yashsingh1/xdaforums huggingface dataset:
[Fire General] rallison203:
Thanks for responding, sorry for any misinformation, I'm quite a noob. So - if the supertool doesnt rollback, do you think I'd have trouble retrying the ad removal tool while running 5.3.2.1. ?
[Fire General] DB126:
Don't see any significant risks with rerunning but also don't think it will be fully effective on an unrooted device.
[Fire General] valzi:
Is this probably the best thread to follow if I want to be notified when it's possible to root 5.3.2.1?
[Fire General] bobey6:
I hope so, I'm certainly subscribed ;)
[Fire General] JBaruch:
Same here!
[Fire General] grochib:
Indeed, same here ?
[Fire General] DB126:
Should be obvious but restated for clarity: no one is responsible for making a formal announcement if/when FireOS 5.3.2.1 becomes rootable - or any other development for that matter.

Being subscribed to a single thread may or may not provide timely awareness of recent news. Best to scan the entire 5th gen forum on occasion, especially the General and Q&A sections where the latest news is often trumpeted.
[Fire General] bobey6:
Let's hope everyone following & subscribed does this and we'll be sure not to miss it :good:
[Fire General] xwin01:
Anti-rollback measures

Hi,

It is clear that Kindle fire has antirollback measures. If this is implemented using flash it could be possible to save entire flash from earlier device and restore it. One must have a tool to do this. None of android tools are capable of doing this because they rely on recovery and fastboot images to be present.

If MediaTek MT8127 D part has some sort of OTP that used for antirollback, then all attempts to roll it back would be unsuccessful. There is just no way around this. I could not find any documents on this chip at all. The only way to make sure is to disassemble bootloader from the fire and see where it looks for antirollback but that is rather complicated and time consuming.

I just wanted to clarify for the thread since there seems to be a lot of speculation and hopes.
[Fire General] DB126:
While no disagreement on conclusions there is no evidence Amazon has intentionally implemented anti-rollback measures. Rather they have taken no steps to accommodate bootloader rollbacks. Perfectly understandable given the target audience for this device and no business case for FireOS digression among that population. This is not not ever was an 'enthusiast'/'modder' device.
[Fire General] xwin01:
Sorry but there is ample evidence of antirollback measures. Please see this thread:

https://xdaforums.com/amazon-fire/general/lk-analysis-bootloader-checking-t3304401

specifically this message:

https://xdaforums.com/showpost.php?p=65123096&postcount=6

There is antirollback check in the loader and it will not run the software if the bits are mismatching. From the messages it looks like antirollback block is in flash and it is probably signed or checksum is stores some place that is not changes on reboot.
[Fire General] DB126:
Fair enough. I had overlooked that thread and the rather explicit anti-rollback traces (d'oh!) A little disappointing but not entirely unexpected for the reasons previously noted. Does dispell the idea that unfavorable rollback outcomes (ie:brick) were entirely passive. A little less respect for Amazon given the near certainty of a ruined device could not have escaped the 'engineering' team. A simple rejection branch would have sufficed. Sigh ...
[Fire General] ryanknut:
Every company is becoming more like Apple and their walled garden approach to things sadly :(
[Fire General] DB126:
Yes - it's the only model that makes economic sense (sadly).
[Fire General] ryanknut:
Why's that? Is it because of piracy? I don't see why they have to keep them locked up.
[Fire General] DB126:
It's all about revenue generating clicks which becomes especially lucrative when the choice of supplier is limited to one.
[Fire General] chwiejak:
Hi Guys,

Is there possibility to root Fire OS 5.3.2.1 and change it to cm?

Thanks
[Fire General] ms372591:
Currently there is no way to root 5.3.2.1, so until there is a way you will not be able change to CM.
[Fire General] greevedogg:
I sent my son's Fire tablet back to Amazon, and am exchanging it for the Samsung Galaxy Tab A 7" instead. The compatibility issues with Google Home/ChromeCast for Netflix and Disney Jr etc was definitely a deal breaker. I would have probably kept it and tinkered with it if it had not updated itself to 5.3.2.1
[Fire General] BeeWall:
Is dirty cow the same as rowhammer? If so, when I ran the Drammer test app on my brother's 5.3.21 tablet, it did not flip anything.
[Fire General] anolis:
DirtyCow exploit has been patched in 5.3.2.1 so it won't work anymore. Gotta wait for A new kernel exploit or something else.
[Fire General] clevebb:
Has anyone tried rooting 5.3.2.1 with the Kingroot PC version?
[Fire General] physicistman:
Tried PC Version doesn't work.

I have tried the PC Version multiple times it doesn't work with 5.3.2.1, along with virtually every root program or apk that can root, with no avail. I have also been trying to figure out how to root myself, but as I have no actual experience with figuring out how to root, I doubt I will figure it out. I have gone so far as to download the source code for the current rom from Amazon, extracting it and looking through it with a hex editor. I have been looking through various methods that have been used in the past, but nothing looks to be common with this rom.
[Fire General] clevebb:
Thanks for you efforts!
[Fire General] chwiejak:
Hello Friends,

Any news with os5321 root or flash other os?

Thanks
[Fire General] rogrobin:
5.3.2.1

Hi

I am hoping that someone a lot cleverer than me will find a way to either roll back or root this version. Im subscribed to this thread so Im hopeful when that happens that it will be posted there.

Cheers!
[Fire General] steve8x8:
Unless someone cracks the patented anti-rollback technology there's little hope for a successful rollback once the updated bootloader has been run and left its mark in a partition of flash memory we cannot access (and modify) anymore. This means you have to either wait for someone to find a loophole in the system (making root possible) or in the bootloader (to be able to replace the kernel with a root-friendly one), or return the device hoping for a replacement that comes with a slightly outdated firmware.

There's almost no way to restore any older bootloader - even the fireOS 5.0.1 one already comes with anti-rollback, and the version counter has been incremented regularly. The exceptions are known but only found by experimenting; it would be nice to "see" from the contents of a fw upgrade whether the RPMB would be bumped or not.
[Fire General] DB126:
Devices secured from Amazon Wearhouse often arrive with older firmware and are usually indistinguishable from new aside from the box they arrive in. Many units are routine returns that did not see significant usage. Lower price point is a nice bonus. Of course the older stock will eventually be depleated.
[Fire General] BeeWall:
If someone used dd to flash the RPMB, lk, preloader, and TEE from an old version (such as 5.0.1) on a rooted tablet, could that downgrade it? I looked at the thread containing he antirollback strings, and those were the mentioned partitions. Obviously, since 5.3.2.1 has no root, this wouldn't work, but would someone with an older, rooted version be wiling to sacrifice their tablet to test this? There are probably a million reason it won't work, but I thought I'd suggest it. Also, could someone with 5.1.1 or higher upload their RPMB so I can compare it to mine?
[Fire General] steve8x8:
The final half-sentence suggests that you were/are able to read your RPMB. Is this true, and does it contain anything useful (i.e. not only zero bytes with an occasional 0x01 for each 512-byte block, which some Michael provided about a year ago for/from 5.0.1)?

There seems to be agreement that the RPMB is *not* accessible using any tools on the OS level - guess what the "P" stands for... thus uboot, preloader, and lk may be the last system components during the boot process that can actually "see" (read and modify) RPMB contents. I'd love to be wrong about this!
[Fire General] jsbeagle:
My daughter cracked the screen on her Fire with CM. I ordered a new one from warehouse last week for like $27 and it shipped with 5.3.2.1
[Fire General] DB126:
Yep - luck of the draw. Guessing the 5th gen 'warehouse' is well stocked with holiday returns which would have been a fairly recent purchase when acquired new.

A few months ago I ordered a 3rd gen HDX simply hoping to receive a rootable, reconditioned device. Instead I got a device loaded with an early generation of FireOS that was nearly 3 years old! Highly desirable/exploitable; took me <15 min to unlock the bootloader and load up CM 13. I was floored; thing was brand new.
[Fire General] BeeWall:
I haven't had time to inspect it closely, but it does only have a few ones so far. Are the ones on bytes 512, 1024, etc, or just somewhere in between??
[Fire General] chwiejak:
Hey,

Did someone find way to root this os?

Thank
[Fire General] steve8x8:
I can only speak for the 5.0.1 one I've seen - it had ones in a very nice pattern, not exactly at "sector" boundaries though. Too regular to contain anything useful (one would expect version tags bigger than one), and very probably faked by the driver built into the kernel.
[Fire General] BeeWall:
I doubt it would be the kernel. I've tried backing it up with dd in TWRP, and it is still the same. Is there some way we could maybe have preloader or lk run a script? Maybe modify it and fastboot boot it? Probably a nooby question, sorry.
[Fire General] steve8x8:
At the current state of affairs you won't be able to modify what's there, just live with it, and exploit it if possible.

Make preloader or lk do something else than their maker made them for - that's quite an ambiitious plan. And, if you succeed, nobody will even think about you being nooby... But be warned: it comes with a price tag - with 120k and 400k of code respectively, this will become a tedious disassembly session. You're not familiar with the ARM instruction set? You will be...

First step on this route to fame (IMHO) would be to understand where the anti-rollback happens, and how it copes with side-effects. This would also provide RPMB details (although probably no easy means to change those). Guessing the meaning of individual cells in the RPMB would be a tough job without them. If we ever get a meaningful RPMB dump, that is.

TBH: this is about an order or two too big for me, and I've seen a lot of machine code (unfortunately not including ARM though). I deeply respect those who accept challenges like this, but I've got to watch from far.
[Fire General] BeeWall:
Yikes. Now I see why nobody did this. I think I don't quite know enough yet....

Like I said, I had no idea how hard it was... Thanks for telling me.
[Fire General] Mr McBoatface:
I was playing around with a fire tablet last night trying various root procedures. I decided to ADB recovery the tablet and accidentally ADB recovered to 5.3.2 instead of 5.3.2.1 . I realised the error before I hit the reboot button and instead cleared cache and user data. Then sideloaded the correct OS ( sideloaded it 3 times just to be sure ). Anyway the tablet booted and all was well.

However following the above I did brick it later in the night following an attempted downgraded to 5.1.1 back up to 5.3.1 in one ADB session without rebooting. This is further confirmation that the anti-rollback measure uses the last fully booted OS . I was considering that maybe just maybe the ADB process would detect the last installed boot loader and write the data to a temp check file for the first reboot. So when I downgraded to 5.1.1 then upgraded to 5.3.1 the 5.1.1 boot file info would be found in check file.... which wasn't the case. I don't mind the brick. I done what I did in the full knowledge it could brick, replaced the motherboard with a spare one which was on 5.0.1 ?
[Fire General] DB126:
Tip-of-the-hat for your sacrifice and sharing learnings with the community. Would have been an important breakthrough had it worked.
[Fire General] Mr McBoatface:
Thanks Davey, no biggy really. The replacement motherboard cost $7.50 had it waiting so knew I wouldn't have a slim door stopper at the end of it.

The fire tablet is breeze to repair, guitar pick, small Philips head screw driver and a hairdryer for the sticky pads on the power, volume buttons, the digitizer pad and speaker. 10 minute job.

When I get time I'll have a look at the aftv2-tools recovery method. I know the one that's there is for the older OS and the boot partition may have changed. But I've everthing setup and can connect to my PC, might need to read the entire MMC data off a good tablet and attempt to write it to the bad. I know that might take days to do but I've a spare pc or 2 on the garage I could leave it run on without any interaction.

As a sidenote AFT2-tools looks interesting. Might also see if root can be achieved through it on the fire tablet. I know we've kingroot which now works on the later OS after 5.1.1 (5.1.3 and 5.1.4 now root) excluding the 2 most recent don't root. My fear is what happens if the kingroot server goes down and stays down! I'm starting to think part of the reason kingroot is hit and miss is the server might be getting overloaded with requests .

A process not depending on cloud would be much better.

EDIT: After a bit of further reading AFT2-Tools currently a no go for anything over 5.1.1 . Ah well I'll keep the bricked motherboard just incase. I've used chip programmers in the past to recovery corrupted bios chips from PC's . These connected to the chip pads and could read and write raw data direct to the chip. Seems like a possible solution but not a general user one.
[Fire General] n3kf:
Thanks for your work! Where did you luck into a MB that cheap?
[Fire General] Mr McBoatface:
EBay sold as defective as they wouldn't register to amazon. Seller sold out now.

Keep an eye out for cheap damaged tablets with cracked screens. Reformatted ones with black welcome screens are on 5.1.4 or lower
[Fire General] physicistman:
I would like to try, but need help.

I am willing to look through as much code as I possibly can. I would be considered a noob at some of this definitely when it comes to actually disassembling the sectors of boot, system, preloader and others, although I do think I have learned a lot in the past month mostly by searching online and figuring it out on my own. I have been trying to go through the lk.bin, the preloader.img, preloader_prod.img, and tz.img, but I have not found any way to disassemble those files. I have taken apart the system, boot and just about everything else, but have not figured out the previously mentioned files. I have already gone through at least a thousand lines of code on the most recent update looking for what vulnerabilities in the apps or in the permissions along with looking at the ramdisk inside the boot.img attempting to find root any way possible.
[Fire General] BeeWall:
I think preloader and lk aren't compressed files. They're just raw code.
[Fire General] physicistman:
I have looked through what I can see using a hex editor, but usually if there are files to extract decompress or decrypt there are numerous seemingly random symbols followed by the execution code towards the end or in the middle and that's what I see opening any of those files, the reason I make that assumption is because before I understood how to extract the boot and system files I saw the exact same setup using a hex editor.
[Fire General] BeeWall:
Maybe. I just feel that they start up a little early to be extracted by anything. I'm pretty sure preloader is the first software to start, so unless the hardware can extract img files... Maybe I'm wrong. I don't really know too much, I'm basically just guessing. Also, I was told that modifying the two requires a lot of experience with arm machine code, so I assumed they were raw code. Though maybe I'm misunderstanding what that means.

Which partition is preloader, mmcblk0boot1 or mmcblk0boot0?
[Fire General] steve8x8:
I haven't checked iFixit for a while, but this might be interesting indeed.

This could provide valuable insight into the raw structure of the flash ROM, and eventually give us a meaningful RPMB dump...

Thanks for your efforts!

---------- Post added at 05:45 PM ---------- Previous post was at 05:35 PM ----------

A very rough estimate: preloader has 120k, lk 400k, about a quarter of that are text strings. If a typical machine instruction has 4 bytes... we're talking about 20k or 75k lines of source code without symbols.

Under the (probably valid) assumption that code is located close to strings used by that code (to keep relative addresses small), it looks a bit better though...

---------- Post added at 06:05 PM ---------- Previous post was at 05:45 PM ----------

According to the updater-script

ui_print("Copying preloader.img to boot partition 0 for unsecure device...");
package_extract_file("images/preloader.img", "/dev/block/platform/mtk-msdc.0/mmcblk0boot0");

Well, I copied the wrong part but the secure preloader would go to the same place.

Re compressed or not: There's a readHeader.py script on my disk that I used to look into the img - a bunch of MediaTek headers (alsmost undocumented), before the code starts. As I had said before, I'm not familiar yet with ARM instruction sets, but this looks uncompressed. (Otherwise there would be no explanation for the rather high percentage of readable strings inside.)
[Fire General] physicistman:
I understand now. Thanks for the info. As said before definitely can be considered as noob, compared to the contributors in this community, I understand physics and mathematics well beyond the normal person, but when it comes to android coding I am fairly new, although I have done Linux scripting for years, and I am willing to put as much time as I possibly can, although I am trying to mod other devices so it might not be as much time as I can. I will try. Thank you to all who have put any attention to this device.
[Fire General] jbnyc341:
Question about fastboot cable

Hi Everyone, I am following this post with a lot of interest. I just acquired the Fire 5th gen and it runs version 5.3.2.1. It was very cheap and I am ready to help trying to root/downgrade it even if it means risking bricking it (and hopefully resurrect it at a later time). In order to do so, I ordered a fastboot cable from Amazon. However when trying it, it does not behave any differently than a regular USB cable. I followed the instructions regarding activating adb on the tablet, installing drivers, etc... the only way I can communicate in fastboot mode with the tablet is by powering it off, starting it with volume down + power and select reboot in bootloader mode. At that point I can communicate with it using fastboot command line utility. However I can also do the exact same thing with a regular USB cable (tried it as well).

From seeing many tutorials online, I thought that the fastboot cable was supposed to boot the tablet directly in fastboot mode so that I have a way to communicate with it if I ever brick it. Does it mean I have received a defective cable or am I misunderstanding how a fastboot cable works?

Thanks in advance for the help and insight here.
[Fire General] BeeWall:
Amazon probably just made it so the device doesn't check for a fastboot cable or not. It wouldn't surprise me.
[Fire General] DB126:
Fastboot (aka factory) cables are useless on this device and most every other Amazon gadget since the 3rd gen HDX (released 2013). There's no magic in those cables, just some crossed wires. If the SOC isn't programed to respond you're done.
[Fire General] jextrevor:
Noob here.

What's the best way to get involved to help discover breakthroughs or vulnerabilities? I don't know much about how the boot process works but I'm willing to learn.

Thanks.
[Fire General] DB126:
Read all you can and contribute where and when you can add value. There is no organized group of hackers that you can join (at least they don't reveal themselves publicly). You'll know when you're amongst knowledgeable individuals who are 'working on' devices of interest.
[Fire General] chillydip:
5.3.2.1 Rollback

********************************************************************************************************************************************

I may have a unique situation concerning rollbacks. I have had my fire for about a year, and have been rooted for about the whole time. I decided to buy my granddaughter a kids edition for xmas. I made the mistake of registering her fire on my account (email) thinking it would help with any warranty concerns, but it linked my rooted fire with hers and somehow Amazon upgraded mine to 5.3.2.1 and killed the jailbreak.

I called Amazon, got her account disassociated with mine, so we are NOW

not

linked. Do I have any recourse as to getting back my root? Clear the update/cache? Thanks in advance if you can help.
[Fire General] DB126:
Unfortunately, no. Timing of the 5.3.2.1 update was likely coincidental. Early methods for blocking OTA updates were not entirely effective and could be easily reversed. Probably what happened to your device. Bottom line is the device is now running 5.3.2.1 which almost certainly includes an updated bootloader/kernel. You know the story from there.

A limited implementation of Google's Play Store can be installed on unrooted devices (here).
[Fire General] melvinaury:
For what I use the Play store work perfect. Also you can change the default launcher...
[Fire General] n3kf:
How do you change the default launcher? On newer models thought the only way to do that was being rooted.... Thanks
[Fire General] BeeWall:
https://xdaforums.com/amazon-fire/orig-development/app-root-launcherhijack-custom-launcher-t3409531
[Fire General] jextrevor:
That method works but is pretty slow and noticeable. Works nonetheless.
[Fire General] BeeWall:
It's the only way to do it, however. If you want it to be less noticeable, go to developer settings and set (transition? If not, window) animation to 0. If you want to choose a launcher, someone made a modded version: https://xdaforums.com/amazon-fire/general/launcher-root-launcher-hijack-v2-t3561026
[Fire General] MisterX00:
Hi, how come you still do not find the solution to unlock Rom 5.3.2.1? it is frustrating to have a tablet and not being able to make the most of its potential.
[Fire General] BeeWall:
People try. It's not easy, and Amazon has talented programmers trying to keep it unrooted. Be thankful that you can still do things like install Google Play and custom launchers.
[Fire General] MisterX00:
I do not doubt that amazon has good programmers, and it is already a good thing to install the google services, but also XDA has the undisputed talents that can solve this problem. I hope that we can in some way to unlock this paperweight.
[Fire General] DB126:
XDA slackers!! What's this world coming to.
[Fire General] n3kf:
It's sarcasm. If this was easy it would have been done.