Database Info

[HELP!] Velocity Cruz T301 Full Brick Recovery

Hi XDA,
so basically i bought a Velocity Cruz T301 recently and followed the known procedures for rooting, flashing ClockworkMod Recovery and custom rom (SJHill Rom v0.3).
before the full brick my device was at ClockworkMod 5 and rooted with SJHill Rom v0.3.
i installed CWM by flashing the zip in stock recovery, then succesfully rooted the device, finally wiped and flashed my custom rom
after major dissapointment in this tablets performance i decided i wanted to get rid of it.
So i downloaded the stock rom, wipe and flashed it onto the tablet...
the tablet turned off when it was finished (i think it was attempting to reboot) and never turned back on again...EVER! :good:
i cant even get to recovery
i tried flashing with adb and fastboot but the device is never even presents itselft to the computer.
i found out that you can boot the device into USB boot mode where you hold the "VOL -" (Volume Down) button and press the reset button and while connected to the computer (windows only) a "JZ4760 USB Boot Device" appears.
i did some googling and also found out that the T301 is based on similar tech to a bunch of tablets and they can all be modified by some software released by Ingenic called USBBootTool.exe
the tool is written in chinese and i cant decypher it all, though i found out how to use it based on its usage for other Ingenic based tablets
1.) you will need to disable driver signature verification (press F8 on boot of windows and toggle the setting, i hate rebooting too but it has to be done)
2.) boot your tablet into USB Boot Mode (hold down Vol - and press Reset button)
3.) install the driver for your device (included in the files below)
4.) with the tablet disconnected you would open the USBBootTool.exe
5.) select your tablet in the options and fill each box with the files needed to flash (files included below)
6.) reconnect the tablet while still in USB Boot Mode and the software will flash your device on detection
everything goes fine for me except when i get to the flashing part in the end.
when USBBootTool detects my tablet, it attempts to flash and gives me a stream of errors and never flashes my device.
i dont know what to do at this point. i have provided direct links to all the software im using and also links to where i got them.
any help would be appreciated, thank you to the XDA community in advance
>------------------- DOWNLOADS ------------------------<
USBBootTool.exe / Tablet Drivers (4725 / 4725B / 4740 / 4750 / 4755 / 4760 / 4770)
http://dl.dropbox.com/u/79196608/burn_tools_3.0.16.rar
obtained from - http://forum.xda-developers.com/showthread.php?t=1720621
Velocity Cruz T301 Update.zip (contains the system.img / data.img / mbr-xboot.bin files)
http://www.cruztablet.com/T301update.zip
obtained from - http://www.cruztablet.com/Article_861.php
SJHill Rom v0.3
http://www.androidfilehost.com/?fid=9390362690511176486
obtained from - http://www.slatedroid.com/topic/27583-rom-t301-sjhill-rom-17-feb-2012-download-link-updated/
ClockworkMod 5
http://files.androtab.info/ingenic/cwm/20120514/T301-recovery-signed.zip
obtained from - http://androtab.info/mips/ingenic/clockworkmod/

I have the same situation. I have gone through every menu in the USB Boot tool and to no avail am I able to recover my T100.

gmick is redoing the software because the coding is set up wrong. Once he gets that figured out there should be a fool proof unbricking method that we can follow. He is posting information over on Slate Droid if you want to take a look.

feyerbrand said:
gmick is redoing the software because the coding is set up wrong. Once he gets that figured out there should be a fool proof unbricking method that we can follow. He is posting information over on Slate Droid if you want to take a look.
Click to expand...
Click to collapse
ok post the link to the thread, and ill add it to the first post as a solution if its found to be a working one

JustSayTech said:
ok post the link to the thread, and ill add it to the first post as a solution if its found to be a working one
Click to expand...
Click to collapse
*Cross Post from SlateDroid* (but I can't post the link because XDA won't allow it)
I found out why the USB boot isn't working. Well, more appropriately I know where it fails but not exactly "why".
The USB Boot tool works like this:
1) Send x00 command (Get CPU Info)
2) Device responds with "JZ4760V1"
3) Host sends two binaries, stage1 and stage2. Stage 1 sets up memory stuff, and Stage 2 sets up USB flashing functions.
4) Host checks that the binaries executed by issuing another x00 command (Which serves as an "Are you still there?" function)
5) If the response is good, the host will flash the images, if the response is bad, it will abort.
Our devices are failing at step 4. The linux usb boot tools (xburst-tools) fail in an identical fashion.
I know that the first stage binary transfers and executes fine because if it didn't the device would be limited to 16k. The second stage is 120K and is transferred successfully. Once the second stage "execute" command is sent, the device crashes.
The second stage is also unique to the CPU type. I've used all of the binaries for JZ4760 I could find on the net and when that failed I cross compiled my own binary from source and it still crashed.
At this point I highly doubt I'll ever be able to fix it, and this completely explains why no one could get any usb recovery tool to work while others using similar devices could. I guess our board is modified just enough for ingenic's stock binaries to fail. Without knowing what's changed (getting Velocity Micro's source) we're SOL.
I can open it up again and solder on the serial header but I'm betting it's going to give me some generic "couldn't execute" message that isn't going to help me. I'll probably do this anyway though because I've come this far so what's the loss.

wow, i learned alot from that post, seems like writing a usbboottool-like application that can send the commands but also log and possibly bypass security checks etc but that def would take sometime. thank you for your insight, seems youve come the closest to cracking the case, actually you found the fault, hopefully your methods can eventually bring about a fix

JZ 4770
gmick said:
*Cross Post from SlateDroid* (but I can't post the link because XDA won't allow it)
I found out why the USB boot isn't working. Well, more appropriately I know where it fails but not exactly "why".
The USB Boot tool works like this:
1) Send x00 command (Get CPU Info)
2) Device responds with "JZ4760V1"
3) Host sends two binaries, stage1 and stage2. Stage 1 sets up memory stuff, and Stage 2 sets up USB flashing functions.
4) Host checks that the binaries executed by issuing another x00 command (Which serves as an "Are you still there?" function)
5) If the response is good, the host will flash the images, if the response is bad, it will abort.
Our devices are failing at step 4. The linux usb boot tools (xburst-tools) fail in an identical fashion.
I know that the first stage binary transfers and executes fine because if it didn't the device would be limited to 16k. The second stage is 120K and is transferred successfully. Once the second stage "execute" command is sent, the device crashes.
The second stage is also unique to the CPU type. I've used all of the binaries for JZ4760 I could find on the net and when that failed I cross compiled my own binary from source and it still crashed.
At this point I highly doubt I'll ever be able to fix it, and this completely explains why no one could get any usb recovery tool to work while others using similar devices could. I guess our board is modified just enough for ingenic's stock binaries to fail. Without knowing what's changed (getting Velocity Micro's source) we're SOL.
I can open it up again and solder on the serial header but I'm betting it's going to give me some generic "couldn't execute" message that isn't going to help me. I'll probably do this anyway though because I've come this far so what's the loss.
Click to expand...
Click to collapse
for my JZ4770 Earlier USB tool was flashing .img without any problem but for now it is saying "load cfg failed". "API downlaod failed' like dialogues and doesnt flash anything. Any idea? Thanks in advance!!

First restart your computer (actually restart it) then redownload the USB boot tool and save it in a completely new directory and use a different USB port
Sent from my Pokeball

Yes, I did
JustSayTech said:
First restart your computer (actually restart it) then redownload the USB boot tool and save it in a completely new directory and use a different USB port
Sent from my Pokeball
Click to expand...
Click to collapse
Yes, I tried with this suggestion. Rather I reinstalled xp and the tried again. But the dialogues are same. The history is like this. Was having ICS on JZ 4770. Formatted with usb tool and put JB updates. It was not sensing touch so reflashed another JB updates. Now the tab boots, it reaches to boot logo for around 12 seconds and restarts in stock recovery. While it is in booting stage it get detected by windows and adb also. In stock recovery mode it get detected by windows and in turn by adb also. If I tried to install updates through SD card it shows it had installed and reboots after completion. But again the same way it goes to boot logo and then back to stock JB recovery. It also boots in ingenic boot device mode and gets detected by USB burn tools. But when try to flash any of the ROM it gives the same dialogues "check cfg failed" "api download failed" "boot. fw failed" and cant flash anything.
Is there any tool which can be flashed or a script which can be used from SD card for completely formatting flash memory so that USB burn tool can flash required ROM?

can you flash the stock rom in recovery?

Managed using USB BOOT TOOL for ingenic JZ 4770 board in English
JustSayTech said:
can you flash the stock rom in recovery?
Click to expand...
Click to collapse
thanks man but I managed to boot the device. I used following USB BOOT TOOL for ingenic 4770 boards. The goodness with this tool, this is completely in English. You will know what you are doing. Even after opening the main window of the tool you can right click and then get another options(yes again in English). My problem with this device was bad blocks at 1024. In the options there is chance to force erase whole the nand partitions which I used and erased all the partitions thereby made all the partions available for flashing and readable by the tool. Then from File option selected stock rom files and flashed them. While flashing selected JZ4770 iNanad.ini file in manual configuration. This tool has really helped me to come out of the issue and will be useful for guys using JZ 4770 board.
http://www.4shared.com/rar/m1BUV5r2/USBBurnTool_20120401_for_relea.html

Got USBBootTool.exe kind of working.
1. Download the following file from Ingenic.
ftp * ingenic * cn/3sw/01linux/tmp/jz4770-20110610.rar
2. Download Applocale from Microsoft.
www * microsoft * com/en-us/download/details.aspx?id=13209
3. Extract the jz4770-20110610.rar and find the folder. (Using 7zip should keep the UTF encoding in Chinese)
20110610\04burn\20110524_4770_Programmer
4. Copy the folder 20110524_4770_Programmer to location you want to use it in.
5. Install Microsoft Applocale (Just in case, I don't think it is required)
Now Start Applocale and create a shortcut to USBbootTool.exe inside 20110524_4770_Programmer
中文(简体) is simplified Chinese option and should let you view the GUI correctly.
6. Now with the Applocale Shortcut created for USBbootTool.exe you can start the application with correct fonts.
Now this is where is breaks down.
TABLET-8 NAND FINAL BSP(S3 TEST) will allow you to read from it and write to it, but the CFG is off.
\tool_cfg\tablet-8-nand-final.ini is the configuration for it.
DO NOT CONNECT THE DEVICE WITH ANY OPTIONS CHECKED OR LOAD ANY FILES.
See Attached Images.
Next to the Read button is some Boot Option menu. I am not fulling aware of what this does.
What I need is a someone to help me fix/correct the ini/cfg files in
\20110524_4770_Programmer\tool_cfg\.ini
\20110524_4770_Programmer\4760\
to correctly match the files of the NAND.
Also if anyone has a copy (dd to img) or (cat to img) of the block devices.
That would help a ton.
# cat /proc/partitions
# cat /proc/mtd
I would also love another T10x Tablet for cheap.
I want to start building things like new bootloader, kernel, system image,
performance libraries to take full use of the Ingenic JZ4760 (www * ingenic * cn/product.aspx?CID=11)
I also bring Christmas gifts
2 APKS. You can place them in /system/app or /data/app.
Google Play will crash now and again, but it will load and work. (Vending.apk)
Secondly I bring the gift of performance increase, just by a slight bit.
edit the line of the heapsize in /system/build.prop dalvik.vm.heapsize=96m
Remember to make sure the permissions are set back to 666 or 644.
Original Vending.Apk before updates came from here: (Incase you are paranoid)
code * google * com/p/ics-nexus-s-4g/source/browse/trunk/system/app/Vending.apk?spec=svn20&r=18
ics-nexus-s-4g * googlecode * com/svn-history/r18/trunk/system/app/Vending.apk
To prevent spam on the XDA forums, ALL new users prevented from posting outside links in their messages. After approximately 10 posts, you will be able to post outside links. Thank you for
Click to expand...
Click to collapse
Stupid. how do you expect real people to help post Tech Docs? That is bad Moderating and Administrating.
Make sure to replace the Asterisk's with spaces to normal dots.

Requesting Block Images.
Does anyone have a copy of it they can send me for a T10x?

block images......
IceGryphon said:
Does anyone have a copy of it they can send me for a T10x?
Click to expand...
Click to collapse
Which block images do you want?
...also is there a way to rip the stock images off the jz4760 in the t301.
Such as:
Can i usethe ingenic uboot tool?
Anybody find the jtag pins?
Is the 4 pin conn next 2 the batt for serial?
.......i guess ill try to take a look this weekend
Ics would be really nice, but probably slower than stock..... especially with the limited ram
I unpacked the stock rom. I also unpacked an ics rom for a jz4770, and repo sync'd the aosp and mips 3.0.8 android kernel.
I'm still trying to figure out specs for the processor though. I know that its mips32 - el- fp- r1, but i cannot figur out the dsp version ... if it has one?

Error in erasing nand
nanachitang420 said:
thanks man but I managed to boot the device. I used following USB BOOT TOOL for ingenic 4770 boards. The goodness with this tool, this is completely in English. You will know what you are doing. Even after opening the main window of the tool you can right click and then get another options(yes again in English). My problem with this device was bad blocks at 1024. In the options there is chance to force erase whole the nand partitions which I used and erased all the partitions thereby made all the partions available for flashing and readable by the tool. Then from File option selected stock rom files and flashed them. While flashing selected JZ4770 iNanad.ini file in manual configuration. This tool has really helped me to come out of the issue and will be useful for guys using JZ 4770 board.
http://www.4shared.com/rar/m1BUV5r2/USBBurnTool_20120401_for_relea.html
Click to expand...
Click to collapse
I used english ingenic tool to erase bad blocks but m nt able erase bad blocks live suit is giving eror id=0x4848

P6000 General Thread - Bug fixes, FAQ, general info.

Elephone P6000
Phone reviews by @s7yler
Stock ROM (SPFlash):
from elephone servers
from needrom.com
Custom Recovery --- Touch RecoveryCourtesy of @bigrammy, @carliv and @Santhosh M​Various
Latin Paradise(拉丁乐园)(Elephone) on Baidu
P6000 Folder
OTA Updates - direct from elephone
--- both are 404 now ---
12282014 to 31012015
01092015 to 31012015
Other threads and useful sites:
http://forum.xda-developers.com/android/general/elephone-p6000-mtk6732-64-bit-4g-5-2g-t2957425
SP Flash Thread - P6000
4pda thread - translated top post is fairly concise
Check your Mobile Network/Carrier
Please use the other threads/Q&A and the thanks button - to minimise duplicate posts reporting the same issues.
I'd like this thread to be used mainly for bug fixes, tips and tricks. If someone reports a similar problem/fix/bug click the thanks button if you'd like to agree.

Bugs
Android 5.0 'Official' Release
Update Official (V3.3)
Some modifications: #186
Android 5.0 Beta
12-02-15 ROM available on needrom.com
Hardware buttons don't work
Battery doesn't draw charge
Ril related memory leak
No ADB​
Android 4.4.4 (V8.4)
Notification light - not breathing when charging
OTG only works with self-powered devices
Battery seems to jump from 100% to ~90% Soon after removing from charger
Screen jumps several pixels (30) on slow scrolling. ​Android 4.4.4 (V8.3) bugs not present in V8.4Data encryption results in a stalled boot/softbrick​
FAQ/Fixes
1. Notification light is not working in V8.4 as it was in V8.3
Try Light Manager from the play store or gravity box (xposed module)
2. Does OTG work?
It seems to work only with a powered USB hub - I've only been able to check a powered external hard-drive which wouldn't connect
3. How do you fix the screen jump issue?
There are several options here:
From @the1024 / zOrgent we have two options 1. Using a chinese tool - and 2. Using a .bat
From elephone we have TpUpgrade.apk (appears to only work with V8.4)
From lidmiloff we have P6000 Bugfixer.apk​
4. How do you restore a Stock ROM?
Download a SPFlash ROM from #1; you will need to install MediaTek USB VCOM drivers (if they aren't automatically installed); On the download page select the scatter from the ROM folder; and the page should populate with the various .img's and .bins; if it doesn't then double click on the entry and locate it manually (also useful if you wan to change boot/recovery with SPFlash). Hit download; remove the battery from the phone and connect it to the PC (you can connect the battery again). The connection will be fairly instantaneous (there may be a driver install the first time it's connected); if it doesn't connect then unplug/replug.
More details from @bigrammy found here
5. Battery jump from 100% to 90%.
Haven't really noticed this too much - download an app like Battery Monitor Widget, add widget (Battery monitor widget gauge => Content => Central value => Battery => Battery Current (mA)) which will show you the battery drain/draw and charge until the draw is close to; if not +0mA
6. Is there any touch recovery?
As of now (pre-5.0) there is no touch recovery. The recovery thread on #1 contains various recoveries - most of which boot but none have touch - this seems to be a kernel issue.
Touch recoveries can be found here. These are built for KK.
7. What about Custom ROMs?
Potential Port devices (MT6732/MT6752) and their ROMS
As there are no official sources released; for MT6732 or P6000 then custom ROMs are a no-go for now. Porting ROMs from other devices running on MT6732 (and MT6752); i.e. Ulefone Be Pro for example is theoretically possible but there doesn't appear to be any custom ROMs on these chips that offer anything different than the stock/AOSP(almost) that we have already. As other devices get released possibly running MIUI or ColorOS then Custom ROMs may be possible.
FlymeOS
8. How do you take a screenshot?
Natively pressing Volume down and power together for 1 second will take a screenshot - it may take a while to get used to - if volume mixer appears then they were too slow and need to wait for it to disappear. Over adb/terminal you can make use of screencap and screen record
9. How do you back up EVERYTHING(except preloader)?
In SPFlash Tools => readback from 0x00 to 0x3a3e000000
This is a fairly quick way to make sure you have a copy of all the partitions on the device; it will create a 14GB+ file containing all the partitions. You will need to break this block up (manually for the moment) into it's constituent parts if you want to use it to restore - using a Hex-editor (HxD for example) and a copy of the matching /proc/partinfo file and/or scatter.txt
The essential partitions to backup for a fully running device are - boot, (recovery), system, (cache) and data which can all be backed up using a custom recovery. The one other partition needed is nvram - this can be backed up with SPFlash (look at /proc/partinfo) or with dd commands. The nvram partition will only be needed to be restored if you Format All with SPFlash. If you don't have a backup you can restore/recreate the IMEI files that it contains.
10. How do you backup/restore IMEI?
Several options here:
1. MTKDroid
2. Backup NVFLASH partition via readback in SPFlash Tools (look at the scatter.txt) to restore you need to modify the scatter.txt to give the nvflash a file_name: and change it from is_Download: false to is_Download: true
3. From elephone there's a IMEI coding tool
4. Keep a copy of the /data/nvram folder
5. Create new imei files to add to nvram folder/partition with imei.exe
6. Chamelephon app from the play store
7. MTK Engineering Mode
11. Adb access with 5.0 Beta ROMs
1. Use KingoRoot
2. Add the Mediatek subsystem id (0x0e8d) to adb_usb.ini
12. Any Stock Camera fixes?
For KK-4.4.4 from @z0rgent at 4pda

FAQ/Fixes Continued
Android 5.0 V1; V1.1; V2.2 (V3.2); V3.3 #125 #186These versions seem to have gapps preinstalled and are prerooted - for everything else have a look at the 5.0 Betas section below
5.0 Modifications #186​Android 5.0 Beta1 Beta2 Beta3
To gain adb access
Linux/Windows - need to add the Mediatek subsystem id (0x0e8d) to adb_usb.ini
Linux: ~/.android/adb_usb.ini
Windows: C:/Users/${Username}/.android/adb_usb.ini​KingoRoot It won't root the device however - I believe this is due to it installing a 32bit su binary rather than a 64bit one.
Root
For root install SuperSU v2.11+
Confirmation
Custom Recovery
Recovery from @carliv - from #1; modded to boot on L (basically just the cmdline changed / initrd.gz from stock L recovery replaced with carliv's built CWM).
Carliv Port by hanuma50 on 4pda (hopefully all his work and not partially stolen to take credit)
This recovery seems to only work when the Lollipop Beta ROM is installed.
Gapps
64-bit gapps made for the Nexus 9.
My phone seems to be running a little hot after installing the gapps - but that might just all the cores kicking in.
Mirrored copy of the version I'm using.
(OP's thread has updated them and removed the previous version)
Busybox
64-bit busybox installation
Removing encrypted data (temporarily)
In recovery while in an adb shell: /sbin/make_ext4fs /dev/block/mmcblk0p19
This will allow you to restore backed up data - but it will get re-encrypted on first boot, I'll take a look at removing encryption when I get the chance - should be either secro partition or something in the boot.img​
Android 5.0 Beta Breakdown
Screenshots to come later.
Entering LKVOL UP and POWER (this no longer enters recovery)
From lk menu: entering fastboot mode and normal boot works.
Entering recovery (stock) doesn't work and I can't tell if the other normal boot options do anything different​Charging batteryFlashing a custom recovery should allow you some way to charge the battery​I haven't yet been able to install/boot any recovery. Flashing lk and boot from 4.4.4 (I took them from the 48MB OTA) seems to let you charge when powered off. Confirmed​RIL Memory leakThere seems to be a RIL/Sim related memory leak leading to random reboots - for testing purposes disable the sim card(s) or enter airplane mode
I could be wrong about the RIL and the ROM just needed time to settle; all I can say is I had reboots until I switched to airplane mode​IMEIIMEI was lost but that would be due to formatted flash memory (wiped nvflash partition) - it's a good idea to keep a backup regardless.​Antutu Scores64-bit Antutu Scores are around 28000
32-bit Scores are around 27000
Data-encrypted 4.4.4 Antutu scores are also around 28000​SensorsBacklight, sound ... can't be changed
Brightness can be fixed in MTK Engineering Mode #5​ROM is not rooted; does not have gapps installed and data is encrypted.
TL;DR The issues with the 5.0 Beta ROM, are primarily not ROM related but kernel related, they have bumped the kernel version up to 3.10.61+, and the issues that need correcting are the various kernel modules (power,sensors).
Android L kernel config

Annotated /system/build.prop
Stripped top of build.prop (build properties) due to size
# begin mediatek build properties
ro.mediatek.version.release=ALPS.KK2.MP13.V1.27
ro.mediatek.platform=MT6752
ro.mediatek.chip_ver=S01
ro.mediatek.version.branch=KK2.MP13
ro.mediatek.version.sdk=3
# end mediatek build properties
#
# from out/target/product/k01q_e/obj/CUSTGEN/config/system.prop
#
#
# system.prop for generic sdk
#
rild.libpath=/system/lib/mtk-ril.so
rild.libargs=-d /dev/ttyC0
# MTK, Infinity, 20090720 {
wifi.interface=wlan0
# MTK, Infinity, 20090720 }
# MTK, mtk03034, 20101210 {
ro.mediatek.wlan.wsc=1
# MTK, mtk03034 20101210}
# MTK, mtk03034, 20110318 {
ro.mediatek.wlan.p2p=1
# MTK, mtk03034 20110318}
# MTK, mtk03034, 20101213 {
mediatek.wlan.ctia=0
# MTK, mtk03034 20101213}
#
wifi.tethering.interface=ap0
#
ro.opengles.version=196608
wifi.direct.interface=p2p0
# dalvik.vm.heapgrowthlimit=256m
# dalvik.vm.heapsize=512m
# USB MTP WHQL
ro.sys.usb.mtp.whql.enable=0
# Power off opt in IPO
sys.ipo.pwrdncap=2
# Switching Menu of Mass storage and MTP
ro.sys.usb.storage.type=mtp #### adding ,massstorage to this gives an additional USB option but it apears to still mount as a media device (MTP) adding ,mass_storage will let you mount the microsd card
# USB BICR function
ro.sys.usb.bicr=no #### changing to yes will allow you to mount /system/mobile_toolkit/iAmCdRom.iso to PC via USB ####
# USB Charge only function
ro.sys.usb.charging.only=yes
# audio
ro.camera.sound.forced=0
ro.audio.silent=0
ro.zygote.preload.enable=0
#
# ADDITIONAL_BUILD_PROPERTIES
#
persist.gemini.sim_num=2
ro.gemini.smart_sim_switch=false
ro.gemini.smart_3g_switch=0
ro.gemini.sim_switch_policy=1
ril.specific.sm_cause=0
bgw.current3gband=0
ril.external.md=0
ro.btstack=blueangel
ro.sf.hwrotation=0
ril.current.share_modem=2
curlockscreen=1
ro.mediatek.gemini_support=true
persist.radio.fd.counter=15
persist.radio.fd.off.counter=5
persist.radio.fd.r8.counter=15
persist.radio.fd.off.r8.counter=5
persist.radio.fd.on.only.r8.network=0
drm.service.enabled=true
fmradio.driver.enable=1
ril.first.md=1
ril.flightmode.poweroffMD=1
ril.telephony.mode=0
dalvik.vm.mtk-stack-trace-file=/data/anr/mtk_traces.txt
persist.mtk.anr.mechanism=1
mediatek.wlan.chip=CONSYS_MT6752
mediatek.wlan.module.postfix=_consys_mt6752
ril.radiooff.poweroffMD=0
ro.config.notification_sound=Proxima.ogg
ro.config.alarm_alert=Alarm_Classic.ogg
ro.config.ringtone=Backroad.ogg
persist.mtk.wcn.combo.chipid=-1
ter.service.enable=0
mediatek.extmd.usbport=0
ro.lte.dc.support=0
ril.active.md=0
ro.setupwizard.mode=OPTIONAL
ro.com.google.gmsversion=4.4.4
ro.com.google.clientidbase=alps-k01q_e-{country}
ro.com.google.clientidbase.ms=alps-k01q_e-{country}
ro.com.google.clientidbase.yt=alps-k01q_e-{country}
ro.com.google.clientidbase.am=alps-k01q_e-{country}
ro.com.google.clientidbase.gmm=alps-k01q_e-{country}
wfd.dummy.enable=1
persist.sys.dalvik.vm.lib=libdvm.so #### Charnging this to libart.so appears to have no effect ####
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
# begin fota properties
ro.fota.platform=MTK6732_KK
ro.fota.type=phone
ro.fota.oem=new-bund6732_KK
ro.fota.device=k01q_e
ro.fota.version=eng.jenkins.1422677980
# end fota properties
ro.sf.lcd_density=190
#### Stock value I believe is 320; changing to >190 switches the device to phablet mode; this spoofs the screen size to be 7.73 inches (CPU-Z) enabling tablet apps in the apps store after clearing play store app data ####
qemu.hw.mainkeys=0
#### This enables softkeys ####
Annotated /custom/customprop/custom.prop
ro.product.model=Elephone P6000
ro.product.name=Elephone P6000
ro.product.brand=elephone
ro.product.manufacturer=elephone
ro.bt.name=P6000
ro.wifi.name=P6000
ro.notification.breath=yes #### This seems to not be working with V8.4 ####
ro.build.display.id=ALPS.KK2.MP13.V1.27
ro.internal.build.version=K01Q-E.ELEPHONE.vR83.E4.150109
ro.custom.build.version=Elephone_P6000_V8.4_20150109
ro.fota.device=Elephone_P6000
ro.fota.version=Elephone_P6000_V8.4_20150109202612

MTK Engineering Mode
*#*#3646633#*#* (*#*#ENGMODE#*#*)
What can be done in engineering mode
General non-specific guide
Backlight
Hardware ===> LCM ===> LCM Cycle ===> add a value between 5 and 55 ===> Hit Set.
(On L at least this value will jump to value in the millions/billions; unsure if this has any implications)
Audio
http://forum.xda-developers.com/showthread.php?t=2746861
http://forum.xda-developers.com/showthread.php?t=2248396
GPS
http://www.cnx-software.com/2013/11...ps-lock-on-mediatek-mt65xx-based-smartphones/
Orientation / GSensor
Hardware Testing ===> Sensor ===> Sensor Calibration ===> GSensor Calibration ===> Do Calibration (20% tolerance)
IMEI Restore
Command should be AT +...
Xposed Installer (or WSM Tools)
I've had no problems with any xposed modules.
You will get a warning regarding AliyunOS -
this issue is reported due to the presence of /system/framework/*.jar.jex files.
You can ignore/move/remove these *.jar.jex files without it causing any (noticable) issue.
I haven't decompiled any apps so I don't know if. jex files are used elsewhere within the ROM (in place of .jar),
so can't comment on whether the stock ROM is indeed an Aliyun OS.
I would advise backing them up so that any future OTA can complete 100%.
Any issues identified with xposed modules will be reported here.​

Very Helpful and concise
Nice one bro :good:
Subscribed

Ludmiloff's Screen fix apk version 1.2 final now works with 8.3 also. Just wanted to give you a quick update so you edit your post HypoTurtle

greekfragma said:
Ludmiloff's Screen fix apk version 1.2 final now works with 8.3 also. Just wanted to give you a quick update so you edit your post HypoTurtle
Click to expand...
Click to collapse
Still doesn't work for me on 8.3.

Nice one, i get my phone in a couple of weeks.

Hello
and Thanks for all your work ! :victory:
Can you add how save and restore imei ?

xenonism said:
Still doesn't work for me on 8.3.
Click to expand...
Click to collapse
Sorry to hear that man. Can you give more details? Are the driver version letters shown normal or "?"

greekfragma said:
Sorry to hear that man. Can you give more details? Are the driver version letters shown normal or "?"
Click to expand...
Click to collapse
Well, I tried the first methods which came out and they wouldn't work. Then I upgraded to V8.4, at the same time the Elephone APK came out, so I used it and it set the thresholds to 3 and 4. Then I decided to go back to V8.3 and since then, no method managed to make a persistent change to the values (I tried ludmiloff's works, Elephone's APK modified by me, which worked for others, and the old Russian method). At best, I get the new vaules in the "init config" portion of the configuration, never in the "real config" portion, and they are always gone after a reboot. File permissions of /proc/gt9xx_config are 660, owned by root. The config version letter is currently F and ludmiloff's app reads it correctly.
I guess that's all the info I can share.

xenonism said:
Well, I tried the first methods which came out and they wouldn't work. Then I upgraded to V8.4, at the same time the Elephone APK came out, so I used it and it set the thresholds to 3 and 4. Then I decided to go back to V8.3 and since then, no method managed to make a persistent change to the values (I tried ludmiloff's works, Elephone's APK modified by me, which worked for others, and the old Russian method). At best, I get the new vaules in the "init config" portion of the configuration, never in the "real config" portion, and they are always gone after a reboot. File permissions of /proc/gt9xx_config are 660, owned by root. The config version letter is currently F and ludmiloff's app reads it correctly.
I guess that's all the info I can share.
Click to expand...
Click to collapse
Well, time to get in here, I guess...
@xenonism, the best I could tell you is to start over with clean ROM, preferably the one listed at 4pda.ru thread about elephone P6000 (in the head section) and try again. There must be something messed up in your device. I really believe the config is independent of ROM. The secret is very simple, you must start with new version letter and at offset 184 set correct checksum. How to calculate checksum:
//cal checksum
byte checksum;
for(i=0; i<chip_cfg_len; i++) {
checksum += file_config;
}
file_config[chip_cfg_len] = (~checksum) + 1;
Where chip_cfg_len = 184
Then write the checksum and write 0x01 at offset 185.
I believe you already know where are the theshsold values - at offset 16 and 17.
If you wish, I could send you my hand crafted config, which I was an inspiration for my apk.
Good luck

Err... it looks like I am unable to install a clean ROM, or even to update the existing one. I guess I'll have to sort this issue out before I join back the discusssion.
I have a fully functionalV8.3_20141228 ROM running and carliv's CWM from the 7th of February installed. The phone offers me the OTA update and it downloads a ~23 MB update. When I agree to install it, the phone reboots to CWM and the update fails with the following messages:
E:Invalid command argument
Finding update package...
E:unknown volume for path [/storage/sdcard0/adupsfota/update.zip]
E:Can't mount /storage/sdcard0/adupsfota/update.zip
Installation aborted.
Click to expand...
Click to collapse
If I try to install the same update with ROM Manager, it also fails in CWM with the following message:
-- Installing: [FILENAME SHOWS HERE]
Finding update package...
Opening update package...
Installing update...
Installation aborted.
Click to expand...
Click to collapse
But when I reboot the phone, I get the "Android is upgrading...] Screen, saying it's optimizing 124 apps. I believe no actual update takes place, though.
And here's what I'd consider the relevant portion of the recovery.log file:
Preparing to install ROM...
about to run program [/cache/dowipedalvikcache.sh] with 1 args
mount: mounting /dev/block/platform/mtk-msdc.0/by-name/userdata on /data failed: Device or resource busy
mount: mounting /dev/block/platform/mtk-msdc.0/by-name/cache on /cache failed: Device or resource busy
mount: can't find /sd-ext in /etc/fstab
umount: can't umount /sd-ext: Invalid argument
run_program: child exited with status 1
about to run program [/sbin/chmod] with 3 args
about to run program [/tmp/recovery/11-rommanager.sh] with 2 args
mount: mounting /dev/block/platform/mtk-msdc.0/by-name/system on /system failed: Device or resource busy
about to run program [/sbin/umount] with 2 args
Click to expand...
Click to collapse
If I try to install the full 20150109 ROM with ROM Manager, it also fails in CWM, without displaying any meaningful messages in recovery. I also get the "Android is upgrading screen here".
The errors in recovery.log are the same as above.
I guess I could install the full ROM via SP Flash Tool, right?
Also... I have a couple of questions to ask, can I feel free to do it in this thread? Some might be trivial for most.

ludmiloff said:
Well, time to get in here, I guess...
@xenonism, the best I could tell you is to start over with clean ROM, preferably the one listed at 4pda.ru thread about elephone P6000 (in the head section) and try again.
Click to expand...
Click to collapse
@ludmiloff does your app require busybox to be installed?
Downloading from 4pda.ru is a bit hit and miss for me, any chance someone can post the CWMLollipop.img...
Is there any difference in the 4pda.ru ROMs and the ones on needrom.com?
Also found a fix for the backlight in Android L - in engineering mode - not sure if it will do anything useful in 4.4.4 (lower the minimum brightness?).
MTK Engineering Mode => Hardware => LCM => LCM Cycle => value between 5 and 55.
xenonism said:
Err... it looks like I am unable to install a clean ROM, or even to update the existing one. I guess I'll have to sort this issue out before I join back the discusssion.
Click to expand...
Click to collapse
Feel free to elaborate. Edit your previous post with your current setup / what you've tried - so we can turn it into a troubleshooting post.

HypoTurtle said:
Feel free to elaborate. Edit your previous post with your current setup / what you've tried - so we can turn it into a troubleshooting post.
Click to expand...
Click to collapse
Ok, thanks a lot. I will edit my post right now. The thing is... I haven't used an Android phone in 4 years and I did a lot of my tinkering on my P6000 while working or late at night so.. things got a bit messy.

@HypoTurtle,
My app does not require busybox. It simply run some commands in the shell, though.
In fact It is my first experience with android programming and I just followed some examples found here and there. I also wanted to make a Kotlin based app, but then I decided to continue with plain old java. The app might not a perfect one. Hope it worked for many of elephone owners
---------- Post added at 08:05 AM ---------- Previous post was at 07:41 AM ----------
@xenonism, you should try a clean ROM with sp flash tool. It is a bit tricky, I have tried one from needrom and as the author suggested, I did not check the preloader mark. Then my phone ended totally bricked. The ROM from 4pda worked for me. Today I'm going to reflash it again and investigate why my app does not work on it.

@ludmiloff, I ended up installing 20150109 via SP Flash Tool and then updating via OTA to the latest version. Sure enough, your app worked then. And permissions for gt9xx_config are now 666.
I am not particularly happy with the gravitybox solution for the notification issue, so I'm trying to look into it, but I am not really hopeful to achieve something.

xenonism said:
@ludmiloff, I ended up installing 20150109 via SP Flash Tool and then updating via OTA to the latest version. Sure enough, your app worked then. And permissions for gt9xx_config are now 666.
I am not particularly happy with the gravitybox solution for the notification issue, so I'm trying to look into it, but I am not really hopeful to achieve something.
Click to expand...
Click to collapse
Same I did just few minutes ago. Won't install updates and will try to make my app working on this ROM.
BTW. Russian method write a very different format to file /process/gmnodexxxxxxx where xxxxxxx is build date. I'm pretty sure if I could change the file with correct checksum and version letter it should work too.
Anyway, my intent was to fix the scroll after I applied the elephone apk. For sure the Russian method with correct version letter and checksum would work too and it is still the best flow now for phones with very stock ROM. I already explained how to calculate the checksum.

HypoTurtle said:
@ludmiloff does your app require busybox to be installed?
Downloading from 4pda.ru is a bit hit and miss for me, any chance someone can post the CWMLollipop.img..
Click to expand...
Click to collapse
I cant see any CWMLollipop.img there
They only list two recoverys my P6000CWM3.img with no links or credits of course
and carliv's CWM_Modd_2.img again no links or credits
I will be working on the lollipop soon
I am getting another phone very soon to use for daily life so I can use the P6000 for dev only purposes.

[Root] H901 - For Newbies!

None of the methods in this thread are my own work. I struggled with getting my phone rooted for a long time and spend 10s of hours on the process. I had never rooted before and was therefore unfamiliar with all the terms, unfamiliar with how to complete all the recommended checks to ensure one had the right model, etc. There were several helpful threads but most approach the subject with the assumption that one knows something about the process. In this post I lay out what worked for me in a step-by-step way and what you have to do to achieve my results.
#1 Ensure you have a H-901 motherboard and not the Korean F600 motherboard by checking the sticker, and checking “About Phone” -> “Hardware Info” -> “Model number” in settings. These must both be LG-H901…from what I can tell the community has only developed technique for the H-901 variant.
#2 Get a micro SD card and load it with Magisk https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 , and if you have Marshmallow or Lollipop and want Nougat (much better experience IMHO), load the files in this thread: https://forum.xda-developers.com/tmobile-lg-v10/development/h901-t-mobile-nougat-v30b-twrp-t3639203 And maybe this thread as well (read both and then decide): https://forum.xda-developers.com/tm.../h901-t-mobile-nougat-v30c-flashable-t3744648
#3 Ensure you have unlocked your bootloader. (apparently only for T-mobile LG v10s since other carriers lock the bootloader) The FWUL virtual machine root method will not work if you have not done so. This is an entire process in itself. The following 2 videos which show how to root android 6.0 or earlier (process will not work with Nougat, 7.0, since some fastboot commands are missing). https://youtu.be/OtXlokk6JkQ , https://youtu.be/PPLwFGxLQA4
Also, this thread may be helpful. https://forum.xda-developers.com/tm...t-mobile-bootloader-factory-unlocked-t3236224 , download the nexus root toolkit here for easy ADB command entry http://www.wugfresh.com/nrt/ —we will only use the “Advanced Utilities” -> ”Manual Input” -> ”Launch CMD Prompt”. When it prompts you to select a phone, select the first option and then for android version select Android *** Any. Don’t use any of the other commands because they are not configured for your device.
If you get a “waiting for device” error while attempting the fastboot oem unlock command in the above thread, see: https://forum.xda-developers.com/tmobile-g4/help/fastboot-waiting-device-t3489789 Great video which shows how to change drivers. You will need to do this, I found a number of drivers that were already on my PC from google and Samsung worked although I didn’t have the specific one mentioned in the above thread. Don’t be afraid to experiment… you can always try another driver. And don’t require it to be hardware compatible. Ignore the warning message: https://youtu.be/nQjg6ePnGAc
---------------------------------------------
NOW that you have your bootloader unlocked you can proceed to actually flash the TWRP image as per this thread: https://forum.xda-developers.com/tmobile-lg-v10/general/root-h901-nougat-t3773942
Notes before beginning:
-To enter download mode to begin: Plug a USB cable into your phone with your phone powered off, hold down on the Vol Up button and plug the USB cord into your computer. It should immediately boot into download mode. Exiting Download mode after flash: pull battery…no damage will be done.
-To enter recovery after flashing TWRP: power off the phone then hold both the down volume and power at the same time. When you see the black LG screen briefly release the power button and then press it again while not letting the volume down up. You will see a screen asking if you want to delete all user settings. Say YES (via the volume and power keys—no touch input). You will see a screen asking if you want to delete all user data. Say YES (the data is only deleted if TWRP loads successfully) You will briefly see the black LG bootup screen. TWRP or factory recovery will load. Or if you did not unlock your bootloader, it will say recovery is corrupted and cannot be trusted, and then boot normally without changing your settings or deleting files.
-Additional note: as of 7-23-18 some commands had changed:
From V20 forum, Brian (runningnak3d) has moved to gitlab.com. So instead of github.com, we have to use a new git repository that Brian created in gitlab.com.
cd
mv lglaf lglaf_BAK
git clone https://gitlab.com/runningnak3d/lglaf
cd lglaf
git pull
git checkout v10-miscwrte
There are additional comments in the thread. Some timeout errors may be solved by: 1 - Download the VirtualBox extension pack: https://download.virtualbox.org/vir..._VirtualBox_Extension_Pack-5.2.8.vbox-extpack
2 - Go to File / Preferences / Extensions / click the + and browse to where you downloaded it.
3 - Once installed, with the VM off, right click on the VM, and go to settings. Click on USB, and pick USB 3.0. If your machine doesn't have a USB 3 port, pick 2.0.
But frankly, simply up arrow after a timeout error to load the last command on the command line and hit enter again. Simply keep doing this until it works. You know it works because no dialog appears for several minutes before informing one of success.
**Upgrade to Nougat after Flashing TWRP and booting to Recovery steps: (I did a full wipe as suggested by this thread: https://forum.xda-developers.com/v20/development/h918-recowvery-unlock-v20-root-shell-t3490594 before flashing the v30b upgrade then full Nougat zip, and then flashing Magisk. I flashed the 3 zips sequentially. I was afraid Nougat would not boot successfully because the zip files are less than 2 gb combined but success! You may want to also flash the 30c upgrade before flashing Magisk for a total of 4 zip flashes. I did not try this. However doing all this means no backups are done so if there is a problem you may have to flash a KDZ with the LG UP tool (don’t ask me how).
As a final note, I cannot answer specific questions about the various processes provided or errors you may encounter that I have not listed in this write up since I have not experienced them. A bit of research on your part may be required, but this post should provide you with a huge head start compared to where I started. Good luck!

Methods to get unlimited mobile hotspot, very useful if you're on the $50 MetroPCs (owned by T-mobile) unlimited plan. All you $70 T-mobile plan suckazzz! https://forum.xda-developers.com/tm...ited-tetherting-hotspot-t3825144#post77249285
I would actually recommend using a USB tether client and forgoing root access if tethering is your only objective and you are trying to be efficient with your time. However, with root you can install all these cool apps!: https://www.digitaltrends.com/mobile/best-android-root-apps/
The following caught my eye:
-Rec: screen record
-liveboot: boot animation (does not work with Magisk)
-Servicely: checks to see which apps are using a lot of battery and lets you suppress them
-Adblock Plus
-Titanium backup: very powerful phone backup application & bloatware remover look into for quickly switching over to a different lg v10
-Greenify: put apps into hibernation
-System tuner: get lots of info about you phone but be careful making changes
-ES file explorer: dig into the android system
-Disk digger: recovers deleted files (photos only?)

Fire HD 8 (2018 ONLY) unbrick, downgrade, unlock & root

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Changelog:
v2 - Fixed the issue with the screen
Make sure to read this guide completely before starting. It requires you to open the tablet, however you don't need to solder or use any advanced tools.
This is only for Fire HD 8, 8th generation, also known as karnak or KFKAWI. It's now confirmed to work on both 16GB and 32GB models.
You will lose all data on the tablet, make a backup of important data before you start. If you've enabled encryption, it's probably a good idea to disable it before you proceed with the guide.
What you need:
- a Linux installation. Since I had to rush it, this guide is only for Linux. Once I get a chance to test it on Windows I'll update the guide.
- microusb cable to connect your tablet to the PC
- some way to open the tablet (pry tool, opening picks, etc)
- something conductive (metal tweezers, a paper clip, a piece of wire, etc)
- amonet.tar.gz
- 6300.zip: https://mega.nz/#!FI1HSI5T!2zUAeiW9I-eH3Ph0Ar10_2nioNIm0ilSnNYgOG9YPNE
- Magisk-v18.0.zip: https://github.com/topjohnwu/Magisk/releases/download/v18.0/Magisk-v18.0.zip
- finalize.zip
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work "sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot".
Extract amonet.tar.gz, open a terminal and navigate to it.
You might need to run the scripts on your PC under sudo if you're getting permission errors.
0. Shut your device down and disconnect it from USB! Also, disconnect all other Android devices you might have connected from your PC. Also, if you have ModemManager installed, you MUST disable or uninstall it before you begin
1. Use a pry tool to remove the back shell from the tablet. Start at the bottom and work your way up. There are no cables between the back shell and the motherboard.
2. On the left side of the board there are 4 test points labeled DAT0, RST, CMD, CLK. We only care about the bottom one, CLK.
3. Plug in one end of the microusb cable, either to the PC or to the tablet, whatever's more convenient.
4. On your PC, run `./bootrom-step.sh`. It should print "Waiting for the bootrom".
5. Using your conductive apparatus, short the CLK test point to the ground. This means you should connect one side of your paperclip to the CLK pin and the other to the metallic shield or a side of the PCB. Firmly hold it in place so that there is connection. (See https://i.imgur.com/7BXIb2y.jpg)
6. Plug in the other end of the microusb cable.
7. You should see a new device appear on your PC
Code:
[10894.058045] usb 3-2.4.1: new full-speed USB device number 9 using xhci_hcd
[10894.239684] usb 3-2.4.1: New USB device found, idVendor=0e8d, idProduct=0003
[10894.239690] usb 3-2.4.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[10894.241330] cdc_acm 3-2.4.1:1.0: ttyACM0: USB ACM device
This *must* be the device you see. If you see a "preloader" device instead, you didn't hold the paperclip strong enough. Unplug it, shut down your Fire (pull out USB cord and wait; if it doesn't shut down, you might have to disconnect the battery) and try again starting at step 4.
8. The script you ran in step 4 should now tell you to remove the short. Remove the paperclip and press Enter as instructed.
9. The script will now proceed to downgrade your device and flash some essential files. Just let it be, it will take about 4 minutes. You should see the following output:
Code:
[2019-01-26 23:30:02.157670] Waiting for bootrom
[2019-01-26 23:30:20.438333] Found port = /dev/ttyACM0
[2019-01-26 23:30:20.439362] Handshake
[2019-01-26 23:30:20.441693] Disable watchdog
* * * Remove the short and press Enter * * *
[2019-01-26 23:30:22.636037] Init crypto engine
[2019-01-26 23:30:22.661832] Disable caches
[2019-01-26 23:30:22.662505] Disable bootrom range checks
[2019-01-26 23:30:22.685773] Load payload from ../brom-payload/build/payload.bin = 0x4690 bytes
[2019-01-26 23:30:22.693170] Send payload
[2019-01-26 23:30:23.527965] Let's rock
[2019-01-26 23:30:23.528832] Wait for the payload to come online...
[2019-01-26 23:30:24.260602] all good
[2019-01-26 23:30:24.261069] Check GPT
[2019-01-26 23:30:24.596346] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 22722527)}
[2019-01-26 23:30:24.596619] Check boot0
[2019-01-26 23:30:24.841858] Check rpmb
[2019-01-26 23:30:25.051079] Downgrade rpmb
[2019-01-26 23:30:25.052924] Recheck rpmb
[2019-01-26 23:30:25.949978] rpmb downgrade ok
[2019-01-26 23:30:25.950284] Flash lk-payload
[5 / 5]
[2019-01-26 23:30:26.471797] Flash preloader
[288 / 288]
[2019-01-26 23:30:44.845804] Flash tz
[6732 / 6732]
[2019-01-26 23:33:08.502134] Flash lk
[685 / 685]
[2019-01-26 23:33:23.337460] Inject microloader
[4 / 4]
[2019-01-26 23:33:23.667547] Reboot to unlocked fastboot
If the script freezes at some point, you will have to restart it. Terminate the script, unplug USB, and try again starting at step 4. If after unplugging USB cable the device doesn't shut down, you might have to disconnect the battery. You can keep it disconnected until the script succeeds, but once it's done you must reconnect it before booting to fastboot.
9. You should see a success message: "Reboot to unlocked fastboot". Only proceed if you see the message.
10. Once the device boots to fastboot (check with "fastboot devices". You should see amazon logo on the screen.), you can run "./fastboot-step.sh". Then, flip the device over so that you can see the display.
11. At this point the device should boot into recovery, however it's possible that the screen will be off by default. Just press the power button twice and the screen should turn on.
12. We'll now upload required files to the recovery. On your PC, do:
adb push 6300.zip /sdcard
adb push Magisk-v18.0.zip /sdcard
adb push finalize.zip /sdcard
13. In the recovery, go to "Install", navigate to "/sdcard" and flash 6300.zip
14. Go to "Wipe" and do the default wipe, then reboot
15. At the Fire setup screen, select your language. On the next screen, Wifi setup, select any password-protected network, then instead of entering the password press "cancel". Now, back at the wifi setup screen, press "skip" and "skip" in the dialog pop-up again
16. Hold down the power button, press Restart and hold volume down to boot into recovery.
17. In the recovery, go to "Install", navigate to "/sdcard" and flash Magisk-v18.0.zip
18. Press back, select finalize.zip and flash it
19. Once finalize.zip is flashed, press "Reboot System"
20. Done. The device should now boot into a rooted 6.3.0.0 firmware. You should have Magisk manager installed, and root working. You will be able to boot into recovery by holding volume down.
21. At this point it should be safe to connect to wifi. If everything works okay, assemble your device.
Your device is now unlocked. You can flash a custom boot image, system image, etc. However, if you ever brick the device so bad the recovery does not boot, you will have to repeat these steps starting from the first one. Read below for what you should not do.
VERY IMPORTANT STUFF:
Only ever flash boot images from TWRP. Since nothing but TWRP is aware of the exploit, if you try to flash a boot image from Android, it won't have the exploit integrated into it! This includes Magisk as well, so do NOT install or uninstall it from Magisk Manager (However, installing modules should be fine; although it depends on the specific module).
Due to how the exploit works, it takes over the first 0x400 bytes of boot.img/recovery.img. When flashing zips from the recovery, it will transparently remove and then reinstall the exploit when needed. So long as you flash zips from the recovery, you should treat the boot image normally. However, this means that you cannot use any other apps (e.g. FlashFire) to flash the boot or recovery partitions.
To revert back to stock:
- download update package from amazon https://fireos-tablet-src.s3.amazon...ate-kindle-NS6301_user_1611_0001309035396.bin to your PC
- flash 6300.zip from twrp
- flash revert-stock.zip from twrp
- wipe data
- reboot to recovery; you should see amazon recovery now
- select "apply update from ADB" in the recovery menu
- run "adb sideload update-kindle-NS6301_user_1611_0001309035396.bin" on your PC
Another way to fix a brick:
- Download update package from amazon https://fireos-tablet-src.s3.amazon...ate-kindle-NS6301_user_1611_0001309035396.bin to your PC
- Download and unzip revert-stock.zip
- Do steps 0 to 9 from this guide (so everything until fastboot-step.sh)
- Wait for device to boot into fastboot mode (check with "fastboot devices")
- Run "fastboot flash boot boot.img" using boot.img from the revert-stock.zip
- Run "fastboot flash recovery recovery.img" using recovery.img from the from the revert-stock.zip
- Run "fastboot reboot recovery"
- Select "apply update from ADB" in the recovery menu
- Run "adb sideload update-kindle-NS6301_user_1611_0001309035396.bin" on your PC
Other misc information / troubleshooting:
- If you need to disconnect the battery, use a pair of tweezers to grab the wires and gently pull towards yourself. You can do bootrom-step.sh either with or without the battery connected, however fastboot-step.sh should be done with the battery connected.
- If your device is bricked (e.g. from a downgrade), just follow the steps as-is.
- If you're getting an error like "Serial protocol mismatch", or any other error in bootrom-step, try disabling or temporarily uninstalling ModemManager from your Linux
- To remount /system as rw use "mount -o rw,remount /system". ("mount -o remount,rw /system" will not work)
Thanks to: @hwmod @firetablethelp for testing different versions of the payload.
Special thanks to: aftv2-tools contributors https://gitlab.com/zeroepoch/aftv2-tools; the bootrom download protocol scripts are largely based on their work

GPL Notice:
- Source code for modified TWRP is available from https://github.com/xyzz/android_bootable_recovery
- Source code for amonet/brom-payload is available from https://github.com/xyzz/amonet/tree/master/brom-payload
Device tree to build TWRP: https://github.com/xyzz/android_device_amazon_karnak
Additionally, source code of the full exploit chain is available from https://github.com/xyzz/amonet
When I finish the writeup for this vulnerability, I'll update this post with a URL to the writeup.

You sir, are a marvelous wizard leet haxor ?. Thanks for this. Will this ever lead to any software solution for root on this tablet. Parden my noob questions?

beanaman said:
You sir, are a marvelous wizard leet haxor . Thanks for this. Will this ever lead to any software solution for root on this tablet. Parden my noob questions?
Click to expand...
Click to collapse
The only reason you have to open the tablet is to put the bootrom into download mode. If somebody figures out another way to do that, then yes it can be done completely in software. One way is to brick the tablet by erasing the preloader completely (both copies). However, this would require root (temporarily), and is more dangerous. Ultimately, I figured that the difficulty level here is about as much as replacing a battery (even lower) so I haven't investigated this further.

Thank you for explaining that further. It's nice to have this capability in our toolbox.

Wow! @xyz` you are a genius!
This exploit can be applied to fire 7 7th gen?

xyz` said:
Make sure to read this guide completely before starting. It requires you to open the tablet, however you don't need to solder or use any advanced tools.
This is only for Fire HD 8, 8th generation, also known as karnak or KFKAWI. I've also only tested this on the 16GB version, though the 32GB one should work the same.
You will lose all data on the tablet, make a backup of important data before you start. If you've enabled encryption, it's probably a good idea to disable it before you proceed with the guide.
What you need:
- a Linux installation. Since I had to rush it, this guide is only for Linux. Once I get a chance to test it on Windows I'll update the guide.
- microusb cable to connect your tablet to the PC
- some way to open the tablet (pry tool, opening picks, etc)
- something conductive (metal tweezers, a paper clip, a piece of wire, etc)
- amonet.tar.gz
- 6300.zip: https://mega.nz/#!FI1HSI5T!2zUAeiW9I-eH3Ph0Ar10_2nioNIm0ilSnNYgOG9YPNE
- Magisk-v18.0.zip: https://github.com/topjohnwu/Magisk/releases/download/v18.0/Magisk-v18.0.zip
- finalize.zip
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work "sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot".
Extract amonet.tar.gz, open a terminal and navigate to it.
You might need to run the scripts on your PC under sudo if you're getting permission errors.
0. Shut your device down and disconnect it from USB! Also, disconnect all other Android devices you might have connected from your PC.
1. Use a pry tool to remove the back shell from the tablet. Start at the bottom and work your way up. There are no cables between the back shell and the motherboard.
2. On the left side of the board there are 4 test points labeled DAT0, RST, CMD, CLK. We only care about the bottom one, CLK.
3. Plug in one end of the microusb cable, either to the PC or to the tablet, whatever's more convenient.
4. On your PC, run `./bootrom-step.sh`. It should print "Waiting for the bootrom".
5. Using your conductive apparatus, short the CLK test point to the ground. This means you should connect one side of your paperclip to the CLK pin and the other to the metallic shield or a side of the PCB. Firmly hold it in place so that there is connection. (See https://i.imgur.com/7BXIb2y.jpg)
6. Plug in the other end of the microusb cable.
7. You should see a new device appear on your PC
This *must* be the device you see. If you see a "preloader" device instead, you didn't hold the paperclip strong enough. Unplug it, shut down your Fire (pull out USB cord and wait; if it doesn't shut down, you might have to disconnect the battery) and try again starting at step 4.
8. The script you ran in step 4 should now tell you to remove the short. Remove the paperclip and press Enter as instructed.
9. The script will now proceed to downgrade your device and flash some essential files. Just let it be, it will take about 4 minutes. You should see the following output:
If the script freezes at some point, you will have to restart it. Terminate the script, unplug USB, and try again starting at step 4. If after unplugging USB cable the device doesn't shut down, you might have to disconnect the battery. You can keep it disconnected until the script succeeds, but once it's done you must reconnect it before booting to fastboot.
9. You should see a success message: "Reboot to unlocked fastboot". Only proceed if you see the message.
10. Once the device boots to fastboot (check with "fastboot devices"), you can run "./fastboot-step.sh". Then, flip the device over so that you can see the display.
11. At this point the device should boot into recovery, however it's possible that the screen will be off by default. Just press the power button twice and the screen should turn on.
13. We'll now upload required files to the recovery. On your PC, do:
adb push 6300.zip /sdcard
adb push Magisk-v18.0.zip /sdcard
adb push finalize.zip /sdcard
14. In the recovery, go to "Install", navigate to "/sdcard" and flash 6300.zip
15. Go to "Wipe" and do the default wipe, then reboot
16. At the Fire setup screen, select your language. On the next screen, Wifi setup, select any password-protected network, then instead of entering the password press "cancel". Now, back at the wifi setup screen, press "skip" and "skip" in the dialog pop-up again
17. Hold down the power button, press Restart and hold volume down to boot into recovery.
18. In the recovery, go to "Install", navigate to "/sdcard" and flash Magisk-v18.0.zip, finalize.zip, in that order.
15. Press "Reboot System" once the latest zip, finalize.zip, is installed.
16. Done. The device should now boot into a rooted 6.3.0.0 firmware. You should have Magisk manager installed, and root working. You will be able to boot into recovery by holding volume down.
17. At this point it should be safe to connect to wifi. If everything works okay, assemble your device.
Your device is now unlocked. You can flash a custom boot image, system image, etc. However, if you ever brick the device so bad the recovery does not boot, you will have to repeat these steps starting from the first one. Read below for what you should not do.
VERY IMPORTANT STUFF:
Only ever flash boot images from TWRP. Since nothing but TWRP is aware of the exploit, if you try to flash a boot image from Android, it won't have the exploit integrated into it! This includes Magisk as well, so do NOT install or uninstall it from Magisk Manager (However, installing modules should be fine; although it depends on the specific module).
Due to how the exploit works, it takes over the first 0x400 bytes of boot.img/recovery.img. When flashing zips from the recovery, it will transparently remove and then reinstall the exploit when needed. So long as you flash zips from the recovery, you should treat the boot image normally. However, this means that you cannot use any other apps (e.g. FlashFire) to flash the boot or recovery partitions.
To revert back to stock:
- download update package from amazon https://fireos-tablet-src.s3.amazon...ate-kindle-NS6301_user_1611_0001309035396.bin to your PC
- flash 6300.zip from twrp
- flash revert-stock.zip from twrp
- wipe data
- reboot to recovery; you should see amazon recovery now
- select "apply update from ADB" in the recovery menu
- run "adb sideload update-kindle-NS6301_user_1611_0001309035396.bin" on your PC
Special thanks to: aftv2-tools contributors https://gitlab.com/zeroepoch/aftv2-tools; the bootrom download protocol scripts are largely based on their work
Click to expand...
Click to collapse
LMFAO I can't ****ing believe this. I'm almost certain this will work on the HD 10 too. You found it before me. Absolutely brilliant. You've just proved many weeks and or months of my hard research that I've posted in more than a few threads between the fire 7 forums and here. You just happened to be a lot quicker at this and probably smarter. ACM I discovered a few weeks or months ago on the HD 10. There is a build file that has many ways to set ACM props. doing this made everything light up on my PC...new drivers were installed and being used including the preloader drivers. I set my test HD 10 to persist ACM since then, convinced it was one of the possible keys to the puzzle. If you've read anything I've done in the past several weeks and months you may have been the only one who truly believed anything I had been saying. I don't know who you are or where you came from but I can only thank you. You've made my day, my week and my year. At least now I can say I'm not crazy, hallucinating or 'don't know what I'm doing or talking about.' it will take me a few days to get started, but I'll get right to testing my test HD 10 in the next few days or so.
Edit: I was convinced it had to do with fos_flags too, which I believe is another way to unlock.
Sent from my MotoG3 using XDA Labs

Rortiz2 said:
Wow! @xyz` you are a genius!
This exploit can be applied to fire 7 7th gen?
Click to expand...
Click to collapse
The vulnerability is present on every mediatek device, so yeah. It will not work as-is because of different addresses (for the crypto device and offsets for LK). Additionally, on Fire 7 7th gen the eMMC test point is hidden behind the shield that you need to desolder, so you will probably want to find a different way to enter the bootrom download mode.

Great work!
xyz` said:
The vulnerability is present on every mediatek device, so yeah. It will not work as-is because of different addresses (for the crypto device and offsets for LK). Additionally, on Fire 7 7th gen the eMMC test point is hidden behind the shield that you need to desolder, so you will probably want to find a different way to enter the bootrom download mode.
Click to expand...
Click to collapse
This is very promising could you please elaborate, what exactly needs to be modified to port this to other MTK-hardware.
I have a fire 5th gen here and I can access brom-mode by pressing left mute button while pluging in.
tried your scripts as is (commenting out the parts that change rpmb or flash partitions) and it get's stuck at
Code:
[2019-01-28 00:01:40.973289] Disable bootrom range checks
Does the hash in load_payload.py (4dd12bdf0ec7d26c482490b3482a1b1f) need to be modified?
I do have the kernel-sources for the device and am willing to investigate correct addressing etc.
Also since this is a boot-rom exploit wouldn't it allow flashing a hacked preloader + lk which just ignore boot-signatures so we can just run a standard twrp?

k4y0z said:
This is very promising could you please elaborate, what exactly needs to be modified to port this to other MTK-hardware.
I have a fire 5th gen here and I can access brom-mode by pressing left mute button while pluging in.
tried your scripts as is (commenting out the parts that change rpmb or flash partitions) and it get's stuck at
Code:
[2019-01-28 00:01:40.973289] Disable bootrom range checks
Does the hash in load_payload.py (4dd12bdf0ec7d26c482490b3482a1b1f) need to be modified?
I do have the kernel-sources for the device and am willing to investigate correct addressing etc.
Also since this is a boot-rom exploit wouldn't it allow flashing a hacked preloader + lk which just ignore boot-signatures so we can just run a standard twrp?
Click to expand...
Click to collapse
So first of all make sure you're accessing bootrom mode and not preloader mode (Although if the preloader supports read/write, the exploit should work there as well, I just haven't tested it since on hd 8 8th gen none of preloaders support these). I suggest soldering on a UART adapter, then use 115200 baud rate. When in bootrom dl mode, you should see "[DL] 00000BB8 444C0005 010701" (basically, the "[DL]" part is the important one)
If it's a different soc, you will have to dump the bootrom and find the offset where range check data is stored (in my case, 0x102868). You might have to modify the 4dd12bdf0ec7d26c482490b3482a1b1f part as well, it's basically calculated as a xor of expected data and actual data it's written. Then, you'll also need to update the pointer I'm overwriting (0x1028A8 in my case, called ptr_send in brom-payload). Again, if executing under preloader it's gonna be completely different way to exploit it.
Once all this is done, you should be able to load binary payloads and execute them in bootrom mode. You'll also need to edit brom-payload and set up proper pointers to send_dword/recv_dword/etc, these can be found by reversing your bootrom dump. At this point it should be possible to get emmc read/write.
Finally, if you want a persistent unlock (and not just the ability to modify /system) you'll need to port lk exploit as well. So you'll have to figure if your lk is vulnerable to the same bug, port microloader, inject_microloader.py and lk-payload to use the proper offsets. It's a lot of work.
I'll hopefully finish my writeup in the next weeks and post a link to it, that should be easier to understand since I'll explain the whole process from start to finish.
You're right about being able to load a custom preloader/lk, however the bootrom exploit requires a PC connection and a bunch of USB commands (so in a way, it's "tethered"). The actual unlock exploit isn't using any bootrom bugs, but rather the lk bug, since that one works without a PC. In fact, the bootrom exploit is only used to flash stuff to eMMC (but, of course you could probably do more fun stuff with it) in my chain.

Thanks for your quick reply.
xyz` said:
So first of all make sure you're accessing bootrom mode and not preloader mode (Although if the preloader supports read/write, the exploit should work there as well, I just haven't tested it since on hd 8 8th gen none of preloaders support these). I suggest soldering on a UART adapter, then use 115200 baud rate. When in bootrom dl mode, you should see "[DL] 00000BB8 444C0005 010701" (basically, the "[DL]" part is the important one)
Click to expand...
Click to collapse
I'm pretty sure I'm in boot-rom, my preloader actually has direct read/write using read_mmc.py but that has been fixed in newer preloaders, so I would rather go the boot-rom route.
Have you tried if pressing left (or both) volume buttons while pluging in brings you to brom-mode as well, like it does on my device?
I'll attach a serial to check for the output.
xyz` said:
If it's a different soc, you will have to dump the bootrom and find the offset where range check data is stored (in my case, 0x102868). You might have to modify the 4dd12bdf0ec7d26c482490b3482a1b1f part as well, it's basically calculated as a xor of expected data and actual data it's written. Then, you'll also need to update the pointer I'm overwriting (0x1028A8 in my case, called ptr_send in brom-payload). Again, if executing under preloader it's gonna be completely different way to exploit it.
Click to expand...
Click to collapse
Any hint on how i would dump the bootrom? Also could you upload your boot-rom so I can compare once i got mine?
xyz` said:
Finally, if you want a persistent unlock (and not just the ability to modify /system) you'll need to port lk exploit as well. So you'll have to figure if your lk is vulnerable to the same bug, port microloader, inject_microloader.py and lk-payload to use the proper offsets. It's a lot of work.
Click to expand...
Click to collapse
Willing to put that work in
xyz` said:
I'll hopefully finish my writeup in the next weeks and post a link to it, that should be easier to understand since I'll explain the whole process from start to finish.
Click to expand...
Click to collapse
looking forward to your writeup.
xyz` said:
You're right about being able to load a custom preloader/lk, however the bootrom exploit requires a PC connection and a bunch of USB commands (so in a way, it's "tethered"). The actual unlock exploit isn't using any bootrom bugs, but rather the lk bug, since that one works without a PC. In fact, the bootrom exploit is only used to flash stuff to eMMC (but, of course you could probably do more fun stuff with it) in my chain.
Click to expand...
Click to collapse
I thought it might be possible to flash a preloader that exploits the same vulnerability, but from your explanation I assume that won't be possible.
For this device it would already be great to be able to overwrite RPMB to downgrade, since there was an LK that allowed booting into unsigned TWRP.

k4y0z said:
Thanks for your quick reply.
I'm pretty sure I'm in boot-rom, my preloader actually has direct read/write using read_mmc.py but that has been fixed in newer preloaders, so I would rather go the boot-rom route.
Have you tried if pressing left (or both) volume buttons while pluging in brings you to brom-mode as well, like it does on my device?
I'll attach a serial to check for the output.
Click to expand...
Click to collapse
Yep, I've tried and it didn't work, though it could be device-specific. There are several additional ways preloader can force you into bootrom download mode, for example if preloader has an assertion and you hold volume down, it just deletes itself from emmc and next boot you'd be in bootrom mode (this doesn't work on hd 8 though as there's a bug in how it's set up); then there's some button checks that sets up a SRAMROM_USBDL which bootrom checks (but the code for the button check isn't present on Fire preloader). So unfortunately the only option that worked for me is shorting eMMC to ground.
k4y0z said:
Any hint on how i would dump the bootrom? Also could you upload your boot-rom so I can compare once i got mine?
Click to expand...
Click to collapse
This will be in the writeup, it's too long to explain here. I'm not sure if I can share my dump since technically it's copyrighted code.
k4y0z said:
I thought it might be possible to flash a preloader that exploits the same vulnerability, but from your explanation I assume that won't be possible.
For this device it would already be great to be able to overwrite RPMB to downgrade, since there was an LK that allowed booting into unsigned TWRP.
Click to expand...
Click to collapse
Well, we only can flash preloaders signed by amazon. If you have a preloader/LK combination that doesn't have signature checks that's great, you can use that.

k4y0z said:
Any hint on how i would dump the bootrom? Also could you upload your boot-rom so I can compare once i got mine?
Click to expand...
Click to collapse
Also, here's what I used on my Fire 7:
Code:
def call_func(func):
sdr_write32(0x11010804, 3)
sdr_write32(0x11010808, 3)
sdr_write32(0x11010C00, func)
sdr_write32(0x11010400, 0)
while (not sdr_read32(0x11010800)):
pass
if (sdr_read32(0x11010800) & 2):
if ( not (sdr_read32(0x11010800) & 1) ):
while ( not sdr_read32(0x11010800) ):
pass
result = -1;
sdr_write32(0x11010804, 3)
else:
while ( not (sdr_read32(0x11010418) & 1) ):
pass
result = 0;
sdr_write32(0x11010804, 3)
return result
def hw_acquire():
sdr_write32(0x11010000, sdr_read32(0x11010000) & 0xFFFFFFF0)
sdr_write32(0x11010000, sdr_read32(0x11010000) | 0xF)
sdr_write32(0x11010004, sdr_read32(0x11010004) & 0xFFFFDFFF)
def hw_release():
sdr_write32(0x11010000, sdr_read32(0x11010000) & 0xFFFFFFF0)
sdr_write32(0x11010000, sdr_read32(0x11010000) | 0xF)
def init():
sdr_write32(0x11010C0C, 0)
sdr_write32(0x11010C10, 0)
sdr_write32(0x11010C14, 0)
sdr_write32(0x11010C18, 0)
sdr_write32(0x11010C1C, 0)
sdr_write32(0x11010C20, 0)
sdr_write32(0x11010C24, 0)
sdr_write32(0x11010C28, 0)
sdr_write32(0x11010C2C, 0)
sdr_write32(0x11010C00 + 18 * 4, [0] * 4)
sdr_write32(0x11010C00 + 22 * 4, [0] * 4)
sdr_write32(0x11010C00 + 26 * 4, [0] * 8)
def aes_read16(addr):
sdr_write32(0x11010C04, addr)
sdr_write32(0x11010C08, 0) # dst to invalid pointer
sdr_write32(0x11010C0C, 1)
sdr_write32(0x11010C14, 18)
sdr_write32(0x11010C18, 26)
sdr_write32(0x11010C1C, 26)
if call_func(126) != 0: # aes decrypt
raise Exception("failed to call the function!")
words = sdr_read32(0x11010C00 + 26 * 4, 4) # read out of the IV
data = b""
for word in words:
data += struct.pack("<I", word)
return data
def aes_write16(addr, data):
if len(data) != 16:
raise RuntimeError("data must be 16 bytes")
pattern = bytes.fromhex("6c38d88958fd0cf51efd9debe8c265a5")
# iv-xor
words = []
for x in range(4):
word = data[x*4:(x+1)*4]
word = struct.unpack("<I", word)[0]
pat = struct.unpack("<I", pattern[x*4:(x+1)*4])[0]
words.append(word ^ pat)
sdr_write32(0x11010C00 + 18 * 4, [0] * 4)
sdr_write32(0x11010C00 + 22 * 4, [0] * 4)
sdr_write32(0x11010C00 + 26 * 4, [0] * 8)
sdr_write32(0x11010C00 + 26 * 4, words)
sdr_write32(0x11010C04, 0xE680) # src to VALID address which has all zeroes (otherwise, update pattern)
sdr_write32(0x11010C08, addr) # dst to our destination
sdr_write32(0x11010C0C, 1)
sdr_write32(0x11010C14, 18)
sdr_write32(0x11010C18, 26)
sdr_write32(0x11010C1C, 26)
if call_func(126) != 0: # aes decrypt
raise Exception("failed to call the function!")
Try calling aes_read16(0) and see if it returns valid looking data (should start with "07 00 00 EA FE FF FF EA FE FF FF EA FE FF FF EA")

xyz` said:
Also, here's what I used on my Fire 7:
Try calling aes_read16(0) and see if it returns valid looking data (should start with "07 00 00 EA FE FF FF EA FE FF FF EA FE FF FF EA")
Click to expand...
Click to collapse
It seems to just hang with both aes_read16 and aes_write16.
It is probably related to the CRYPTO_BASE.
I tried finding the correct one here: https://github.com/chaosmaster/andr...ch/arm/mach-mt8127/include/mach/mt_reg_base.h
but didn't seem to find anything usefull (I tried CRYPTO_BASE = 0x1101B000, but that doesn't work either)

k4y0z said:
It seems to just hang with both aes_read16 and aes_write16.
It is probably related to the CRYPTO_BASE.
I tried finding the correct one here: https://github.com/chaosmaster/andr...ch/arm/mach-mt8127/include/mach/mt_reg_base.h
but didn't seem to find anything usefull (I tried CRYPTO_BASE = 0x1101B000, but that doesn't work either)
Click to expand...
Click to collapse
So what you can do is download a firmware update for your device, load up the preloader in IDA (or a disassembler of your choice) and search for "hw sha". You should see it used like this: https://i.imgur.com/1PcObV7.png. Then inside that function https://i.imgur.com/wvpq5Qm.png the first call is essentially hw_acquire, then hash, then hw_release. Going further https://i.imgur.com/D5Z9UoM.png. So the base in my case is 0x10210000. You should figure out at which point it hangs, if it's inside one of the while loops, make sure you call init() and hw_acquire() first (it's not always required, seems to be hw-dependent)

Porting the hack to Fire 7" 7th Generation
xyz` said:
So first of all make sure you're accessing bootrom mode and not preloader mode (Although if the preloader supports read/write, the exploit should work there as well, I just haven't tested it since on hd 8 8th gen none of preloaders support these). I suggest soldering on a UART adapter, then use 115200 baud rate. When in bootrom dl mode, you should see "[DL] 00000BB8 444C0005 010701" (basically, the "[DL]" part is the important one)
If it's a different soc, you will have to dump the bootrom and find the offset where range check data is stored (in my case, 0x102868). You might have to modify the 4dd12bdf0ec7d26c482490b3482a1b1f part as well, it's basically calculated as a xor of expected data and actual data it's written. Then, you'll also need to update the pointer I'm overwriting (0x1028A8 in my case, called ptr_send in brom-payload). Again, if executing under preloader it's gonna be completely different way to exploit it.
Once all this is done, you should be able to load binary payloads and execute them in bootrom mode. You'll also need to edit brom-payload and set up proper pointers to send_dword/recv_dword/etc, these can be found by reversing your bootrom dump. At this point it should be possible to get emmc read/write.
Finally, if you want a persistent unlock (and not just the ability to modify /system) you'll need to port lk exploit as well. So you'll have to figure if your lk is vulnerable to the same bug, port microloader, inject_microloader.py and lk-payload to use the proper offsets. It's a lot of work.
I'll hopefully finish my writeup in the next weeks and post a link to it, that should be easier to understand since I'll explain the whole process from start to finish.
You're right about being able to load a custom preloader/lk, however the bootrom exploit requires a PC connection and a bunch of USB commands (so in a way, it's "tethered"). The actual unlock exploit isn't using any bootrom bugs, but rather the lk bug, since that one works without a PC. In fact, the bootrom exploit is only used to flash stuff to eMMC (but, of course you could probably do more fun stuff with it) in my chain.
Click to expand...
Click to collapse
That was smart of you @xyz a genial solution.
You have proven that the "chain of trust" was a joke.
Many have said that what we were trying was impossible.
Did you realize on the 7" 7th Gen there are RST and EINT pads on the back of the photo I sent ?
Can we port your method to the 7th Gen by using RST instead of CLK to stop the MCU accessing the EMMC ?
Also the "watchdog" you disabled is on the RTC device of the MT6323 PMIC chip which in turn is on the I2C bus.
I can write to the I2C bus using a Bus Pirate v4, I already tried some write and seems I can do that too as an alternative.
Again the pads for accessing the I2C bus are on the back of the PCB of 7th Gen. tablets, they are labelled SCL2 and SDA2.
In a couple of week, or less, you have shown that Lab126 didn't deserve all that money for such a fake security mechanism.
I confirm that zeroing the "preloader" in "mmcblk0boot0" also forces the MCU to enter [DL] mode.
I was sure that investing time on the the [DL] mode would have paid back.
Again congratulation for the achievement and thank you for the time you have put on this.
.:HWMOD:.

hwmod said:
Did you realize on the 7" 7th Gen there are RST and EINT pads on the back of the photo I sent ?
Can we port your method to the 7th Gen by using RST instead of CLK to stop the MCU accessing the EMMC ?
Click to expand...
Click to collapse
I haven't tried with RST. Try it and see if you get a "[DL]" message on uart, if you do then it should work.
hwmod said:
Also the "watchdog" you disabled is on the RTC device of the MT6323 PMIC chip which in turn is on the I2C bus.
I can write to the I2C bus using a Bus Pirate v4, I already tried some write and seems I can do that too as an alternative.
Again the pads for accessing the I2C bus are on the back of the PCB of 7th Gen. tablets, they are labelled SCL2 and SDA2.
Click to expand...
Click to collapse
Yeah, I haven't investigated the watchdog too much. I don't think there's anything interesting you can do with it though.
hwmod said:
In a couple of week, or less, you have shown that Lab126 didn't deserve all that money for such a fake security mechanism.
I confirm that zeroing the "preloader" in "mmcblk0boot0" also forces the MCU to enter [DL] mode.
I was sure that investing time on the the [DL] mode would have paid back.
Click to expand...
Click to collapse
To be fair to lab126 all of the fail lies solely on mediatek. The bootrom code amazon probably doesn't even have access to, and LK is likely based on mediatek sources (although, it's a really obvious bug in image loading, come on). The boot chain is reasonably secure in its design, it's only the implementation that's flawed.

xyz` said:
So what you can do is download a firmware update for your device, load up the preloader in IDA (or a disassembler of your choice) and search for "hw sha". You should see it used like this: https://i.imgur.com/1PcObV7.png. Then inside that function https://i.imgur.com/wvpq5Qm.png the first call is essentially hw_acquire, then hash, then hw_release. Going further https://i.imgur.com/D5Z9UoM.png. So the base in my case is 0x10210000. You should figure out at which point it hangs, if it's inside one of the while loops, make sure you call init() and hw_acquire() first (it's not always required, seems to be hw-dependent)
Click to expand...
Click to collapse
Sadly i don't have the IDA decompiler, so just assembler it is :/
I did however find the correct CRYPTO_BASE I believe:
Code:
CRYPTO_BASE = 0x11010000
that gives the following output with aes_read16:
Code:
b'\x07\x00\x00\xea\xfe\xff\xff\xea\xfe\xff\xff\xea\xfe\xff\xff\xea'
aes_write16 now fails with "RuntimeError: ERROR: Serial protocol mismatch".
Can i dump the boot-rom with this now?

First of all, congrats and big thanks!
So, any hope for the 2017 HD8?

k4y0z said:
Sadly i don't have the IDA decompiler, so just assembler it is :/
I did however find the correct CRYPTO_BASE I believe:
Code:
CRYPTO_BASE = 0x11010000
that gives the following output with aes_read16:
Code:
b'\x07\x00\x00\xea\xfe\xff\xff\xea\xfe\xff\xff\xea\xfe\xff\xff\xea'
aes_write16 now fails with "RuntimeError: ERROR: Serial protocol mismatch".
Can i dump the boot-rom with this now?
Click to expand...
Click to collapse
Yeah, just go through all of the bootrom memory (0 to 0x20000, just to be sure, in 16 byte increments), call aes_read16 on it, concatenate everything and you'll get your bootrom dumped. It should end with a bunch of FF bytes so that's how you can tell the actual size.

[TUT] ROOT HD8(2018) via Magisk + [TWRP] + [Xposed]

Update - September 7th, 2019.
There is a more convenient method now by @k4y0z that can achieve the same unlocking objectives with fewer user commands. Please head over to this thread to achieve unlocking.
Thanks again to all who used the original method below, and hopefully you are enjoying your unlocked device!
The original post using lots of terminal commands in order to unlock
We are there! We have several fully successful attempts by @glate and @daymz (in addition to 3 partial successes earlier - thanks to @leakcheck, @spdqbr, @ShayBox). I have updated the instructions for further clarity. Please report back if there are issues. Still, be prepared to remove the back cover as described in this link in the rather unlikely case things go wrong.
First of all, full credit to @xyz` and @diplomatic, since the approach here 100% relies on their great work!
Motivation for this post: make obtaining root on Fire HD8 2018 simpler, without removing the back cover of your tablet. You will also preserve your current FireOS version, and all your user apps and settings (meaning, no Factory Reset).
Skill level required: moderate - since you will need to work with Linux and Python. HD8 2018 has Android version 7, and therefore will use Magisk for root management.
Legalese, or the standard disclaimer: While every effort had been made to ensure the instructions accuracy, any and all risk you take with this procedure is entirely yours. Please pay attention, and proceed with care! Happy unlocking!!!
Notice. If you already have a working TWRP from a prior effort, you should start at Step 11 or 12 depending on what you need to do! With TWRP, the tablet is already under your full control! Unlocking is a one time thing! Post on XDA what you are trying to do, and you will be helped!
Here we go:
Get access to Linux, install Linux tools required as per the original work by @xyz` in this link (click Thanks there!!!). Specifically, on Debian/Ubuntu do this "sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot". Download attached amonet-lite.zip to Linux.
Download attached unlock_images.zip, unpack it, place the individual image files into /sdcard/00 folder on your tablet (create /sdcard/00 folder on your tablet if it does not exist - "adb shell mkdir /sdcard/00")
Download attached finalize_no_ota.zip to /sdcard/00 on your tablet
Download Magisk to /sdcard/00 from here: Magisk-v18.0.zip If you like to live on the bleeding edge, and will be itching to upgrade, also download the latest and greatest Magisk zip - link (at present -version 18.1).
Noob protection: drain tablet battery to some low number, ~3% (this is a safety measure, in case you later get a freeze while in BootRom). Use Fast Discharge app from the Google Play Store if you are impatient. If you do get a freeze in BootRom, your Fire will discharge about ~1% per hour. The battery has to discharge to 0% for the device to exit the BootRom mode. So for battery at 50% you will be waiting ~2 days.
Get an adb root shell via mtk-su (arm version, not arm64), follow this method by @diplomatic (click Thanks there while you are doing it!!!) You may not get a proper full root on the very first try. Specifically, if ls command fails, exit shell via exit command, and run mtk-su again.
In this root shell, obtained in the previous step, first, and foremost, please verify that your prompt looks something like this : [karnak:/data/local/tmp #]. Specifically, that your device is really a karnak (i.e., HD8 2018). If you have a different device, MISSION ABORT, and do refer to the original rooting thread for instructions on how to permanently root YOUR type of device. If you do have a karnak, proceed to do the following operations.
Run the following commands
Code:
dd if=/dev/block/platform/soc/11230000.mmc/by-name/boot of=/sdcard/00/boot_orig.img
dd if=/dev/block/platform/soc/11230000.mmc/by-name/lk of=/sdcard/00/orig_lk.bin
dd if=/dev/block/platform/soc/11230000.mmc/by-name/tee1 of=/sdcard/00/orig_tz.bin
dd if=/dev/block/mmcblk0boot0 of=/sdcard/00/orig_boot0.bin
dd if=/dev/zero of=/dev/block/platform/soc/11230000.mmc/by-name/recovery
dd if=/sdcard/00/unlock_recovery-inj.img of=/dev/block/platform/soc/11230000.mmc/by-name/recovery
md5sum /sdcard/00/unlock_lk.bin; md5sum /sdcard/00/unlock_tz.bin; md5sum /dev/block/platform/soc/11230000.mmc/by-name/recovery
Make sure the above commands run without any errors!!! If there are errors, check if you perhaps did not put the image files into /sdcard/00. Below in red are the checksums you should see, take a moment to ensure that they match!!! If the checksums don't match, mission ABORT! Come back here and paste your output. You can disconnect your tablet for the time being.
Code:
[COLOR="Red"]
90ee125c08abc999f78325d30e26a388 /sdcard/00/unlock_lk.bin
982513e70d6de114ed4a9058a86de848 /sdcard/00/unlock_tz.bin
faae811e229f0a7780fd130a286d3c47 /dev/block/platform/soc/11230000.mmc/by-name/recovery
[/COLOR]
If everything looks good, proceed with updating the rest, and wiping the preloader which will enable the BootRom mode:
Code:
dd if=/sdcard/00/unlock_lk.bin of=/dev/block/platform/soc/11230000.mmc/by-name/lk
dd if=/sdcard/00/unlock_tz.bin of=/dev/block/platform/soc/11230000.mmc/by-name/tee1
dd if=/sdcard/00/unlock_tz.bin of=/dev/block/platform/soc/11230000.mmc/by-name/tee2
dd if=/sdcard/00/unlock_recovery-inj.img of=/dev/block/platform/soc/11230000.mmc/by-name/boot
dd if=/sdcard/00/unlock_recovery-inj.img of=/dev/block/platform/soc/11230000.mmc/by-name/recovery
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/block/mmcblk0boot0
echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0
md5sum /dev/block/mmcblk0boot0
(Thanks to @k4y0z, @Rortiz2, @retyre, @hwmod for figuring out the last step!!!)
You are now in a properly bricked state. Disconnect the USB cable, turn off your tablet. It's a nice brick
On Linux, you will now finish all the work required to unlock your tablet.
First make sure to uninstall/disable ModemManager (very mission critical!!!) [on Ubuntu: "sudo apt-get remove modemmanager"]. Next, run these commands:
Code:
unzip amonet-lite.zip
cd amonet-lite
chmod 755 ./bootrom-step.sh
sudo su
./bootrom-step.sh
Attach your properly bricked tablet to your Linux computer with a USB cable, do try to use a pure USB2 port on your PC (if you have it). Your tablet should come up in the BootRom mode, and start interacting with the bootrom-step.sh script above (watch the output in the Linux terminal). The tablet screen will be off and you won't see anything. Follow the bootrom-step.sh script instructions. When the script prompts "Remove the short and press Enter", just press Enter (there is no short in this method!). Hopefully, everything works. If it freezes before finishing, disconnect the tablet, and let it sit for few hours (please report back if you had to wait for battery to drain here - mainly for statistics). The battery should drain, and the tablet will leave the BootRom mode. Try again in a few hours by re-running bootrom-step.sh, and connecting your bricked tablet to your Linux computer.
Here your tablet should have rebooted to TWRP. The screen might be blank, try to hit Power button twice to wake TWRP up. If you still don't see anything, try to turn the tablet off by holding the Power button. If nothing works, wait for the battery to drain, and then re-try.
Once TWRP comes up, go to "Install/Install Image", and install /sdcard/00/boot_orig.img to boot partition (here we are returning your original boot image to it's proper partition)
In TWRP, go to "Install", select Magisk zip from /sdcard/00, and install. Version 18.0 is known to be rock solid, the newer 18.1 may or may not work OK. If you do flash 18.1, please watch for TWRP installation errors.
In TWRP, go to "Install", select finalize_no_ota.zip from /sdcard/00,and install. You only need to do this once per new system image, to make sure OTA is disabled. Don't need to repeat this if you did not upgrade/sideload a fresh ROM. It will give an error message if it was already run before - in such a case ignore the error.
In TWRP, reboot
You should now be back in FireOS, but with Magisk for root. If you don't see Magisk Manager in your app list, install it via apk downloaded from this link. If you are bootlooping due to Magisk, reboot to TWRP using Pwr+Vol buttons, and start at Step 11 but using 18.0 Magisk this time.
If you would like to install Xposed, proceed to this post #2.
If your FireOS is not the latest version (6.3.0.1 at present), use instructions in post #3 to upgrade.
Notice. If you modify your tablet to the point of an unrecoverable bootloop, check if you can still boot TWRP. If you can, then you are still unlocked, and have simple ways to recover!!! Do not rush into doing a Factory Reset, reloading your OS, sideloading the stock Amazon ROM, repeating the full above procedure, etc. Come back here, ask questions, and wait for a competent answer. If TWRP is available, everything is relatively easy to fix!!!
TWRP system restore warning: Avoid backing up & restoring your system via TWRP. Unless you fully understand the current HD8 unlocking hack, unpleasant bricks may result! You are better off re-loading the fresh stock back (/system + /boot only) via TWRP, and then immediately re-applying Magisk and finalize zip. This way if you get into a bootloop, your TWRP is still there.
Q&A :
Q: How is this different from the approach by @xyz`? A: No need to remove the back cover. Also, the modified amonet script writes only ~4% of the data in the BootRom mode compared to the original method, thus reducing the chances of a freeze in case BootRom access is flaky. Finally, the battery pre-drain should enable BootRom to die reasonably quickly if it does freeze.
Want to say thanks by clicking the "Thanks" button ?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Magisk modules, and, Xposed in particular
In this post I shall cover the installation of Magisk modules and Xposed since this operation had presented certain challenges in the past.
Once you have Magisk up and running, install a couple of useful modules first.
Busybox-1.29.2-YDS-ARM.zip. You can flash it either via Magisk, or in TWRP. It does limited modifications to the system, and is very benign, in terms of potentially causing any bootloop issues (pretty much unheard of!).
Magisk Manager for Recovery Mode (mm). Please download this zip to /sdcard/00, and flash via TWRP. Run it in TWRP, and familiarize yourself fully with its features. Specifically, try to disable the above Busybox module, reboot to OS, and observe that the Busybox module is disabled. This module is your ticket out of any bootloop when you try to install more aggressive Magisk modules!
Now that you are familiar with ways to disable bootloop-y Magisk modules via TWRP, proceed to install Xposed. Thanks to @delessio100 (link) for helping me to sort things out on my first attempt!
Download the attached Xposed_Framework_(SDK_25)-89.3_(Systemless).zip to /sdcard/00
Reboot to TWRP, and flash it
Reboot to OS, and be prepared to wait good 10-15 minutes. The first boot is unusually long, where it looks like things are in bootloop. Things may be fine, just slow, wait!!! Most likely, you shall boot into FireOS, just have patience.
If the bootloop is continuing for more than 20 minutes, turn the tablet off via the long Power button press, and reboot to TWRP (Vol buttons + Power together). Run the above mm module (in TWRP terminal, type either mm, or /data/media/mm). Disable Xposed, and reboot to OS. You should boot back into OS without issues. Report your failure back to XDA, and wait for advice.
Install XposedInstaller_3.1.5-Magisk.apk from this link, and verify that the Xposed framework (Systemless) is active.
Install some modules from the list below, activate them in Xposed Installer/Modules, and reboot
In case you get into bootloop while installing other Magisk modules, simply disable those via mm. Then search for solutions on XDA
My favourite Xposed modules
App Settings, version 1.15. This module helps to control misc per app settings. My main use - make Chrome tabs look like those on cell phone, without tabs on top, see this link for examples. AppSettings for Chrome on HD8 to trigger the cell phone look: DPI 240, screen(dp) - 320x480.
Gravity Box - add a network traffic indicator to the status bar, I like to see how much data is coming in/leaving. Also, change battery color.
No Play Games. This will stop bugging you about Google Play Games installation for certain games
Per App Hacking - more options to change settings for a single app
XVolume30 - improve volume control, with more steps

How to upgrade FireOS version:
At this moment 6.3.0.1 is the latest version. If you have something older, just flash the 6301 zip file from this link in TWRP. After the flash, re-apply Magisk and its modules. Clear cache & dalvik in TWRP before reboot.

#4 - reserved

Is it required to create the sdcard/00 ? I cant seem to find the folder at least in the internal storage when connected over usb to it.

leakcheck said:
Is it required to create the sdcard/00 ? I cant seem to find the folder at least in the internal storage when connected over usb to it.
Click to expand...
Click to collapse
Yes, just create yourself!

So far so good I am at reboot to unlock fastboot!
---------- Post added 03-03-2019 at 12:01 AM ---------- Previous post was 02-03-2019 at 11:56 PM ----------
Hmm things looked good but now darkness lol
It had finished and said reboot to unlock fastboot but now nothing, power button does nothing.

leakcheck said:
So far so good I am at reboot to unlock fastboot!
---------- Post added 03-03-2019 at 12:01 AM ---------- Previous post was 02-03-2019 at 11:56 PM ----------
Hmm things looked good but now darkness lol
It had finished and said reboot to unlock fastboot but now nothing, power button does nothing.
Click to expand...
Click to collapse
OK. It may be still stuck in BootRom? If the cover is removed, could you disconnect the battery? Could you post the Linux log here?

bibikalka said:
OK. It may be still stuck in BootRom? If the cover is removed, could you disconnect the battery? Could you post the Linux log here?
Click to expand...
Click to collapse
[email protected]:~$ cd /home/admin/Downloads
[email protected]:~/Downloads$ cd /home/admin/Downloads/amonet-lite
[email protected]:~/Downloads/amonet-lite$ chmod 755 ./[email protected]:~/Downloads/amonet-lite$ sudo su
[email protected]:/home/admin/Downloads/amonet-lite# .bootrom-step.sh
.bootrom-step.sh: command not found
[email protected]:/home/admin/Downloads/amonet-lite# ./bootrom-step.sh
[2019-03-02 17:54:19.837131] Waiting for bootrom
[2019-03-02 17:54:34.187944] Found port = /dev/ttyACM0
[2019-03-02 17:54:34.188213] Handshake
[2019-03-02 17:54:34.188569] Disable watchdog
* * * Remove the short and press Enter * * *
[2019-03-02 17:55:56.007937] Init crypto engine
[2019-03-02 17:55:56.029801] Disable caches
[2019-03-02 17:55:56.030372] Disable bootrom range checks
[2019-03-02 17:55:56.044687] Load payload from ../brom-payload/build/payload.bin = 0x4690 bytes
[2019-03-02 17:55:56.049490] Send payload
[2019-03-02 17:55:56.588729] Let's rock
[2019-03-02 17:55:56.589343] Wait for the payload to come online...
[2019-03-02 17:55:57.321067] all good
[2019-03-02 17:55:57.321628] Check GPT
[2019-03-02 17:55:57.660554] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 22722527)}
[2019-03-02 17:55:57.660890] Check boot0
[2019-03-02 17:55:57.906247] Check rpmb
[2019-03-02 17:55:58.115712] Downgrade rpmb
[2019-03-02 17:55:58.117623] Recheck rpmb
[2019-03-02 17:55:59.012188] rpmb downgrade ok
[2019-03-02 17:55:59.012691] Inject microloader
[4 / 4]
[2019-03-02 17:55:59.343207] Flash lk-payload
[4 / 4]
[2019-03-02 17:55:59.709695] Flash preloader
[288 / 288]
[2019-03-02 17:56:11.854171] Reboot to unlocked fastboot
---------- Post added at 12:24 AM ---------- Previous post was at 12:17 AM ----------
I tried pulling the battery and now I get this when I try to connect via bootrom-step
[email protected]3:/home/admin/Downloads/amonet-lite# sudo ./bootrom-step.sh
[2019-03-02 18:12:58.394533] Waiting for bootrom
^[[B[2019-03-02 18:13:06.513079] Found port = /dev/ttyACM0
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 265, in open
self.fd = os.open(self.portstr, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)
FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "main.py", line 123, in <module>
main()
File "main.py", line 51, in main
dev.find_device()
File "/home/admin/Downloads/amonet-lite/modules/common.py", line 80, in find_device
self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)
File "/usr/lib/python3/dist-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'

leakcheck said:
...
Click to expand...
Click to collapse
OK. Thank you for your valuable service!!! I will carefully check my procedure.
I think you are now coming up in the preloader mode, since preloader is now appears to be working fine. Disconnect the battery, and attempt to short the contacts, following the original procedure here: https://forum.xda-developers.com/hd...fire-hd-8-2018-downgrade-unlock-root-t3894256
My procedure is a one shot option, once the preloader is restored, you are back to shorting contacts.

Awesome ok now the shorting contact method worked, however I am not sure what I am suppose to do from here, the directions say I can use fastboot devices to check to see if its good to start( alledgedly should see an amazon logo) the fastboo-stept.sh process. I am not seeing the logo, do you know if this is a long process ?

I think I have it! Took me several tries and many reboots! Thanks for all the help!

leakcheck said:
I think I have it! Took me several tries and many reboots! Thanks for all the help!
Click to expand...
Click to collapse
Great! I've updated instructions to have some quality control along the way as to avoid some critical user errors. I have also kept amonet script as close to the original as possible. Will be asking for more volunteers

Nice guide, @bibikalka!
Although I can't help but think this could be made easier. If you guys update the LK exploit for the latest FW, then you won't need to reboot to the bootrom. If I understand correctly, the only reason that's necessary is to downgrade. Otherwise, everything could be flashed from the OS. And even if there is no way around clearing the RPMB, I'm pretty sure the crypto stuff could be done from the OS as root too.

diplomatic said:
Nice guide, @bibikalka!
Although I can't help but think this could be made easier. If you guys update the LK exploit for the latest FW, then you won't need to reboot to the bootrom. If I understand correctly, the only reason that's necessary is to downgrade. Otherwise, everything could be flashed from the OS. And even if there is no way around clearing the RPMB, I'm pretty sure the crypto stuff could be done from the OS as root too.
Click to expand...
Click to collapse
Excellent points! I raised them before. And, there are a few practical challenges to consider
Updating LK exploits is very time consuming. It's easier to have people install Linux, and clear RPMB, than to hack every new LK version.
For example, I could not convince @xyz` yet to even fix his current exploit. As is, it writes at 2Mb offset into boot0 which is only 1Mb in size. So no easy dd access to the exploit address for now ...
Also, the approach presented here is quite generic, if HD10 gained an unlock, one could again clear RPMB, and use whatever LK was hacked.I
A few people could get by without clearing rpmb, but these would always be in minority ... So the current foolproof method is more complex, but also more general as well. It's a compromise!

I made it to bootrom-step.sh, and that appears to have run successfully. However now when I try
Code:
fastboot reboot recovery
I get the usage message for fastboot:
Code:
# ./bootrom-step.sh
[2019-03-04 00:27:18.798732] Waiting for bootrom
[2019-03-04 00:27:26.336656] Found port = /dev/ttyACM0
[2019-03-04 00:27:26.336890] Handshake
[2019-03-04 00:27:26.337276] Disable watchdog
* * * Remove the short and press Enter * * *
[2019-03-04 00:27:56.377687] Init crypto engine
[2019-03-04 00:27:56.395798] Disable caches
[2019-03-04 00:27:56.399726] Disable bootrom range checks
[2019-03-04 00:27:56.410763] Load payload from ../brom-payload/build/payload.bin = 0x4690 bytes
[2019-03-04 00:27:56.412639] Send payload
[2019-03-04 00:27:57.074721] Let's rock
[2019-03-04 00:27:57.075569] Wait for the payload to come online...
[2019-03-04 00:27:57.807523] all good
[2019-03-04 00:27:57.807917] Check GPT
[2019-03-04 00:27:58.164678] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 22480863)}
[2019-03-04 00:27:58.164880] Check boot0
[2019-03-04 00:27:58.410125] Check rpmb
[2019-03-04 00:27:58.619520] Downgrade rpmb
[2019-03-04 00:27:58.621743] Recheck rpmb
[2019-03-04 00:27:59.515990] rpmb downgrade ok
[2019-03-04 00:27:59.516232] Flash lk-payload
[4 / 4]
[2019-03-04 00:27:59.847318] Flash preloader
[288 / 288]
[2019-03-04 00:28:06.291277] Inject microloader
[4 / 4]
[2019-03-04 00:28:06.623363] Reboot to unlocked fastboot
[email protected]/amonet-lite# fastboot reboot recovery
usage: fastboot [ <option> ] <command>
commands:
update <filename> Reflash device from update.zip.
flashall Flash boot, system, vendor, and --
if found -- recovery.
flash <partition> [ <filename> ] Write a file to a flash partition.
flashing lock Locks the device. Prevents flashing.
...
A few things I was able to try:
At this point I have the amazon logo on a black screen:
Holding down the power button shuts off the tablet.
Issuing
Code:
fastboot reboot
reboots the tablet to the Amazon logo
Issuing
Code:
fastboot reboot-bootloader
reboots the table and I get a black screen with just
Code:
=> FASTBOOT mode...
at the bottom
If I shut down the tablet, and rerun the script, I get the following:
Code:
# ./bootrom-step.sh
[2019-03-04 00:39:41.574553] Waiting for bootrom
[2019-03-04 00:39:51.413047] Found port = /dev/ttyACM0
[2019-03-04 00:39:51.413639] Handshake
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 537, in write
n = os.write(self.fd, d)
OSError: [Errno 5] Input/output error
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "main.py", line 121, in <module>
main()
File "main.py", line 54, in main
handshake(dev)
File "/home/spdqbr/Fire HD 8 2018/amonet-lite/modules/handshake.py", line 9, in handshake
dev.handshake()
File "/home/spdqbr/Fire HD 8 2018/amonet-lite/modules/common.py", line 97, in handshake
c = self._writeb(b'\xa0')
File "/home/spdqbr/Fire HD 8 2018/amonet-lite/modules/common.py", line 91, in _writeb
self.dev.write(out_str)
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 571, in write
raise SerialException('write failed: {}'.format(e))
serial.serialutil.SerialException: write failed: [Errno 5] Input/output error
I appear to be stuck from this point. Do you have any suggestions?

@spdqbr - Sounds like your fastboot is out of date. Several of the mainstream repos have this problem. The reboot recovery option didn't come along until more recently. Try updating manually from sdk or Google for one of the updates you can wget and copy over the existing.

spdqbr said:
I made it to bootrom-step.sh, and that appears to have run successfully. However now when I try
Code:
fastboot reboot recovery
I get the usage message for fastboot:
...
I appear to be stuck from this point. Do you have any suggestions?
Click to expand...
Click to collapse
Ok, I think you have made it! You are success case #1 !!!
Turn the tablet off, and boot recovery by holding Vol buttons when you press Power to turn it on (the usual deal). I think I shall remove the unlocked fastboot flashing from amonet, since it only creates issues.
ktdt00 said:
@spdqbr - Sounds like your fastboot is out of date. Several of the mainstream repos have this problem. The reboot recovery option didn't come along until more recently. Try updating manually from sdk or Google for one of the updates you can wget and copy over the existing.
Click to expand...
Click to collapse
Interesting. Indeed then, it's another option - updating fastboot on Linux/Windows.

I've got a 2018 HD8 that's just sitting here with its battery dead waiting for this exact moment; however, my machine runs Windows (I know, I know).
Is there a LiveCD that you'd recommend to complete this task? Just straight up Ubuntu I assume? Haven't run Linux as my daily driver in a few years so thought I'd double check before downloading anything. For ModemManager I'd assume it would just be `sudo apt-get remove modemmanager` correct?
Thanks!

I've gotten through all the steps, but i'm stuck at fastboot reboot recovery, I am running on arch and have the latest android-tools, so it shouldn't be an out of date problem unless its a feature that hasn't hit actual release yet, holding volume when turning on doesn't do anything.
EDIT: Turns out the package is out of date, because google split adb and fastboot into seperate packages, I got the command working, but it doesn't reboot into twrp it just goes to the amazon logo again, and I never downloaded a twrp image as far as I know.
Also unless this changes this, the HD 8 can not boot to recovery with vol buttons, so removing the fastboot part may not be a great idea, at-least if I understand it right.
EDIT2: I figured it out, I had to download the non-lite amonet because it contained an extra fastboot shell script that actually flashed the recovery, amonet-lite didn't
EDIT3: TWRP cant find the boot_orig.bin file, it finds unlock_recovery-inj.img but not bin files, in both image and zip mode
Also flashing magisk worked, but flashing finalize_no_ota.zip errored with code 1, then any following attempts with code 255
EDIT4: I just ended up doing the rest of the instructions on the original guide, I had to factory reset but that's alright. Thanks, this worked and I never had to open my device! Tester #2 (or 3)
I can't wait to see roms for this, get rid of this amazon garbage