[Kindle Fire HDX 7" & 8.9" Original Android Develop] draxie:
Revelations... (^; ;^P

I see. Since we only ever have partial info (most people

do all kinds of things in panic and don't even remember

what they did, and usually wouldn't know which of their

actions might make a difference, anyway), it's not easy

to get those dots connected.

The images I posted came from the official Amazon update

and match the MD5 hashes of the aboot images [MENTION=5594063]ONYXis[/MENTION]

had posted; so, unless they (a) mixed up Thor vs Apollo

[which my lazy naming scheme makes much too easy],

or (b) got their aboot from yet another source, I seriously

doubt the bootloader image itself is at fault. (Besides, that

one needs to be *properly* signed by Amazon; so, I think

this path is likely uninteresting.)

Right... I never quite understood what the deal was with that one.

What made devices with newer SW (I assume) freak out...

I think it _could_ be useful to understand if all those recent cases

have this factor in common. THEN, it may be worth to investigate

in more detail... (BTW, didn't [MENTION=5749760]ggow[/MENTION] pull that flashable ZIP after

the assumed bricks started coming in?)

Hmm... I think I'd need more elaboration on this one, as I'm not

quite sure I follow. Is the first sentence above referring to past

successful cases, past cases bricked by the flashable bootloader

update, or the new cases. I got a bit lost... Sorry...

BTW, my Thor had the latest FireOS firmware flashed directly

from Amazon before it got the 1-Click treatment...

Yes, I believe so.

On the other hand, I had a few cases where I had to scratch

my head, as apparent reality didn't quite add up with my own

experiences/expectations.

The current case we're discussing would also be one of those,

since [MENTION=8799219]sunapeelakers[/MENTION] claims to have successfully booted 7.x

ROM:s on a bootloader that seems to have been still locked...

*** TA-DA ***

I've just noticed that I had a bug in my script that checks for faked

signatures on boot.img .... The boot.img files in all the AEX ROM:s

_ARE_ actually fake-signed, meaning that they will boot just fine

on an *locked* vulnerable bootloader. This likely also applies to

the other Nougat ROM:s then... That clears up one confusion (i.e.

the ability to boot Nougat does **NOT** imply an unlocked BL).

---------- Post added at 11:26 ---------- Previous post was at 11:17 ----------

RIght... apparently, the boot images for all those ROM:s are

fake signed; so, they will boot just fine, but anything that

messes with the boot.img (such as Magisk) will hit a wall,

since they don't fake-re-sign the image after their changes.

---------- Post added at 11:35 ---------- Previous post was at 11:26 ----------

Hmm... That sounds _really_ odd. The actual unlock part (i.e. flashing

the code) is so simple, it should be entirely deterministic... Did you guys

also re-run 'get-code.bat' to derive the unlock code once again, or just

kept trying 'unlock.bat' with the same code and it kept failing a lot until it

eventually succeeded? I'm just curious. Perhaps, there's a way to fix that,

IF it can be reproduced and bisected...

---------- Post added at 11:41 ---------- Previous post was at 11:35 ----------

Indeed! Given that the latest ROM:s *DO*, in fact, have a fake-signed

boot.img, they will boot just fine on a *LOCKED* vulnerable bootloader.