[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
Tested only on 2017 hd8

This post is outdated please refer to: https://xdaforums.com/hd8-hd10/orig-development/unlock-fire-hd-8-2017-douglas-t3962846

1 - Open your fire hd 8 7th gen, now you need to access the pads under the board(be very careful there is a lot of glue), specifically we need the pad TP28 which is the clk signal of the emmc

2 - Get yourself a wire (I recommend one with only one conductor in the plastic shroud) or something conductive

3 - Now on a linux machine/vm (if you use a vm, do usb passthrough) go in the amonet folder and do:

sudo ./bootrom-step.sh

4 - When you see:

[2019-02-07 14:35:59.478924] Waiting for bootrom

short TP28 to ground (there is a big pad near TP28, its ground so you can use it) and plug the usb

5 - If the operation is successful you should be prompted to remove the short and press enter

6 - Wait until the script end if it's succesfull you will see:

[2019-02-07 12:11:05.621357] Reboot to unlocked fastboot

in case of any error probably you should start again from step 4

7 - now the device should reboot and go automatically in fastboot mode (if not, try unplug and plug back the usb), you can reflash any partition ex:

sudo fastboot flash <partition-name> <image-file.img>

The boot partition need to be flashed on the device in order to recover from the first part of the guide so:

sudo fastboot flash boot boot.img

You can extract boot.img from the ota archive

Becouse there is no system partition check on th 7th gen you can flash a modified system.img (a rooted one)

i will link the ota where i've extracted the .img (sorry i can't upload mine becouse my up speed is trash, 512kbit/s)

8 - Now, again on al linux machine/vm go in the folder amonet-res and run again:

sudo ./bootrom-step.sh

the steps are the same as from 3 to 6

9 - your table should reboot into FireOS

Recover from flashing the 8th gen exploit

in step 7, when you get into fastboot mode do:

sudo fastboot flash boot boot.img

with the boot.img from an ota then proceed with the other step

Ready to flash rooted system

Instead of make your own modified system image, you can flash this (thanks to [MENTION=7982409]JJ2017[/MENTION]) https://mega.nz/#F!G7pn3SCS!TWhEmzSFNctoil626IbF3A

download both boot and system from the mega link then, once you get in the fastboot mode in step 7, run from the directory where the downloaded system.img and boot.img are:

sudo fastboot flash system system.img
sudo fastboot flash boot boot.img

This method require you to install the SuperSu app (download an apk from a site like APKmirror)

Make your own system.img

Download this : https://raw.githubusercontent.com/xpirt/sdat2img/master/sdat2img.py

(assuming debian or ubuntu distro) install android-tools-fsutils

1 - get yourself an ota archive

2 - extract it

3 - put sdat2img.py in the same directory as the extracted ota

4 - do

python2 sdat2img.py system.transfer.list system.new.dat system.img

5 - now do

mkdir system && sudo mount system.img system

6 - now you can modify the image and for example install SuperSU (Install SuperSu on system.img section of the thread)

7 - unmount the image

8 - do

img2simg system.img system-a.img

9 - in fastboot mode do:

sudo fastboot flash system system-a.img
sudo fastboot flash boot boot.img

run the commands in the same folder as the .img

Install SuperSu on system.img

Coming soon. for now you can refer to Building the system image section of this post (thanks to [MENTION=9294334]cybersaga[/MENTION]) https://xdaforums.com/showpost.php?p=78864228&postcount=31

Or try this script for creating a rooted system.img (thanks to [MENTION=6439148]SirausKen[/MENTION]) https://xdaforums.com/showpost.php?p=78868608&postcount=39

My terminal output while i'm flashing rooted system.img

https://pastebin.com/hn2Rhk87

Thanks

- xyz' for the amonet exploit chain

- <br > for the emmc pinout

- xpirt for sdat2img