Related
So for the last 7 hours i've been researching how to root/ install JB or another rom onto this brand new kindle i have running 10.2.3.
I've got ADB running and i've tried Sparkym3 and a few other root methods and i keep getting permission denied when i go to write fbmode or su
SO i'm at a loss, i'd really like to get this installed and working for my handicapped father's new kindle, its his xmas gift, and i know i'd prefer he be able to use google play and stuff.
Any help would be fantastic, this is really rattling my brain.
Unfortunately, you're out of luck with a custom ROM/Jelly Bean, but you can gain access to the play store and lose the ads with root. I tried the automated method in the link below with no success. The qemu tool just quit after step two.
Is this the method you tried?
http://forum.xda-developers.com/showthread.php?t=1893838
I just followed this video to the letter, and I was golden. HOWEVER, I was on 10.2.1. I don't know if it will work with .3. Keep me posted because my other daughter's KF2 received the update before I attempted root, and I haven't attempted root on it yet . I renamed the otacert.zip file to prevent the update on the alreay-rooted tablet.
http://forum.xda-developers.com/showthread.php?t=1891939
scubamike said:
Unfortunately, you're out of luck with a custom ROM/Jelly Bean, but you can gain access to the play store and lose the ads with root. I tried the automated method in the link below with no success. The qemu tool just quit after step two.
Is this the method you tried?
http://forum.xda-developers.com/showthread.php?t=1893838
I just followed this video to the letter, and I was golden. HOWEVER, I was on 10.2.1. I don't know if it will work with .3. Keep me posted because my other daughter's KF2 received the update before I attempted root, and I haven't attempted root on it yet . I renamed the otacert.zip file to prevent the update on the alreay-rooted tablet.
http://forum.xda-developers.com/showthread.php?t=1891939
Click to expand...
Click to collapse
The commands:
adb shell
rm -r /data/local/tmp
ln -s /data/ /data/local/tmp
exit
adb reboot
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
exit
abd reboot
adb shell mount -o remount,rw /system
adb push su /system/xbin/su
adb shell
chown 0.0 /system/xbin/su
chmod 06755 /system/xbin/su
rm /data/local.prop
exit
adb reboot
adb install Superuser.apk
^^^ Method i tried, and failed, wont allow remount, gives me permission denied, i didnt try Qemu at all.
If i could get access to play store i'd be fine keeping it on stock, i just want my dad to be able to use this thing with standard apps.
I think this method is strictly for the kindle fire HD and i'm trying to do it on a standard Kindle Fire.
Hi there,
I,ve got the same issue with my brand new KF Gen2 FW 10.2.3. During the 1st run everythings seems fine (all commands were accepted),
but in the end I was not able to get root access by the superuser-app.
After that I decided to reset the device to factory defaults, but now I'm not able to create any file under /data (echo 'ro.kernel.qemu=1' > /data/local.prop).
Has anyone a good idea which way we have to choose to get root access on the KF2 (FW10.2.3)?
Thanks yanzz
yanzz said:
Hi there,
I,ve got the same issue with my brand new KF Gen2 FW 10.2.3. During the 1st run everythings seems fine (all commands were accepted),
but in the end I was not able to get root access by the superuser-app.
After that I decided to reset the device to factory defaults, but now I'm not able to create any file under /data (echo 'ro.kernel.qemu=1' > /data/local.prop).
Has anyone a good idea which way we have to choose to get root access on the KF2 (FW10.2.3)?
Thanks yanzz
Click to expand...
Click to collapse
My device lets me punch in the echo command but once i hit mount or push i'll get permission denied so i'm at a loss myself. I hope one of these higher end techies can help us make this happen before Christmas time or my dads kindle stays stock :crying:
I actually was able to root my 10.2.1 yesterday, but overnight it appears to have upgraded itself to 10.2.3, and now it's unrooted again.
The original technique to root fails on this step:
<code>
[email protected]:/ $ echo 'ro.kernel.qemu=1' > /data/local.prop
echo 'ro.kernel.qemu=1' > /data/local.prop
/system/bin/sh: cannot create /data/local.prop: Permission denied
</code>
Anyone have any luck?
I'd love any ideas to override the bootloader on thing, since I'm about sick and done with the stock rom.
arcymag said:
I actually was able to root my 10.2.1 yesterday, but overnight it appears to have upgraded itself to 10.2.3, and now it's unrooted again.
The original technique to root fails on this step:
<code>
[email protected]:/ $ echo 'ro.kernel.qemu=1' > /data/local.prop
echo 'ro.kernel.qemu=1' > /data/local.prop
/system/bin/sh: cannot create /data/local.prop: Permission denied
</code>
Anyone have any luck?
I'd love any ideas to override the bootloader on thing, since I'm about sick and done with the stock rom.
Click to expand...
Click to collapse
If you put the 10.2.1 rom back in the kindleupdates folder on the SDCard and go the setting to update the kindle I wonder if it will reset back to 10.2.1. Atleast you could re-root and then try to block the OTA so it wont go back to 10.2.3.
bodi524 said:
If you put the 10.2.1 rom back in the kindleupdates folder on the SDCard and go the setting to update the kindle I wonder if it will reset back to 10.2.1. Atleast you could re-root and then try to block the OTA so it wont go back to 10.2.3.
Click to expand...
Click to collapse
I tried that last night, but it didn't work for me. Does anyone know if the .bin files from Amazon are flashable through fastboot... It would definitely be worth building/buying a factory cable if we could fastboot flash back to 10.2.1, root, and block ota updates.
Not to beat a dead horse but I am having the same trouble with Kindle Fire 2. Lost Root access last night when Amazon pushed 10.2.3. I tried to down-date to 10.2.1 but the .bin file keeps getting deleted from the kindleupdates folder after I press the update button in "settings-device-about". Unfortunately I learned about disabling automatic updates a little too late. Thank you in advance for helping us out. We are not worthy.
arcymag said:
I actually was able to root my 10.2.1 yesterday, but overnight it appears to have upgraded itself to 10.2.3, and now it's unrooted again.
The original technique to root fails on this step:
<code>
[email protected]:/ $ echo 'ro.kernel.qemu=1' > /data/local.prop
echo 'ro.kernel.qemu=1' > /data/local.prop
/system/bin/sh: cannot create /data/local.prop: Permission denied
</code>
Anyone have any luck?
I'd love any ideas to override the bootloader on thing, since I'm about sick and done with the stock rom.
Click to expand...
Click to collapse
Thats exactly where it fails for me :/
Oh kindle hacking gods have mercy on us.
xiastro1ix said:
Thats exactly where it fails for me :/
Oh kindle hacking gods have mercy on us.
Click to expand...
Click to collapse
I am willing to try the hack posted for the 8.9" bootloader.
However I want to know the restore process works first.
If someone will pull the partitions to restore, zip them and post them I will try the backup on my KindleFire2.
See Here:
http://forum.xda-developers.com/showthread.php?t=2032822
Mine is bricked as of now so trying to restore it won't harm it anymore that it already is.
Once we having a working restore I will try the bootloader crack....and in an exchange with
Hashcode he said he thinks the Original KF roms will then work (WITH SOME KERNEL CHANGES)
for the KindleFire2.
this thread
http://forum.xda-developers.com/showthread.php?t=2033297
claims that they've got root working on the current version, but I tried and it doesn't even recognize my device is plugged in. Several confirmations in that thread that people have it working though.
confrmed root access on 10.2.3
http://forum.xda-developers.com/showthread.php?t=2033297
Just completed hooray!
Now to replace ROM
well it claims its rooted and it has super user installed, but i still cant get past permission denied messages when trying to go ahead and get a new rom on it.
Not sure what to do here, i want to get google aps on it and i'll be fine, but i don't know what file explorer would be good for the stock rom that i can get through the amazon store :\
I'm actually not sure if it is rooted, the first method installed SU onto the phone, but i don't actually see the second portion processing the exploit, its getting permission denied aswell, the kindle has superuser on it, but now i'm completely lost, i still cant get it to do anything....
Edit- ALL DONE YAY
Got googleplay and 1mobile installed, just had to purchase ES file explorer and play around a bit
Any idea why I can't seem to get past these root methods even seeing my kindle is plugged in? I KNOW one of the methods came bundled with some kinda drivers ... I'm just at a loss for what I'm doing wrong because I've tried all sorts of stuff from various posts and instructions...
Running Win7 x64 if that helps any.
Trendy Ideology said:
Any idea why I can't seem to get past these root methods even seeing my kindle is plugged in? I KNOW one of the methods came bundled with some kinda drivers ... I'm just at a loss for what I'm doing wrong because I've tried all sorts of stuff from various posts and instructions...
Running Win7 x64 if that helps any.
Click to expand...
Click to collapse
Step one is getting ADB hooked up and installed on your computer
if youre telling me your computer is seeing "kindle" then youre already doing it wrong. In order for these methods to work upon plugging in your kindle, device manager should say Android- ADB composite device, or something along those lines,
xiastro1ix said:
Step one is getting ADB hooked up and installed on your computer
if youre telling me your computer is seeing "kindle" then youre already doing it wrong. In order for these methods to work upon plugging in your kindle, device manager should say Android- ADB composite device, or something along those lines,
Click to expand...
Click to collapse
I was trying to use the ADB drivers found here,
http://forum.xda-developers.com/showthread.php?t=1893838
but when installed they didn't say anything like that in the final step that showed me what was installed, it said amazon kindle somethingorother.
Device manager went from showing
Portable devices
|
_ Kindle
To now
Kindle Fire
|
_ Kindle
Installing the driver manually gets me something that looks like ADB Kindle Fire but now it doesn't show up in My Computer at all, and the root with restore
http://forum.xda-developers.com/showthread.php?t=1886460
doesn't "see" my kindle...
I'm rather lost.
Here's a log of as far as I've gotten so far:
======================================================================
= This script will root your Android phone with adb restore function =
= Script by Bin4ry (thanks to Goroh_kun and tkymgr for the idea) =
= Idea for Tablet S from Fi01_IS01 =
= (22.11.2012) v17 =
======================================================================
Device type:
1) Normal
2) Special (for example: Sony Tablet S, Medion Lifetab)
x) Unroot
Make a choice: 1
Checking if i should run in Normal Mode or special Sony Mode
Please connect your device with USB-Debugging enabled now
remote object '/system/app/Backup-Restore.apk' does not exist
remote object '/system/bin/ric' does not exist
.
.
Normal Mode enabled!
.
Pushing busybox....
failed to copy 'stuff/busybox' to '/data/local/tmp/./busybox': Permission denied
Pushing su binary ....
failed to copy 'stuff/su' to '/data/local/tmp/./su': Permission denied
Pushing Superuser app
failed to copy 'stuff/Superuser.apk' to '/data/local/tmp/./Superuser.apk': Permi
ssion denied
Making busybox runable ...
Unable to chmod /data/local/tmp/busybox: No such file or directory
.
Please look at your device and click RESTORE!
If all is successful i will tell you, if not this shell will run forever.
Running ...
Successful, going to reboot your device in 10 seconds!
error: device not found
Waiting for device to show up again....
Going to copy files to it's place
/system/bin/sh: /data/local/tmp/busybox: not found
You can close all open command-prompts now!
After reboot all is done! Have fun!
Bin4ry
Press any key to continue . . .
It's only "Seeing" my kindle if I power it down, plug in the USB, and then it seems to "catch" it while it's booting up. And it remains caught until the tool lets go of it and then it goes to the lock screen as normal.
on this step
Please look at your device and click RESTORE!
If all is successful i will tell you, if not this shell will run forever.
I get no restore option, probably because my kindle is in a booting state when this is all happening.
I was able to root my Kindle Fire 2 on 10.2.3 doing a combination of:
http://forum.xda-developers.com/showthread.php?t=1891939
and
http://forum.xda-developers.com/showthread.php?t=1894717
adb shell
rm -r /data/local/tmp
ln -s /data/ /data/local/tmp
exit
adb reboot
This step in red no longer works!
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
exit
Instead do...
4) Restore the fake "backup": adb restore fakebackup.ab Note: do not click restore on your device. Just enter the command into the command prompt on your PC and press the enter key.
5) Run the "exploit": adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" Note: when you enter this command, you should see your adb window flooded with errors -- this is what is supposed to happen.
6) Now that the "exploit" is running, click restore on your device.
7) Once it finishes, reboot your device: adb reboot Note: Do not try and use your device when it reboots. Running this exploit will reboot your device into emulator mode, so it will be laggy and the screen will flicker -- this is normal.
adb shell mount -o remount,rw /system
adb push su /system/xbin/su
adb shell
chown 0.0 /system/xbin/su
chmod 06755 /system/xbin/su
rm /data/local.prop
exit
adb reboot
adb install Superuser.apk
Deflection said:
I was able to root my Kindle Fire 2 on 10.2.3 doing a combination of:
http://forum.xda-developers.com/showthread.php?t=1891939
and
http://forum.xda-developers.com/showthread.php?t=1894717
adb shell
rm -r /data/local/tmp
ln -s /data/ /data/local/tmp
exit
adb reboot
This step in red no longer works!
adb shell
echo 'ro.kernel.qemu=1' > /data/local.prop
exit
Instead do...
4) Restore the fake "backup": adb restore fakebackup.ab Note: do not click restore on your device. Just enter the command into the command prompt on your PC and press the enter key.
5) Run the "exploit": adb shell "while ! ln -s /data/local.prop /data/data/com.android.settings/a/file99; do :; done" Note: when you enter this command, you should see your adb window flooded with errors -- this is what is supposed to happen.
6) Now that the "exploit" is running, click restore on your device.
7) Once it finishes, reboot your device: adb reboot Note: Do not try and use your device when it reboots. Running this exploit will reboot your device into emulator mode, so it will be laggy and the screen will flicker -- this is normal.
adb shell mount -o remount,rw /system
adb push su /system/xbin/su
adb shell
chown 0.0 /system/xbin/su
chmod 06755 /system/xbin/su
rm /data/local.prop
exit
adb reboot
adb install Superuser.apk
Click to expand...
Click to collapse
I have a new Kindle Fire (1st gen) and all your steps were perfect until I tried to install the SuperUser.apk where it says I dont have permissions to copy to /data/tmp... ans fails to install superuser.
Any ideas? Maybe chmod of /data getting in emulator mode?
Thanks
reyvaj said:
I have a new Kindle Fire (1st gen) and all your steps were perfect until I tried to install the SuperUser.apk where it says I dont have permissions to copy to /data/tmp... ans fails to install superuser.
Any ideas? Maybe chmod of /data getting in emulator mode?
Thanks
Click to expand...
Click to collapse
There is a whole forum for kf1. Kf1 runs 6.something not 10.2...
Hi, i need help, i want root my kindle fire first generation 7 on 10.2.3_user_2313820 sw version, many thanks
Introduction
The following procedure will walk you through the step-by-step process for gaining root access on the Nvidia Shield.
Note: You must have an unlocked bootloader before you can proceed with this tutorial!
A tutorial on how to unlock your Shield's bootloader can be found here.
This tutorial also assumes how have the correct ADB and Fastboot drivers installed for your device, for a tutorial on how to install the ADB and Fastboot drivers for the Shield please look here.
Due to the nature of modifying devices system files the standard XDA disclaimer applies: I take no responsibility for bricked devices due to the following rooting procedure, no warranty express or implied is given, I will not be held responsible if you mess up your device by following this procedure!
Procedure
Before you begin please make sure to read and re-read the whole procedure, making sure you understand the directions.
1. Download the "Superuser-su.zip" file and the "roth-insecure-boot-63.img" file that are attached to this post. After you have downloaded the files, extract the contents of the "Superuser-su.zip" file which contains Superuser.apk and the su binary, and move them to your ADB and Fastboot folder on your computer. Also transfer the "roth-insecure-boot-63.img" to your computer's ADB and Fastboot folder.
MD5 Checksum for "roth-insecure-boot-63.img": F8BA5C48D0323D99E2A748C77BF647F6
2. Connect your Shield to your computer using your USB cable. For maximum reliability please connect the USB cable to a USB 2.0 port directly connected to the motherboard as USB ports on the front of a case panel or USB 3.0 ports can sometimes be unreliable.
3. Now that your Shield is connected to your computer make sure that "USB debugging" is enabled under the Developer Options section in the system settings menu (If the Developer Options section is hidden, go to the About Phone/About Tablet section of the system settings and then tap on the item that lists the Build number 7 times or until it says "You are now a developer" and the Developer Options section becomes visible in the system settings).
4. Open a command prompt window (cmd) in your ADB and Fastboot folder on your computer and issue the following commands (If you are new to using ADB and Fastboot I would recommend checking out this excellent guide to get you up and running):
Code:
adb reboot bootloader
Now that you are in fastboot mode let's make sure that the computer see's our device:
Code:
fastboot devices
If the computer see's our device then we can proceed, if it doesn't see your device make sure you are in fastboot mode and have the correct ADB and Fastboot drivers installed for the Shield.
Now we will be booting an insecure boot.img (ro.secure = 0) to our device to allow us to gain root acess:
Code:
fastboot boot roth-insecure-boot-63.img
After the insecure boot.img finishes flashing the device will automatically boot up using the insecure boot.img.
5.First we need to mount the /system partition as read/write so we can modify it:
Code:
adb shell
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
exit
6. Now we need to run the following commands to push the Superuser.apk and su binary to there correct positions and set the proper file permissions:
Code:
adb push su /system/xbin
adb push Superuser.apk /system/app
adb shell
chmod 6755 /system/xbin/su
chmod 644 /system/app/Superuser.apk
mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
sync
reboot
7. After the device reboots and power on into the Android Operating System you should see Koush's Superuser app in your app-drawer and you should be rooted. If you would like to verify root access you can download and run Root Checker Basic from the Play Store here. Enjoy!
Credits: Koush for his open source Superuser.apk and the su binary (https://github.com/koush/Superuser)
If users would like me to create a 1-click root process of this please let me know and I will do so .
If you are stuck with the rooting procedures I would recommend checking out this great video tutorial by wwjoshdew.
Alternatively the following works in almost one click (one fast boot, actually): https://github.com/linux-shield/shield-root
Gnurou said:
Alternatively the following works in almost one click (one fast boot, actually): https://github.com/linux-shield/shield-root
Click to expand...
Click to collapse
It's just whole unlocking thing and giving up your devices warranty. NVIIDA being able to decline your RMA if your fan goes out and the unit overheats. Or if the scree dies (for example). I'll do it, just gotta grow a pair first.
wwjoshdew said:
It's just whole unlocking thing and giving up your devices warranty. NVIIDA being able to decline your RMA if your fan goes out and the unit overheats. Or if the scree dies (for example). I'll do it, just gotta grow a pair first.
Click to expand...
Click to collapse
I did my RMA and nvidia sent me a new 1. So you should get your new shield b4 you send it back if you happen to root it and the screen dies.
This is a pretty complicated way of rooting. All I did was unlock the bootloader, flashed Clockworkmod Recovery, and then flashed the SuperSu zip with that. Rooted! As easy as a Nexus.
dark42 said:
This is a pretty complicated way of rooting. All I did was unlock the bootloader, flashed Clockworkmod Recovery, and then flashed the SuperSu zip with that. Rooted! As easy as a Nexus.
Click to expand...
Click to collapse
I hear yeah, this procedure is meant for those that really want to understand how the basic rooting process works and who want to gain experience manually performing these types of procedures .
Sent from my SCH-I535 using xda premium
shimp208 said:
I hear yeah, this procedure is meant for those that really want to understand how the basic rooting process works and who want to gain experience manually performing these types of procedures .
Sent from my SCH-I535 using xda premium
Click to expand...
Click to collapse
This method is actually nearly the same. It's a bootable self-contained image (like recovery is) that mounts the correct partitions, installs the necessary bits, and is done.
I haven't done this yet ... but could you also provide instructions on how to revert? I ask this as it would be nice to know that there is a back-out plan.
Kris
i00 said:
I haven't done this yet ... but could you also provide instructions on how to revert? I ask this as it would be nice to know that there is a back-out plan.
Kris
Click to expand...
Click to collapse
To unroot your Shield since you are only temporarily booting an insecure boot image rather then flashing it, if you run the following commands in either ADB shell or terminal emulator will unroot your device:
Code:
$ su
# mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
# rm -f /system/app/Superuser.apk
# rm -f /system/xbin/su
# mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
Then after you have entered those commands reboot your device and you'll be unrooted.
shimp208 said:
To unroot your Shield since you are only temporarily booting an insecure boot image rather then flashing it, if you run the following commands in either ADB shell or terminal emulator will unroot your device:
Code:
$ su
# mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
# rm -f /system/app/Superuser.apk
# rm -f /system/xbin/su
# mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP /system
Then after you have entered those commands reboot your device and you'll be unrooted.
Click to expand...
Click to collapse
OK ... well lets say after rooting we install an app that uses root access to stuff up your device ... how do you restore the original image?
Kris
i00 said:
OK ... well lets say after rooting we install an app that uses root access to stuff up your device ... how do you restore the original image?
Kris
Click to expand...
Click to collapse
The original factory restore image that you can be flashed to your shield to return it to stock can be downloaded from here, along with the factory image extraction instructions (Under the open source resources section), as well as the factory image flashing instructions.
Does anyone if the root stop you from updating the device like GS4?
Simply rooting does not. I was rooted and updated. You lose root but can just reroot it like the first time. I am not sure if you have a custom recovery installed though. I haven't used one on the shield.
I am using the window 8 and I can't get the command prompt to work either directly open or open it as administrator to type the command. Any idea what I am doing wrong?
Shimp208. Can you create a video on how to unlock and root the shield?
Sent from my SHIELD using Tapatalk 2
wrc1010 said:
I am using the window 8 and I can't get the command prompt to work either directly open or open it as administrator to type the command. Any idea what I am doing wrong?
Shimp208. Can you create a video on how to unlock and root the shield?
Sent from my SHIELD using Tapatalk 2
Click to expand...
Click to collapse
When you mean you can't get the command prompt to directly open what do you mean by that? Does command prompt not open or run at all when you open it? Do you have ADB and Fastboot installed and the files listed for this procedure in your ADB and Fastboot directory? The Shield I rooted was my friends and he's on vacation right now so I unfortunately can't make a video right now , but I'll still be happy to try and help you through the procedure.
Finally success root my shield
oh god
wrc1010 said:
Finally success root my shield
Click to expand...
Click to collapse
I want that feeling soooo bad. The drivers aren't installing on my computer correctly. I can boot my shield via command but when I enter adb devices nothing shows up even though in device manager the device shows up as Nvidia Shield ADB.
Sad times, its tough as its so new everyone is still trying to figure it out and if the drivers don't install first time there aren't any problem solving threads etc
gogul1 said:
I want that feeling soooo bad. The drivers aren't installing on my computer correctly. I can boot my shield via command but when I enter adb devices nothing shows up even though in device manager the device shows up as Nvidia Shield ADB.
Sad times, its tough as its so new everyone is still trying to figure it out and if the drivers don't install first time there aren't any problem solving threads etc
Click to expand...
Click to collapse
What drivers are you trying to install and which version of Windows are you running?
Drivers
shimp208 said:
What drivers are you trying to install and which version of Windows are you running?
Click to expand...
Click to collapse
The ADB drivers and I'm running windows 7 64bit
Been trying to install them all day but I can bootload into shield but it can't pick up devices so can't root it.
gogul1 said:
The ADB drivers and I'm running windows 7 64bit
Been trying to install them all day but I can bootload into shield but it can't pick up devices so can't root it.
Click to expand...
Click to collapse
Did you try and install these drivers? Make sure to uninstall your old driver installation first.
I WROTE THE FOLLOWING WHILE TRYING TO TROUBLESHOOT/DOCUMENT MY OWN STEPS BUT I HAVE FOUND A SOLUTION. I HAVE POSTED THIS IN CASE SOMEONE ELSE MAY FIND THE INFORMATION USEFUL.
Is that appropriate? Move/delete this if you see fit.
I have an AT&T Moto X running 4.2.2 rooted with PwnMyMoto. Since it is with ATT, it has a locked bootloader.
[PROBLEM]
After putting a custom bootanimation.zip in the /system/media directory, device boots/"works" but display is black.
[HOW IT HAPPENED]
Using ES File Explorer, I turned on the /system r/w, copied the bootanimation.zip from the (internal) sdcard, and then overwrote the original boot animation (I do have a backup).
However, after booting the phone now, there is only a black screen. It seems to be working, there's just nothing displayed.
[WHAT I CAN DO/HAVE DONE]
ADB debugging has already been enabled
ADB shell has already been granted superuser permissions (Using SuperSU, unsure if solution works if this hasn't been done?)
It vibrates sometimes as though I have an email, notification, or whatever
I can access storage with usb cable,
adb get-state returns device,
I CAN get into fastboot (screen displays normally here), however PwnMyMoto overwrites recovery,
when rebooting the phone, the motorola power down animation is displayed
I tried to put back the original with
adb push bootanimation.zip /system/media
but get 'permission denied' (you may be able to use method this on a different device/carrier/ROM)
adb shell getprop ro.boot.write_protect returns 0
in adb shell
mv /sdcard/download/bootanimation.zip /system/media/ returns failed - cross-device link (googled this, seems normal, but I'm unsure how else to copy it back)
su
mount -o remount,rw /system
doesn't return anything but I am unsure where to go from there.
cannot run adb as root, as the phone is not a dev model
[RELATED POSTS]
http://forum.xda-developers.com/showthread.php?t=2249659
[HOW I FIXED IT]
start adb
ensure that 'adb shell getprop ro.boot.write_protect' returns 0 (if not, reboot into recovery)
start phone in recovery mode with
adb reboot recovery
then
adb shell
su
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount -o remount,rw /system (not sure which one of these ended up being 'correct' but it didn't hurt to do both)
cp /sdcard/download/bootanimation.zip /system/media/ (copy <src> <dest>, src is wherever the backup zip is located, if you are unsure of where the files are, use the 'ls' command to navigate the directories)
adb reboot
After doing this, the screen started displaying as normal.
Apologies for the lack of technicality, not much a dev myself. Just glad to have it working again.
help
oc83 said:
I WROTE THE FOLLOWING WHILE TRYING TO TROUBLESHOOT/DOCUMENT MY OWN STEPS BUT I HAVE FOUND A SOLUTION. I HAVE POSTED THIS IN CASE SOMEONE ELSE MAY FIND THE INFORMATION USEFUL.
Is that appropriate? Move/delete this if you see fit.
I have an AT&T Moto X running 4.2.2 rooted with PwnMyMoto. Since it is with ATT, it has a locked bootloader.
[PROBLEM]
After putting a custom bootanimation.zip in the /system/media directory, device boots/"works" but display is black.
[HOW IT HAPPENED]
Using ES File Explorer, I turned on the /system r/w, copied the bootanimation.zip from the (internal) sdcard, and then overwrote the original boot animation (I do have a backup).
However, after booting the phone now, there is only a black screen. It seems to be working, there's just nothing displayed.
[WHAT I CAN DO/HAVE DONE]
ADB debugging has already been enabled
ADB shell has already been granted superuser permissions (Using SuperSU, unsure if solution works if this hasn't been done?)
It vibrates sometimes as though I have an email, notification, or whatever
I can access storage with usb cable,
adb get-state returns device,
I CAN get into fastboot (screen displays normally here), however PwnMyMoto overwrites recovery,
when rebooting the phone, the motorola power down animation is displayed
I tried to put back the original with
adb push bootanimation.zip /system/media
but get 'permission denied' (you may be able to use method this on a different device/carrier/ROM)
adb shell getprop ro.boot.write_protect returns 0
in adb shell
mv /sdcard/download/bootanimation.zip /system/media/ returns failed - cross-device link (googled this, seems normal, but I'm unsure how else to copy it back)
su
mount -o remount,rw /system
doesn't return anything but I am unsure where to go from there.
cannot run adb as root, as the phone is not a dev model
[RELATED POSTS]
http://forum.xda-developers.com/showthread.php?t=2249659
[HOW I FIXED IT]
start adb
ensure that 'adb shell getprop ro.boot.write_protect' returns 0 (if not, reboot into recovery)
start phone in recovery mode with
adb reboot recovery
then
adb shell
su
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount -o remount,rw /system (not sure which one of these ended up being 'correct' but it didn't hurt to do both)
cp /sdcard/download/bootanimation.zip /system/media/ (copy <src> <dest>, src is wherever the backup zip is located, if you are unsure of where the files are, use the 'ls' command to navigate the directories)
adb reboot
After doing this, the screen started displaying as normal.
Apologies for the lack of technicality, not much a dev myself. Just glad to have it working again.
Click to expand...
Click to collapse
I had the same problem and i want a simple way to fix. any help?
iamgothamshero said:
I had the same problem and i want a simple way to fix. any help?
Click to expand...
Click to collapse
I wrote down the steps I took to fix it at the end of the post. You'll have to restore the old boot animation file with ADB. Hopefully, ADB shell was already given root permissions on your phone, otherwise I'd be unsure of how to fix it.
reply to u
oc83 said:
I wrote down the steps I took to fix it at the end of the post. You'll have to restore the old boot animation file with ADB. Hopefully, ADB shell was already given root permissions on your phone, otherwise I'd be unsure of how to fix it.
Click to expand...
Click to collapse
In the how i fixed it section, idk how to do those things. i have sdk manager on pc. please i am freaked out. can u give me simple instructions. Thank you so much
iamgothamshero said:
In the how i fixed it section, idk how to do those things. i have sdk manager on pc. please i am freaked out. can u give me simple instructions. Thank you so much
Click to expand...
Click to collapse
If you're unsure how to start ADB, I'd think that you've never used it before, and in that case I'd be entirely unsure if that method would work.
That said, you should find adb.exe in the sdk/platform-tools folder. If you shift+right-click this folder you can quickly open a command prompt there to start using the commands (each line in the instructions is a separate command). If you're unsure how exactly to use adb, I'm sure there are youtube videos or other forum posts documenting the basics (try searching for beginner's guide to adb on xda).
YES!!!
oc83 said:
If you're unsure how to start ADB, I'd think that you've never used it before, and in that case I'd be entirely unsure if that method would work.
That said, you should find adb.exe in the sdk/platform-tools folder. If you shift+right-click this folder you can quickly open a command prompt there to start using the commands (each line in the instructions is a separate command). If you're unsure how exactly to use adb, I'm sure there are youtube videos or other forum posts documenting the basics (try searching for beginner's guide to adb on xda).
Click to expand...
Click to collapse
I just downloaded random bootanimation zip, followed ur process, and it worked!!!!!!!!!!!!!!!!!!!!!!! omg so happy!!! thanks so much!!!!!!
---------- Post added at 11:49 PM ---------- Previous post was at 11:23 PM ----------
oc83 said:
If you're unsure how to start ADB, I'd think that you've never used it before, and in that case I'd be entirely unsure if that method would work.
That said, you should find adb.exe in the sdk/platform-tools folder. If you shift+right-click this folder you can quickly open a command prompt there to start using the commands (each line in the instructions is a separate command). If you're unsure how exactly to use adb, I'm sure there are youtube videos or other forum posts documenting the basics (try searching for beginner's guide to adb on xda).
Click to expand...
Click to collapse
It worked the first time then next reboot it shows black screen but i know it hasnt booted cause no sounds. and when i turn tablet sideways it doesnt show half of a screen. (it did that last time the screen was black).
Hi guys, I would really appreciate some help. I am able to root my gear and transfer the TWRP via odin. But when I reboot into recovery it just goes back to the stock launcher. I read this in the developer thread:
IF YOU FIND THE RECOVERY IS NOT STICKING & YOUR GEAR WIPES WHEN ATTEMPTING TO ACCESS RECOVERY AFTER FLASHING.
YOU MUST ROOT YOUR GEAR PRIOR TO INSTALLING TWRP AGIAN & RUN THE FOLLOWING COMMANDS IN ADB.
*NOTE* YOU WILL HAVE TO ACCEPT A SUPERUSER REQUEST POPUP WHEN EXECUTING "SU" COMMAND.
*NOTE 2* PROBABLY A GOOD IDEA TO RUN THIS PRIOR TO FIRST INSTALLATION, TO SAVE TIME.
Code:
$ adb shell
$ su
# mount -o rw,remount /dev/block/mmcblk0p20 /system
# rm /system/recovery-from-boot.p
IF YOU DELETE THE "RECOVERY-FROM-BOOT.P" FILE YOU MUST RELFASH TWRP RECOVERY.
I have rooted and installed roms on phone before but working in the developer tools is new to me. Can anyone explain exactly how and when to do this during the TWRP recovery install process? Or possibly just point me to a how to or youtube on basic adb commands? I have searched and it looks super complicated. Just need to know how to run these 3 commands.
THANKS!
i have the exact same issue, is there any answer for this??
Wettpassat said:
Hi guys, I would really appreciate some help. I am able to root my gear and transfer the TWRP via odin. But when I reboot into recovery it just goes back to the stock launcher. I read this in the developer thread:
IF YOU FIND THE RECOVERY IS NOT STICKING & YOUR GEAR WIPES WHEN ATTEMPTING TO ACCESS RECOVERY AFTER FLASHING.
YOU MUST ROOT YOUR GEAR PRIOR TO INSTALLING TWRP AGIAN & RUN THE FOLLOWING COMMANDS IN ADB.
*NOTE* YOU WILL HAVE TO ACCEPT A SUPERUSER REQUEST POPUP WHEN EXECUTING "SU" COMMAND.
*NOTE 2* PROBABLY A GOOD IDEA TO RUN THIS PRIOR TO FIRST INSTALLATION, TO SAVE TIME.
Code:
$ adb shell
$ su
# mount -o rw,remount /dev/block/mmcblk0p20 /system
# rm /system/recovery-from-boot.p
IF YOU DELETE THE "RECOVERY-FROM-BOOT.P" FILE YOU MUST RELFASH TWRP RECOVERY.
I have rooted and installed roms on phone before but working in the developer tools is new to me. Can anyone explain exactly how and when to do this during the TWRP recovery install process? Or possibly just point me to a how to or youtube on basic adb commands? I have searched and it looks super complicated. Just need to know how to run these 3 commands.
THANKS!
Click to expand...
Click to collapse
i have the exact same issue, is there any answer for this??
Well it's been well over a year since I did that but let's see if I can help..... Before I start I'm hoping you've already enabled adb debugging on the gear and downloaded adb onto your computer. I believe you run the commands after you've run cygnia but before you flash twrp. You run the task from a command prompt from your pc. I'm pretty sure you don't include the $ or #. Before you start try the adb command- adb devices from the command prompt on your pc. That'll let you know if the gear is connected. I remember being a bit intimidated by it all as it was different to any other flash I'd done. In reflection it's very easy, type the line in a command prompt, press enter, wait for the cursor to come up again, type the next line. As for guides..... I can't remember which one I used but there's plenty out there.
Read this whole guide before starting.
This is for the 2nd gen Fire TV Stick (tank)
Current relase: amonet-tank-v1.2.2.zip
NOTE: Recent reports indicate a change that disables brom DL-mode
The change seems to have been introduced with devices that where manufactured in December 2019 or later.
The change is unrelated to the software-version and results in the device not showing up as a USB device when shorted.
Unfortunately these devices cannot currently be unlocked.
NOTE: If you are on version 1.0, don't update to 1.2.1 through TWRP, as there is a bug.
NOTE: This issue has been fixed in version 1.2.2
NOTE: When updating from version 1.0, don't install anything else before rebooting
To update to the current release if you are already unlocked, just flash the zip in TWRP.
What you need:
A Linux installation or live-system
A micro-USB cable
Something conductive (paperclip, tweezers etc)
Something to open the stick.
NOTE: Ideally you want to update your system to 5.2.6.9 before starting this process, since this flashes the 5.2.6.8 boot.img and people have reported issues with adb-authorization with older firmware.
Since version 1.2 this isn't required, because instead of flashing the 5.2.6.9 boot.img, your existing boot.img will be patched.
It is still recommended to first update to 5.2.6.9
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
1. Extract the attached zip-file "amonet-tank-v1.2.2.zip" and open a terminal in that directory.
2. start the script:
Code:
./bootrom-step.sh
It should now say Waiting for bootrom.
Short CLK to GND (The metal shielding is also GND) according to the attached photo and plug it in.
NOTE:
In lsusb the boot-rom shows up as:
Code:
Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone
If it shows up as:
Code:
Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.
dmesg lists the correct device as:
Code:
[ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:
./fastboot-step.sh
8. Wait for the device to reboot into TWRP.
9. Use TWRP to flash custom ROM, Magisk etc.
NOTE:
Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
your device will likely not boot anymore (unless you flashed a signed image).
TWRP will patch recovery/boot-images on the fly.
NOTE:
This process does not disable OTA or does any other modifications to your system.
You will have to do that according to the other guides in this forum.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Thanks to @hwmod for doing initial investigations and providing the attached image.
Changelog
Version 1.2 (25.03.2019)
Update TWRP to twrp-9.0 sources
Implement downgrade-protection for LK/PL/TZ
Add scripts to enter fastboot/recovery in case of bootloop
Automatically restore boot-patch when you boot into recovery
Features.
Hacked fastboot mode lets you use all fastboot commands (flash etc).
Boots custom/unsigned kernel-images (need to be patched)
For the devs: sets printk.disable_uart=0 (enables debug-output over UART).
TWRP protects from accidental lk/preloader/tz downgrades
Set bootmode via preloader
NOTE: Hacked fastboot can be reached via TWRP.
NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
Use TWRP for autopatching.
There are three options for interacting with TWRP:
A mouse via USB-OTG
TWRP commandline via adb: https://twrp.me/faq/openrecoveryscript.html
Via /cache/recovery/command
Example for /cache/recovery/command:
Code:
echo "--update_package=/path/to/zipfile" > /cache/recovery/command
echo "--wipe_cache" >> /cache/recovery/command
reboot recovery
Should you somehow end in a bootloop you can boot into hacked fastboot or recovery using.
Code:
sudo ./boot-fastboot.sh
Code:
sudo ./boot-recovery.sh
NOTE:This will only work if the boot-exploit is still there.
Source Code:
https://github.com/chaosmaster/amonet
https://github.com/chaosmaster/android_bootable_recovery
how would you get to twrp after rebooting to system?
krsmit0 said:
how would you get to twrp after rebooting to system?
Click to expand...
Click to collapse
Code:
adb reboot recovery
k4y0z said:
Code:
adb reboot recovery
Click to expand...
Click to collapse
ok, made it to recovery. not sure how to navigate recovery.
krsmit0 said:
ok, made it to recovery. not sure how to navigate recovery.
Click to expand...
Click to collapse
Either via adb shell, or a mouse via USB-OTG
k4y0z said:
Either via adb shell, or a mouse via USB-OTG
Click to expand...
Click to collapse
found this, thanks, didnt know about this
https://twrp.me/faq/openrecoveryscript.html
Oh nice! I'll try it later today!
first one worked fine. second seemed to go ok but i cant get back in with adb. device unauthorized. i went through the process again to get back to recovery and i copied the adb_keys from the one that worked to the other one. permissions and ownership are the same, but it still says unauthorized. i also dont get the prompt to allow connection on the stick itself. i have connected with this stick through adb before this.
UPDATE: Factory reset didnt bring back the adb debug prompt. but an update did. I was on an older version.
krsmit0 said:
first one worked fine. second seemed to go ok but i cant get back in with adb. device unauthorized. i went through the process again to get back to recovery and i copied the adb_keys from the one that worked to the other one. permissions and ownership are the same, but it still says unauthorized. i also dont get the prompt to allow connection on the stick itself. i have connected with this stick through adb before this.
Click to expand...
Click to collapse
Mhh, what Firmware are you on?
Does it still boot normally?
Have you tried adb both over network and USB?
Can you make sure, adb is enabled in developer settings?
If that doesn't help could you try factory reset?
k4y0z said:
Either via adb shell, or a mouse via USB-OTG
Click to expand...
Click to collapse
k4y0z said:
Mhh, what Firmware are you on?
Does it still boot normally?
Have you tried adb both over network and USB?
Can you make sure, adb is enabled in developer settings?
If that doesn't help could you try factory reset?
Click to expand...
Click to collapse
it took an update to resolve it. factory reset didnt work. i was not getting the adb authorization prompt so i couldnt boot to recovery. i have it back up and running.
krsmit0 said:
it took an update to resolve it. factory reset didnt work. i was not getting the adb authorization prompt so i couldnt boot to recovery. i have it back up and running.
Click to expand...
Click to collapse
fastboot-step flashes the 5.2.6.8 boot.img, maybe that was causing an issue with older firmware.
Glad you got it solved. Now we also know updates are working fine (Allthough disabling OTA might not be the worst idea)
The photo has the points labeled but doesn't specify what gets shorted. Are you supposed to short CLK to GND?
AFTVnews.com said:
The photo has the points labeled but doesn't specify what gets shorted. Are you supposed to short CLK to GND?
Click to expand...
Click to collapse
Yes, exactly.
I have updated the OP.
Wow, nice one @k4y0z. I'm so happy this little device can now have an unlocked bootloader; it's going to open up many possibilities on a device that is so inexpensive.
My Firestick 4k bootloops
Sir i have a serious problem with my Firestick 4k. I experimented to sideload google play services on my FS 4k and it installed successfully. But when i restart my device it bootloops on and on to Firestick logo. Any solution sir? Damn i must have not do that. Please sir help me. I think i must hard reset the Firestick 4k but how?
Will the Playing with Fire pack work without any changes?
Any chance a similar exploit can be done on the 1st gen stick (montoya)?
k4y0z said:
Yes, exactly.
I have updated the OP.
Click to expand...
Click to collapse
It looks like there is a test point attached to the trace that looks like it's going to what's labeled as CLK. Is that what you can use to short, or do you have to short the thing you are pointing to?
Have you modified anything, or is this the stock stuff that the original exploit used? Are these .bin files what I would get if I were to compile everything from the github?