yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] Rortiz2:
You hard bricked the fire. There's no solution. If it was still under warranty send it to amazon.
[Fire Android Development] DragonFire1024:
The preloader drivers are recognized by SP Flash tool. I can get the tool to recognize the tablet and attempt a download, and after exactly 15 seconds, the tool disconnects and tells me the tablet turned off, or was unplugged and it never gets any further. Of course the tablet was none of the above. Something still blocks it and damned if I know what...
[Fire Android Development] Rortiz2:
That happens with the whole mtk 81xx series, what you have to do is press the volume + button when you connect the tablet.
[Fire Android Development] Rortiz2:
And I'll just warn you:

I opened the beedfed2 with a hex editor and I can see your wifi mac adress your serial number and your bt mac adress. I think it contains the specific data of each fire. I recommend you delete it because it contains unique information.
[Fire Android Development] hwmod:
Wrong message and timing.

Moderator please remove this post.
[Fire Android Development] k4y0z:
Good news everyone, there is now a way to unbrick/downgrade any fire 7 2015:

https://xdaforums.com/amazon-fire/development/downgrade-fire-7-2015-softbrick-t3894671
[Fire Android Development] sinpec:
Sounds promising. Thanks [MENTION=9667509]xyz`[/MENTION] for his hard work. But I am still lost. Can anyone make a video for a whole process for either Fire 7 5th or 7th?

Thanks in advance.

---------- Post added at 06:57 AM ---------- Previous post was at 06:56 AM ----------

Sounds promising. Thanks [MENTION=9667509]xyz`[/MENTION] for his hard work. But I am still lost. Can anyone make a video for a whole process for either Fire 7 5th or 7th?

Thanks in advance.
[Fire Android Development] bibikalka:
20/20

In hindsight, before the new method to zero out RPMB, this could have been a way to root any FireOs versions. Here is how:

1) Brick by sideloading 5.0.1

2) use aftv2-tools to restore new Tz, Lk to comply with the anti-rollback (5.0.1 preloader would allow these operations on a bricked device!)

3) boot into 5.0.1 with the new Tz/Lk, and root it via Kingroot

Anyway, water under the bridge ...
[Fire Android Development] Patey07:
having trouble after the handshake is successful, anyone have any advice?

[IMG="Screencap"]https://cdn.imgpaste.net/2019/06/07/b5v77.png[/IMG]
[Fire Android Development] Rortiz2:
1- Command in Windows is different

2- Use this method...

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] Patey07:
I'd prefer to do it in windows if I can, only way I'm gonna be able to do linux is a VM atm and I doubt that's going to work
[Fire Android Development] Rortiz2:
Look, it's very easy:

No linux = no unbrick :)

So yes, VM will work. I unlocked my Fire (austin) with VM.

Luck!
[Fire Android Development] Patey07:
After attempting to mount it to a VM the tablet now disappears from device manager after a few seconds and won't mount to the VM. I can't do anything with it at all now, I'm in a worse position than before..
[Fire Android Development] mrmazak:
some people have said this works good and easy using a paspberry pie also. so that is option too, if you have one
[Fire Android Development] Patey07:
got a boot disk going for ubuntu, running handshake script gives an error for "Import Serial" - module not found
[Fire Android Development] mrmazak:
One of first steps says "sudo aptget install pie-serial" verify the name
[Fire Android Development] Patey07:
you mean "pip install pyserial"? yeah, one of the first things I did. v 3.4 is installed.
[Fire Android Development] michaelehoward1986:
has anyone tried this with the 8 inch 6th gen tablet

I have one that is on black screen when I type in handshake it does the waiting for pre-loader I then hold the vol down button and plug it in, it returns with com 5 then says complete but I am very new with this and have just been experimenting on my own with whatever information I have been able to find on the web google search does not have a whole lot for the 6th gen. any help or directions would be awesome? thanks to all who work on these amazon devices I have 2 fire 7 5th gen and 2 fire 8 6th gen one of each on black screen not sure what i keep doing wrong but i have followed every thread here on xda and have not been able to bring the 7 back to life
[Fire Android Development] Rortiz2:
Hey I'm doing an unbrick thread for the 6th gen soon keep updated at hd8 forums.

Regards!
[Fire Android Development] besweeet:
I went from 5.3.6.4 to 5.0.1 to perform https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860/ in order to install Lineage. Sideloading the 5.0.1 BIN file through adb sideload resulted in a MediaTek phone / MediaTek preloader loop.

It's first detected as phone. After a few seconds, it disconnects and switches to preloader. After a few seconds, it too disappears. This process keeps repeating and it won't stay put.

Any remedies?
[Fire Android Development] nocci:
I did the same stupid thing and may want to ask you, if you had any luck to get the device back working?
[Fire Android Development] besweeet:
I gave up. Wasn't worth the trouble.
[Fire Android Development] Michajin:
FYI, if your device is going to phone, then you can run the unlock, boot to unlocked fastboot, install TWRP, then Install lineage... (ford)

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] nocci:
YES! This did the trick... now installing LineageOS via adb sideload. Thank you!
[Fire Android Development] radikll:
Downgrade brick 5.3.6

Can you provide the link to the update with the lk_511.bin?

All I can find on Amazon's site is the latest firmware update, which didn't work for me.

Also, does anyone know if this works to unbrick with the latest update 5.3.6.4. I downgraded from 5.3.6.4 to 5.0.1 and bricked my tablet, are there special instructions for this downgrade brick? Or is it the same and I just need to use the 5.1.1 lk.bin?
[Fire Android Development] Michajin:
Go to the unlock thread above and run the scripts to unlock.
[Fire Android Development] radikll:
Thanks! That worked haha! I did everything right, but I didn't understand the bootrom-step and freaked when I couldn't see anything happening on the tablet haha

Anyways, it's all working now.
[Fire Android Development] lex66676:
Hello friends

I can t flash crack bootloader use amonet-austin-v1.4.1

I bricking Fire7 2017 model SR043KL (flash use adb old firmware update-kindle-55.5.7.9_user_579225620.bin)

Now he is constantly reconnecting with the driver MT65xx Preloader (I install MTK USB drriver)

But I do not know how to restore the bootloader, there is a utility (Linux ISO - Unbrick the Fire HD6/HD7 ,"UNBRICK" Fire 7 5th Gen after a downgrade attempt from 5.1.1 to 5.0.1, AFTV2-Tools ) but it is for Fire7 2017

I have two more workers Fire7 2017 but I need the help of professionals :)

P.S. Fire 7 2017 connected if use AFTV2-Tools But I'm a looser in commands and files for the bootloader
[Fire Android Development] lex66676:
All Ok i unbrick Fire7 2017 use this post

[UNLOCK][ROOT][TWRP][UNBRICK][DOWNGRADE] Fire 7 (ford and austin).

and contackt VDD1 this post

and USB Live kali-linux-2020.2-live-amd64

And always disconnected battery connector to step FastBoot

BiiiiiiG Thanks--k4y0z--hwmod--and all the guys from the forum XDA

If Fire 7 2017 after desoldering the shielding foil, does not turn on and does not respond to USB, then you have 100% damaged the charging controller SM5328

But there is a temporary way out just to solder the jumper VBUSIN+VBUSOUT

SM5328 IC Aliexpess
[Fire Android Development] ISCJB:
I can't get ./handshake to run, it says '.' is not recognized as an internal or external command...
[Fire Android Development] arnierulezz:
LK-511

Where can I find the lk511.bin?
[Fire Android Development] LameMan:
When I connect mine to pc it loop disconnects and reconnects, is that normal?
[Fire Android Development] sd_shadow:
Read the last few pages.
[Fire Android Development] Akshat120:
i am new to all this ....But can anyone give me scatter file for mtk65 Amazon 5th generation ford...please
[Fire Android Development] jbbandos:
Hi, I know this is old and probably nobody will read it, but... I managed to do the handshake, but now the write_mmc seems to hang. A quick use of print statements shows me that it is hanging in the test of msdc_dma_status, on line 355.

Anyone else has seen it? My fire 7 gen 5 was likely to be with the latest firmware when it bricked. It was booting only into recovery, and I made the mistake of installing an old firmware (5.3.0, I think) and now it is stuck in the mediatek bootloader.
[Fire Android Development] kasimhansia:
has anyone encountered this error and knows how to take care of this?

C:\Users\Kasim\Desktop\aftv2-tools-master>write_mmc.py $((0x1460000)) lk_512.bin

Traceback (most recent call last):

File "C:\Users\Kasim\Desktop\aftv2-tools-master\write_mmc.py", line 337, in <module>

addr = int(int(sys.argv[1], 0) / BLOCK_SIZE) # block addr

ValueError: invalid literal for int() with base 0: '$((0x1460000))'

---------- Post added at 09:20 PM ---------- Previous post was at 09:15 PM ----------

Were you able to fix your Fire Tablet with this method? Did you use a Windows laptop to execute the scripts, and if so, can you share if you did something differently than the above? I also (stupidly) tried to downgrade from 5.1.2 to 5.1.1 and now bricked. I am able to handshake.py sucessfully but can't get any command to work from there on.
[Fire Android Development] berganardo:
Hi, I'm new here in the forum and nothing experienced with the Fire. I bought it recently. I'm trying to get my tablet that again. It has less than 2 weeks. I did **** trying to get the Fire OS to install the CM 11. So already installed Python and PySerial Mac OS El Capitan, but when I run the command "./handshake.py" I get the following message:

"LEONARDO-MAC: aftv2-tools Leonardo $ ./handshake.py

Traceback (most recent call last):

** File "./handshake.py", line 5, in <module>

**** import serial

ImportError: No module named 'serial'. "

Could anyone help me, please?

Thank you.
[Fire Android Development] hwmod:
The "handshake.py" script requires "python" version 3 or higher (see first line of the script).

It works for me on Mac OS X El Capitan, I have used "Homebrew" to install "python3", then "pip" as the python package manager and then the needed "pyserial" module. You are probably using "python" version 2 since that's the default installed on Mac OS (version 2.7.10).

To check your default version/installation, from terminal, type:

python --version

then, to check the list of installed modules/packages, type:

python -m pip list

After installing "python3" and "pip", you can install "pyserial" by typing:

python3 -m pip install pyserial

The same problem you spotted and the same solution is common for all platforms (Linux, Mac and Windows).

Hope you can get a correct installation with these short notes and be able to do the "unbrick".

.:HWMOD:.
[Fire Android Development] sinpec:
Unsuccessful handshake

Status - device bricked for downgrade from 5.12.1 to 5.1.1 -- following the procedure on Window, python installed, pyserial installed.. but handshake not working...only port found then nothing.. Please help !
[Fire Android Development] y512yuki:
"$((0x1460000))" for linux. Use "0x1460000" for Windows.

write_mmc.py 0x1460000 lk_512.bin
[Fire Android Development] fmc000:
Even if hansdhake worked there are reports in this thread that the procedure doesn't work from 5.1.2.1 to 5.1.1 - it's been reported working only from 5.1.1 to 5.0.1 .
[Fire Android Development] kasimhansia:
Thanks mate. You're a lifesaver. One more noob question, where can I get the lk.bin file for my tablet? I was on 5.1.2 and tried to downgrade to 5.1.1. Which version of the lk.bin file would I need to write and where do I get it from?
[Fire Android Development] sinpec:
Is your phone already bricked? -- if you manage to unbrick it .. please share.. I want my Fire back soon... Thank.
[Fire Android Development] kasimhansia:
Looks like a hard brick to me, but I am not giving up yet.
[Fire Android Development] y512yuki:
Delete "lastaddr.txt" in "atfv" directory and retry from first step.

If no effects, comment out "write_mmc.py" line 379-381: (do not use "notepad". Another text editor is required that can handle ’LF' as a line break.)

# if last_addr >= phys_addr:
# print("...Already done ", last_addr, " >= ", phys_addr)
# continue

But in my environment, this unbrick method is not valid for bricked by 5.1.2->5.1.1 downgrading. (work for 5.1.1->5.0.1 only?) :crying:
[Fire Android Development] berganardo:
Thanks for your help! Now ./handshake.py command is working.

However, by following the following steps, I get the following message:

LEONARDO-MAC: aftv2-tools Leonardo $ ./read_mmc.py $ 0x1460000 $ 795 * 512 UBOOT_501_backup.part
Usage: read_mmc.py addr size file
LEONARDO-MAC: aftv2-tools Leonardo $ dd if = of = UBOOT_501_backup.part UBOOT_501_backup.bin bs = 406964 count = 1
dd: unknown operand if

What can it be?
[Fire Android Development] fmc000:
I don't know anything about this method but what I'm sure is that you did not copy all the commands correctly, there are too many spaces floating around and the if= part of the dd command is messed up.
[Fire Android Development] hwmod:
There is no need to remove those lines, the program is just informing that the memory address already contains the value we are trying to write so it skips the write operation. It is the expected behavior.

It looks like the user have tried to write the same version of the "lk.bin" that was already present on the tablet.

I suggest to avoid modifying "handshake.py" it works well as is.

.:HWMOD:.
[Fire Android Development] Tomsgt:
the Fire OS 5.1.4 firmware has been release and it might be a good idea to add all the MD5 sums and file size of the lk.bin files to the OP

MD5 B3CDBC2E30FA7DDFB9D0EB3E471E4CB2 5.1.4 407,160 bytes
[Fire Android Development] kasimhansia:
Hi, I thought handshake.py is just to enable serial communication with the MT device. Is there something else you'd suggest to modify in there?

---------- Post added at 12:58 PM ---------- Previous post was at 12:57 PM ----------

Damn.... so is there no rescue for 5.1.2/5.1.2.1->5.1.1 bricks?
[Fire Android Development] berganardo:
Thank you for your help.

Commands that did not work, now work thanks to your help. But I got a question. This tutorial is to help people who have downgraded the Fire OS 5.1.1 to 5.0.1. But my case is downgraded from version 5.1.2 to 5.1.1. What should I do differently this tutorial?

Thanks.
[Fire Android Development] fmc000:
You can't do anything, as for now there's no way to achieve that.
[Fire Android Development] gostmn26:
Ok, So I had my daughters Fire that was having problems with running Amazon video with version 5.1.4 installed onto it. Oddly hers is the only one out of 4 other Fires in the house running this update and having this problem. I was attempting to downgrade to 5.1.2 and inadvertantly downgraded to 5.1.1! So now it is bricked and has a black screen.

I have been attempting to folllow through your instructions installing lk_514 and no recovery. I also for the hell of it did the same with lk_512 and lk_511. I figured what else could it hurt. I noticed that the md5sum for lk_514 is different

md5sum lk_514.bin
b3cdbc2e30fa7ddfb9d0eb3e471e4cb2 lk_514.bin
md5sum lk_512.bin
d73a2c504dc4db427d1dc3996ce4e206 lk_512.bin
md5sum lk_511.bin
1a1971a9b5f33cee4ae4e5bb7e17204d lk_511.bin

It was mentioned to include md5sum when running the command to flash. How would I do this? Another thing to note is that the 5.1.4 upgrade file is larger than either 5.1.2 or 5.1.1, could this be why downgrading isn't working using your method.

What can i do to help work through fixing this downgrade rick for other as well. I have on hand a serial adapter and can run through some commands but, not too much. I just need to make a mini usb cableto adapt to the serial adapter. Any guidance will definitely be appreciated along with other ideas.

I am not worried about this Fire since I have another one coming for her tomorrow. Just want to try and help work through a possible unbrick for other idiots like myself.

Thanks,

Gost
[Fire Android Development] hwmod:
This method is not usable on devices having "bootloaders" higher than 5.1.1.

The programmers behind the firmware of these devices are working against us.

They have blocked this method on all the "bootloaders" of version 5.1.2 and higher.

Normal programmers write software to make devices work better at each release by fixing bugs.

These special kind of programmers make their life out of "bricking" our tablets and creating new bugs.

I can't help you with 5.1.2 / 5.1.4 but keep the tablet around in case someone comes up with a solution.

If the tablet is still covered by warranty I suggest you return it to Amazon and get a replacement unit.

.:HWMOD:.
[Fire Android Development] Kramar111:
Hah! I'm asked you about it 2 weeks earlier in other thread.

You answer is

And where is [MENTION=4246643]Tomsgt[/MENTION] with working write_mmc.py on a 5.1.2?
[Fire Android Development] sd_shadow:
they never found a working method
[Fire Android Development] hwmod:
Two weeks ago I received a new Fire 7 still with a 5.0.1 version of the OS so I could experiment more.

In these two weeks I was able to reinstall 5.1.1 on my "unbricked" tablet and updated it all up to 5.1.4.

Then I downgraded back to 5.1.2.1 and after to 5.1.2 by using the ADB sideload method which worked.

Once I tried to downgrade to 5.1.1 I "bricked" it again and realized I couldn't use the "read_mmc.py/write_mmc.py" to rewrite an older "preloader.img". The PRELOADER partition resides in another EMMC region called EMMC_BOOT_1 which is not available for writing on a non working tablet. On a working (rooted) tablet it is possible to write to that region through the "/dev/block/mmcblk0boot0" device.

At this point, my guess is that if it were possible at all to downgrade any version it should be done on a working tablet (fully booted and rooted) by writing both the "preloader.img" and the "lk.bin" of the exact same version in one shot before rebooting. Otherwise the result will be another "brick".

.:HWMOD:.
[Fire Android Development] Tomsgt:
I would love to test this downgrade idea with you some time we will have to setup a time to test it.
[Fire Android Development] dem0nk1d:
Where are you guys finding the LK_5XX.bin files?
[Fire Android Development] Kramar111:
29th May 2016, 00:09 |#69 (in other thread again :) )

When I asked this question 30th May 2016, 13:10 |#82

I already knew about this (that write_mmc.py didn't work)

i think it's not enough

read US20140250290.pdf from http://xdaforums.com/showpost.php?p=65123096&postcount=6
[Fire Android Development] hwmod:
I already said ... at that time, when you asked, I had not tried 5.1.2 yet so I couldn't answer.

However I am not sure I understand why you asked if you already knew the answer ...

Regarding the downgrade, I tested myself and it is possible to downgrade the OS, I went from 5.1.4 down to 5.1.2.

What is not possible is to downgrade to previous versions of the "PRELOADER" or "UBOOT" (like those in OS 5.0.1 or 5.1.1).

Current "brick" log (OS downgrade from 5.1.2 to 5.0.1, non recoverable by the described method):

mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 3 TEE: 3002 LK: 4
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] PL version mismatch!
[ANTI-ROLLBACK] L: 3 R: 2

Previous "brick" log (OS downgrade from 5.1.1 to 5.0.1, recoverable by the described method):

mmc_rpmb_send_command -> req_type=0x1, type=0x4, blks=0x1
mmc_rpmb_send_command -> req_type=0x2, type=0x4, blks=0x1
[ANTI-ROLLBACK] PL: 2 TEE: 3002 LK: 3
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] LK version mismatch!
[ANTI-ROLLBACK] L: 3 R: 2

My conclusions are that the method described in this thread can effectively recover a "LK version mismatch!" but cannot recover a "PL version mismatch!". The reasons are that on "bricked" tablets we have no access to the "PRELOADER" partition and on "UBOOT" version 5.1.2 and higher it seems that Amazon have blocked this method. Also, I believe Amazon is using "efuse" on these devices since I have seen pads marked "EFUSE" on the main-board.

.:HWMOD:.
[Fire Android Development] Kramar111:
I thought that was broken only my tablet

then I read this http://www.aftvnews.com/software-ve...a-to-a-usb-cable-on-fire-tv-2/#comment-280355
[Fire Android Development] olegi4a:
Hi friends. beforehand please apologize for my English.

background: (tablet 5.1.2) updated using flashfire on SlimLP

everything went well. then playing with flashfire I tried to fill TWRP recovery.img, of course I failed and lost on your recovery. then, without thinking, tried to go to CM-12.1, the process took a long time (more than 1 hour) and I realized that it is not established.

I have now: amazon fire 7 (5th) without recovery and without OS. load the logo CM and hanging

Fast boot works; devices that appear in Device Manager - MT65xx Preloader; usb MTP - Fire; MT65xx Android Phone.

tried to go to instructions on the first page:

C:\android\aftv2-tools-master>handshake.py

Waiting for preloader...

Found port = COM6

Handshake complete!

C:\android\aftv2-tools-master>write_mmc.py $((0x1460000)) lk_512.bin

Traceback (most recent call last):

File "C:\android\aftv2-tools-master\write_mmc.py", line 337, in <module>

addr = int(int(sys.argv[1], 0) / BLOCK_SIZE) # block addr

ValueError: invalid literal for int() with base 0: '$((0x1460000))'

C:\android\aftv2-tools-master>
[Fire Android Development] dem0nk1d:
linux cmd >> write_mmc.py $((0x1460000)) lk_512.bin

windows cmd >> write_mmc.py 0x1460000 lk_512.bin
[Fire Android Development] bibikalka:
First of all, this is fantastic piece of work !!! Perhaps this route can also be used to recover 4th gen Fires.

I am wondering why you stop at flashing UBOOT only. Would not you be able to re-flash TEE1 & pre-loader as well ? Basically, you'd update all images

to the newer versions, and the brick should no longer have the versions mismatch. Then one can re-load the system from the Amazon update file.

The method seems to just write into specific addresses, so why would it care if you are updating UBOOT or TEE1 ? With TEE1, you should be able to fix 5.2.1 bricks as well, if it works ...

Edit :

0x1460000 in decimal divided by 512 is 41728, this is UBOOT.

4 -> 41728 (PARTNAME=UBOOT)

For TEE1, we have :

9 -> 117504 (PARTNAME=TEE1)

117504 x 512 in hex : 0x3960000

The full partition list is here :

http://xdaforums.com/showpost.php?p=63566358&postcount=2
[Fire Android Development] hwmod:
I whish it were so easy ... but it is not. I have also tried what you suggested to be sure.

TEE1 is not the "PRELOADER" partition, it is the "Trusted Execution Environment" partition.

When the tablet is "bricked" in this way we have no access to the "PRELOADER" partition.

The "PRELOADER" partition resides in a different EMMC region named EMMC_BOOT_1.

In this state, and using this method, we only have access to the EMMC_USER region.

This means we can write any partition listed in the link you sent except "PRELOADER" (which is not listed there).

.:HWMOD:.
[Fire Android Development] bibikalka:
OK, thanks for clarifying ! But a follow up question - there is some memory region before the 1st partition, it seems :

1 -> 2048 (PARTNAME=KB)

2048x512 = 1 Mb

Can you read/write the first Mb of memory at 0x0000000 at all ??? All that stuff before KB partition ?
[Fire Android Development] Kramar111:
Yes, we can (up to 5.1.2). But only GPT here, not preloader.

Preloader in boot1 area (/dev/block/platform/mtk-msdc.0/mmcblk0boot0), not in user area, unfortunately.