yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Nevermind. I think it's just 'cause I hadn't installed SuperSU from the store yet.
[Fire HD 8 and HD 10 Original Android Development] x410x:
[MENTION=9325417]t0x1cSH[/MENTION] [MENTION=9294334]cybersaga[/MENTION] Thank both of you, was able to root all 3 of the hd8's i have. Now to hope for custom roms at some point!
[Fire HD 8 and HD 10 Original Android Development] JJ2017:
Yes, I used the download 5.6.3.0.bin from Amazon but some reason it's 5.6.3.4 on the tablet(?!). They both say 626533320 by them so I'm assuming same thing.

Anyway, looking through your later posts seems like you got it sorted anyway.

Nice write up #31 (https://xdaforums.com/showpost.php?p=78864228&postcount=31)- very clear :good:
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
I have created a script automating the process of extracting, creating a modified system.img and getting boot.img.

Setup a Ubuntu VM (if you need to)

@cybersaga:

1. Download the archive containing everything you need (Software wise obv)

I have also provided amonet and supersu along with an OTA file (5.6.3.0).

Google Drive to hd8autoimg.zip

and extract it. It contains all you need to generate the images you need. You may use other OTA Archives too.

2. Run

sudo ./autoimg.sh <OTA-Archive> <supersu folder>

or if you dont want to change anything:

sudo ./autoimg.sh update-kindle-50.6.2.6_user_626533320.bin supersu

Dont write paths. Put the files (if you want to use other files) in the same folder and use the fileneame and run the same command.

The script extracts the ota archive, and copies boot.img and system.img to its directory and modifies system.img, as explained by @cybersaga in his post.

It then turns it to a system image file.

Once the script finishes, you will have :

a new folder named ota. This is where the OTA-Archive is extracted to. All files here are original and serve as a backup. the system.img here is generated by sdat2img.py.

(modified) system.img

boot.img

If you encounter any errors, post them here.
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Nice work! This is exactly what I was going to do once I got a few free moments to go through the process. You beat me to it lol!
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
Feel free to modify it. It is very rudimentary, as I don't know any bash script.
[Fire HD 8 and HD 10 Original Android Development] klister:
So I'm running through the scripts in preparation and I was able to install all but "android-tools-fstools" getting the error "E: Unable to locate package android-tools-fstools".

Of course though, moving on through, when running the script that SirausKen provided (and running from Ubuntu desktop), it runs most of the way through... I get an "ota" folder and "ota.zip". But then right after:

"inflating: ota/META-INF/CERT.RSA"

"########## Creating system.img##########"

I get the following error:

"./autoimg.sh: line 29: python: command not found"

Ideas?
[Fire HD 8 and HD 10 Original Android Development] AccountForXDA:
Hi, sorry if a really obvious question. Any tips for exposing the back of the circuit board? It feels like it requires more force than I want to use to lift it up, and also lifting it up looks like it might interfere with the camera, or the pull on the wires on the right side of the board? I've removed the four screws at the top and I couldnt see any others.
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
Ah, yes. It appears I forgot to put the python script sdat2img.py from the original post. Just put that in the same folder as everything else. I'll fix the archive now.

It it currently uploading. I'll post when done.
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
Archive is fixed. Same link applies
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Just four screws yes. You have to undo the touch screen ribbon top and center. It's connected to this square thing that's glued down (kind of like double-sided tape under). Disconnect that connector and flip that square piece up out of the way.

And yes, disconnect the camera too. There's black tape over the connector. Take off the tape and the connector pops right up and you can put the camera aside.

Then the board will come up. There's glue down both short sides, so concentrate your pulling there. Just make sure that when it does finally give out, you don't damage the ribbon still connected at the bottom.

I used a paper clip that's coated in plastic. I bent it straight, then in half and cut away some of the plastic from the tips. I bent it so that the tips were the perfect distance apart for what I need.

I stood the tablet straight up and pushed the board away from the screen and used the paper clip in behind there. I could hold the paper clip in place and keep the tablet up with one hand while I plugged it in with my other.
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
I removed the camera to make sure I didn't break it, then you have to put quite a bit of force to get the glue to release. The patch of glue is on the side with them camera, and yes it will make you nervous putting that much pressure on the board.

Try to pull it evenly and slowly
[Fire HD 8 and HD 10 Original Android Development] AccountForXDA:
Thanks all. Took a while, but the device is now rootedt. I found the hardmod root guide for HD8 2017 had some good instructions for taking it apart as well as the replies above. When taking the back cover off, make sure to take out any sdcard first. I snapped my sdcard clean in half by accident somehow because i forgot it was in there. Fortunately the slot still works after bending it back.
[Fire HD 8 and HD 10 Original Android Development] samuel6827:
Should the chip be shorted with kindle off then plug in usb ?
[Fire HD 8 and HD 10 Original Android Development] AccountForXDA:
Yeah kindle off, short then plug in USB. Dont reassemble and turn on until after the final step
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
Yes. See the steps for the gen 8 exploit:

(Taken from Fire HD 8 (2018 ONLY) unbrick, downgrade, unlock & root
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
Has anyone attempted to install xposed or twrp?
[Fire HD 8 and HD 10 Original Android Development] samuel6827:
Keep getting this error when runnung although modemanager is uninstalled

ubuntu@ubuntu:~/Desktop/amonet$ sudo ./bootrom-step.sh

Traceback (most recent call last):

File "main.py", line 3, in <module>

from common import Device

File "/home/ubuntu/Desktop/amonet/modules/common.py", line 6, in <module>

import serial

ModuleNotFoundError: No module named 'serial'
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Install "python3-serial".
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Ok, FINALLY got it working!

It should go without saying... make sure you have a good USB cable lol

I'm looking for a good place to host the patched system.img and I'll upload it to hopefully make everyone's life a little easier
[Fire HD 8 and HD 10 Original Android Development] klister:
Rooted now! I left a wire in place so I won't have to lift the board again. In my previous attempts I had to resolder the speaker wires a couple times so I should be able to avoid that now.
[Fire HD 8 and HD 10 Original Android Development] samuel6827:
Super su installed binaries updated but apps dont detect root

Update: Appearently for apps to detect root you gotta set Default access in settings to grant
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Yep, I had the exact same problem.
[Fire HD 8 and HD 10 Original Android Development] Gwenm:
Got the root working with your method! Thank you so much! Now I have a naive question: it seems that at step 7, we could flash whatever we would want: is it possible to flash there some TWRP?
[Fire HD 8 and HD 10 Original Android Development] James Bottomtooth III:
Is it safe to do this?
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Provided they used an insulated wire and routed it out of the way, sure why not?

this is actually got me considering wiring a tiny momentary contact button to TP28 and ground and mounting it in one of the kinda empty areas inside the tablet with a pin hole to access it. Then I could ground the test pin without even opening the tablet up... that is, provided the hack still works with the battery connected, which I don't know and haven't tried yet.
[Fire HD 8 and HD 10 Original Android Development] klister:
Sorry guys, I'll take a pic next time I open it. Basically due to previous experience having to resolder the speaker leads, I used blue masking tape (eh, it works) to mask the area around TP28 and used a spot of solder past to solder an insulated wire to that test point. Then I routed it around the corner by the camera (which I just leave connected to the board since it lifts out with it) and have a length of about 1.5 inches with about 1/8 inch stripped (and tinned) from the end that by hand I can simply contact the metal shielding with. I used more tape to isolate the stripped end and then a tiny amount more to hold it down and out of the way of anything else standing off the board. Next time I do this I won't have to lift the board, just remove the tape and contact the metal shielding (ground).
[Fire HD 8 and HD 10 Original Android Development] Nightmare-Rex420:
what versions has this been tested on should i update/partalyupdate? (on 6.3.0.0) before going or just stay?
[Fire HD 8 and HD 10 Original Android Development] klister:
This particular thread relates to the 2017 model HD8 (douglas) which I don't think has any updates to 6.3.0.0. Team, correct me if I'm wrong on that. The origin of this thread goes back to the OP for this exploit on the 2018 model (karnak) found here:

https://xdaforums.com/hd8-hd10/orig-development/fire-hd-8-2018-downgrade-unlock-root-t3894256
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Whatever version you're on, you'll have to overwrite anyway. I just downloaded the latest update from Amazon's site to use for this.
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Ditto! I was a few versions back due to blocking the OTA not long after I bought the tablet and was able to flash the latest update without issue. Upgraded and didn't even lose any data :)
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
Just to inform you that I successfully rooted my HD 8 (2016) running OS 5.6.3.0

Many thanks:good:
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Here's the rooted system.img and the matching boot.img for it

https://www.androidfilehost.com/?fid=1395089523397891100
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
I am not sure from the guide now many times boot.img has to be flashed from fastboot. It seems like three times? Is the same boot.img file used each time?
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
Only once, when you flash system
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Only once.

It's the boot.img from the OTA update (unmodified)

So, a synopsis would be:

(This is NOT a full guide, not by a long shot... just a synopsis of the process I did in order to clarify the full process in the OP.)

Download OTA, unpack it, mount the system.img, patch etc... or just use one I already patched: https://www.androidfilehost.com/?fid...89523397891100

Run bootrom-step.sh in the amonet folder

Do the short when you're supposed to, undo when you're supposed to...

Flash the boot.img then the system.img via fastboot

Run bootrom-step.sh in the amonet-res folder

Boot to rooted FireOS

Profit

...Probably have to update SuperSU and switch it to default of "grant" since "prompt" doesn't seem to be working all the time
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
So, im attempting this root now. I took off the back cover on my tablet. Im struggling with the touchscreen connector on the top center. how do I remove this ribbon cable?

Update: Neevermind. I realised the latch is on the black part of the connector on the board.

---------- Post added at 12:57 PM ---------- Previous post was at 12:01 PM ----------

When I run amonet, it stops while flashing tz...

it ramps up to some number then stops.
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
can you post the output?
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
There is none. No error message or anything.

just

[2019-02-13 14:38:34.640312] Flash tz
[random number/6732]

after i use KeyboardInterrupt:

^CTraceback (most recent call last):
File "main.py", line 125, in <module>
main()
File "main.py", line 107, in flash_binary
flash_binary(dev, "../bin/tz.bin", gpt["teel"][1] + 0x200)
File "main.py", line 27 in, flash_binary
dev.emmc_write(start_block + x, data[x * 0x200:(x + 1) * 0x200])
File "/home/<user>/Working/root/amonet/modules/common.py", line 193, in emmc_write
self.dev.write(p32_be(idx))
File "usr/lib/python3.7/site-packages/serial/serialposix.py", line 556 in write
abort, ready, _ = select.select([self.pipe_abort_write_r], [delf.fd], [], None)
KeyboardInterrupt

Update: after is stopped at Flash lk this time, I tried ctrl-z and resume... now Im flashing system.img after boot.img....
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
can you provide the entire ./bootrom-step.sh output

have you uninstalled modemManager?

is the behaviour always the same when you running ./bootrom-step.sh ?
[Fire HD 8 and HD 10 Original Android Development] SirausKen:
ModemManager is uninstalled. I am using Arch linux.

Using Ctrl-z and the fg%1, seems to have fixed the issue?????

im downloading supersu from play store rn.

UPDATE: I can confirm root!

If anyone has a problem where one of the counters on amonet suddenly stops, press Ctrl-Z and then run fg%1
[Fire HD 8 and HD 10 Original Android Development] hacker-on:
All scripts works fine without any errors , but as result tablet boot in same system as before flash :(

P.S. Also now touch screen not work :( probably I damage it :( Any advice? :(
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
How are you checking for root? The system should be the same, just with the addition of supersu.

As for your touchscreen issue, when you flipped the main board over, did you unplug the touchscreen ribbon? Maybe by accident? Make sure it's plugged in properly, seated and the little black latch is down. Disconnect and reconnect it if necessary
[Fire HD 8 and HD 10 Original Android Development] hacker-on:
1. After full flash I boot in rom with all same apps and data (like nothing happened) :) I thought my tablet would be empty after the system.img full firmware

2. You was right, broke Fixing part of the plug, fixed in another way - thanks for advice.
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Glad you got it figured out
[Fire HD 8 and HD 10 Original Android Development] hacker-on:
but no root :(
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Did you install SuperSU from the Play Store?

This hack will install the su binary on there, but nothing can use it yet until you install SuperSU from the store.
[Fire HD 8 and HD 10 Original Android Development] hacker-on:
Yes, SuperSu Installed but all rootCheckers show "No" or just stuck on checking process.

So idea is "after flash system.img and boot.img I got same system without data erase and with root" ?

Again, my flow:

1. Load in fastboot via amonet

2. Flash rooted system.img (from 1 message) and boot.img

3. use /amonet-res/bootrom-step.sh

4. Boot manual and see old system as before flash without root.
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
If you do "adb shell" from your computer and then try to run "su", what happens?
[Fire HD 8 and HD 10 Original Android Development] ElPeWe:
Hi,

i used this method to root my Fire HD8 (7th gen.) but i am not able to get to recovery.

Tried flashing recovery.img from revert-stock.zip but get an error:

FAILED (remote: size too large)

Any ideas?

Thanks alot.
[Fire HD 8 and HD 10 Original Android Development] hacker-on:
adb shell

su

- empty prompt and nothing happened

-----

Hey, headed topic and found that need to change Default access in SuperSu to "Grand" and all works fine after that, RootChecker says "Rooted". Thanks!
[Fire HD 8 and HD 10 Original Android Development] AccountForXDA:
On a rooted tablet, what is the best way to remove the amazon bloat? I kept mine at 5.4.0.0 previously so I could use adb shell to pm uninstall stuff. Is this still the best and easiest way? Can bloat now be fully removed to free up space, instead of just uninstalling for the current user?
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
my advice is to refer to https://xdaforums.com/hd8-hd10/general/updated-amazon-app-bloatware-tracking-t3823624 as a starter point

i've tried to uninstall most of the amazon stuff, but the tablet can start acting weirdly, so be careful and dont go too far from the spreadsheet

also you can follow https://xdaforums.com/hd8-hd10/general/steps-2017-fire-hd-10-owner-root-t3872063 for stuff like changing the default launcher

if you decide to change the default launcher, install your launcher, make it a system app with link2SD(https://www.apkmirror.com/apk/bulen...4-release/link2sd-4-3-4-android-apk-download/), then, in adb shell or on a terminal on the device, do

su
pm disable com.amazon.firelauncher
pm disable com.amazon.paladin
[Fire HD 8 and HD 10 Original Android Development] samuel6827:
Anyone ever tried replacing SuperSU with magisk ?
[Fire HD 8 and HD 10 Original Android Development] k4b4l:
I have a dumb question: In which state should the kindle be before I start the procedure? Switched off, fastboot mode, switched on and booted??

Second question regarding the two connection points...the red point is the TP28..thats clear. But is the red circle the ground or should I use another point? Please help....and thank you!
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
The kindle must be switched off and yes the red circle is ok (ground).
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
I am preparing to root a Fire HD8, 6th generation but I have a question. The second phase involves running 'amonet-res' to install the correct bootloaders. So in the 'bin' folder of 'amonet-res' I need to replace the TZ and LK files with one's from the correct OTA bin file. There is also a file 'boot0-short.bin' in that folder. How do I obtain this file?
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
Correct:good:

This is the preloader file from the OTA bin file. But I had to modify it with an hex editor to comply with the structure of the boot0-short.bin.

I have a copy of it on my laptop, I can post it later if you want.
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
Posting it would be great thanks. Instructions would be good too: I was planning to use bootloader files from version 5.3.1.1 as this would enable that version to be sideloaded from ADB if necessary: an insurance policy as that version is rootable with Kingoroot.

Another question, the TZ file from the OTA is an 'img' file. I know from installing bootloaders on the Fire 7 (5th gen.) that the extension can be renamed to '.bin' but is this enough? I found on the Fire 7 (5th gen.) that using a renamed 'TZ.img' file caused the Wi-Fi to stop working.
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
Yes, just renaming to '.bin' is enough.

I don't have problem with the WiFi (OS version 5.6.3.0)
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
When I was testing for the HD8 (2016), in the second stage (when you have to reflash the preloader,tz and lk) I just renamed the preloader.bin (that I extracted from the OTA update.bin) to boot0-short.bin and I bricked my device.

So I compared the OTA's preloader.bin to the xwz's boot0-short.bin with an hex editor and I remarked that the first 1000 blocks were different so I copied the first 1000 blocks from xwz's boot0-short.bin and added them to the OTA's preloader.bin, renamed it to boot0-short.bin and flashed it along with tz.img from OTA (renamed to tz.bin) and lk.bin from OTA. And that worked.

I attached the boot0-short.bin for HD 8 (2016) OS 5.6.3.0 and 0S 5.3.1.1

Note that I tested the 5.6.3.0 but not the 5.3.1.1 (but I suppose that it should be ok).
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
Thanks, I am interested to see if the device is OK on OS 5.6.3.0 with 5.3.1.1 bootloaders. The Fire 7 (5th gen) on OS 5.6.3.0 bootloops with an older LK flashed, but this is a different device so who knows?
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
Had a bit of bad luck. I carefully cut a hole in the shielding to access the point to short: I did not cause any physical damage to the board or components. I ran the bootrom-step script which then failed. It seems that in shorting the terminal something must have blown.:( The device is now permanently in bootrom mode (shows up as a Mediatek 'phone' when running 'lsusb') and refuses to boot up. Presumably this can't be fixed.

I have ordered a tablet with a broken screen off eBay for its motherboard but am anxious about trying this again in case the same thing happens.
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
At which step bootroom-step is failing ? Is it giving you an error message ?

Have you done the bootrom-step with the battery connected ? if so, could you retry with the battery disconnected ?

What dmesg is showing ? A log could be helpful to determine the problem.
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
Fire 7 2015 is a bit of a fluke. I think 5.3.1.1 bootloaders should work fine with the newer FireOS for this device.

Btw, my plan to root is minimalistic. Drill a hole to enable bootrom, clear out rpmb, downgrade LK/TZ/preloader to 5.3.1.1. That's all the bootrom access i need.

Then I will sideload full 5.3.1.1, Kingoroot it, and same strategy as Fire HD10 for everything else. I don't want to mess with su and system image just yet for pre-rooting purposes. That's way too many operations for my taste.

I had this with an unopened Fire 7. Got stuck in bootrom, waited it out for 2 days till battery depleted, and then I was back in business when the Fire finally shut down and left BootRom! And did not have to open it at all ...

---------- Post added at 06:31 AM ---------- Previous post was at 05:58 AM ----------

The ages of this FireOs (lollipop) and SuperSu are well matched. :D

There is absolutely no point in messing with magisk - it'll create more complexity than needed.

---------- Post added at 06:40 AM ---------- Previous post was at 06:31 AM ----------

Perhaps those 1000 blocks are that header file that's present in the Rom bins?
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
I'm kind of impatient so when this kind of problem happens, I always opt for the open/disconnect method:D

xwz's bootshort-0.bin first 1000 bytes are composed of 2 quasi-identical blocks of 800 bytes. These two blocks begin each with the sequence 45 4D 4D 43 5F 42 4F 4F 54 (which translates to EMMC BOOT in ANSI) followed essentially by 00 and FF.

After these 1000 bytes, you find the sequence 4D 4D 4D 01 38 00 00 00 46 49 4C 45 5F 49 4E 46 (which translates to MMM.8...FILE_INF in ANSI) and is the same sequence that you find at the beginning of the preloader.bin of the OTA update.bin

Note:

(1) I'm speaking in hexadecimal here so that 800*2=1000 (or 2048*2=4096 in decimal ).

(2) I said quasi-indentical because there is only 4 bytes of difference between the two blocks of 800 bytes.