[DEV] Bootloader unlock procedure and software

Search This thread
By:
Advanced…
D

dpeddi

Senior Member
Mar 10, 2007
206
133
The steps described should be enough.

Perhaps later can be improved or can be added a windowa executable or apk that do all, but not now.
 
M

mxzwhx

Member
May 19, 2011
47
4
dpeddi said:
The steps described should be enough.

Perhaps later can be improved or can be added a windowa executable or apk that do all, but not now.
Click to expand...
Click to collapse

Okay,thanks.one more question, I'm currently running @ggow's HDX nexus ROM v2.0.4 ,do I have to roll back to Amazon fire os to do that ?or I could just do the unlock steps on currently ROM ?

Sent from my Nexus HDX 8.9 using XDA Free mobile app
 
D

dpeddi

Senior Member
Mar 10, 2007
206
133
mxzwhx said:
Okay,thanks.one more question, I'm currently running @ggow's HDX nexus ROM v2.0.4 ,do I have to roll back to Amazon fire os to do that ?or I could just do the unlock steps on currently ROM ?

Sent from my Nexus HDX 8.9 using XDA Free mobile app
Click to expand...
Click to collapse

No need to revert to stock.

Perhaps you can't use adb shell idme print.

If this step fails ask ggow to include idme in next hdx nexus.
 
R

rubinho

Senior Member
Feb 4, 2006
83
13
Saarland
@mxzwhx
The unlock procedur incl. "idme print" works fine with hdx nexus (2.0.5).

For creating the unlock signature you need linux. Only fastboot works with Windows
You just need to install the windows driver correctly (only for fastboot connection)
 
ggow

ggow

Recognized Developer
Feb 28, 2014
4,114
10,993
dpeddi said:
I get to unlock the bootloader of my kindle hdx 8.9

Prerequisite:
- Bootloader shipped with firmwareversion 1[34].3.1.0 <= x <= 1[34].3.2.4 (as we use the rsa bug)
- Rooted kindle

adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial

create a file unlock.img with following content:
0xmmssssssss
where mm=manfid and ss=serial

encrypt it with my vortox fork of signing tool at

https://github.com/dpeddi/Cuber

./cuber_unlockbl --sign ./unlock.img ./unlock.signed

connect the hdx to a linux box and do following command:

./fastboot -i 0x1949 devices
./fastboot -i 0x1949 flash unlock unlock.signed
./fastboot -i 0x1949 reboot

adb shell
idme print
[...]
unlock_code: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsv9S[...]WRUFx7FaA==

Regards and thank to all (Hashcode, Cpasjuste, Vortox...)
Click to expand...
Click to collapse

Excellent work :)

Definitely make developing custom kernels a whole lot safer.

Thank you.
 
  • Like
Reactions: tbm13
jeryll

jeryll

Senior Member
Dec 23, 2010
899
719
Lenovo P11
Realme GT
Thank you very much @dpeddi, after a little bit struggling with ubuntu live I managed to unlock my HDX 8.9 too (running Nexus 2.0.5) !!! Yay! Confirmed with idme print, thank you again, excellent work!
 

Attachments

  • IMG_20150214_170448.jpg
    IMG_20150214_170448.jpg
    233.9 KB · Views: 1,176
jcase

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,308
15,761
Raleigh NC
You should credit Lee Harrison (ralekdev) for discovery and publishing the vuln details.

Also, you can get teh serial and manfid from the bootloader itself, so you can craft it without the need for root

Edit:

Sorry wrong this this morning while in bed, sounds harsh, wasn't suppose to be. Congrats! This also works on FireTV. Its patched in first release of the phone.

dpeddi said:
I get to unlock the bootloader of my kindle hdx 8.9

Prerequisite:
- Bootloader shipped with firmwareversion 1[34].3.1.0 <= x <= 1[34].3.2.4 (as we use the rsa bug)
- Rooted kindle

adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial

create a file unlock.img with following content:
0xmmssssssss
where mm=manfid and ss=serial

encrypt it with my vortox fork of signing tool at

https://github.com/dpeddi/Cuber

./cuber_unlockbl --sign ./unlock.img ./unlock.signed

connect the hdx to a linux box and do following command:

./fastboot -i 0x1949 devices
./fastboot -i 0x1949 flash unlock unlock.signed
./fastboot -i 0x1949 reboot

adb shell
idme print
[...]
unlock_code: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsv9S[...]WRUFx7FaA==

Regards and thank to all (Hashcode, Cpasjuste, Vortox...)
Click to expand...
Click to collapse
 
Last edited:
  • Like
Reactions: ONYXis
A

andPS2

Senior Member
Jan 15, 2011
323
51
great work!
does this work for hdx 7 too?
cm11 will continue to run afterwards correct? (the one with the bootloader bypass)?
 
A

andPS2

Senior Member
Jan 15, 2011
323
51
btw for linux u guys need to apt-get install android-tools-adb and android-tools-fastboot for
ubuntu
adb reboot bootloader get into fastboot mode
both could be added to op
p.s. i guess idme is not included in [ROM] cm-11-20150110-UNOFFICIAL-thor
is there another way to check if bootloader was unlocked?
 
Last edited:
A

andPS2

Senior Member
Jan 15, 2011
323
51
got it unlocked too
my hdx screen didnt give any output other than fastboot mode
and invalid comment
 
M

mxzwhx

Member
May 19, 2011
47
4
File is not an Android boot image ,what does that mean ?

Sent from my Nexus HDX 8.9 using XDA Free mobile app
 
A

AmazonLeaker

Senior Member
Nov 20, 2014
72
21
Have anyone tried this on 14.3.2.8 ?

I know that it would not work but still can there be some one willing to test this, i would have tested it but currently my dual booting Ubuntu broke and I'm bad with Linux.


It would be very greatful if someone can help people with kindles on 14.3.2.8.

Amazon Canada has 4.5.3 update rolled out america would be soon on list i believe....
 
You must log in or register to reply here.

Similar threads

ggow
[DEV] Bootloader Signature Bypass
Replies
106
Views
33K
DB126
DB126
V
[Tool] Signing tool for pre 3.2.4 booloaders
Replies
37
Views
18K
D
draxie
ggow
  • Locked
[DISCONTINUED][STABLE][7.1.2][31 December 2017] Slim 7
Replies
90
Views
35K
V
vinhhaui22
ggow
[dev] usb otg
Replies
5
Views
6K
ggow
ggow
D
[DEV] Automated do-it-all app (idea)
Replies
2
Views
4K
F
fryheit

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 39
    D
    dpeddi
    I get to unlock the bootloader of my kindle hdx 8.9

    Prerequisite:
    - Bootloader shipped with firmwareversion 1[34].3.1.0 <= x <= 1[34].3.2.4 (as we use the rsa bug)
    - Rooted kindle

    adb shell
    cat /sys/block/mmcblk0/device/manfid
    cat /sys/block/mmcblk0/device/serial

    create a file unlock.img with following content:
    0xmmssssssss
    where mm=manfid and ss=serial

    encrypt it with my vortox fork of signing tool at

    https://github.com/dpeddi/Cuber

    ./cuber_unlockbl --sign ./unlock.img ./unlock.signed

    connect the hdx to a linux box and do following command:

    ./fastboot -i 0x1949 devices
    ./fastboot -i 0x1949 flash unlock unlock.signed
    ./fastboot -i 0x1949 reboot

    adb shell
    idme print
    [...]
    unlock_code: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMsv9S[...]WRUFx7FaA==

    to get into fastboot mode you can press:
    standby volume+ volume- at the same time and keep pressed

    follows list of fastboot command:
    fastboot -i 0x1949 getvar product
    fastboot -i 0x1949 getvar version
    fastboot -i 0x1949 getvar kernel
    fastboot -i 0x1949 getvar serialno
    fastboot -i 0x1949 getvar production
    fastboot -i 0x1949 getvar partition-size:userdata|sytem|cache
    fastboot -i 0x1949 getvar partition-type:userdata|sytem|cache
    fastboot -i 0x1949 getvar max-download-size
    fastboot -i 0x1949 boot (still untested by me)
    fastboot -i 0x1949 verify (still untested by me)
    fastboot -i 0x1949 flash (still untested by me)
    fastboot -i 0x1949 erase (still untested by me)
    fastboot -i 0x1949 continue
    fastboot -i 0x1949 reboot
    fastboot -i 0x1949 reboot-bootloader
    fastboot -i 0x1949 oem device-info
    fastboot -i 0x1949 oem idme ? (only if unlocked)
    fastboot -i 0x1949 oem idme cl3an (untested by me but is destructive!)
    fastboot -i 0x1949 oem idme v3rsion (untested by me but seems destructive!)
    fastboot -i 0x1949 oem relock (i'm lazy to test it)
    fastboot -i 0x1949 dump (don't work with current windows implementation of fastboot that i'm using now - try this)

    you can use python only tool too :
    http://xdaforums.com/kindle-fire-hdx/development/tools-create-unlock-img-fix-boot-img-t3050689
    http://xdaforums.com/kindle-fire-hd...e-software-t3030281/post58897784#post58897784

    Regards and thank to all (ralekdev, jcase, Hashcode, Cpasjuste, Vortox, draxie...)
    View
    33
    ceyo14
    ceyo14
    draxie said:
    Hi there,

    With so many complaints about Linux dependencies,
    I figured a Python-only version of cuber may be a good idea.
    (Windows does have Python ports, right?
    You'll still need python-gmpy2, in addition to fairly standard Python stuff.)

    So, here it comes.
    Both boot images and unlock codes are supported,
    depending on what you pass on the command line.

    For unlock codes, figure out your manfid and serial
    as explained by the OP, and use the following:
    Code: 
    > python cuberHDX.py [I]mmssssssss[/I]
Your unlock code is in '[I]mmssssssss[/I].unlock'.
    And, then do the fastboot dance from the OP.

    For boot images, the procedure is fairly similar:
    Code: 
    > python cuberHDX.py [I]your-boot.img[/I]
Your image '[I]your-boot.img[/I]' is now "signed".

    I've downloaded and tested the new version (-v2),
    and it works fine on my Apollo.
    Click to expand...
    Click to collapse

    For other that might not have understood as easily..., (its been a while since I work with anything) complete as follows. tested on HDX 7 (Thor) Rooted 13.3.1.0

    get Python 2.7 for windows and install it

    get GMPY2 for Python 2.7

    open command prompt to your ADB directory:

    Code: 
    adb shell
cat /sys/block/mmcblk0/device/manfid
cat /sys/block/mmcblk0/device/serial

    from these 2 results you get your the code we need, insert the last 2 digits of the manfID with your serial
    following

    like this: mmssssssss

    download the attachment on the following post: http://xdaforums.com/showpost.php?p=58864282&postcount=46
    Then place the file inside the attachement to C:\Python27 should be C:\Python\cuberHDX.py

    open command prompt in: C:\Python27

    replace "mmssssssss" with yours below:
    Code: 
    python.exe cuberHDX.py 0xmmssssssss

    that will put a new 0xmmssssssss.UNLOCK file in the Python27 directory

    copy that file to your fastboot directory.

    on an ADB prompt type

    Code: 
    adb reboot-bootloader

    then on a fastboot prompt type

    Code: 
    fastboot -i 0x1949 devices
fastboot -i 0x1949 flash unlock 0xmmssssssss.unlock
fastboot -i 0x1949 reboot

    thats it.

    Gathered all from this thread, just a little clearer I think...
    thanks to @dpeddi, @vortox, @draxie, @ApokrifX
    View
    8
    D
    draxie
    Python-only cuber

    Don't bother with the obsolete cuberHDX.py, please refer to this post my new post for a python-less alternative instead.

    Hi there,

    With so many complaints about Linux dependencies,
    I figured a Python-only version of cuber may be a good idea.
    (Windows does have Python ports, right?
    You'll still need python-gmpy2, in addition to fairly standard Python stuff.)

    So, here it comes.
    Both boot images and unlock codes are supported,
    depending on what you pass on the command line.

    For unlock codes, figure out your manfid and serial
    as explained by the OP, and use the following:
    Code: 
    > python cuberHDX.py [I]mmssssssss[/I]
Your unlock code is in '[I]mmssssssss[/I].unlock'.
    And, then do the fastboot dance from the OP.

    For boot images, the procedure is fairly similar:
    Code: 
    > python cuberHDX.py [I]your-boot.img[/I]
Your image '[I]your-boot.img[/I]' is now "signed".

    Finally, v3 fixes the text/binary issue and SHOULD work also on Windows.
    I cannot test as I do not have that OS..

    Oh, and thanks go to @vortox and @dpeddi for the predecessors of this script.


    UPDATE:

    For those who miss the '-c|--check' option of the original cuber,
    you can simply use the openssl command line to verify your unlock code.
    (Scroll to the right for the revelation.)
    Code: 
    > python cuberHDX.py AA12345678
Your unlock code is in 'AA12345678.unlock'.
> openssl rsautl -verify -inkey unlock.crt -certin -in AA12345678.unlock -hexdump
0000 - 30 78 41 41 31 32 33 34-35 36 37 38 0a 00 00 00   0xAA12345678....
0010 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0020 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0030 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0040 - 00 00 00 00 00 00 00 00-00 00 00 93 6a d2 8e da   ............j...
0050 - 94 30 8b 2c 38 21 09 2e-bd e1 13 7d dd e0 ba 22   .0.,8!.....}..."
0060 - e0 1d 8d 73 8a a3 f1 ac-5b f5 3d 06 c5 95 ba 2f   ...s....[.=..../
0070 - ab fe 86 7c 26 64 3d ee-47 84 1b cb 12 6a 42 27   ...|&d=.G....jB'
0080 - 53 04 14 f6 a4 17 89 fc-8c b6 96 d3 10 de 21 35   S.............!5
0090 - dc 8b c5 6e 4c ec f2 9e-c1 50 72 8a 06 ff 3b 61   ...nL....Pr...;a
00a0 - 1a a3 52 bd c3 04 13 4c-a1 2a 8f 93 88 6b 46 cf   ..R....L.*...kF.
00b0 - df 1f 1b f3 a1 7a d1 9d-a2 04 77 8a a3 37 14 c5   .....z....w..7..
00c0 - 08 98 5f ac 5b d7 0f 1f-fa fe 0f e2 a4 65 5f b3   .._.[........e_.
00d0 - f7 8b 9f bf a5 b2 28 84-39 e2 0d 03 6b 82 03 f2   ......(.9...k...
00e0 - 25 dc f1 41 9d 27 75 6f-10 fe 93 0d c7 95 71 67   %..A.'uo......qg
00f0 - 54 2b                                             T+
00f5 - <SPACES/NULS>
    You can add the '-raw' flag to the end of the command line
    if you also want to see the PKCS padding string...

    For boot images, slightly more acrobatics is needed,
    for getting the hash and the signature, but it's not too bad.
    This assumes 'dd' is available on your platform.
    Code: 
    [COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k of=/dev/null
[COLOR="Red"]3634[/COLOR]+0 records in
3634+0 records out
7442432 bytes (7.4 MB) copied, 0.00792165 s, 940 MB/s
[COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k skip=[COLOR="Red"]3633[/COLOR] count=256 iflag=count_bytes of=sig
0+1 records in
0+1 records out
256 bytes (256 B) copied, 0.000197051 s, 1.3 MB/s
[COLOR="Lime"]>[/COLOR] openssl rsautl -verify -inkey production.crt -certin -in sig -hexdump
0000 - ad 84 84 25 a7 89 57 c3-8c 67 6a c3 25 5c b7 2e   ...%..W..gj.%\..
0010 - f4 c8 90 ac a2 fb bf 36-91 3c 43 18 f4 08 c4 9e   .......6.<C.....
0020 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0030 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
0040 - 00 00 00 00 00 00 00 00-00 00 00 a4 8f 3e 09 eb   .............>..
0050 - 65 3c 1b 3e de 2e b8 0b-6c 37 55 40 40 9e c0 dd   e<.>....l7U@@...
0060 - f7 e0 25 7d 32 18 1b 93-dc ee 1e 9f 7c b7 1b 00   ..%}2.......|...
0070 - d8 62 ec 67 b2 46 74 e8-7f 58 3a b7 ff 22 60 cf   .b.g.Ft..X:.."`.
0080 - c4 27 07 83 3f d1 01 06-f6 e6 63 b7 77 5e 45 1f   .'..?.....c.w^E.
0090 - 6e 85 2f 29 4f d0 89 70-fb d7 3c e2 da 6f e3 06   n./)O..p..<..o..
00a0 - 5a f2 1f 9e ca aa 7d 84-24 f4 56 9d 8f 16 cf 9c   Z.....}.$.V.....
00b0 - c1 07 74 c4 b4 1b f4 7f-04 95 cf d4 93 a1 59 e8   ..t...........Y.
00c0 - 34 a6 aa 2a 7a 39 05 50-0f bb 2d 41 71 cf 8b 47   4..*z9.P..-Aq..G
00d0 - 7a e5 70 3c 36 27 e0 c1-a6 14 2b 28 92 f9 d1 c3   z.p<6'....+(....
00e0 - ac 1e 54 05 10 49 00 6d-ed f9 8a 0b f6 e7 4a 29   ..T..I.m......J)
00f0 - 9a 74 27 10                                       .t'.
00f5 - <SPACES/NULS>
[COLOR="Lime"]>[/COLOR] dd if=boot.img bs=2k count=[COLOR="Red"]3633[/COLOR] | sha256sum
3633+0 records in
3633+0 records out
7440384 bytes (7.4 MB) copied, 0.0493471 s, 151 MB/s
ad848425a78957c38c676ac3255cb72ef4c890aca2fbbf36913c4318f408c49e  -
    The first 'dd' line to '/dev/null' is just to get the size in pages.
    You can do the math yourself instead. I'm just lazy...
    The other 'dd' lines use that size-1, which may not always work,
    since some images contain additional all-zero pages at the end.
    In that case you'll need to experiment with the value to skip,
    or use a hexdump utility to figure out the offset.

    Oh, and you can get all those pesky certificates from
    an ancient post of mine (speculating about a bootloader unlock).
    View
    4
    DB126
    DB126
    D0ubl3_X said:
    Hello,

    steps for unlocking described by @ceyo14 here
    Click to expand...
    Click to collapse
    Some additional tips/guidance here which complements the link in the post by @D0ubl3_X. Although there are several different BL unlock guides/tools circulating I have found the one by @cey014 works best for my limited brain power.

    Unlocking is not hard but does involve utilizing tools/techniques you may not be familiar with and potentially fighting with Windows device drivers/security...especially on Win 8.1 x64. Ask targeted questions along the way; folks are generally willing to help if you have done your homework. There are no one click apks or hand holding tutorials. Grab the beverage of your choice, roll up your sleeves and plan to spend a fun evening screwing with stuff that is somewhat arcane.
    View
    3
    E
    EncryptedCurse
    draxie said:
    Note that it *IS* possible to roll back from 3.2.x to 3.1.0
    at least, up to and including 3.2.6, which I had before TWRP came.
    The instructions for 3.2.5 and above are at the end of the post.
    The procedure is verified for 3.2.6, but f you can get root on your device,
    I suspect that this might work for 3.2.7 & 3.28 as well, but I don't know
    (since I happened to have 3.2.6 at the time).

    If you are the adventurous type and you understand what the scripts do,
    you can "extrapolate" and move to 3.2.3.2 directly (which is what I did),
    but it may be both faster and easier to move to 3.1.0 first, and then use
    the stock update from Amazon to upgrade to 3.2.3.2.

    In either case, you'll need to fetch one of these, depending on your device:

    https://kindle-fire-updates.s3.amazonaws.com/update-kindle-13.3.2.3.2_user_323001720.bin
    https://kindle-fire-updates.s3.amazonaws.com/update-kindle-14.3.2.3.2_user_323001720.bin


    Good luck!
    Click to expand...
    Click to collapse

    Amazon started including anti-rollback protection for x.3.2.7 and x.3.2.8.
    View

New posts