[EMMC CORRUPTION FIX] HOW-TO Recover EMMC Bricked Kindle Fire 1st Gen [2013-08-20]

Search This thread

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Thank you very much.
I will try more. If I correctly understand you, usbboot and fastboot is a single process in this case and despite of usbboot success ("sending image to target" message) and green LED etc. almost every time I try it, if fastboot commands (e.g. "fastboot boot ./recovery.img") failed on "waiting for device" message, than whole "usbboot" process is failed, too.
And one more question, is fastboot cable useless for now, until chip is fixed?
Thank you once more for your time. I'm sorry if my questions are too stupid.

Yes, you probably don't need fastboot cable for this procedure. And remember, there's no such thing as stupid questions.. :p

Well, I take it back this is XDA and you'll get eaten alive if you ask something really silly.
 

alarien

Senior Member
Sep 30, 2010
65
21
Kyiv
One more update.
Tried for a few more dozens of times, with no luck entering fastboot even once.
Also, got
Code:
dmesg | tail -n 15
[25331.112041] usb 1-1: USB disconnect, device number 33
[25463.860703] usb 1-1: new high-speed USB device number 34 using ehci-pci
[25463.994678] usb 1-1: unable to get BOS descriptor
[25463.995797] usb 1-1: New USB device found, idVendor=0451, idProduct=d00f
[25463.995810] usb 1-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
[25463.995819] usb 1-1: Product: OMAP4430
[25463.995828] usb 1-1: Manufacturer: Texas Instruments
[25464.039378] usb 1-1: USB disconnect, device number 34
[25523.124150] usb 1-1: new high-speed USB device number 35 using ehci-pci
[25523.256612] usb 1-1: [B]unable to get BOS descriptor[/B] - [I]what is this, by the way?[/I]
[25523.257730] usb 1-1: New USB device found, idVendor=0451, idProduct=d00f
[25523.257742] usb 1-1: New USB device strings: Mfr=33, Product=37, SerialNumber=0
[25523.257752] usb 1-1: Product: OMAP4430
[25523.257761] usb 1-1: Manufacturer: Texas Instruments
[25523.301463] usb 1-1: [B]USB disconnect, device number 35[/B] - [I]despite cable is connected and LED is green.[/I]
So, device is somehow recognized.
"fastboot getvar product" still stuck on "waiting for device".
I've got usbboot success and LED green almost every time now. But still no fastboot.
Also, may disfunctional battery be the problem? Is USB power enough to boot up?
Some advises on timing or technique, please, anyone? Just really needs a success story here :(
Thank you.
 
Last edited:

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Do you have a /etc/udev/rules.d/51-android.rules (this could really be anything) entry for the TI vid/pid?

0451/d00f

Sent from my DROID RAZR HD using Tapatalk 2
 
Last edited:
  • Like
Reactions: donnelpa

alarien

Senior Member
Sep 30, 2010
65
21
Kyiv
Do you have a /etc/udev/rules.d/51-android.rules (this could really be anything) entry for the TI vid/pid?

0451/d00f

Sent from my DROID RAZR HD using Tapatalk 2

Yes, just like this, but I'm not sure if it is correct.
Code:
cat /etc/udev/rules.d/otter-adb-fastboot.rules
#		Amazon Kindle Fire
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0006", SYMLINK+="android_adb"
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0006", SYMLINK+="android_fastboot"
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d00f"
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
Yes, just like this, but I'm not sure if it is correct.
Code:
cat /etc/udev/rules.d/otter-adb-fastboot.rules
#		Amazon Kindle Fire
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0006", SYMLINK+="android_adb"
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", ATTR{idProduct}=="0006", SYMLINK+="android_fastboot"
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="d00f"

Here's what I have on mine (99-android.rules):
Code:
# Texas Instruments
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", MODE="0666", GROUP="plugdev"
# Amazon Kindle Fire
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", MODE="0666", GROUP="plugdev"
 
  • Like
Reactions: donnelpa

alarien

Senior Member
Sep 30, 2010
65
21
Kyiv
Here's what I have on mine (99-android.rules):
Code:
# Texas Instruments
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", MODE="0666", GROUP="plugdev"
# Amazon Kindle Fire
SUBSYSTEM=="usb", ATTR{idVendor}=="1949", MODE="0666", GROUP="plugdev"

Thank you very much. I'll try it ASAP along with possibly fixing my battery.
I really, really appreciate your help and care.

Sent from my Galaxy Nexus
 

Jeffjb

Member
Jan 10, 2013
21
4
Believe it or not, there is no such thing as "totally bricked". The usbboot solves that for us. If done correctly, it will boot your device to a usable state and you can re-write literally every partition from backups.

I'm sort of with @soupmagnet on this one. Booting from usbboot is alot about timing and technique. If it doesn't look like it's working then it's best to long press the power button and try it again. I have the fortunate ability to watch serial output while it's coming up, so I immediately know if usbboot is working or not. For the normal user it will be trial and error.

Definitely give it another shot.

Is there a possibility of booting everything from USB (incl ROM)? It seems my eMMC is completely dead as well as not being able to mount the sdcard.

original thread I created about my attempts to revive my KF1 if you want to take a read: http://xdaforums.com/showthread.php?t=2445930
 

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
Still stuck

Hi Hash
I recently got my new screen for my mmc damaged kindle. i have tried to follow your instructions but I cant figure it out.
Have you changed the file names? also my recovery partition is corrupt can you please give any more advice for a noob like me.
I can preform the usbboot trick and it says its loaded recovery but it just hangs on the twrp boot logo. any help would be great. cheers steve
 

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
Hi Hash
I recently got my new screen for my mmc damaged kindle. i have tried to follow your instructions but I cant figure it out.
Have you changed the file names? also my recovery partition is corrupt can you please give any more advice for a noob like me.
I can preform the usbboot trick and it says its loaded recovery but it just hangs on the twrp boot logo. any help would be great. cheers steve

Edit. How many files should i have downloaded. I have 5 including the openrecovery-twrp-2.6.0.0-otter.img. should i have 2 more. I cd into the dirictory with those files inside and run ./usb_boot_twrp in terminal and all i get back is ./usb_boot_twrp: No such file or directory. sorry but i don't understand where its getting usb_boot_twrp from. should i have a file called mmc_utils?
 
Last edited:

kinfauns

Retired Senior Moderator and Retired DC Lead
Jan 5, 2012
1,864
3,543
Edit. How many files should i have downloaded. I have 5 including the openrecovery-twrp-2.6.0.0-otter.img. should i have 2 more. I cd into the dirictory with those files inside and run ./usb_boot_twrp in terminal and all i get back is ./usb_boot_twrp: No such file or directory. sorry but i don't understand where its getting usb_boot_twrp from. should i have a file called mmc_utils?

usb_boot_twrp is in pokey9000's Firekit distribution -> http://xdaforums.com/showthread.php?t=1430038
a prebuilt mmc_utils binary is in Hashcode's github repository for the project -> https://github.com/Hashcode/mmc-utils

I'm afraid you're on your own for the rest of it because I've never tried the shorting trick to force it into usbboot mode.
 
  • Like
Reactions: lovejoy777

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
thank you so much. i know all about the short trick, so no problems there. its just the files i couldn't find. i will try again this evening when I'm back. thanks for the heads up on the files. cheers steve

Sent from my Nexus 5 using Tapatalk
 

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
@kinfauns do i push all of the files from mmc-utils-master or just mmc-utils from within mmc-utils-master.
also my damage is in my recovery partition so the only recovery i can boot into and get adb working is "cwm-based recovery v5.0.2.7 full (by DooMLoRD)" I remember this from when i first got curupted all those months ago. even when I usb boot into twrp from pokey's firekit it just hangs on the twrp boot animation (all other recoveries do this except DooMLoRD's, hence "I think its my recovery partition thats screwed) anymore help please. cheers for your time Steve

Maybe a little more detailed explanation for a mere noob like me.... Thanks again:)

Edit.
I tried just the 1 file mmc_utils and just get this

lovejoy@acer:~$ adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
4FC6000600000001 recovery

lovejoy@acer:~$ adb push '/home/lovejoy/Desktop/kindleemmc/mmc-utils-master/mmc_utils' /sbin
545 KB/s (22232 bytes in 0.039s)
lovejoy@acer:~$ adb shell
~ # mmc_utils vendor 0 /dev/block/mmcblk0
/sbin/sh: mmc_utils: not found
~ #

am i doing something wrong?
 
Last edited:

kinfauns

Retired Senior Moderator and Retired DC Lead
Jan 5, 2012
1,864
3,543
@kinfauns do i push all of the files from mmc-utils-master or just mmc-utils from within mmc-utils-master.
also my damage is in my recovery partition so the only recovery i can boot into and get adb working is "cwm-based recovery v5.0.2.7 full (by DooMLoRD)" I remember this from when i first got curupted all those months ago. even when I usb boot into twrp from pokey's firekit it just hangs on the twrp boot animation (all other recoveries do this except DooMLoRD's, hence "I think its my recovery partition thats screwed) anymore help please. cheers for your time Steve

Maybe a little more detailed explanation for a mere noob like me.... Thanks again:)

Edit.
I tried just the 1 file mmc_utils and just get this

lovejoy@acer:~$ adb devices
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
List of devices attached
4FC6000600000001 recovery

lovejoy@acer:~$ adb push '/home/lovejoy/Desktop/kindleemmc/mmc-utils-master/mmc_utils' /sbin
545 KB/s (22232 bytes in 0.039s)
lovejoy@acer:~$ adb shell
~ # mmc_utils vendor 0 /dev/block/mmcblk0
/sbin/sh: mmc_utils: not found
~ #

am i doing something wrong?

I've never attempted the process Hashcode has outlined here, so I'm not the best person to be helping you. These answers/tips are just based on my experience with other things...

- Hopefully, you've managed to pull those two files mentioned in the OP.
- Just the mmc_utils binary should be all you need. The other files there are used to build that binary.
- The error you got is telling you that the shell can't find the mmc_utils binary in its known executable path.
- Check to see that the mmc_utils binary is actually in /sbin -> "ls /sbin"
- Make sure that it's executable -> "chmod 777 /sbin/mmc_utils"
- Try using the full path to the executable in your command -> "/sbin/mmc_utils vendor 0 /dev/block/mmcblk0"
- The binary doesn't necessarily have to be run from /sbin... you just need to get it somewhere in the filesystem. You'll have to look around to see what's available to you. Since you've got a damaged storage system, I don't know what your options might be.

As a general tip, you might want to look into some basic unix/linux commands. Being able to get around the directory structure and do some rudimentary file manipulations is going to help you in a lot of other things.

Good luck.
 

Hashcode

Senior Recognized Developer
Sep 3, 2011
3,424
23,730
thanks again ill try again tonight. cheers steve

Sent from my Nexus 5 using Tapatalk

I'm about 80% done w/ the new bootloader for the KFire 1st Ed.. While the initial version will only have the same menu options as the existing firefirefire v1.5, I plan on adding a menu option under "Advanced" to support the EMMC fix from inside the bootloader(!)

It's kind of a complicated process to do from a bootloader standpoint, but I feel that it's by far the easiest way for users to recover from hard bricks, as they can use the usbboot process to load it. Basically process looks like this:
- Boot up new otterx bootloader (via pin short trick + usbboot)
- Use the menu system to go into Advanced -> EMMC Corruption Fix
- Select [ CONFIRM] that this will wipe the entire device
- The bootloader backs up the following partitions to memory: bootpart0, bootpart1, xloader, bootloader and recovery.
- Then it runs the Samsung iNAND command series to wipe the entire emmc
- Performs the format to re-establish the partition table
- Restores the backed up partitions

Then it would be up to the user to reboot into recovery and possibly re-flash whatever back to the device.

So if you continue to have issues, there's always that. Probably a week or 2 out tho, as I'm still working on the new menu system.
 
Last edited:

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
you kind sir are a genius.
thankyou i will give it a go when im home. cheers steve

Sent from my Nexus 5 using Tapatalk
 

lovejoy777

Inactive Recognized Developer
Dec 30, 2011
3,725
4,541
Nottingham
ok im going to wait for your bootloader as my copper shorting pad on the pcb is nearly gone (due to trying so many times last year). thanks again and i will watchout for your awesome bootloader. Steve

Sent from my Nexus 5 using Tapatalk
 

Top Liked Posts

  • There are no posts matching your filters.
  • 34
    * WARNING: This post contains very loose instructions for COMPLETELY erasing the MMC chip on the Kindle Fire 1st Gen. USE WITH CAUTION *

    THIS IS NOT FOR KINDLE FIRE 2 USERS WHO HAVE BRICKED IN SOME WAY. THIS IS FOR KINDLE FIRE 1ST GEN USERS WHO EXPERIENCED MMC CORRUPTION DUE TO UNFORSEEN CHANGES IN THE EARLY DEVELOPMENT OF THE 3.0 KERNEL.


    ----------------------
    BACKGROUND:

    So, yesterday I was in IRC and @Entropy512 mentioned they had found a leaked moviNAND spec sheet. This is some of the technical data for the mmc chip in our Kindle Fires:
    http://web3032.sh1.magic2008.cn.m1.magic2008.cn/uFile/3032/201144131450191.pdf

    In that spec sheet he pointed out CMD62 which is used to resize the boot0/boot1 partitions and a quote from the following paragraph (on page 11 of the PDF, section 4.1.3)
    After setting the boot partition size, all of data in the moviNAND is removed. And the value of EXT_CSD [227:226] and SEC_COUNT is automatically changing. So user should be careful changing boot partition size.

    He also pointed out a git location for the mmc-utils source code (a binary used to read/write/manipulate MMC via some of the pre-determined MMC_CMDs). And that in theory it should be possible to add some kind of command there to use CMD62 in a way to perform this "reset".
    https://kernel.googlesource.com/pub/scm/linux/kernel/git/cjb/mmc-utils/

    I forked this over to:
    https://github.com/Hashcode/mmc-utils

    Then, added a new variant to the command:
    mmc_utils vendor <size> <device>

    This implements CMD62 using the techsheet's instructions. And when run, it COMPLETELY ERASES the mmc chip. Everything goes. The partition tables, the boot0/boot1 contents and everything in your partitions. This should only be used if you have EMMC corruption caused by the early versions of the 3.0 kernel (You know if you have it).

    ----------------------
    INSTRUCTIONS

    Before using this, you want to backup your boot0/boot1 blocks if you can access them. They contain the MAC address info and serial #'s for your device. If you cannot access them, just know that you will need to generate a new mac and use idme to set it later, or you will have wifi issues. And you will never be able to use the Amazon OS due to security checks against the original serial # / MAC.

    I'm going to paraphrase very loosely how I restored my Kindle using Ubuntu with adb already installed and configured (not going to cover that here):

    1. Download all the files here and place them in 1 directory:
      http://goo.im/devs/Hashcode/otter/unbrick
      (NOTE: I've included 2 files created by @pokey9000 in this folder: aboot.bin and usbboot. He built them for use w/ Firekit. He's an awesome dev and deserves the credit for these files.)
    2. [optional] You may or may not be able to boot to recovery depending on the emmc damage / current state of your Kindle. I recommend you try and adb pull as many of your partitions as you can for backup. To help you reboot successfully, I recommend trying the following at the very least from recovery (if you can get there):
      • adb pull /dev/block/mmcblk0boot0
      • adb pull /dev/block/mmcblk0boot1
    3. Download TWRP for Kindle Fire 1st Gen and place this in the same directory (used with usbboot to enter recovery when there's no recovery on the device):
      http://techerrata.com/file/twrp2/blaze/openrecovery-twrp-2.6.0.0-otter.img

    To use usbboot to load recovery from USB go into the directory where you downloaded everything and run the following command:
    Code:
    ./usb_boot_twrp

    It should be waiting for USB connection to the device.

    Now you need to take the cover of the device off and short the test point located here to the surrounding metal wall (using a paper clip or some other metal object):
    http://xdaforums.com/showpost.php?p=19762674&postcount=51

    This should trigger usbboot and it will attempt to load to recovery.

    Once recovery is loaded:
    (WARNING THE COMMANDS BELOW WILL COMPLETELY RESET YOUR EMMC CHIP. BE SURE YOU TRIED TO BACKUP BOOT0/BOOT1 ABOVE)
    Code:
    adb push mmc_utils /sbin
    adb shell
    mmc_utils vendor 0 /dev/block/mmcblk0
    # (wait about a minute)
    mmc_utils vendor 4 /dev/block/mmcblk0
    # (wait another minute)

    At this point your ENTIRE mmc has been erased and you should probably reboot w/ usbboot again but instead use this command:
    Code:
    ./usb_boot_reformat
    This resets your partition table to the stock Amazon layout. And then loads recovery.

    Now, once back in recovery, the first thing you'll want to do is reformat the "media" partition:
    • Using TWRP go into "Wipe" -> "Advanced Wipe" -> checkbox "sdcard" and "Swipe to Wipe"

    To format the "cache" partition as ext4 via adb:
    Code:
    adb shell
    mke2fs -t ext4 /dev/block/platform/omap/omap_hsmmc.1/by-name/cache
    mount /cache
    exit

    Then you can attempt to reload the initial set of partitions:

    If you were able to backup the boot0/boot1 blocks above use this step. If not, skip this part and goto the next step.
    Code:
    adb push mmcblk0boot0 /sdcard
    adb push mmcblk0boot1 /sdcard
    adb shell
    cd /sys/block/mmcblk0boot0
    echo 0 > force_ro
    cd /sys/block/mmcblk0boot1
    echo 0 > force_ro
    dd if=/sdcard/mmcblk0boot0 of=/dev/block/mmcblk0boot0
    dd if=/sdcard/mmcblk0boot1 of=/dev/block/mmcblk0boot1
    exit

    Now we can restore the first set of partitions to make the device bootable to recovery:
    Code:
    adb push mmcblk0p1 /sdcard
    adb push mmcblk0p2 /sdcard
    adb push openrecovery-twrp-2.6.0.0-otter.img /sdcard
    adb shell
    dd if=/sdcard/mmcblk0p1 of=/dev/block/platform/omap/omap_hsmmc.1/by-name/xloader
    dd if=/sdcard/mmcblk0p2 of=/dev/block/platform/omap/omap_hsmmc.1/by-name/bootloader
    dd if=/sdcard/openrecovery-twrp-2.6.0.0-otter.img of=/dev/block/platform/omap/omap_hsmmc.1/by-name/recovery
    exit

    At this point you *should* be able to reboot the device w/o the use of usbboot, and get a normal bootloader screen where you can use the power button to choose a recovery boot.

    To complete your device recovery you need to find your preferred ROM (or download from http://get.cm/?device=otter), and place that on your sdcard and flash w/ gapps like any normal ROM install.


    For those who couldn't restore the boot0/boot1 partitions, you will want to use the "idme" command to reset the following field, or else wifi will probably have issues.:
    Code:
    idme mac <a random MAC addr>


    Enjoy.

    PS. The instructions above were completely written from memory AFTER I had fixed my device. I'm looking for any comments / cleanup you might experience if you try these instructions.
    5
    Very nice write up @Hashcode. Im just wondering what "unforseen changes" would you be talking about?

    Sent from my TF300T using Tapatalk 4

    There were a few devices which were running a CWM recovery built from the initial 3.0 kernel back in May 2012. That kernel was not patched for MMC_CAP_ERASE, and on our emmc chip it caused a wear levelling bug which basically made the device unusable.

    The entire thread is here:http://xdaforums.com/showthread.php?t=1651413

    This issue should not be hit by current Kindle Fire users.
    4
    This is a major victory in the fight against Superbrick.

    Unfortunately, the users hit hardest by the Superbrick bug (Samsung Galaxy S2 family) have devices that cannot be USB-booted in any way.

    Also, you might want to rename the command to be more descriptive. "vendor" could be anything - this is a very specific vendor command sequence here.

    Yeah I'll probably set it up "mmc_utils vendor bootsize <size> <device>" as there is a report summary I may add later.
    4
    @Hashcode my device suffered from the brick but i could "fix" it, but i lost some blocks on my partitions. I had to shrink some partitions, so i could use the device again.

    Doing this process can fix this for me, will i have back all my partition size right?

    It should. Unlike workarounds that avoid touching damaged areas, this resets the chip so completely that the corrupted wear leveller data structures are reset. At least that was the theory, and Hashcode's results with his Superbricked KFire confirm that this appears to be the case.