Thor & 4.5.5.2 : Easy to root and Unlock Bootloader

Search This thread

DB126

Senior Member
Oct 15, 2013
15,362
10,174
I follow the instruction now my tablet has twrp and i just install slim os for thor and its stock in slim boot logo
i think i didn't correctly unlock the bootloader, so my problem is, I don't have ADB now and because os not boot but i can access to fast boot via twrp
i think if someone make unlock.code for me based on my result i can unlock my bootlaoder when it is in fastboot mode

my codes are

$ cat /sys/block/mmcblk0/device/manfid
0x000045
$ cat /sys/block/mmcblk0/device/serial
0x0a1faa6f

please send me unlock.code or guide me on this command below
adb shell "id=$(cat /sys/class/block/mmcblk0/device/{manfid,serial}); echo $id; echo 0x${id:6:2}${id:11:8} | %dir%/cuber > %dir%/unlock.code"

how can i inject my serial and use another phone to make unlock.code file

Thanks in advance
You created a separate thread thread with this question then reposted here an hour later. Impatient? Please don't cross post. I will respond to your initial post as time permits.
 

draxie

Senior Member
Apr 20, 2014
515
642
You created a separate thread thread with this question then reposted here an hour later. Impatient? Please don't cross post. I will respond to your initial post as time permits.

I also got a PM about the same issue... (-;

With the manfid & serial posted, the quoted line from get-code.bat can be simplified to
Code:
 adb shell "echo 0x450a1faa6f | %dir%/cuber > %dir%/unlock.code"
 

tetriz

Member
Aug 30, 2017
5
2
how to continue?

Hello! I've stucked with one issue. I went successfully till the working TWRP (I also had an issue with a permanent screen "Fastboot / Ready" but then solved it using "fastboot -i 0x1949 erase aboot" and "fastboot -i 0x1949 reboot").

So I've tried to use adb sideload to upload cm12 from here: https://xdaforums.com/kindle-fire-hdx/development/rom-cm-12-unofficial-apollo-thor-t3050199

But when progress was reaching ~64% my Kindle was always switching to an "mtp" mode and sideload was failing. But thank to MTP I was able to upload cm12.zip and gaps.zip to my Kindle simly via explorer (win10).

So then I did in TWRP:
- wipe (basic: data, cache, dalvik)
- install cm12.zip
- install gaps.zip (pico version for ARM and android 5.1)
- Reboot

Now I see a grey logo "Kindle Fire" and it doesnt load into the system (no loading animation, nothing happening).

Can you please advise? Thanks!

PS. in the console after the cm12.zip installation I see the following (and I do not know if this is OK or not):

Installing zip file '/sideload/cm12.zip'
script succeeded: result was [/system]
Updating partition details...
...done

UPDATE: I've got it working with stock repacked latest 4.5.5.2 rom. But don't know how to continue towards CM12...
 
Last edited:

draxie

Senior Member
Apr 20, 2014
515
642
Quick Control Question

Hello! I've stucked with one issue. I went successfully till the working TWRP (I also had an issue with a permanent screen "Fastboot / Ready" but then solved it using "fastboot -i 0x1949 erase aboot" and "fastboot -i 0x1949 reboot").

So I've tried to use adb sideload to upload cm12 from here: https://xdaforums.com/kindle-fire-hdx/development/rom-cm-12-unofficial-apollo-thor-t3050199

But when progress was reaching ~64% my Kindle was always switching to an "mtp" mode and sideload was failing. But thank to MTP I was able to upload cm12.zip and gaps.zip to my Kindle simly via explorer (win10).

So then I did in TWRP:
- wipe (basic: data, cache, dalvik)
- install cm12.zip
- install gaps.zip (pico version for ARM and android 5.1)
- Reboot

Now I see a grey logo "Kindle Fire" and it doesnt load into the system (no loading animation, nothing happening).

Can you please advise? Thanks!

PS. in the console after the cm12.zip installation I see the following (and I do not know if this is OK or not):



UPDATE: I've got it working with stock repacked latest 4.5.5.2 rom. But don't know how to continue towards CM12...

Just to make sure we're on the same page, have you unlocked the bootloader?
 
  • Like
Reactions: tetriz

tetriz

Member
Aug 30, 2017
5
2
Just to make sure we're on the same page, have you unlocked the bootloader?

I was going by the manual from the first post in this thread and did the step "e) execute unlock.bat".
After this I've get a permanent "fastboot Ready" screen and didn't knew how to get out of it untill haven't found this soultion: "fastboot -i 0x1949 erase aboot" & "fastboot -i 0x1949 reboot"

Can it be that unblock.bat didn't worked as expected or by the applying fix mentioned above I've "blocked" the bootloader again?

Is there any way to check status of bootloader using installed TWRP or via ADB (usb connection)?
 

draxie

Senior Member
Apr 20, 2014
515
642
I was going by the manual from the first post in this thread and did the step "e) execute unlock.bat".
I'd venture a guess that you didn't _quite_ follow the steps,
and 'unlock.bat' got stuck, because you *manually* rebooted
from 'adb' to 'fastboot'.

After this I've get a permanent "fastboot Ready" screen and didn't knew how to get out of it untill haven't found this soultion: "fastboot -i 0x1949 erase aboot" & "fastboot -i 0x1949 reboot"
That "solution" is certainly not what you want.
Look inside 'unlock.bat' (right-click & choose 'Edit')
and copy the 'fastboot' line from there to unlock.
After that you can reboot using the 2nd command
from your "solution", but don't erase aboot.


Can it be that unblock.bat didn't worked as expected or by the applying fix mentioned above I've "blocked" the bootloader again?
Yes, indeed.
BTW, you would've noticed if you had managed to unlock,
as you get very obvious feedback on the Kindle's screen.


Is there any way to check status of bootloader using installed TWRP or via ADB (usb connection)?

Sure, at least, if you still have (close to) stock installed in
your system partition (I'm unsure if TWRP has 'idme' or not).

Code:
adb shell su -c "idme print unlock_code"

In either case, you can always check from 'fastboot'
(what you called a "permanent" 'fastboot Ready' prompt).

Code:
fastboot -i 0x1949 oem idme \?

BUT, you might as well just try to unlock instead...
 
  • Like
Reactions: tetriz and DB126

tetriz

Member
Aug 30, 2017
5
2
BUT, you might as well just try to unlock instead...

Thanks Draxie for heloping me!

I've tried what you said and actually in two different versions:

Manually switching from ADB to Fastboot (Screen "Fastboot ready") and executing

Code:
fastboot -i 0x1949 flash unlock unlock.code

And by beeing in ADB mode - executing the unlock.bat

In both cases I'm getting same result in a CMD console:

target didn't report max-download-size
sending 'unlock' (0 KB)...
FAILED (command write failed (No error))
finished. total time: 0.008s

Any further advise? Thanks a lot!

[UPDATE] I get it unlocked! But really randomly. Was playing with Motorola drivers on 2 different machines for 2 hours. At the end it didn't worked on Win7 64bit machine where Moto drivers has installed w/o issues (and fastboot was showing "READY" from the very beginning). But then it did work on Win10 64bit where I'm getting error during Moto drivers installation, but then I was able to chose this driver in device manager. And unlock just worked!

Hint for others - if you are rooting by Kingroot and finding that ADB is not working as described here, go to KingRoot and ALLOW root access for ADB.
 
Last edited:
  • Like
Reactions: draxie and DB126

rommel19540

New member
Nov 12, 2016
2
0
Step2 missing

Finally I got myself to root and unlock bootloader of my Thor Kindles. I've been lurking for few years. Here is the steps:-

1. Install Kingroot from Kingroot website (https://kingroot.net/) and root the phone. I got it first try. But some people are saying they need 8 tries to work. Some even report success after 20 tries.
2. Flash TWRP and Unlock bootloaders. Instruction in https://xdaforums.com/kindle-fire-h...r-firmware-t3463982/post70881555#post70881555. Instruction in this post is better than the first post (OP) in the thread. The step is:-
a) install ADB driver and install Kindle Fire USB driver
b) put get_code.bat and unlock.bat in adb.exe directory. Put aboot and cubed twrp in /sdcard/
b) create unlock.code with get_code.bat
c) flash aboot and cubed twrp with this command in DOS command prompt in adb.exe directory:-
d) make sure check the Android ADB Composite driver is properly install in Device Manager
e) execute unlock.bat
f) reboot, press UP + power to boot into TWRP
g) wipe, then flash your ROM using adb sideload or normal flashing if you already have the rom in your device earlier. Then wipe again.

Tips:-
1. Make sure the driver is Android ADB Composite Driver is properly install or the unlock bootloader (unlock.bat) won't work
2. Installing Rom, press UP+POWER to go into TWRP, download the ROM to PC, then enable ADB side in TWRP, follow up with ADB sideload command in PC. Wipe before and after. :-
https://xdaforums.com/kindle-fire-hdx/orig-development/rom-fire-nexus-rom-ktu84q-t3322931
3. Safe Strap is not supported in 4.5.5.2
4. Copy ROM zip file to /sdcard/ before doing the above to skip the adb sideload step and you can directly flash the rom from TWRP only.
5. Can't boot into 4.5.5.2 after unlock bootloader. I've tried issuing "fastboot -i 0x1949 oem idme bootmode 4000" and then "fastboot -i 0x1949 reboot" command but it does not work.

Added another instructions from another forumer who think my instructions is not complete:-

Hey whats up? I'm trying to unlock bootloaders and install twrp. I followed the link to draxies post but it is missing the 2nd step. It says its in the OP but I don't know where the OP is. So can u please tell me what I do after the get_code.bat step?
 

kkcheong

Senior Member
Oct 20, 2009
309
32
Penang
LG V50 ThinQ
Hey whats up? I'm trying to unlock bootloaders and install twrp. I followed the link to draxies post but it is missing the 2nd step. It says its in the OP but I don't know where the OP is. So can u please tell me what I do after the get_code.bat step?

OP is first post. I am referring to first post in this link
https://xdaforums.com/kindle-fire-h...r-firmware-t3463982/post70881555#post70881555

Just follow exactly this link and you will be find:-
https://xdaforums.com/kindle-fire-h...r-firmware-t3463982/post70881555#post70881555
 

rwbonesy

Member
Dec 31, 2015
21
1
Is there any way to force KingRoot to keep trying? I was gifted an HDX 7" 3rd Gen that is on 4.5.5.3 so am I stuck waiting patiently for KingRoot to update?
 
Last edited:

DB126

Senior Member
Oct 15, 2013
15,362
10,174
Is there any way to force KingRoot to keep trying? I was gifted an HDX 7" 3rd Gen that is on 4.5.5.3 so am I stuck waiting patiently for KingRoot to update?
KingRoot often fails (erroneously reporting device can not be rooted) before eventually succeeding. Multiple attempts are often necessary. However, there is another way to root which may be attractive if your ultimate goal is to unlock the bootloader and install a custom ROM. See here.
 
Last edited:

navmad

Senior Member
Jan 10, 2013
417
98
Seattle
Last edited:

vartanarsen

Member
Oct 7, 2014
44
3
Can somebody PLEASSSEEE Make a video on this in 2018? Every video I see is al, over the place and no one starts from square ONE
 

DB126

Senior Member
Oct 15, 2013
15,362
10,174
Can somebody PLEASSSEEE Make a video on this in 2018? Every video I see is al, over the place and no one starts from square ONE
This is a 5-year-old KitKat era device (last production mid-2014) with a limited user base. Creating such a video would take hours and likely not address all of the varied issues that can complicate the bootloader unlock procedure. If you lack the experience, technical expertise or time/drive to read through the previously posted material it's probably best to use the device as-is. Not everything in life is easy. HDX 'hacking' falls into that category.

As previously mentioned, bootloader unlocking is much easier if you can find a friend with a Linux or Mac (OS X) based host that can run the '1-click script' developed by @draxie.

Related post: https://xdaforums.com/member.php?u=6943624
 

Cryper

New member
Oct 22, 2018
1
0
Need assistant to solve Problems by flashing my device

Sorry video generation . You guys need to learn to read instead of watching YouTube. But you can ask me anything.

Hello there. I really want to get your help with my problems. My Motherlanguage is german, so please try to use simple English with me.

I try to get root access to my kindle HDX 7 ( Version 4.5.5.2 )

I have ADB Drivers installed and i THINK they are working cause i can go to fastboot and such things.

But what is not working ist this here. I will show you what happend, when i tried to flash twrp and aboot. (That is nessesary to open the Booloader and with root access??)

C:\Users\crype\Desktop\tools>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
su
dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/abootshell@thor:/ $ su
/system/bin/sh: su: not found
f=/dev/block/platform/msm_sdcc.1/by-name/recovery <
/dev/block/platform/msm_sdcc.1/by-name/recovery: cannot open for write: Permission denied
=/dev/block/platform/msm_sdcc.1/by-name/aboot <

I try to wait for you answer now. I did a lot more to get it work. But maybe you can tell me how i solve that problem to flash twrp and aboot, so i can unlock my device with the unlock.bat. (That would hopefully be no problem for me)

Please assist me, i worked days and many hours on it. I get really frustraded at the moment.

Edit: HDX Device is NOT ROOTED checked with Rootcheck.apk / Device is still offline (No Wlan given)

BR

Cryper

Edit: I cant post pictures right now (No permission for links. I will sent you a PM and when someone want to see the inner structure of my kindle pls PM me)


Next Update:

I give KingRoot a second try and was succsessfull in rooting my Kindle. But one Problem still remains:

C:\Users\crype\Desktop\tools>adb shell
su
dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recoveryshell@thor:/ $ su
/dev/block/platform/msm_sdcc.1/by-name/recovery <
/sdcard/twrp_cubed.img: cannot open for read: No such file or directory
1|root@thor:/ #

I cant open or read the File "Twrp_cubed.img"

Update:

Tablet restartet files were copied successfull - But cant unlock bootloader!!!!

C:\Users\crype\Desktop\tools>fastboot -i 0x1949 getvar product
fastboot: unknown option -- i

Any Ideas so far?
 
Last edited:

vartanarsen

Member
Oct 7, 2014
44
3
Moderator Edit:

Please read the Forum Rules

viz:

7. Do not sell or trade on the forums.

If you wish to advertise a product, simply contact us. We can provide ads but you are not permitted to just post it in the forums. If you do, it will be removed and you're likely to receive a ban.
The buying, selling, trading and / or exchanging of any item is now prohibited on XDA, in any forum or via Private Messages. We now use www.swappa.com
 
Last edited by a moderator:

kkcheong

Senior Member
Oct 20, 2009
309
32
Penang
LG V50 ThinQ
Wie geht es dir?

Forum Rule #4

4. Use the English language.

We understand that with all the different nationalities, not everyone speaks English well, but please try. If you're really unable to post in English, use an online translator. You're free to include your original message in your own language, below the English translation. (This rule covers your posts, profile entries and signature).
 
Last edited by a moderator:

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Finally I got myself to root and unlock bootloader of my Thor Kindles. I've been lurking for few years. Here is the steps:-

    1. Install Kingroot from Kingroot website (https://kingroot.net/) and root the phone. I got it first try. But some people are saying they need 8 tries to work. Some even report success after 20 tries.
    2. Flash TWRP and Unlock bootloaders. Instruction in https://xdaforums.com/kindle-fire-h...r-firmware-t3463982/post70881555#post70881555. Instruction in this post is better than the first post (OP) in the thread. The step is:-
    a) install ADB driver and install Kindle Fire USB driver
    b) put get_code.bat and unlock.bat in adb.exe directory. Put aboot and cubed twrp in /sdcard/
    b) create unlock.code with get_code.bat
    c) flash aboot and cubed twrp with this command in DOS command prompt in adb.exe directory:-
    adb shell
    su
    dd if=/sdcard/twrp_cubed.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery
    dd if=/sdcard/aboot_vuln.mbn of=/dev/block/platform/msm_sdcc.1/by-name/aboot
    d) make sure check the Android ADB Composite driver is properly install in Device Manager
    e) execute unlock.bat
    f) reboot, press UP + power to boot into TWRP
    g) wipe, then flash your ROM using adb sideload or normal flashing if you already have the rom in your device earlier. Then wipe again.

    Tips:-
    1. Make sure the driver is Android ADB Composite Driver is properly install or the unlock bootloader (unlock.bat) won't work
    2. Installing Rom, press UP+POWER to go into TWRP, download the ROM to PC, then enable ADB side in TWRP, follow up with ADB sideload command in PC. Wipe before and after. :-
    https://xdaforums.com/kindle-fire-hdx/orig-development/rom-fire-nexus-rom-ktu84q-t3322931
    3. Safe Strap is not supported in 4.5.5.2
    4. Copy ROM zip file to /sdcard/ before doing the above to skip the adb sideload step and you can directly flash the rom from TWRP only.
    5. Can't boot into 4.5.5.2 after unlock bootloader. I've tried issuing "fastboot -i 0x1949 oem idme bootmode 4000" and then "fastboot -i 0x1949 reboot" command but it does not work.

    Added another instructions from another forumer who think my instructions is not complete:-
    1. Install the moto driver and then plug in your device while running normal
    2. Run the get_code.bat (from this link)
    3. once unlock.code file is created, run "adb reboot bootloader". It will show [Fastboot] with the kf logo.
    4. Once bootloader comes up, change driver in device manager for "Other Android" to use the Android -> Mot Adb Composite Driver. It should say "Ready" on the KF
    5. Run the stuff from this post (do the bottom steps with fastboot erase first)
    6. After you are done in bulk mode, hold the power button for 15 secs to reboot. It will automatically boot into Fastboot
    7. When you run the unlock command, use the "unlock.code" file.. not the "0xmmssssssss.unlock" example from that link.
    8. Now unplug and hold power again to shut down. Hold VolUp + Power. About 3 secs after you see the KF logo, you can let go of the power button (possibly both buttons) and you get TWRP
    From here you can flash CM and gapps (5.1).
    3
    ok i tried my laptop and got further. I changed the driver to "Android Bootloader Driver".. and got "Ready" showing. Also tried with "Android Composite ADB Driver" and that also showed me Ready.
    I now have "Ready" showing up on my KF in fastboot
    But that's all. Still can't run the wmic commands as they say "No instance(s) available) ... and "fastboot devices" doesn't show any devices. So I still cannot communicate with it even though it appears to be ready.
    Download the Motorola Device Manager from here and install. Then place HDX in fastboot mode and update Win driver to "Mot Composite ADB Interface" (if successful will show under Android heading in Device Manger). Also make sure you are using the latest Minimal ADB and Fastboot (here). Combination should do the trick assuming cable is ok.
    3
    I didn't know it's possible to access root directory of Kindle with Windows Explorer during twrp. Thus the complicated approach. I feel stupid already lol.
    XDA is a community; we learn from each other. I have had many a humbling experience at the hands of others and thank them for sharing their time and knowledge. :)

    ---------- Post added at 02:07 PM ---------- Previous post was at 01:46 PM ----------

    I did a quick search of this thread and didn't see anything addressing this, but has anyone figured out how to root with Kingroot and then substitute it with Super Su? I don't really have a need to unlock the bootloader and would prefer to avoid flashing anything, as I recently hard bricked a tablet doing just that. So, I'm a bit gun shy on that front right now. I would just like to maintain root without keeping Kingroot on my tablet. I can easily root with Kingroot 4.8.1, and I have done that temporarily to accomplish a few things, but I have not been able to swap it out with Super Su, which is my preference for maintaining root access. I have an HDX 7 (Thor) on version 4.5.5.2.
    It's hard to brick if you follow exactly my steps. I am noob also didn't brick my Kindle . You can Google about how to replace kingroot. It's all over the internet but not all method works.
    In addition to home-brewed methods of varying effectiveness and quality you can use the Super-Sume app available in the Play Store. Just be sure to try it immediately (within 2 hours) so you can secure a refund if it doesn't work. Unfortunately, the author doesn't offer an alternative purchase method if you don't have access to Google Play on the target device.

    Alternatively, you can update (but not unlock) the bootloader and then boot a recovery that will permit replacing KingUser with SuperSu. More importantly it provides a method for reviving your device should something go wrong with FireOS. HDX models are famously unrecoverable when FireOS takes a dump as the native Amazon recovery environment offers no options for resetting the operating system (the misnamed "factory reset" simply deletes user data).
    3
    THANK YOU!!!
    This was it! The Mot driver makes it work as expected.
    So the full process
    1. Install the moto driver and then plug in your device while running normal
    2. Run the get_code.bat (from this link)
    3. once unlock.code file is created, run "adb reboot bootloader". It will show [Fastboot] with the kf logo.
    4. Once bootloader comes up, change driver in device manager for "Other Android" to use the Android -> Mot Adb Composite Driver. It should say "Ready" on the KF
    5. Run the stuff from this post (do the bottom steps with fastboot erase first)
    6. After you are done in bulk mode, hold the power button for 15 secs to reboot. It will automatically boot into Fastboot
    7. When you run the unlock command, use the "unlock.code" file.. not the "0xmmssssssss.unlock" example from that link.
    8. Now unplug and hold power again to shut down. Hold VolUp + Power. About 3 secs after you see the KF logo, you can let go of the power button (possibly both buttons) and you get TWRP
    From here you can flash CM and gapps (5.1).

    Thanks everyone for all the help!! I did all 4 of my KF HDX 7's with perfect success on each.
    It's amazing how much faster CM12 runs on these babies! I was about to give up and buy some Tab S2's but these things are so fast now.
    Well done. @draxie is a great resource who knows the ins and outs of HDX devices better than just about anyone.

    Note CM 12.1 is no longer supported and does not play nice with Bluetooth peripherals. There are a handful of well regarded custom ROMs for this device including LineageOS 14.1 which is a descendant of CM 12.1. I use the latter on one of my primary HDXs mainly for Xposed compatibility. It's quite stable and responsive but isn't the most power efficient in some states and consumes 15-20% more memory for 'core' processes vs MM/Nougat successors. Slim 7 is a promising new comer along with LineageOS 13.0 which demonstrate excellent BlueTooth compatibility if that's important to you.

    Enjoy your liberated devices!

    ---------- Post added at 01:21 PM ---------- Previous post was at 01:05 PM ----------

    If the device finally *connected* in fastboot mode (ready prompt is showing), I see no need to mess with drivers any further...
    Unfortunately, the presence of a "Ready" prompt does not always equate to a functional fastboot connection on this device...at least w/Windows. Typically corrected with a different driver although I have personally experienced flaky USB cables exhibit the same behavior. Issuing fastboot "devices" command (adding vendor flag as needed) usually validates connection viability. Lucky Linux users generally don't have to jump through these hoops assuming the USB cable is up to snuff.
    2
    No joy! I flashed the new recovery.img to the recovery partition with fastboot, but when I gave
    fastboot -i 0x1949 reboot, it rebooted to the fastboot mode. Also tried power + volume + keys
    and it booted into fastboot mode. So now what sir? Only fastboot available, no adb.
    Oh, the sha1sum gives ok. :crying:
    Yep - recall that recommendation to leave well enough alone. Been down this path before. I'm certain @draxie will get things cleaned up. Reflashing stock recovery has never been a clean procedure...although that may change in the future based on learnings from this go-around.

    As an aside, you can reinstall and/or boot TWRP from fastboot (assuming an unlocked bootloader) which is the likely the path @draxie will take to revive your device. Good chance whatever ROM was previously installed remains intact; same for contents of the data partition. See TWRP thread for related fastboot commands.