Multi-platform 1-Click bootloader unlock for *ANY* 3rd Gen HDX (with VirtualBox)

Search This thread

draxie

Senior Member
Apr 20, 2014
513
624
Update: I have tried all variants of Synaptics.X.y.thor.img after converting the .ihex on http://matrixstorm.com/avr/hextobin/ihexconverter.html , rebooted the device. I noticed the problem "seems" to go away in portrait mode, but in landscape, i have to swipe multiple times until it works. However, the issue would come back soon after. Interestingly, if I pulled the virtual keyboard, I find sometimes only the first line (quertyuiop..) works the first time when typing, but not the second or third line of the keyboard.

I have a 2nd kindle HDX 7 (but 16GB) which is running AOSPExtended flawlessly. Is it possible to restored a backup of the 16GB on this 32GB problem device? I did try a backup on TWRP and restore the .img on the device but it did not resolve the issue.
Hmm... that isn't looiking great, is it...

Looking at the updater's README, you'll find a number of other interesting options.
For starters, you _could_ try to dump the config area from both devices and compare. That _might_ give
a clue about which firmware to flash to what area... I've never had to deal with this personally; so, I'm afraid
this is about as far as I can stretch my limits on this one. Perhaps, @ ggow could help you. I don' t know.
 

mbuck2019

Member
Jan 2, 2019
18
3
Ok, I looked at the README and the only config I could compare is the UI. The others don't give me an output, except "-pm" which is all zero'ed out. So I got the following, but it's an exact match on the 'good' HDX7 :

Draxie, your help is much appreciated. Are you based in the U.K? I thought I could send you the kindle if you were interested to have a go. I don't mind loosing everything on it. I bought it recently which was working without issues like this on FireOS. To remind, the problem only started after I flashed it with LOS16 (Thor) via 1-Click and then reverted back to AOSP.
 

Attachments

  • configdump.txt
    5 KB · Views: 8

draxie

Senior Member
Apr 20, 2014
513
624
I got the following, but it's an exact match on the 'good' HDX7 :
Hmm... interesting...

Draxie, your help is much appreciated. Are you based in the U.K? I thought I could send you the kindle if you were interested to have a go. I don't mind loosing everything on it.
I'm not in the UK, and I barely have time to take care of my own projects... SORRY!

I bought it recently which was working without issues like this on FireOS. To remind, the problem only started after I flashed it with LOS16 (Thor) via 1-Click and then reverted back to AOSP.
A relatively new addition to 1-Click, specifically motivated by the OP of the LOS16 thread,
is an option to wipe the misc partition (probably, selected by default).
(I didn't include an option for fota, since I've never seen such a partition
on any of my HDX tablets, independent of what ROM, stock or custom, they were on.)

You could compare those partitions with your "good" HDX and experiment with either
wiping or reflashing a copy from the "good" one.
 

mbuck2019

Member
Jan 2, 2019
18
3
Update: It looks like the problem is fixed. Here's how. I found this option in Developer Options called "Show taps" and I activated it. I noticed there were missing taps on part the screen when I swiped my finger across, no matter how many times I tried. Of course, when I switched into portrait mode, the traces were missing on the same area of the screen. I thought the digitizer was faulty. So I stripped the device open, disconnected the mainboard, removed it and put it back, rebooted, .. et voila... the issue disappeared. It sounds like the digitizer connection to the board might have been seated firmly all that time.

Please note, the digitizer connector is located underneath the board - it was a hell of a nightmare to plug it back in as the cable cannot be pulled out enough to be able to plug it in with the fingers. It took me more than 30 mins to get it seated properly.

I reran 1-Click and reinstalled AOSP. There was no need to fiddle with synaptics this time round.

Thanks for your help and tips. It was a great way to learn.
 

draxie

Senior Member
Apr 20, 2014
513
624
Oh, yes... it's tough to fix HW issues from SW... :cool:

Good job tracking down and fixing the culprit!!

I've heard similar stories about the volume buttons,
but unsure about the digitizer. BTW, in some of those
other cases, applying pressure EXTERNALLY at the right
place (approximately, of course; eye-balled from tear-down
videos for the location of the relevant connector) was enough.
I'd probably try that first before prying open my HDX.
Of course, you may have done that, too; for all I know.
 
  • Like
Reactions: mbuck2019

tfurrows

New member
Apr 30, 2013
1
5
Had a Fire HDX 7 3rd gen (C9R6QM) sitting in a drawer wasting space, thought I'd give it a try with a new ROM. Could not for the life of me get the boot loader unlocked... until I found this thread. Yes, you have to wait for the download link, but it is worth it. Worked flawlessly, quickly, and was easy to understand. This is some solid, solid work. MANY thanks!
 

madmaxmedia

Member
Sep 5, 2014
22
9
Do you guys know if this method can be used to restore a 1-Clicked unit to stock?

I have a 7 HDX lying around, am considering trading it in to Amazon towards an HD 10 ($15 trade in value, somehow higher than my 8.9 HDX lol.)
 

draxie

Senior Member
Apr 20, 2014
513
624
Do you guys know if this method can be used to restore a 1-Clicked unit to stock?

I have a 7 HDX lying around, am considering trading it in to Amazon towards an HD 10 ($15 trade in value, somehow higher than my 8.9 HDX lol.)
You'd probably have to apply quite few tweaks to that process to make it work.

I posted my original back2stockscript here a while back.
BUT, I have actually updated it since then, when helping someone restore their tablet.
If you're handy with a terminal, you might want to give it a try...
(SCRIPT UPDATED on 2011-11-12)

Code:
#!/usr/bin/env bash

set -e

x=${0##*/}

,() {
    echo $'\x1b[1;31m'"$*!"$'\x1b[m' >&2
    exit 1
}

@() {
    echo $'\x1b[1;37m'"$*"$'\x1b[m' >&2
}

[ -r "$1" ] || {
    echo Usage: $x UPDATE.BIN
    echo
    echo Replace UPDATE.BIN above with the Amazon update to be applied,
    echo e.g. $x update-kindle-14.4.5.5_user_455006420.bin
    echo
    , NB: the update will _also_ replace TWRP by stock recovery
}

@ make sure prerequisites installed
for cmd in adb zip unzip
do type -p $cmd || missing+=($cmd)
done
! ((${#missing[@]})) || , please install $'\x1b[7m'"${missing[*]}"$'\x1b[27m'

@ ensure a device is connected
adb devices -l | tee /dev/tty | grep -cq product: ||
    , please connect your device with USB debugging enabled

u=META-INF/com/google/android/updater-script
z="$1.zip"

# make a copy with a .zip extension
cp -v "$1" "$z"

# clean up on exit
on_exit() {
    trap - 0
    set +e
    rm -dfvr $z $u ${u%%/*}
}
trap on_exit 0

@ remove device checks, since ROM:s tend to change model name
unzip -u -o "$z" $u
sed -i '/^getprop/d' $u
zip -u "$z" $u

@ push the tweaked stock image
adb push "$z" /sdcard/

@ enter TWRP
adb reboot recovery
echo $'\x1b[1;36m'"
Your Kindle should now reboot to recovery (which _SHOULD_ be TWRP).
If the device boots normally or enters fastboot instead, please
boot to recovery manually (keep holding VolumeUp during boot)!
"$'\x1b[m'
adb wait-for-recovery

@ got recovery, make sure it is TWRP
while sleep 1
do v=$(adb shell twrp get tw_version) && [[ "$v" = "tw_version = "* ]] && break
done

@ got TWRP ${v##*= }, install stock update
sleep 1
#adb shell echo
adb shell twrp set tw_skip_digest_check 1
adb shell twrp install /sdcard/${z##*/}

@ wipe everything and reboot
adb shell twrp wipe cache
adb shell twrp wipe dalvik
adb shell twrp wipe data
adb reboot
echo $'\x1b[1;35m'"
Your Kindle should now take a long time to reboot to FireOS.
Be patient and make sure to 'Allow USB debugging', if asked!
"$'\x1b[m'
adb wait-for-device

read -sn1 -p \
    $'\x1b[0;33mReboot to stock recovery for Factory Reset? \x1b[7m[Y/n]\x1b[m '
echo
[ n = "${REPLY,}" ] || {
    adb reboot recovery
echo $'\x1b[1;33m'"
Your Kindle should now reboot to stock recovery for 'Factory Reset'.
"$'\x1b[0;33m'"
The [VolumeDown] and [Power] buttons can be used to select and confirm
first 'Reset to Factory Defaults' and then 'Yes -- Erase everything'.
"$'\x1b[m'
}

@ DONE


BTW, depending on condition, these tables are still trending at
between double to quadruple of the cited 15USD trade-in value on eBay...
(e.g. https://www.ebay.com/itm/324811525956)
 
Last edited:
  • Like
Reactions: ffluffy and JJ2017

madmaxmedia

Member
Sep 5, 2014
22
9
You'd probably have to apply quite few tweaks to that process to make it work.

I posted my original back2stockscript here a while back.
BUT, I have actually updated it since then, when helping someone restore their tablet.
If you're handy with a terminal, you might want to give it a try...


Code:
#!/bin/bash -ex                                                                                                                              

[ -r "$1" ] || {                                                                                                                             
    echo Usage: ${0##*/} UPDATE.BIN [[.][-]]                                                                                                 
    echo                                                                                                                                     
    echo Replace UPDATE.BIN with the Amazon update to be applied,                                                                            
    echo e.g. update-kindle-14.4.5.5_user_455006420.bin                                                                                      
    echo                                                                                                                                     
    echo Use . to _move_ the .BIN to .ZIP [otherwise a _copy_ is made].                                                                      
    echo Use - to skip restoring stock recovery [i.e. keep TWRP as is].                                                                      
    echo Use .- to signal both.  Order is important.                                                                                         
    exit 1                                                                                                                                   
}                                                                                                                                       

u=META-INF/com/google/android/updater-script                                                                                                 
p=recovery/recovery-from-boot.p                                                                                                              
d=system/etc/recovery-resource.dat                                                                                                           
a=boot.img                                                                                                                                   
t=/data/local/tmp                                                                                                                            
e=/sdcard/rec.img                                                                                                                            

z="$1.zip"                                                                                                                                   

# keep original unless otherwise instructed                                                                                                  
x=mv                                                                                                                                         
[ . = "${2%-}" ] || x=cp\ -u                                                                                                                 

$x -v "$1" "$z"                                                                                                                              

# prepare exit handler                                                                                                                       
on_exit=()                                                                                                                                   
on_exit() {                                                                                                                                  
    trap - 0                                                                                                                                 
    set +e                                                                                                                                   
    for x in "${on_exit[@]}"                                                                                                                 
    do $x                                                                                                                                    
    done                                                                                                                                     
}                                                                                                                                       
trap on_exit 0

# may need to enter TWRP more than once
enter_twrp() {
    adb reboot recovery
    adb wait-for-recovery

    while sleep .1
    do
        case $(adb shell twrp get tw_version) in (tw_version\ =\ *) break
        esac
    done
}

# remove device checks, since ROM:s tend to change model name
unzip -u -o "$z" $u
on_exit+=("rm -dvr $u ${u%%/*}")  # clean up on exit
sed -i '/^getprop/d' $u
zip -u "$z" $u

# push the tweaked stock image
adb push -p "$z" /sdcard/

enter_twrp

# install stock update
adb shell twrp install /sdcard/${z##*/}

# wipe everything and reboot
adb shell twrp wipe cache
adb shell twrp wipe dalvik
adb shell twrp wipe data
adb shell reboot

# reboot might take a while
adb wait-for-device

# exit if restoring recovery should be skipped
! [ - = "${2#.}" ] || exit

# extract required bits and pieces for recovery
unzip -u -o "$z" $p $d $a
# clean up locally on exit
on_exit+=("rm -drv $p $d $a ${p%%/*} ${d%%/*}")

# push the extracted files
for i in p d a
do
    adb push -p ${!i} $t/$i
    # clean up on-device on exit
    on_exit+=("adb shell rm -f $t/$i")
done

# extract, adjust, and execute command to generate recovery image
unzip -p "$z" recovery/etc/install-recovery.sh | while read -a x
do
    case ${x[0]}${x[1]} in
        (applypatch-b)
            x[2]=$t/d
            x[3]=$t/a
            x[4]=$e
            x[7]=${x[7]%%:*}:$t/p
            adb shell touch $e
            adb shell "${x[@]}"
            adb shell mv $e.patch $e
            on_exit+=("adb shell rm -f $e")
    esac
done

enter_twrp

# install stock recovery and reboot
p=/dev/block/platform
d=$(adb shell ls $p)
adb shell dd if=$e of=$p/${d%$'\r'}/by-name/recovery bs=64k conv=notrunc
adb shell reboot

# reboot might take a while
adb wait-for-device



BTW, depending on condition, these tables are still trending at
between double to quadruple of the cited 15USD trade-in value on eBay...
(e.g. https://www.ebay.com/itm/324811525956)

Thanks draxie! I'm not much of a command line guy, so as you say probably better to just go EBay route- I've sold on EBay but hadn't checked recent prices for the 7".

BTW- last year I had a 8.9 HDX that I managed to screw up and brick into bulk mode (probably the only person who ever screwed up 1-Click...) You gave me some suggestions but I wasn't able to work it out so it's been sitting on the shelf. I just dusted it off and charged it the other day, somehow it booted successfully into Lineage OS and is now up and running (very smoothly too, for a 2013 tablet...)
 

cee-bot

Member
Jun 27, 2010
17
1
Incredible tool. Draxie provided a link very quickly - the tool is very polished and provides full instructions as you go along. It's clear a lot of time and effort has gone into this seamless experience. Thank you so much for making unlocking my old device so simple :)
 
  • Like
Reactions: draxie

tviderman

New member
Nov 26, 2021
1
2
Have been visiting this site for YEARS now but never ended up with an account. I've been a sad sad leech and will continue to be a sad sad leech. But I am so, SO grateful for this website. Have had to update my hdx every few years due to loss of compatibility with netflix/hulu. I just got one of the new baby 7" from amazon and man, I miss the hdx already. Thought I was done with it, thought I wouldn't want to get it up and running again. Buuuuuut I think I'll give it one more go :) This is a just a general "thank you" to all the types on here that understand things WAY more than I do that make these things so accessible to those willing to exert a little effort. You are all fantastic. <3
 

tekiro7

Member
Jul 18, 2018
13
2
I'd like to learn how to use the script. Can I simply copy and paste using ADB? If somehow I can get a crash course and I figure it out pretty quickly from there.
 

senthai

New member
Sep 7, 2010
4
1
Perhaps you can help me too @draxie
I ran the script and cannot get past this point:

+ '[' -r update-kindle-13.4.5.5_user_455004220.bin ']' + u=META-INF/com/google/android/updater-script + p=recovery/recovery-from-boot.p + d=system/etc/recovery-resource.dat + a=boot.img + t=/data/local/tmp + e=/sdcard/rec.img + z=update-kindle-13.4.5.5_user_455004220.bin.zip + x=mv + '[' . = '' ']' + x='rsync -u' + rsync -u -v update-kindle-13.4.5.5_user_455004220.bin update-kindle-13.4.5.5_user_455004220.bin.zip sent 76 bytes received 20 bytes 192.00 bytes/sec total size is 882479199 speedup is 9192491.66 + on_exit=() + trap on_exit 0 + unzip -u -o update-kindle-13.4.5.5_user_455004220.bin.zip META-INF/com/google/android/updater-script Archive: update-kindle-13.4.5.5_user_455004220.bin.zip signed by SignApk inflating: META-INF/com/google/android/updater-script + on_exit+=("rm -dvr $u ${u%%/*}") + sed -i '/^getprop/d' META-INF/com/google/android/updater-script sed: 1: "META-INF/com/google/and ...": invalid command code M + on_exit + trap - 0 + set +e + for x in '"${on_exit[@]}"' + rm -dvr META-INF/com/google/android/updater-script META-INF META-INF/com/google/android/updater-script META-INF/com/google/android META-INF/com/google META-INF/com META-INF

I have a thor model if this is relevant.
I also had to replace the cp command with rsync to get past my first error ^^
 

draxie

Senior Member
Apr 20, 2014
513
624
You ran "the script", you say? Interesting...
What you posted vaguely resembles
an old version of my back2stock script.
This thread is about 1-Click. What gives?

That said, the latest version is in post #628 above.
You just need to "CLICK TO SHOW CONTENT"...

BUT, if cp doesn't work on your system,
then you likely have more serious issues
than just using an old version of "the script"...
 
Last edited:

senthai

New member
Sep 7, 2010
4
1
Yep, figured that out and ran the latest one from post #628 on another machine with linux.
There cp seems to work ;)
but the tablet does not reboot into the recovery, also not with pressing plus on the tablet.
I tried to restart manually in recovery. Then it does not go further then got recovery, make sure it is TWRP

I have Safestrap 3.75 (TWRP v2.7.1.0)
Here is the whole
:
bash back2stock update-kindle-13.4.5.5_user_455007020.bin
make sure prerequisites installed
/usr/bin/adb
/usr/bin/zip
/usr/bin/unzip
ensure a device is connected
List of devices attached
D0FBA0A03483003J device usb:1-1.4 product:thor model:KFTHWI device:thor transport_id:1

'update-kindle-13.4.5.5_user_455007020.bin' -> 'update-kindle-13.4.5.5_user_455007020.bin.zip'
remove device checks, since ROM:s tend to change model name
Archive: update-kindle-13.4.5.5_user_455007020.bin.zip
signed by SignApk
inflating: META-INF/com/google/android/updater-script
updating: META-INF/com/google/android/updater-script
zip warning: Local Entry CRC does not match CD: META-INF/com/google/android/updater-script
(deflated 85%)
push the tweaked stock image
update-kindle-13.4.5.5_user_455007020.bin.zip: 1 file pushed. 2.6 MB/s (884405821 bytes in 319.655s)
enter TWRP

Your Kindle should now reboot to recovery (which _SHOULD_ be TWRP).
If the device boots normally or enters fastboot instead, please
boot to recovery manually (keep holding VolumeUp during boot)!

got recovery, make sure it is TWRP

Do I have to do anything before running "the script" :) ?
 
Last edited:

longbush

Member
Mar 31, 2010
18
3
Portland, Oregon
Many thanks to Draxie for this script, for me it worked flawlessly. I installed Lineage 6 rom and that continues to be an adventure, but the tablet is usable and disabling 5ghz wireless with the Magisk Module developed for that purpose seems to have stabilized the WiFi. Using the WiFi hotspot from my phone gives me a compact, full-service tablet which is what I was after, along with the challenge of making it work.

Thanks again to all the developers and users for making this possible.
 

senthai

New member
Sep 7, 2010
4
1
I ran the 1-Click script without any problems and now I can use my device again. It has a second life now :)
I have to find out why it does not rotate the screen and stuff, but the update to (real) TWRP and the ROM update went smooth.
Thank you very much @draxie
Great work and awesome experience!!!
 
  • Like
Reactions: draxie

Top Liked Posts

  • There are no posts matching your filters.
  • 174
    UPDATE 2022-03-05: Network Access Snafu

    During the last week or so, a server-side issue caused 1-Click to fail
    either silently or with a "1-Click needs network access!" message
    on startup. If you experienced the above, please try again!



    Changed:
    • VirtualBox 6.1.x support (tested with 6.1.16)
      works fine on Linux with Firefox and USB2 ports
      tends to be flaky on MacOS with Safari; PLEASE use Firefox or Chrome!!
      may need to connect via a USB2 hub or try different ports and cables
    • More accurate state assessment (i.e. rooted/unlocked/etc)
    • More aggressive planning logic
      always look for ROM/GAPPS/SU in internal storage
      may end up offering choices that make very little sense
    • Assorted fixes and improvements
      hopefully fewer new bugs were introduced than old ones fixed

    Unchanged:
    1. No prerequisites on the device side
      • no root needed
      • full stock is OK
      • stuck in fastboot is fine
      • heck, it even works with _some_ soft-bricks
    2. Does NOT work on Windows
      1-Click is a virtual machine and a script that starts the VM in VirtualBox.
      Unfortunately, VirtualBox on Windows fails to pass certain USB devices
      including the HDX in bulk mode from Windows to the VM.
    3. Network access required to grab the right aboot + TWRP for your device
    4. Optional TWRP magic to auto-install ROM.zip, GAPPS.zip, and SU.zip from internal storage
    PM me for a personal link and please state your regular HOST operating system.

    Gotchas:
    • Requests without HOST OS information will be ignored.
      • Naturally, the same applies to requests with a Windows HOST OS.
    • Running 1-Click inside another VM is almost guaranteed NOT to work.
    • Link requests should be sent at the earliest 2 weeks after join date.
      Freshly joined members are encouraged to spend some time
      familiarizing themselves with the details of working with this device
      by studying the relevant threads in this forum.
    • If you send a request be sure to monitor your account for replies!
      A response should arrive within a week (or so), but the link is only valid for 2 days.
      Don't miss your chance!
    8
    Hi i need any working mirror of this tool pls, thank's

    Look, I'm really sorry I haven't been able to put out a new release for a **long** time.
    Believe it or not, I'm still working on it, when I have the time, but I've had *way* too
    much going on the last couple of months. I recall making a comment that I'll surely
    finish this by Xmas, but the didn't happen. I do apologize. There's barely anything
    worse than unkept promises...

    I'd give you an old version, if I had more of an order (version control, etc.) on this
    project, but -unfortunately- it's a bit of a chaos. I have different versions floating
    around on different USB sticks. My "master" copy is being totally reworked (and
    not yet fully functional, nor tested to any reasonable standards). I simply cannot
    take responsibility or give support to some random version, which is also why I'm
    asking not to mirror. If you happen to find the wrong version (there had been
    test releases, which didn't quite work -- no bricks, as far as I know, but no joy,
    either), you'll be in for a surprise.

    Here's what I'll (try to) do: I've just finished my delivery for work (you know, the
    stuff that actually pays... ;)), and I have only two more interesting 'research' projects
    going on besides this tool. I'll put those aside and concentrate on this one. Let's see
    if I can get out a usable version in a few days. (I have most parts working, but I need
    to put everything together and _thoroughly_ test; so, you don't end up with a brick.)
    5
    Any takers?

    Very cool! Will be interesting to try this out (have to wait for a someone with an eligible device that is willing to give it a whirl).

    BTW, this works with already unlocked devices also, :p
    if anyone is willing to do some independent testing.
    This is how I tested also... should be completely harmless. ;)
    5
    That's awesome! I appreciate all the work you guys do! Let us know when you have it up to your standards :)

    I just posted a download link...
    5
    Had a Fire HDX 7 3rd gen (C9R6QM) sitting in a drawer wasting space, thought I'd give it a try with a new ROM. Could not for the life of me get the boot loader unlocked... until I found this thread. Yes, you have to wait for the download link, but it is worth it. Worked flawlessly, quickly, and was easy to understand. This is some solid, solid work. MANY thanks!