yashsingh1/xdaforums huggingface dataset:
[Fire HD 6 and 7 Android Development] SergeantFury:
Fire HD 7 Ariel (4th gen) in soft brick, preloader unbrick has had no effect

I tried this method using the modified Archbang on a USB flash drive, to no effect. What happened was after downgrading to 4.5.3 to attempt root from a PC with KingRoot, I couldn't disable OTAs and the device began to update in the middle of the rooting procedure, resulting in a lifeless device (no boot logo when power button held for >1 min, even after charging). After one attempt on the Archbang unbrick, the boot logo was back, but it would not load any OS, just bootlooping until the device runs out of battery. Any ideas?:fingers-crossed:
[Fire HD 6 and 7 Android Development] LesterLynx:
Fire HD 6 4th Gen Dead!

I have a Amazon Fire HD 6 (4th gen) which automatically downloaded and installed FireOs 4.5.5.1, after that the tablet is dead, the screen doesn't turn on, and on my computer device manager it is show as a serial port device: MediaTek USB VCOM (Android) and it keeps connecting and disconnecting.

I have tried to follow the instructions on this post but I am getting an error on this command: read_mmc.py 0x0000000 0x1000 0x0000000.part.

Addr: 0x0

ERROR: Command Timeout

I also downloaded and tried the ISO made by [MENTION=4469251]powerpoint45[/MENTION] but the command reader.sh gave me the same error as above. I have tried in at least three computers all of them with different Windows Version (Windows 7, 8.1, 10) with no luck.

Am I missing something? Please help me.
[Fire HD 6 and 7 Android Development] regxhack:
Could use a little help

Ok, So I started with a Fire HD6 gen4 at 5.6.0.1.

I tried to use the linked procedure here https://xdaforums.com/fire-hd/general/2017-root-kindle-fire-hd-6-4th-gen-t3677600 to downgrade and root the device.

When I ran the kingroot, it would not root the device. At one point on a second attempt, I was working the problem with kingroot open on the screen.

I walked away for a moment and came back to black screen, no power, no nada.

Next, I went to the ISO method of unbricking.

I can get the handshake, I get all the parts read, it says option A, so I use option A.

Note that while writing the option A back, it usually hangs once or twice. I am able to reset and get the write going again, but I have not gotten it to write complete from start to finish without a hang.

Anyway, once the write completes, I hold the volume up, run the complete.sh script and it boots amazon, and then fire. TWRP never appears.

After a few moments of FireOS running, it goes to lunch and I am back where I started.

I have not been able to get back into adb at any point.

Any suggestions? Guidance? A complimentary blade to fall on?

Thanx
[Fire HD 6 and 7 Android Development] jbdman:
Parts

Good Evening All:

I've attached my part files from windows, I ran the linux live, and there was no option determined. Any help would be greatly appreciated!

Thanks So Much,

Josh
[Fire HD 6 and 7 Android Development] blakegriplingph:
I'm sure this can be adapted to work on non-Amazon MTK devices, right? I've got a Nabi SE demo unit which I tried to convert to retail some time ago. Flashed a backup of the demo ROM using the retail scatter/partition layout (I used addon.img and system.img from retail as the demo ones are too big) and ended up getting stuck at the boot logo (not the boot animation). And when I tried to roll back to the old demo ROM dump (ROM_0) using write memory, it got knackered i.e. no screen output, and no longer responds to pressing volume up to force USB Serial Device mode. The preloader device is still available upon connecting it though.
[Fire HD 6 and 7 Android Development] zeroepoch:
Yes it should work to edit partition contents on the flash memory if it uses a MTK preloader. The mmc device address might be different though if it's not the same or similar SOC. Try reading the start of the boot.img partition. I should have the word Android I believe.
[Fire HD 6 and 7 Android Development] blakegriplingph:
It's running off an MT8127, which AFAIK is the similar to the one used on the 5th gen Fire. It has an unlockable bootloader, but I forgot to poke into that prior, and I didn't expect it to be an arse compared to the LeapFrog Epic which shared the same SOC but is easily unbrickable for as long as you have a backup at hand.

If it's any consolation, I made a complete backup of both my friend's retail Nabi SE and my demo unit. Maybe someone could help with looking into it, and I am more than willing to test if any adaptations to the unbrick script are done.
[Fire HD 6 and 7 Android Development] CandyAngel:
Just tried to use the ISO to recover a Fire HD6 that was given to me and I could get the handshake to work and the device to stay on/connected, but running "reader.sh" does nothing. It's very likely it is 5.3.1 or later as it was on auto-update before it was broken.

Permanent brick or something else I can try, maybe? Thankies!
[Fire HD 6 and 7 Android Development] bibikalka:
I presume stock recovery with sideloading does not work either? I am afraid, you may be out of luck here ...
[Fire HD 6 and 7 Android Development] exdeeei:
./reader.sh Has no response at all

Is this method will work on my device? :confused:

I'm still at ./reader.sh following the linux os tut.

Edit: My device is fire hd 6 4th gen

My pc is win 7
[Fire HD 6 and 7 Android Development] exdeeei:
Sorry to ask this. Should i copy that Exact codes and paste them on terminal command after handshake or what? :confused:
[Fire HD 6 and 7 Android Development] nicktm:
I have the same issue

reader.sh stack forever

I am able to login to stock recovery and run adb sideload update-kindle-20.4.5.3.bin and got this error

E:failed to mount /cache

E:failed to set up expected mounts for install; aborting

is there any way to fix ?
[Fire HD 6 and 7 Android Development] Smartphone_Broken_Service:
Need special .sh files

Reader.sh

ReaderSpecialOptionA.sh

ReaderSpecialOptionB.sh

I am performing this in an atypical manner as i could not boot from special ArchLinux distro included in this build were the aforementioned .sh script files

DOES ANYONE HAVE A COPY OF THESE?

Appreciated
[Fire HD 6 and 7 Android Development] Miller94:
cant read mmc

hi,i have a bricked amazon kindle fire hd 7 2014,and i cant read mmc.... :confused::confused::confused: handshake is ok,but when i start a command to read mmc,i am wait a loooong time (12 hours) and nothing happens (( The line of the command that I launched still remains without any changes.

Not strong in python, but a lot of things were flashed and rebuilt others devices. Pyserial.py has bin install correctly, Py2exe too. What line do I need to get dumps? (I entered 'read_mmc.py 0x0000000 0x1000 0x0000000.part')

I can prepend access to the TeamViewer for manipulations))Thanks :) I hope all will be ok
[Fire HD 6 and 7 Android Development] ZenIsBestWolf:
Hi! I know this thread is REALLY old, but was wondering if anyone could not get the handshake to work? My Kindle Fire HD 6 4th gen bricked after trying to root and does not get to the Amazon screen at all.
[Fire HD 6 and 7 Android Development] scales11:
I too am stuck at the "reader.sh"....no response, it just sits there with a blinking cursor. Any tips or updates?
[Fire HD 6 and 7 Android Development] mr.knowbody:
fire hd 8 5th

Parts

Dear bibikalka

I have a fire HD 8 5th gen that bricked because of downgrade from last update 5.6.3.4 to 5.2.2 by adb sideload commands (No fastboot , No recovery mode available).

fortunately handshake complete and I can read_emmc in ubuntu 18.04.

I'm curious to know is there any way to find offset address and relive my device?

I want to see if there is an option (A,B,C or need try new option) for me.[/QUOTE]

sorry I unable to attach my files:( .
[Fire HD 6 and 7 Android Development] mr.knowbody:
Write MMC files

I found the addresses ,but now can I use this files "453p_xxx.img" for fire hd 5th generation too?:confused:
[Fire HD 6 and 7 Android Development] Shadowwolf218:
I hate to poke at an ancient thread, but it seems worse to start a new one when the solution is already 95% covered already.

Long story short, I got a bricked HD8 (2015, KFMEWI) from a friend, thinking I could resurrect it. But on connection to the pc, all I can get is the MT65xx preloader stuff.

Using the methods from this thread, and the super helpful linux iso from the related thread linked in the first post, I was able to connect and complete the handshake. But, since all of this is for the HD6/7, I'm stuck with a lot of .part files and some hex to sift through...and that leaves me out of my depth.

I've attached what I believe to be the relevant files...do I have any hope with this, or is it a paperweight already?
[Fire HD 6 and 7 Android Development] bibikalka:
Are you still chasing this brick? Or gave up?
[Fire HD 6 and 7 Android Development] Akshat120:
hey can u tell me how much time on average it takes to unbrink coz for me its took 2 days...xD
[Fire HD 6 and 7 Android Development] Akshat120:
Can anyone tell what command to put in after the unbricking is done??please help
[Fire HD 6 and 7 Android Development] organicandroid:
edit: Have been able to download the ISO file now.
[Fire HD 6 and 7 Android Development] kingston1246:
Hi,

I have a fire hd 6 (2014) which has been hard bricked.

Story:

Downgraded from Fire OS 5 to 4 for some experiments

Tried to update from Fire OS 4 to Fire os (i don't know) via ota. After reboot 1, it was bricked. So I did some research and was able to unbrick it with a video guide of this method. But the sad thing is, I flashed 5.3.1 and then it never lit up again. The unbrick cannot read anything. Is there any method to unbrick now? eMMC writer?
[Fire HD 6 and 7 Android Development] Shadowwolf218:
Gave up for a long time (clearly), but I do still have the device. Couldn't justify trashing it, on the tiny chance I'd develop the skills needed to finish the job someday.
[Fire HD 6 and 7 Android Development] Liz-kawa:
I tried 3 times, but it was wasteful. There may be few battery remaining amounts. I charge it and try once again. Can I have time?
[Fire HD 6 and 7 Android Development] bibikalka:
Sure, take your time and charge it!!!

If you succeed, after the you read the partitions, I need you to write the following :

write_mmc.py 0x2380000 08_kb.img

write_mmc.py 0x2480000 09_dkb.img

write_mmc.py 0x2580000 10_misc.img

write_mmc.py 0x2600000 11_persisbackup.img

The required files are attached below.

Sorry again for all the stress :(
[Fire HD 6 and 7 Android Development] Liz-kawa:
I charged it 3hours, but HD6 doesn't work. Nothing will be done any more. I'm thankful for your help.
[Fire HD 6 and 7 Android Development] bibikalka:
Well, the preloader is still there as before, it seems impossible to overwrite it ... I wonder why it's not talking ... Download "USBDeview" to your PC (google for it). Then connect Fire to USB, hold power button for 60 sec. Do you see anything changing in USBDeview ??? Does Fire connect for a short time ? You could also try to uninstall the driver for the preloader (just right click on the preloader driver in USBDeview, and choose "Uninstall Selected Devices".
[Fire HD 6 and 7 Android Development] bibikalka:
OK, are you still around ? There were some kinks in the process due to the floating addresses, but it seems like we should have the mechanics of this down by now. Before any unbricking, the 1st step is to read a lot of blocks, so we can figure out what the shift is. See the update in post #1 for details.

Once we figure out the addresses for TEE1, UBOOT, and recovery, we can write stuff there.
[Fire HD 6 and 7 Android Development] kirito9:
Ok, before this I followed your guide same as [MENTION=7562637]Liz-kawa[/MENTION] but I think it got stuck reading one of the addresses (it went on for 5 hours+).

Now I've tried your updated guide, it's also stuck (maybe taking a long time) at read_mmc.py 0x0600000 0x1000 0x0600000.part. I was able to read the others tho. Should I upload those, would they be able to determine the unique offset address?

Thanks
[Fire HD 6 and 7 Android Development] bibikalka:
Ok, it just hangs sometimes ! It does for me as well. Kill the DOS window, open a new one. Start the handshake again. Hold the power button for 1 min (with the Fire plugged into USB). When it comes alive, it'll handshake. Resume from where it froze. Do it until you read them all.
[Fire HD 6 and 7 Android Development] kirito9:
Thanks, I'll do that now. I thought as much it was that. Preloader can only be active for so long right.
[Fire HD 6 and 7 Android Development] kirito9:
[MENTION=6680544]bibikalka[/MENTION] I'm sorry for the long wait but I'm still reading all those addresses you had up on the first post. It's really taking quite a while for me to read all these addresses because the preloader(?) stops ever so often. I have to reboot my PC everytime I want to read a new address. Plugging out the cable then trying again results in the handshake.py script finding the tablet but doesn't complete the handshake until I restart my computer.

Any thoughts on this? It always seems to stop after I read 3 addresses consecutively.
[Fire HD 6 and 7 Android Development] zeroepoch:
When people were first testing my MTK preloader tools on the AFTV 2 people had the most success using a desktop computer vs a laptop. Also Linux seems to work more reliably than Windows. You might try another computer as the first alternative. Some people mentioned using a different USB port, but I don't think there was conclusive evidence that it really helped rather than just luck.

Oh... just one more comment. When I originally developed these tools, which was on a Linux desktop, it never stopped for me. In fact I dumped the entire 26 MB recovery partition which took 8 hours without any problems. I later did a diff with a dd dump when the device was back online and it matched. That gave me the confidence to start writing things more massive and distributing the tools to others. It was only later when I tested it on Windows and Mac and a few other systems did I start to see some hangs.
[Fire HD 6 and 7 Android Development] kirito9:
Thanks for the info. Linux was my original go-to for this unbrick method but I couldn't get the psyserial installed which prevented me from running the ./handshake.py script. I searched everywhere on the internet to figure out how to install it on an ArchLinux (mine is BBQLinux) but I couldn't find anything. So I just switched to Windows.

On BBQLinux it gives this error

./handshake.py
Traceback (most recent call last):
File "./handshake.py", line 5, in <module>
import serial
ImportError: No module named 'serial'
[Fire HD 6 and 7 Android Development] bibikalka:
Interesting ! Mine hangs as well under Windows XP. I changed the version of the serial module, but did not help.

But everything worked fine for [MENTION=7562637]Liz-kawa[/MENTION] . I wonder what system was that ? Liz-kawa, can you tell us your configuration, computer/OS/etc ? Btw, did your Fire come back to life after long charging ?

Anyway, [MENTION=5515628]kirito9[/MENTION], just post whatever blocks you got so far. Perhaps that'd be enough for me to figure out the offset !!! It won't be fun though if it hangs when it's writing the partitions. Zeroepoch, did it hang when writing memory as well ? Or only when reading ?
[Fire HD 6 and 7 Android Development] kirito9:
Here you go - partitions.rar. I hope it will be enough to unbrick, and I'll try again getting it to work with BBQLinux.
[Fire HD 6 and 7 Android Development] bibikalka:
That's good enough !

Try these, and post them :

read_mmc.py 0x0780000 0x1000 00.part
read_mmc.py 0x0788000 0x1000 PRO_INFO.part
read_mmc.py 0x0880000 0x1000 PMT.part
read_mmc.py 0x0c80000 0x1000 TEE1.part
read_mmc.py 0x1180000 0x1000 TEE2.part
read_mmc.py 0x1680000 0x1000 UBOOT.part
read_mmc.py 0x1700000 0x1000 boot.part
read_mmc.py 0x1f00000 0x1000 recovery.part
read_mmc.py 0x2700000 0x1000 KB.part
read_mmc.py 0x2800000 0x1000 DKB.part
read_mmc.py 0x2900000 0x1000 MISC.part
read_mmc.py 0x2980000 0x1000 persisbackup.part
[Fire HD 6 and 7 Android Development] Diesen_Dev:
My Fire HD 6 is laying bricked for 6-7 months or so. Is this method (theoretically) can recover Fire what was on 5.0.1, then downgraded to 4.5.3 (and TWRP was installed too), updated to 4.5.x.x by OTA (i don't know accurately what update was installed by OTA in the background, forgot to disable OTA's after downgrade), then blackscreened? MTK Preloader message is only what i have in Windows.
[Fire HD 6 and 7 Android Development] bibikalka:
We can write partitions (so you can put 4.5.3 bootloader + TWRP). But I cannot guarantee that it will start after that (I think it should). I am currently recovering a partially bricked Fire, which bootloops on the Amazon logo (easier case). But why don't you try ?

The hardest part for me was to find a stable computer such that the write_mmc would not hang on long jobs. Another WinXP laptop seems fine, the 1st one was not ...

Run the block reads, I'll generate the correct offsets for you. Then we can try to replace UBOOT/TEE1/TWRP, and see what happens.
[Fire HD 6 and 7 Android Development] Diesen_Dev:
Trying it out now, but no success. Device detects like "Unknown" (MT65xx Preloader), but handshake's "Waiting for preloader" step is never passed. Spend a lot of time to config python right in Windows 10. Wanna try another machine.

UPD. Mac machine detected it, showed "Found port = /dev/cu.usbmodem1A130", but read operation is not working for me.
[Fire HD 6 and 7 Android Development] bibikalka:
For Windows the driver is a bit tricky, try these :

http://droidchina.com/forum/Thread-MTK-Phone-Preloader-drivers-for-all-Windows-versions

Keep using USBdeview to uninstall the drivers, and try again.
[Fire HD 6 and 7 Android Development] kirito9:
After countless attempts, I was still unable to get UBOOT.part and boot.part but got everything else.

I've attached those I got.
[Fire HD 6 and 7 Android Development] bibikalka:
Ok, this is good enough! The addresses check out. The main issue here is still that you won't be able to write into memory if it keeps hanging! You need to find another PC ...

The brick looks a bit weird to me, it seems to be FireOS 4.5.4/4.5.5, and not 4.5.5.1 . So I start to wonder how this happened, since I have not seen any reports on such bricking configuration ... What was downgraded to what ???
[Fire HD 6 and 7 Android Development] kirito9:
Yeah, working on getting another PC to use. I'll use VM with windows XP. Will that work?

Also like I said before, it's not my device but helping a friend and he didn't go into much detail as to how he bricked. He kinda doesn't know much about android but is slowly learning. I did remember him saying he UPGRADED to 4.5.5 and then it didn't turn on afterwards.
[Fire HD 6 and 7 Android Development] kirito9:
[MENTION=6680544]bibikalka[/MENTION] I got pyserial installed on my arch linux so I don't think hanging would be a problem now but I now have another problem, I have this error when trying to run the ./handshake.py command in terminal.

[kirito9@kirito9-pc aftv2-tools]$ ./handshake.py

Waiting for preloader...

Found port = /dev/ttyACM0

Traceback (most recent call last):

File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 497, in read

'device reports readiness to read but returned no data '

serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "./handshake.py", line 90, in <module>

handshake()

File "./handshake.py", line 56, in handshake

c = write8(b'\xa0')

File "./handshake.py", line 48, in write8

in_str = dev.read()

File "/usr/lib/python3.5/site-packages/serial/serialposix.py", line 508, in read

raise SerialException('read failed: {}'.format(e))

serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
[Fire HD 6 and 7 Android Development] bibikalka:
Perhaps, try to re-install an older version of pyserial:

python -m pip install pyserial==3.0.1
[Fire HD 6 and 7 Android Development] kirito9:
mm, this doesn't work. I tried sudo pacman -S python-pyserial-3.0.1 but doesn't work either. I tried sudo pacman -S python -m pip install pyserial
[Fire HD 6 and 7 Android Development] bibikalka:
pip install pyserial==3.0.1
[Fire HD 6 and 7 Android Development] kirito9:
[kirito9@kirito9-pc ~]$ pip install pyserial==3.0.1

bash: pip: command not found

[kirito9@kirito9-pc ~]$ sudo pip install pyserial==3.0.1

[sudo] password for kirito9:

---------- Post added at 09:39 PM ---------- Previous post was at 09:29 PM ----------

sorry for the noobness [MENTION=6680544]bibikalka[/MENTION], I was using python 2 instead of 3, switched now.

What do you want me to write?
[Fire HD 6 and 7 Android Development] bibikalka:
First, read something longer to see that it's indeed stable :

read_mmc.py 0x1680000 0x00080000 UBOOT.full

If that works, go for the write (will take about ~ 6 hours, grab the files from post #1 since those are padded with zeros at the end):

write_mmc.py 0x0c80000 453p_tee1.img
write_mmc.py 0x1680000 453p_uboot.img
write_mmc.py 0x1f00000 453p_twrp.img

Godspeed !
[Fire HD 6 and 7 Android Development] kirito9:
Ahh thanks, will begin reading now.
[Fire HD 6 and 7 Android Development] bibikalka:
You don't need to disconnect the battery ! Just grab the signed drivers for Windows, and use USBDeView to see what's going on as the preloader loops through. If it shows up in USBDeView, do "Uninstall Selected Device", then supply the proper signed driver from here:

https://www.androidfilehost.com/?w=files&flid=68715

If your Python is working, and Fire shows up in USBDeView, it should handshake!
[Fire HD 6 and 7 Android Development] jhoutz:
Ok, using USBDeView the device shows up as MT65xx Preloader. I guess I just can't seem to find the proper driver. I've been using the cdc-amc.inf, I'm gonna keep screwing around with it, not really sure what's going on.
[Fire HD 6 and 7 Android Development] Diesen_Dev:
Tried hard to do something with windows (10 and 7) - no result. A little success with reading on mac.
[Fire HD 6 and 7 Android Development] bibikalka:
Good progress! And, most importantly, you current setup is stable ! :D

You have a weird bricking case, the TEE/UBOOT partitions point to 4.5.4/4.5.5 FireOS version, I have not heard about such bricks before. Have you ever had Lollipop on this device ?

Read these for quality control first:

read_mmc.py 0x0780000 0x4000 00.part
read_mmc.py 0x0788000 0x4000 PRO_INFO.part
read_mmc.py 0x0880000 0x4000 PMT.part
read_mmc.py 0x0c80000 0x4000 TEE1.part
read_mmc.py 0x1180000 0x4000 TEE2.part
read_mmc.py 0x1680000 0x4000 UBOOT.part
read_mmc.py 0x1700000 0x4000 boot.part
read_mmc.py 0x1f00000 0x4000 recovery.part
read_mmc.py 0x2700000 0x4000 KB.part
read_mmc.py 0x2800000 0x4000 DKB.part
read_mmc.py 0x2900000 0x4000 MISC.part
read_mmc.py 0x2980000 0x4000 persisbackup.part

And, write :

write_mmc.py 0x0c80000 453p_tee1.img
write_mmc.py 0x1680000 453p_uboot.img
write_mmc.py 0x1f00000 453p_twrp.img

The time to write the 3 files is about ~ 6 hours. Make sure it's not interrupted !!!

After writing, repeat the read commands above. Save the outputs from both runs. Then disconnect, and try to reboot.