yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] MontysEvilTwin:
I left my Fire 7 2015 with OS 5.6.3.0 and 5.01 bootloaders switched off overnight. When I powered it up it went into a bootloop at the Amazon logo stage. Reflashing the bootloader files with the unbricking tool resurrected it. I thought I'd try using the unbricking tool to load later LK and TZ files (5.6.3.0). I copied these from the update.bin. It worked but I lost WiFi. I tried a few things and I think the problem is with the TZ file from the update. It is a '.img' file: I renamed it to '.bin' and placed it in the requisite folder in the unbricking tool. It flashed but there is presumably a problem with the format. How was the TZ file for the unbricking tool obtained?

The device is now on OS 5.6.3.0 with 5.01 preloader and TZ with 5.6.3.0 LK. I know this stops TWRP working but if it prevents the bootloop I will be happy.

---------- Post added at 08:26 PM ---------- Previous post was at 08:19 PM ----------

On another matter, how difficult is it to produce an unbricking tool for the Fire HD8 (6th generation)? I don't know how easy it is to access the point on the board to be shorted. If the unbricking tool could clear the downgrade protection and flash OS 5.3.1.0 bootloaders, that version could then be sideloaded by adb and rooted with the PC version of KingoRoot.
[Fire Android Development] k4y0z:
I assume it must be something like that.

The files where obtained by dumping them from a never updated device, but the files from the firmware-update should work just the same,

I did some testes yesterday with the 5.6.3.0 TZ thinking that would fix the problem.

I will keep working on the unlock-exploit for the 5.0.1 LK, hopefully we will find a fix for the boot-issue with 5.6.3.0.

https://xdaforums.com/hd8-hd10/orig-development/fire-hd-8-2018-downgrade-unlock-root-t3894256

This one should work for unbricking HD8 6th gen, since it is also based on MT8163, you just need to replace the files with the correct versions.

Here is a nice overview which SOCs are used by which tablet:

https://developer.amazon.com/docs/fire-tablets/ft-device-and-feature-specifications.html

Currently we have Unbrick/Downgrade-capabilities for MT8163, MT8127, MT8173
[Fire Android Development] Rortiz2:
Only two stupid questions. Why do you need to update? Why you don't install lineage os 12?
[Fire Android Development] MontysEvilTwin:
Thanks for the info. I downloaded 'amonet' from the first thread quoted but I am a bit out of my depth. That does more than reset the anti rollback and flash bootloaders and I am not sure how to proceed. Also it is not known (as far as I am aware) which terminal would need to be shorted on the Fire HD8 (6th gen.) board to enter the correct mode. I hope someone more knowledgeable than myself takes an interest in this.
[Fire Android Development] k4y0z:
You will have to edit modules/main.py. It should be pretty obvious what's happening there.

Obviously don't use the fastboot-step.

Which pin I cannot tell you, It will likely be close to the EMMC-chip, although if your preloader is bricked, it should go into boot-rom mode by itself.

You could post a picture of the main-board, and we can take a guess :P Be aware though, poking the wrong things could brick stuff.
[Fire Android Development] wolf45801:
Has there been any luck on getting the fire 7 7th gen unlocked and rooted?
[Fire Android Development] MontysEvilTwin:
Pictures of the board are available here and there is another photo and information here. My tablet is working fine, but it would be nice to downgrade so that I can root it.
[Fire Android Development] MontysEvilTwin:
I powered down two Fire 7 (2015) tablets last night and booted them up this morning. One is running OS 5.4.0.0 with 5.01 preloader, TZ and LK, the other is on OS 5.6.3.0 with 5.01 preloader and TZ with 5.6.3.0 LK. Both booted correctly with no bootloops. I will report back if I have any more issues but it looks like it is the combination of later software with earlier LK that is the problem: I have seen similar bootloops with a combination of OS 5.6.0.0 and 5.3.1.0 bootloaders in the past.
[Fire Android Development] bibikalka:
Ok - that makes sense. LK is the thing running prior to booting the OS. Now, this doesn't help too much since this newer LK won't run twrp which is the whole aspiration.
[Fire Android Development] pilterzo:
First, thanks for the amazing work.

I think the script worked, but i couldnt fastboot any recovery that could access the partitions or install anything.

what could I do? how could I check which preloder is install so if the script had success?
[Fire Android Development] DoctorRzepa:
I also have a problem with TWRP as it can't mount any partition. At least it boots...

Gonna try downgrading FireOS too.
[Fire Android Development] k4y0z:
The output of the script should clearly show if it flashed or not.

Are you not able to boot twrp at all?

Which TWRP are you using?

I am using this one: https://xdaforums.com/amazon-fire/development/recovery-twrp-3-0-2-0-t3506897
[Fire Android Development] DoctorRzepa:
I tried both 2.8.7.0 and 3.0.2.0. Every partition is unmounted so it shows it's empty and has 0 MB size. I can't even mount sd card.

EDIT

Sideloading 5.0.1 firmware did not help. Gonna try FlashFire

At boot it says "E:Unable to find partition size for '/boot'"

and for /UB00T /TEE1 /misc /recovery /boot0

and "E:Unable to set bootloader message."

then it fails to mount partitions.
[Fire Android Development] pilterzo:
Same here
[Fire Android Development] k4y0z:
Hmm, not sure why that would be, works perfectly for my.

Maybe check the TWRP-thread if there are known issues?
[Fire Android Development] DoctorRzepa:
I found one xda thread via google where someone had similar issue on different tablet. It turned out TWRP was not compatible with bootloader. I guess some compatibility issues remain despite having 5.0.1 bootloader on Amazon Fire. Maybe some leftovers? Downgrade didn't work (stuck at Amazon logo), but sideloading 5.6.0.0 worked. I did run script again, boot into TWRP and its still the same... or maybe I am doing something wrong?

Maybe the script succeeded only partially? Since I do not have linux machine, I just used Raspberry Pi to run this. Is there other way to verify that everything got flashed properly (like verifying checksum from dumped partition)?

EDIT

What model number do you guys have? My device is from UK, SV98LN. Maybe there is inconsistency in partition table or something. Is partition order in gpt_parsed relevant? I run script twice and that order was different everytime and also different from OPs version. Second value for userdata partition is also different from OPs (the rest match).
[Fire Android Development] bibikalka:
It seems that with this method, people are loading 5.0.1 bootloaders and twrp on tablets of later hardware vintages. These never ran twrp before since there was no way to downgrade to 5.0.1. It makes sense to examine the partition table, and compare to the one from the older models where twrp works. A straightforward twrp update is all that is probably needed here.
[Fire Android Development] ANDROID2468:
Ok, I patch a system.img with root now I just need the scripts to flash/ test it. I tried to see if I can make my own but I just started learning python at the beginning of this year so it's a little too advanced for me right now:silly:

so can anyone make me a script that flashes a system.img?
[Fire Android Development] DoctorRzepa:
Well, if it's that simple then I hope someone is capable of doing that. Who could I ask for such thing?
[Fire Android Development] bibikalka:
You gotta bring in the cavalry - a.k.a, the old guard ! :D

TWRP update, pinging [MENTION=5749760]ggow[/MENTION], [MENTION=4551511]Vlasp[/MENTION]
[Fire Android Development] MontysEvilTwin:
This may be unrelated to the problems reported above, so I have already posted in another general thread here. One of my 5th gen. Fire 7 tablets was running slowly and apps were crashing (the unit running OS 5.4.0.0 with 5.01 bootloaders: this is a 16GB model which originally came with OS 5.1.2 installed). I backed up my apps with Titanium and attempted a factory reset through the standard menus. This failed so I booted to recovery mode. I got several error messages about not being able to mount the cache partition. I tried a factory reset from recovery which also failed. I selected the option to wipe and format the cache which failed. I then tried to update the software with an adb sideload which failed too. I booted to TWRP, but it listed the internal storage as '0MB', refused to flash any zips and failed to wipe/ format the cache. I did find that if I wiped the system partition with Flashfire, the device returned to a factory reset type state. I was also able to flash to later software with Flashfire. I have rerun the unbrick tool to update the LK to 5.6.3.0 and reinstalled my apps. The device is now running smoothly, but I still get the same error messages entering recovery mode, formatting/ wiping the cache still does not seem to work and it is not possible to do a proper factory reset or sideload software over adb. I ran the following command from a root adb shell in a terminal emulator - 'su -c cat proc/mounts' and got the following pertaining to the cache partition - '/dev/block/platform/mtk-msdc.0/by-name/cache /cache ext4 rw,seclabel,nosuid,nodev,noatime,noauto_da_alloc,data=ordered 0 0'. So it does seem like the cache is mounted. I cannot explain the behaviour in recovery mode and don't know how to fix it. Any help would be appreciated.
[Fire Android Development] k4y0z:
Here are some linebreaks for you, it seems you have run out :p

try doing

su -c "fsck /dev/block/platform/mtk-msdc.0/by-name/cache"
[Fire Android Development] hwmod:
The problem observed by using the TWRP built for FireOS 5.0.1 5th Gen on 7th Gen is due to differences in the EXT_CSD revision of the EMMC.

It is clearly reported in the system logs as follow:

mmc0: unrecognised EXT_CSD revision 8
mmc0: error -22 whilst initialising MMC card

So an updated TWRP should hopefully fix the problem. Somebody seems to be already working on that, we must be patient.

.:HWMOD:.
[Fire Android Development] MontysEvilTwin:
My problems are on a Fire 7, 5th generation tablet.
[Fire Android Development] riverstyxxx:
This is terrific news, the one we've all been waiting for. I look forward to either a windows version or a bootable linux iso.
[Fire Android Development] ANDROID2468:
[MENTION=7104332]k4y0z[/MENTION]

nevermind about the script thing. I looked at it again and I figured it out the flashing part. I'm testing the script right now.
[Fire Android Development] k4y0z:
Remember it will be very slow, and you should make sure to have a reliable connections, I've had better success with USB-2.0 ports.

Expect to wait at least 24 hours, until it is finished.
[Fire Android Development] ANDROID2468:
well, it's a good thing I have more than one computer to do this on ;)
[Fire Android Development] reliant_turbo:
i see a newer nightly build is out? has py serial been added?

thanks

Brian
[Fire Android Development] newinnov:
Its not working on my 5th gen. Uninstalled modemmanager and it;s shorted but no matter what it always shows:

Mediatek Inc. MT6227 phone in usb list.
[Fire Android Development] ANDROID2468:
s*** I screwed up the script. when I added the flash system in the main.py, it didn't save or something ( i was switching between computers.. that's what probably mess me up.)

but here's what I did

# 7.5) Downgrade system
log("Flash tz")
switch_user(dev)
flash_binary(dev, "../bin/system.img", gpt["TEE1"][0], gpt["system"][1] * 0x200)

after that I tried restoring but I only get an amazon logo and it reboots :((i cant even get into recovery) when I did that.

then i tried the files from the ota.zip but I got a black screen with the backlight on

then i tried restoring it agin and I get this...

[2019-02-10 19:49:21.348120] Waiting for bootrom
[2019-02-10 19:50:01.312504] Found port = /dev/ttyACM0
[2019-02-10 19:50:01.313550] Handshake
[2019-02-10 19:50:01.314351] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-02-10 19:50:03.844405] Init crypto engine
[2019-02-10 19:50:03.883178] Disable caches
[2019-02-10 19:50:03.883897] Disable bootrom range checks
[2019-02-10 19:50:03.902641] Load payload from ../brom-payload/build/payload.bin = 0x45DC bytes
[2019-02-10 19:50:03.906265] Send payload
[2019-02-10 19:50:05.142613] Let's rock
[2019-02-10 19:50:05.143813] Wait for the payload to come online...
Traceback (most recent call last):
File "main.py", line 132, in <module>
main()
File "main.py", line 60, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/load_payload.py", line 145, in load_payload
dev.wait_payload()
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 173, in wait_payload
raise RuntimeError("received {} instead of expected pattern".format(data))
RuntimeError: received b'' instead of expected pattern

yup my tablet is probably hard bricked :( but at least I still have that 5th gen. my 5th gen had a cracked screen so that's why I bought the 7th gen. I thought that I could switch out the boards since it had root but the boards are layout differently and they flipped the touchscreen connector just to screw with us:mad:
[Fire Android Development] k4y0z:
that's what it should show up as.

In preloader it lists as

It's probably not hardbricked but you flashed system image, over TEE1 and everything after it.

[PART] 9: 00002800 0001CB00 'TEE1'
[PART] 10: 00002800 0001F300 'TEE2'
[PART] 11: 00258000 00021B00 'system'
[PART] 12: 0007D000 00279B00 'cache'
[PART] 13: 00B994DF 002F6B00 'userdata'

So your TEE1, TEE2 and system are broken.

You should flash tz.bin to your tee1 and tee2.

Then you should be able to at least get into fastboot and recovery.

If you also messed with LK and preloader, you will have to write the correct files there as well.

Also make sure to zero out RPMB.
[Fire Android Development] ANDROID2468:
sorry, I haven't had time to check yet. I will let you know tomorrow
[Fire Android Development] ANDROID2468:
i tryed doing what you said but i get this error

[2019-02-11 17:14:47.551121] Waiting for bootrom
[2019-02-11 17:15:00.633673] Found port = /dev/ttyACM0
[2019-02-11 17:15:00.635645] Handshake
[2019-02-11 17:15:00.639625] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-02-11 17:15:02.578750] Init crypto engine
[2019-02-11 17:15:02.819650] Disable caches
[2019-02-11 17:15:02.823642] Disable bootrom range checks
[2019-02-11 17:15:02.968286] Load payload from ../brom-payload/build/payload.bin = 0x45DC bytes
[2019-02-11 17:15:02.973654] Send payload
[2019-02-11 17:15:07.530623] Let's rock
[2019-02-11 17:15:07.535633] Wait for the payload to come online...
Traceback (most recent call last):
File "main.py", line 135, in <module>
main()
File "main.py", line 60, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/nicholas/Desktop/fire7-2015-downgrade-unbrick (copy)/modules/load_payload.py", line 145, in load_payload
dev.wait_payload()
File "/home/nicholas/Desktop/fire7-2015-downgrade-unbrick (copy)/modules/common.py", line 173, in wait_payload
raise RuntimeError("received {} instead of expected pattern".format(data))
RuntimeError: received b'' instead of expected pattern
[Fire Android Development] k4y0z:
Hmm, not sure, try disconnecting the battery while doing it.
[Fire Android Development] ANDROID2468:
nope still get the same error
[Fire Android Development] k4y0z:
Try redownloading the zip, maybe you broke something else, when you messed with the scripts?
[Fire Android Development] ANDROID2468:
I tested it on my 5th gen and it works! no more "fastboot boot"! :)
[Fire Android Development] k4y0z:
Yes, it uses the 5.6.3 LK that doesn't support "fastboot boot", but therefore it will boot 5.6.* without any issues and you can flash TWRP :p

But I kept the 5.0.1 preloader for easy access to the boot-rom :)
[Fire Android Development] k4y0z:
If you wan't, you can test the preview I just posted here.

It includes TWRP 3.2.3 using the latest LK and kernel.
[Fire Android Development] ANDROID2468:
well back on my 7gen:

nope, still get this same error. my guess is the partitions probably got messed up

there is the error

[2019-02-11 18:03:07.070934] Waiting for bootrom
[2019-02-11 18:03:16.885692] Found port = /dev/ttyACM0
[2019-02-11 18:03:16.887675] Handshake
[2019-02-11 18:03:16.891655] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-02-11 18:03:30.470907] Init crypto engine
[2019-02-11 18:03:30.715585] Disable caches
[2019-02-11 18:03:30.719614] Disable bootrom range checks
[2019-02-11 18:03:30.852683] Load payload from ../brom-payload/build/payload.bin = 0x45DC bytes
[2019-02-11 18:03:30.857043] Send payload
[2019-02-11 18:03:35.403898] Let's rock
[2019-02-11 18:03:35.408924] Wait for the payload to come online...
Traceback (most recent call last):
File "main.py", line 134, in <module>
main()
File "main.py", line 60, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/load_payload.py", line 145, in load_payload
dev.wait_payload()
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 173, in wait_payload
raise RuntimeError("received {} instead of expected pattern".format(data))
RuntimeError: received b'' instead of expected pattern
[Fire Android Development] k4y0z:
Even if the partitions are completely messed up, the exploit should still work. I don't know what's going on.

Can you think of anything else, you have done differently? Try a different PC perhaps?
[Fire Android Development] ANDROID2468:
nope not yet

you can check its progress here

https://code.binbash.it:8443/FWUL/build_fwul/issues/97

---------- Post added at 01:14 AM ---------- Previous post was at 12:32 AM ----------

maybe an efuse blew. can it even boot to boot rom if that happens?

I tried it on another pc yesterday with no luck. but I will try it again later... right now I'm working on a fire os 5.6.3. zip for flashing in twrp that won't flash the bootloader. I have done this for 5.4.0 already over here.
[Fire Android Development] ANDROID2468:
edit:

looks like I hit a roadblock making that fire os 5.6.3 fw with no bootloader files...

this build of TWRP doesn't like this type of installer script.

https://drive.google.com/drive/u/1/folders/1jefnFfz-vvDToeZBnw2t-bHVjbZJuz__

this script works on the other build of twrp.

I guess I got to do it the system.dat way :(

edit: I forgot to mention that LOS works.

I fixed my issue with the rom script...

I had it like this before:

package_extract_file("boot.bin", "/dev/block/bootdevice/by-name/boot");

this worked on older twrp.

How I have it now:

package_extract_file("boot.bin", "/dev/block/platform/mtk-msdc.0/by-name/boot");
[Fire Android Development] reliant_turbo:
thanks, until then, i just manually installed it. :good:

i thought about using puppy linux (i tinker with that more) to do this bootrom stuff (have a hd8 8th gen that im going to unlock soon as well as a 5th gen) but the FWUL seems setup so nicely already that i wanted to try it.

thanks

Brian
[Fire Android Development] newinnov:
But mine is stuck at - Waiting for bootrom only!

It does not give any error or anything just that same line. Usb list shows- MT6227

I have Fire os 5.4, 2015 edition and Ubuntu 18 lts installed

Edit- My device works perfectly fine, I had 5.6 but later downgraded to 5.4 to disable apps. Only purpose to use this exploit is to have root and magisk. Is this method only work with broken devices?
[Fire Android Development] ANDROID2468:
it sounds like you are not making good contact to ground. also, try it with the battery disconnected.
[Xiaomi Mi A1 Accessories] Yuzuki Takahashi:
I have a question since i stumble upon a 4000 mah battery while online shopping yesterday (BN31 the same code with the original MiA1 battery). Is it ok/safe installing this kind of battery?:confused: (The battery are not manufactured by Xiaomi)
[Xiaomi Mi A1 Accessories] emiljano539:
As long as the ratings are the same as the Xiaomi mi a1's battery it's safe to replace them. But the longevity of them depends on the quality
[Xiaomi Mi A1 Accessories] barrack1:
Most likely the 4000 rating is false, China manufacturers are well known for this.
[Xiaomi Mi A1 Accessories] valkyrjur:
I received the "chensuper" battery. I've swapped mine with the new one but in cpuz shows 3080 mah like the old one.
[Xiaomi Mi A1 Accessories] jordanjoe1995:
is it last longer ?
[Xiaomi Mi A1 Accessories] valkyrjur:
It's the same (shame) capacity of the official one so there are not improves on that. But for the price it's a good replacement.
[Xiaomi Mi A1 Accessories] emiljano539:
Maybe it was a fake 4000mah battery
[Xiaomi Mi A1 Accessories] lithoc:
ANy updates?

Does the battery lasted ?
[Xiaomi Mi A1 Accessories] Yuzuki Takahashi:
For me there is a bit of improvement but still I'll suggest that you stick with the original battery since mine bloated up due to heavy usage and frequent discharging and charging of the battery. With the original battery, it already reaching its 2 years of life time now since first bought and it need a change of new battery now because the capacity is way to low to even last a half day. :laugh:
[Xiaomi Mi A1 Accessories] Akmak:
I have bought a 5000mah bn31 battery from the brand Losoncoer. When arrived the packaging said 6400mah. I can surely say that after 3 and a half months its capacity is exactly the half of the stated one. Around 3200 mah. But it takes much more time to charge, so I advise everyone to buy original Xiaomi replacement parts.
[Xiaomi Mi A1 Accessories] methuselah:
The moral of the story is, you should always buy genuine parts. Because batteries are typical piece of work. The manufacturing used by the OEM is robust compared to the local ones. So its always far better to buy underived ones. Other stuff like display, digitizer can be taken from third party vendor. But for batteries always choose OEM one.
[Xiaomi Mi A1 Accessories] Akmak:
For me it is still usable, but it has far worse screen on time, so yeah buy genuine batteries.

Altough in my mi a1 the usb-c port died the 4th time in the last 2 years, they always lasted half a year, no matter if i bought genuine part for Replacement or not?
[Xiaomi Mi A1 Accessories] methuselah:
How come your USB C Port can die? How many times you your to charge your phone?
[Xiaomi Mi A1 Accessories] Akmak:
I have no idea at all. At first it will throw away charge at random times. Later it develops worse contact problems. It starts to only charge slowly and at the very end it could only take up charge if I apply force on it sideways.

I charge my phone every night. I used the original cable but lately i am using a blitzwolf branded one.

I have friends whose phone's port only needed a cleaning, but it does not help mine.
[Xiaomi Mi A1 Accessories] reharsh67:
yeah
[Xiaomi Mi A1 Accessories] ranjodhricky:
i want to replace my phone's battery can i buy original battery online if not then which battery is good to buy online?