[Fire HD 6 and 7 Android Development] bibikalka:
Update [Nov 23, 2016] :

powerpoint45 made a separate thread, so please use his method first from this link. Notice that in FireOS 5.3.1 this functionality has been disabled, so nothing happens as people try to read/write memory :(

Update [Sep 27, 2016] :

Thanks to the great effort by powerpoint45, there is now a custom Linux image specifically created to run AFTV2 tools (here). It will even recognize which addresses you have, so no need to upload any binary blocks anymore! Please use it! Also note that a couple of Fire bricks turned out to be unrecoverable, it seems impossible to read/write the memory, so no luck :( If you have one of these, please post and explain how you managed to brick it so much.

Update [Sep 16, 2016] :

Thanks to the fantastic effort by powerpoint45 to read UART logs on a bricked FIRE, we now know why downgrades produce dark screen bricks! It looks like the new FireOS 5 bootloaders check the version in eFUSE, and if it's newer than the current, they refuse to boot. Please see this link for details. This is very similar to the issues found on Fire 2015, see this link.

Update [Aug 14, 2016] :

The instructions have been extensively cleaned up for more general use. The unbricking was finally successful for the classic "wrong/older bootloader" (black screen) type of Fire HD bricking (thanks to [MENTION=7487709]n3roxda333[/MENTION] for persisting with his brick !!!). Thus the procedure is fully tested to be used by anybody for pretty much any type of recovery. Yey !!! Again, what this means is that even the black screen bricks can be successfully brought back to life.

Unfortunately, the procedure is somewhat fragile, so you may have to work through various challenges. The key software required : Python 3 (with the pyserial module - "pip install pyserial"), and AFTV2-Tools. If you are on Windows 8/10, make sure to get the proper signed Win 8&10 MediaTek USB VCOM drivers in order to set up the communication between your PC and Fire as quickly as possible. For other OSes, see the posts from [MENTION=3411776]zeroepoch[/MENTION] and [MENTION=4381075]hwmod[/MENTION]. Very recently, [MENTION=4469251]powerpoint45[/MENTION] has put together an excellent iso with Linux that already has all the necessary software included (see this link, and don't forget to click "Thanks!").

Once you establish communication with the device (a.k.a. "handshake"), it's important to establish that the read_mmc procedure is stable, and does not hang. If it hangs, you'll have to find another computer that is stable :( There seems to be no other way around this instability issue at the moment. Please see a couple of other key posts on how to get AFTV2 tools working, first from the author of the AFTV2 tools himself - [MENTION=3411776]zeroepoch[/MENTION] (link), and then [MENTION=4381075]hwmod[/MENTION] who used this method to unbrick Fire 2015 (link).

Instructions.

1. Setup Python 3, download the required AFTV2 tools, install the preloader drivers (if needed), and establish the handshake with the device (this is the generic part of the procedure, independent of the specific Amazon device, use the posts by [MENTION=4381075]hwmod[/MENTION] (link) and [MENTION=3411776]zeroepoch[/MENTION] (link) to understand and fix any issues so that you can handshake successfully):

C:\extra\android\kindle_root\aftv2-tools>handshake.py
Waiting for preloader...

[COLOR="Red"](now plug in fully turned off Fire HD, it'll get turned on by the USB power, and I already had preloader drivers from the prior bricked
Fire HD, so handshake completed just fine). If the device is in the weird state, plug it in, and hold the Power button. At some point it'll start rebooting, and the preloader should handshake if you got all the other prerequisites taken care of[/COLOR]

Found port = COM8
Handshake complete!

Note that under Linux sometimes USB ports stop working (when they worked before!), see this link on how to fix such a condition (and click "Thanks!").

2. On each 2014 Fire HD the partitions we need to write into have unique offsets relative to 0x0. So before writing anything it's necessary to figure out what this unique offset is. A way to do is to read a bunch of blocks, and then determine in a hex editor which are meaningful. This allows to determine the correct unique offset. Run the following read commands to get the data blocks, zip all of the *part files, and post it here. In this step you will also find out if your setup is stable. If the read commands hang, that is a bad sign, you will need another computer (or perhaps a different OS on the same hardware, as in dual boot Linux on a Windows machine)

read_mmc.py 0x0000000 0x1000 0x0000000.part
read_mmc.py 0x0080000 0x1000 0x0080000.part
read_mmc.py 0x0100000 0x1000 0x0100000.part
read_mmc.py 0x0180000 0x1000 0x0180000.part
read_mmc.py 0x0200000 0x1000 0x0200000.part
read_mmc.py 0x0280000 0x1000 0x0280000.part
read_mmc.py 0x0300000 0x1000 0x0300000.part
read_mmc.py 0x0380000 0x1000 0x0380000.part
read_mmc.py 0x0400000 0x1000 0x0400000.part
read_mmc.py 0x0480000 0x1000 0x0480000.part
read_mmc.py 0x0500000 0x1000 0x0500000.part
read_mmc.py 0x0580000 0x1000 0x0580000.part
read_mmc.py 0x0600000 0x1000 0x0600000.part
read_mmc.py 0x0680000 0x1000 0x0680000.part
read_mmc.py 0x0700000 0x1000 0x0700000.part
read_mmc.py 0x0780000 0x1000 0x0780000.part
read_mmc.py 0x0800000 0x1000 0x0800000.part
read_mmc.py 0x0880000 0x1000 0x0880000.part
read_mmc.py 0x0900000 0x1000 0x0900000.part
read_mmc.py 0x0980000 0x1000 0x0980000.part
read_mmc.py 0x0a00000 0x1000 0x0a00000.part
read_mmc.py 0x0a80000 0x1000 0x0a80000.part
read_mmc.py 0x0b00000 0x1000 0x0b00000.part
read_mmc.py 0x0b80000 0x1000 0x0b80000.part
read_mmc.py 0x0c00000 0x1000 0x0c00000.part
read_mmc.py 0x0c80000 0x1000 0x0c80000.part
read_mmc.py 0x0d00000 0x1000 0x0d00000.part
read_mmc.py 0x0d80000 0x1000 0x0d80000.part
read_mmc.py 0x0e00000 0x1000 0x0e00000.part
read_mmc.py 0x0e80000 0x1000 0x0e80000.part
read_mmc.py 0x0f00000 0x1000 0x0f00000.part
read_mmc.py 0x0f80000 0x1000 0x0f80000.part
read_mmc.py 0x1000000 0x1000 0x1000000.part
read_mmc.py 0x1080000 0x1000 0x1080000.part
read_mmc.py 0x1100000 0x1000 0x1100000.part
read_mmc.py 0x1180000 0x1000 0x1180000.part
read_mmc.py 0x1200000 0x1000 0x1200000.part
read_mmc.py 0x1280000 0x1000 0x1280000.part
read_mmc.py 0x1300000 0x1000 0x1300000.part
read_mmc.py 0x1380000 0x1000 0x1380000.part
read_mmc.py 0x1400000 0x1000 0x1400000.part
read_mmc.py 0x1480000 0x1000 0x1480000.part
read_mmc.py 0x1500000 0x1000 0x1500000.part
read_mmc.py 0x1580000 0x1000 0x1580000.part
read_mmc.py 0x1600000 0x1000 0x1600000.part
read_mmc.py 0x1680000 0x1000 0x1680000.part
read_mmc.py 0x1700000 0x1000 0x1700000.part
read_mmc.py 0x1780000 0x1000 0x1780000.part
read_mmc.py 0x1800000 0x1000 0x1800000.part
read_mmc.py 0x1880000 0x1000 0x1880000.part
read_mmc.py 0x1900000 0x1000 0x1900000.part
read_mmc.py 0x1980000 0x1000 0x1980000.part
read_mmc.py 0x1a00000 0x1000 0x1a00000.part
read_mmc.py 0x1a80000 0x1000 0x1a80000.part
read_mmc.py 0x1b00000 0x1000 0x1b00000.part
read_mmc.py 0x1b80000 0x1000 0x1b80000.part
read_mmc.py 0x1c00000 0x1000 0x1c00000.part
read_mmc.py 0x1c80000 0x1000 0x1c80000.part
read_mmc.py 0x1d00000 0x1000 0x1d00000.part
read_mmc.py 0x1d80000 0x1000 0x1d80000.part
read_mmc.py 0x1e00000 0x1000 0x1e00000.part
read_mmc.py 0x1e80000 0x1000 0x1e80000.part
read_mmc.py 0x1f00000 0x1000 0x1f00000.part
read_mmc.py 0x1f80000 0x1000 0x1f80000.part
read_mmc.py 0x2000000 0x1000 0x2000000.part
read_mmc.py 0x2080000 0x1000 0x2080000.part
read_mmc.py 0x2100000 0x1000 0x2100000.part
read_mmc.py 0x2180000 0x1000 0x2180000.part
read_mmc.py 0x2200000 0x1000 0x2200000.part
read_mmc.py 0x2280000 0x1000 0x2280000.part
read_mmc.py 0x2300000 0x1000 0x2300000.part
read_mmc.py 0x2380000 0x1000 0x2380000.part
read_mmc.py 0x2400000 0x1000 0x2400000.part
read_mmc.py 0x2480000 0x1000 0x2480000.part
read_mmc.py 0x2500000 0x1000 0x2500000.part
read_mmc.py 0x2580000 0x1000 0x2580000.part
read_mmc.py 0x2600000 0x1000 0x2600000.part
read_mmc.py 0x2680000 0x1000 0x2680000.part
read_mmc.py 0x2700000 0x1000 0x2700000.part
read_mmc.py 0x2780000 0x1000 0x2780000.part
read_mmc.py 0x2800000 0x1000 0x2800000.part
read_mmc.py 0x2880000 0x1000 0x2880000.part
read_mmc.py 0x2900000 0x1000 0x2900000.part
read_mmc.py 0x2980000 0x1000 0x2980000.part
read_mmc.py 0x2a00000 0x1000 0x2a00000.part
read_mmc.py 0x2a80000 0x1000 0x2a80000.part
read_mmc.py 0x2b00000 0x1000 0x2b00000.part
read_mmc.py 0x2b80000 0x1000 0x2b80000.part
read_mmc.py 0x2c00000 0x1000 0x2c00000.part
read_mmc.py 0x2c80000 0x1000 0x2c80000.part
read_mmc.py 0x0400000 0x4000 0x00a.part
read_mmc.py 0x0408000 0x4000 0xPRO_INFOa.part
read_mmc.py 0x0500000 0x4000 0xPMTa.part
read_mmc.py 0x0900000 0x1000 0xTEE1a.part
read_mmc.py 0x1300000 0x1000 0xUBOOTa.part
read_mmc.py 0x0780000 0x4000 0x00b.part
read_mmc.py 0x0788000 0x4000 0xPRO_INFOb.part
read_mmc.py 0x0880000 0x4000 0xPMTb.part
read_mmc.py 0x0c80000 0x1000 0xTEE1b.part
read_mmc.py 0x1680000 0x1000 0xUBOOTb.part
read_mmc.py 0x0a00000 0x4000 0x00c.part
read_mmc.py 0x0a08000 0x4000 0xPRO_INFOc.part
read_mmc.py 0x0b00000 0x4000 0xPMTc.part
read_mmc.py 0x0f00000 0x1000 0xTEE1c.part
read_mmc.py 0x1900000 0x1000 0xUBOOTc.part

If you are skilled with binary editors, you can examine these *.part files using Appendix 1 as a reference, and if you find a match for LK partition, choose the respective option in Appendix 1.

3. After the correct addresses have been figured out, use the supplied addresses to read the partition headers, and save these just in case (before you do the reading again in Step 5 !!!). The read commands will be provided to you once you upload the zip file. Here is an example of what this will look like :

[strike]
read_mmc.py 0x0400000 0x4000 00.part
read_mmc.py 0x0408000 0x4000 PRO_INFO.part
read_mmc.py 0x0500000 0x4000 PMT.part
read_mmc.py 0x0900000 0x4000 TEE1.part
read_mmc.py 0x0e00000 0x4000 TEE2.part
read_mmc.py 0x1300000 0x4000 UBOOT.part
read_mmc.py 0x1380000 0x4000 boot.part
read_mmc.py 0x1b80000 0x4000 recovery.part
read_mmc.py 0x2380000 0x4000 KB.part
read_mmc.py 0x2480000 0x4000 DKB.part
read_mmc.py 0x2580000 0x4000 MISC.part
read_mmc.py 0x2600000 0x4000 persisbackup.part
read_mmc.py 0x3600000 0x4000 system.part
read_mmc.py 0x4e600000 0x4000 cache.part
read_mmc.py 0x85600000 0x4000 userdata.part
[/strike]

4. Download 453_padded_img.zip from below and unpack. These are zero padded 4.5.3 bootloaders + TWRP. I had to pad them with zeroes since AFTV2 tools will discard the last chunk of the file if it's not in blocks of 256 bytes (?).

To restore 4.5.3 bootloaders & TWRP, you will run commands similar to the ones below (will take from 30-40 minutes to 5-6 hours in total). Again, do note that your addresses will be different, so do not use the commands below as is, before getting the unique offset for your Fire HD which will be provided after you post the zip file from Step 2 !!! If you try to figure out these addresses yourself, and do it incorrectly, you may permanently brick, and this time without ANY recovery

[strike]write_mmc.py 0x0900000 453p_tee1.img
write_mmc.py 0x1300000 453p_uboot.img
write_mmc.py 0x1b80000 453p_twrp.img[/strike]

(if you are getting this message "...Already done", you need to delete lastaddr.txt file in the aftv2-tools folder, thanks to [MENTION=5728225]Kramar111[/MENTION] for pointing this out !!! )

5. Repeat the read commands from Step 3, save the outputs (again, using your unique addresses provided to you in this thread !). Make sure you are not overwriting the outputs from Step 3.

6. Send the command to disconnect, and hopefully the device will reboot. Hold the "Vol+" button to get into TWRP. Then either flash the proper bootloaders in TWRP (to make whatever ROM you already have installed bootable again), or replace the entire ROM as per these instructions (link). If you choose the wrong bootloaders again, you will have to repeat Step 4 to get TWRP back (!!!)

C:\extra\android\kindle_root\aftv2-tools>read32.py 0 1
1: 0xd1
4: 0x00 0x00 0x00 0x00
4: 0x00 0x00 0x00 0x01
[COLOR="Red"]
(and the device turns off here, and will reboot)[/COLOR]

7. Once you reboot to TWRP, proceed to the post discussing how to install rooted FireOS via TWRP:

http://xdaforums.com/fire-hd/general/how-to-upgrade-to-lollipop-root-gapps-t3163950

Appendix 1

These are currently known addresses (so if you are skilled, you can try to use a HEX editor to figure out if your UBOOT (LK) partition matches any of these). In general, LK is the easiest to identify. If not, post the blocks in the forum, and the addresses will be supplied to you. Remember, your addresses could end up being different from the choices provided below !!!

Option A. LK @ 0x1300000

Reading the partitions for quality control :

read_mmc.py 0x0400000 0x4000 00.part
read_mmc.py 0x0408000 0x4000 PRO_INFO.part
read_mmc.py 0x0500000 0x4000 PMT.part
read_mmc.py 0x0900000 0x4000 TEE1.part
read_mmc.py 0x0e00000 0x4000 TEE2.part
read_mmc.py 0x1300000 0x4000 UBOOT.part
read_mmc.py 0x1380000 0x4000 boot.part
read_mmc.py 0x1b80000 0x4000 recovery.part
read_mmc.py 0x2380000 0x4000 KB.part
read_mmc.py 0x2480000 0x4000 DKB.part
read_mmc.py 0x2580000 0x4000 MISC.part
read_mmc.py 0x2600000 0x4000 persisbackup.part

And writing TWRP & related :

write_mmc.py 0x0900000 453p_tee1.img
write_mmc.py 0x1300000 453p_uboot.img
write_mmc.py 0x1b80000 453p_twrp.img

Option B. LK @ 0x1680000

Reading the partitions for quality control :

read_mmc.py 0x0780000 0x4000 00.part
read_mmc.py 0x0788000 0x4000 PRO_INFO.part
read_mmc.py 0x0880000 0x4000 PMT.part
read_mmc.py 0x0c80000 0x4000 TEE1.part
read_mmc.py 0x1180000 0x4000 TEE2.part
read_mmc.py 0x1680000 0x4000 UBOOT.part
read_mmc.py 0x1700000 0x4000 boot.part
read_mmc.py 0x1f00000 0x4000 recovery.part
read_mmc.py 0x2700000 0x4000 KB.part
read_mmc.py 0x2800000 0x4000 DKB.part
read_mmc.py 0x2900000 0x4000 MISC.part
read_mmc.py 0x2980000 0x4000 persisbackup.part

And writing TWRP & related :

write_mmc.py 0x0c80000 453p_tee1.img
write_mmc.py 0x1680000 453p_uboot.img
write_mmc.py 0x1f00000 453p_twrp.img

Option C. LK @ 0x1900000

Reading the partitions for quality control :

read_mmc.py 0x0a00000 0x4000 00.part
read_mmc.py 0x0a08000 0x4000 PRO_INFO.part
read_mmc.py 0x0b00000 0x4000 PMT.part
read_mmc.py 0x0f00000 0x4000 TEE1.part
read_mmc.py 0x1400000 0x4000 TEE2.part
read_mmc.py 0x1900000 0x4000 UBOOT.part
read_mmc.py 0x1980000 0x4000 boot.part
read_mmc.py 0x2180000 0x4000 recovery.part
read_mmc.py 0x2980000 0x4000 KB.part
read_mmc.py 0x2a80000 0x4000 DKB.part
read_mmc.py 0x2b80000 0x4000 MISC.part
read_mmc.py 0x2c00000 0x4000 persisbackup.part

And writing TWRP & related :

write_mmc.py 0x0f00000 453p_tee1.img
write_mmc.py 0x1900000 453p_uboot.img
write_mmc.py 0x2180000 453p_twrp.img

Other stuff of interest:

On Fire 2015, one could get UART logs from a bricked Fire via the following instructions (by connecting a FT232RL USB-to-TTL-Serial adapter to a 5-pin micro USB plug). Unfortunately, this procedure does not work on Fire HD 2014.

http://xdaforums.com/showpost.php?p=65585385&postcount=16

http://xdaforums.com/showpost.php?p=65587440&postcount=17

http://xdaforums.com/showpost.php?p=65588189&postcount=18

Here is a sample log from my AFTV2 tools trials on my Fire HD (Windows XP, Python 3.4). And your addresses will be different, so don't write anything just yet (my comments below are in red) :

C:\extra\android\kindle_root\aftv2-tools>python -m pip install pyserial==3.0.1

(the latest 3.1.1 pyserial would not work under WinXP)

C:\extra\android\kindle_root\aftv2-tools>handshake.py

Waiting for preloader...

(now plug in fully turned off Fire HD, it'll get turned on by the USB power, and I already had preloader drivers from the prior bricked Fire HD, so handshake completed just fine)

Found port = COM8

Handshake complete!

C:\extra\android\kindle_root\aftv2-tools>read_mmc.py 0x1400000 0x1000 tee2.part

Addr: 0x1400000

Addr: 0x1400200

Addr: 0x1400400

Addr: 0x1400600

Addr: 0x1400800

Addr: 0x1400a00

Addr: 0x1400c00

Addr: 0x1400e00

C:\extra\android\kindle_root\aftv2-tools>write_mmc.py 0x1400000 tee2.part

Addr: 0x1400000

Addr: 0x1400200

Addr: 0x1400400

Addr: 0x1400600

Addr: 0x1400800

Addr: 0x1400a00

Addr: 0x1400c00

Addr: 0x1400e00

C:\extra\android\kindle_root\aftv2-tools>write_mmc.py 0x1400000 tee2.part

Addr: 0x1400000

...Already done

Addr: 0x1400200

...Already done

Addr: 0x1400400

...Already done

Addr: 0x1400600

...Already done

Addr: 0x1400800

...Already done

Addr: 0x1400a00

...Already done

Addr: 0x1400c00

...Already done

Addr: 0x1400e00

...Already done

(if you are getting this message "...Already done", you need to delete lastaddr.txt file in the aftv2-tools folder, thanks to [MENTION=5728225]Kramar111[/MENTION] for pointing this out !!! )

C:\extra\android\kindle_root\aftv2-tools>read32.py 0 1

1: 0xd1

4: 0x00 0x00 0x00 0x00

4: 0x00 0x00 0x00 0x01

(and the device turns off here, and will reboot)

I've also poked around, and found the Fire HD preloader sitting in /dev/block/mmcblk0boot0 (see the attached file). It does not seem to have any ANTI-ROLLBACK strings, but still bricks. It's definitely smaller than the version from Fire 2015, but the beginning of it looks similar. There is also another partition, /dev/block/mmcblk0boot1, which seems to contain all the key data for the device.

[MENTION=5702881]moroxoro[/MENTION], [MENTION=7070888]notorious.dds[/MENTION], [MENTION=5737824]CJD14[/MENTION], [MENTION=6058831]DoLooper[/MENTION], [MENTION=6782156]Gimzie[/MENTION], [MENTION=5515628]kirito9[/MENTION], [MENTION=4267571]sd_shadow[/MENTION], [MENTION=7399392]Drevenu[/MENTION], [MENTION=7158360]kyle12345109876[/MENTION], [MENTION=5728225]Kramar111[/MENTION], [MENTION=3411776]zeroepoch[/MENTION], [MENTION=4381075]hwmod[/MENTION]