[ROOT][WIP] root 6.2.1 / install TWRP / unbrick any ROM

pokey9000 · Dec 23, 2011

kfuller said:
Great work pokey9000! Very interesting what you are doing.

A couple of questions if you can spare the time.
1) What bootmode is it that shorting the pin enables?
2) As I have a factory cable, would this do the same without popping the case?

Thanks. This bootmode isn't the same as you set with "idme". This boot mode (called SYS_BOOT) tells the CPU what kind of device to boot from. Stock bootmode is SYS_BOOT[5:0]=0b110110 which equates to MMC2(1)->USB->UART->MMC1. That is, it will try to find a valid bootloader on internal flash, then try USB, UART, and (nonexistant) second eMMC/SD slot. This must be for factory programming, where the Fire is assembled with a blank flash, and the first boot allows them to do a USB boot to shoehorn in the flash contents.

In correction to what I said earlier, this SYS_BOOT is one bit away from having USB boot first, then MMC2(1) boot last. If we could identify SYS_BOOT[5] and short it low permanently (remove/replace a resistor) then this would boot up just like the Nooks, where USB is tried before the internal flash. So it still needs soldering, but only a little once we find the correct signal.

The factory cable doesn't do the same thing. Amazon's version of the bootloader is rigged to look for the fastboot cable's presence. If it sees the ID pin tied to 5V, it will go into fastboot mode.

Since the fastboot cable behavior is in the bootloader, and Amazon can update the bootloader with an update (and has in 6.2 and 6.2.1), they can potentially lock out the fastboot cable method. I very much doubt this will happen since I think Amazon uses the fastboot cable for in-factory software updates and diagnostics.

The fastboot cable is definitely safer as long as you don't try to format everything or flash any untested bootloaders.

Also, and this is off topic and possibly already asked and answered, but I'm curious of your thoughts of the possibility to just select boot from usb on power up from the device, maybe through a utility such as TWRP or some other. Seems that if that could be done, one could greatly increase the size of storage, effectively circumventing the current internal storage limitation. And since the usb is removable and rewritable, you could revert to an earlier version archived on a pc if any updates get pushed that break something.

USB in this case has the Fire acting as a USB device to a host PC. It won't boot off of a thumb drive or whatever. It would be great if that were the case...

iDylan1357 · Dec 23, 2011

thanks so much man. I was switching between CM7 and Stock for a while, but I think I'm sticking with CM7 for now on, til ICS alpha of course

kfuller · Dec 23, 2011

pokey9000 said:
Thanks. This bootmode isn't the same as you set with "idme". This boot mode (called SYS_BOOT) tells the CPU what kind of device to boot from. Stock bootmode is SYS_BOOT[5:0]=0b110110 which equates to MMC2(1)->USB->UART->MMC1. That is, it will try to find a valid bootloader on internal flash, then try USB, UART, and (nonexistant) second eMMC/SD slot. This must be for factory programming, where the Fire is assembled with a blank flash, and the first boot allows them to do a USB boot to shoehorn in the flash contents.

In correction to what I said earlier, this SYS_BOOT is one bit away from having USB boot first, then MMC2(1) boot last. If we could identify SYS_BOOT[5] and short it low permanently (remove/replace a resistor) then this would boot up just like the Nooks, where USB is tried before the internal flash. So it still needs soldering, but only a little once we find the correct signal.

The factory cable doesn't do the same thing. Amazon's version of the bootloader is rigged to look for the fastboot cable's presence. If it sees the ID pin tied to 5V, it will go into fastboot mode.

Since the fastboot cable behavior is in the bootloader, and Amazon can update the bootloader with an update (and has in 6.2 and 6.2.1), they can potentially lock out the fastboot cable method. I very much doubt this will happen since I think Amazon uses the fastboot cable for in-factory software updates and diagnostics.

The fastboot cable is definitely safer as long as you don't try to format everything or flash any untested bootloaders.

USB in this case has the Fire acting as a USB device to a host PC. It won't boot off of a thumb drive or whatever. It would be great if that were the case...

I appreciate the reply. Its tough to stay current and these days seems most everything is software. I hesitate to ask questions here as I'm not code level, though I have surface knowledge due to management of a custom integration project with linux and asterisk at work. My forte and training is more on the hardware side, so no problem with SMD (other than needing magnification and hands less steady as I've gotten older ). Sounds like you have that covered but if I can help let me know.

Your original post and your reply both have piqued my curiosity. Ubuntu 11.10 on a stick is sweet by the way! Makes me wonder why windows at all. And, this may be the answer to finally de-bricking my Fire - just as soon as I get all the presents wrapped

.

As for needing a usb host, check out this link: http://www.talkandroid.com/73692-an...oid-2-3-squeezed-onto-usb-stick/#.TvUHXXqQJIw

Thanks again and have a merry Christmas.

pokey9000 · Dec 24, 2011

kfuller said:
I appreciate the reply. Its tough to stay current and these days seems most everything is software. I hesitate to ask questions here as I'm not code level, though I have surface knowledge due to management of a custom integration project with linux and asterisk at work. My forte and training is more on the hardware side, so no problem with SMD (other than needing magnification and hands less steady as I've gotten older ). Sounds like you have that covered but if I can help let me know.

Thanks, I'm all set on the SMD front. I've got access to some nice rework equipment at work if I need it. It looks like each signal to strap the CPU into a different boot mode is flanked by pads for either pullup or pulldown, so to change the value you just move the resistor (or wire jumper) from one side to the other.

Your original post and your reply both have piqued my curiosity. Ubuntu 11.10 on a stick is sweet by the way! Makes me wonder why windows at all. And, this may be the answer to finally de-bricking my Fire - just as soon as I get all the presents wrapped .

As for needing a usb host, check out this link: http://www.talkandroid.com/73692-an...oid-2-3-squeezed-onto-usb-stick/#.TvUHXXqQJIw

If only it were that easy... The stage of the boot that's being controlled by shorting the pin is managed by software permanently baked into the CPU. We get a selection of boot sources (various flash, external SD card, USB device mode, serial) but we can't add a new one after the fact. Because this is hardcoded into the CPU, Amazon can't take this boot & install scheme from us unless they start making Fires with the relevant signals buried in the PCB.

The hardware is there to do USB host, but it's not really possible to boot from it.

mrpaint · May 23, 2012

Sorry for replying to this old thread but I couldn't find a more relevant thread so please bear with me (and help me!).

So today I stupidly flashed .zip as the bootloader so the KF has become a brick. I remove the back cover wanting to try the shorting trick but there no usbboot for Mac OSX so I cloned your repo and pulled this commit (https://github.com/cfriedt/omap4boot/commit/7e6ccff81be0171c651595ce5c69b9571f3a133a) and successfully compiled for darwin. Then I tried

Code:

./usbboot aboot.bin u-boot.bin

usbboot and aboot.bin is my compiled version
u-boot.bin is the one in this thread's first post .zip package

This is the output

Code:

waiting for OMAP44xx device...
sending 2ndstage to target...
waiting for 2ndstage response...
sending image to target...

I also noticed the power led flashed green once. Then I tried fastboot to no avail... Can you help? I did the shorting trick for 5 times and it all ended up the same way.

Thank you.

pokey9000 · May 26, 2012

mrpaint said:
Sorry for replying to this old thread but I couldn't find a more relevant thread so please bear with me (and help me!).

So today I stupidly flashed .zip as the bootloader so the KF has become a brick. I remove the back cover wanting to try the shorting trick but there no usbboot for Mac OSX so I cloned your repo and pulled this commit (https://github.com/cfriedt/omap4boot/commit/7e6ccff81be0171c651595ce5c69b9571f3a133a) and successfully compiled for darwin. Then I tried

Code:

./usbboot aboot.bin u-boot.bin

usbboot and aboot.bin is my compiled version
u-boot.bin is the one in this thread's first post .zip package

This is the output

Code:

waiting for OMAP44xx device... sending 2ndstage to target... waiting for 2ndstage response... sending image to target...

I also noticed the power led flashed green once. Then I tried fastboot to no avail... Can you help? I did the shorting trick for 5 times and it all ended up the same way.

Thank you.

Use the usbboot you compiled with my aboot. aboot contains device specific memory and I/O setup.

bsoplinger · May 27, 2012

mrpaint said:
Sorry for replying to this old thread but I couldn't find a more relevant thread so please bear with me (and help me!).
...
I remove the back cover wanting to try the shorting trick but there no usbboot for Mac OSX so I cloned your repo and pulled this commit (https://github.com/cfriedt/omap4boot/commit/7e6ccff81be0171c651595ce5c69b9571f3a133a) and successfully compiled for darwin.

If you get this working with the help suggested, would you please post the Mac OSX usbboot you're created? Then I won't need to get Linux working to try to fix my bricked Kindle.

Sent from my Sprint Evo View 4G (PG41200) using Xparent Purple Tapatalk 2

mrpaint · May 31, 2012

pokey9000 said:
Use the usbboot you compiled with my aboot. aboot contains device specific memory and I/O setup.

Thank you for your reply. I have been away for the last few days so I couldn't response earlier.

Anyway, I tried with your aboot.bin and got the same "sending image to target" message. After that, I tried "fastboot boot twrp-blaze-2.0.0RC0.img" to no avail (I have fastboot in my PATH). The power led shines for 1 seconds (when the usbboot connects to it I think) before turning off...

Do you have any idea?

---------- Post added at 04:52 PM ---------- Previous post was at 04:42 PM ----------

bsoplinger said:
If you get this working with the help suggested, would you please post the Mac OSX usbboot you're created? Then I won't need to get Linux working to try to fix my bricked Kindle.

Sent from my Sprint Evo View 4G (PG41200) using Xparent Purple Tapatalk 2

It doesn't work for me yet but you can get my compiled version here

https://github.com/downloads/daohoangson/omap4boot/usbboot

Good luck.

bsoplinger · May 31, 2012

If you get that MacOS port working I'll be all over it.

But until then, can this be done with a live CD vs. a full blown Linux install?

Sent from my Sprint Evo View 4G (PG41200) using Xparent Purple Tapatalk 2

smirkis · May 31, 2012

bsoplinger said:
If you get that MacOS port working I'll be all over it.

But until then, can this be done with a live CD vs. a full blown Linux install?

Sent from my Sprint Evo View 4G (PG41200) using Xparent Purple Tapatalk 2

u can do it with a thumb drive install.

Sent from my HTC Glacier using xda premium

lovejoy777 · May 31, 2012

i tried allsorts and now find it easy i've done it so many times. lol

follow the steps exactly

download pendrive installer
follow instructions to install livecd onto pendrive (i tried this so much with my ubuntu desktop, it did not work)
extract the fk script to the pen drive
boot pc of usbpen

make sure your kindle is off (hold power for 30 seconds)
make sure usb A (big end) plugged into pc
make sure usb b (small end) is not plugged into kindle)
open terminal and type
sudo /cdrom/fk and press enter.
select option from list ie. usb_fix press tab
then press enter
it should say waiting for omap device

short out pin and frame and keep it shorted as you plug in your kindle (i found i had to hold the pin shorted all the time it was running script).

hope this is usefull

steve

westlandnick · Jun 12, 2012

So I also made the mistake of flashing the firefirefire as a zip and bricked my kf. I have a adb to kindle working ubuntu computer, I have tried shorting the pin several times and I'm getting nothing... In my terminal I have:

nick@ftp:~/rekindle$ sudo ./usbboot aboot.bin u-boot.bin; ./fastboot boot twrp.img
[sudo] password for nick:
?
waiting for OMAP44xx device...
^C< waiting for device >

When I short the pin and plug it in I get nothing... I've tried holding the pin for several seconds after plugged in.. I'm getting nothing. After I bricked the KF I left it sitting for about a week. Is it possible I drained the battery? Will it not charge when its bricked? I plugged it in for a few hours, tried again, still nothing.

Any suggestions??

---Edit---
I finally got the usb-shorting trick to work with the fire kit, For anyone else in this situation just keep trying. I probably shorted mine at least 50 times before it finally worked.

assasukasse · Aug 4, 2013

insted of opening the difficult case what about drilling a small hole that allows a tool to get tru and short?
Does anyone have a case open to take precise measurements?

soupmagnet · Aug 4, 2013

assasukasse said:
insted of opening the difficult case what about drilling a small hole that allows a tool to get tru and short?
Does anyone have a case open to take precise measurements?

Bad idea. It's too easy to create an ESD and ruin some component. Then you would have to deal with dust, dirt, and possibly even moisture getting in. It's best to just open the case.

Oh, and use a safety pin for the short

Sblood86 · Aug 6, 2013

assasukasse said:
insted of opening the difficult case what about drilling a small hole that allows a tool to get tru and short?
Does anyone have a case open to take precise measurements?

soupmagnet said:
Bad idea. It's too easy to create an ESD and ruin some component. Then you would have to deal with dust, dirt, and possibly even moisture getting in. It's best to just open the case.

Oh, and use a safety pin for the short

Just thought I'd mention (in case someone hasn't) guitar picks are particularly helpful when opening cases.

piercedfreak · Sep 19, 2014

ok, so i finally got it to work, but cant seem to install anything. twrp is installed via fastboot, and the kindle is in recovery, so fastboot will not work, and when i try to install a rom via the booted twrp it fails. what should i do?

sd_shadow · Sep 19, 2014

hairy_testicles said:
when i try this i get nothing on the screen, after shorting it 5-6 times, but the cpu chip gets warm, so i know its turning on, do i need to just keep trying, or is my kindle fire first gen dead as dead can get?

Think you just need a fastboot cable, and a pc with drivers installed properly
Or use soupkit on a linux system

Sent from my XT894 using Tapatalk

poshat · Sep 22, 2014

Same problem with Huawei U9500 (omap4440)

Have same problem with Huawei Ascend D1 (U9500) - OMAP4440 SoC. I lost bootloader, can't boot and flash firmware. May be somebody advice me something about way to repair bootloader? I tried find "short the point" on motherboard (look in attach), but didn't find it.

maheboi · Apr 22, 2015

Is there anyway to do this with the kindle fire 2? i dont have the fastboot cable and im trying to short it into fastboot with this method. i already had twrp installed, just acidentally wiped internal storage and im now in boot loop with no adb connection.

koop1955 · Apr 23, 2015

maheboi said:
Is there anyway to do this with the kindle fire 2? i dont have the fastboot cable and im trying to short it into fastboot with this method. i already had twrp installed, just acidentally wiped internal storage and im now in boot loop with no adb connection.

You would be better off asking on the Kindle Fire 2 forums: http://xdaforums.com/kindle-fire-hd/fire-2-development

[ROOT][WIP] root 6.2.1 / install TWRP / unbrick any ROM

Senior Member

Senior Member

Member

Senior Member

Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

Inactive Recognized Developer

Member

Senior Member

Retired Forum Moderator

Inactive Recognized Developer

Senior Member

Recognized Contributor / XDA Welcome Team

Member

Attachments

Senior Member

Senior Member

Similar threads

Top Liked Posts