TUTORIAL: Unbrick your Huami AmazFit Smartwatch / Xiaomi AmazFit PACE - Amazfit

In case you bricked your watch, here is a tutorial how to unbrick the watch:
1. What is a "bricked" watch?
A bricked watch does no longer boot. It typically stops at the boot logo and waits forever. This can happen for example, if a flash of the system image failed and the boot image can no longer boot the system.
In such cases, you cannot reach adb from the command line, so there seems to be no way to recover the watch. Fortunately, it has been discovered how fastboot can be entered without a running system.
2. Procedure
Step 1: Get into fastboot
This is the most difficult part. @kiralex1995 has developed a procedure that will lead reproducible to boot the watch into fastboot mode, but it may take many tries (one user reported that it took him 30 min of tries).
Follow this guide: https://forum.xda-developers.com/sm...tches/amazfit-boot-fastboot-directly-t3546829
When you are in fastboot and see the fastboot logo, you have mastered the most difficult part.
Step 2: Choose a ROM to flash on the watch
There are currently three possible ROMs to choose from:
a.) The English AmazFit firmware 1.3.0n
Download the following file on your PC: https://mega.nz/#!xIkC1IQZ!bLLSN9BMvbp7zhZHg2oQq6p4ud-EFyUYkatCGKgHeS8
b) The Chinese AmazFit firmware 1.2.5a
Download the following file on your PC: https://mega.nz/#!tNdggR4b!VXmExGqdNixrj8pVLqTkAi_munmjF5RidRJP9L-LAXE
c) An old Chinese AmazFit firmware 0.9.50:
Download the following file on your PC: https://mega.nz/#!wY9mEQoI!0ARB0MaK0byjttgrPmJJQX4ZFdIXgHOUquxqFhghg7U
Step 3: Download flash script from xda
Download the attached flash script from this post to your PC.
Step 4: Unpack the archive on your PC
Depending on you PC choose the right method to extract the files in the ROM archive and the flash script.
Step 4: Boot the watch into special recovery
Check that your fastboot drivers see that watch (which should still show the fastboot logo):
'fastboot devices'
You should see your device listed. Otherwise check your fastboot driver installation on your PC. (Note: On Linux you sometimes need to use "sudo fastboot ...".)
Then boot the modded recovery that is included in the archive you unpacked in step 2.
'fastboot boot Amazfit-mod-recovery.img'
You will see a "FAILED" message on your commandline. This is normal.
On the watch you should see the recovery triangle and the text "No command".
Step 5: Transfer the ROM files and the flash script onto the watch
First check that you are now able to connect to your watch via adb:
'adb devices'
You should see your watch listed. Otherwise check you "adb driver" installation. For Windows take care that you use Khoushs universal adb drivers.
Then push the files to the watch:
'adb push boot.img /data/media/0/
adb push system.img.gz /data/media/0/
adb push md5s.txt /data/media/0/
adb push flash_rom.sh /data/media/0/'
Step 6: Enter the shell on the watch and check your files
After you have successfully transferred the files to the watch, you then enter the shell on the watch:
'adb shell'
You should see only a "#", meaning you have full root access.
Now switch drirectory to the sdcard
'cd /data/media/0/
ls'
You should see your files on the "sdcard", including the ones that were pushed before
7. Start flashing the files
Run the flash sccript with the following command on the watch:
'sh flash_rom.sh'
If everything worked correctly, you should see something like:
Code:
Validating images
boot.img.gz: OK
system.img.gz: OK
Starting to flash now. DO NOT TURN OFF OR REMOVE THE USB CABLE! Press Enter to continue or CTRL-C to stop!
Flashing boot.img
2304+0 records in
2304+0 records out
9437184 bytes (9.0MB) copied, 2.075793 seconds, 4.3MB/s
Flashing system.img
210944+0 records in
210944+0 records out
864026624 bytes (824.0MB) copied, 107.981352 seconds, 7.6MB/s
Finished
If you see any error message during or after flashing, then DO NOT REBOOT the watch, but get some help or analyse yourself, what went wrong. You can still reflash.
8. OPTIONAL: Delete the dalvik-cache
You can erase the dalvik-cache on the watch with the following command:
'rm -rf /data/dalvik-cache'
This will make the system "re-optimize" all apps when it boots (successfully) the next time. This is optional, as you could always do that later again.
9. Reboot the watch
If everything is ok, then you can reboot the watch
'reboot'
Your watch should boot normally into the flashed system, you downloaded. CONGRATULATIONS, you unbricked your watch!

Thank you for this post.

Neuer_User said:
In case you bricked your watch, here is a tutorial how to unbrick the watch:
1. What is a "bricked" watch?
A bricked watch does no longer boot. It typically stops at the boot logo and waits forever. This can happen for example, if a flash of the system image failed and the boot image can no longer boot the system.....[/B]
Click to expand...
Click to collapse
I'm so happy that my post help people. Thanks to your job and thanks to your rom @Neuer_User .
I wonder if it would be possible to create a rom with all google services included ?

First watch has just successfully been unbricked (1immortals watch) [emoji106] [emoji2]

kiralex1995 said:
I'm so happy that my post help people. Thanks to your job and thanks to your rom @Neuer_User .
I wonder if it would be possible to create a rom with all google services included ?
Click to expand...
Click to collapse
Yes, it would be possible. But you also need to look at connectivity. The watch checks does turn off wlan automatically.

@Neuer_User, you're a GOD !!!
All bow @Neuer_User , he is the true ruler of Amazfit, conquer of the M200 SoC, bringer of root to the MIPS platform ! all hail the king !!!

Neuer_User said:
Yes, it would be possible. But you also need to look at connectivity. The watch checks does turn off wlan automatically.
Click to expand...
Click to collapse
Well i guess constant WiFi would dramatically reduce the running time? On the other hand it might just be turned on for short periods, don't know how Google does that.
1immortal said:
@Neuer_User, you're a GOD !!!
All bow @Neuer_User , he is the true ruler of Amazfit, conquer of the M200 SoC, bringer of root to the MIPS platform ! all hail the king !!!
Click to expand...
Click to collapse
Congratulations and thanks to Neuer_User.

hi, after this step the watch reboot and restart the loop on logo. why?
'fastboot boot Amazfit-mod-recovery.img'
You will see a "FAILED" message on your commandline. This is normal.
On the watch you should see the recovery triangle and the text "No command".
edit: after more test, i'm not able to go to recovery mode. For an errore, when i try another time to go to Fastboot mode, i push 2 times the button and i ERASE ALL the watch, now i have a device called JZ4785 USB Boot Device.
There's some way to save this watch?
Thanks.

I think that you have entered some "Deep" flash mode - the JZ4785 is the SoC model, and you need to provide a driver for the flashing process.
please download this tool:
ftp://ftp.ingenic.com/DevSupport/Tools/USBBurner/cloner-1.2.0/cloner-1.2.0-windows_release.zip
you will need a 32 bit machine for running that.
it contains the drivers and the software for flashing. I hope that there's a way of creating a dump file of a working watch, and flashing it directly on yours.

1immortal said:
I think that you have entered some "Deep" flash mode - the JZ4785 is the SoC model, and you need to provide a driver for the flashing process.
please download this tool:
ftp://ftp.ingenic.com/DevSupport/Tools/USBBurner/cloner-1.2.0/cloner-1.2.0-windows_release.zip
you will need a 32 bit machine for running that.
it contains the drivers and the software for flashing. I hope that there's a way of creating a dump file of a working watch, and flashing it directly on yours.
Click to expand...
Click to collapse
This could indeed be the case. Noone of us ever entered that mode so far. It would be very good to understand, how you really got into that. It must have happened in the first step, where you were supposed to enter fastboot. Did you see the screen on the watch with the two options? There is a video in the link of @kiralex1995 post. Maybe you can comment, what exactly looked identical for you and where it exactly started to differ.
In case, you are really in that SOC flash mode, the Ingenic USBburner tool would indeed, probably, be the right tool to reflash the watch. As I mentioned, nobody here used that before. I have some experience with similar tools for the MTK platform. I believe that it should be possible to generate the necessary dump from a working watch, but this is all theory so far.
Where are you located?

well, nothing helped, there's no configs for the JZ4785, and there's no relevant information of partitions offset for flashing. we tried to flash both 1.2.5 and some generic ingenic image, with a lack of success as well
contacted ingenic for some clarification and some help, lets see where this lead to ...

Hello and thanks for tour support.
Also "launcher has stopped" i have to consider as a brick situation?
Palese led me know because i tried to update from chinese firmware but Now it doesn't work, i am able to start in fastboot mode
Thank you vero much fo and your advice

regarding the launcher errors, please try to unpair your watch and re-pair it again, it's a non-brick situation.

after i worte: fastboot boot Amazfit-mod-recovery.img . it says:
downloading 'boot.img'...
FAILED (command write failed (Unknown error))
finished. total time: 5.014s

alon1211 said:
after i worte: fastboot boot Amazfit-mod-recovery.img . it says:
downloading 'boot.img'...
FAILED (command write failed (Unknown error))
finished. total time: 5.014s
Click to expand...
Click to collapse
Try a different USB cable. Bad cables are known to produce that error.

This is pretty awesome! I used this to convert my Chinese Amazfit watch to English ROM, and it seems to work OK.
However, there's a piece missing from the bundle -- the recovery image. There's an OTA available, and I pulled the update.zip file using the Fastboot trick so the OS didn't load and delete it - then booted the "mod recovery". Here's that update.zip (to 1.3.2b): https://mega.nz/#!nIBDhLrR!7nQlWsn-TF4bsMNBSaTOfimY-vo-Z2R3dSavrDp1wsA
The OTA didn't succeed -- when it went to reboot to recovery and apply the update, it booted with Chinese text in recovery boot and failed with just one word - "Error". I'd imagine that's because recovery.img wasn't part of the bundle, so my watch still has the Chinese ROM recovery on it. Looking at the update.zip, it's fairly clear it's built in English - with English error messages in "updater-script".
I'm hunting around for the English ROM's recovery image, and will probably find it in the next few minutes, but figure I should mention this hole - and that this routine is also useful for converting to English. It'd been demonstrated before that you can run the English ROM just by flashing it (and boot.img), but no unified thread seems to exist for it yet (that I can find via Googling at least). :good:
edit: Literally 5 minutes later, bam. https://forum.xda-developers.com/showpost.php?p=71264431&postcount=599 - I downloaded that Fix_recovery bundle, pushed it to /data/media/0/ from the mod recovery, ran it, and it gave some errors but fell back to the "dd" method. So, all that's needed to get a complete English ROM flash is to add recovery.img and the line:
Code:
busybox dd if=recovery.img of=/dev/block/platform/jzmmc_v1.2.0/by-name/recovery bs=4096

Hi All,
I have just received my watch from a BT/WiFi issue repair.
I am not sure if they have fixed it as starting the watch and
I am getting "Unfortunately the launcher has stopped" message.
I do see the charging indicator but this is pretty much the only thing I see.
If I reboot pushing the button I get to the same point.
I see that this is an old problem. How do you guys fix this?
I do have adb shell access. Can I somehow reset to factory default using adb?
Thanks
Dimitar

dpenevdpenev said:
Hi All,
I have just received my watch from a BT/WiFi issue repair.
I am not sure if they have fixed it as starting the watch and
I am getting "Unfortunately the launcher has stopped" message.
I do see the charging indicator but this is pretty much the only thing I see.
If I reboot pushing the button I get to the same point.
I see that this is an old problem. How do you guys fix this?
I do have adb shell access. Can I somehow reset to factory default using adb?
Thanks
Dimitar
Click to expand...
Click to collapse
You can boot into the bootloader (fastboot) with "adb shell reboot bootloader". Then in fastboot you can tyoe "fastboot -w continue". That will boot the watch normally, but clear cache and all userdata.

Neuer_User said:
You can boot into the bootloader (fastboot) with "adb shell reboot bootloader". Then in fastboot you can tyoe "fastboot -w continue". That will boot the watch normally, but clear cache and all userdata.
Click to expand...
Click to collapse
Thanks Neuer_User,
what I did:
1. I have entered Fastboot as you explained. Fastboot logo on the watch
2. :~$fastboot devices
0123456789 fastboot
:~$fastboot -w continue (this in the Linux bash shell)
resuming boot...
FAILED (status read failed (No such device))
finished. total time: 6.395s
:~$
The watch reboots due to above
Or should I enter fastboot watch shell first?
The above procedure doesn't help.
Still I get "Unfortunately the launcher has stopped"
This should be on the original Chinese ROM 1.2.9 as far as I remember. It was long time ago I ship the watch to China for repair.
Should go to Pace ROM. what would you advice.
Thank you once again.

dpenevdpenev said:
Thanks Neuer_User,
what I did:
1. I have entered Fastboot as you explained. Fastboot logo on the watch
2. :~$fastboot devices
0123456789 fastboot
:~$fastboot -w continue (this in the Linux bash shell)
resuming boot...
FAILED (status read failed (No such device))
finished. total time: 6.395s
:~$
The watch reboots due to above
Or should I enter fastboot watch shell first?
The above procedure doesn't help.
Still I get "Unfortunately the launcher has stopped"
This should be on the original Chinese ROM 1.2.9 as far as I remember. It was long time ago I ship the watch to China for repair.
Should go to Pace ROM. what would you advice.
Thank you once again.
Click to expand...
Click to collapse
Hmm, if that doesn't work, try "fastboot erase cache" and "fastboot erase data". That will really completely delete all user and cache data. The next restart should take a long time.

Related

Hangs on boot to recovery mode and normal mode [Solved! :)]

Hello people
I think my HTC Hero is what you call softbricked.
When I hold Home + Power on to go to recovery mode I get this single line of text:
Build : RA-hero-v1.5.2
If I hold Home and press power on the text disappears leaving an all black screen. Pressing home + power on again brings the text back.
When I boot normally it just keeps saying "Hero"
I think I did a full wipe, installed VillainROM 6.0.0 and then did a OTA update to VillainROM 6.1.0. I did notice the latest rom being rather slow and hanging sometimes. Then three days ago it froze. I pulled the battery and when I put it back in I was left with what I've described above.
Can't access VillainROM's official website
Another frustrating thing is that w w w. villainrom .co .uk has seemed down to me this whole softbrick-period. But they've announced a new version and no one have commented on their site being down. Apparently I'm the only one who can't access it.
Vol. down + power on
I've never used this boot mode. But it's the only one which seems to work.
HBOOT says Sd checking and all the tests results in:
No image! or No image or wrong image!
FASTBOOT just gives a red box with the white text FASTBOOT in it.
What can i do?
I did a nandroid backup before installing VillainROM 6.0.0 but I can't access recovery mode.
I would like to install the official 1.5 RUU-rom but HTC Sync can't find my phone, neither can adb shell.
I can insert the SD card in my computer and put an update.zip file in the root. Is this a solution? I don't know how to make the phone boot the update.zip file or how this works.
Sorry for this long post. I've been searching the web ever since thursday without any luck. So now I'm just putting all I've experienced out.
I hope someone can help me. I would be very glad
Alright, if you can get to the fastboot screen, this is what you should do:
Plug your hero in fastboot mode into a computer with the latest android sdk installed.
DL the latest recovery for your device: I don't think I can post links yet so search the forum for Amon RA's recovery (1.6.2) and place it in the tools folder of the sdk.
Then:
Open a command prompt (or terminal for linux, idk for mac)
Go to the tools folder with cd
(./)fastboot boot recovery-RA-hero-v1.6.2.img
(./ is for linux ^^,) And that should normally work
From there your best bet is to use Nandroid to recover one of your backups.
Thank you for your response
But I got an error:
Code:
C:\android-sdk-windows\tools\fastboot boot recovery-RA-hero-v1.6.2.img
downloading 'boot.img' ... FAILED (remote: not allow)
finished. total time: 0.010s
The site I downloaded the recovery image from suggestion this installation:
via fastboot + adb -> In case you don't have a custom recovery, so when you get signature fail errors
Code:
adb shell reboot bootloader fastboot boot recovery-RA-hero-v1.6.2.img adb shell mount /sdcard adb push recovery-RA-hero-v1.6.2.img /sdcard/recovery-RA-hero-v1.6.2.img adb shell flash_image recovery /sdcard/recovery-RA-hero-v1.6.2.img adb shell reboot
I've also tried this but it resulted in: error: device not found
I've noticed how my phone says "fastboot usb" when connected to my computer.
Re: Hangs on boot to recovery mode and normal mode
NessGuard said:
Thank you for your response
But I got an error:
Code:
C:\android-sdk-windows\tools\fastboot boot recovery-RA-hero-v1.6.2.img
downloading 'boot.img' ... FAILED (remote: not allow)
finished. total time: 0.010s
The site I downloaded the recovery image from suggestion this installation:
via fastboot + adb -> In case you don't have a custom recovery, so when you get signature fail errors
Code:
adb shell reboot bootloader fastboot boot recovery-RA-hero-v1.6.2.img adb shell mount /sdcard adb push recovery-RA-hero-v1.6.2.img /sdcard/recovery-RA-hero-v1.6.2.img adb shell flash_image recovery /sdcard/recovery-RA-hero-v1.6.2.img adb shell reboot
I've also tried this but it resulted in: error: device not found
I've noticed how my phone says "fastboot usb" when connected to my computer.
Click to expand...
Click to collapse
Have you flashed the official 2.1 rom thats been floating round?
Sent from my HTC Hero using Tapatalk
AndroHero said:
Have you flashed the official 2.1 rom thats been floating round?
Click to expand...
Click to collapse
No, I haven't.
Just now I did this:
Code:
C:\android-sdk-windows\tools\adb devices
List of devices attached
And none was shown...
Then I did:
Code:
C:\android-sdk-windows\tools\fastboot devices
HT97TL903447 fastboot
Is this some sort of serial number of my phone?
Re: Hangs on boot to recovery mode and normal mode
Your sd card is seen by your phone or not ?
sebxd said:
Your sd card is seen by your phone or not ?
Click to expand...
Click to collapse
How can I check this?
Hboot says Sd checking and all the tests results in:
Code:
No image! [I]or[/I] No image or wrong image!
The site isn't down, but some people can't get to it due to their DNS setup.
Use 8.8.8.8 and 8.8.4.4 to get it, or go to http://villainrom.grense.no/villainrom.co.uk to get in.
Re: Hangs on boot to recovery mode and normal mode
Mmm if i'm right you can't boot normaly ? It's strange..
Have you tried to boot without your sd card ?
I don't really know what the answer of fastboot means..
anon2122 said:
The site isn't down, but some people can't get to it due to their DNS setup.
Use 8.8.8.8 and 8.8.4.4 to get it, or go to
[url not allowed] to get in.
Click to expand...
Click to collapse
Thanks, but I think I will just stick to this forum. Hope I can get a solution
sebxd said:
Mmm if i'm right you can't boot normaly ? It's strange..
Have you tried to boot without your sd card ?
I don't really know what the answer of fastboot means..
Click to expand...
Click to collapse
Yes, I have tried booting without SD card and without simcard aswell. My simcard is now in a good old Nokia 3310
I have updated the radio earlier
A while ago I updated the radio to this version: 63.18.55.06JU_6.35.09.26
Is that an android 2.1-radio? And is that what's causing "not allow" when running fastboot flash?
What recovery image would I then be allowed to flash? An official one?
Or is it my bootloader (that's SPL, right?) that needs to be flashed to a version that allows the fastboot flashing?
I haven't been able to find a guide on flashing SPL on HTC Hero.
Is this the way to go?
Still need help or is this now sorted?....
It's now working
My phone is now working. I did the following:
1. Connected my phone to a computer with HTC Sync and drivers installed.
2. Started the bootloader on my phone (vol. down + power on, hold until bootloader starts).
3. Pressed back to start fastboot. It said fastboot usb because it was connected to my computer.
4. I tried to install an official 1.5 RUU rom. The phone responded and began the process. It cleared/deleted some caches/files or something. But then my computer and my phone said that the ROM installation had failed and that I should find the right rom.
5. Somehow this cleaned up the phone so I now could boot in recovery mode as I used to (I didn't try a normal boot, so can't say if that worked). I did a full wipe and flashed a custom rom (not VillainROM 6.0.0 ).
Even though VillainROM has made me sad I will now go for VillainROM 10.
Wish me luck
And thanks for your responses.
Brilliant. Just edit the title of your thread to put [SOLVED] on.
And good luck, but i'm sure you wont need it.
EDIT...... Excellent, done it already.
ddotpatel said:
EDIT...... Excellent, done it already.
Click to expand...
Click to collapse
Hehe, yes, even though it's my first post I am a little bit smart
Oh nice ! You have done it ! It is really smart indeed and I'm happy for you !
its not solved for my hero
i tried everything within last two days. but i havent succeess. (i tried your solition too)
i did nondroid backup and then restore. finaly my phone doesnt open.
and after i have given the same your errors (from adb and phone)...
but i havent success..
where i do wrong?
thanks...
Can you explain what you did, what are the errors and when does it appears please
EDIT...... Excellent, done it already.
Click to expand...
Click to collapse
Hehe, yes, even though it's my first post I am a little bit smart
Click to expand...
Click to collapse
Indeed. I'm sorry, I never meant to sound like an ass.
-------------------------------------
Sent via the XDA Tapatalk App

HUAWEI SMARTWATCH - Preview image for testing - WEAR 2.0 - failed

Hi all,
I need your help. Given what I already (unsuccessfully) tried, I'm not sure if there will be a solution, at all...worst case, my Huawei Smartwatch isn't usable anymore,,,
Given that there is a preview version of WEAR Version 2.0 available, I thought it might be good idea to install and test. In fact, given that I manually/successfully installed the WEAR Version 1.4, some months ago, I was sure that I can manage to do it, with the preview version, as well.
I followed the steps, which you can find here developer.android.com/wear/preview/downloads
The point is, after the update has been done (given the message in ADB) the Smartwatch didn't automatically start to reboot. I was waiting about 30- 40 minutes, but nothing happened. So, I rebooted the watch by my own, via the fastboot menu.
But, the watch was only booting up to the Huawei Logo and nothing more did happen. I was also waiting for 30 - 40 minuntes.
After that, I googled and found a way how to access the fastboot mode (long and shore pressing of the power button of the watch) Here I tried the possible options. But, I would say, the only option which worked was "shutdown". All the other option, except fastboot recovery, brought me to the same result, as described above. Finally, I tried fastboot recovery, which might have made the situation even worse...means, after the Huawei Logo I can see a fallen over "android" with a open flap / a sign with a bang plus some text lines. But, it's so fast disappearing, nobody can read...even this is coming up again and again.
Next what I wanted to try is, to flash the WEAR version 1.4 again. But, it seems to be that ADB doesn't find the Huawei device anymore. (command ADB Devices doesn't show me any device)
Meanwhile, even it is somehow not logical (as it was working before with my "Standard Win 10 PC and the drivers installed) I tried 3 different PC with different combinations of Windows Version (7,8, 10), USB Ports (2.0 and 3.0) and probably almost all Android USB Drivers you can find.on the WEB. I even followed a procedure how to modify the INF file with some HUAWEI specific entries. I also let the watch run, overnight, in the loop mode, so the battery got empty..which really didn't help, as once loaded again, the watch started with the "loop procedure" again. However, I tried all the steps I did before, once again.
Regarding ADB/Fastboot, I'm not using the full Android SDK package, but the minimal version, at first version 1.1.3 and the later 1.4.3. I also followed the hints to open a command line with shift and right click "in" the respective ADB folder.
So, as you can read, I already tried a lot of thinks with no luck. in fact, I wasn't able to find anything more when I googled.
Hope you / some Android "guru's" can help me, now.
Here some of my current thoughts to which you have answers/comments.
1. Could it be, that the watch is totally broken and can't be "repaired" anymore?
2. Could it be, even the watch is in the fastboot mode, that the watch really isn't in a "full" one (...because the upgrade procedure of WAER 2.0 somehow failed) and this might be the reason, why ADB can't find the device anymore?
3. If 2. is really the case, is there any way to force a "full" fastboot mode?
4. Do you have any other idea, what can be done to make ADB aware of the device?
5. Is there meanwhile a specific ADB driver for the HUAWEI watch available? / Can somebody send me a link to a driver which is definitely working with that watch.
6.Whatever you can think of.
I really would appreciate any help to get my problem fixed.
Thanks in advance
Claus
TL;DR
When you used flash-all.bat it wipes your userdata partition. That means all settings are back to default. So no developer options, no adb debugging.
You can only use fastboot.
Code:
fastboot devices -l
needs to show your device.
- Then untargz the factory image.
- unzip the *.zip
- print out the flash-all.bat (or open in an editor)
use these commands:
Code:
fastboot flash bootloader bootloader-sturgeon-nvd36i.img
fastboot reboot-bootloader
sleep 5
and now flash each image in sequence (boot, cache, recovery, system, userdata.img
fastboot's 2nd param is like the basename of the corresponding .img file
Hi ranf,
first of all, THANKS A LOT, my watch is alive, again.
FYI, what I did...both ways are working, but as I saw, that you updated the procedure, I did the flash the watch two times. To add, I flashed the WEAR 2.0 Preview version.
1. The normal flash process by using one IMG and the one ZIP file, following the steps in the flash-all.bat.
2. Your updated "version", means the IMG file, plus all IMGs (extract from the ZIP file) plus the steps you have written, above.
I just finnished number 2 and the watch is synchronizing..looks good so far.
Thanks
Claus
Nice.
I have the suspicion that this "sleep 5" (seconds) sometimes is not enough.
I did All the steps, but my watch is stucked in moving circles screen

rooting xperia z5 e5823 6.0.1 build #32.2.a.5.11 (boot loader unlocked)

folks im at my nerves end... (hello btw)
firstly a thousand apologies to the mods if im posting this in the wrong place and a thousand apologies more to the rest of you for asking a question that has probably been answered time and time again.....
I can't get round it, iv been able to unlock bootloader and I thought that would have been the hardest part.... but I think I cant get my hands on the right, up to date files, in order to root my current system... iv been doing a ton of reading and just as many rooting attempts on my phone but to no avail......
the closest iv got in the command window was "error: device 'null' not found", to my understanding this is a driver related issue?...I dont know... if someone could hold my hand (im scared) and walk me through the process step by step I would be very, VERY grateful....
P.s; in exchange I can help you install CFW on a PSP.....lol right? (I actually made a pandora battery back in the day and im still rather proud of that)
UPDATE:........ So i think I was able to flash the proper Kernel (adroid plus kernal V42) but was unable to do flash recovery?
rootcheck says "root access is not properly installed on this device" still.....
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash boot boot.img
target reported max download size of 536870912 bytes
sending 'boot' (14956 KB)...
OKAY [ 0.479s]
writing 'boot'...
OKAY [ 0.143s]
finished. total time: 0.624s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash recovery twrp-2.8
.7.0-E6653-20151114_material.img
error: cannot load 'twrp-2.8.7.0-E6653-20151114_material.img'
UPDATE:
So i was able to do a flash recovery by renaiming the twrp file to simply twrp and adapting the code typed in the command window...... this caused my phone to soft brick or enter a bootloop....
after some swearing and more reading I was able to do a flash recovery with twrp-3.0.2-0-E5823.img (again by typing the exact name of the .img file in the command window....duuhhhh).... this allowed my phone to boot properly (thank God)... but root checker still says "root access is not properly installed on this device".....
I feel as if im close to my goal, what am I doing wrong!?......that soft brick served me as a cold shower and a lesson....this is kinda fun!
FINAL UPDATE:
BOOOM!!! success..... only took me all day...... still one thing though, i was unable to back my system due to lack of space on my SD card.... am I boned in this regard or can I create a back up later?
Thanks for the updates, i will try to follow your guide. how did you finally achieve success ?
Hey Rath,
First off im not responsibly for any damage caused to your device by the following guide....
....on to business...
Assuming your phones bootloader is unlocked, you have correctly installed ADB tools and the drivers required, allowed USB debugging and you know your build number you'll need to head over to this site...
https://kernel.andro.plus/kitakami_r2.html
scroll down....there you will see two sets of requirements one for the Xperia Z5 [E6653 / E6603] and one for the Xperia Z5 Compact [E5823 / E5803]
we are interested in the compact requirements.... you'll see that it says "32.2.A.5.11 -> v42 -" this means that for build number 32.2.A.5.11 you will need kernel version 42....
so keep scrolling down once you've figured out what version you need and click on "google drive V32 and later" for the Xperia Z5 Compact this will open a page with all the files inside (google drive)...either hover over with your mouse each file until you find "Z5C_AndroPlusKernel_v42.zip" or organize the files by clicking "last modified" in list view, this should show you the most recent file (v42) at the top of the list....
once you have found this file DL it and extract it to your desktop...copy ONLY the "boot.img" file into your platform-tools folder (android->sdk->platform-tools)....
next you'll need a recovery file or "twrp" to go with that, so head on over here...
https://www.androidfilehost.com/?fid=24459283995304864
and download that file, again copy it to your desktop (no need to extract) then copy this file as well to your platform-tools folder......copy the exact name of the file(TWRP-3.0.0.0-suzuran without the .img part...if youre on windows the .img will not show anyway..)...you'll need it later...
next open the command window by clicking on an empty space IN THE PLATFORM-TOOLS folder, then press shift+right click and select "open command window here" this will open adb tools...connect your phone via usb cable to your pc if it not already connected and type in the command window "adb devices" and hit enter....you should see your device listed...
if so type "adb reload bootloader" your phone should turn off and boot into bootloader (a blue led light should show in the top right corner of your phone)
if so type "fastboot devices" and hit enter...your device should show again on the list...
if so then type "fastboot flash boot boot.img" this will flash the kernel V.42 to your system....
you should see a couple of "OKAY"s and the time it took to flash the device....
next type "fastboot flash recovery *right click after the space and paste the exact name of the twrp file you copied earlier*.img
E.g: fastboot flash recovery TWRP-3.0.0.0-suzuran.img
and hit enter.... again you should see a couple of "OKAY"s and flashing times....
if all goes well you want to then type "fastboot reboot", your phone should then reboot...once you see a yellow light turn on on the top right corner press the down volume key several times until you enter the TWRP recovery menu.... if so, and the twrp is stable (ie it doesnt turn off on its own and reload) then the hardest part is done.....
click "reboot" on your phone and then click "system"...this will reboot your phone, this time let it run to see if it doenst get stuck in a bootloop....once your phone has loaded you'll want to install superSU....
go to the play store and DL rootchecker.... run the app and it will most likely tell you that your system isnt rooted yet (because we havent installed superSu) so head on over here...
http://www.supersu.com/download
scroll down and DL Recovery "Flashable.zip"...then take the file WITHOUT EXTRACTING IT and put it in the SD of your phone... reboot into recovery using the command window (adb reboot recovery) or turn off your phone, turn it back on and when you see the yellow light click volume down button repeatedly....
once in recovery select INSTALL click on the ZIP file you just added and the phone will install supersu, once done reboot your system and VOILA! check with the root checker app if your phone is root and have fun!....
I found this video to help me out a lot....he uses really old files and is rooting an xperia z5 but its essentially the same....
https://www.youtube.com/watch?v=dTlosea6SJE&t=709s
SwisSwiss said:
UPDATE:........ So i think I was able to flash the proper Kernel (adroid plus kernal V42) but was unable to do flash recovery?
rootcheck says "root access is not properly installed on this device" still.....
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash boot boot.img
target reported max download size of 536870912 bytes
sending 'boot' (14956 KB)...
OKAY [ 0.479s]
writing 'boot'...
OKAY [ 0.143s]
finished. total time: 0.624s
C:\Program Files (x86)\Minimal ADB and Fastboot>fastboot flash recovery twrp-2.8
.7.0-E6653-20151114_material.img
error: cannot load 'twrp-2.8.7.0-E6653-20151114_material.img'
UPDATE:
So i was able to do a flash recovery by renaiming the twrp file to simply twrp and adapting the code typed in the command window...... this caused my phone to soft brick or enter a bootloop....
after some swearing and more reading I was able to do a flash recovery with twrp-3.0.2-0-E5823.img (again by typing the exact name of the .img file in the command window....duuhhhh).... this allowed my phone to boot properly (thank God)... but root checker still says "root access is not properly installed on this device".....
I feel as if im close to my goal, what am I doing wrong!?......that soft brick served me as a cold shower and a lesson....this is kinda fun!
FINAL UPDATE:
BOOOM!!! success..... only took me all day...... still one thing though, i was unable to back my system due to lack of space on my SD card.... am I boned in this regard or can I create a back up later?
Click to expand...
Click to collapse
i wonder if you backup the DRM keys\TA partition
In regards to why i was unable to create a back up right away? Not sure, think it was simply a matter of volume...
Had a crappy 4gb micro sd In there....

Yoga Book YB1-X90F (Android) - How to Flash back to Stock Rom 6.0.1 /downgrade

hello all
i spent last few hours looking for solution to how to flash Stock Rom to my YB1-X90F and i found steps here and there and finally i got it. so i gathered all the steps in one thread to help whoever want to flush back to stock or downgrade from newer version for any reason.
This will erase all user data.
1. do it on your own risk, I'm not responsible for any damage to your devise.
2. Unlco your bootloader here is the steps by earthCallingAngela ----->>> Here
3. if you having issue to connect your drive to your computer while on bootloader you can install Intel driver, its worked for me, ----> Here
4. now install Intel Phone Flash Tool, i think it will install drivers as well, download it from here
5. Download Yoga book YB1-X90F Stock Rom Uploaded by Flippy498 from here
6. open Intel Phone Flash Tool and boot your phone on bootloader by Vol Up + Power, you should see the tool detect your Tablet.
7. on intel tool click on brows and located the Rom, wait for the tool to unzip it,
8. do not change anything just click on Flush and wait for it, on the middle of the process the tablet will ask you if its ok to wipe user data choose yes
after that the tablet will reboot and finish the installations and power off itself, power it on and wait for it, its will take long time for first boot so do not power it off.
Halo keyboard will not work until you do these steps By vimalbhimani on here
a) Open ‘’contacts’’ app, create a new local contact ” test”
b) Click search button at contact
c) Input ####6020# code into search bar
d) a list of country codes will po up, browser the country code list, then chose country code US and click OK
e) Then device will reboot and update, you should be able to use halo Keyboard after that.
note: i have issue with TouchPl keep stopping, had to chose google instead of Lenovo to get it to work without error
if you want to update the system to latest version (7.0.1) you can just go to update and update it.
if you have something to add please do
Thank you all.
Here's an alternative method for those who don't trust flashing tools due to bad experiences and prefer flashing files manually via Fastboot (like me):
Follow steps 1. to 3. and 5. of the opening post.
Unzip the stock rom (archive) into your ADB/Fastboot folder.
Boot the tablet to the bootloader (c.f. step 6. of the opening post).
Use the following commands:
Code:
fastboot flash gpt gpt.bin
fastboot erase misc
fastboot erase persistent
fastboot erase frp
fastboot erase metadata
fastboot format config
fastboot format country
fastboot format cache
fastboot format data
fastboot format factory
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash config config.img
fastboot flash country country.img
fastboot flash system system.img
fastboot flash bootloader bootloader
fastboot flash oemvars bootloader_policy-oemvars.txt
fastboot flashing lock
fastboot continue
Execute each of them with Enter and wait till a command got executed completely before you try to use the next one.
It might happen that you face an error while flashing that oemvars bootloader_policy-oemvars.txt. I couldn't find out why that happened and ignoring it seems to be harmless.
Follow steps a) to e) of the opening post.
Flippy498 said:
Here's an alternative method for those who don't trust flashing tools due to bad experiences and prefer flashing files manually via Fastboot (like me):
Follow steps 1. to 3. and 5. of the opening post.
Unzip the stock rom (archive) into your ADB/Fastboot folder.
Boot the tablet to the bootloader (c.f. step 6. of the opening post).
Use the following commands:
Code:
fastboot flash gpt gpt.bin
fastboot erase misc
fastboot erase persistent
fastboot erase frp
fastboot erase metadata
fastboot format config
fastboot format country
fastboot format cache
fastboot format data
fastboot format factory
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash config config.img
fastboot flash country country.img
fastboot flash system system.img
fastboot flash bootloader bootloader
fastboot flash oemvars bootloader_policy-oemvars.txt
fastboot flashing lock
fastboot continue
Execute each of them with Enter and wait till a command got executed completely before you try to use the next one.
It might happen that you face an error while flashing that oemvars bootloader_policy-oemvars.txt. I couldn't find out why that happened and ignoring it seems to be harmless.
Follow steps a) to e) of the opening post.
Click to expand...
Click to collapse
Thanks Flippy for sharing the steps with us.
can i downgrade from Nougat to Marshmallow?
microbai said:
can i downgrade from Nougat to Marshmallow?
Click to expand...
Click to collapse
sorry for the delay, yes you can, just follow the steps.
ayad said:
hello all
i spent last few hours looking for solution to how to flash Stock Rom to my YB1-X90F and i found steps here and there and finally i got it. so i gathered all the steps in one thread to help whoever want to flush back to stock or downgrade from newer version for any reason.
This will erase all user data.
1. do it on your own risk, I'm not responsible for any damage to your devise.
2. Unlco your bootloader here is the steps by earthCallingAngela ----->>> Here
3. if you having issue to connect your drive to your computer while on bootloader you can install Intel driver, its worked for me, ----> Here
4. now install Intel Phone Flash Tool, i think it will install drivers as well, download it from here
5. Download Yoga book YB1-X90F Stock Rom Uploaded by Flippy498 from here
6. open Intel Phone Flash Tool and boot your phone on bootloader by Vol Up + Power, you should see the tool detect your Tablet.
7. on intel tool click on brows and located the Rom, wait for the tool to unzip it,
8. do not change anything just click on Flush and wait for it, on the middle of the process the tablet will ask you if its ok to wipe user data choose yes
after that the tablet will reboot and finish the installations and power off itself, power it on and wait for it, its will take long time for first boot so do not power it off.
Halo keyboard will not work until you do these steps By vimalbhimani on here
a) Open ‘’contacts’’ app, create a new local contact ” test”
b) Click search button at contact
c) Input ####6020# code into search bar
d) a list of country codes will po up, browser the country code list, then chose country code US and click OK
e) Then device will reboot and update, you should be able to use halo Keyboard after that.
note: i have issue with TouchPl keep stopping, had to chose google instead of Lenovo to get it to work without error
if you want to update the system to latest version (7.0.1) you can just go to update and update it.
if you have something to add please do
Thank you all.
Click to expand...
Click to collapse
I followed all of the steps and it says "Flash Failed (Fastboot) PLEASE HELP
Edit: I fixed the problem by simply rebooting it. I didn't think it would be that easy.
SameSame, but L-Version ... cannot find Stock ROM ...
Hi there,
I would like to downgrade 2 Tablets YB1-X90L (not F), this thread is onderful BUT I cannot find the STOCK ROM version for the L-Model (the one with LTE) ... can someone point me out as where to get it ? The background is that Nougat screwes up the playstore ... as discussed in many other threads and there is no -permanent- solution... Thank you!
pwallenb said:
Hi there,
I would like to downgrade 2 Tablets YB1-X90L (not F), this thread is onderful BUT I cannot find the STOCK ROM version for the L-Model (the one with LTE) ... can someone point me out as where to get it ? The background is that Nougat screwes up the playstore ... as discussed in many other threads and there is no -permanent- solution... Thank you!
Click to expand...
Click to collapse
found myself in the same boat and eventually came across this:
https://cloud.kolyandex.su/index.php/s/npeVhVlnJw8BFIy
hopefully it sticks around long enough for others to grab.
note that the steps are slightly different in that you have to manually select the .json in the extracted folder.
Could someone please help me with downgrading my YB1-X90L, it just refuses to boot at all after my nephews messed with it, I found the stock rom but I can't get some of the needed programs and drivers,
Flippy498 said:
Here's an alternative method for those who don't trust flashing tools due to bad experiences and prefer flashing files manually via Fastboot (like me):
Follow steps 1. to 3. and 5. of the opening post.
Unzip the stock rom (archive) into your ADB/Fastboot folder.
Boot the tablet to the bootloader (c.f. step 6. of the opening post).
Use the following commands:
Code:
fastboot flash gpt gpt.bin
fastboot erase misc
fastboot erase persistent
fastboot erase frp
fastboot erase metadata
fastboot format config
fastboot format country
fastboot format cache
fastboot format data
fastboot format factory
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash config config.img
fastboot flash country country.img
fastboot flash system system.img
fastboot flash bootloader bootloader
fastboot flash oemvars bootloader_policy-oemvars.txt
fastboot flashing lock
fastboot continue
Execute each of them with Enter and wait till a command got executed completely before you try to use the next one.
It might happen that you face an error while flashing that oemvars bootloader_policy-oemvars.txt. I couldn't find out why that happened and ignoring it seems to be harmless.
Follow steps a) to e) of the opening post.
Click to expand...
Click to collapse
Hello
I made this all and my Yoga-Book runs on Android 6.0.1 . But is there a possibility to get an Android Build 7.1.1? Because I can't restore my Backup it seams it is corrupt and if I try to update im configuration-app its does anything but at the end its allways on 6.0.1.
It would be great if someone can helb me.
Best regards
Peter
borisattva said:
found myself in the same boat and eventually came across this:
https://cloud.kolyandex.su/index.php/s/npeVhVlnJw8BFIy
hopefully it sticks around long enough for others to grab.
note that the steps are slightly different in that you have to manually select the .json in the extracted folder.
Click to expand...
Click to collapse
sorry for replying to such an old post.
could you or anyone else please reupload a 6.x stock rom for the yb1 x90L? i just cant find any working link and am currently stuck with a device without properly working wlan. wlan keeps turning itself off after a few seconds after reboot and only restarting the whole device can turn it back on again... i hope a rollback can solve the issue...
phsma said:
sorry for replying to such an old post.
could you or anyone else please reupload a 6.x stock rom for the yb1 x90L? i just cant find any working link and am currently stuck with a device without properly working wlan. wlan keeps turning itself off after a few seconds after reboot and only restarting the whole device can turn it back on again... i hope a rollback can solve the issue...
Click to expand...
Click to collapse
looks like the original link is down, so i searched for the file name YB1-X90L_USR_S110085_1710170829_WW08_EP_ROW_otafull.zip and this came up:
YB1-X90L_USR_S110085_1710170829_WW08_EP_ROW_otafull.zip | Easy Firmware
easy-firmware.com
ive no idea if this is working or safe to use but its a start.
good luck
So my Android YB1-X90F was locking up when trying to boot, just stuck showing the Lenovo logo. Thinking I'm clever I stubbled across the boot menu if you start the device with the Volume Up held. From there I tried the Recovery Mode and did a Factory Reset. Then the tablet started up and shows the Green Andriod Bin Man, saysi Encrypting and promptly reboots. So one starts Googling and ends up here. Some very help information, thanks for that.
So I've got as far as installing all the drivers/Intel Phone tool/Android Suite etc. but I'm still stuck. The flash is locked. Is there another way to unlock this as I can't get into Android to allow the developer options as suggested in Step 2 of the opening post?
Trying the fastbook commands in post 2 also fail
Code:
FAILED (remote: Prohibited command in locked state.)
finished. total time: 0.170s
TIA
LOL @ me, of course the manual fastboot commands fail as that's precisely what the Phone Tool App trying when doing its magic.
galumph said:
So my Android YB1-X90F was locking up when trying to boot, just stuck showing the Lenovo logo. Thinking I'm clever I stubbled across the boot menu if you start the device with the Volume Up held. From there I tried the Recovery Mode and did a Factory Reset. Then the tablet started up and shows the Green Andriod Bin Man, saysi Encrypting and promptly reboots. So one starts Googling and ends up here. Some very help information, thanks for that.
So I've got as far as installing all the drivers/Intel Phone tool/Android Suite etc. but I'm still stuck. The flash is locked. Is there another way to unlock this as I can't get into Android to allow the developer options as suggested in Step 2 of the opening post?
Trying the fastbook commands in post 2 also fail
Code:
FAILED (remote: Prohibited command in locked state.)
finished. total time: 0.170s
TIA
LOL @ me, of course the manual fastboot commands fail as that's precisely what the Phone Tool App trying when doing its magic.
Click to expand...
Click to collapse
I'm in the same boat. I acquired a YB1-X90F but all it does is show the orange Lenovo splash screen, then a black screen.
So here I am reading threads. But I'm already at my first hurdle...since I can't boot into the OS and go into Developer Options to start the boot loader unlock process.
YB1-X90F No OS(?) - Flashing Help
TL;DR: Noob needs to stock flash a device that won't boot into OS. Here's how the recovery looks (without and interaction): Boot loader: Splash screen: I have acquired a YB1-X90F that just shows the orange Lenovo splash screen and or a...
forum.xda-developers.com
Solved. I ran 'flash_update_from_user.json
Just waiting for the battery to charge to 30% to hopefully enable the Halo Keyboard.
Here are the files needed in case other links void in the future: https://drive.google.com/drive/folders/1gD9FyA03GbLZ7ZcjkyMDlhVPs4_em2rY?usp=sharing
Edit: The Android N update bricks the device for some reason.
Brent.M said:
Solved. I ran 'flash_update_from_user.json
Just waiting for the battery to charge to 30% to hopefully enable the Halo Keyboard.
Here are the files needed in case other links void in the future: https://drive.google.com/drive/folders/1gD9FyA03GbLZ7ZcjkyMDlhVPs4_em2rY?usp=sharing
Edit: The Android N update bricks the device for some reason.
Click to expand...
Click to collapse
any ideea why my yoga book is not visible in fastboot?
i installed drivers and platform lite indicated in drive location.
currently my yoga sbows bootloader error 05 during booting
Thank you @Brent.M I have a booting Yoga Book again
borisattva said:
found myself in the same boat and eventually came across this:
https://cloud.kolyandex.su/index.php/s/npeVhVlnJw8BFIy
hopefully it sticks around long enough for others to grab.
note that the steps are slightly different in that you have to manually select the .json in the extracted folder.
Click to expand...
Click to collapse
The link is not work anymore, could you please share you firmware for x90L model ? thanks

[HELP] Thor 4.5.5.3 Unlock Bootloader Specific Questions

I’ve been lurking on these forums for a while and I have decided that I’m willing to take the risk to unlock my Thor’s potential. I have made sure to read through advised reading materials, and searching through other posts before posting. (I tried figuring out how to quote multiple posts to make this thread easier to navigate but I couldn't, sorry)
Device: Kindle Fire HDX 7” 3rd Generation running Fire OS 4.5.5.3
I will be using a Windows 10 Home machine to do this.
Purpose: Allow for the device to work well in Google’s ecosystem so I can have a useful device for medical school.
I am currently trying to learn the steps outlined here, but I have some concerns:
Does it matter whether or not I factory reset my device before I begin?
Will my computer’s OS cause any issues? According to this, there might be some driver issues? Should I download the “Motorola Device manager”?
Where is the “aboot_vuln.mbn” file? Do I obtain it once I follow the steps in order?
I want to use “Minimal ADB and Fastboot” instead of the attached “15 seconds ADB Installer v1.4.3” because the later has not been updated in a while and the former was updated this month. According to the install instructions for the former, I need to have my device already plugged in and the “kindle fire USB driver” already installed. Will this affect step 4 of the procedure or anything else?
On step 5, am I correct in my assumption that changing the driver will be a simple few click process?
On step 6, do I follow the directions as they are quoted, or the ones on the original forum? If the later, does “change to the directory with the extracted dd.exe” mean to type the directory or something else? Also, a poster here stated that he got error message on the second 2 commands instead of the first, is the concerning at all? Should I take any precautionary measures?
Once step 9 is completed, can the kindle run as normal if I don’t flash anything? And what does it mean “get into the TWRP”? I’ll simply be in the recovery menu on the kindle? How do I flash my chosen ROM using TWRP?
What ROM do you recommend for my needs? And could you provide me a link to the correct download/discussion board? I would prefer a ROM running at least Nougat that has long-term support planned. I read that “Fire Nexus ROM” is pretty basic, so I don’t think I want it. As of now, I’m looking at CM/Lineage 14.1, but I don’t know what ROM would work on my device from the website. AospExtended seems like a good option but apparently, there are wi-fi issues which are a deal-breaker.
Thank you so much for reading through this. Hopefully all my research and proves to be useful for anyone trying to help. If I’m able to get this working cleanly, I would be willing to make a cleaned up guide for this version and device to better aid future people.
hwwof said:
I’ve been lurking on these forums for a while and I have decided that I’m willing to take the risk to unlock my Thor’s potential. I have made sure to read through advised reading materials, and searching through other posts before posting. (I tried figuring out how to quote multiple posts to make this thread easier to navigate but I couldn't, sorry)
Device: Kindle Fire HDX 7” 3rd Generation running Fire OS 4.5.5.3
I will be using a Windows 10 Home machine to do this.
Purpose: Allow for the device to work well in Google’s ecosystem so I can have a useful device for medical school.
Click to expand...
Click to collapse
Hello @hwwof -
You have done your homework (thank you!) and presented reasonable questions. I'm going to answer the first five 'in-line' below. Responses will be brief to keep the thread serviceable for those accessing XDA content on small screens; don't read anything into that. Bounce back on any items that need further elaboration.
hwwof said:
I am currently trying to learn the steps outlined here, but I have some concerns:
Does it matter whether or not I factory reset my device before I begin?
Click to expand...
Click to collapse
No; however, it would be better if you did NOT reset the device.
hwwof said:
Will my computer’s OS cause any issues? According to this, there might be some driver issues? Should I download the “Motorola Device manager”?
Click to expand...
Click to collapse
Nope. Drivers installed via the Motorola Device manager are properly signed which mitigates any potential issues on 64-bit Win 10 builds (yet another reason to use the Moto drivers vs others that have been posted)
hwwof said:
Where is the “aboot_vuln.mbn” file? Do I obtain it once I follow the steps in order?
Click to expand...
Click to collapse
It's contained within aboot-13-thor.zip; just named differently.
hwwof said:
I want to use “Minimal ADB and Fastboot” instead of the attached “15 seconds ADB Installer v1.4.3” because the later has not been updated in a while and the former was updated this month. According to the install instructions for the former, I need to have my device already plugged in and the “kindle fire USB driver” already installed. Will this affect step 4 of the procedure or anything else?
Click to expand...
Click to collapse
Good idea. Your device does not need to be tethered while installing Minimal ADB and Fastboot. Take note of where the package is installed (typically "C:\Program Files (x86)\Minimal ADB and Fastboot") and practice opening a command window focused in that folder. To make life simpler you can direct the installer to place the files in "c:\work" which is a lot easier to type.
hwwof said:
On step 5, am I correct in my assumption that changing the driver will be a simple few click process?
Click to expand...
Click to collapse
Yes - but here's were it gets interesting and a bit frustrating. Even with the Moto drivers Windows can be very fussy communicating with HDX devices. To complicate matters there are two modes to deal with: ADB and Fastboot. You'll learn which is which as time goes on and will likely have to switch Windows drivers for each mode. Sometimes a reboot is needed to get everyone talking. Note there is no danger involved simply tethering your device and issuing basic queries.
To test basic ADB communications:
- execute step #2 (only) from the linked procedure
- open a Windows command prompt as outlined above
- boot HDX into FireOS and move past the screen lock
- tether device to windows; take note of any noises and/or confirmation messages
- in the window command prompt issue the command "adb devices" and press Enter. What happens?
Post back results and we'll go from there.
Thank you @Davey126 . I appreciate you taking the time to help me out. Answers to the other questions would be very appreciated as well!
Here are my results that you requested:
The kindle beeped, and the internal storage popped up on my computer. I ran the minimal adb and fastboot program, and got this output:
Code:
C:\adb>adb devices
List of devices attached
* daemon not running; starting now at tcp:5037
* daemon started successfully
D0FBA0A0351401GB unauthorized
C:\adb>
And on the kindle, I got a “Allow USV debugging” popup on the kindle and it showed my computer’s RSA Fingerprint. I then pressed allow. I took note of the fingerprint just in case. I then tried ejecting my device but it wouldn’t let me because a program was still using it. I ran “adb devices” again and got this output:
Code:
C:\adb>adb devices
List of devices attached
D0FBA0A0351401GB device
C:\adb>
hwwof said:
Thank you @Davey126 . I appreciate you taking the time to help me out. Answers to the other questions would be very appreciated as well!
Click to expand...
Click to collapse
Second response is positive. Next issue the following command: 'adb reboot bootloader'. This will place your device in fastboot mode. If you are very lucky a 'Ready' prompt will appear on the device below the word 'fastboot'. Most likely you will need to head to Windows Device Manager, identify which entry is associated with the tethered HDX and then change the device driver to 'Moto Composite' or something similar (might not have the wording exactly right). Once you get a 'Ready' prompt issue the following command: 'fastboot devices'. If you get a response similar to 'adb devices' then you are good to go.
Hints/tips:
- to help determine which entry(s) are associated with your HDX tether/untether your device while Windows Device Manager is open
- right click an entry to change the device driver; navigate 'Browse my computer ...' -> 'Let me pick ...'; do not choose any of the automated options
- if you can't get a Ready prompt and/or an response to 'fastboot devices' reboot both devices and try again
- if still no joy change USB ports and cables; the latter are especially problematic (people never believe that until trying 1821 other things - ugh!)
Report back and we'll go from there. I know you prefer the rest of your questions answered up front. Experience suggests an incremental approach is more productive - for you, me and future readers.
Davey126 said:
Second response is positive. Next issue the following command: 'adb reboot bootloader'. This will place your device in fastboot mode. If you are very lucky a 'Ready' prompt will appear on the device below the word 'fastboot'. Most likely you will need to head to Windows Device Manager, identify which entry is associated with the tethered HDX and then change the device driver to 'Moto Composite' or something similar (might not have the wording exactly right). Once you get a 'Ready' prompt issue the following command: 'fastboot devices'. If you get a response similar to 'adb devices' then you are good to go.
Hints/tips:
- to help determine which entry(s) are associated with your HDX tether/untether your device while Windows Device Manager is open
- right click an entry to change the device driver; navigate 'Browse my computer ...' -> 'Let me pick ...'; do not choose any of the automated options
- if you can't get a Ready prompt and/or an response to 'fastboot devices' reboot both devices and try again
- if still no joy change USB ports and cables; the latter are especially problematic (people never believe that until trying 1821 other things - ugh!)
Report back and we'll go from there. I know you prefer the rest of your questions answered up front. Experience suggests an incremental approach is more productive - for you, me and future readers.
Click to expand...
Click to collapse
Thank you! Now it says "ready" but I'm concerned about how to unplug it without messing anything up. here's the output:
Code:
Microsoft Windows [Version 10.0.16299.248]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\adb>adb reboot bootloader
C:\adb>fastboot devices
D0FBA0A0351401GB fastboot
C:\adb>
You are correct that I would prefer having all the answers upfront, but it's only so I can then question the answers to get a better understanding before messing with the device. A quick reply would be appreciated!
hwwof said:
Thank you! Now it says "ready" but I'm concerned about how to unplug it without messing anything up. here's the output:
{content removed}
You are correct that I would prefer having all the answers upfront, but it's only so I can then question the answers to get a better understanding before messing with the device. A quick reply would be appreciated!
Click to expand...
Click to collapse
Great!! The purpose of this exercise was to validate connectivity in two different modes and, if needed, provide a safe 'test' environment for remediation. No worries about breaking the tether if there is no active data transfer taking place. Simply unplug and then long press <power> until the device shuts down.
In response to your other questions:
Q: On step 6, do I follow the directions as they are quoted, or the ones on the original forum? If the later, does “change to the directory with the extracted dd.exe” mean to type the directory or something else? Also, a poster here stated that he got error message on the second 2 commands instead of the first, is the concerning at all? Should I take any precautionary measures?
A: Follow the steps as quoted
Q: Once step 9 is completed, can the kindle run as normal if I don’t flash anything? And what does it mean “get into the TWRP”? I’ll simply be in the recovery menu on the kindle? How do I flash my chosen ROM using TWRP?
A1: You should assume all content on your device will be erased following completion of Step #9 (although it will likely remain intact)
A2: The two files you will be 'flashing' with the dd command should be located in the same folder as "Minimal ADB and Fastboot"
A3: Deal with that later (flashing ROM)
Q: ROMs:
A: All of the Nougat based custom ROMs for HDX are stable and feature complete. Nuances are subtle and probably not worth worrying about now; you can always change later. My personal preference is AEX (AospExtended). That said, Lineage 14.1 and Slim 7 are both excellent alternatives.
Davey126 said:
Great!! The purpose of this exercise was to validate connectivity in two different modes and, if needed, provide a safe 'test' environment for remediation. No worries about breaking the tether if there is no active data transfer taking place. Simply unplug and then long press <power> until the device shuts down.
In response to your other questions:
Q: On step 6, do I follow the directions as they are quoted, or the ones on the original forum? If the later, does “change to the directory with the extracted dd.exe” mean to type the directory or something else? Also, a poster here stated that he got error message on the second 2 commands instead of the first, is the concerning at all? Should I take any precautionary measures?
A: Follow the steps as quoted
Q: Once step 9 is completed, can the kindle run as normal if I don’t flash anything? And what does it mean “get into the TWRP”? I’ll simply be in the recovery menu on the kindle? How do I flash my chosen ROM using TWRP?
A1: You should assume all content on your device will be erased following completion of Step #9 (although it will likely remain intact)
A2: The two files you will be 'flashing' with the dd command should be located in the same folder as "Minimal ADB and Fastboot"
A3: Deal with that later (flashing ROM)
Q: ROMs:
A: All of the Nougat based custom ROMs for HDX are stable and feature complete. Nuances are subtle and probably not worth worrying about now; you can always change later. My personal preference is AEX (AospExtended). That said, Lineage 14.1 and Slim 7 are both excellent alternatives.
Click to expand...
Click to collapse
So I completed the instructions, booted to TWRP, turned it off, booted up, did the unlock batch, but I didn't get "unlock code is correct". I got a lot of green lines "getvar slot-count...OK getvar:slot-suffixes...OK getvar:has-slot:unlock...OK getvarartition-type:unlock...OK getvar:max-download-size...[[0x20000000 ]] download:00000000..." Here's the cmd when I try running unlock.bat https://gyazo.com/a041dc49c786f9846d706c049eacbbf3
Did I mess something up or am I unlocked? I'm not sure what to do from here. I was still able to get back to TWRP. It's telling me to swipe to allow modifications or to keep read only. Where do I proceed from here? I'm reading in some places to wipe before installing, and a lot of other conflicting information. I downlaoded the AEX november build and would like to flash it. Do I have any need for rooting or SuperSU?
Again, Thank you so much for all your help
*deleted*
*deleted*
hwwof said:
So I completed the instructions, booted to TWRP, turned it off, booted up, did the unlock batch, but I didn't get "unlock code is correct". I got a lot of green lines "getvar slot-count...OK getvar:slot-suffixes...OK getvar:has-slot:unlock...OK getvarartition-type:unlock...OK getvar:max-download-size...[[0x20000000 ]] download:00000000..." Here's the cmd when I try running unlock.bat https://gyazo.com/a041dc49c786f9846d706c049eacbbf3
Did I mess something up or am I unlocked? I'm not sure what to do from here. I was still able to get back to TWRP. It's telling me to swipe to allow modifications or to keep read only. Where do I proceed from here? I'm reading in some places to wipe before installing, and a lot of other conflicting information. I downlaoded the AEX november build and would like to flash it. Do I have any need for rooting or SuperSU?
Again, Thank you so much for all your help
Click to expand...
Click to collapse
Device is NOT unlocked. Tied up for the next hour or two; will respond then. Do not wipe or attempt to flash anything. Sorry for wait ...
Davey126 said:
Device is NOT unlocked. Tied up for the next hour or two; will respond then. Do not wipe or attempt to flash anything. Sorry for wait ...
Click to expand...
Click to collapse
Thank you for being on top of this! I'm glad I was patient and didn't immediately try flashing anything. I'll try to wait up! I apologize if I fall asleep.
hwwof said:
Thank you for being on top of this! I'm glad I was patient and didn't immediately try flashing anything. I'll try to wait up! I apologize if I fall asleep.
Click to expand...
Click to collapse
Quick activity while you wait:
- boot into TWRP (power down; press <power>+<vol-up> for ~3 sec then release)
- swipe to allow modifications
- tap the backup option, select all partitions except cache, swipe to execute
- when complete tether device; should connect in adb mode
- from look for a new device/drive in Windows File Explorer
- click <device ID> -> Internal Storage; should see a folder named TWRP
- drag or right-click folder to a storage location on your Win 10 machine
- congrats! You have just made a backup of your device -and- placed a reserve copy on your Windows machine
Comment: prior to backing up you had completed the most risky tasks (stuff that could have yielded a soft/hard brick). It's all downhill from here. Will post more info on unlocking and installing a new ROM in a bit; real-life is calling . Fully understand if you need to sleep; post will be waiting in the morning. Penning this from Northeast USA; timezone UTC-5.
Davey126 said:
Quick activity while you wait:
- boot into TWRP (power down; press <power>+<vol-up> for ~3 sec then release)
- swipe to allow modifications
- tap the backup option, select all partitions except cache, swipe to execute
- when complete tether device; should connect in adb mode
- from look for a new device/drive in Windows File Explorer
- click <device ID> -> Internal Storage; should see a folder named TWRP
- drag or right-click folder to a storage location on your Win 10 machine
- congrats! You have just made a backup of your device -and- placed a reserve copy on your Windows machine
Comment: prior to backing up you had completed the most risky tasks (stuff that could have yielded a soft/hard brick). It's all downhill from here. Will post more info on unlocking and installing a new ROM in a bit; real-life is calling . Fully understand if you need to sleep; post will be waiting in the morning. Penning this from Northeast USA; timezone UTC-5.
Click to expand...
Click to collapse
I appreciate you so much! And I completely understand. I hope everything you're working on gets resolved!
I have backed it up as you suggested! Since the back-up is also on the internal drive, it will be deleted later, correct? It's 5gbs out of the already small storage space.
hwwof said:
I appreciate you so much! And I completely understand. I hope everything you're working on gets resolved!
I have backed it up as you suggested! Since the back-up is also on the internal drive, it will be deleted later, correct? It's 5gbs out of the already small storage space.
Click to expand...
Click to collapse
With the 5GB TWRP backup folder safely copied off-device you can delete the local copy at any time...although there is no immediate reason to do so.
Next step is to unlock the bootloader:
- verify 'get_code.bat' & 'unlock.bat' reside in the same folder as adb.exe and fastboot.exe
- look around to see if you have a file called 'unlock.code' from a previous run of 'get_code.bat'; if so place it in the same folder
- tether device and boot into fastboot (easiest way: boot into TWRP and then use reboot menu to boot the bootloader) [<--what an awkward sentence!]
- enter 'fastboot devices' to validate communication between host and device
- execute unlock.bat; if you get a green 'OK' the bootloader is unlocked!
- if not boot into FireOS (get past unlock screen), tether, verify adb communication is working and then run 'get_code.bat' to (re)create the 'unlock.code' file
- repeat steps 2-4 (above)
If that doesn't work and/or you are unable to boot into TWRP then a bit of extra work will be needed to generate a valid unlock code. Brief outline:
- download legacy Fire Nexus ROM from here (it does NOT require an unlocked bootloader)
- tether device and into TWRP
- from Windows copy downloaded ROM to a folder on the device (suggest creating a new folder with your initials as the name)
- from the TWRP main menu tap Wipe then swipe to perform a 'factory reset'
- from the TWRP main menu tap Install
- navigate to the folder where you stored the downloaded ROM
- select the ROM zip and then click to install
- when complete allow the device to restart; after a 3-5 min it should boot into Fire Nexus; skip the Google config (not needed)
- enable developer options and adb bridge
- tether device and verify adb connectivity
- run 'get_code.bat' to generate a fresh unlock.code file
I will be traveling much of Sunday with irregular network access. I'll try to respond to an questions/problems as time permits. Apologies in advance for any delays.
Davey126 said:
With the 5GB TWRP backup folder safely copied off-device you can delete the local copy at any time...although there is no immediate reason to do so.
Next step is to unlock the bootloader:
- verify 'get_code.bat' & 'unlock.bat' reside in the same folder as adb.exe and fastboot.exe
- look around to see if you have a file called 'unlock.code' from a previous run of 'get_code.bat'; if so place it in the same folder
- tether device and boot into fastboot (easiest way: boot into TWRP and then use reboot menu to boot the bootloader) [<--what an awkward sentence!]
- enter 'fastboot devices' to validate communication between host and device
- execute unlock.bat; if you get a green 'OK' the bootloader is unlocked!
- if not boot into FireOS (get past unlock screen), tether, verify adb communication is working and then run 'get_code.bat' to (re)create the 'unlock.code' file
- repeat steps 2-4 (above)
If that doesn't work and/or you are unable to boot into TWRP then a bit of extra work will be needed to generate a valid unlock code. Brief outline:
- download legacy Fire Nexus ROM from here (it does NOT require an unlocked bootloader)
- tether device and into TWRP
- from Windows copy downloaded ROM to a folder on the device (suggest creating a new folder with your initials as the name)
- from the TWRP main menu tap Wipe then swipe to perform a 'factory reset'
- from the TWRP main menu tap Install
- navigate to the folder where you stored the downloaded ROM
- select the ROM zip and then click to install
- when complete allow the device to restart; after a 3-5 min it should boot into Fire Nexus; skip the Google config (not needed)
- enable developer options and adb bridge
- tether device and verify adb connectivity
- run 'get_code.bat' to generate a fresh unlock.code file
I will be traveling much of Sunday with irregular network access. I'll try to respond to an questions/problems as time permits. Apologies in advance for any delays.
Click to expand...
Click to collapse
Welp, device won't boot into FireOS. It boots straight to Fastboot. I tried Installing nexus ROM but I got "can't install this package over newer build updater process ended with error:7".
hwwof said:
Welp, device won't boot into FireOS. It boots straight to Fastboot. I tried Installing nexus ROM but I got "can't install this package over newer build updater process ended with error:7".
Click to expand...
Click to collapse
Error 7 is pretty generic and can be due to a conflict between install package and TWRP or an issue with the system partition. It's a solvable issue without too much work. They the following in the order listed.
1) In TWRP tap wipe -> advanced. Tick system, data, dalvik and cache; leave internal storage unticked. Tap the appropriate button to execute. Return to main menu and reboot back into recovery. Then try to install the Nexus ROM.
2) Download an older build of TWRP from here and transfer to adb/fastboot folder on Windows. Boot device into fastboot mode and issue the following command to install:
sudo fastboot -i 0x1949 flash recovery <recovery-image>
Will check back in 5-6 hours on progress.
Davey126 said:
Error 7 is pretty generic and can be due to a conflict between install package and TWRP or an issue with the system partition. It's a solvable issue without too much work. They the following in the order listed.
1) In TWRP tap wipe -> advanced. Tick system, data, dalvik and cache; leave internal storage unticked. Tap the appropriate button to execute. Return to main menu and reboot back into recovery. Then try to install the Nexus ROM.
2) Download an older build of TWRP from here and transfer to adb/fastboot folder on Windows. Boot device into fastboot mode and issue the following command to install:
sudo fastboot -i 0x1949 flash recovery <recovery-image>
Will check back in 5-6 hours on progress.
Click to expand...
Click to collapse
First one didn't work, second one put this out:
C:\adb>sudo fastboot -i 0x1949 flash recovery signed-thor-twrp-2870.img
'sudo' is not recognized as an internal or external command,
operable program or batch file.
hwwof said:
First one didn't work, second one put this out:
C:\adb>sudo fastboot -i 0x1949 flash recovery signed-thor-twrp-2870.img
'sudo' is not recognized as an internal or external command,
operable program or batch file.
Click to expand...
Click to collapse
Drop the sudo prefix ...
Davey126 said:
Drop the sudo prefix ...
Click to expand...
Click to collapse
"
C:\adb>fastboot devices
D0FBA0A0351401GB fastboot
C:\adb>fastboot -i 0x1949 flash recovery signed-thor-twrp-2870.img
target reported max download size of 536870912 bytes
sending 'recovery' (9220 KB)...
OKAY [ 0.361s]
writing 'recovery'...
FAILED (remote: flashing not allowed for locked hw)
finished. total time: 0.424s
C:\adb>
"
hwwof said:
"
C:\adb>fastboot devices
D0FBA0A0351401GB fastboot
C:\adb>fastboot -i 0x1949 flash recovery signed-thor-twrp-2870.img
target reported max download size of 536870912 bytes
sending 'recovery' (9220 KB)...
OKAY [ 0.361s]
writing 'recovery'...
FAILED (remote: flashing not allowed for locked hw)
finished. total time: 0.424s
C:\adb>
"
Click to expand...
Click to collapse
This suggest the vulnerable bootloader was not properly installed. You will probably need to repeat the installation procedure from the point of placing the device in 'bulk' mode. Be sure to pay attention to file indexes and file identifiers that follow "if=".
@draxie - would you agree with this assessment? Poster is following this guide and using the files attached to that post.

Categories

Resources