status)... Is there any way to write the lk.bin from version 5.1.2 into the bootloader with python scripts?
[Fire Android Development] bibikalka:
OK, you are done. Preloader version is different between these 2, and there is no way to write into the preloader area with the Python tools discussed here. Contact Amazon.
[Fire Android Development] planet_sammy:
OK, thank you for your fast reply. I bought it 2 weeks ago on prime day, but do you think it is no problem to contact Amazon in fact of the different preloader version?
[Fire Android Development] DB126:
Amazon will exchange device no questions asked. Just say it stopped working.
[Fire Android Development] :
Please Help Me

But i don't know how to instill a Python module called "pyserial" or how to then "cd" or execute a py ( python )

Please Help ME. Thank You

---------- Post added at 01:12 PM ---------- Previous post was at 12:55 PM ----------

Can You Help ME

i don't know how to instill a Python module called "pyserial" or how to then "cd" or execute a py ( python )

Please , thank :crying: you
[Fire Android Development] fmc000:
Boy, can you READ??? I already answered in your other thread. You said that you downgraded from 5.3.1 to 5.1.1 - this thread is ONLY for downgrades from 5.1.1 to 5.0.1.

There's nothing you can do with your tablet. It's a brick, it's just as good as a (lean) door stopper. Do you understand that? As I told you in the other thread, if your tablet is within the 90 days of delivery you can return it to Amazon for a replacement, no question asked.

Besides, this is not a thread about "how to use python". There are tons of references on the net, use them.
[Fire Android Development] DB126:
A bit rugged but gets the point across :)
[Fire Android Development] fmc000:
Well, I took my time to post an answer in his thread, explaining the problem and the only possible solution and he completely ignores my answer and cross-posts the same question elsewhere. I think that I was even too kind to answer him again (:D)
[Fire Android Development] :
Just say you don't know

Excuse me , by returning the product isn't a solution to a problem. I asked the question because i needed help, and i know about so call returning it because I talked to Amazon before i came here.

Just say you can't help me. That it. Don't try to make an excuse. I post it here so more can see me, and might help me. If you can't help, then don't try to act cool by saying 'I think that I was even too kind to answer him again':laugh:

You talking to me as if i done something wrong. Plus who uses a tablet as a door stopper,??? there is something called charity.:good:

Thats enough for today.

PS. I Unblocked/unbricked it, thank you for your generosity :silly:
[Fire Android Development] fmc000:
You're too funny, you should try stand-up comedy.
[Fire Android Development] DB126:
- you did do something wrong; that's why your tablet bricked

- if you did what you said you did there is no known recovery

- glad you got it working; sounds like it wasn't bricked after all

- if you choose to cross post again be sure to reference prior posts and those that attempted to help
[Fire Android Development] ssincerely:
Simpler Terms

I appreciate this information very much, am a newbie to linux and is lost, owever I am willing to learn because linux rocks!!!! A few pictures or videos would be nice as a tutorial, respect again. Waiting anxiously, Respect.
[Fire Android Development] powerpoint45:
[MENTION=4381075]hwmod[/MENTION]

Hi! You said you had to rip off some of the pads to access UART. May I ask which pad was that? If plausible may you also share the details for which pin is what? I tried setting up a breakout for the JDEBUG port but only found the TX port. I have a thread over here: http://xdaforums.com/fire-hd/development/uart-port-fire-hd6-t2991474#post68050528 . Any help would be appreciated. Thank you!
[Fire Android Development] hwmod:
A few months back I did post a couple of pictures showing the TX/RX pads on the Fire 7 5 Gen motherboard.

The post is in the "Bootloader Unlock Ideas" thread #22, here is the direct link to it:

http://xdaforums.com/showpost.php?p=66265656&postcount=22
[Fire Android Development] powerpoint45:
Wow thank you so much. Will check it out when I get home. I guess I did a lot of extra work that didn't need to be done. I have the HD6 but I'm sure the board layout is extremely similar.
[Fire Android Development] Kramar111:
[MENTION=4469251]powerpoint45[/MENTION]

look at this (serial console: no soldering!)

http://xdaforums.com/showpost.php?p=65585385&postcount=16

http://xdaforums.com/showpost.php?p=65588189&postcount=18