yashsingh1/xdaforums huggingface dataset:
[BLU R1 HD Guides, News, & Discussion] :
We've now confirmed that this update breaks SPFT. It is currently unknown if we will be able to recover from this, but I'm hoping we can.

http://xdaforums.com/showpost.php?p=68578922&postcount=1319

It doesn't appear to relock the bootloader or break fastboot in any way, so if your bootloader is already unlocked you might be okay. I still highly recommend against it.
[BLU R1 HD Guides, News, & Discussion] DarkBlood.:
With the fire tablet they disabled the preloader and changed the pid
[BLU R1 HD Guides, News, & Discussion] kal250:
So, I wonder then, if we dont get a custom rom soon, can the security updates be pulled from the prime OTA and be incorporated into non Prime. I bet if 6.6 plugged SPFT and makes it near impossible for new users to switch to non prime or debloat, that will be the last OTA we see for awhile.
[BLU R1 HD Guides, News, & Discussion] bionictoothpick:
I installed V6.6 OTA update...not sure if I'll regret it. The amazon ads haven't bothered me because I always have notifications, and the ads are smaller than them...plus I was on a CHEAP phone ($10.00) from best buy via slickdeals ad about a year ago...so now I feel like I'm on a contender...it's all relative...Compared to http://www.lg.com/us/cell-phones/lg-LS620-realm I'm flying.
[BLU R1 HD Guides, News, & Discussion] jacewt:
I am sticking to the prime version. I had disabled OTA. Bootloader unlocked. Hopefully someone can see if 6.6 has anything to offer.
[BLU R1 HD Guides, News, & Discussion] :
You cannot simply "disable" the preloader. We discussed what exactly Amazon did with the Fire a little bit in the private hangout the other day. The bottom line is that we still don't know exactly what shenanigans Amazon is up to, or what tricks they have up their sleeve. Knowing Amazon, it can't be good for us.
[BLU R1 HD Guides, News, & Discussion] :
It has the August security patch and some things that lock things down. Nothing else that I'm aware of.
[BLU R1 HD Guides, News, & Discussion] :
If you unlocked your bootloader (fastboot style) via one of the methods before, you should still be able to gain root. If not, you are probably hosed, at least for now. Weather or not you will end up regretting that is up to you, but I certainly would.
[BLU R1 HD Guides, News, & Discussion] :
I agree. By the way, I will be releasing a TWRP version of the image for people who did manage to unlock their bootloader to use to convert after taking the update. I will also try to get a TWRP image of the old-school preloader image working once I've figured out if it's safe.

As for mixing the ROMs, I've considered doing it before. I worry about breaking some of the advantages of the OEM ROM. If this continues for too much longer, I'll consider it more seriously and start looking into it, but I think for now it remains a case of "there are more important things to do".
[BLU R1 HD Guides, News, & Discussion] kal250:
Fortunately, I had OTA blocked and as I said the other day when i get downtime(hopefully Sunday), I'm back to OEM, to hell with security patches!!
[BLU R1 HD Guides, News, & Discussion] bibikalka:
[MENTION=5355478]ColtonDRG[/MENTION], [MENTION=7494374]DarkBlood.[/MENTION], [MENTION=5233991]waingro808[/MENTION], [MENTION=440235]kal250[/MENTION], @ jacewt

Do we have the zip file for the OTA update yet ?

It's usually very trivial to repackage the update zip in order to make it update only /boot and /system, and nothing else (I've done this back with V6.5 since I wanted to keep the oldest bootloaders available). This way one gets all the updates, without any impact on the preloader, unlock status, etc.

This is kind of similar to how it's done for Fire 7 :

http://xdaforums.com/amazon-fire/general/howto-install-fireos-5-1-1-root-gapps-t3265594
[BLU R1 HD Guides, News, & Discussion] DarkBlood.:
The zip is available in https://na.mirrors.coltondrg.com/coltondrg/r1hd/stockota/prime/
[BLU R1 HD Guides, News, & Discussion] :
Go for it, but I'm not interested in taking any of Amazon's **** either way.

As [MENTION=7494374]DarkBlood.[/MENTION] said, the zip file is mirrored on https://na.mirrors.coltondrg.com/coltondrg/r1hd/stockota/prime/
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
I am curious, and we may already know, but did they fail to properly implement the version check in their OTA updater script? Just looking at the reviews on Amazon, it seems a few have suddenly been borked, and only able to boot to stock recovery since Sept 6th or so. I am curious as one of the recovery system check failure messages appears to be hanging up on the v6.1 files and refusing to boot saying they were modified. Was wondering if those are devices that updated from v6.1 straight to v6.6 whereas it seems Amazon/Blu should have ensured the updater abort if device was not v6.5. Thoughts? They may have created a real mess for themselves....
[BLU R1 HD Guides, News, & Discussion] :
A handful of people around here actually got their phone bootlooped just after taking the upgrade straight from 6.5 to 6.6. At first I figured it was a fluke because their phones were altered, but at this point it's getting very suspicious (almost like it's a hit or miss thing for everyone, even those that haven't touched anything). I hope this doesn't damage the device's reputation too bad, and Amazon better get their **** together. Chopping off their nose in spite of their face. I guess I shouldn't be surprised at this point. This is Amazon we're talking about here.
[BLU R1 HD Guides, News, & Discussion] kal250:
If the zip can be modified, can we inject the 6.1 preloader and bootloader into the 6.6 OTA and modify it to run over current 6.6 installs allowing those who have been locked to at least unlock themselves?? I'm not savy enough to try....
[BLU R1 HD Guides, News, & Discussion] :
I think the update package checks the md5sum (or some other checksum) before flashing. I have a handful of different plans for getting this taken care of. Right now I'm working on a root-running script that will replace the preloader with the V6.1 version. Once we've got that working I will be taking a crack at doing the same thing in the form of a TWRP flashable zip. As for acomplishing it on devices that don't have their bootloaders unlocked and can't get rooted or to TWRP, it will be tricky, but I have a few ideas.
[BLU R1 HD Guides, News, & Discussion] kal250:
It occurs to me, if Amazon wants to lock down a phone for the sole purpose of income generating advertising(and make no mistake, they are making a killing from advertising revenue) why not just give the damn phone away, then from that standpoint I can see them "protecting" their asset, however once I shell out money for a device, it's mine to do what I choose to do with it!!
[BLU R1 HD Guides, News, & Discussion] :
I agree. Once I've paid for a device, it should be mine and I should be allowed to do whatever I please with it. Even in cases where I'm paying a phone off month-by-month like my G4 on my T-Mobile EIP, I have still agreed to pay for the device in full, and I fully plan to do so. It could be argued that in the Amazon case the $60 is a down payment and looking at their ads is my way of paying off the phone, but this is a legal gray area, and I personally don't have any moral qualms here, so at the end of the day I don't care. Besides, even if you made that argument, it could be argued that the moment my looking at ads has generated the rest of the $50, they should automatically be removed, and the bootloader should instantly become unlockable. The way it stands, the only official way to get rid of ads is to pay the extra $50 on top of whatever ad revenue you've generated them, and then the bootloader is STILL not unlockable and you're STILL left with a phone that has a ton of Amazon bloatware and other garbage.
[BLU R1 HD Guides, News, & Discussion] emc2cube:
Yes and no. It usually does, but on this one it did not check everything.

It does check the boot partition (updater-script line 379):

apply_patch_check("EMMC:/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot:8686888:2199eb2582ef0fa8dbaa18f9c36ec83da379e925:8686888:cf59fc72be3a28ae70f872680c3eb097cd8ab53d") || abort("\"EMMC:/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot:8686888:2199eb2582ef0fa8dbaa18f9c36ec83da379e925:8686888:cf59fc72be3a28ae70f872680c3eb097cd8ab53d\" has unexpected contents.");

But it do not check the other ones (uboot, lk, secro, logo, preloader_p6601, trustzone), and simply overwrite them right away (lines 2020 and up)

assert(run_program("/system/bin/dd", "if=/dev/zero", "of=/proc/driver/mtd_writeable", "bs=3", "count=1"));
assert(package_extract_file("uboot.img", "/tmp/lk.img"),
write_raw_image("/tmp/lk.img", "lk"),
delete("/tmp/lk.img"));
apply_sig(package_extract_file("sig/boot.sig"), "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot");
show_mtupdate_stage("/cache/recovery/last_mtupdate_stage");
ifelse (
less_than_int(get_mtupdate_stage("/cache/recovery/last_mtupdate_stage"), "1") ,
(
ui_print("start to update general image");
package_extract_file("lk.bin", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk");
package_extract_file("secro.img", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/secro");
package_extract_file("logo.bin", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/logo");
assert(package_extract_file("preloader_p6601.bin", "/tmp/preloader_p6601.bin"),
write_raw_image("/tmp/preloader_p6601.bin", "/dev/block/mmcblk0boot0"),
delete("/tmp/preloader_p6601.bin"));
set_mtupdate_stage("/cache/recovery/last_mtupdate_stage", "1");
),
ui_print("general images are already updated");
);
ifelse (
less_than_int(get_mtupdate_stage("/cache/recovery/last_mtupdate_stage"), "3") ,
(
if less_than_int(get_mtupdate_stage("/cache/recovery/last_mtupdate_stage"), "2") then

ui_print("start to update alt loader image");
package_extract_file("trustzone.bin", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee2");
set_mtupdate_stage("/cache/recovery/last_mtupdate_stage", "2");
endif;

switch_active("tee1", "tee2");
set_mtupdate_stage("/cache/recovery/last_mtupdate_stage", "3");
),
ui_print("alt loder images are already updated");
);
ifelse (
less_than_int(get_mtupdate_stage("/cache/recovery/last_mtupdate_stage"), "5") ,
(
if less_than_int(get_mtupdate_stage("/cache/recovery/last_mtupdate_stage"), "4") then

ui_print("start to update main loader image");
package_extract_file("trustzone.bin", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/tee1");
set_mtupdate_stage("/cache/recovery/last_mtupdate_stage", "4");
endif;

switch_active("tee2", "tee1");
),
ui_print("main loader images are already updated");
);
delete("/cache/recovery/last_mtupdate_stage");
[BLU R1 HD Guides, News, & Discussion] :
We're not wondering if it checks the preloader, we're wondering if it checks the checksum of the preloader file that it's about to flash. Besides, I don't think we'll be able to install the 6.5 boot partition for it to check (in order to trick it into installing a patched 6.6 over 6.6) without root, and once we're rooted we can just overwrite the preloader ourselves anyway. Maybe we could take advantage of 6.7 if/when it's released, but something tells me that until we find a way around this, Amazon won't be releasing many more updates, and if we do find a way around us, the only update will be to hinder our progress. Besides, I think once we patch the any OTA file, FOTA/stock recovery will refuse to install it.

EDIT: Sorry if I seem to be missing the point and the updater script you posted shows that it does not in fact check preloader.img (it really should, just for the sake of not bricking phones, we ain't got no ECC RAM). updater-script language is like Chinese to me (I actually get it a little bit, but it hurts my brain).
[BLU R1 HD Guides, News, & Discussion] emc2cube:
Yes it's not checking the img. I think it only checks the patches for .apk and .odex files (EDIT: Actually it probably don't, the odex.p md5 is 7f81e69a8f8b251cc7947448924b96e5)

apply_patch("/system/priv-app/GoogleServicesFramework/oat/arm/GoogleServicesFramework.odex",
"-", eef8131f929802172b81cae90e42a379be3ec097, 2441708,
200f6b1022d9294ca570c0d0094cdf9d119c0184, package_extract_file("patch/system/priv-app/GoogleServicesFramework/oat/arm/GoogleServicesFramework.odex.p"));

Yes FOTA/stock recovery won't let you install a modified OTA, but you should be able to install it via TWRP (either by being flashed instead of recovery or just booting on it via fastboot boot).
[BLU R1 HD Guides, News, & Discussion] :
Wow, that's dangerous. Anyway, yeah, that's great, but the underlying problem still exists. Installing an update via TWRP is a waste of time. We can just flash the preloader straight to the partition in TWRP (I'm working on a zip for it right now). The real thing we have to figure out at this point is how we get preloader back without root or any chance of getting root (for those of us who have locked bootloaders).
[BLU R1 HD Guides, News, & Discussion] bkores:
Help! I installed the update and now it is bootlooping and I cannot boot into recovery since it just bootloops! What do I do?
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
Details? What were you on? Was your bootloader unlocked? Etc.....
[BLU R1 HD Guides, News, & Discussion] bkores:
I am on the prime version. I did not tinker with it at all. I did not unlock the bootloader, flash TWRP, whatever. I just updated normally through the updater and that's what happened!
[BLU R1 HD Guides, News, & Discussion] kal250:
Try letting it bootloop until battery dies, then attach charger and see if it starts normal then
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
Do you know what version you were upgrading from? (6.1, 6.4, 6.5)
[BLU R1 HD Guides, News, & Discussion] bkores:
6.1. This was the first time since I got the phone that I checked for an update.
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
When you say boot looping, how far is it getting? Is it going to the white BLU screen and then restarting over and over, and completely unresponsive to any buttons? You can't hold volume down and power to get into stock recovery? If not, try letting die completely (may take 8+ hours), and then plug in again and see if it boots. Same thing happened to me once.
[BLU R1 HD Guides, News, & Discussion] :
I hope the phone would refuse to upgrade from a different version...
[BLU R1 HD Guides, News, & Discussion] :
Did you go from V6.1 to V6.4, or from V6.1 straight to V6.6. I hope the latter is impossible. I really do.
[BLU R1 HD Guides, News, & Discussion] :
I don't think it can me modified, and even if it can, the phone will have to think it's an upgrade, not a downgrade or a sidegrade, so we would have to wait for a V6.7
[BLU R1 HD Guides, News, & Discussion] :
Bizarre. fwiw, you can force the phone to power off by holding volup and power for 12 seconds.
[BLU R1 HD Guides, News, & Discussion] bkores:
It doesn't get past the Blu screen. I get the boot menu when I hold power and volume up but after I select recovery with the power button it continues to boot loop. I guess my only option is to wait for it to die.

---------- Post added at 12:35 AM ---------- Previous post was at 12:34 AM ----------

I went straight from 6.1 to 6.6
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
This is what I was trying to say earlier, I fear it is, hence unmodified devices on 6.1 bootlooping when they take the 6.6 OTA due to updater not aborting. It deletes partition before checking I believe, so when it fails check, partition is already wiped.....I hope they were not this careless, but it seems anecdotal evidence says otherwise

---------- Post added at 12:40 AM ---------- Previous post was at 12:35 AM ----------

Not always, when mine looped to BLU screen it was like I/O cache got flooded, and it would not respond to any inputs until battery completely died and cache cleared as result. Something went buggy.
[BLU R1 HD Guides, News, & Discussion] emc2cube:
Can anyone with an unmodified 6.1 retrieve the url for the 6.1 to 6.6 update package, or upload it somewhere, so we can have a look at what is going on during this update process exactly?
[BLU R1 HD Guides, News, & Discussion] kal250:
Unless we crack this one, I'm not holding my breath for a 6.7 (unless they are forced to if it turns out 6.6 is bricking otherwise untouched phones)
[BLU R1 HD Guides, News, & Discussion] :
Oh... Oh no... Oh no no... I hope it downloaded the full batch of updates and applied them in sequence. It doesn't make a lot of sense to me, but it's the only way, unless this is a ****-up the likes of which have never been seen before.
[BLU R1 HD Guides, News, & Discussion] :
Oh no... That's horrible. they better fix this. FAST!

That's strange.
[BLU R1 HD Guides, News, & Discussion] :
I was under the assumption that the updates we have are the only ones. You really think they're releasing deltas FROM each version TO each version? That seems insane to me. I might be able to grab an update URL if you tell me how to do it (I know you probably already did, but I don't want to dig up an old post)
[BLU R1 HD Guides, News, & Discussion] :
It looks like that might be the case, but we can't modify them anyway. Besides, even if we could, if the reason that V6.6 is bricking phones is as I suspect, I don't think a V6.7 will have the same structure.
[BLU R1 HD Guides, News, & Discussion] emc2cube:
The thing is even if a phone on 6.1 download the 6.5 to 6.6 update it won't be able to install as it checks for md5sum and will abort if it can't find a 6.5 system.

They probably don't release deltas from each to each, but from 6.1 (phones shipped are probably all with this one) to 6.6 directly to be sure the phone is locked as soon as possible with the new bootloader etc it would actually make sense.

At least that's why I assume they released a 6.1 to 6.6 update.

To capture the OTA url you need to create a wifi share from a computer running Wireshark.

You then launch the capture for the WiFi a few seconds before checking for updates, check for updates and stop the capture as soon it starts downloading. Be sure to cancel the download too.

Then if you filter the captured data by using "http" you will be left with only one or two lines containing the OTA url.
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
The thing is, it SHOULD check md5sum and abort before wiping current partition, but not sure that is what is happening. Looking at the very recent Amazon reviews, it looks like the v6.6 update is seeing the 6.1 files as modded, and aborting, but only after what appears to be wiping the bootloader, leaving only recovery accessible.
[BLU R1 HD Guides, News, & Discussion] :
I see, that makes sense. Still, the number of phones that have gotten bricked so far (or bootlooped, same thing to the average Joe) is very concerning.
[BLU R1 HD Guides, News, & Discussion] :
If it wipes the bootloader, you can't access recovery. That's a hard brick. (with the possible exception of preloader saving the day, but I think preloader+bootloader are the same thing in this case)
[BLU R1 HD Guides, News, & Discussion] emc2cube:
Yes, very.

My bet is that this potential upgrade was done in a rush and probably either wipe something it should not, or was not properly tested and the trustzone/signature or other is wrong.

It may be silently fixed on their side quickly, it may already be the case as far as we know, else they may end up with a lot of damaged phones.

Maybe they count on our eagerness to finally get the long time promised band 12 update (if we ever finally got it) and think everyone is already up to date to 6.5.
[BLU R1 HD Guides, News, & Discussion] ariesgodofwar:
Here is a pic of what someone in the reviews reported if it is helpful to others
[BLU R1 HD Guides, News, & Discussion] :
Still, anyone who bought the phone today will still be on 6.1. Period. Permanently borking all future phones that don't come here to XDA right away is downright retarded. This is a huge oversight.
[BLU R1 HD Guides, News, & Discussion] :
Uh-oh!

Edit: Are they seriously checking the integrity of a file by checking the last modified date? What the actual ****?
[BLU R1 HD Guides, News, & Discussion] bkores:
Fixed it! I was able to boot into fast boot and format the data and cache partitions now it boots up! (Had to restore everything though :(
[BLU R1 HD Guides, News, & Discussion] DarkBlood.:
Thats so stupid. They clearly rushed the update.

---------- Post added at 02:22 AM ---------- Previous post was at 02:20 AM ----------

We should lower our reviews and maybe they will finally release band 12 update
[BLU R1 HD Guides, News, & Discussion] kal250:
[MENTION=5355478]ColtonDRG[/MENTION] could this be of any help??

http://www.engineerthink.com/blog/2016/07/how-to-unbrick-hard-bricked-mediatekmtk-android-phone/
[BLU R1 HD Guides, News, & Discussion] :
It's worth a shot.

By the way, that site ****ing sucks. Blocking ad blockers, the ads are horrible (very intrusive, over 20 ads on that one page, including one that covered the whole screen and has a fake "close" button that actually clicks on the ad) and horrible English. Talk about a sudden urge to down a gallon of Clorox.
[BLU R1 HD Guides, News, & Discussion] kal250:
Yeah i know, but Google mtk meta mode apparently it can allow spft to write partitions and preloader even with usb debugging disabled etc... But in our case it would allow flashing of preloader via spft, only downside is actually having to disassemble to remove battery... It uses a different driver altogether not the normal vcom driver we see detected in spft download mode
[BLU R1 HD Guides, News, & Discussion] :
Yep. I think someone somewhere (the general thread? The public (brick) hangout?) already discovered and tried that to no avail though. Not entirely sure on that, so still worth a shot, but I think that's the case.
[BLU R1 HD Guides, News, & Discussion] kal250:
Oh I didn't see that anywhere, then apparently there is a similar technique they use on the amlogic android tv boxes it involves rolling the pins on the chip to enter meta there was some discussion on it on another forum, and i think i saw a youtube video, but that was an older 65xx SoC...

---------- Post added at 03:14 AM ---------- Previous post was at 03:09 AM ----------

@RainofOranges you game to try popping out your battery and seeing if Meta mode exists for our phone to flash preloader?
[BLU R1 HD Guides, News, & Discussion] :
Someone in the brick hangout tore down their phone and didn't find anything of interest.

[MENTION=7221761]RainofOranges[/MENTION] Damn XDA mentioning system be all ****ed up an' **** again. Just mentioning you to bring your attention to the post above's failed mention.
[BLU R1 HD Guides, News, & Discussion] kal250:
I guess the trick is install drivers remove battery vol down/power, make sure it shows right driver(not vcom) disconnect phone then open SPFT load scatter (select preloader file) then download then vol down/power(battery still disconnected). Idk I'm just grasping at straws
[BLU R1 HD Guides, News, & Discussion] :
Sounds like a ****ing blast.
[BLU R1 HD Guides, News, & Discussion] kal250:
But if it works, that may be only option for those who didn't unlock bootloader prior to accepting the OTA. It will suck, thats if it even works, what a clusterf**k, thx Amazon :mad: