yashsingh1/xdaforums huggingface dataset:
[Fire Android Development] Jdub226:
Tried rooting amazon firestick 2nd gen

When I tried rooting my firestick I shorted it and ran the program and this is what happened

jack@jack-Vostro-220-Series:~/Desktop/amonet-tank-v1.2.2/amonet$ sudo ./bootrom-step.sh

[2020-05-05 19:34:06.412028] Waiting for bootrom

[2020-05-05 19:34:15.027798] Found port = /dev/ttyACM0

[2020-05-05 19:34:15.053201] Handshake

[2020-05-05 19:34:15.073855] Disable watchdog

Traceback (most recent call last):

File "main.py", line 158, in <module>

main()

File "main.py", line 76, in main

handshake(dev)

File "/home/jack/Desktop/amonet-tank-v1.2.2/amonet/modules/handshake.py", line 11, in handshake

dev.write32(0x10007000, 0x22000000)

File "/home/jack/Desktop/amonet-tank-v1.2.2/amonet/modules/common.py", line 160, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

File "/home/jack/Desktop/amonet-tank-v1.2.2/amonet/modules/common.py", line 87, in check

raise RuntimeError("ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch

When I retry it nothing comes up but when I plug it in without the short it says the same thing as it does above. Any help would be greatly appreciated!
[Fire Android Development] pr91:
Getting "Serial protocol mismatch" when unlocking Fire Stick

Hi [MENTION=7104332]k4y0z[/MENTION] [MENTION=295159]xyz[/MENTION]

I am trying to unlock my fire stick tv (October 2019 manufactured) tank. When running the bootrom-step.sh script, I am getting below error -

I have already removed modemmanager with 'sudo apt remove modemmanager' command. Still I am getting the same error.

dmesg output -

Please help...
[Fire Android Development] Rortiz2:
Very good but I do not see any point under that metal cover ..
[Fire Android Development] ANDROID2468:
there are some points but they are small. I can't tell from the picture of the 5gen board but what chip is by the test point?
[Fire Android Development] Rortiz2:
I don't know... Maybe [MENTION=7104332]k4y0z[/MENTION] can help us.
[Fire Android Development] k4y0z:
You will not be able to use both USB and serial at the same time on the USB-connector.

You will have to solder to the RX/TX lines (They should be marked)

The points you found are for testing USB and Battery, I'm afraid you will have to remove the shield.

That's a gread idea, I didn't think of that. Should be safe to try, since the tablet is basically unbrickable now :P

Maybe someone is even brave enough to try and flash the 2015 rom to the 2017 fire in the hopes that the preloader will still work, because it's basically the same hardware.

Then we could get into boot-rom there as well without shorting anything.

I suppose that would work :)

Try shorting the pins marked in the attached image of your board to ground one at a time (also check if there are other points close to the FLASH-chip I may have missed)
[Fire Android Development] bibikalka:
I see. The tablet I am playing with is in my household, but not mine, so I have to tread carefully here ;) No soldering, that's for sure! :D

Your script fails for read commands. A few causes I am thinking of. 1) Windows vs Linux (unlikely); 2) Different addresses for 5.1.2 ROM; 3) Slightly different tablet hardware with different addresses. I will wait for a few more reports to see if I am the only one with this weirdness.

I am more motivated to chase Fire HD 2014 now, since I have 2 bricks sitting around.
[Fire Android Development] k4y0z:
Understood ;)

Yes it shouldn't hurt to try on Linux. What device was this again?

The addresses shouldn't matter, since it first reads out the partition-table and then uses the information in there for the rest.

But it seems to already fail trying to read out the partition table :/
[Fire Android Development] ANDROID2468:
I got it!!

[2019-01-30 13:23:57.490518] Waiting for bootrom
[2019-01-30 13:24:11.379230] Found port = /dev/ttyACM0
[2019-01-30 13:24:11.411767] Handshake
[2019-01-30 13:24:11.431799] Disable watchdog
b'AT'
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 57, in main
handshake(dev)
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/handshake.py", line 11, in handshake
dev.write32(0x10007000, 0x22000000)
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 152, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

https://imgur.com/a/0vLj8FS

https://imgur.com/a/92VLl6i

I kind of thought it might have been that pin when I took the shield off.

I think it flashed the bootloader for the 5th gen by looking at the code so I'm not rebooting yet.
[Fire Android Development] Rortiz2:
Have you managed to start in TWRP?
[MENTION=7104332]k4y0z[/MENTION] Are there more methods to restart in bootrom? .. I do not want to **** the tablet trying to remove the shield.
[Fire Android Development] ANDROID2468:
no, the only way to boot to ACM mode is to short that pin to the ground but we can probably make a method for cutting a hole in the shield instead of removing it
[Fire Android Development] Rortiz2:
There have to be more methods. If we brick the tablet could enter bootrom mode.

How do I make the hole? With a knife?:silly:
[Fire Android Development] ANDROID2468:
so the pin is right around here

https://imgur.com/a/sbvP2WI

you can probably cut the shielding where the open parts are using snipers or anything that can cut metal

---------- Post added at 08:45 PM ---------- Previous post was at 08:23 PM ----------

[MENTION=7104332]k4y0z[/MENTION] so did it start flashing the bootloader?

[2019-01-30 13:23:57.490518] Waiting for bootrom
[2019-01-30 13:24:11.379230] Found port = /dev/ttyACM0
[2019-01-30 13:24:11.411767] Handshake
[2019-01-30 13:24:11.431799] Disable watchdog
b'AT'
b'\x00\x01'
Traceback (most recent call last):
File "main.py", line 128, in <module>
main()
File "main.py", line 57, in main
handshake(dev)
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/handshake.py", line 11, in handshake
dev.write32(0x10007000, 0x22000000)
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 152, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/nicholas/Downloads/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

it never asks me to press any key to continue
[Fire Android Development] xyz`:
It's the same problem we had in another thread, you need to uninstall/disable modemmanager.
[Fire Android Development] ANDROID2468:
so did it flash anything? I used this program to test the test points on the hd 7 7gen
[Fire Android Development] Rortiz2:
Its your fire turning on?
[Fire Android Development] xyz`:
No, it'd tell you when it flashes.
[Fire Android Development] ANDROID2468:
I don't want to reboot if I flash a bootloader from a different
[Fire Android Development] Rortiz2:
Have you tried this:

https://xdaforums.com/attachment.php?attachmentid=4695933&d=1548766553

It's for the 2017 gen.
[Fire Android Development] ANDROID2468:
ok good my tablet still boots now we need a script that roots it!;)

---------- Post added at 09:20 PM ---------- Previous post was at 09:17 PM ----------

that would have been useful!
[Fire Android Development] Rortiz2:
Test it and comment the results. If it works, tomorrow I'll do it
[Fire Android Development] k4y0z:
As [MENTION=9667509]xyz`[/MENTION] has already mentioned, you should uninstall modemmanager:

sudo apt remove modemmanager

It did not flash anything.

And if you use fire7-2017-test it will not flash anything and will just stop after printing out the partition-table.

It's just meant for testing if it works in general.

if that works and you have a backup of your preloader/lk/tee you can try the version for the 2015.

Yes, bricking the preloader would force the device into boot-rom.

If you already have root, that would be an option.
[Fire Android Development] zeroepoch:
I'm so far out of context these days because I haven't touched aftv2-tools in years. What is the new development in terms of hacking the mediatek devices?
[Fire Android Development] k4y0z:
TLDR:
[MENTION=9667509]xyz`[/MENTION] has pretty much defeated all current mediatek devices using a boot-rom-exploit. It borrows some code of yours implementing the DA-protocol although talking to the boot-rom directly instead of the preloader.

Check out his github here: https://github.com/xyzz/amonet
[Fire Android Development] ANDROID2468:
I removed modemmanager and rebooted and it doesn't detect the bootrom anymore
[Fire Android Development] k4y0z:
There is no reason uninstalling modemmanager should cause this.

Are you properly shorting the testpoint to ground?
[Fire Android Development] ANDROID2468:
so I'm having an issue where I have shorted to ground for a min or two it won't detect but when I stop holding the wire it detects it. if it's because it's not soldered, I'm going to have to wait until Friday because my soldering iron is at my other house
[Fire Android Development] k4y0z:
NO! You shouldn't solder it!

The short should only be applied until the script tells you to " * * * Remove the short and press Enter * * * ".

Then you MUST remove the short before you continue.

Detecting it takes a few seconds, not longer. If it isn't detected unplug the device, make sure it is powered off and try again.
[Fire Android Development] ANDROID2468:
I'm still having the same issue where it's only detecting after you remove the short. I must have something configured wrong or something. also, I'm wondering you said you can force it in ACM mode by bricking it if you have root. I have a 5th gen with root so what kind of brick will force it to boot into ACM mode? can downgrading cause it to be in ACM mode or blows a resistor causing a hard brick?

LOL I keep reading RCM instead of ACM.. wait for a minute.... this exploit is similar to the switch's exploit! funny isn't it.
[Fire Android Development] k4y0z:
Very strange, since you were able to get a handshake before.

Is your device still booting normally?

Are you sure you are shorting the correct pin?

Also try a different USB port maybe.

Before doing that I'd try if it goes into boot-rom by holding the left volume-button while pluging in.

If that doesn't work, by bricking I mean intentionally overwriting the preloader.

su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro; cat /dev/zero > /dev/block/mmcblk0boot0; echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0"

THIS WILL BRICK YOUR DEVICE UNTIL FIXED USING THE EXPLOIT

Alternatively you can try the method described by [MENTION=6680544]bibikalka[/MENTION] here: https://xdaforums.com/showpost.php?p=78797229&postcount=19

No it cannot cause a hardbrick only a softbrick.

And it's boot-rom mode (ACM is also avaiable in preloader but useless on newer versions)
[Fire Android Development] zeroepoch:
Wow nice work [MENTION=9667509]xyz`[/MENTION]! You took it a lot further than I did. I see you solved some the issues I wasn't sure how to tackle like initializing the eMMC and switching to the boot section so you can modify the preloader. How were you able to get it to run your payload using the sort of initially dysfunctional bootrom? Since you're working at the bootrom level the device is permanently hackable. It's possible that a future device might close the loophole, but pretty much every modern mediatek device is now rootable and almost unbrickable! I'm assuming the shorting trick is to get the device into the bootrom by force by stopping the clock without needing to corrupt the preloader?
[Fire Android Development] k4y0z:
[MENTION=3411776]zeroepoch[/MENTION] I'm not xyz` but since I ported his exploit from mt8163 to mt8127 I can answer some of your questions.

The exploit uses the aes_decrypt function of the crypto_hardware to trick the rom into overwriting the range_check.

This then allows writing to arbitrary memory.

Which it uses to write the binary payload and jump to it.

The rest is done inside of the payload.

You explained the shorting trick pretty accurately yourself ;)
[Fire Android Development] zeroepoch:
I guess the question was for xyz, but you summed it up pretty well. I'd have to look into the details about what is being done after the range check is disabled. Probably won't have time to do that these days, but very excited to see that people are making new tools based off my work. You guys were able to get to the next step (the bootrom) that I was never able to figure out. I'm pretty sure I could unbrick the AFTV2 I had with a botched preloader based on these new tools, but I don't have any of them anymore to try now.
[Fire Android Development] Ulikime:
Hello. I have 5th gen bricked from downgrade. I used the "main.py" file from attached zip and got this

D:\Firefire\fire7-2015-downgrade-unbrick\modules>main.py
[2019-01-31 18:54:39.155852] Waiting for bootrom
[2019-01-31 18:55:15.905954] Found port = COM4
[2019-01-31 18:55:15.917955] Handshake
[2019-01-31 18:55:15.923955] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-01-31 18:55:20.953243] Init crypto engine
[2019-01-31 18:55:21.118252] Disable caches
[2019-01-31 18:55:21.121252] Disable bootrom range checks
[2019-01-31 18:55:21.209257] Load payload from ../brom-payload/build/payload.bin
= 0x45DC bytes
[2019-01-31 18:55:21.220258] Send payload
[2019-01-31 18:55:25.722515] Let's rock
[2019-01-31 18:55:25.727516] Wait for the payload to come online...
[2019-01-31 18:55:26.336551] all good
[2019-01-31 18:55:26.339551] Check GPT
Traceback (most recent call last):
File "D:\Firefire\fire7-2015-downgrade-unbrick\modules\main.py", line 128, in
<module>
main()
File "D:\Firefire\fire7-2015-downgrade-unbrick\modules\main.py", line 64, in m
ain
switch_user(dev)
File "D:\Firefire\fire7-2015-downgrade-unbrick\modules\main.py", line 33, in s
witch_user
block = dev.emmc_read(0)
File "D:\Firefire\fire7-2015-downgrade-unbrick\modules\common.py", line 185, i
n emmc_read
raise RuntimeError("read fail")
RuntimeError: read fail

Can anyone tell me what i did wrong?
[Fire Android Development] jacobas92:
nvm, fixed it. thanks!
[Fire Android Development] ANDROID2468:
I don't think I will be able to work on this today but here's how I'm going to troubleshoot it:

1. I'm going to using FWUL

2.insted of tape I will use hot glue to secure the short

3. Try a different USB cable
[Fire Android Development] bibikalka:
I had a similar issue under Windows. I am installing Ubuntu, and will test the same under Linux to see if Windows was an issue.

Wait, wait, don't go yet! Could you briefly describe what you did with your downgrade bricking/restore, and if it worked as expected??? Inquiring minds need a solid report on this! :D
[Fire Android Development] Rortiz2:
LOL-- I installed a bin and I disconnected the tablet in the middle of the installation, I made wipes and restarted to see if it bricked the preloader and now it does not pass from amazon grey logo.
[Fire Android Development] k4y0z:
Looks like the same issue [MENTION=6680544]bibikalka[/MENTION] had using windows.

As said in OP, the scripts aren't tested on windows, so try using linux.

I don't know FWUL. I'd suggest a ubuntu or debian.

Again, the short should only be applied while pluging in, so no need to secure anything with tape or hot glue.

What bin did you install? Did you sideload the 5.0.1 bin?

then you could try entering boot-rom by holding left volume-button while pluging in.
[Fire Android Development] k4y0z:
Double post...
[Fire Android Development] Rortiz2:
5.4.0...
[Fire Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION], [MENTION=9667509]xyz`[/MENTION]

Well, the fun did not last long ...

Due to the stupid modemmanager under linux my Fire 7 2015 got stuck in the bootrom mode (on the command - serial protocol mismatch). Does not respond to the button pushes, or any commands from the Python. I held the power button for 5 minutes, no go.

Any ideas how to get it unstuck other than opening the case and disconnecting the battery???
[Fire Android Development] xyz`:
You probably just need to comment out the initial handshake from the python script since it's already done; can't tell more without a log.
[Fire Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION], [MENTION=9667509]xyz`[/MENTION]

Tried that, no go. It keeps crashing within the payload routine. Looks like disconnecting the battery is the only path forward. Here is the log when I got the error the 1st time:

# ./bootrom-step.sh [2019-01-31 15:49:44.254359] Waiting for bootrom
[2019-01-31 15:51:32.781871] Found port = /dev/ttyACM0
[2019-01-31 15:51:32.784902] Handshake
[2019-01-31 15:51:32.791203] Disable watchdog
[2019-01-31 15:51:32.799141] Before loadpayload

* * * Remove the short and press Enter * * *

[2019-01-31 15:51:38.658153] Init crypto engine
b'A'
b'\xd4'
Traceback (most recent call last):
File "main.py", line 139, in <module>
main()
File "main.py", line 61, in main
load_payload(dev, "payload.bin")
File "/home/funtik/android/fire7-2015-downgrade-unbrick/modules/load_payload.py", line 114, in load_payload
init(dev)
File "/home/funtik/android/fire7-2015-downgrade-unbrick/modules/load_payload.py", line 9, in init
dev.write32(CRYPTO_BASE + 0x0C0C, 0)
File "/home/funtik/android/fire7-2015-downgrade-unbrick/modules/common.py", line 144, in write32
self.check(self.dev.read(1), b'\xd4') # echo cmd
File "/home/funtik/android/fire7-2015-downgrade-unbrick/modules/common.py", line 89, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
[Fire Android Development] ANDROID2468:
I have been working on this all night with no luck. I have been having issues from "serial protocol mismatch" to not finding ACM untell I remove the short or unplug the USB and plugging it back in. This is with or without modem manager installed.

but I found out that you can short out this pad and boot to ACM mode too

https://imgur.com/a/FdZGWEs

if you short this pin to ground while booting you get this artifact on the screen

https://imgur.com/a/JDuiNtW

also, I should mention I was running it as "sudo" because I don't think I got it to work without it.
[Fire Android Development] k4y0z:
This looks like you still have modemmanager running. Note the A (from AT-command):

b'A'

Not sure what is happening there, since you already got further in the beginning...

Also it's boot-rom mode because ACM != ACM.

The preloader is also recognized as ACM, that is probably what you are getting when removing the short.
[Fire Android Development] ANDROID2468:
[MENTION=8978978]Rortiz2[/MENTION] [MENTION=7104332]k4y0z[/MENTION] I got it working!! on the fire 7 7gen it's really hard to keep a secured short because the pad is so small

I used this pad

https://imgur.com/a/0vLj8FS

here is the log

[2019-02-01 20:03:58.179223] Waiting for bootrom
[2019-02-01 20:05:15.689901] Found port = /dev/ttyACM0
[2019-02-01 20:05:15.690650] Handshake
[2019-02-01 20:05:15.691490] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-02-01 20:05:22.782376] Init crypto engine
[2019-02-01 20:05:22.823340] Disable caches
[2019-02-01 20:05:22.824190] Disable bootrom range checks
[2019-02-01 20:05:22.847928] Load payload from ../brom-payload/build/payload.bin = 0x45DC bytes
[2019-02-01 20:05:22.851660] Send payload
[2019-02-01 20:05:24.012094] Let's rock
[2019-02-01 20:05:24.013301] Wait for the payload to come online...
[2019-02-01 20:05:24.795530] all good
[2019-02-01 20:05:24.795806] Check GPT
[2019-02-01 20:05:25.090778] gpt_parsed = {'KB': (2048, 2048), 'DKB': (4096, 2048), 'EXPDB': (6144, 35584), 'UBOOT': (41728, 2048), 'boot': (43776, 32768), 'recovery': (76544, 32768), 'MISC': (109312, 1024), 'LOGO': (110336, 7168), 'TEE1': (117504, 10240), 'TEE2': (127744, 10240), 'system': (137984, 2457600), 'cache': (2595584, 512000), 'userdata': (3107584, 12162271), '': (0, 1)}
[2019-02-01 20:05:25.090926] Check boot0
[2019-02-01 20:05:25.296769] Check rpmb
[2019-02-01 20:05:25.505941] b'AMZN\x01\x00\x00\x00\x05\x00\x030\x05\x00V4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
[2019-02-01 20:05:25.506158] Reboot
[Fire Android Development] Rortiz2:
Did you installed TWRP??!
[Fire Android Development] k4y0z:
Great! You can use the attached file to get a backup of your preloader/tz/lk.

Then you can give the 2015-Version a try!
[Fire Android Development] tonibm19:
I get Serial Protocol Mismatch Error in my fire7 2015.

Back in the day it came with FireOs 5.1.2.1 (downgradable to 5.1.2 and rootable)

---------- Post added at 02:47 PM ---------- Previous post was at 02:41 PM ----------

Bricked with what version?
[Fire Android Development] Ulikime:
From 5.3.2 to 5.1.1
[Fire Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION], [MENTION=9667509]xyz`[/MENTION]

This was the initial run that made it unresponsive. The subsequent trials did not go anywhere. BUT! I let it sit like that for a couple of days, and today I pushed the power button and it had low power indicator on. I charged it a bit (~3-4 min), and it booted up into FireOS showing the same 58% of power as when it stopped responding! So thankfully, I did not have to open the case.

I seem to have similar issues with 5.1.2 bootloaders. Time will tell if that's fixable, or one needs to brick with 5.0.1 to make things work.
[Fire Android Development] k4y0z:
Use Linux, the scripts currently don't seem to work on Windows.

Are you sure, you can enter boot-rom-mode with 5.1.2, without opening the device?
[Fire Android Development] jacobas92:
Well, mine seemed to get stuck after trying to init crypto engine and wouldn't complete handshake again after that so I had to disconnect the battery and I also disabled modemmanager. After that I tried again and everything worked fine.
[Fire Android Development] bibikalka:
This is the exact same issue that I had!!! Fortunately, my battery drained on its own, so I did not have to open the case.

[MENTION=7104332]k4y0z[/MENTION] / [MENTION=9667509]xyz`[/MENTION] - I think you script needs to explicitly check for the presence of modemmanager in the Linux system, and refuse to run if it's present! There are now 2 reports where Fire 7 does not leave the BoomRom mode, and requires some way to get the battery either disconnected or discharged to a low state (taking a couple of days as in my case). This is best avoided, if possible.

There will be way fewer questions from the new users on why the procedure fails if modemmanager check is implemented in the script.