yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION]

Updating post, I totally forgot to start with the handshake, then plugin the device while pushing the button ... So with 5.1.2 bootloaders for Fire 7 I am getting a proper handshake, but things are crashing, perhaps because I am using Python3 under Windows XP. Anyway, will keep looking into this a bit. But this is good news, being able to go from 5.1.2 bootloaders to 5.0.1 is nice! The device calls itself "MTK USB Port". I tried the same for Fire HD 2014, it seems to go into the pre-loader mode, so I will keep trying.

C:\extra\android\fire_2015\fire7-2017-test\modules>python main.py
[2019-01-29 20:46:00.234375] Waiting for bootrom
[2019-01-29 20:46:16.765625] Found port = COM10
[2019-01-29 20:46:16.796875] Handshake
[2019-01-29 20:46:16.812500] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-01-29 20:46:21.265625] Init crypto engine
[2019-01-29 20:46:21.515625] Disable caches
[2019-01-29 20:46:21.515625] Disable bootrom range checks
[2019-01-29 20:46:21.640625] Load payload from ../brom-payload/build/payload.bin
= 0x45DC bytes
[2019-01-29 20:46:21.656250] Send payload
[2019-01-29 20:46:26.156250] Let's rock
[2019-01-29 20:46:26.156250] Wait for the payload to come online...
[2019-01-29 20:46:26.765625] all good
[2019-01-29 20:46:26.765625] Check GPT
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 64, in main
switch_user(dev)
File "main.py", line 33, in switch_user
block = dev.emmc_read(0)
File "C:\extra\android\fire_2015\fire7-2017-test\modules\common.py", line 185,
in emmc_read
raise RuntimeError("read fail")
RuntimeError: read fail

[MENTION=5728225]Kramar111[/MENTION]
[Fire Android Development] k4y0z:
Yes and no, it is based on [MENTION=9667509]xyz`[/MENTION] s work for the HD8, wich uses parts of aftv2-tools.

Since it is a boot-rom exploit though it will work on any firmware-version.

The HD6/7 2014 are based on the MT8135 SOC for which no port exists yet.

So far there is xyz`s original work for MT8163 and my port for MT8127.

Porting the exploit to new hardware isn't an easy task.

Yes that would work, but needs porting of the exploit. I don't have any hardware based on MT8135, so I can't help with that.

I believe on the 7th gen it sadly is soldered on :/

That's interesting, it looks like the payload successfully executed, but then fails to read for some reason.

If you have serial connected to the fire, it would be interesting to see, what it prints.
[Fire Android Development] Rortiz2:
Oh f**. Then there is no root ... If I have to disarm..
[Fire Android Development] bibikalka:
Agreed. HD 2014 was a more powerful device than Fire 7, but more expensive. So fewer people have it, and the hacking talent pool is far more limited. Anyway, we'll keep trying.

This bootloader version 5.1.2 for Fire 7 can output UART over the USB connection. But I need to figure out how to have both the normal USB cable connected to a computer, and then spliced in wires to be reading UART output at the same time over the same cable, as per this:

https://xdaforums.com/showpost.php?p=65585385&postcount=16

https://xdaforums.com/showpost.php?p=65588189&postcount=18

Pinging the prior crew:

@hwmod, [MENTION=4267571]sd_shadow[/MENTION], [MENTION=4246643]Tomsgt[/MENTION], @Davey126, @DragonFire1024, [MENTION=8978978]Rortiz2[/MENTION], [MENTION=885099]noelcragg[/MENTION], [MENTION=3411776]zeroepoch[/MENTION]
[Fire Android Development] Rortiz2:
Hi, Bad news .... I have opened the Fire 7 7th gen and this is what I have found ... Is soldered down ... I have found these points (see attachments)
[Fire Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION]

It looks like for "live" Fire 7 2015 tablets with any ROM version (!!!) there is an easy way to get into 5.0.1 TWRP without opening the case!!! Yay!

See this:

https://xdaforums.com/showpost.php?p=78796634&postcount=135

Method:

1) Brick the tablet by sideloading 5.0.1 ROM from here:

http://kindle-fire-updates.s3.amazo...ZjK/update-kindle-37.5.2.2_user_522054520.bin

2) For the bricked tablet, 5.0.1 preloader will enter the bootrom mode via the left volume button press (this happens before the anti-rollback check!!!).

3) Run the tools from this thread to zero out RPMB (can you make a clean version that only does this, and nothing else?)

4) Boot into the tethered TWRP since 5.0.1 should be able to boot now - and do whatever you want (root, custom ROM, etc)

5) Profit!!!

Once we have a brave volunteer to try this, could you put this information into post #1 ?

---------- Post added at 06:21 PM ---------- Previous post was at 06:20 PM ----------

Once somebody brave enough removes the cover and finds the right contact to short, one could simply drill a hole in the right spot - that's quicker than removing the whole shield.
[Fire Android Development] ANDROID2468:
yea.. but I took the risk of removing the shield. I used a pocket knife and needle nose, pliers. I got some board damage but it still works.

https://imgur.com/a/YRxzM6y

update: I was rely close to damaging some traces.. :( yea I don't recommend doing it this way
[Fire Android Development] newinnov:
Battery is disconnected, I tried with both connected and disconnected. + usblist removes Mediatek 6227 device when I remove the short, so I think it's nicely shorted.

I guess this does not work on all devices.
[Fire Android Development] ANDROID2468:
this will work on all 5th gens. try running as root. type sudo at the beginning
[Fire Android Development] bibikalka:
Nice work!

But, I am confused. Is it not possible to boot into twrp the old way, flash a zip with your new LK & TWRP, and simply reboot into recovery - your new twrp?

Btw, did you disable LK version updates to RPMB ?

Also, FireOs 5 is Lollipop 5.11, is there any reason not to stick with the golden SuperSu 2.82SR5 ? In Lollipop the system root mode works great.

The biggest value i see in having twrp in recovery, and having the untethered twrp option.

Or am I missing the bigger picture here?
[Fire Android Development] ANDROID2468:
wifi does not work on any firmware I tried so far
[Fire Android Development] yakov116:
Is there any way to get this working on windows 10 with Linux?
[Fire Android Development] newinnov:
You are the Rockstar! :) My bad, It works fine with sudo. It was indeed privilege issue. Thanks

One more question can custom rom e.g. lineage can be flashed with this? Or still non amazon boot.img is not supported?
[Fire Android Development] k4y0z:
That will not work, the lk-payload is stored on boot0, also new LK probably won't work because RPMB isn't reset.

What do you mean? the preloader writes the RPMB.

I suppose SuperSu would work just as well, minus the hiding root and other features of Magisk.

This opens up the door for newer ROMS, given that developers could now build custom kernels.
[MENTION=5749760]ggow[/MENTION] [MENTION=2511007]csolanol[/MENTION] tagging you here :p

Just noticed, as a quick fix, flash the tz.bin from the zip in the first post and zero out RPMB.

Will post an update later.
[Fire Android Development] k4y0z:
Here the updated package.
[Fire Android Development] newinnov:
Hi,

I have just tested today, this package works fine, and boot.img exploit works as expected with help of your custom twrp. I tested with LOS and Magisk, working fine.

Plus above reported wifi issue is also no there. Thanks for reviving this device.:)
[Fire Android Development] DoctorRzepa:
Hell yes, it works like a charm!
[Fire Android Development] ANDROID2468:
I can confirm that wifi is working
[Fire Android Development] bibikalka:
But if I am booting the old twrp, that means I have 5.0.1, so RPMB is in fact reset. And, the old twrp can write into boot0 areas, that's how Amazon updates do it for preloader. So, I am trying to say that the twrp route seems perfectly viable to get your unlock on the device.

For rpmb, my question was after you run the newer hacked LK, does rpmb anti-rollback flags get updated to this newer LK version or not? So if I were to go back to 5.0.1 LK without tomb reset, would it brick?
[Fire Android Development] k4y0z:
Yes, TWRP could write to boot0. But I'm not sure if you can write a newer bootloader without resetting RPMB.

Again RPMB is set and checked by the preloader, so yes, writing 5.0.1 LK without clearing RPMB will brick.

I will do some tests and see if I can create an update-zip for the old TWRP.
[Fire Android Development] ANDROID2468:
I have 2 fire os 5.6.3 based roms ready to be released on XDA once you officially release this...

The first rom is just fire os 5.6.3 with no bootloader flashing, OTA blocked and ads blocked.

more details:

you can try it here

but I'm waiting until this "semi-bootloader unlock" to get officially released until posting it on XDA.

The other one is a more customized version of fire os that I'm calling "fire os revamped "

more details:

I removed the launcher, blocked OTA, blocked ads, removed silk, removed the help app(it's a little broken from removing the launcher), and the music player.

I added the nova launcher, xda labs, black player(music player), Firefox(because of fire os ;) )

you can try it here.

but I'm waiting until this "semi-bootloader unlock" to get officially released until posting it on XDA.

anyone who test this, please do not post issues or adding/removal request on this thread!!

post issues here.
[Fire Android Development] thoughtlesskyle:
couldn't get it to move passed looking for bootrom,

I am on a preloader that can fastboot recovery, but holding volume left and plugging it in takes me to recovery, the other button takes me to fastboot

am I on the wrong preloader or am I doing something wrong?

Using a lenovo chromebook that I put elementaryOS on natively and using a USB 2.0 port, tried all of the USB on the device with no luck
[Fire Android Development] ANDROID2468:
If you have root you can get to boot-room mode by overwriting the preloader.

This was from page 5 said by k4y0z

su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro; cat /dev/zero > /dev/block/mmcblk0boot0; echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0"

THIS WILL BRICK YOUR DEVICE UNTIL FIXED USING THE EXPLOIT

Edit: running the script automatically fixes the brick
[Fire Android Development] nicokovac:
Hi, i did the exploit with athe newest FireOS on a 5th gen.

It worked, but since then the wifi and bluetooth doesn't work.

I just tried the new release with the fastbook hack but still it

only says activating wifi and nothing happens.

Any suggestions?

Thx
[Fire Android Development] ANDROID2468:
Did you do version 2?
[Fire Android Development] k4y0z:
Here is the release, you guys have been waiting for:

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860/
[Fire Android Development] nicokovac:
Yeah thats what I did today, but it doesn't help. Perhaps the newest

release. Will give it a try.
[Fire Android Development] ANDROID2468:
The official thread is out now

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860
[Fire Android Development] ANDROID2468:
[MENTION=7104332]k4y0z[/MENTION] back to my bricked 7 gen....

I tried another computer and with no luck but when I was doing that I think I found my problem. I was testing what will happen when I hold vol down when I plugged it in and it worked right away(which means when I probably mix the 5th gen and 7th gen files together by accident:( )

so before I bricked my 7th gen, I updated to the latest FW but I forgot to run the backup script so I used the ones in the rom but some of them have different file extensions.. which means mabby I blow an efuse? but can it even boot up into boot-rom if that happens?

here is my error:

[2019-02-13 18:06:20.422774] Waiting for bootrom
[2019-02-13 18:06:47.826228] Found port = /dev/ttyACM0
[2019-02-13 18:06:47.827535] Handshake
[2019-02-13 18:06:47.829498] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-02-13 18:06:51.139583] Init crypto engine
[2019-02-13 18:06:51.177523] Disable caches
[2019-02-13 18:06:51.178223] Disable bootrom range checks
[2019-02-13 18:06:51.198746] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-02-13 18:06:51.205711] Send payload
[2019-02-13 18:06:52.397674] Let's rock
[2019-02-13 18:06:52.399354] Wait for the payload to come online...
Traceback (most recent call last):
File "main.py", line 130, in <module>
main()
File "main.py", line 67, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/nicholas/Downloads/amonet/modules/load_payload.py", line 160, in load_payload
dev.wait_payload()
File "/home/nicholas/Downloads/amonet/modules/common.py", line 173, in wait_payload
raise RuntimeError("received {} instead of expected pattern".format(data))
RuntimeError: received b'' instead of expected pattern
[Fire Android Development] k4y0z:
It looks, like the payload never comes online. I don't know why.

Have you tried hooking up serial?

The first thing it does, it tries to initialize MMC.

Maybe you physically bricked your MMC by shorting the wrong things?

Does it enter bootrom-mode when you don't short anything and press no buttons?
[Fire Android Development] ANDROID2468:
no, I'm not sure what you mean by that.
[Fire Android Development] k4y0z:
You can use a "Mediatek Debug Cable" for that.

http://www.stevenhoneyman.co.uk/2014/11/mtk-mediatek-debug-cable.html
[Fire Android Development] k4y0z:
Can you try with the attached brom-payload if you get back the "all good" message?
[Fire Android Development] ANDROID2468:
I fix it! I comply disconnect the board it from everything, plugged it in and it started flashing! but now I'm stuck on the Amazon logo and i can't get into recovery.
[Fire Android Development] k4y0z:
What exactly have you flashed now?

You could use the zip provided in the unlock-thread to get into unlocked fastboot (Don't run fastboot-step).

In unlocked fastboot you can flash the correct boot,recovery and system-images.

then replace the files in the bin folder (tz, lk and preloader_prod.img) with the ones from 7th gen firmware.

Comment out this line and rerun bootrom-step.
[Fire Android Development] ANDROID2468:
I can't find the recovery but i can find the boot.img and system
[Fire Android Development] k4y0z:
Then flash only boot and system. recovery should be created on first boot, when you used the correct boot and system.img.
[Fire Android Development] k4y0z:
I have attached a boot.img and recovery.img from the 7th gen 5.6.3.0-Firmware.

The recovery.img is created from the boot.img, you can try these.
[Fire Android Development] mateo121212:
Thanks the recovery works.
[Fire Android Development] Rortiz2:
[MENTION=7104332]k4y0z[/MENTION] or [MENTION=6568249]mateo121212[/MENTION] I need help!

I used the script for install TWRP on the fire 7th gen and now the tablet shows amazon logo and reboots...

I can access to fastboot mode but all commands give me the same output:

restricted on locked hw
[Fire Android Development] k4y0z:
Did you mean to write in the other thread? There is no TWRP for the 7th gen here.

What did you do exaclty? Have you tried entering recovery-mode? (Left volume button during power-on)

You are in normal fastboot-mode that won't allow you do do much.
[Fire Android Development] Rortiz2:
Ohh ****...

So what is this file?

https://xdaforums.com/attachment.php?attachmentid=4706824&d=1550362739

I executed this command:

su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro; cat /dev/zero > /dev/block/mmcblk0boot0; echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0"

I powered off the tablet and the computer detected the fire in BootROM Mode. Then I executed the amonet-fire7-7th-gen-v1.2.zip and the tablet started a loop in the amazon logo.

If I short the pin and I connect the tablet to the computer, it only detects it as Preloader..

I only can enter to fastboot locked mode.
[Fire Android Development] k4y0z:
Yes, that file is from the other thread.

what exactly was the output of the script? the first step apparently succeeded, otherwise there would be no amazon logo.

Have you tried entering recovery-mode?

If you end up in preloader, your shorting is probably not done right.

Also disconnect the battery when doing it this way (reconnect it when the first script finishes).
[Fire Android Development] Rortiz2:
I can't access to recovery mode. But what does the script?!

Here's the output:

[2019-02-17 18:34:51.156525] Waiting for bootrom
[2019-02-17 18:35:00.543181] Found port = /dev/ttyACM0
[2019-02-17 18:35:00.563564] Handshake
[2019-02-17 18:35:00.585092] Disable watchdog
[2019-02-17 18:35:04.026151] Init crypto engine
[2019-02-17 18:35:04.969899] Disable caches
[2019-02-17 18:35:04.983481] Disable bootrom range checks
[2019-02-17 18:35:05.486991] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-02-17 18:35:05.512140] Send payload
[2019-02-17 18:35:31.252808] Let's rock
[2019-02-17 18:35:31.274422] Wait for the payload to come online...
[2019-02-17 18:35:31.882900] all good
[2019-02-17 18:35:31.883388] Check GPT
[2019-02-17 18:35:32.309287] gpt_parsed = {'EXPDB': (6144, 35584), 'system': (137984, 2457600), 'UBOOT': (41728, 2048), '': (0, 1), 'DKB': (4096, 2048), 'recovery': (76544, 32768), 'LOGO': (110336, 7168), 'userdata': (3107584, 27428063), 'TEE2': (127744, 10240), 'boot': (43776, 32768), 'KB': (2048, 2048), 'cache': (2595584, 512000), 'TEE1': (117504, 10240), 'MISC': (109312, 1024)}
[2019-02-17 18:35:32.309681] Check boot0
[2019-02-17 18:35:32.539306] Check rpmb
[2019-02-17 18:35:32.762995] Downgrade rpmb
[2019-02-17 18:35:32.778677] Recheck rpmb
[2019-02-17 18:35:33.679933] rpmb downgrade ok
[2019-02-17 18:35:33.680148] Flash lk-payload
[2019-02-17 18:35:34.136648] Flash preloader
[2019-02-17 18:35:43.735111] Flash tz
[2019-02-17 18:37:12.036836] Flash lk
[2019-02-17 18:37:49.095067] Inject microloader
[2019-02-17 18:37:49.473129] Reboot to unlocked fastboot
[Fire Android Development] k4y0z:
So "bootrom-step" looks good, what about "fastboot-step"?

When you try to boot normal after "bootrom-step" it should go into hacked fastboot.
[Fire Android Development] Rortiz2:
NOPE. There's no fastboot hacked.. It only shows amazon logo but you can use fastboot commands.

I can't get the tablet in BootROM Mode again..
[Fire Android Development] k4y0z:
but you cant do "fastboot flash recovery recovery.img" ?

Try "stock-recovery.sh" maybe?

To get into bootrom again, make sure to disconnect the battery, while trying.

Also there are other points that can be shorted, as [MENTION=4381075]hwmod[/MENTION] has explained.
[Fire Android Development] Rortiz2:
I can't flash anything. Always the same:

FAILED (remote: the command you input is restricted on locked hw)

I will try other points..

fastboot-step.sh output:

rortiz2@rortiz2-VirtualBox:~/Descargas/amonet$ sudo ./fastboot-step.sh
target reported max download size of 134217728 bytes
sending 'boot' (4736 KB)...
OKAY [ 1.747s]
writing 'boot'...
FAILED (remote: the command you input is restricted on locked hw)
finished. total time: 1.759s
[Fire Android Development] mateo121212:
If you wanna troubleshoot it

Start over with new download of new files. Dont reuse anything.

Your gonna have to short the pin.(try using a saftey pin and wire for precision and a maginifying glass to see well)

Since your in vm when trying to enter bootrom make sure to check to make sure your in the right usb mode.

After first boot to hacked fastboot check the screen to make sure it says so before you run fastboot step.
[Fire Android Development] k4y0z:
I'm sorry, I may have messed up the package, I will upload a new one in a few minutes.
[Fire Android Development] k4y0z:
So new build is up, [MENTION=6568249]mateo121212[/MENTION] is currently running a last test.

[MENTION=8978978]Rortiz2[/MENTION] It seems like your recovery was already broken before, otherwise you would have been able to enter recovery now, since it was never overwritten.

You will have to reenter bootrom-mode and run the new scripts.
[Fire Android Development] Rortiz2:
Oh Fvck .. Now how do I fix the tablet? I have to remove the shield completely and I do not know how to do it.
[Fire Android Development] k4y0z:
how did you enter bootrom-mode before?
[Fire Android Development] Rortiz2:
Shorting the points.

But now doesn't work.
[Fire Android Development] k4y0z:
Maybe disconnect the battery and let it be for a few minutes.

Then try again. If it worked before, it will work again.
[Fire Android Development] Rortiz2:
For disconnect the battery I need to remove 2 screws but but they are very firmly fixed and it is very difficult to remove them.

There's another way?
[Fire Android Development] k4y0z:
With the right tools, the screws shouldn't be to difficult to remove.

I don't know what else to suggest, you will have to reenter bootrom-mode.

The new files are up and tested (thanks [MENTION=6568249]mateo121212[/MENTION])
[Fire Android Development] Rortiz2:
Goodness, I have been the lucky one who has bricked the tablet for using the "broken" script:)
[Fire Android Development] k4y0z:
Nothing is lost forever. The worst thing could be that you have to wait until the battery dies, if you are unable to disconnect it.

Your recovery must have already been botched before you ran the script, since that was never overwritten by the script.

You would have been able to enter recovery now.
[Fire Android Development] hwmod:
Disconnect the battery as they suggested, remove the two screws using the correct size screwdriver then lift up the metal connector.

Once you have done that go to sleep ... the next day you will be good to go, no jokes do that since doing the work under pressure

and letting panic take on you will only bring more damages. Do not rush, as other said it is impossible to break by software.

It can always be recovered if the hardware is good, be patient and follow the given suggestions.

.:HWMOD:.

---------- Post added at 02:46 AM ---------- Previous post was at 02:30 AM ----------

Disconnect the battery as they suggested, remove the two screws using the correct size screwdriver then lift up the metal connector.

Once you have done that go to sleep ... the next day you will be good to go, no jokes do that since doing the work under pressure

and letting panic take on you will only bring more damages. Do not rush, as other said it is impossible to break by software.

It can always be recovered if the hardware is good, be patient and follow the given suggestions.

.:HWMOD:.
[Fire Android Development] Jackaf:
I have a Fire 7 2015 on original 5.0.1 firmware, never had any updates.

After shutting down tablet a few days ago, it wasn't turning on, but when connected to USB is detected as 0e8d:0003

Trying this script, it gets up to "Wait for the payload to come online..." and then fails with error "received b'' instead of expected pattern".

Any ideas?
[Fire Android Development] k4y0z:
Although you can still use the tools in this thread for unbricking, I'd suggest you use the tools from here:

https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860

Take care to prepare your system as is explained in the OP
[Fire Android Development] tngu125@gmail.com:
I'm stuck on the waiting for bootrom. I have a 2015 Fire 7 tablet and VirtualBox Ubuntu setup. Did you fix your issue?
[Fire Android Development] k4y0z:
Use the tools and procedure from the other thread.
[Fire Android Development] whereismyhat:
I have run into this exact issue trying to unlock/root my kindle, it is totally unresponsive now :( I was trying to use the VCC1 "pad" to short because the CMD one was not working, and now im stuck, this is the second board ive tried with, the first one i knocked a component off by mistake when trying to remove the sheild....

EDIT: I wasnt trying to downgrade, i have the 7th gen and was just trying to follow this thread https://xdaforums.com/amazon-fire/development/unlock-fire-t3899860 but my result looks nearly similar and it seems bricked.
[Fire Android Development] Black Swift:
Thank you verry much!! it worked out verry well