Database Users

[How to] flash Lollipop on Desire 820 dual sim Non-Indian variant. Fix Wrong Variant

Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part

Lovely! Thanks for credit towards me!
Excellent find bro ?

Any one knows MID of HK variant?

help
Hey, thanks for this post, i have tried every solution posted in this site, but anyone of them worked, this one seems the most effective one, but i cant change the MID! I copy the code, hit enter, the window closes, but when i reboot the phone and check de getvar mid, it doesnt change! what can i do? i have the phone in S-OFF, rooted and super CID... the phone was unlocked, tried this way, but now is relocked, tried this one also but its the same MID ..thaks for the help u can give me
ok i try some of the code, just to avoid the window from closing and it says this :
adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found...

gpcga said:
Hey, thanks for this post, i have tried every solution posted in this site, but anyone of them worked, this one seems the most effective one, but i cant change the MID! I copy the code, hit enter, the window closes, but when i reboot the phone and check de getvar mid, it doesnt change! what can i do? i have the phone in S-OFF, rooted and super CID... the phone was unlocked, tried this way, but now is relocked, tried this one also but its the same MID ..thaks for the help u can give me
ok i try some of the code, just to avoid the window from closing and it says this :
adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found...
Click to expand...
Click to collapse
What is the current MID of your device? also is it Qualcomm processor? If you boot the phone nornally with ADB debugging. is it detected? as from the last line it seems device is not connected or not detected

I changed the recovery
Hello, the phone didn't connect because of the recovery, I flashed another one, and that was it. Thanks, I have the stock lollipop 5.0.2 now. This is the only solution that worked fast and effective.
fshami said:
What is the current MID of your device? also is it Qualcomm processor? If you boot the phone nornally with ADB debugging. is it detected? as from the last line it seems device is not connected or not detected
Click to expand...
Click to collapse

Would this method work on my Chinese Desire 820t?

sponmagnet said:
Would this method work on my Chinese Desire 820t?
Click to expand...
Click to collapse
This thread is for the non-indian variants with Qualcomm chipset.. all details in first post. So if u have the same mid OPFJ11xxx then go a head & try.. be sure ur hardware specs match as i mentioned in the guide

Can anybody post instructions of how to change MID to TW variant? (-> from 0PFJ10000 to 0PFJ12000)

Prowler_gr said:
Can anybody post instructions of how to change MID to TW variant? (-> from 0PFJ10000 to 0PFJ12000)
Click to expand...
Click to collapse
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x32\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader

I am getting error
"adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found..."
Device is connected !!!
I tried everything but nothing works...
I want my phone to run on lollipop
please help me

shubhamkanwaria said:
I am getting error
"adb shell
adb server is out of date. killing...
* daemon started successfully *
error: device not found..."
Device is connected !!!
I tried everything but nothing works...
I want my phone to run on lollipop
please help me
Click to expand...
Click to collapse
Check if USB debugging is enabled.. and after connecting the phone, all drivers are installed properly

fshami said:
Check if USB debugging is enabled.. and after connecting the phone, all drivers are installed properly
Click to expand...
Click to collapse
USB debugging is enabled and all drivers are properly installed but still same error.

shubhamkanwaria said:
USB debugging is enabled and all drivers are properly installed but still same error.
Click to expand...
Click to collapse
If your phone is booted, still adb devices command is not showing your device?
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app

fshami said:
If your phone is booted, still adb devices command is not showing your device?
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app
Click to expand...
Click to collapse
Thank you so much... i got it... Now my phone running on lollipop.....

shubhamkanwaria said:
Thank you so much... i got it... Now my phone running on lollipop.....
Click to expand...
Click to collapse
glad to help

fshami said:
Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part
Click to expand...
Click to collapse
sorry .. this is no more available .. please check the next replay #18

fshami said:
Hi guys, so a friend of mine got a Desire 820 dual sim few days back. Device came in a very messy condition in terms for software. It was already Super CID'd & S-OFFed, no option to update software & around 200 languages. So i tried different threads to fix the issue & upgrade the phone to Lollipop.
I was able to get it back to stock Indian KK RUU 1.22.720.1 assuming that it was an Indian variant based on its id A51_DTUL but it was not the case.. After downloading the 1.22.720.10 update, it was giving me error like Modified System or Wrong Variant
Cut short i managed to identify / fix the problem & successfully upgraded the phone to Android L
Story line is that most of the guides available for 820 dual sim Lollipop upgrade are for the Indian variant with MID 0PFJ10000. Problem occurring is with its Chinesse sibbling with MID 0PFJ11000 & this is where the phone wont allow you to do software updates.
RUU is just checking the CID while in the OTA updater-script they have plenty of checks before flashing it.
So in the below KK updater-script, you can see that first it is checking for the current firmware, then CID & then MID
PHP:
mount("ext4", "EMMC", "system", "/system");
assert(file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.1:user/release-keys" ||
file_getprop("/system/build.prop", "ro.build.fingerprint") == "htc/htc_asia_india/htc_a51dtul:4.4.4/KTU84P/429556.10:user/release-keys");
assert(file_getprop("/system/build.prop", "ro.aa.taskid") == "402794" ||
file_getprop("/system/build.prop", "ro.aa.taskid") == "447333");
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_cid(getprop("ro.cid"), "00000000" , "11111111" ,
"22222222" , "33333333" , "44444444" , "55555555" , "66666666" ,
"77777777" , "88888888" , "99999999" , "HTC__038") == "t");
);
ifelse( is_ship_bootloader(getprop("ro.bootloader")) == "t" ,
assert(check_mid("full", "0PFJ10000") == "t");,
assert(check_mid("simple", "0PFJ10000") == "t");
This is point where we get Wrong Variant or Modified System error on device other than 0PFJ10000 MID.
So inorder to get rid of this error & getting all the updates automatically while keeping your ROM in stock status. These are the requirements / guidelines.
Required:
S-OFF
Root
Super CID
I assume you already know about fastboot commands stuff
So before proceeding, verify that you phone is A51_DTUL & the processor type is hTCBmsm8939 with 2GB of RAM. You can do this by booting into bootloader & run command fastboot getvar all
1st step, change MID of your device -> from 0PFJ11000 to 0PFJ10000. Run the following ADB commands:
PHP:
adb shell
su
echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x00\x30\x00\x30\x00\x30' | dd of=/dev/block/mmcblk0p5 bs=1 seek=16384
exit
exit
adb reboot bootloader
Now once the commands are successful, to verify the MID in fastboot again verify it with command fastboot getvar MID. It should now be 0PFJ10000
So we killed the BUG :laugh:
2nd step:
2a. download Indian KK RUU from this thread -> Thanks to sshivampp & robinsahlot
2b. Rename the downloaded ZIP to “0PFJIMG.zip” or to 0PFJIMG.txt incase you are unable to copy it
2c. Copy the 0PFJIMG.txt / zip file to the External SD card & do change the extension back to .zip incase you had to change it to .txt
2d. Reboot into bootloader & dont forget to disable Fastboot option under power settings
2e. Press Vol up for update once prompted
You will lot of checks & update prompts on the screen
Once successful, reboot the phone & check for software updates. You should now be able to install all the OTAs without any errors
Special thanks to h1dd3n_sn1p3r for his initial guide on upgrading to Android L.
And our dexter, Mr. scotty1223 for his amazing guides & work. Through which i was able to figure out MID change part
Click to expand...
Click to collapse
my data before :
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ11000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.022s
D:\HTC\fastboot>
and do :
D:\HTC\fastboot>adb shell
[email protected]_a51dtul:/ $ su
[email protected]_a51dtul:/ # echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x0>
17+0 records in
17+0 records out
17 bytes transferred in 0.005 secs (3400 bytes/sec)
[email protected]_a51dtul:/ # exit
[email protected]_a51dtul:/ $ exit
so the data after :
D:\HTC\fastboot>fastboot getvar mid
mid: 0PFJ10000
finished. total time: 0.002s
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ10000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.034s
D:\HTC\fastboot>
checked update .. 70.01MB .. downloaded .. but still got the msg (your system modified contact htc)
#Note : i was downloaded the ruu that you mention .. just changed mid then checked update
any help ??

nabilovetch said:
my data before :
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ11000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.022s
D:\HTC\fastboot>
and do :
D:\HTC\fastboot>adb shell
[email protected]_a51dtul:/ $ su
[email protected]_a51dtul:/ # echo -ne '\x30\x00\x50\x00\x46\x00\x4a\x00\x31\x00\x30\x0>
17+0 records in
17+0 records out
17 bytes transferred in 0.005 secs (3400 bytes/sec)
[email protected]_a51dtul:/ # exit
[email protected]_a51dtul:/ $ exit
so the data after :
D:\HTC\fastboot>fastboot getvar mid
mid: 0PFJ10000
finished. total time: 0.002s
D:\HTC\fastboot>fastboot getvar all
(bootloader) version: 0.5
(bootloader) version-bootloader: 3.19.0.0000
(bootloader) version-baseband: 01.01.010_U1030481_08.01.41119
(bootloader) version-cpld: None
(bootloader) version-microp: None
(bootloader) version-main: 1.22.720.1
(bootloader) version-misc: PVT SHIP S-OFF
(bootloader) serialno: HC4ANYC01045
(bootloader) imei: 355386060878133
(bootloader) imei2: 355386060878141
(bootloader) meid: 00000000000000
(bootloader) product: a51_dtul
(bootloader) platform: hTCBmsm8939
(bootloader) modelid: 0PFJ10000
(bootloader) cidnum: 11111111
(bootloader) battery-status: good
(bootloader) battery-voltage: 0mV
(bootloader) partition-layout: Generic
(bootloader) security: off
(bootloader) build-mode: SHIP
(bootloader) boot-mode: FASTBOOT
(bootloader) commitno-bootloader: ed7d3c37
(bootloader) hbootpreupdate: 11
(bootloader) gencheckpt: 0
(bootloader) mfg-name:
all: Done!
finished. total time: 0.034s
D:\HTC\fastboot>
checked update .. 70.01MB .. downloaded .. but still got the msg (your system modified contact htc)
#Note : i was downloaded the ruu that you mention .. just changed mid then checked update
any help ??
Click to expand...
Click to collapse
Good you've changed CID & MID. Now download & flash the RUU i mentioned. Once flashed then your device will do updates
Sent from my HTC One E9PLUS dual sim using XDA-Developers mobile app

fshami said:
Good you've changed CID & MID. Now download & flash the RUU i mentioned. Once flashed then your device will do updates
Sent from my HTC One E9PLUS dual sim using XDA- mobile app
Click to expand...
Click to collapse
i do factory reset and reflash ruu using sd card ..
still got the msg (your software is modified, contact htc)

Update my M9+

Hello,
I would like to update my HTC M9+.
The current version is :
Android : 5.0.2
HTC Sense : 7.0
base band : 1.1506V24P59.2508.1008_HTW
build : 1.03.708.12 CL608897 release-keys
cid: HTC--622
I live in France, but I've bought my phone on internet, and I think it come from Hong-Kong...
I don't know wich update I have to use...
Can you help me ?
(sorry for my English, it's not my native language...).

I asked the customer service about this problem
The answer was the package on the internet not working and you have to give us your phone to update it
Sent from my HTC One M9PLUS using XDA-Developers Legacy app

So... the best way is to buy a new phone...

fanfanus said:
So... the best way is to buy a new phone...
Click to expand...
Click to collapse
Hi, can you please share all the details about your phone with "fastboot getvar all" ? Do you know about this ?
After this you need to S-OFF with sunshine apk and come back to me here will give you instructons more....
Cheers!
P

Peacemaker69 said:
Hi, can you please share all the details about your phone with "fastboot getvar all" ? Do you know about this ?
Click to expand...
Click to collapse
Code:
(bootloader) kernel: lk
(bootloader) product: htc_hiaur_ml_tuhl
(bootloader) version: 1.0
(bootloader) imei:
(bootloader) version-main: 1.03.708.12
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.01.0000
(bootloader) mid: 0PK711001
(bootloader) cid: HTC__622
all:
finished. total time: 0.003s
Peacemaker69 said:
After this you need to S-OFF with sunshine apk and come back to me here will give you instructons more....P
Click to expand...
Click to collapse
It's done.

fanfanus said:
Code:
(bootloader) kernel: lk
(bootloader) product: htc_hiaur_ml_tuhl
(bootloader) version: 1.0
(bootloader) imei: 358812064*****xxx
(bootloader) version-main: 1.03.708.12
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.01.0000
(bootloader) mid: 0PK711001
(bootloader) cid: HTC__622
all:
finished. total time: 0.003s
It's done.
Click to expand...
Click to collapse
Ok... Did take S-OFF with sunshine apk ?
P.S. Remove your IMEI from here...

Yes i use sunshine apk to the S-OFF

fanfanus said:
Yes i use sunshine apk to the S-OFF
Click to expand...
Click to collapse
Ok, do you want to flash EU version to your phone? Because you are in EU as I can see... So am I...
Let me know....

Peacemaker69 said:
Ok, do you want to flash EU version to your phone? Because you are in EU as I can see... So am I...
Let me know....
Click to expand...
Click to collapse
Sure ! If it's work.
I read some componentes of the phone could change with the asian versions ? Is il not a prob ?

fanfanus said:
Sure ! If it's work.
I read some componentes of the phone could change with the asian versions ? Is il not a prob ?
Click to expand...
Click to collapse
Yup, it is but I'm not 100% sure.. Your version is from Hong Kong and it is "Supreme camera".... Correct ?
Alright, let's start...
First you need to change your CID...
---Before start flashing you need to download my ABD files... Check attached files down below
---Create some backup of your system before doing this !
Down this:
https://androidfilehost.com/?fid=745425885120699799
1. Go into Download mode and type command:
fastboot oem writecid HTC__621
2. Then command: fastboot reboot ... After that for and check if you CID has changed.. After go again to Download mode.
3. Rename zip file to 0PK7IMG.zip --must be putted in the same folder with fastboot ADB !!!!
4. fastboot oem rebootRUU
5. fastboot flash zip 0PK7IMG.zip
6. fastboot reboot
If you got some error message just let me know...
Cheers!
P

Peacemaker69 said:
5. fastboot flash zip 0PK7IMG.zip
Click to expand...
Click to collapse
ahah my SD card is too little...
Code:
htc_fastboot v3.0.9.2 (2015-05-29)
target reported max download size of 800000000 bytes
Invalid sparse file format at header magi
sending sparse 'zip' (8512 KB)...
OKAY [ 1.299s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR [SD_UPDATE_ERR] update_fb_ZIP_buf: can not find ZIP hea
(bootloader) der
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 22
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 22
(bootloader) [email protected]
FAILED (remote: 22: fail to flash via downloadzip)
finished. total time: 2.376s
htc_fastboot finished. total time: 5.293s

fanfanus said:
ahah my SD card is too little...
Code:
htc_fastboot v3.0.9.2 (2015-05-29)
target reported max download size of 800000000 bytes
Invalid sparse file format at header magi
sending sparse 'zip' (8512 KB)...
OKAY [ 1.299s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR [SD_UPDATE_ERR] update_fb_ZIP_buf: can not find ZIP hea
(bootloader) der
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 22
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 22
(bootloader) [email protected]
FAILED (remote: 22: fail to flash via downloadzip)
finished. total time: 2.376s
htc_fastboot finished. total time: 5.293s
Click to expand...
Click to collapse
You can try to install this with TWRP recovery If you have installed... Try that

Hello,
I try with a new SD card.
For the asian ROM you give me :
Code:
C:\Users\fanfa\Desktop\tempo\fastboot_adb>fastboot flash zip 0PK7IMG.zip
htc_fastboot v3.0.9.2 (2015-05-29)
target reported max download size of 800000000 bytes
Invalid sparse file format at header magi
sending sparse 'zip' (8376 KB)...
OKAY [ 1.338s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR [SD_UPDATE_ERR] update_fb_ZIP_buf: can not find ZIP hea
(bootloader) der
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 22
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 22
(bootloader) [email protected]
FAILED (remote: 22: fail to flash via downloadzip)
finished. total time: 2.412s
htc_fastboot finished. total time: 22.947s
And I try with the UE version (1.90) :
Code:
C:\Users\fanfa\Desktop\tempo\fastboot_adb>fastboot flash zip 0PK7IMG_EU.zip
htc_fastboot v3.0.9.2 (2015-05-29)
found large-zip header, file count: 8
processing file 1/8...
sending 'zip' (78987 KB)...
OKAY [ 3.854s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR CID not matched
(bootloader) ERR [SD_UPDATE_ERR] CID NOT ALLOWED
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 7
(bootloader) ERR Update zip file failed.
(bootloader) ERR ZIP ERROR, exit read zip loop
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 7
(bootloader) [email protected]
FAILED (remote: 7: fail to flash via downloadzip)
finished. total time: 4.988s
htc_fastboot finished. total time: 12.511s
Any suggestion ?
Thanks

fanfanus said:
Hello,
I try with a new SD card.
For the asian ROM you give me :
Code:
C:\Users\fanfa\Desktop\tempo\fastboot_adb>fastboot flash zip 0PK7IMG.zip
htc_fastboot v3.0.9.2 (2015-05-29)
target reported max download size of 800000000 bytes
Invalid sparse file format at header magi
sending sparse 'zip' (8376 KB)...
OKAY [ 1.338s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR [SD_UPDATE_ERR] update_fb_ZIP_buf: can not find ZIP hea
(bootloader) der
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 22
(bootloader) ERR Update zip file failed.
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 22
(bootloader) [email protected]
FAILED (remote: 22: fail to flash via downloadzip)
finished. total time: 2.412s
htc_fastboot finished. total time: 22.947s
And I try with the UE version (1.90) :
Code:
C:\Users\fanfa\Desktop\tempo\fastboot_adb>fastboot flash zip 0PK7IMG_EU.zip
htc_fastboot v3.0.9.2 (2015-05-29)
found large-zip header, file count: 8
processing file 1/8...
sending 'zip' (78987 KB)...
OKAY [ 3.854s]
writing 'zip'...
(bootloader) HOSD CL#608897
(bootloader) ERR CID not matched
(bootloader) ERR [SD_UPDATE_ERR] CID NOT ALLOWED
(bootloader) ERR [SD_UPDATE_ERR] sddownload failed: 7
(bootloader) ERR Update zip file failed.
(bootloader) ERR ZIP ERROR, exit read zip loop
(bootloader) Update zip file OK
(bootloader) ERR ZIP ERROR CODE, 7
(bootloader) [email protected]
FAILED (remote: 7: fail to flash via downloadzip)
finished. total time: 4.988s
htc_fastboot finished. total time: 12.511s
Any suggestion ?
Thanks
Click to expand...
Click to collapse
Hi again,
Did you try to change your CID ? Install TWRP and then flash the file that I give you and let me know... Do you know how to change your CID and install TWRP ?

Peacemaker69 said:
Did you try to change your CID ?
Click to expand...
Click to collapse
I succeed to install the europe version. I change the CID with a super CID :
Code:
fastboot oem writecid 11111111
It's working but.... only self-portrait is aviable in camera !

fanfanus said:
I succeed to install the europe version. I change the CID with a super CID :
Code:
fastboot oem writecid 11111111
It's working but.... only self-portrait is aviable in camera !
Click to expand...
Click to collapse
How did you install with fastboot or SD card or via TWRP? and which version of ?

I use fastbook.
now :
Code:
(bootloader) kernel: lk
(bootloader) product: htc_hiau_ml_tuhl
(bootloader) version: 1.0
(bootloader) imei:
(bootloader) version-main: 1.90.401.3
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.01.0000
(bootloader) mid: 0PK711001
(bootloader) cid: 11111111
Android is always 5.0.2
The phone ask me to install android 6.0 with this version. But It refuse to intall it because my phone was modified...

fanfanus said:
I use fastbook.
now :
Code:
(bootloader) kernel: lk
(bootloader) product: htc_hiau_ml_tuhl
(bootloader) version: 1.0
(bootloader) imei: 358812064194422
(bootloader) version-main: 1.90.401.3
(bootloader) boot-mode: download
(bootloader) version-bootloader: 1.01.0000
(bootloader) mid: 0PK711001
(bootloader) cid: 11111111
Android is always 5.0.2
The phone ask me to install android 6.0 with this version. But It refuse to intall it because my phone was modified...
Click to expand...
Click to collapse
You can change your CID If you find Asia RUUs with 6.0 version... Other way is to flash "CleanSlate 2.0 rom" via TWRP,,, and see if that would helps..
Here you can download CleanSlate 2.0 rom :
https://forum.xda-developers.com/on...nslate-1-0-world-wide-edition-t3120017/page36

I foud this version :
0PK7IMG_HIAUR_ML_TUHL_M60_SENSE70_MR_hTC_Asia_TW_2.15.709.1_Radio_1.1550V70.2501.0304_HT[W.T]_release_486004_signed_HBoot.zip
(http://en.pars-hamrah.com/download-...-_release_487210_combined_signed_2_4-zip.html)
But I don't find a free link....

Peacemaker69 said:
You can change your CID If you find Asia RUUs with 6.0 version... Other way is to flash "CleanSlate 2.0 rom" via TWRP,,, and see if that would helps..
Here you can download CleanSlate 2.0 rom :
https://forum.xda-developers.com/on...nslate-1-0-world-wide-edition-t3120017/page36
Click to expand...
Click to collapse
hai peacemaker..
i want to clean flash my htc one m9+ ..can u teach me step by step please..
my baseband version is 1.1550v70.2501.0304_HTW..
i want to change to asia WW stock rom but have no idea at all what to do..
currently my phone dont have a network and cant register any sim since i moved from taiwan to malaysia..
i will be so grateful if u can help me with this thanks

i need downgrade u ultra dual sim for oreo to noguet

Code:
Send: fastboot getvar all
(bootloader) kernel: lk
(bootloader) product: htc_ocedugl
(bootloader) version: 1.0
(bootloader) max-download-size: 1579200000
(bootloader) serialno: xxxxxxxxxxxx
(bootloader) slot-count: 0
(bootloader) current-slot:
(bootloader) imei: xxxxxxxxxxxxxxx
(bootloader) version-main: 1.64.401.10
(bootloader) boot-mode: download
(bootloader) version-baseband: [email protected]
(bootloader) version-bootloader: 1.0.0.0000
(bootloader) mid: 2PZF20000
(bootloader) cid: HTC__A07
all:
finished. total time: 0.006s
htc_fastboot finished. total time: 0.106s
i need stock rom or ruu.

Try this RUU
https://www.androidfilehost.com/?fid=3700668719832236904

thanks ur reply
minhnewpro said:
Try this RUU
https://www.androidfilehost.com/?fid=3700668719832236904
Click to expand...
Click to collapse
i trying it now.

please help me imei null.
I'm a little weak to speak English. Sorry for my english.
i installed this rom Link. 2PZFIMG_OCEAN_[email protected]70515_56.34_release_507305_signed_2_4.zip than after setup i locked BL. imei null.

https://androidfilehost.com/?fid=962187416754474071 i install this room. again imei null.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb devices
List of devices attached
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
error: no devices/emulators found
C:\Program Files (x86)\Minimal ADB and Fastboot>mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
'mke2fs' is not recognized as an internal or external command,
operable program or batch file.
Click to expand...
Click to collapse
i hate this mistake.

Adream09 said:
i hate this mistake.
Click to expand...
Click to collapse
10. After flashing, your device can boot into Android but no signal or IMEI received, dont worry, continue these steps
11. Reboot into download mode, reflash TWRP, then boot to TWRP
12. At cmd windows, type
Code:
adb devices
adb shell
mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
13. Reboot device to check if IMEI received
14. If IMEI received, you should reflash stock recovery from RUU.zip, but reflash the RUU is recommended.
If not, try to format the persist partition manually again (step 12)
15. Done

thanks ur reply
minhnewpro said:
10. After flashing, your device can boot into Android but no signal or IMEI received, dont worry, continue these steps
11. Reboot into download mode, reflash TWRP, then boot to TWRP
12. At cmd windows, type
Code:
adb devices
adb shell
mke2fs -t ext4 /dev/block/bootdevice/by-name/persist
13. Reboot device to check if IMEI received
14. If IMEI received, you should reflash stock recovery from RUU.zip, but reflash the RUU is recommended.
If not, try to format the persist partition manually again (step 12)
15. Done
Click to expand...
Click to collapse
thanks bro

Stock recovery for Fire HD 8 (6th generation)

Hi everyone,
First sorry for my English, I'm Vietnamese. I bought fire hd 8 6th used for a cheap price, I want to flash new rom via sideload becase i didn't find any topic about flashtool for fire hd tablet, so i decided to sideload it but unfortunately sideload processing to 47% and fail all of time, so i did some research and know that method only working on non modification devices, and my tablet already unlocked bootloader.. maybe, i knew it by using fastboot getvar unlocked and it say Yes. I thought with unblocked bootloader might be able to flash custom recovery to install a new rom, i tried and the results is writing recovery done but when device boot to recovery mode by holding power + volume down button nothing appear still remain blackscreen with recovery mode text from bottom left and with the bonus thing is Stock recovery is gone. Just for my stupid action, its bricked with only fastboot mode is accessible
I'm sorry for taking to long. Please let me know if you have any advice and stock recovery please share me
Thank you so much!
Issue solved thanks for k4y0z. Here is the recovery image file
https://forum.xda-developers.com/showpost.php?p=79663247&postcount=21
and the instruction for create recovery
https://forum.xda-developers.com/showpost.php?p=79656602&postcount=10

vnhatduy2010 said:
Hi everyone,
First sorry for my English, I'm Vietnamese. I bought fire hd 8 6th used for a cheap price, I want to flash new rom via sideload becase i didn't find any topic about flashtool for fire hd tablet, so i decided to sideload it but unfortunately sideload processing to 47% and fail all of time, so i did some research and know that method only working on non modification devices, and my tablet already unlocked bootloader.. maybe, i knew it by using fastboot getvar unlocked and it say Yes. I thought with unblocked bootloader might be able to flash custom recovery to install a new rom, i tried and the results is writing recovery done but when device boot to recovery mode by holding power + volume down button nothing appear still remain blackscreen with recovery mode text from bottom left and with the bonus thing is Stock recovery is gone. Just for my stupid action, its bricked with only fastboot mode is accessible
I'm sorry for taking to long. Please let me know if you have any advice and stock recovery please share me
Thank you so much!
Click to expand...
Click to collapse
Impossible that you have unlocked BL. Can you post the output of fastboot getvar all?
Thanks!

Rortiz2 said:
Impossible that you have unlocked BL. Can you post the output of fastboot getvar all?
Thanks!
Click to expand...
Click to collapse
Hi sorry for late reply
this is the output of getvar all
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>fastboot devices
G000L40360860685 fastboot
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>fastboot getvar all
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlock_code: 0x2a2097d9656b4eed
(bootloader) serialno: G000L40360860685
(bootloader) max-download-size: 0x6d00000
(bootloader) partition-size:userdata: 69d6fbe00
(bootloader) partition-type:userdata: ext4
(bootloader) partition-sizeMT: 438000
(bootloader) partition-typeMT: ext4
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: ext4
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: ext4
(bootloader) partition-size:dfs: 20000000
(bootloader) partition-type:dfs: ext4
(bootloader) partition-size:dkernel: 1000000
(bootloader) partition-type:dkernel: ext4
(bootloader) partition-size:cache: 1a800000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 64e48000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:dkb: 100000
(bootloader) partition-type:dkb: raw data
(bootloader) partition-size:kb: 100000
(bootloader) partition-type:kb: raw data
(bootloader) partition-size:metadata: 2760000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:tee2: 500000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:expdb: a00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-sizeara: 80000
(bootloader) partition-typeara: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: ext4
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: fe3000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:lk: 7d000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:seccfg: 40000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-sizerotect2: a00000
(bootloader) partition-typerotect2: ext4
(bootloader) partition-sizerotect1: a00000
(bootloader) partition-typerotect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-sizeroinfo: 300000
(bootloader) partition-typeroinfo: raw data
(bootloader) partition-sizereloader: 40000
(bootloader) partition-typereloader: raw data
(bootloader) off-mode-charge: 1
(bootloader) warranty: no
(bootloader) unlocked: yes
(bootloader) secure: no
(bootloader) kernel: lk
(bootloader) product: GIZA
(bootloader) version-preloader: 0.1.00
(bootloader) version: 0.5
(bootloader) partition-size:userdata: 69d6fbe00
(bootloader) partition-type:userdata: ext4
(bootloader) partition-sizeMT: 438000
(bootloader) partition-typeMT: ext4
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: ext4
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: ext4
(bootloader) partition-size:dfs: 20000000
(bootloader) partition-type:dfs: ext4
(bootloader) partition-size:dkernel: 1000000
(bootloader) partition-type:dkernel: ext4
(bootloader) partition-size:cache: 1a800000
(bootloader) partition-type:cache: ext4
(bootloader) partition-size:system: 64e48000
(bootloader) partition-type:system: ext4
(bootloader) partition-size:dkb: 100000
(bootloader) partition-type:dkb: raw data
(bootloader) partition-size:kb: 100000
(bootloader) partition-type:kb: raw data
(bootloader) partition-size:metadata: 2760000
(bootloader) partition-type:metadata: raw data
(bootloader) partition-size:tee2: 500000
(bootloader) partition-type:tee2: raw data
(bootloader) partition-size:tee1: 500000
(bootloader) partition-type:tee1: raw data
(bootloader) partition-size:frp: 100000
(bootloader) partition-type:frp: raw data
(bootloader) partition-size:expdb: a00000
(bootloader) partition-type:expdb: raw data
(bootloader) partition-size:logo: 800000
(bootloader) partition-type:logo: raw data
(bootloader) partition-sizeara: 80000
(bootloader) partition-typeara: raw data
(bootloader) partition-size:secro: 600000
(bootloader) partition-type:secro: ext4
(bootloader) partition-size:recovery: 1000000
(bootloader) partition-type:recovery: raw data
(bootloader) partition-size:boot: fe3000
(bootloader) partition-type:boot: raw data
(bootloader) partition-size:lk: 7d000
(bootloader) partition-type:lk: raw data
(bootloader) partition-size:seccfg: 40000
(bootloader) partition-type:seccfg: raw data
(bootloader) partition-sizerotect2: a00000
(bootloader) partition-typerotect2: ext4
(bootloader) partition-sizerotect1: a00000
(bootloader) partition-typerotect1: ext4
(bootloader) partition-size:nvram: 500000
(bootloader) partition-type:nvram: raw data
(bootloader) partition-sizeroinfo: 300000
(bootloader) partition-typeroinfo: raw data
(bootloader) partition-sizereloader: 40000
(bootloader) partition-typereloader: raw data
all: Done!!
finished. total time: 0.207s
C:\Users\1\Desktop\fire7\ADB FASTBOOT FILES WINDOWS>
Click to expand...
Click to collapse
Thank you

vnhatduy2010 said:
Hi sorry for late reply
this is the output of getvar all
Code:
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlocked: yes
(bootloader) secure: no
Thank you
Click to expand...
Click to collapse
What?
You can create the recovery from the boot-image using the install-recovery.sh script.
If you have unmodified boot and system it should happen automatically on boot.
Otherwise you can modify the script to read boot.img from a file.

What?
You can create the recovery from the boot-image using the install-recovery.sh script.
If you have unmodified boot and system it should happen automatically on boot.
Otherwise you can modify the script to read boot.img from a file.
Click to expand...
Click to collapse
Hi that mean my device not unlocked yet?
I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~

vnhatduy2010 said:
Hi I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~
Click to expand...
Click to collapse
Post the contents of the script here please.
The firmware-bin is just a ZIP-file, no special tools needed to extract it.

vnhatduy2010 said:
Hi that mean my device not unlocked yet?
I'm just google to find the firmware extractor tool, I manage to extract it and found recovery-from-boot.p file & install-recovery.sh inside /bin
I don't want to bother you but please I don't know what to do next to create recovery from sh file, the internet said that need using Linux OS but I don't know how to modify the script.
I will dualboot Ubuntu if necessary. Can you give me instruction?
Thanks~
Click to expand...
Click to collapse
Are you sure that is the Fire HD8 2016? Nvm, yes it's 2016: GIZA.
How did you unlocked the BL?

k4y0z said:
Post the contents of the script here please.
The firmware-bin is just a ZIP-file, no special tools needed to extract it.
Click to expand...
Click to collapse
yes I extracted with Winrar but after that I stuck with img file and windows can't open that file type.
btw here is the scritpt
Code:
#!/system/bin/sh
if ! applypatch -c EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:9218048:a1aff37711937c43c8bd4396803fb254a35db53a; then
applypatch -b /system/etc/recovery-resource.dat EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:8607744:05901192d8e64b20a9eabbddbf8b92b1ec0ca492 EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p && echo "
Installing new recovery image: succeeded
" >> /cache/recovery/log || echo "
Installing new recovery image: failed
" >> /cache/recovery/log
else
log -t recovery "Recovery image already installed"
fi

Rortiz2 said:
Are you sure that is the Fire HD8 2016? Nvm, yes it's 2016: GIZA.
How did you unlocked the BL?
Click to expand...
Click to collapse
I don't know this is the used device maybe the old owner unlocked it, I'm not sure about it maybe my wrong,
did you noticed anything from my getvar output?

vnhatduy2010 said:
yes I extracted with Winrar but after that I stuck with img file and windows can't open that file type.
btw here is the scritpt
Code:
#!/system/bin/sh
if ! applypatch -c EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery:9218048:a1aff37711937c43c8bd4396803fb254a35db53a; then
applypatch -b /system/etc/recovery-resource.dat EMMC:/dev/block/platform/mtk-msdc.0/by-name/boot:8607744:05901192d8e64b20a9eabbddbf8b92b1ec0ca492 EMMC:/dev/block/platform/mtk-msdc.0/by-name/recovery a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p && echo "
Installing new recovery image: succeeded
" >> /cache/recovery/log || echo "
Installing new recovery image: failed
" >> /cache/recovery/log
else
log -t recovery "Recovery image already installed"
fi
Click to expand...
Click to collapse
OK, make sure the firmware you have extracted is the same version you have installed.
Then copy the boot.img from the firmware to /sdcard
Code:
adb push boot.img /sdcard/
Then go into adb shell and run the following command
Code:
applypatch -b /system/etc/recovery-resource.dat /sdcard/boot.img /sdcard/recovery.img a1aff37711937c43c8bd4396803fb254a35db53a 9218048 05901192d8e64b20a9eabbddbf8b92b1ec0ca492:/system/recovery-from-boot.p
It should create /sdcard/recovery.img
You can pull it
Code:
adb pull /sdcard/recovey.img
If it isn't the same version you have installed (or the files have been modified to prevent recovery from being overwritten), you will have to extract the files
Code:
/system/etc/recovery-resource.dat
/system/recovery-from-boot.p
and place them on the device as well.

Thanks k4y0z but like i said on first post when i boot into recovery mode by holding power + volume down, nothing come up only the blackscreen with recovery mode text and my pc only regconize fastboot mode but recovery mode pc regconize as MTP device and no devices attached in cmd even i'm trying to reinstall driver and try on different pc, that mean i can't use adb command.
it's no hope:crying:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

vnhatduy2010 said:
Thanks k4y0z but like i said on first post when i boot into recovery mode by holding power + volume down, nothing come up only the blackscreen with recovery mode text and my pc only regconize fastboot mode but recovery mode pc regconize as MTP device and no devices attached in cmd even i'm trying to reinstall driver and try on different pc, that mean i can't use adb command.
it's no hope:crying:
Click to expand...
Click to collapse
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.

k4y0z said:
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.
Click to expand...
Click to collapse
Why he has the BL unlocked if it is a HD8 2016? Did you ported the exploit to that device?

Rortiz2 said:
Why he has the BL unlocked if it is a HD8 2016? Did you ported the exploit to that device?
Click to expand...
Click to collapse
No, I don't own that device. I don't think it really is unlocked, but the getvar output seems to be self-contradicting, as I noted above:
(bootloader) secure: yes
(bootloader) prod: 0
(bootloader) unlock_status: false
(bootloader) unlocked: yes
(bootloader) secure: no
Click to expand...
Click to collapse

k4y0z said:
Yes it's likely your recovery is broken.
You will have to flash the recovery produced by the scripts.
Make sure you are using the correct versions of all the files.
Click to expand...
Click to collapse
you right recovery completely broken, i tried to figure out but still don't know how to flash recovery produce by the script can we flash recovery.img file from the other kindle fire tablet like Hd 7 or Hd 8 older gen?

k4y0z said:
No, I don't own that device. I don't think it really is unlocked, but the getvar output seems to be self-contradicting, as I noted above:
Click to expand...
Click to collapse
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?

Rortiz2 said:
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?
Click to expand...
Click to collapse
I hope so, if can be flash recovery it will great

Rortiz2 said:
Amazing. Never saw that...
So he can flash the recovery tought fastboot right?
Click to expand...
Click to collapse
vnhatduy2010 said:
I hope so, if can be flash recovery it will great
Click to expand...
Click to collapse
According to the OP, you said, that fastboot flash was working.
Another option would be to flash from a rooted system.

k4y0z said:
According to the OP, you said, that fastboot flash was working.
Another option would be to flash from a rooted system.
Click to expand...
Click to collapse
yeah, fastboot still working fine but recovery is broken so i can't access and using adb command just only fastboot command, fastboot flash recovery command working but when i reboot to recovery nothing come up, maybe recovery image not compatible with hd 8 6th gen

vnhatduy2010 said:
yeah, fastboot still working fine but recovery is broken so i can't access and using adb command just only fastboot command, fastboot flash recovery command working but when i reboot to recovery nothing come up, maybe recovery image not compatible with hd 8 6th gen
Click to expand...
Click to collapse
Well, what recovery are you flashing?
It needs to be for GIZA.
I have given you instructions how to create a proper recovery-image.
What firmware-version do you have installed?

Fire HD 8 2015 (5th Gen) debrick

I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.

paklids said:
I have 3 of these, so I'm being a little carefree.
I went into recovery and adb sideload flashed an older version, causing that one to go into a preloader loop (not a big deal)
I'd love to recover that one and it appears I can do so using some of the techniques found here https://forum.xda-developers.com/amazon-fire/development/unbrick-fire-7-5th-gen-downgrade-t3388747
I can definitely handshake at the beginning and read/write. On one of my working tablets I went into fastboot and ran `fastboot getvar all` and was able to see some partition sizes and offsets.
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
Hi,
So looks like you downgraded the Preloader to version that has non-patched rw commands:good:
I can try to help you. If you want, just PM me.
Regards.

I'm going to add some details to the thread so peeps know where I'm coming from and where I'm going:
This unit, if you want to get into adb you'll need to enable adb debugging in the menu. After that you cannot reboot directly into fastboot mode, but you can hop over to recovery and then do it from there:
`adb reboot recovery` then select `reboot to recovery`
When the unit is stock (in my case v5.6.1.0) and on adb - the lsusb is:
Bus 005 Device 124: ID 1949:0212 Lab126, Inc.
& on fastboot lsusb reports:
Bus 005 Device 003: ID 0bb4:0c01 HTC (High Tech Computer Corp.) Dream / ADP1 / G1 / Magic / Tattoo
(Hey...that looks familiar! I had an HTC Magic that I rooted the first day I owned it)
What did I do to put this unit in preloader loop? I booted into revocery and used adb sideload to flash (I *think*) update-kindle-32.5.2.2_user_522054520.bin . After that the screen went black and I could see it rebooting because the USB would come up and then back down. lsusb would then report:
Bus 001 Device 105: ID 0e8d:3000 MediaTek Inc.
I hope this helps any of you follow along in case you are trying to recover your Fire HD 8 5th gen (2015)

Oh, and here are the details I gathered from the known working tablet:
fastboot getvar all
(bootloader) unlock_status: false
(bootloader) unlock_version: 1
(bootloader) unlock_code: 0xFFFFFFFFFFFFFFFF
(bootloader) prod: 1
(bootloader) serialno: FFFFFFFFFFFFFFFF
(bootloader) partition-offset:userdata: 5ec80000
(bootloader) partition-size:userdata: 173bfbe00
(bootloader) partition-type:userdata: unknown
(bootloader) partition-offset:cache: 4f280000
(bootloader) partition-size:cache: fa00000
(bootloader) partition-type:cache: unknown
(bootloader) partition-offset:system: 4280000
(bootloader) partition-size:system: 4b000000
(bootloader) partition-type:system: unknown
(bootloader) partition-offsetersisbackup: 3280000
(bootloader) partition-sizeersisbackup: 1000000
(bootloader) partition-typeersisbackup: unknown
(bootloader) partition-offset:MISC: 3200000
(bootloader) partition-size:MISC: 80000
(bootloader) partition-type:MISC: unknown
(bootloader) partition-offsetKB: 3100000
(bootloader) partition-sizeKB: 100000
(bootloader) partition-typeKB: unknown
(bootloader) partition-offset:KB: 3000000
(bootloader) partition-size:KB: 100000
(bootloader) partition-type:KB: unknown
(bootloader) partition-offset:recovery: 2800000
(bootloader) partition-size:recovery: 800000
(bootloader) partition-type:recovery: unknown
(bootloader) partition-offset:boot: 2000000
(bootloader) partition-size:boot: 800000
(bootloader) partition-type:boot: unknown
(bootloader) partition-offset:UBOOT: 1f00000
(bootloader) partition-size:UBOOT: 100000
(bootloader) partition-type:UBOOT: unknown
(bootloader) partition-offset:TEE2: 1a00000
(bootloader) partition-size:TEE2: 500000
(bootloader) partition-type:TEE2: unknown
(bootloader) partition-offset:TEE1: 1500000
(bootloader) partition-size:TEE1: 500000
(bootloader) partition-type:TEE1: unknown
(bootloader) partition-offsetMT: 1100000
(bootloader) partition-sizeMT: 400000
(bootloader) partition-typeMT: unknown
(bootloader) partition-offsetRO_INFO: 1008000
(bootloader) partition-sizeRO_INFO: 20000
(bootloader) partition-typeRO_INFO: unknown
(bootloader) max-download-size: 52429824
(bootloader) kernel: lk
(bootloader) product: THEBES
(bootloader) version: 0.5
(bootloader) unlocked: not unlocked
(bootloader) production: Unknown
all: Done!!

So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin

paklids said:
I have 3 of these, so I'm being a little carefree.
...
I've tried writing some things to the tablet stuck in preloader mode, but still not getting that one back to adb or fastboot. Some examples:
./write_mmc.py $((0x2000000)) boot.img
./write_mmc.py $((0x1F00000)) lk.bin
./write_mmc.py $((0x1500000)) tz.img
I can keep banging away at this but if anyone has a few more hints, I really could use a clue by four. Thanks!
PS: I imagine that these models (THEBES) could get some of the same goodness as the amonet versions but it has been low on people's priority.
Click to expand...
Click to collapse
paklids said:
So I did confirm that you can get the tablet (in my case tablet number 2) into preloader mode by booting to recovery and side loading the update that I mentioned before. For reference:
md5sum update-kindle-32.5.2.2_user_522054520.bin
615019d226954c2e4e2f98613151bc75 update-kindle-32.5.2.2_user_522054520.bin
Click to expand...
Click to collapse
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))

Just a note for anyone else, sometimes running ./handshake.py as a regular user will just continue waiting. I ran it as root and it completed quickly. This isn't uncommon with a number of linux distributions (I'm on Debian 9 Stretch) because of the permissions on /dev/tty type devices. It's always recommended that if you can run it as a regular user, then that is better. It may be possible to use sudo to do this as well.

bibikalka said:
You gotta be careful with write_mmc.py and ensure that you have the addresses right! Those can be quite tricky, you should go through the Fire HD 2014 thread which has the same chipset:
https://forum.xda-developers.com/fire-hd/development/unbrick-fire-hd-6-7-flashing-lollipop-t3405797
You will need to replace TZ/LK to the version you had before the downgrade. Then it should boot, and you may be able to root FireOS via KingRoot or something (if it's vulnerable). If your preloader version changed, then you cannot do anything since there is no way to write preloader via write_mmc.py. I think the recent scripts by @k4y0z can query the versions of PL/TZ/LK, see if you can do that too, just to make sure that PL does not need to be replaced, and to get an idea which versions you are dealing with.
Edit: Here is how you can see which versions of PL/TZ/LK you have (remove the junk - I copied this from another script):
Code:
tee_version=$((`adb shell getprop ro.boot.tee_version | dos2unix`))
lk_version=$((`adb shell getprop ro.boot.lk_version | dos2unix`))
pl_version=$((`adb shell getprop ro.boot.pl_version | dos2unix`))
Click to expand...
Click to collapse
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.

Rortiz2 said:
Yup, thebes and ariel share same CPU
So, now that we know Preloader is vulerable, we can flash a prerooted system.img (Yes, will take a lot of time).
Probably Amazon patched up this in latest preloaders but downgrading the Preloader and then restoring correct TZ, LK and flash the rooted system img may do the trick
Regards.
Click to expand...
Click to collapse
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).

bibikalka said:
This is too slow. The first order of business would be to update LK/TZ and see if it boots. If it does, then just do Kingroot: https://forum.xda-developers.com/showpost.php?p=63061585&postcount=4
If PL also has downgrade protection, it will still not boot. Then RPMB needs to be cleared for which we don't have a procedure (yet).
Click to expand...
Click to collapse
any one cant root this ?