Related
Some of these commands can and will brick your phone.
Maybe this will be usefull.
fastboot oem
(bootloader) command list
(bootloader) dmesg
(bootloader) last_dmesg
(bootloader) clearaspflag
(bootloader) refurbish
(bootloader) get_identifier_token
(bootloader) checkKeycardID
(bootloader) get_tamper_flag
(bootloader) checkSbl1
(bootloader) checkHWSecurity
(bootloader) enter
(bootloader) keytest
(bootloader) heap
(bootloader) boot
(bootloader) reset
(bootloader) powerdown
(bootloader) rebootRUU
(bootloader) heap_test
(bootloader) erase_phone_storage
(bootloader) erase_nfc_record
(bootloader) gotohboot
(bootloader) resetgift
(bootloader) ats
(bootloader) rtask
(bootloader) task
(bootloader) enableqxdm
(bootloader) gencheckpt
(bootloader) readmeid
(bootloader) readpid
(bootloader) writepid
(bootloader) readcid
(bootloader) writecid
(bootloader) readimei
(bootloader) writeimei
(bootloader) readsecureflag
(bootloader) writesecureflag
(bootloader) ddr2gbh
(bootloader) ramdump2gbh
(bootloader) ddr2gstatus
(bootloader) get_temp
(bootloader) writemeid
(bootloader) lock
(bootloader) readusername
(bootloader) writeusername
(bootloader) resethtcdebugflag
(bootloader) load_emmc
(bootloader) check_emmc_mid
(bootloader) read_mmc
(bootloader) load_modem_emmc
(bootloader) get_wp_info_emmc
(bootloader) send_wp_info_emmc
(bootloader) get_ext_csd_emmc
(bootloader) get_sector_info_emmc
i dont understand how do you use it?
fasboot oem readcid?
hamdir said:
i dont understand how do you use it?
fasboot oem readcid?
Click to expand...
Click to collapse
Yes, in fastboot usb you have to type:
Code:
fastboot oem readcid
and you can see your cid.
You can use
Code:
fastboot getvar cid
too
what's refurbish for?
fastboot oem get_identifier_token...
shiningarmor said:
what's refurbish for?
Click to expand...
Click to collapse
I'm curious too. Refurbish sounds exciting. Someone should try it!
Sent from my HTC One
I will try ...
ECEXCURSION said:
I'm curious too. Refurbish sounds exciting. Someone should try it!
Sent from my HTC One
Click to expand...
Click to collapse
wouterx said:
I will try ...
Click to expand...
Click to collapse
[email protected]*******:~$ fastboot oem refurbish
< waiting for device >
...
(bootloader) Start Verify: 3
(bootloader) Start Verify: 3
(bootloader) Boot/Recovery signature checking...
(bootloader) TZ_HTC_SVC_HASH ret = 0
(bootloader) setup_tag addr=0x80600100 cmdline add=0x00347020
(bootloader) TAG:Ramdisk OK
(bootloader) TAG:skuid 0x34C0C
(bootloader) TAG:hero panel = 0x940069
(bootloader) TAG:engineerid = 0x0
(bootloader) TAG: PS ID = 0x0
(bootloader) TAG: Gyro ID = 0x2
(bootloader) Device CID is not super CID
(bootloader) CID is HTC__E11
(bootloader) setting->cid::HTC__E11
(bootloader) serial number: FA354W903578
(bootloader) commandline from head: console=ttyHSL0,115200,n8 androidboot
(bootloader) .hardware=m7 user_debug=31
(bootloader) command line length =866
(bootloader) active commandline: poweron_status=1 reset_status=0 board_m7
(bootloader) _ul.disable_uart3=0 diag.enabled=0 board_m7_ul.debug_uart=0
(bootloader) userdata_sel=0 androidboot.emmc=true androidboot.pagesize=20
(bootloader) 48 skuid=0 ddt=20 ats=0 dap=6 androidboot.lb=1 uif=O000 td.
(bootloader) sf=1 td.td=1 td.ofs=328 td.prd=1 td.dly=0 td.tmo=300 hlog.of
(bootloader) s=628 un.ofs=694 imc_online_log=0 androidboot.efuse_info=2N
(bootloader) SL androidboot.baseband=4A.14.3250.13 androidboot.cid=HTC__E
(bootloader) 11 androidboot.devicerev=3 androidboot.batt_poweron=good_bat
(bootloader) tery androidboot.car
(bootloader) aARM_Partion[0].name=misc
(bootloader) aARM_Partion[1].name=recovery
(bootloader) aARM_Partion[2].name=boot
(bootloader) aARM_Partion[3].name=system
(bootloader) aARM_Partion[4].name=local
(bootloader) aARM_Partion[5].name=cache
(bootloader) aARM_Partion[6].name=userdata
(bootloader) aARM_Partion[7].name=devlog
(bootloader) aARM_Partion[8].name=pdata
(bootloader) aARM_Partion[9].name=extra
(bootloader) aARM_Partion[A].name=radio
(bootloader) aARM_Partion.name=adsp
(bootloader) aARM_Partion[C].name=dsps
(bootloader) aARM_Partion[D].name=radio_config
(bootloader) aARM_Partion[E].name=modem_st1
(bootloader) aARM_Partion[F].name=modem_st2
(bootloader) aARM_Partion[10].name=cdma_record
(bootloader) aARM_Partion[11].name=reserve_1
(bootloader) aARM_Partion[12].name=reserve_2
(bootloader) aARM_Partion[13].name=reserve_3
(bootloader) aARM_Partion[14].name=reserve
(bootloader) partition number=21
(bootloader) Valid partition num=21
(bootloader) setting_get_bootmode() = 3
(bootloader) smem 8CF04000 (phy 8CF04000): TZ_HTC_SVC_UPDATE_SMEM ret = 0
(bootloader) TZ_HTC_SVC_ENC ret = 0
(bootloader) Start Verify: 3
(bootloader) TZ_HTC_SVC_ENC ret = 0
(bootloader) TZ_HTC_SVC_DISABLE ret = 205643776 (0xC41E000)
(bootloader) [PARTITION_ERR] partition_write_prot_emmc: Cannot find end p
(bootloader) artition [modem]
(bootloader) msm_mpu_emmc_protect: set write protection fail (from reserv
(bootloader) e_2 to modem)
(bootloader) Start Verify: 3
(bootloader) [RUMBA_S] firmware version: 3-45-43-33-0-0-0-0
(bootloader) [RUMBA_S] ondevice version: 3-45-43-33-4-28-A3-0
(bootloader) [RUMBA_S] firmware version already up-to-date
(bootloader) pm8921_vreg_disable function, vreg_id = 7
(bootloader) pm8921_vreg_disable function, vreg_id = 37
(bootloader) pm8921_vreg_disable function, vreg_id = 34
(bootloader) pm8921_vreg_disable function, vreg_id = 8
(bootloader) jump_to_kernel: machine_id(4308), tags_addr(0x80600100), ker
(bootloader) nel_addr(0x80608000)
(bootloader) -------------------hboot boot time:46925 msec
FAILED (status read failed (No such device))
finished. total time: 8.247s
In the end its boots in ClockworkMod Recovery....
bump! as we have s off for all!!!
Hey guys.
So, I'll be direct. None command worked on my RAZR D3.
Maybe fast boot have a limitation or some kind like that.
Did you see something like this?
Please, if you did, "quote me"hehe
Adriano-A3 said:
Hey guys.
So, I'll be direct. None command worked on my RAZR D3.
Maybe fast boot have a limitation or some kind like that.
Did you see something like this?
Please, if you did, "quote me"hehe
Click to expand...
Click to collapse
I think different hboots have different commands available, so between devices its likely that they will be different also.
Lol that's a very bad idea to post all those commands
If you dont know what it does.....don't use it!
Sent from my HTC One using xda app-developers app
zaphodbeeb said:
I think different hboots have different commands available, so between devices its likely that they will be different also.
Click to expand...
Click to collapse
Most of these commands are HTC-specific. They ain't gonna work on other phones.
Every phone has it's own set of "fastboot oem" commands, only the "fastboot" commands are universal.
Apart from that, Motorola phones don't use HBOOT(HTC BOOT). AFAIK they use a customized ABOOT.
Adriano-A3 said:
Hey guys.
So, I'll be direct. None command worked on my RAZR D3.
Please, if you did, "quote me"hehe
Click to expand...
Click to collapse
You should try on your Nokia 3310!
These commands are OEM-specific, i.e. not common for Android project.
need help
please "fastboot oem writeimei" gives command error please what can i do...
Sammie5 said:
please "fastboot oem writeimei" gives command error please what can i do...
Click to expand...
Click to collapse
you can't change the IMEI using this command and changing the IMEI number might be illegal in your country.
alray said:
you can't change the IMEI using this command and changing the IMEI number might be illegal in your country.
Click to expand...
Click to collapse
its not illegal here because i need to change it to connect to internet for some service providers
and please what is the command
Sammie5 said:
its not illegal here because i need to change it to connect to internet for some service providers
and please what is the command
Click to expand...
Click to collapse
There is no command to change the imei number and if you need to change your imei it means your phone is declared lost or stolen/linked to unpaid bills.
alray said:
There is no command to change the imei number and if you need to change your imei it means your phone is declared lost or stolen/linked to unpaid bills.
Click to expand...
Click to collapse
so it cant be changed?
Sammie5 said:
so it cant be changed?
Click to expand...
Click to collapse
short answer, no
sorry
I feel like if we put together a thread, we can share our progress and knowledge on unlocking the Fire HD bootloader which will allow us to root and install custom roms. I want to just put out into the open that I am a noob to Android so I may not make sense sometimes.
I am going to post all the information about the bootloader in this thread, so that people who do not have an HD device can still debug and poke around a little. It is going to start off small, but if people are willing to contribute their knowledge we will add it to the thread!
$ fastboot getvar all
Code:
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x4ad481f13eb0c4d7
(bootloader) prod: 1
(bootloader) serialno: G090G80953540BQG
(bootloader) partition-offset:userdata: 5ec80000
(bootloader) partition-size:userdata: 173f7be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-offset:cache: 4f280000
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-offset:system: 4280000
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-offset:persisbackup: 3280000
(bootloader) partition-size:persisbackup: 1000000
(bootloader) partition-type:persisbackup: unknown
(bootloader) partition-offset:MISC: 3200000
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-offset:DKB: 3100000
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-offset:KB: 3000000
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) partition-offset:recovery: 2800000
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-offset:boot: 2000000
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: unknown
(bootloader) partition-offset:UBOOT: 1f00000
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-offset:TEE2: 1a00000
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-offset:TEE1: 1500000
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-offset:PMT: 1100000
(bootloader) partition-size:PMT: 400000
(bootloader) partition-type:PMT: unknown
(bootloader) partition-offset:PRO_INFO: 1008000
(bootloader) partition-size:PRO_INFO: 20000
(bootloader) partition-type:PRO_INFO: unknown
(bootloader) max-download-size: 52429824
(bootloader) kernel: lk
(bootloader) product: THEBES
(bootloader) version: 0.5
(bootloader) unlocked: not unlocked
(bootloader) production: Unknown
all: Done!!
finished. total time: 0.022s
nyln said:
I feel like if we put together a thread, we can share our progress and knowledge on unlocking the Fire HD bootloader which will allow us to root and install custom roms. I want to just put out into the open that I am a noob to Android so I may not make sense sometimes.
I am going to post all the information about the bootloader in this thread, so that people who do not have an HD device can still debug and poke around a little. It is going to start off small, but if people are willing to contribute their knowledge we will add it to the thread!
$ fastboot getvar all
Code:
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0x4ad481f13eb0c4d7
(bootloader) prod: 1
(bootloader) serialno: G090G80953540BQG
(bootloader) partition-offset:userdata: 5ec80000
(bootloader) partition-size:userdata: 173f7be00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-offset:cache: 4f280000
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-offset:system: 4280000
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-offset:persisbackup: 3280000
(bootloader) partition-size:persisbackup: 1000000
(bootloader) partition-type:persisbackup: unknown
(bootloader) partition-offset:MISC: 3200000
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-offset:DKB: 3100000
(bootloader) partition-size:DKB: 100000
(bootloader) partition-type:DKB: unknown
(bootloader) partition-offset:KB: 3000000
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) partition-offset:recovery: 2800000
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-offset:boot: 2000000
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: unknown
(bootloader) partition-offset:UBOOT: 1f00000
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-offset:TEE2: 1a00000
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-offset:TEE1: 1500000
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-offset:PMT: 1100000
(bootloader) partition-size:PMT: 400000
(bootloader) partition-type:PMT: unknown
(bootloader) partition-offset:PRO_INFO: 1008000
(bootloader) partition-size:PRO_INFO: 20000
(bootloader) partition-type:PRO_INFO: unknown
(bootloader) max-download-size: 52429824
(bootloader) kernel: lk
(bootloader) product: THEBES
(bootloader) version: 0.5
(bootloader) unlocked: not unlocked
(bootloader) production: Unknown
all: Done!!
finished. total time: 0.022s
Click to expand...
Click to collapse
i wish i had a second one lying around so that i could help out on these initial stages. as it stands, we need a better bootloader. as we get closer to the goal, i'll feel more comfortable using my mom's HD 10.
Having toyed around with fastboot, it seems to me that the blank fastboot screen is less of an issue and more of an added security measure. I think the focus should be on the current capabilities of the bootloader via fastboot, but I'm usually just a novice, instead of focusing on that it's a blank screen. Such as, if you run 2015 7" root scripts on the HD 8/10 it refuses with errors, not lack of device communication. I'd dive in deeper but this is a Christmas gift that I'm using daily around the living room.
I know I'm somewhat stating the obvious but I've read a lot of misleading post regarding a "proper fastboot". I'm thinking this is just an evolved bootloader instead.
madsc13n41s4 said:
Having toyed around with fastboot, it seems to me that the blank fastboot screen is less of an issue and more of an added security measure. I think the focus should be on the current capabilities of the bootloader via fastboot, but I'm usually just a novice, instead of focusing on that it's a blank screen. Such as, if you run 2015 7" root scripts on the HD 8/10 it refuses with errors, not lack of device communication. I'd dive in deeper but this is a Christmas gift that I'm using daily around the living room.
I know I'm somewhat stating the obvious but I've read a lot of misleading post regarding a "proper fastboot". I'm thinking this is just an evolved bootloader instead.
Click to expand...
Click to collapse
I would be happy to setup my device remotely if anyone wants to tinker with the fastboot console.
Is anyone interested in giving me commands to run on my device?
I would start by taking a look at the rootjunkie 5th gen supertool for the 2015 7". Its probably the closest compatible effort, fastboot commands are in the .bat files. You look like you know a thing or two about scripts.
madsc13n41s4 said:
I would start by taking a look at the rootjunkie 5th gen supertool for the 2015 7". Its probably the closest compatible effort, fastboot commands are in the .bat files. You look like you know a thing or two about scripts.
Click to expand...
Click to collapse
I have already tried this, there is a different fastboot screen, and the bootloader unlock command does not function on HD models.
Send me commands to try if you want me too.
Hi everybody,
I have a moto x play updated to 6.0 official that i am trying to unlock to root but so far failed.
I have installed ALL drivers then uninstalled then reinstalled more than five times but still failed to get unlock string.
The device is seen in adb/fastboot and the bootloader logs on the device show the commands i am sending but it still says failed try again.
I have followed all advice given on the other posts but same message, so i typed in the getvar all cmd hopeing it could help someone find a solution thanks in advance.
C:\Users\Sandwiches>fastboot devices
ZY22247TWN fastboot
C:\Users\Sandwiches>fastboot oem get_unlock_data
...
(bootloader) Failed to get unlock data, please try again!
FAILED (remote failure)
finished. total time: 0.281s
C:\Users\Sandwiches>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: moto-msm8939-80.EC
(bootloader) product: lux
(bootloader) board: lux
(bootloader) secure: yes
(bootloader) hwrev: 0x82C0
(bootloader) radio: 0x4
(bootloader) emmc: 16GB Toshiba REV=07 PRV=00 TYPE=57
(bootloader) ram: 2048MB Samsung S8 SDRAM DIE=4Gb
(bootloader) cpu: MSM8939
(bootloader) serialno: ZY22247TWN
(bootloader) cid: 0x0000
(bootloader) channelid: 0x00
(bootloader) uid: 54FE1D0400000000000000000000
(bootloader) unlocked: no
(bootloader) securestate: locked
(bootloader) iswarrantyvoid: no
(bootloader) mot_sst: 0
(bootloader) max-download-size: 268435456
(bootloader) reason: Reboot mode set to fastboot
(bootloader) imei: 358967060920707
(bootloader) meid:
(bootloader) date: 08-14-2015
(bootloader) sku: XT1562
(bootloader) battid:
(bootloader) iccid:
(bootloader) cust_md5:
(bootloader) max-sparse-size: 268435456
(bootloader) current-time: "Mon Feb 22 16:31:24 UTC 2016"
(bootloader) ro.build.fingerprint[0]: motorola/lux_reteu/lux:6.0/MPD24.6
(bootloader) ro.build.fingerprint[1]: 5-18.1/1:user/release-keys
(bootloader) ro.build.version.full[0]: Blur_Version.24.14.1.lux_reteu.re
(bootloader) ro.build.version.full[1]: teu.en.EU
(bootloader) ro.build.version.qcom[0]: AU_LINUX_ANDROID_LA.BR.1.1.3_RB1.
(bootloader) ro.build.version.qcom[1]: 05.01.00.032.015
(bootloader) version-baseband: M8936_2020628.40.03.21.50R LUX_EMEA_CUST
(bootloader) kernel.version[0]: Linux version 3.10.49-g6dd1a6d (hudsoncm
(bootloader) kernel.version[1]: @ilclbld73) (gcc version 4.8 (GCC) ) #1
(bootloader) kernel.version[2]: SMP PREEMPT Thu Dec 3 16:18:03 CST 2015
(bootloader) sbl1.git: git=MBM-NG-V80.EC-0-g7abea31
(bootloader) rpm.git: git=MBM-NG-V80.EC-0-g932f716
(bootloader) tz.git: git=MBM-NG-V80.EC-0-ga1c5ae6
(bootloader) hyp.git: git=MBM-NG-V80.EC-0-ga1c5ae6
(bootloader) aboot.git: git=MBM-NG-V80.EC-0-gcfa8344
(bootloader) partition-type:modem: raw
(bootloader) partition-type:sbl1: raw
(bootloader) partition-typeDR: raw
(bootloader) partition-type:aboot: raw
(bootloader) partition-type:rpm: raw
(bootloader) partition-type:tz: raw
(bootloader) partition-type:hyp: raw
(bootloader) partition-type:utags: raw
(bootloader) partition-type:misc: raw
(bootloader) partition-typeadA: raw
(bootloader) partition-type:abootBackup: raw
(bootloader) partition-type:rpmBackup: raw
(bootloader) partition-type:tzBackup: raw
(bootloader) partition-type:hypBackup: raw
(bootloader) partition-type:utagsBackup: raw
(bootloader) partition-type:logs: raw
(bootloader) partition-type:frp: raw
(bootloader) partition-typeadB: raw
(bootloader) partition-type:modemst1: raw
(bootloader) partition-type:modemst2: raw
(bootloader) partition-type:hob: raw
(bootloader) partition-type:dhob: raw
(bootloader) partition-type:fsg: raw
(bootloader) partition-type:fsc: raw
(bootloader) partition-type:cid: raw
(bootloader) partition-type:metadata: raw
(bootloader) partition-type:logo: raw
(bootloader) partition-type:clogo: raw
(bootloader) partition-typeersist: raw
(bootloader) partition-type:kpan: raw
(bootloader) partition-type:boot: raw
(bootloader) partition-type:recovery: raw
(bootloader) partition-type:ssd: raw
(bootloader) partition-typeadC: raw
(bootloader) partition-type:sp: raw
(bootloader) partition-type:keystore: raw
(bootloader) partition-type:customize: raw
(bootloader) partition-typeem: raw
(bootloader) partition-type:carrier: ext4
(bootloader) partition-type:cache: raw
(bootloader) partition-type:system: raw
(bootloader) partition-type:userdata: raw
(bootloader) partition-size:modem: 0x00000000027e0000
(bootloader) partition-size:sbl1: 0x0000000000080000
(bootloader) partition-sizeDR: 0x0000000000020000
(bootloader) partition-size:aboot: 0x0000000000113000
(bootloader) partition-size:rpm: 0x000000000003e800
(bootloader) partition-size:tz: 0x000000000008c000
(bootloader) partition-size:hyp: 0x0000000000020000
(bootloader) partition-size:utags: 0x0000000000080000
(bootloader) partition-size:misc: 0x0000000000080000
(bootloader) partition-sizeadA: 0x000000000036f000
(bootloader) partition-size:abootBackup: 0x0000000000113000
(bootloader) partition-size:rpmBackup: 0x000000000003e800
(bootloader) partition-size:tzBackup: 0x000000000008c000
(bootloader) partition-size:hypBackup: 0x0000000000020000
(bootloader) partition-size:utagsBackup: 0x0000000000080000
(bootloader) partition-size:logs: 0x0000000000200000
(bootloader) partition-size:frp: 0x0000000000080000
(bootloader) partition-sizeadB: 0x000000000022f000
(bootloader) partition-size:modemst1: 0x0000000000180000
(bootloader) partition-size:modemst2: 0x0000000000180000
(bootloader) partition-size:hob: 0x000000000007a000
(bootloader) partition-size:dhob: 0x0000000000008000
(bootloader) partition-size:fsg: 0x0000000000180000
(bootloader) partition-size:fsc: 0x0000000000000400
(bootloader) partition-size:cid: 0x0000000000020000
(bootloader) partition-size:metadata: 0x0000000000080000
(bootloader) partition-size:logo: 0x0000000000600000
(bootloader) partition-size:clogo: 0x0000000000600000
(bootloader) partition-sizeersist: 0x0000000000800000
(bootloader) partition-size:kpan: 0x0000000000800000
(bootloader) partition-size:boot: 0x0000000002000000
(bootloader) partition-size:recovery: 0x0000000001ffc000
(bootloader) partition-size:ssd: 0x0000000000002000
(bootloader) partition-sizeadC: 0x000000000061e000
(bootloader) partition-size:sp: 0x0000000000800000
(bootloader) partition-size:keystore: 0x0000000000800000
(bootloader) partition-size:customize: 0x0000000002000000
(bootloader) partition-sizeem: 0x0000000001000000
(bootloader) partition-size:carrier: 0x0000000001000000
(bootloader) partition-size:cache: 0x0000000030000000
(bootloader) partition-size:system: 0x00000000aa000000
(bootloader) partition-size:userdata: 0x00000002c03e0000
(bootloader) qe: qe 0/0
(bootloader) frp-state: no protection (0)
(bootloader) ro.carrier: unknown
all: listed above
finished. total time: 0.452s
Make sure that OEM Unlocking is enabled in Developer Options. I had the same problem when I did mine.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Sent from my Moto X Play
I used this tool "WinDroid" to unlock the bootloader. Its fully automated and very easy to use.
You can unlock your bootloader only with a few mouse clicks. Very handy tool :good:
http://forum.xda-developers.com/showthread.php?t=2499926
moto
brian10161 said:
Make sure that OEM Unlocking is enabled in Developer Options. I had the same problem when I did mine.
Sent from my Moto X Play
Click to expand...
Click to collapse
They are all enabled.
Developer Options are enabled
Usb debug enabled
oem unlocking enabled
Thats what i can't understand.
Sickaxis79 said:
I used this tool "WinDroid" to unlock the bootloader. Its fully automated and very easy to use.
You can unlock your bootloader only with a few mouse clicks. Very handy tool :good:
http://forum.xda-developers.com/showthread.php?t=2499926
Click to expand...
Click to collapse
i have tried the tool suggested gives me an error contact xda devs message.
That is very weird. Just wondering, can you try using mfasboot instead of fastboot? It's the Motorola branded version of the software. Maybe it will help?
Sent from my Moto X Play
brian10161 said:
That is very weird. Just wondering, can you try using mfasboot instead of fastboot? It's the Motorola branded version of the software. Maybe it will help?
Sent from my Moto X Play
Click to expand...
Click to collapse
Same message
(bootloader) Failed to get unlock data, please try again!
FAILED (remote failure)
finished. total time: 0.268s
I did have it sent for repair a couple of weeks ago because i forget my gmail account details, do you think that has somethink to do with it.
I do not think it will help but maybe worth a try to just factory reset it and see if has an effect.
That might be your best net, you will be erased anyway when you unlock so nothing to lose attempting it.
Sent from my XT1563 using Tapatalk
No luck, i will try a full windows reinstall tomorrow maybe that will help if not i am stuck with a unrooted phone :crying:
I don't think reinstalling Windows will be necessary. I have a feeling something has changed as far as Moto goes. Does your phone have any subsidy on it? Was it purchased out right? Maybe a network unlock is needed? What carrier, if it applies, was it purchased through?
Sent from my Moto G 2014 using Tapatalk
brian10161 said:
I don't think reinstalling Windows will be necessary. I have a feeling something has changed as far as Moto goes. Does your phone have any subsidy on it? Was it purchased out right? Maybe a network unlock is needed? What carrier, if it applies, was it purchased through?
Sent from my Moto G 2014 using Tapatalk
Click to expand...
Click to collapse
What do you mean by subsidy?.
It was purchased on ebay a couple of days before official launch day. It was unlocked out of the box to any carrier and i haven't had a sim in it at all as i have another phone for that.
Oh okay. A subsidy, in what I'm referring to, is when a phone is purchased with a contract or a tab and has a debt owed against the phone.
Just was curious. But if the phone was purchased before launch I'm wondering if maybe it has a special board with older software in it that won't allow a bootloader unlock.
Very strange, I have never seen anything like it.
Sent from my Moto X Play
No subsidy no contacts.
I brought it off the top of my head between 3-7 days before launch day.
I won't know about old software stuff i'm a novice at the stuff its my second phone in 11 years! and both i've had in the last year so i'm new to this stuff.
brian10161 said:
Oh okay. A subsidy, in what I'm referring to, is when a phone is purchased with a contract or a tab and has a debt owed against the phone.
Just was curious. But if the phone was purchased before launch I'm wondering if maybe it has a special board with older software in it that won't allow a bootloader unlock.
Very strange, I have never seen anything like it.
Sent from my Moto X Play
Click to expand...
Click to collapse
A part from unique id strings and region code from this guys getvar all info it looks the same as mine. But i did notice his bootloader date is older (bootloader) date: 08-05-2015 vs mine (bootloader) date: 08-14-2015 if that counts at all, like i said i am new to this.
http://forum.xda-developers.com/mot...nlock-data-t3225594/post63320372#post63320372
Try this fastboot and unlock bootloader
http://forum.xda-developers.com/showthread.php?p=48915118#post48915118
if nothing works ask the service center guys to unlock it.
Have you also installed the Motorola device drivers?
drmuruga said:
Try this fastboot and unlock bootloader
http://forum.xda-developers.com/showthread.php?p=48915118#post48915118
Click to expand...
Click to collapse
Thats what i am using when receiving the failed message and its been tried as admin and without still the same.
Sickaxis79 said:
Have you also installed the Motorola device drivers?
Click to expand...
Click to collapse
I have installed and reinstalled the moto device manager/drivers and the ADB Installer v1.4.3 exactly as instructed + i have used fastboot, mfastboot and tried out the windroid toolkit.
I have usb debug, oem unlocking and dev options enabled.
hello everybody said:
I have installed and reinstalled the moto device manager/drivers and the ADB Installer v1.4.3 exactly as instructed + i have used fastboot, mfastboot and tried out the windroid toolkit.
I have usb debug, oem unlocking and dev options enabled.
Click to expand...
Click to collapse
Maybe you could try using another pc from someone else and see if it works. Its a very strange situation.
Hi everyone,
First sorry for my English, I'm Vietnamese. I bought fire hd 8 6th used for a cheap price, I want to flash new rom via sideload becase i didn't find any topic about flashtool for fire hd tablet, so i decided to sideload it but unfortunately sideload processing to 47% and fail all of time, so i did some research and know that method only working on non modification devices, and my tablet already unlocked bootloader.. maybe, i knew it by using fastboot getvar unlocked and it say Yes. I thought with unblocked bootloader might be able to flash custom recovery to install a new rom, i tried and the results is writing recovery done but when device boot to recovery mode by holding power + volume down button nothing appear still remain blackscreen with recovery mode text from bottom left and with the bonus thing is Stock recovery is gone. Just for my stupid action, its bricked with only fastboot mode is accessible
I'm sorry for taking to long. Please let me know if you have any advice and stock recovery please share me
Thank you so much!
Issue solved thanks for k4y0z. Here is the recovery image file
https://forum.xda-developers.com/showpost.php?p=79663247&postcount=21
and the instruction for create recovery
https://forum.xda-developers.com/showpost.php?p=79656602&postcount=10
vnhatduy2010 said:
Hi everyone,
First sorry for my English, I'm Vietnamese. I bought fire hd 8 6th used for a cheap price, I want to flash new rom via sideload becase i didn't find any topic about flashtool for fire hd tablet, so i decided to sideload it but unfortunately sideload processing to 47% and fail all of time, so i did some research and know that method only working on non modification devices, and my tablet already unlocked bootloader.. maybe, i knew it by using fastboot getvar unlocked and it say Yes. I thought with unblocked bootloader might be able to flash custom recovery to install a new rom, i tried and the results is writing recovery done but when device boot to recovery mode by holding power + volume down button nothing appear still remain blackscreen with recovery mode text from bottom left and with the bonus thing is Stock recovery is gone. Just for my stupid action, its bricked with only fastboot mode is accessible
I'm sorry for taking to long. Please let me know if you have any advice and stock recovery please share me
Thank you so much!
Click to expand...
Click to collapse
Impossible that you have unlocked BL. Can you post the output of fastboot getvar all?
Thanks!
Rortiz2 said:
Impossible that you have unlocked BL. Can you post the output of fastboot getvar all?
Thanks!
Click to expand...
Click to collapse
Hi sorry for late reply
this is the output of getvar all
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>fastboot devices
G000L40360860685 fastboot
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>fastboot getvar all
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlock_code: 0x2a2097d9656b4eed
(bootloader) serialno: G000L40360860685
(bootloader) max-download-size: 0x6d00000
(bootloader) partition-size:userdata: 69d6fbe00
(bootloader) partition-type:userdata: ext4
(bootloader) partition-sizeMT: 438000
(bootloader) partition-typeMT: ext4
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: ext4
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: ext4
(bootloader) partition-size:dfs: 20000000
(bootloader) partition-type:dfs: ext4
(bootloader) partition-size:dkernel: 1000000
(bootloader) partition-type:dkernel: ext4
(bootloader) partition-size:cache: 1a800000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 64e48000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:dkb: 100000
(bootloader) partition-type:dkb: raw data
(bootloader) partition-size:kb: 100000
(bootloader) partition-type:kb: raw data
(bootloader) partition-size:metadata: 2760000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:tee2: 500000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:expdb: a00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-sizeara: 80000
(bootloader) partition-typeara: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: ext4
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: fe3000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:lk: 7d000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:seccfg: 40000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-sizerotect2: a00000
(bootloader) partition-typerotect2: ext4
(bootloader) partition-sizerotect1: a00000
(bootloader) partition-typerotect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-sizeroinfo: 300000
(bootloader) partition-typeroinfo: raw data
(bootloader) partition-sizereloader: 40000
(bootloader) partition-typereloader: raw data
(bootloader) off-mode-charge: 1
(bootloader) warranty: no
(bootloader) unlocked: yes
(bootloader) secure: no
(bootloader) kernel: lk
(bootloader) product: GIZA
(bootloader) version-preloader: 0.1.00
(bootloader) version: 0.5
(bootloader) partition-size:userdata: 69d6fbe00
(bootloader) partition-type:userdata: ext4
(bootloader) partition-sizeMT: 438000
(bootloader) partition-typeMT: ext4
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: ext4
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: ext4
(bootloader) partition-size:dfs: 20000000
(bootloader) partition-type:dfs: ext4
(bootloader) partition-size:dkernel: 1000000
(bootloader) partition-type:dkernel: ext4
(bootloader) partition-size:cache: 1a800000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 64e48000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:dkb: 100000
(bootloader) partition-type:dkb: raw data
(bootloader) partition-size:kb: 100000
(bootloader) partition-type:kb: raw data
(bootloader) partition-size:metadata: 2760000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:tee2: 500000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:expdb: a00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-sizeara: 80000
(bootloader) partition-typeara: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: ext4
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: fe3000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:lk: 7d000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:seccfg: 40000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-sizerotect2: a00000
(bootloader) partition-typerotect2: ext4
(bootloader) partition-sizerotect1: a00000
(bootloader) partition-typerotect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-sizeroinfo: 300000
(bootloader) partition-typeroinfo: raw data
(bootloader) partition-sizereloader: 40000
(bootloader) partition-typereloader: raw data
all: Done!!
finished. total time: 0.207s
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>
Click to expand...
Click to collapse
Thank you
vnhatduy2010 said:
Hi sorry for late reply
this is the output of getvar all
Code:
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlocked: yes
(bootloader) secure: no
Thank you
Click to expand...
Click to collapse
What?
You can create the recovery from the boot-image using the install-recovery.sh script.
If you have unmodified boot and system it should happen automatically on boot.
Otherwise you can modify the script to read boot.img from a file.
What?
You can create the recovery from the boot-image using the install-recovery.sh script.
If you have unmodified boot and system it should happen automatically on boot.
Otherwise you can modify the script to read boot.img from a file.
Click to expand...
Click to collapse
Hi that mean my device not unlocked yet?
I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~
vnhatduy2010 said:
Hi I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~
Click to expand...
Click to collapse
Post the contents of the script here please.
The firmware-bin is just a ZIP-file, no special tools needed to extract it.
vnhatduy2010 said:
Hi that mean my device not unlocked yet?
I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~
Click to expand...
Click to collapse
Are you sure that is the Fire HD8 2016? Nvm, yes it's 2016: GIZA.
How did you unlocked the BL?
k4y0z said:
Post the contents of the script here please.
The firmware-bin is just a ZIP-file, no special tools needed to extract it.
Click to expand...
Click to collapse
yes I extracted with Winrar but after that I stuck with img file and windows can't open that file type.
btw here is the scritpt
Code:
#!/system/bin/sh
if ! applypatch -c EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:9218048:a1aff37711937c43c8bd4396803fb254a35db53a; then
applypatch -b /system/etc/recovery-resource.dat EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:8607744:05901192d8e64b20a9eabbddbf8b92b1ec0ca492 EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p && echo "
Installing new recovery image: succeeded
" >> /cache/recovery/log || echo "
Installing new recovery image: failed
" >> /cache/recovery/log
else
log -t recovery "Recovery image already installed"
fi
Rortiz2 said:
Are you sure that is the Fire HD8 2016? Nvm, yes it's 2016: GIZA.
How did you unlocked the BL?
Click to expand...
Click to collapse
I don't know this is the used device maybe the old owner unlocked it, I'm not sure about it maybe my wrong,
did you noticed anything from my getvar output?
vnhatduy2010 said:
yes I extracted with Winrar but after that I stuck with img file and windows can't open that file type.
btw here is the scritpt
Code:
#!/system/bin/sh
if ! applypatch -c EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:9218048:a1aff37711937c43c8bd4396803fb254a35db53a; then
applypatch -b /system/etc/recovery-resource.dat EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:8607744:05901192d8e64b20a9eabbddbf8b92b1ec0ca492 EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p && echo "
Installing new recovery image: succeeded
" >> /cache/recovery/log || echo "
Installing new recovery image: failed
" >> /cache/recovery/log
else
log -t recovery "Recovery image already installed"
fi
Click to expand...
Click to collapse
OK, make sure the firmware you have extracted is the same version you have installed.
Then copy the boot.img from the firmware to /sdcard
Code:
adb push boot.img /sdcard/
Then go into adb shell and run the following command
Code:
applypatch -b /system/etc/recovery-resource.dat /sdcard/boot.img /sdcard/recovery.img a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p
It should create /sdcard/recovery.img
You can pull it
Code:
adb pull /sdcard/recovey.img
If it isn't the same version you have installed (or the files have been modified to prevent recovery from being overwritten), you will have to extract the files
Code:
/system/etc/recovery-resource.dat
/system/recovery-from-boot.p
and place them on the device as well.
Thanks k4y0z but like i said on first post when i boot into recovery mode by holding power + volume down, nothing come up only the blackscreen with recovery mode text and my pc only regconize fastboot mode but recovery mode pc regconize as MTP device and no devices attached in cmd even i'm trying to reinstall driver and try on different pc, that mean i can't use adb command.
it's no hope:crying:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
vnhatduy2010 said:
Thanks k4y0z but like i said on first post when i boot into recovery mode by holding power + volume down, nothing come up only the blackscreen with recovery mode text and my pc only regconize fastboot mode but recovery mode pc regconize as MTP device and no devices attached in cmd even i'm trying to reinstall driver and try on different pc, that mean i can't use adb command.
it's no hope:crying:
Click to expand...
Click to collapse
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.
k4y0z said:
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.
Click to expand...
Click to collapse
Why he has the BL unlocked if it is a HD8 2016? Did you ported the exploit to that device?
Rortiz2 said:
Why he has the BL unlocked if it is a HD8 2016? Did you ported the exploit to that device?
Click to expand...
Click to collapse
No, I don't own that device. I don't think it really is unlocked, but the getvar output seems to be self-contradicting, as I noted above:
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlocked: yes
(bootloader) secure: no
Click to expand...
Click to collapse
k4y0z said:
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.
Click to expand...
Click to collapse
you right recovery completely broken, i tried to figure out but still don't know how to flash recovery produce by the script can we flash recovery.img file from the other kindle fire tablet like Hd 7 or Hd 8 older gen?
k4y0z said:
No, I don't own that device. I don't think it really is unlocked, but the getvar output seems to be self-contradicting, as I noted above:
Click to expand...
Click to collapse
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?
Rortiz2 said:
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?
Click to expand...
Click to collapse
I hope so, if can be flash recovery it will great
Rortiz2 said:
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?
Click to expand...
Click to collapse
vnhatduy2010 said:
I hope so, if can be flash recovery it will great
Click to expand...
Click to collapse
According to the OP, you said, that fastboot flash was working.
Another option would be to flash from a rooted system.
k4y0z said:
According to the OP, you said, that fastboot flash was working.
Another option would be to flash from a rooted system.
Click to expand...
Click to collapse
yeah, fastboot still working fine but recovery is broken so i can't access and using adb command just only fastboot command, fastboot flash recovery command working but when i reboot to recovery nothing come up, maybe recovery image not compatible with hd 8 6th gen
vnhatduy2010 said:
yeah, fastboot still working fine but recovery is broken so i can't access and using adb command just only fastboot command, fastboot flash recovery command working but when i reboot to recovery nothing come up, maybe recovery image not compatible with hd 8 6th gen
Click to expand...
Click to collapse
Well, what recovery are you flashing?
It needs to be for GIZA.
I have given you instructions how to create a proper recovery-image.
What firmware-version do you have installed?
I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
paklids said:
I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
Hi,
So looks like you downgraded the Preloader to version that has non-patched rw commands:good:
I can try to help you. If you want, just PM me.
Regards.
I'm going to add some details to the thread so peeps know where I'm coming from and where I'm going:
This unit, if you want to get into adb you'll need to enable adb debugging in the menu. After that you cannot reboot directly into fastboot mode, but you can hop over to recovery and then do it from there:
`adb reboot recovery` then select `reboot to recovery`
When the unit is stock (in my case v5.6.1.0) and on adb - the lsusb is:
Bus 005 Device 124: ID 1949:0212 Lab126, Inc.
& on fastboot lsusb reports:
Bus 005 Device 003: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo
(Hey...that looks familiar! I had an HTC Magic that I rooted the first day I owned it)
What did I do to put this unit in preloader loop? I booted into revocery and used adb sideload to flash (I *think*) update-kindle-32.5.2.2_user_522054520.bin . After that the screen went black and I could see it rebooting because the USB would come up and then back down. lsusb would then report:
Bus 001 Device 105: ID 0e8d:3000 MediaTek Inc.
I hope this helps any of you follow along in case you are trying to recover your Fire HD 8 5th gen (2015)
Oh, and here are the details I gathered from the known working tablet:
fastboot getvar all
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0xFFFFFFFFFFFFFFFF
(bootloader) prod: 1
(bootloader) serialno: FFFFFFFFFFFFFFFF
(bootloader) partition-offset:userdata: 5ec80000
(bootloader) partition-size:userdata: 173bfbe00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-offset:cache: 4f280000
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-offset:system: 4280000
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-offsetersisbackup: 3280000
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: unknown
(bootloader) partition-offset:MISC: 3200000
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-offsetKB: 3100000
(bootloader) partition-sizeKB: 100000
(bootloader) partition-typeKB: unknown
(bootloader) partition-offset:KB: 3000000
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) partition-offset:recovery: 2800000
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-offset:boot: 2000000
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: unknown
(bootloader) partition-offset:UBOOT: 1f00000
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-offset:TEE2: 1a00000
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-offset:TEE1: 1500000
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-offsetMT: 1100000
(bootloader) partition-sizeMT: 400000
(bootloader) partition-typeMT: unknown
(bootloader) partition-offsetRO_INFO: 1008000
(bootloader) partition-sizeRO_INFO: 20000
(bootloader) partition-typeRO_INFO: unknown
(bootloader) max-download-size: 52429824
(bootloader) kernel: lk
(bootloader) product: THEBES
(bootloader) version: 0.5
(bootloader) unlocked: not unlocked
(bootloader) production: Unknown
all: Done!!
So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin
paklids said:
I have 3 of these, so I'm being a little carefree.
...
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
paklids said:
So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin
Click to expand...
Click to collapse
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))
Just a note for anyone else, sometimes running ./handshake.py as a regular user will just continue waiting. I ran it as root and it completed quickly. This isn't uncommon with a number of linux distributions (I'm on Debian 9 Stretch) because of the permissions on /dev/tty type devices. It's always recommended that if you can run it as a regular user, then that is better. It may be possible to use sudo to do this as well.
bibikalka said:
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))
Click to expand...
Click to collapse
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.
Rortiz2 said:
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.
Click to expand...
Click to collapse
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).
bibikalka said:
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).
Click to expand...
Click to collapse
any one cant root this ?