Can't root newer kindle 10 - Fire HD 8 and HD 10 Q&A, Help & Troubleshooting

I just got a kindle fire hd 10 and I can't seem to downgrade it from 5.1.4. It seems this one has shipped with 3e recovery which performs a signature check and causes any .bin file less than 5.1.4 to fail the signature check when sideloading. I tried 5.1.2 as others mentioned success, but no dice on mine.
Anyone have a workaround? Is there any way to fake the sig check?
You guys that had success, did your device have 3e recovery on it?
Update: Also tried using "adb reboot bootloader" and then "fastboot unlock_critical" but it's of course locked. - I noticed that the bootloader on this device is literally a black screen. I imagine a lot of people thought their device was bricked because of that. Fastboot does detect the device though, you can't do much other than "fastboot restart" at that point.

Update: After several attempts, the 5.1.2.1 bin worked from this page: http://forum.xda-developers.com/showpost.php?p=63061579&postcount=3
Hope it helps someone.

Related

[Q] Bricked/Stuck in Fastboot (How to Remove TWRP?)

So, I've been up all night after buying this Fire trying to fix it, and I've decided to go along with my original decision to just return it. I'll rewind a bit to give you guys a play by play to show how I got to what I've determined is a FUBAR situation, and hopefully you guys can help me at least remove TWRP so I can return it without much issue.
If it's tl;dr, I bolded the main errors I got from the console and TWRP
1. I purchased my Kindle Fire from Best Buy with a 1 Year Protection plan, so in all reality, I could just break it in half and get a replacement, but I don't necessarily want a replacement.
2. I initially purchased it for my mom, but when I found out that the stock Fire OS didn't have Korean input or the option to have a Korean interface, I did a bit of research and started reading up on how to root, how to install the market, things like that. My mom's not a native English speaker, so this was an important thing for her, etc etc.
3. I read multiple guides on this forum and others, and rooted using the guide found here , since a few of the threads I was reading through seemed to point in that direction, and I had a bad experience with SOCR on my Droid X.
4. The root was successful, so I moved on and used KFU .3 to do the rest of the important bits; android market, etc etc.
5. Everything was working fine, but, after looking through it, I realized that it wouldn't work for what I needed it to, and I would have to return it, so, I attempted to unroot the tablet using TWRP's interface.
6. I cleared the cache, the devlak cache, and system wiped, then restored using the system restore point in the TWRP folder, figuring after that, the Kindle would boot up with stock OS and then I would just system restore the default way. This method got me stuck in a recovery-loop, and no matter what I did, the Fire always booted to recovery mode.
7. I figured I had bricked it, so I followed the steps in this guide, but always seemed to have problems at the step where I have to chmod 755 of the zergRush. I get "Not a directory" error, which after doing some research, I believe is on account of me no longer having rw privilege?
8. I looked around some more, ignoring that guide, and found a method to force-push the amazon update, but TWRP would no longer run the update, saying it could not Mount the SD Card due to an Invalid Argument, and I have yet to determine what that means.
9. After manually changing it to fastboot in an attempt to at least get it out of recovery mode, I have the Fire recognizable as a device in my ADB, but it is now stuck in a fastboot loop, and when I attempt to re-root it in order to give myself rw privileges again, it stalls on "waiting for device" and never gets past that point.
Update
I tried to reroot while the Fire was stuck in the Kindle Fire splash screen using the KFU tool, and used zergRush, but the error message I got was - exec '/system/bin/sh' failed: No such file or directory (2) - 4 times over.
What I think the problem is, is that when I wiped the cache/devlak cache/ and system reformatted, it wiped my SU privileges, and as a result, no longer allowed me to write the backup to the Fire, therefore leaving me in a perpetual state of limbo?
What I'm asking for from you is;
What can I do to fix this?
Is there any more information you need/want from me?
And finally,
Is there an easy way for me to remove TWRP from the system?
Thank you.
Hi!
There are a lot of great tips regarding TWRP and fastboot over at RootzWiki.
Some users are reporting the same fastboot loop that you currently experience. I suggest you read the thread and follow the suggestions. One suggestion which you may want to try first is the one in this post.
Thank you for the reply. I did as you suggested and followed the links and the post on the guide, and although that did change the nature of my fastboot loop, I'm still stuck in a fastboot loop.
I was initially stuck in a fastboot loop on the Kindle Fire logo, which I determined by running fastboot devices, while it was stuck on that logo, and it showed the device as being fastboot. After following that guide, and using the hard reset, then using the "How to Unbrick" in order to change back to a normal boot, I'm stuck in a fastboot loop on the TWRP splash screen of a triangle with a fire in it. I'll continue looking through the guides to see if I can solve the problem, but thank you once again, and sorry for not clarifying which type of fastboot loop I was in.
Sorry it didn't work out! However...
isjonamon said:
I'm stuck in a fastboot loop on the TWRP splash screen of a triangle with a fire in it.
Click to expand...
Click to collapse
I really though the solution posted over at RootzWizi would solve this problem. Getting stuck at the yellow triangle is 'common'. I really though adding
%SingleAdbInterface% = USB_Install, USB\VID_18D1&PID_0100
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_0100&MI_01
Click to expand...
Click to collapse
to android_winusb.inf would solve it. But if you are able to recognize your Fire in fastboot mode via your PC, I guess that's not where your problem is.
Is this tip to any help?
And lastly... the great Kindle Fire Utility thread is worth checking out, in case you haven't already
I hope you'll find a solution to this problem!
I've tried the tip you linked me to, and sadly it didn't do anything for me.
Moving on, though, I'm reading through the KFU thread again to see if there was anything I missed, and decided I might as well try re-flashing to CM7 to see if I can at least get it working up to a rooted/rom standpoint. I figure from there, I can at least have a working platform to factory reset from. If I can't do that... well...
Does anyone know a way to just return everything to factory settings? To just wipe everything and make it so it turns on like it's out of the box? Either through adb commands, or TWRP or anything?
Sorry for the double post, but I managed to get CM7 back up on my Fire, and managed to regain SU access. Can anyone point me to a guide to restoring it back to its former "glory" so I can return it?
Fixed it!!
For anyone interested, this is what worked for me;
From where I ended up with the problem, I followed hachiueno's advice and read through the KFU's thread as well as the TWRP thread on Rootzwiki, that led me to adding those lines to the device firmware, which I think was the first step in the solution, so...
Step 1. Add
%SingleAdbInterface% = USB_Install, USB\VID_18D1&PID_0100
%CompositeAdbInterface% = USB_Install, USB\VID_18D1&PID_0100&MI_01
to android_winusb.inf , then restart your computer with your Fire unplugged.
After that, I was inspired, through reading the KFU thread, to attempt to manually install CM7 since I wasn't having much luck zergRushing on my own, so, I went to the CM7 thread and pushed the Update.zip there, and used my TWRP to install that, effectively rebuilding my filestructure, since it seems the Kindle Fire doesn't have so much as a SH folder in it.
Step 2. MANUALLY (maybe) install CM7 if you can.
Once I got CM7 up and working, using the USB mounting option, I replaced the update.zip in the sdcard folder with the Amazon 6.2 firmware downloaded from their website, renamed to update.zip, and then unmounted my fire from my laptop.
Step 3. Download the Amazon 6.2 Firmware from amazon's website (I can't post...), rename it to update.zip, and replace the CM7 mod update.zip in your /sdcard directory with it.
Then, I figured if I ran TWRP like it was supposed to run, and just ran the update.zip like any other ROM, it should fill in the blanks in the filesstructure, bypassing Amazon's own lack of certain folders, and various other things, filling in the gaps as they were. The next step might be entirely redundant, since I'm a bit clueless, and it might have been entirely luck on my part, but I initially forgot to wipe my cache, devlak cache, and system restore, so I did all that and did it again, and my wishful thinking leads me to believe that doing that saved my ass from having a crapton of errors....
Step 4. Using the install function on TWRP, install the renamed Amazon update.zip, reboot, clear your cache, devlak cache, system reformat, then reinstall the update.zip. Reboot one more time, and you should come up to the Kindle Fire splash screen. Leave it for a few minutes, and it'll be like it just came out of the box.
Thanks for all your help. I love you. Seriously. No homo. Maybe a little. I love you.
Good to hear that you managed to boot it again!
isjonamon said:
Sorry for the double post, but I managed to get CM7 back up on my Fire, and managed to regain SU access. Can anyone point me to a guide to restoring it back to its former "glory" so I can return it?
Click to expand...
Click to collapse
This guide seems to be an easy solution to this. However, no one has replied any success or failure, so not sure if it's 100% bulletproof for everyone... if I were you, I would follow JackpotClavin's guide here. He's a known developer here and knows what he's doing, and many successful replies from users having used this method... so yeah, just to be 'sure' (can you ever be...?) that you won't experience any further problems, I recommend the last one.
I actually used the first guide in order to get the Amazon update, but couldn't post a reply since I'm still a noob. I had to do a few things differently, and ultimately got a few different results, but posted up my own version of the steps.
Once again, thanks for all your help!
It seems to me that the majority of problems people are having are driver related. When I was using KFU to install TWRP it stalled half way through and just said waiting for device. Just had to install drivers again and it happily completed the install.
Sent from my Kindle Fire using xda premium
all u needed do initially was change bootmode it seemed. thrn u went and did all kinds of stuff that wasnt necessary.
sent from my kindle fire
smirkis said:
all u needed do initially was change bootmode it seemed. thrn u went and did all kinds of stuff that wasnt necessary.
sent from my kindle fire
Click to expand...
Click to collapse
I actually changed bootmodes quite frequently, following multiple threads and guides, changing from recovery, to normal, to fastboot, and back and forth when called for. Changing to fastboot stuck me in an eternal fastboot loop, changing to normal reverted me to a recovery loop, and recovery was the only bootmode I could access adb from.
Sheolrock said:
It seems to me that the majority of problems people are having are driver related. When I was using KFU to install TWRP it stalled half way through and just said waiting for device. Just had to install drivers again and it happily completed the install.
Sent from my Kindle Fire using xda premium
Click to expand...
Click to collapse
Driver issues seemed to be part of the problem for me, but just updating the drivers didn't fix the issue entirely. I'm jealous that you got it to work with just a driver update...
Hey i believe im in the same problem but i keep reading the posts and im still stuck and i have no idea what to do im worried that i cant fix it.... Some please help me ASAP
Thanks in advance
wrong boot mode ?
with adb:
adb shell su -c "idme bootmode 4000"
adb reboot
with fastboot:
fastboot -i 0x1949 oem idme bootmode 4000
fastboot reboot
bad drivers ?
http://forum.xda-developers.com/showpost.php?p=20855280&postcount=54
I have had the looping problem and none of these would fix it. I got it to work by adding those lines to android_winusb and running the run.bat, trying to make it switch to normal mode as the kindle was turning on. Somewhere along the yellow triangle when it was loading it accepted the command from KFU. Hope this helps, only thing that worked for me.
the drivers i included contain all the necessary entries in adb_usb.ini and android_winusb.inf
Please can someone help me!?
I did idme bootmode 4002 and now my fire won't boot up or show up in android adb. Any solution?
awidawad said:
I did idme bootmode 4002 and now my fire won't boot up or show up in android adb. Any solution?
Click to expand...
Click to collapse
you switched it to fastboot (4002) - adb commands are not working in fastboot mode !
little guide:
driver (under android phone):
normal & recovery boot: -> android composite adb interface
fastboot: -> android adb interface
here all the possible commands to change bootmode:
with adb (secure kernel):
adb shell su -c "idme bootmode 4000"
adb reboot
or (twrp or unsecure kernel):
adb shell idme bootmode 4000
adb reboot
with fastboot:
fastboot -i 0x1949 oem idme bootmode 4000
fastboot -i 0x1949 reboot
or:
fastboot -i 0x18d1 oem idme bootmode 4000
fastboot -i 0x18d1 reboot
or:
fastboot oem idme bootmode 4000
fastboot reboot
the number is the bootmode you want to switch to:
normal boot -> 4000
fastboot -> 4002
boot to recovery -> 5001
and if you know:
normal boot -> adb commands YES -> fastboot commands NO
fastboot -> adb commands NO -> fastboot commands YES
recovery -> adb commands YES -> fastboot commands NO
then you only have to count 1 and 1 together and can master nearly each hanging situation !
Click to expand...
Click to collapse
Not sure if this is totally helpful to anyone but originally I thought the thread was started with a posting of being stuck bootlooping into twrp in recovery mode with a complete loss of file structure. I had this same issue my Kindle would not start in anything but straight to twrp and if I tried to flash my CM9 ICS rom it was not there and only the twrp folder empty was. So I went to mount and mounted usb storage and moved the stock update zip file from amazon to the twrp folder and flashed that. Worked like a charm now I appear to be straight stock. I am no developer of this stuff I just am a bit of a tinkerer so don't understand all the code stuff but it starts like a normal kindle and appears totally stock. So hopefuly that helps you return your deice to stock for return or to continue wahtever modifications you intend.
2992

[Q] KFU - bootloader FireFireFire access denied

This is one I haven't seen in the forums -
Last night I used KFU 093 to permanently root my phone, flash firefirefire bootloader and the twrp recovery module, followed by a flash of CM7 with a twrp backup and the KF as a second backup. All did not go smoothly but i knuckled down and with the help of the forums - i got there. i was hoping to use twrp to switch between backups of CM7 and the KF OS as needed but as of this morning i'm not seeing the firefirefire bootloader screen anymore and so i can't boot into recovery using the power button.
i tried to use kfu again today to re-flash firefirefire but now am getting an "access denied - the bootloader was not flashed" message on my kindle even though the kfu says the flash was successful. rebooting the kf demonstrates firefirefire was not flashed.
Any ideas what might be causing the "access denied" message? I checked and su access is allowed... any help would be greatly appreciated! Thank you.
PS i'm running Win 7 and KF 6.2.2.
I used KFU 093 to permanently root my phone
Click to expand...
Click to collapse
i assume you mean the kf ?
never seen such failure - sounds like messed partitions
if you get it to fastboot somehow you could try to hotboot the bootloader
by "fastboot -i 0x1949 boot bootloader u-boot.bin" and
try to restore factory partitioning with "fastboot oem format"
if you have to format it maybe this thread can help you further:
http://forum.xda-developers.com/showthread.php?t=1403337
maybe you'll need a factory cable to get to fastboot:
http://forum.xda-developers.com/showthread.php?t=1392693
Minor detail - yes the kindle fire.
I had not thought about partitions - perhaps that's the issue. I haven't had the best of luck getting it into fastboot - with the utility or by command prompt. The driver issues with the KF are absurd. Any experience with Firekit? http://forum.xda-developers.com/showthread.php?t=1430038
Perhaps I will need to get a factory cable (which by the way appear to finally be in stock: http://forum.xda-developers.com/showthread.php?t=1430038).
Is there any way for me to confirm it is a partition issue before reformatting?
Thanks again!
Btw I have been ripping off sound advice from you on these forums for a few days now - since I got myself addicted to this whole mess. I owe you already!
the thing with the drivers sounds more complicated than it is - i have written a quite long post about this: http://forum.xda-developers.com/showpost.php?p=22342376&postcount=6
i have no experience with firekit but as linux needs no drivers and the firekit is prepared exactly for the kf it should work fine - it had done for many others
if you don't have adb commands available i don't know a way to check the partitions
and to have a factory cable is allways a good idea - i have one from scorpn allthough i never needed it - just good to have

Help with Amazon Fire HD8 Fastboot

Trying to get CyanogenMod on my mums new Amazon Fire HD8 tablet. However, it's faring a little harder than expected. I have downloaded the AmazonFire SuperTool package as well as GoogleApps and the CMM Disc Image, however, when I try to run the .bat file in the supertool, my device shows up fine - the ADB works. However, when I try to boot the device into TRWP through the .bat, the screen simply turns blank on the tablet with no "FastBoot" on the screen. I have tried installing drivers many times, and have used the minimal ADB + Fastboot installer but even that has been to no avail. Trying to manually install drivers has failed too, with this resulting in the error message "The folder you have specified doesn't contain a compatible software driver for your device." Weird.. Could anyone help me out?
Thanks.
Thread moved to proper forum
The Super Tool written by RootJunky is currently only for the Amazon Fire 7" model. The reason why the HD models (8" and 10.1") are not compatible is because there is not a good fastboot screen right now. I am currently working on a root/replace firelauncher currently. Please check it out here:
http://forum.xda-developers.com/hd8...zon-fire-hd-8-10-remove-firelauncher-t3286646

(GUIDE) Root Onn 8 Gen 2 100011885

Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
LaikaXv1 said:
Since there's a new generation of the Onn 8 tablets, and there currently isn't a rooting guide for them,
I figured I'd write one since I finally got mine to boot with magisk.
DISCLAIMER: I AM NOT RESPONSIBLE FOR BRICKED DEVICES. CONSIDER BACKING YOUR DEVICE UP BEFORE FOLLOWING THE INSTRUCTIONS LISTED IN THIS POST.
I won't bore you with useless details, let's just get into how to root this thing.
TOOLS:
You're going to need your vbmeta.img file to flash. You can use the one I have attached below, or supply your own from your own device dumps. Either way, you're gonna need that.
You will also need EITHER, the stock boot.img file for your tab (mine is also attached), or a magisk patched boot.img file, which I'll show you how to create if you don't already have one.
You will also need ADB and Fastboot installed on your PC for your platform, as well.
A guide on how to obtain that is available here if you don't already have it.
CREATING PATCHED MAGISK BOOT.IMG:
On your device, install the magisk manager apk.
inside the app, click on Install magisk, and supply the app with your boot.img file.
It should then open a terminal and patch the boot file, and output it to your download folder.
Now you've got a rooted boot.img file for your device. Alternatively, you can use the one I've supplied at the bottom of this post.
FLASHING ROOT ON YOUR DEVICE:
Here's the part where things get interesting.
Copy the patched boot.img to your pc from your tablet, and save it somewhere you'll remember. (preferably the same place you saved your vbmeta.img file.)
You'll need to shut down your device, then power it into fastboot mode by holding Vol+ and Power at the same time. This should bring up a menu with three options: Recovery, Fastboot, And Normal.
You'll want to use Vol+ to scroll to fastboot, then press Vol- to select and boot into fastboot.
Connect your device to your pc and open your ADB and fastboot program.
In the command prompt, type "fastboot devices".
This should spit out the serial number of your device followed by the word "fastboot".
If there is no device present, make sure you have android USB drivers installed properly.
Given that your device is connected properly, type the following commands. (without the quotes.)
"fastboot flash --disable-verity --disable-verification --skip-reboot boot /path/to/your/magisk_boot.img"
then
"fastboot flash --disable-verity --disable-verification vbmeta /path/to/your/vbmeta.img"
If all goes well and you get no errors, you should be safe to reboot, and you should have root now!
Once booted, open Magisk, and you should see that V22 is installed and running. You can now install edxposed via the magisk module manager if you'd like xposed installed, since TWRP currently isnt available for this model and lots of android 10 devices don't support it.
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
Click to expand...
Click to collapse
NOTE: SAFETYNET CHECK DOES NOT PASS, WE'LL NEED TO LOOK INTO THAT.
I'm glad to see that there is finally a root solution for this device. I have 2 Onn 8 first gen, Android 9 tablets and I use the Magisk module: Universal SafetyNet Fix to
pass.
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Let us all know if this works. I work in a Walmart electronics department and have not bought one of the 2nd gen devices because I had assumed that it could not be rooted. I am temped just for a new challenge, even though I really don't need a new device.
Have you been able to create a backup of the stock rom? Is it flashed with spflashtool like the older device?
Thanks
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
Ah, I didn't hit reply. Oops!
I'm not new to XDA persay, but I'm not usually the one making guides and actually saying things haha.
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Boox17 said:
Doesn't seem to work for me
Keeps failing says
(remote: not allowed in locked state)
Click to expand...
Click to collapse
It sounds like maybe you did not unlock the bootloader first?
martyfender said:
It sounds like maybe you did not unlock the bootloader first?
Click to expand...
Click to collapse
Yeah exactly what it was
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
I'm stuck in a boot loop. Does this work with a 100011885 that has Android 11 or did I just brick it cause I didn't pay attention.
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
bowb said:
I think I have extracted the boot.img using spflashtool on the 100011885 with Android 11. abootimg seems to like it and I can extract the kernel and initrd.img I have tried booting with fastboot boot but it blackscreens the tablet. I have not tried re-flashing this image as I don't know if it will actually work.
start location and size
0x00000000085c0000
0x0000000002000000
boot.img
and another boot image found at
A5C0000
boot2.img
Click to expand...
Click to collapse
Did you get this working?
Valiante said:
Did you get this working?
Click to expand...
Click to collapse
No.
LaikaXv1 said:
I'll get the ROM backup uploaded to Google drive once I'm done updating windows.. it's taking forever, but I do have the dumps. Yes, spflashtool is what you'll need to flash the stock backup.
As for the magisk module, that seems to do the trick! Magist safetynet check reports a success for both basicIntegrity and ctsProfile.
Thanks for the tip!
Click to expand...
Click to collapse
did you happen to upload this image yet? if so, got a link?
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
pj_dev said:
I followed this guide for a ONN 100003561 (didn't look closely at the numbers) and this is what I get when trying to flash the vbmeta:
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (11520 KB) OKAY [ 0.287s]
Writing 'vbmeta' FAILED (remote: 'size too large')
I tried using a different vbmeta and when I restarted my tablet and got blank black screen. Tried twrp and now I can't get anything to work. Never tried rooting an Android device before, just trying to get all the annoying stuff off and now it looks like I bricked it.
Any advice from anyone?
Click to expand...
Click to collapse
Unfortunately, the numbers are important. Are you able to get to fastbootd? If you can get to fastbootd, I would recommend trying to change to boot slot. Newer androids actually have two boot partitions for updating purposes. You can check which boot partition you're using with `fastboot getvar current-slot` which should return "a" or "b". Then do `fastboot set-active x` and replace x with whichever slot is NOT active as determined by the previous command. If the other boot slot is still intact, this would hopefully result in a bootable device. I haven't tried this myself, but this is what I would try if I were in your situation.
If this doesn't work, I would try flashing stock with sp flash tool, which doesn't need fastboot if you can't access that. It's a leaked mediatek tool, so there isn't an official site to get it from unfortunately. I got it from here: https://androidmtk.com/smart-phone-flash-tool but use your discretion. And get v5, because that's what most of the guides use. Then you can try flashing the 3561 stock firmware here: https://forum.xda-developers.com/t/stock-stock-backups-images-otas.3998227/post-82619259
If you can get it to boot at this point and want to de-walmart it, I would recommend just flashing a GSI rather than messing around with the stock rom. You can find the GSI's here: https://github.com/phhusson/treble_experimentations/wiki/Generic-System-Image-(GSI)-list
LaikaXv1 said:
Here's a couple pics just showing I actually DID do this, and I'm not just ****posting or something
Click to expand...
Click to collapse
Lol, remember those copy-pasted guides where they provide the wrong TWRP images and it messes up the device
So the 8" Onn actually has a boot-ramdisk it appears. On the 7" Onn Surf (100005206), there is no boot-ramdisk, so the alternative is patching a recovery.img and allowing Magisk to hijack the /recovery partition. The only drawback is, anytime you need to reboot, using hardware keys as though booting into recovery is necessary.
inzane105 said:
I have a 100011886 that I got used and has FRP lock, will this process work on it as well? Only rooted Fire tablets before, so this would be new to me and if I brick it not much will be lost. But any insight as to what I will need that isn't included in your post would be great! It seems pretty thorough though.
Edit: I've tried it, and I have done pretty much everything thanks to being able to get to the browser with one of those language keyboard tricks, but I can't enable dev mode and turn on OEM unlock so I can't unlock the bootloader. Really want to know what to do so I don't have a paper weight At least it was only $30
Click to expand...
Click to collapse
I'm in a similar situation, my friend got an RCA Atlas 10 Pro-S from Goodwill for $1. It had an FRP lock on it though, and we ultimately managed to get to the home screen by enabling TalkBack and watching the support video to open the browser. Then, we installed Lawnchair to access the home screen. The settings app worked, but Developer Options would not open.
GetDroidTips has published a software called Miracle Box, claiming that it can unlock MediaTek bootloaders, as well as bypass FRP. However, a VirusTotal scan indicates that it is likely malware. I tried running it in a virtual machine and it asked if I wanted to run a process impersonating "svchost.exe" as Administrator. I airgapped the virtual machine, and Miracle Box said it needed Internet access for licensing, however GetDroidTips said it was free. I suspect that this was a fake software crack.
I am aware of a program called SP Flash Tool, but that won't work because I am on Linux, and not Windows. I doubt it would work under WINE, as it requires special device-specific drivers that also only work on Windows. I have a spare Lenovo IdeaPad 110-15ACL, however I don't have the drivers needed to set up Windows 7 on it. I could, of course, use Windows 10, but I have heard it is bad for flashing, and it is very slow anyway. (I did, however, buy an SSD for it, perhaps this will speed it up enough to be somewhat usable?)
I also found an open-source MediaTek exploit script called MTKTools. It did not work, and it told me to hold all hardware buttons before plugging the device in. It still did not detect the tablet. It told me that I could also short TP1 to ground, however I could not find Test Point 1 on the tablet's motherboard.
There are no custom recoveries or FRP unlocking guides for this device, likely because it's an obscure Android 7.1 tablet from back in 2014. I wouldnt be able to flash them anyway as the bootloader is locked. It has 2 GB of RAM and the processor cores are Cortex-A35s so I'm not sure that this is worth unlocking. On the other hand, it costs over $100 from Walmart.
I am worried that the device was stolen, as it had a password, and once I reset it from Recovery mode, it had an FRP lock. If it is indeed stolen, I can't return it, due to the "as is" nature of Goodwill, and besides, I have disassembled it several times as well. Should I be concerned about the ethical implications of unlocking this device?
Does this work on Android 11? I have the Onn. 100011885 model, according to my settings app.

"your device is corrupt. it cant be trusted and will not boot"

I previously rooted my phone and I wanted to unroot it. I am running "OxygenOS 11.0.8.8".
I uninstalled Magisk from within Magisk and confirmed the phone was not rooted with the root checker app.
Then I used ADB to run these commands:
adb reboot bootloader
fastboot oem lock
After that when it boots I'm getting a message "your device is corrupt. it cant be trusted and will not boot"
I can still manage to get to "Fastboot Mode" and it reports Device State is locked.
Can anyone plz point me how to finish "unbrick" the phone?
SPFlashTool can help I think
ugh I only have access to Mac not windows. I was also looking at this "unbrick tool" but it also seems to be Windows only: https://forum.highonandroid.com/t/how-to-unbrick-oneplus-8-or-8-pro/181
idk if it will work but why not try fastboot oem unlock
That actually worked. Now I'm back into the normal phone, what's the safest way to return to locked bootloader total stock from here?
When I try to update OS via settings I get a red font error "installation will continue when device isn't being used"
Now I've updated to "11.0.11.11.IN11BA" but my bootloader is still unlocked, what's the safest way to lock it?
Thanks!
Ishta said:
Now I've updated to "11.0.11.11.IN11BA" but my bootloader is still unlocked, what's the safest way to lock it?
Thanks!
Click to expand...
Click to collapse
[OP8PRO][OOS 11AA/BA/DA] Unbrick tool to restore your device to OxygenOS
Disclaimer: By attempting any of the processes listed in this thread you accept full responsibility for your actions. I will not be held responsible if your device stops working, catches fire, or turns into a hipster and claims to have been...
forum.xda-developers.com
Use MSM Tool
Ishta said:
ugh I only have access to Mac not windows. I was also looking at this "unbrick tool" but it also seems to be Windows only: https://forum.highonandroid.com/t/how-to-unbrick-oneplus-8-or-8-pro/181
Click to expand...
Click to collapse
Try to use virtualbox
If you can flash TWRP 3.6.1, you can use it to flash roms that are a zip file. That includes stock roms also. This version of TWRP works well to flash roms. I have even gone from Android 11 to 12 with it.
You can flash TWRP both with fastboot and adb. Adb works really nice using adb sideload TWRP.zip. It will auto flash into both partitions.

Categories

Resources