• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Kindle Fire HD (3rd Generation) Bootloader Unlock and TWRP

Search This thread

spudowiar

Senior Member
Dec 7, 2013
132
142
spudowiar.me
Code:
#include <std/disclaimer.h>

/*
 * Your warranty is now void.
 *
 * I am not responsible for bricked devices, dead SD cards,
 * thermonuclear war, or you getting fired because the alarm app failed. Please
 * do some research if you have any concerns about features included in this ROM
 * before flashing it! YOU are choosing to make these modifications, and if
 * you point the finger at me for messing up your device, I will amputate it with
 * a piece of rusty metal. Unless it kills your cat, in which case I shall apologise
 * for your loss.
 */
This is for the 2013 Kindle Fire HD (3rd Generation) "soho" or KFSOWI. Please follow the instructions below very carefully. These instructions WILL change, ensure you keep up to date.

First, download and extract the attachment (exploit.zip) into a folder. Then you need to download Fire OS 4.5.5.1 and SuperSU into that folder. Check the MD5 sums!

Although not recommended, if your Fire is rooted, you can enter fastboot mode without a fastboot cable. Using a fastboot cable covers you against most cases of bricking your device. Not using one increases the likelihood.

To use this totally unsupported, unsafe method of accessing fastboot mode, run

Code:
adb shell su -c "dd if=/dev/zero of=/dev/block/platform/omap_hsmmc.1/by-name/boot bs=1 count=1 seek=848"
adb reboot

Make sure you have the latest version of adb and fastboot and that you have installed drivers for the Fire (if you run an inferior operating system). Boot into Fire OS and ensure you have a good charge on the device. Connect the device with a fastboot cable and enter fastboot mode.

Run

Code:
fastboot -i 0x1949 oem format
fastboot -i 0x1949 flash boot hijack.img
fastboot -i 0x1949 flash system system.img
fastboot -i 0x1949 continue
Now wait for the Amazon logo with the orange underline and run

Code:
fastboot -i 0x1949 flash boot recovery.img
fastboot -i 0x1949 oem format
fastboot -i 0x1949 continue
Now wait for TWRP to load up and go into Advanced -> ADB Sideload and tick the two boxes (Wipe Dalvik Cache and Wipe Cache) then swipe the slider (Swipe to Start Sideload). Return to your terminal and run (changing the filename, if necessary)

Code:
adb sideload [B]update-kindle-11.4.5.5_user_455002120.bin[/B]
Now wait for TWRP to finish flashing and press Back then go into ADB Sideload and swipe the slider (Swipe to Start Sideload). Return to your terminal and run (changing the filename, if necessary)

Code:
adb sideload [B]UPDATE-SuperSU-v2.46.zip[/B]
If you want to, you can download the Google Apps and flash them in a similar manner. Google Apps will cause issues with Fire OS if you perform a factory reset! You have been warned.

Now wait for TWRP to finish flashing, remove the fastboot cable and press Reboot System. When the device has booted, reinsert the cable and run

Code:
adb push recovery.img /sdcard/recovery.img
adb shell su -c "dd if=/sdcard/recovery.img of=/dev/block/platform/omap_hsmmc.1/by-name/recovery"
adb push exploit.img /sdcard/exploit.img
adb shell su -c "dd if=/sdcard/exploit.img of=/dev/block/platform/omap_hsmmc.1/by-name/exploit"
adb shell rm /sdcard/recovery.img /sdcard/exploit.img

To boot into recovery, power off the device and hold the volume button [ - ] then push the power button (you may need to do this more than once). When the Amazon logo appears, release the volume button.

Please could any testers report back with results, and which model they have (pictures of it running TWRP would be nice). If you have any problems, also include your entire terminal session and any errors TWRP gives when flashing. You shan't recieve help otherwise. If you are inexperienced, please wait for other testers to try this method.

Please refrain from mirroring any of the files, just link back to this post.

ROM Developers: you need to add boot.img from the files to the beginning of your ROM's boot.img


XDA:DevDB Information
Kindle Fire HD (3rd Generation) Bootloader Unlock and TWRP, Tool/Utility for the Amazon 7" Kindle Fire HD

Contributors
spudowiar

Version Information
Status: Alpha

Created 2015-12-13
Last Updated 2016-01-01
 
Last edited:

bobcat131

Senior Member
Sep 15, 2013
154
15
Venice
Test #1

This is a major accomplishment and all us hackers love you. :good:





I tested and here are some observations/suggestions.
1. Make a backup of your device before starting this exploit.
2. The command "adb reboot" does not reboot into fastboot mode even when connected with fastboot cable.
Try to disconnect fastboot cable, turn off device, and reconnect fastboot cable. Boots into fastboot ok.
Will try from scratch again.
 
Last edited:

Rhyn

Senior Member
Aug 25, 2012
159
90
Budapest
I got stucked.

Everything went well until the second oem format command. Thats just not working. I'm using ubuntu in a virtualbox on windows 7, i'll try it tomorrow from my workplace where I have a real ubuntu installation.

I have a 16G version.

the console output:

[email protected]:/home/bari/SOHO# fastboot -i 0x1949 devices
00D306073494080F fastboot
[email protected]:/home/bari/SOHO# fastboot -i 0x1949 oem format
...
OKAY [ 0.052s]
finished. total time: 0.052s
[email protected]:/home/bari/SOHO# fastboot -i 0x1949 flash boot recovery.img
target reported max download size of 1005584384 bytes
sending 'boot' (8192 KB)...
OKAY [ 1.033s]
writing 'boot'...
OKAY [ 0.583s]
finished. total time: 1.616s
[email protected]:/home/bari/SOHO# fastboot -i 0x1949 flash system system.img
target reported max download size of 1005584384 bytes
sending 'system' (6370 KB)...
OKAY [ 0.821s]
writing 'system'...
OKAY [ 0.913s]
finished. total time: 1.734s
[email protected]:/home/bari/SOHO# fastboot -i 0x1949 continue
resuming boot...
OKAY [ 0.004s]
finished. total time: 0.004s
[email protected]:/home/bari/SOHO# fastboot -i 0x1949 oem format
...
FAILED (command write failed (Broken pipe))
finished. total time: 0.002s
[email protected]:/home/bari/SOHO#
 

bobcat131

Senior Member
Sep 15, 2013
154
15
Venice
Test 2 failed.

All went well, until I rebooted to system from TWRP. It booted straight into language select then system settings and no navigation bar or home screen.
Stuck in system settings .
Is this just me or a bug?
 
Last edited:

spudowiar

Senior Member
Dec 7, 2013
132
142
spudowiar.me
This is a major accomplishment and all us hackers love you. :good:





I tested and here are some observations/suggestions.
1. Make a backup of your device before starting this exploit.
2. The command "adb reboot" does not reboot into fastboot mode even when connected with fastboot cable.
Try to disconnect fastboot cable, turn off device, and reconnect fastboot cable. Boots into fastboot ok.
3. The adb reboot recovery command reboots into red triangle options and unable to enter recovery.
Using power button and volume button also boots into red triangle. Needs a fix.
4. Boot into system is not complete. No navigation.
5. Missed the exploit flash, so I will reset and test again.

Which model do you have (8GB or 16GB)? I tested these instructions from stock using my fastboot cable, YMMV.

  1. That is probably wise but Amazon provide complete stock images of everything but the system (which can be reconstructed), cache and userdata
  2. "adb reboot" should reboot into fastboot mode since it does a hard reboot, I did this since my fastboot cable (whilst it worked with the "otter2") only allowed one command if it had been plugged into the powered off "soho". I only have access to one fastboot cable and this worked for that one.
  3. That means you didn't flash SuperSU or the recovery (that is the stock recovery)
  4. Not flashing the exploit results in the recovery not booting (the screen would flash red and fastboot would load up on both of the methods you tried), you didn't flash SuperSU or the recovery (the stock recovery booted up)

I got stucked.

Everything went well until the second oem format command. Thats just not working. I'm using ubuntu in a virtualbox on windows 7, i'll try it tomorrow from my workplace where I have a real ubuntu installation.

I have a 16G version.

the console output:


You were too quick on that command. I wrote "arrow underline" in the instructions, I meant "orange underline". (originally I wrote "orange arrow underline" :)) What happened is fastboot reinitialised but was not accepting commands. Also, VirtualBox may take a bit of time (there was a USB disconnect/reconnect). A live CD would be much easier, I avoided putting any Linux commands in here (I have a script to craft the images).



All went well, until I rebooted to system from TWRP. It booted straight into language select then system settings and no navigation bar or home screen.
Stuck in system settings .
Is this just me or a bug?



As I said, I tested these instructions from stock. Did you try a factory reset? (You can do a backup in TWRP :eek:)


does this work?
Code:
adb reboot-bootloader
Of course! My bad.

See above.

Anyway, this is definitely a WIP, I have access to one device and one fastboot cable. You can help iron out any bugs with this method. Thanks for trying! :eek:
 
Last edited:
  • Like
Reactions: codomir and Rhyn

spudowiar

Senior Member
Dec 7, 2013
132
142
spudowiar.me
Booting into TWRP might cause a TWRP bootloop (when you reboot, it boots back into TWRP instead of system). For now, only use TWRP with access to a fastboot cable (so you can go into fastboot and do fastboot -i 0x1949 continue) or you could flash /system/recovery.img to the recovery partition and reboot using the stock recovery - but don't bother!
 

Rhyn

Senior Member
Aug 25, 2012
159
90
Budapest
You were too quick on that command. I wrote "arrow underline" in the instructions, I meant "orange underline". (originally I wrote "orange arrow underline" :)) What happened is fastboot reinitialised but was not accepting commands. Also, VirtualBox may take a bit of time (there was a USB disconnect/reconnect). A live CD would be much easier, I avoided putting any Linux commands in here (I have a script to craft the images).

It was the virtualbox. On my work computer from linux it worked perfectly.

Pictures as you requested :) http://imgur.com/a/GVr7f
 

Top Liked Posts

  • There are no posts matching your filters.
  • 51
    Code:
    #include <std/disclaimer.h>
    
    /*
     * Your warranty is now void.
     *
     * I am not responsible for bricked devices, dead SD cards,
     * thermonuclear war, or you getting fired because the alarm app failed. Please
     * do some research if you have any concerns about features included in this ROM
     * before flashing it! YOU are choosing to make these modifications, and if
     * you point the finger at me for messing up your device, I will amputate it with
     * a piece of rusty metal. Unless it kills your cat, in which case I shall apologise
     * for your loss.
     */
    This is for the 2013 Kindle Fire HD (3rd Generation) "soho" or KFSOWI. Please follow the instructions below very carefully. These instructions WILL change, ensure you keep up to date.

    First, download and extract the attachment (exploit.zip) into a folder. Then you need to download Fire OS 4.5.5.1 and SuperSU into that folder. Check the MD5 sums!

    Although not recommended, if your Fire is rooted, you can enter fastboot mode without a fastboot cable. Using a fastboot cable covers you against most cases of bricking your device. Not using one increases the likelihood.

    To use this totally unsupported, unsafe method of accessing fastboot mode, run

    Code:
    adb shell su -c "dd if=/dev/zero of=/dev/block/platform/omap_hsmmc.1/by-name/boot bs=1 count=1 seek=848"
    adb reboot

    Make sure you have the latest version of adb and fastboot and that you have installed drivers for the Fire (if you run an inferior operating system). Boot into Fire OS and ensure you have a good charge on the device. Connect the device with a fastboot cable and enter fastboot mode.

    Run

    Code:
    fastboot -i 0x1949 oem format
    fastboot -i 0x1949 flash boot hijack.img
    fastboot -i 0x1949 flash system system.img
    fastboot -i 0x1949 continue
    Now wait for the Amazon logo with the orange underline and run

    Code:
    fastboot -i 0x1949 flash boot recovery.img
    fastboot -i 0x1949 oem format
    fastboot -i 0x1949 continue
    Now wait for TWRP to load up and go into Advanced -> ADB Sideload and tick the two boxes (Wipe Dalvik Cache and Wipe Cache) then swipe the slider (Swipe to Start Sideload). Return to your terminal and run (changing the filename, if necessary)

    Code:
    adb sideload [B]update-kindle-11.4.5.5_user_455002120.bin[/B]
    Now wait for TWRP to finish flashing and press Back then go into ADB Sideload and swipe the slider (Swipe to Start Sideload). Return to your terminal and run (changing the filename, if necessary)

    Code:
    adb sideload [B]UPDATE-SuperSU-v2.46.zip[/B]
    If you want to, you can download the Google Apps and flash them in a similar manner. Google Apps will cause issues with Fire OS if you perform a factory reset! You have been warned.

    Now wait for TWRP to finish flashing, remove the fastboot cable and press Reboot System. When the device has booted, reinsert the cable and run

    Code:
    adb push recovery.img /sdcard/recovery.img
    adb shell su -c "dd if=/sdcard/recovery.img of=/dev/block/platform/omap_hsmmc.1/by-name/recovery"
    adb push exploit.img /sdcard/exploit.img
    adb shell su -c "dd if=/sdcard/exploit.img of=/dev/block/platform/omap_hsmmc.1/by-name/exploit"
    adb shell rm /sdcard/recovery.img /sdcard/exploit.img

    To boot into recovery, power off the device and hold the volume button [ - ] then push the power button (you may need to do this more than once). When the Amazon logo appears, release the volume button.

    Please could any testers report back with results, and which model they have (pictures of it running TWRP would be nice). If you have any problems, also include your entire terminal session and any errors TWRP gives when flashing. You shan't recieve help otherwise. If you are inexperienced, please wait for other testers to try this method.

    Please refrain from mirroring any of the files, just link back to this post.

    ROM Developers: you need to add boot.img from the files to the beginning of your ROM's boot.img


    XDA:DevDB Information
    Kindle Fire HD (3rd Generation) Bootloader Unlock and TWRP, Tool/Utility for the Amazon 7" Kindle Fire HD

    Contributors
    spudowiar

    Version Information
    Status: Alpha

    Created 2015-12-13
    Last Updated 2016-01-01
    5
    The unlock is released, go to the first post to find out how to install!
    4
    I had to not install gapps at first. Installed after running system a few times and then flashed gapps from the sd with TWRP and dl youtube. Both the play store and youtube work fine so far. I didn't try any other gapps yet.

    Yeah, I'll have to do some trial and error but I'll focus on porting CM.