[BOOTLOADER] 2nd-Bootloader/Recovery unlock process for KFire 2 [TWRP 2.6.3.0]

Search This thread

soupmagnet

Retired Forum Moderator
Jan 7, 2012
3,990
2,587
Austin, TX
Google Pixel 6
Is it not possible to downgrade to an earlier version via fastboot?

See above, and now below...

We might still be able to re-flash the 2nd-bootloader from 10.2.4 where this hole exists, but this is unconfirmed as of yet.

If you are on the 10.3.0 software you will NOT be able to use the OP's instructions for applying the 2nd-bootloader fix. Hold off until we figure out of re-flashing the 10.2.4 bootloader works.
 
  • Like
Reactions: flopower1996

flopower1996

Senior Member
Sep 8, 2012
679
235
AW: [BOOTLOADER] 2nd-Bootloader/Recovery unlock process for Kindle Fire 2

Haha thanks.

Gesendet von meinem LG-P990 mit Tapatalk 2
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Instructions for flashing your bootloader back to the 10.2.4 binary (this worked for the KFireHD 8.9 -- thanks to soupmagnet for testing):

Link to the 10.2.4 u-boot (bootloader) file for the Kindle Fire 2 here:
http://goo.im/devs/Hashcode/otter2/otter2-u-boot-prod-10.2.4.bin
md5sum 5b03a7b428325de8d360ec201a745498
(You SHOULD check this before using fastboot -- downloads CAN be corrupted)

And this is flashed via fastboot with:
Code:
fastboot -i 0x1949 flash bootloader otter2-u-boot-prod-10.2.4.bin
 
  • Like
Reactions: aarons510

aarons510

Senior Member
Mar 28, 2012
72
9
Instructions for flashing your bootloader back to the 10.2.4 binary (this worked for the KFireHD 8.9 -- thanks to soupmagnet for testing):

Link to the 10.2.4 u-boot (bootloader) file for the Kindle Fire 2 here:
http://goo.im/devs/Hashcode/otter2/otter2-u-boot-prod-10.2.4.bin
md5sum 5b03a7b428325de8d360ec201a745498
(You SHOULD check this before using fastboot -- downloads CAN be corrupted)

And this is flashed via fastboot with:
Code:
fastboot -i 0x1949 flash bootloader otter2-u-boot-prod-10.2.4.bin
I did this and it seemed to work, judging from the Terminal responses (which I unfortunately seem to have failed to save). But how can I verify that it has, and that the 10.2.4 bootloader is installed? (The System version still shows as 10.3.0_user_xxxxxxx, which I presume does not contradict the bootloader version being 10.2.4)

And in this situation, is it safe to just try to flash (with fastboot) an appropriate TWRP image to see if that works?
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Re: [BOOTLOADER] 2nd-Bootloader/Recovery unlock process for Kindle Fire 2

yep, there is really no way to confirm bootloader version after flashing.


Sent from my DROID RAZR HD using Tapatalk 2
 

abreeden

Senior Member
Nov 7, 2008
97
19
Assuming if you are already running CM10.1 nightlies you have nothing to fear from this 3/27 Amazon update? i dont see how, but i want to be sure before i have a couple of family members drop their bricked KF2's in my lap.
 

peoro

Senior Member
Dec 28, 2011
57
5
Not sure if anyone's noticed this but if you don't have a fastboot cable, just run

Code:
adb push boot.img /mnt/sdcard
adb push twrp.img /mnt/sdcard
adb shell
su
#dd if=/mnt/sdcard/boot.img of=/dev/block/platform/omap/omap_hsmmc.1/by-name/boot
#dd if=/mnt/sdcard/twrp.img of=/dev/block/platform/omap/omap_hsmmc.1/by-name/recovery

from a running OS. It seemed to do the job for me.

So, if I do like this, I'm gonna flash a 100% working bootloader?

A few days ago I tried to flash a bootloader this way, but I totally bricked the device and had to send it to warranty. (I believe it's because I flashed a bootloader for Kindle Fire 1 though).
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Re: [BOOTLOADER] 2nd-Bootloader/Recovery unlock process for Kindle Fire 2

The only time you should flash the bootloader partition directly would be to downgrade to an older version of the stock signed bootloader.


Other than that, we dont touch the stock bootloader.

Sent from my DROID RAZR HD using Tapatalk 2
 

mpr90

Member
Oct 26, 2010
14
1
I didn't see anything in this thread about which software version this procedure does work with (other than that it doesn't work with 10.3.0). Does anyone know if works with 10.1.1 (which I have on my KF2)?
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
OP is updated:

1. Includes the option of downgrading the stock bootloader to 10.2.4 incase you're on version 10.3.0 where the security hole we use to load custom kernel/ROMs has been fixed. (Step 3.5)
2. Recovery links are updated for TWRP 2.4.4.0 built for the Kindle Fire 2 (loaded via the 2nd-bootloader).

Enjoy.
 

seokhun

Senior Member
Feb 23, 2013
331
226
Hashcode, the link to the xda thread with the 1-click method isn't working. Thanks!
 

ab30494

Senior Member
Dec 12, 2010
121
27
is the fast boot cable, the one that came with the kindle. or do i need to buy a special cable
 

s10010001

Senior Member
Mar 31, 2009
87
4
Instructions for flashing your bootloader back to the 10.2.4 binary (this worked for the KFireHD 8.9 -- thanks to soupmagnet for testing):

Link to the 10.2.4 u-boot (bootloader) file for the Kindle Fire 2 here:
http://goo.im/devs/Hashcode/otter2/otter2-u-boot-prod-10.2.4.bin
md5sum 5b03a7b428325de8d360ec201a745498
(You SHOULD check this before using fastboot -- downloads CAN be corrupted)

And this is flashed via fastboot with:
Code:
fastboot -i 0x1949 flash bootloader otter2-u-boot-prod-10.2.4.bin

can I get a little help with the downgrade. I have a stock KF2 with root. But is on 10.3! I tried to downgrade with that command (I just used the fastboot.exe in the droidSDK right?) But it just says waiting for device. Is that because im not using a fastboot cable?
 

Xperia Player

Senior Member
Aug 1, 2012
1,330
164
C:\Documents and Settings\Nick>adb push stack /data/local/tmp/ 4 KB/s (4096 bytes in 1.000s) C:\Documents and Settings\Nick>adb shell su -c "dd if=/data/local/tmp/stack of=dev/block/platform/omap/omap_hsmmc.1/by-name/system bs=6519488 seek=1" 0+1 records in 0+1 records out 4096 bytes transferred in 0.002 secs (2048000 bytes/sec) C:\Documents and Settings\Nick>adb shell su -c "reboot bootloader" C:\Documents and Settings\Nick>fastboot -i 0x1949 flash bootloader otter2-u-boo-prod-10.2.4.bin target reported max download size of 486539264 bytes error: cannot load 'otter2-u-boot-prod-10.2.4.bin': Unknown error C:\Documents and Settings\Nick>fastboot -i 0x1949 flash bootloader otter2-u-boo-prod-10.2.4.bin target reported max download size of 486539264 bytes error: cannot load 'otter2-u-boot-prod-10.2.4.bin': Unknown error C:\Documents and Settings\Nick>fastboot -i 0x1949 getvar product < waiting for device >


Can anyone tell me what I'm doing wrong?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 73
    Introducing: Kindle Fire 2nd-bootloader + TWRP 2.6.3.0 for the Kindle Fire 2nd GEN

    *** USE AT YOUR OWN RISK! WHILE I TRY MY BEST TO PROVIDE WORKING KERNELS/ROMS, I AM NOT RESPONSIBLE IF THIS SOFTWARE OR ANYTHING I'VE WORKED ON SUDDENLY FRIES YOUR DEVICE. ***


    *** READ CAREFULLY BEFORE DOING ANYTHING ***
    *** Kindle Fire 1st-gen ROMs/KERNELS are *NOT* compatible with the Kindle Fire 2. Please only flash ROMs/KERNELS that are made for the Kindle Fire 2. ***



    ** IF YOU HAVE QUESTIONS, RE-READ THROUGH THE THREAD FOR ANSWERS. WHEN YOU'RE ABSOLUTELY SURE NO ONE HAS ASKED YOUR QUESTION, GO AHEAD AND RE-READ THE THREAD AGAIN AND USE THE SEARCH FEATURE. THEN POST YOUR QUESTION IF YOU STILL CAN'T FIND THE ANSWER **


    ** WHEN MOVING FROM AMAZON OS TO CM10.1 IN TWRP: "WIPE" -> "SYSTEM" AND "FACTORY RESET" TO CLEAR SYSTEM/DATA/CACHE. YOUR APPS FROM AMAZON ICS AREN'T COMPATIBLE. IF NOT YOU'LL LOOP ON THE CM10.1 BOOT ANIMATION **


    [03/27] NEW support thread for OFFICIAL CM on the Otter2 (Kindle Fire 2):
    http://xdaforums.com/showthread.php?t=2209995


    ** YOU SHOULD HAVE A WORKING FASTBOOT CABLE + FASTBOOT DRIVERS/ACCESS ON YOUR PC. **

    Q: How do I know if my fastboot works?
    A: Plug the cable into your device and then the computer. Reboot the Kindle. It *SHOULD* show a Fastboot screen. Once at the screen use this command on your computer:
    fastboot -i 0x1949 devices
    You should see something like this:
    0123456789ABCDEF

    Here's 1 website you can purchase a FASTBOOT adapter from (works with your normal USB cable)
    http://shop.teamblackhat.info/Factory-Adapters-motadapt.htm
    ** I don't make any commission or fee from the sales of these devices, I just know they have them on stock most of the time and ship in a reasonable time frame unlike the Chinese variants found on ebay.

    If you do NOT see this, then make sure you have the SDK installed correctly and you have the right setup for fastboot on your PC before proceeding.


    *** BE SURE YOU HAVE A GOOD CHARGE ON THE DEVICE ***


    INITIAL SETUP INSTRUCTIONS (1st TIME ONLY) FOR 2ND-BOOTLOADER + TeamWinRecoveryProject INSTALL:

    STEP 1. Backup your stock partitions to your own HD for later if you need disaster recovery:
    Code:
    adb pull /dev/block/mmcblk0boot0
    adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/boot
    adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
    adb pull /dev/block/platform/omap/omap_hsmmc.1/by-name/system # This will take a few minutes
    Take those files and put them somewhere safe.


    STEP 2: Download the files you will need to install 2nd-bootloader, TWRP and CM10.1:
    1. Stack override file:
      http://goo.im/devs/Hashcode/otter2/stack
    2. [12/09] otter2-freedom-boot-10.4.6.img (USED ONLY THE FIRST TIME -- .zip files will have their own boot.img's from now on):
      http://goo.im/devs/Hashcode/otter2/otter2-freedom-boot-10.4.6.img
      md5sum: 80f9b9ba80910de361463560f86f315a
    3. [09/03] TeamWin Recovery 2.6.3.0:
      http://goo.im/devs/Hashcode/otter2/otter2-twrp-2.6.3.0-recovery.img
      md5sum: a66a8cbab92fd5daaa85f6303e9cc0c3
    4. older 10.2.4 bootloader file and flash to your device via fastboot:
      http://goo.im/devs/Hashcode/otter2/otter2-u-boot-prod-10.2.4.bin
      md5sum 5b03a7b428325de8d360ec201a745498
      (You SHOULD check the MD5SUM before using fastboot -- downloads CAN be corrupted)
    5. CM-10.1/CM-10.2 for the Kindle Fire 2 (choose the latest version from):
      http://www.get.cm/?device=otter2
    6. Google Apps from: http://goo.im/gapps (choose the version: CM10.1 or CM10.2)
    Place the ROM and the gapps .zip on your device in the /sdcard area


    STEP 3. Install the stack override in /system:
    ADB commands entered while booted up into STOCK *rooted* Amazon Kindle OS -- May need to enable ADB debugging in Settings:
    [2013-08-21] edited the location where stack is placed on device due to permissions changes
    Code:
    adb push stack /sdcard/
    adb shell su -c "dd if=/sdcard/stack of=/dev/block/platform/omap/omap_hsmmc.1/by-name/system bs=6519488 seek=1"

    [ Connect fastboot cable, and reboot the device so that "Fastboot" is showing ]

    STEP 4.
    Flash the OLD bootloader, new otter2-freedom-boot.img and TWRP recovery.[/B]
    *DONT RE-FLASH FREEDOM-BOOT.IMG LATER AFTER FLASHING CM10.1 -- IT'S FOR STOCK AMAZON OS ONLY / FIRST INSTALL ONLY*
    Code:
    fastboot -i 0x1949 flash bootloader otter2-u-boot-prod-10.2.4.bin
    fastboot -i 0x1949 flash boot otter2-freedom-boot-10.4.6.img
    fastboot -i 0x1949 flash recovery otter2-twrp-2.6.3.0-recovery.img
    fastboot -i 0x1949 reboot

    ** If everything was done correctly you will at this point see the bootmenu with a BLUE logo during the reboot. **

    TO ENTER RECOVERY:
    During the blue logo screen press the power button to cycle through options and select "Recovery" to enter TWRP.

    Once in TWRP you can Install" the CM-10.1/CM-10.2 by selecting "Install" and then browsing the device and selecting it, then "Add Zip" and select the Gapps .zip as well.

    Use the slider to start the install.


    FLASHING BACK TO STOCK:
    ** FIND THE FILES WE BACKED UP IN STEP #1 OR DOWNLOAD NEW ONES FROM THE RECOVERY THREAD HERE: **
    http://xdaforums.com/showthread.php?t=2035047

    Once you have these files (we'll name them boot.img/recovery.img and system.img for the purpose of these instructions, but they could be different on your system).

    Plug in your fastboot cable and reboot so that you see the fastboot screen and enter the following commands:
    Code:
    fastboot -i 0x1949 flash boot [B]boot.img[/B]
    fastboot -i 0x1949 flash recovery [B]recovery.img[/B]
    fastboot -i 0x1949 flash system [B]system.img[/B] # This one will take a few minutes
    fastboot -i 0x1949 reboot

    Enjoy

    THANKS TO:
    • fattire for finding the original bootloader exploit
    • TESTERS: powerpoint45 and FMKilo
    23
    Changelog: updated 2013-07-08

    freedom boot.img (for use w/ stock Amazon OS + 2nd-bootloader):
    • [07/08] Updated w/ kernel from 10.4.3 release

    TeamWin Recovery (TWRP) 2.6.0.0
    • [07/08] USB Vendor ID / Product ID in recovery now matches stock Amazon OS
    • [07/08] Based on 10.4.3 stock kernel
    • [07/08] Fixed recovery bootloop issue
    • [07/08] TWRP 2.6.0.0 update
    12
    one more reserved space
    8
    Yes I do. Check md5 as I'm not sure that when you download them they'lll be complete!

    https://www.mediafire.com/folder/5oda4fual3ht3/KF2_Boot_and_Recovery

    :)

    Bump just so everyone knows these files are here
    7
    does anyone have a mirror of the files?

    Yes I do. Check md5 as I'm not sure that when you download them they'lll be complete!

    https://www.mediafire.com/folder/5oda4fual3ht3/KF2_Boot_and_Recovery

    :)