yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] k4y0z:
Great to hear you where successfull :)

AFAIR there is only the production and development preloader (perloader_prod.img and preloader.img). So all devices sold to customers should be on preloader_prod.img. Also I believe during the efforts of unlocking the Fire 7 someone tried using the development preloader/lk on a production device and didn't notice any difference, besides them using different signatures.

These RPMBs are different though if you look carefully ;)

Since you cleared RPMB before flashing though you can pretty much mix and mach preloader/lk as you like.

But as long as booting into TWRP works for you I guess it doesn't really matter what preloader you use.

I will add a note to the OP, to disable/uninstall modemmanager, I believe the issue should also be fixable using udev-rules.

I'm not sure if it's worth the hassle checking for the presence of modemmanager, since detection might not work properly on all distros.
[Fire Android Development] bibikalka:
I actually recall that somebody reported a brick when using the wrong preloader :D Too lazy now to hunt for that post ...

Right - my wording was not precise. I meant to say the versions for preloaders themselves did not change, but they do change for LK/TZ pieces. I may actually keep 5.0.1 preloader, but use the latest LK/TZ in order to enable the latest FireOS to run. I could not get the latest FireOS to run with the older LK/TZ, as I posted here.
[Fire Android Development] hwmod:
[MENTION=7104332]k4y0z[/MENTION], it is not possible to run the non production 'preloader' on a production tablet, it doesn't even boot.

If it did we would already have an unlocked tablet. I tried long ago and retried recently without success. (tablet doesn't boot).

It is true that is possible to change the 'board_id' using the 'idme' command so the next update will use the 'preloader.img' instead of 'preloader_prod.img'.

However the tablet will result non functional, I don't know why yet ... it maybe depend not only on the 'board_id' but on a combinations of that ID with another value.

If you have further information or different results about that please share.

Did somebody had success with running the new downgrading process on the Fire 7 7th Generation ?

It looks like it is not easy to put the 7th Generation tablets in the [DL] mode like we do on the 5th Generation tablets.

.:HWMOD:.
[Fire Android Development] k4y0z:
Yes, there were lots of these :laugh:

Mostly because an older preloader or an incompatible preloader/lk (prod/dev) was flashed.

But I remember at least one occasion were someone attempted to install dev-preloader and lk of the same version and was successful.

Since that didn't seem to be of any help I don't think anyone bothered to further investigate.

Makes sense.

With this method it's virtually impossible to brick the tablet though (although opening it might be necessary when the preloader still runs, but is to new).

Also you can pretty much just mix and match preloader/lk because the RPMB is cleared.
[Fire Android Development] k4y0z:
I must have misremembered, thanks for clearing that up.

[MENTION=7806151]ANDROID2468[/MENTION] successfully tried the test-script, to confirm that the exploit works, but haven't seen any tries actually flashing the 5th gen preloader/lk to the 7th gen.
[Fire Android Development] ANDROID2468:
downgrade attempt unsuccessful :( no amazon logo and the backlight turns on for a few seconds and turns off for an endless loop

i reflash my tablet by replacing the files from the 2015 downgrade to the files from the dump

---------- Post added at 05:23 AM ---------- Previous post was at 05:19 AM ----------

I found to increase my chances of getting a good short is to completely drain the tablet of power by unplugging the battery before shorting it to ground
[Fire Android Development] Rortiz2:
Hi all,

I've been fighting with the shield and in the end I managed to make this hole and I found the point. See the images.

PS: As [MENTION=7806151]ANDROID2468[/MENTION] has said, I do not recommend using a knife to do it because it leaves damage to the motherboard. But the tablet works.

Ok, I take a paperclip and I short the point with the shield. I execute handshake.py and connect the tablet, but it stays like this:

PS: Im on windows..

[MENTION=7104332]k4y0z[/MENTION] [MENTION=9667509]xyz`[/MENTION] [MENTION=6680544]bibikalka[/MENTION] any ideas?
[Fire Android Development] k4y0z:
Thanks for the feedback!

I suppose there isn't a bootloader for the 7th gen, that allowed running TWRP?

At least there is a way to Unbrick/Downgrade the 7th gen now as well.

I don't think anyone was successful yet, running the scripts on Windows.

Also you probably want to run main.py not handshake.py
[Fire Android Development] Rortiz2:
I will try to do it in ubuntu.

And no, there's no bootloader that allowed boot TWRP...
[Fire Android Development] ANDROID2468:
Nope no bootloader that let's you boot from TWRP sadly :(
[Fire Android Development] Rortiz2:
Have you recovered your fire?

To me in ubuntu when I connect it and execute bootrom-step it gives me this error

ubuntu@ubuntu:~/Downloads/fire7-2017-test$ ./bootrom-step.sh
Traceback (most recent call last):
File "main.py", line 3, in <module>
from common import Device
File "/home/ubuntu/Downloads/fire7-2017-test/modules/common.py", line 6, in <module>
import serial
ImportError: No module named 'serial'

What I can do [MENTION=7104332]k4y0z[/MENTION] ?
[Fire Android Development] ANDROID2468:
Yes I did and you need to install all of these packages

sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot
[Fire Android Development] Rortiz2:
Ok, now I get this error

[2019-02-03 14:13:29.396334] Waiting for bootrom
[2019-02-03 14:13:45.253596] Found port = /dev/ttyACM0
Traceback (most recent call last):
File "handshake.py", line 19, in <module>
dev.find_device()
File "/home/ubuntu/Downloads/fire7-2017-test/modules/common.py", line 82, in find_device
self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)
File "/usr/local/lib/python2.7/dist-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/local/lib/python2.7/dist-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 19] could not open port /dev/ttyACM0: [Errno 19] No such device: '/dev/ttyACM0'
[Fire Android Development] ANDROID2468:
You probably didn't uninstall modemmanger

Sudo apt Purge modemmanger

And Your short is probably not secured well. Unplug the battery and then short and plug in the battery
[Fire Android Development] Rortiz2:
The same error... What have you used to short the point? I am using a paper clip

---------- Post added at 02:56 PM ---------- Previous post was at 02:36 PM ----------

Ok now it detects the tablet in bootrom mode but it shows this error

root@ubuntu:/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick# ./bootrom-step.sh
[2019-02-03 14:51:48.281593] Waiting for bootrom
[2019-02-03 14:51:54.373761] Found port = /dev/ttyACM0
[2019-02-03 14:51:54.413045] Handshake
[2019-02-03 14:51:54.435524] Disable watchdog
b''
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 57, in main
handshake(dev)
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/handshake.py", line 11, in handshake
dev.write32(0x10007000, 0x22000000)
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 152, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")

Did it happen to you too. How did you fix it?
[Fire Android Development] ANDROID2468:
If you are doing this on fire 7 7 gen it takes a couple of trys to get in to boot rom

Just unplug the battery , unplug the cord , make sure you are making good contact with the pad ,plug in the battery and try again
[Fire Android Development] Rortiz2:
One thing:

If I short the point that worked for you, it shows me this error:

[2019-02-03 14:13:29.396334] Waiting for bootrom
[2019-02-03 14:13:45.253596] Found port = /dev/ttyACM0
Traceback (most recent call last):
File "handshake.py", line 19, in <module>
dev.find_device()
File "/home/ubuntu/Downloads/fire7-2017-test/modules/common.py", line 82, in find_device
self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)
File "/usr/local/lib/python2.7/dist-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/local/lib/python2.7/dist-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 19] could not open port /dev/ttyACM0: [Errno 19] No such device: '/dev/ttyACM0'

But if I short the point VBAT:

It shows me the last error:

root@ubuntu:/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick# ./bootrom-step.sh
[2019-02-03 14:51:48.281593] Waiting for bootrom
[2019-02-03 14:51:54.373761] Found port = /dev/ttyACM0
[2019-02-03 14:51:54.413045] Handshake
[2019-02-03 14:51:54.435524] Disable watchdog
b''
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 57, in main
handshake(dev)
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/handshake.py", line 11, in handshake
dev.write32(0x10007000, 0x22000000)
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 152, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/ubuntu/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
[Fire Android Development] ANDROID2468:
NO DON'T USED VBAT!!! THAT IS NOT GROUND!!
[Fire Android Development] Rortiz2:
Okay, I thought it was weird that sparks were coming out and the tablet was turned off every time I used VBAT.

In the end have you used ubuntu or FWUL? Have you installed it or is it a live usb?

Could it not work for me because I did it from a live usb?
[Fire Android Development] k4y0z:
You can probably leave the battery unplugged, until the handshake is completed.

Oof, don't short VBAT, that could kill your battery and/or device!
[Fire Android Development] Rortiz2:
Lol-- I shorted VBAT about 20 times and it is true that when I turned on the tablet the battery was at 1%.

Good thing it's still working. But what is VBAT for?
[Fire Android Development] ANDROID2468:
Most likely Battery voltage or battery +

---------- Post added at 06:11 PM ---------- Previous post was at 05:51 PM ----------

so for rooting the fir hd 7 7gen, can you flash a patched rooted system.img with this exploit or do you guys think that there is an easier way using this exploit?
[Fire Android Development] k4y0z:
If the 7th gen doesn't use dm-verity that would be an option, although flashing system-image using the boot-rom would take a very long time.
[Fire Android Development] hwmod:
[MENTION=7806151]ANDROID2468[/MENTION] ...

Do you short to ground the CMD pin or the CKE0/CKE1 pin (clock enable) ?

I ask because I can never get the 7th Gen in the idVendor=0e8d, idProduct=0003 state.

Can you confirm that when you do the short you get exactly these lines logged in 'dmesg' ?

Feb 2 18:13:25 localhost kernel: usb 1-9.4: new full-speed USB device number 33 using xhci_hcd
Feb 2 18:13:25 localhost kernel: usb 1-9.4: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
Feb 2 18:13:25 localhost kernel: usb 1-9.4: New USB device strings: Mfr=0, Product=0, SerialNumber=0
Feb 2 18:13:25 localhost kernel: cdc_acm 1-9.4:1.0: ttyACM0: USB ACM device

Thank you for the help !

.:HWMOD:.
[Fire Android Development] Rortiz2:
And flash TWRP? It can be ported from other device that uses mt8127 too.
[Fire Android Development] k4y0z:
You'd need an unlocked bootloader for that.
[Fire Android Development] Rortiz2:
And how has it been installed on the fire hd8 2018?
[Fire Android Development] ANDROID2468:
Yes you can use FWUL but It doesn't come with python serial by default so if you are not familiar installing packages on Manjaro use Ubuntu instead.

This live CD acts like you installed it so yes it can work.

( I'm Probably going to reach out to the developer steadfasterX to add py serial for future users to use for people not familiar with Linux) I used deepin which is distribution of Debian because i used it instead of windows

---------- Post added at 07:06 PM ---------- Previous post was at 06:48 PM ----------

i use this pad

https://imgur.com/a/0vLj8FS

I wrapped a wire on a screw to make it easier to ground and I put a needle on the other end

https://imgur.com/a/TpkRaPj

https://imgur.com/a/ytOLZuO
[Fire Android Development] MontysEvilTwin:
I have an unrooted Fire 7 2015 (running OS 5.6.1.0) and I plan to use the method described in this thread to enable root. Once I have the 5.01 bootloader installed do I need to use adb to root or can I just flash SuperSU from TWRP?

Do I need to change the versions of LK and TZ to work with this later software version? How do I do this? Can I just download suitable LK/ TZ files and replace the ones in the zip file used to carry out the downgrade procedure?
[Fire Android Development] r42001:
---------- Post added at 12:08 AM ---------- Previous post was at 12:06 AM ----------

For my type Windows user, someone please do a full step by step video tutorial with Linux/Ubuntu or any easier platform which will help us to achieve the goal

:(

Thanks in advance!
[Fire Android Development] ANDROID2468:
this is still early days of this exploit and it will get essayer to setup and do as time goes on.

I'm probably going to make a guide soon on how to do it on FWUL for people how don't want to install Linux on their pc
[Fire Android Development] bibikalka:
You may want to start by bricking it via 5.0.1 sideload. Then you have a 5.0.1 preloader that can use the scripts here without opening the tablet. You can boot twrp from fastboot, but cannot save it into recovery partition.
[Fire Android Development] k4y0z:
It uses another exploit for the bootloader (LK) that would need to be ported as well.

You can use either adb or TWRP to gain root there are guides how to do that available.

No you shouldn't need to change anything, just tested with 5.6.3.0, it still boots just fine using these and you keep a way to enter boot-rom without opening and a way to load TWRP (as long as they aren't overwritten during another OTA)
[Fire Android Development] MontysEvilTwin:
Thanks for the reply. What about TZ and LK? Do I need to update both of these to use later software? I am OK with opening the case. My plan was to use the zip file utility from the first post and swap the TZ and LK files with those extracted from a software update (TZ is TZ.img in the update, but TZ.bin in the zip. I presume I just change the extension?) so that the tablet gets flashed with the 5.0.1 bootloader but later versions of LK and TZ. Is this strategy sound?
[Fire Android Development] k4y0z:
Why do you wan't to use a newer LK? Newer versions don't allow booting TWRP.

LK IS the 5.0.1 bootloader.
[Fire Android Development] MontysEvilTwin:
This assumption was based upon this post here. On another Fire 7 (2015) I rooted on 5.3.1.0, then flashed updates with Flashfire, preserving the bootloader. On versions later than 5.4.0.0, I found that if the tablet was powered down it would get stuck at the splash screen on startup. I presumed this was some incompatibility between the software version and bootloader. The quoted post seems to confirm this. I would like to know which files need to be version 5.01 to allow TWRP etc. and which need to be later to allow a later version of software to function correctly.
[Fire Android Development] k4y0z:
For me it boots just fine with the current version.

If you want TWRP you will need LK from this package, if you want to be able to get into boot-rom without opening the device you will need preloader from this package.

If it doesn't work for you, you can still flash other versions after you rooted using TWRP.

I'd suggest just starting with this package and than see what works.
[Fire Android Development] bibikalka:
So, [MENTION=7104332]k4y0z[/MENTION], you can boot the latest FireOS 5.6 with 5.0.1 bootloaders (altogether - preloader, TZ, LK) without any problems? It did not work for me.

A workable solution is to have 5.0.1 preloader, everything else (TZ, LK, Rom) at 5.6 version. Then one can use the exploit here to downgrade TZ, LK when needed to 5.0.1, and boot into TWRP. Keeping the pre-loader at 5.0.1 helps to enable the exploit without opening the case.
[Fire Android Development] k4y0z:
It did boot fine yesterday, I just tried again (without changing anything) and now it bootloops with the amazon-logo.

I don't know why that would be.

So I suppose there is indeed some incompatibility with the current ROM.

Will check out the serial-log when I have time later.

Your suggestion seems like a good solution.
[Fire Android Development] bibikalka:
Yep - I've seen that too! One good boot, and then - Amazon logo reboots. I wonder if there is something in RPMB that's changed. Having a log would be very interesting as well!

Edit: I am now thinking that on its 1st boot the new ROM writes something somewhere, that causes later incompatibility. Perhaps, there is some script one could run after each boot to clear the condition, and restore the ability for 5.0.1 to boot the latest ROMs.
[Fire Android Development] Rortiz2:
[MENTION=7104332]k4y0z[/MENTION] If the computer detects the tablet like this (see image) is it in BootROM?

PS: Ubuntu not detects the fire in BootRom Mode after uninstall modemmanager...
[MENTION=7806151]ANDROID2468[/MENTION] How windows detects your tablet in BootROM Mode? As in my photo (# 0003)?
[Fire Android Development] k4y0z:
No, this isn't bootrom, it clearly says Preloader in the screenshot.
[Fire Android Development] Rortiz2:
Ok. Thanks for the clarification. But I still do not understand why Ubuntu does not detect the Fire after uninstalling modemmanager ... I will try to boot in ubuntu without uninstalling modemmanager.
[Fire Android Development] MontysEvilTwin:
I have run this bootloader downgrade on two tablets now. One was already rooted and is running OS 5.4.0.0 (was previously on 5.3.1.0 bootloaders). The other was unrooted on OS 5.6.1.0. After the downgrade I rooted by flashing SuperSU from TWRP. This went fine and the tablet was still booting OK after several shutdowns: I even disconnected the battery for a while to see what happened and it was OK. I have since flashed OS 5.6.3.0 (5.3.6.4), with 5.0.1 bootloaders and SuperSU (with Flashfire, for convenience) and it is still fine after several shutdowns. I have seen the bootloop before with 5.3.1.0 bootloaders/ OS 5.6.0.0. This seemed to happen when the unit was booted after being switched off for a day or so: on 5.3.1.0 bootloaders/ OS 5.4.0.0 I had no problems. I will see what happens. If I get a bootloop I will boot into TWRP and reflash 5.6.3.0. I will then run the bootloader downgrade again but replace the 5.01 LK and TZ files with 5.6.3.0 ones.

Out of interest, there are two versions of OS 5.01. How do they differ?

A couple of unrelated practical points: when removing the metal cover to access the board, I used a plastic pry tool and found the easiest place to open it was at the bottom left corner by the battery connector (see the photo attached to the first post in this thread). At first when attempting the bootloader downgrade, the process kept getting stuck at handshake. Disconnecting the battery for a few seconds enabled the procedure to work correctly.
[Fire Android Development] diplomatic:
You need to check the "Detalles" tab for a HW ID like USB\VID_0E8D&PID_0003. The #0003 tag in that window is something else. Having the modemmanager thing installed cannot possibly help.
[Fire Android Development] ANDROID2468:
Well it worked for me. You are doing it with the 7 gen right? That one takes a couple of trys to get to boot rom mode. If it gets stuck on wating for boot rom for more than 10 seconds then thats a failed attempt. Make sure you apply the short when the battery is disconnected.

For anyone who doesn't want to install Linux on their PC, I requested to the developer of FWUL(a Linux live CD made for Android) steadfasterX to add pi serial to FWUL and It will be available in the next nightly build!! I will make a link as soon as it's available!

(This is good because it will have everything ready out of the box besides the scripts for your device!! )
[Fire Android Development] k4y0z:
Just did a bit of testing, it seems to load up fine using boot.img from the 5.0.1 but then loops in "system optimization". (tested using "fastboot boot").

Maybe some newer boot-image will load fine?
[Fire Android Development] bibikalka:
Well, try the latest that seemed OK - 5.4.0.1 :

https://xdaforums.com/amazon-fire/general/howto-install-fireos-5-1-1-root-gapps-t3265594

Is there a log when it bootloops with the Amazon logo when the boot.img is the new, and bootloaders are at 5.0.1? One could read UART from the usb port or something.

Interesting that recovery is made by patching boot.img, and it worked for me OK with the older bootloader - that's how I could downgrade from the latest to 5.4.0.1 even when boot.img was no go.
[Fire Android Development] k4y0z:
[MENTION=6680544]bibikalka[/MENTION] [MENTION=7839832]MontysEvilTwin[/MENTION]

Looks like I got it working :D

Keep the 5.0.1 preloader/lk but flash the 5.6.3.0 tz

So I can continue working on exploiting the 5.0.1 LK to get unlock.

Would've sucked having an unlocked BL that won't boot the newest OS :laugh:
[Fire Android Development] bibikalka:
Great!!! So I gather it can boot more than once? ;) And I guess lk is the one that boots twrp, so that's still working in this configuration, right?
[Fire Android Development] k4y0z:
Seems like I was to quick :(.

It did boot multiple times doing reboots/poweroffs.

Just left it off for a while now and tried again -> back to square 1. Just like [MENTION=7839832]MontysEvilTwin[/MENTION] said.

Will do some more testing.

Serial over USB didn't help, since the kernel doesn't output anything. Does anyone know if there was a way to enable uart-logging?

"fastboot oem p2u on" didn't seem to work.

EDIT:

Flashing tz again fixed it for the next boot.

Might have to update both tz-partitions for it to keep working.
[Fire Android Development] bibikalka:
That's very weird. How come it did not brick? If TZ's switched between 1 & 2? If you had 5.0.1 TZ in 2, it should have bricked.
[Fire Android Development] k4y0z:
Yes, weird indeed. Just flashed both tzs, rebooted a few times, powered off and on, everything was fine.

Then left it off for a few minutes and again bootloop...

I wonder if the initramfs does something to the tz that causes this, since i can reflash tz and it will work again until left off for a while.
[Fire Android Development] bibikalka:
Just read both TZs in TWRP, and compare. See what's different, if anything!
[Fire Android Development] k4y0z:
Was just gonna do that, while the device was bootlooping again.

The script failed after handshake, funny enough after that it booted up fine again.

So it seems it's enough to enter boot-rom (without doing anything) to "fix" the problem for the next boot.

Very strange.
[Fire Android Development] interprises:
it works perfectly on my amazon fire 7 5 gen with hard brick !!!! thanks !!
[Fire Android Development] bibikalka:
So it seems like it then has nothing to do with what is in memory, and instead with some weird power states. That's what the actions that "fix" it have in common - some sort of other state, after which things become OK for a bit. This very much feels like a genuine bug somewhere.