yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
OK, I did some reference checking :D

In the update script, we see this:

package_extract_file("images/preloader.hdr0", "/dev/block/platform/mtk-msdc.0/by-name/boot0hdr0");
package_extract_file("images/preloader.bin", "/dev/block/platform/mtk-msdc.0/by-name/boot0img0");
package_extract_file("images/preloader.hdr1", "/dev/block/platform/mtk-msdc.0/by-name/boot0hdr1");
package_extract_file("images/preloader.bin", "/dev/block/platform/mtk-msdc.0/by-name/boot0img1");

Now, going back to partition info (borrowed from HD10 2017 - link), I see this:

cat /proc/partitions
major minor #blocks name

7 0 81664 loop0
...
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 1024 mmcblk0boot0
179 33 2 mmcblk0boot0p1
179 34 2 mmcblk0boot0p2
179 35 256 mmcblk0boot0p3
179 36 747 mmcblk0boot0p4

So the actual order in boot0 is : [preloader.hdr0, preloader.hdr1, preloader.bin, preloader.bin]. Then [MENTION=9667509]xyz`[/MENTION] made a version of 3 concatenated files [preloader.hdr0, preloader.hdr1, preloader.bin] and called it boot0-short.bin. One could align the 2nd copy of preloader.bin properly, and call it boot0-long.bin :D

Now, for HD8 2016 5.3.1.1 there is a 2 byte difference at x211, x221 in [preloader.hdr0. It's x26 value instead of x40 as in [MENTION=9667509]xyz`[/MENTION] version boot0-short.bin. It sounds like that had no impact on what you did, so I guess it does not matter much.
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
Good work! :good:

Now we know the structure of boot0-short.bin.

+1:)
[Fire HD 8 and HD 10 Original Android Development] teixeirap:
@#$@#$! I did the same thing .... bye bye 64GB card
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
Are we going to hear back??? What happened?

I am itching to update my hd 8 2016, but concerned about logistics. The hex screws look unusual.

I also wish we had twrp available just like hd8 2018 ...

---------- Post added at 05:01 AM ---------- Previous post was at 04:52 AM ----------

Oh, I did not wait on purpose! :D I was calculating it'd take weeks/months to discharge. And I had no time to crack it open just yet. Then I checked 2 days later, and was delighted to see it depleted. So fortunately for us, BootRom mode is not very energy efficient ! ;)
[Fire HD 8 and HD 10 Original Android Development] MontysEvilTwin:
I did get it working. Next to the point recommended to short the device and enter bootrom mode are two small surface mounted components side by side. A small sliver of metal from the case had got lodged between two of the adjacent pins of these components causing a permanent short. I managed to free it with a needle and the tablet started working again.

The rooting process worked but I did find shorting the marked point a bit hit and miss. In the end I shorted across adjacent legs of the two side by side components instead.

I now have a rooted tablet with OS 5.6.3.0 and 5.3.1.1 bootloaders and no bootloop problems to date. Like other versions of the HD8, SuperSU needs to be in grant mode (at some point I will copy over the xml file from an Fire 7 listing the apps with grant permissions to allow me to switch to prompt mode).

Some practical points. The right sized flat-bladed screwdriver easily removes the hex screws. One of the speaker cables is very short. I avoided desoldering by rotating the board by 90°, taping it down to the back of the tablet and flipping it over to access the rear of the board. I would not be comfortable personally drilling the shield by hand; it should OK if you have a drill mounted on a stand so that you can precisely control the height of the drill bit.
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
Great!!!:highfive:

This is also what I use to unscrew them. ( 1.35 mm )
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
Yep - that's my fear too! One thing I was thinking about is just making a hole with a needle, once the metal thins by the drill bit. Another option is to wrap some tape around the drill bit immediately past its tip (like a bit stopper - for height control). So when a hole is through, the bit does not sink into it with its entire length. Anyway, one of these days I am gonna try! ;)
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
I'd be extremely cautious with these drill bit ideas. Besides the obvious dangers, drilling will also cause lots of tiny metal shavings, which can short random components, as MontysEvilTwin already found out.
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
[MENTION=9733510]0mr1[/MENTION], [MENTION=7839832]MontysEvilTwin[/MENTION]

It looks like I totally scratched my hacking itch with the refurb HD8 2018 I bought for $45 from Amazon Warehouse :D It's a far more convenient hacking device with an unlocked bootloader, working TWRP, Android 7.1.2, Magisk, etc. This package is really hard to beat!

Playing with the 2018 version made me realize that my main user of HD8 2016 absolutely does not care about root/Xposed/etc. So I decided not to risk any physical and software damage now by going through with the BootRom activation.

Perhaps, over time there'd a way to enter BootRom in an easier fashion ... Or at least, a working TWRP would become available after all the hassle with the hole drilling, etc.

Anyway, thanks for your heroic pioneering efforts on HD8 2016 !!!
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
You're right, with the HD 8 (2018) you have more without risking to damage it. :)
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
It seems that diplomatic has found a method to software-root the HD 8/ 10

https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
[MENTION=9733510]0mr1[/MENTION], [MENTION=7839832]MontysEvilTwin[/MENTION] - it looks like you guys were a bit too ahead of your time :D In hindsight, it's a good thing I waited :D

I rooted HD8 2016 using the above new method by [MENTION=8132642]diplomatic[/MENTION]. See this report - link

It so easy!
[Fire HD 8 and HD 10 Original Android Development] 0mr1:
When I saw the post of diplomatic, I immediately thought of you and that you were right not to hurry to drill;)
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Ok so I have the tablet open. Now where can I find the tp28 chip?
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
Probably want to just snap the cover back on and go here: https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Unfortunately, I cannot use this method. My tablet won't connect via ADB because of the brick. If I can just have someone tell me where the chip is I can get to it. Please can someone help me? Thank you.
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
It is not under a plate, there's 4 screws you have to remove and flip the board over, it's on the back.

It sounds like you don't have the developer options turned on though.
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Ah, I see. I reread the directions and realized this. I'm sorry. So, can I not do this method because I don't have ADB enabled?
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
You need ADB enabled for this method too, so you're better off using the other method.

If you don't have the developer options already enabled, so to Settings -> Device Options -> keep tapping Serial Number until the developer options are enabled.

Then go into Developer Options and turn on "Enable ADB" .
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
How can I enable Adb while the tablet is bricked? Is there a way?
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
Oh you didn't say it was bricked.

Well give this method a try then. Maybe I'm wrong about having to enable ADB before starting this.

To answer your question about how to find TP28: you have to disconnect the touch screen connector first, which is that square pad with the QR code on it. From the perspective of your picture, there's a connector to the left of it. Disconnect that, then peel it up (there's something like two-sided tape under it).

Then there are 4 screws (I think 4) holding the circuit board down.

Also remove the black tape, which is holing the connector for the camera. You can undo that connector and the camera just comes right out.

Then you can peel up the circuit board. The battery and LCD connectors are still connected at the bottom, so be careful. There is two-sided tape down the left and right, so focus there. Peel it up so it pivots at the battery and LCD connectors. You don't need to pull the board right out. The TP28 pad is on the back near the top.

I used a paper clip that's coated in plastic and I just peeled off a bit of the plastic on either end and shaped it so I could touch TP28 and the big grounding pad next to it. I held the tablet standing up so I could push the board forward and get the paper clip in behind. I held the paper clip and the tablet with one hand, and plugged in the USB cable with the other.
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Ok, So I've successfully located TP28 (thanks to your wonderful directions) and I'm ready to connect it to the PC. I hope this works. :fingers-crossed:

Well, it appears I'm out of luck. Might as well as throw the device away. I can't get a signal from the tablet and therefore cannot proceed with this method. I've heard that you can use the test points and short those out to get a connection but I don't know if it's worth the hassle. Oh well, thank you for this method anyways!
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
So what did you try? You're supposed to short TP28 to ground while you plug it in. Is that what you did?
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Dude, I'm all over the place at the moment. Didn't know what I was doing but now I do. But, yeah no I did not do it right. I will give it another go (this time doing it right) and see what happens. It's been a long few weeks. :p
[Fire HD 8 and HD 10 Original Android Development] Datastream33:
Redid the process and shorted the TP28 to the ground while I plugged it in. Nothing. Nothing happened. No, signal from the PC that something was plugged in... no response at all. When I run the script it just says It cannot find the module named 'serial'.
[Fire HD 8 and HD 10 Original Android Development] cybersaga:
You need to install some prerequisites still. See my post here: https://xdaforums.com/showpost.php?p=78864228&postcount=31

I put a couple apt-get commands that will remove and install stuff you need.

Then you run the script (the 'amonet' one). When it tells you to, short TP28 then plug in the USB cable. If all is well, the script will proceed and tell you when to remove the short.

You can follow my post if you want to give yourself root at this point, but at least flash the stock boot and system partitions if nothing else.

Then run the other script (the 'amonet-res' one) and follow the same steps with shorting TP28 again.
[Fire HD 8 and HD 10 Original Android Development] CarthyMcDan:
I have a Fire HD8 2016 and bricked it. I opened it but cannot find TP28. On the board nor underneath. Is it possible to revive it?

Greetings
[Fire HD 8 and HD 10 Original Android Development] MaxPowerOne:
I have a hd 8 7th gen fire tablet, after a restore it boots into sytem but does not log/update cause I've messed with OTA apps before. What can I do? I'm on 5.3.6.4 now I want to save the tablet and if possible still be able to root. If you could provide some guided help it would save the tab that is k.o. now stuck on language selection and wi-fi setup intro. I can enter recovery.
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Sideload the latest update.bin and root it using [MENTION=8132642]diplomatic[/MENTION]'s software ROOT.
[Fire HD 8 and HD 10 Original Android Development] MaxPowerOne:
Do I have to sideload with ADB? Do i need drivers (i've installed the ones in the adb+drivers package)? I've tried briefly last night but my prompt command did not accept adb as a command, I guess I'm not using adb correctly. I'm going to try fix it tonight!!
[Fire HD 8 and HD 10 Original Android Development] MaxPowerOne:
Thanks for the help, I have restored the tab successfully! I'm now on 5.6.4.0 fire os, can I root? Can I disable the lockscreen ads in a clean way? No roms out there right? It's such a bad os, the tab would be decent on itself.
[Fire HD 8 and HD 10 Original Android Development] DB126:
Tons of information in this forum; best do your homework.

https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595

https://xdaforums.com/hd8-hd10/orig-development/unlock-fire-hd-10-2017-suez-t3913639
[Fire HD 8 and HD 10 Original Android Development] TheLoonyRebel:
Great news is I have unbricked my HD8 2017. Bad news is now I can't get the thing to detect any taps or anything on the screen. Any ideas on how to fix this? Thanks in advance.

Edit: Working now. Apparently I wasn't hitting the right spot to get past the "welcome" screen. Now just waiting for the battery to get to 100% then will update and use the experimental root solution to get myself rooted.
[Fire HD 8 and HD 10 Original Android Development] tek3195:
Hi, I don't know if it's just inexperience or my own density but I feel like a dog chasing my own tale looking for a way to unlock the bootloader. What I'm not understanding is what is stopping us from flashing what we want once it is unlocked with 8th gen exploit. why does it require recovering from being unlocked? Everything I've read points to HD10 or back to this thread. Or, at least that's what it seems like. I've tried porting recovery and using dd to push it to recovery partition with expected results of a hard brick. Next attempt left me with installed apps but no way to install any additional apps. PM was non-existent even through adb install and had no recovery for a reset but adb shell still worked. No fastboot so recovered via adb shell using dd of .img files I had copied to sdcard previously. It's not a lack of effort on my part I just seem to be missing something on the unlocking. I just don't understand it. A little insight please?
[Fire HD 8 and HD 10 Original Android Development] masterpost2004:
Hi guys .. I am totally new here and please I need your help!

I followed the procedures at the beginning of the thread but I didn't success! when I type "sudo ./bootrom-step.sh" I get the following error message:

"sudo ./bootrom-step.sh: command not found"

can anybody help please? I think the problem is with setting up amonet.

I'm using Ubuntu 18.1 64bit from osboxes.org and I run it on VMware Worksation.
[Fire HD 8 and HD 10 Original Android Development] nujak:
Did you run the command from the location of the amonet scripts? You will have to navigate to the folder you extracted amonet.tar.gz to before you can run the command.
[Fire HD 8 and HD 10 Original Android Development] masterpost2004:
I clicked right-click on the amonet folder and selected terminal then started to use the commands.

Is there any procedure that I should follow or any other files that i need to download and install before I start using amonet?
[Fire HD 8 and HD 10 Original Android Development] nujak:
I'm sorry, but I'm still not sure whether or not you extracted the contents of amonet.tar.gz from OP. If not, open terminal at the download location of amonet.tar.gz and type:

tar -xzf amonet.tar.gz

This will give you a new folder called amonet containing everything you need. You can then cd to the folder or just open terminal from the folder in the file explorer.

If you already did this, double check the path in terminal and see if the files are showing by using the ls command. You should have an amonet folder containing 4 folders (bin, broom-payload, LK-payload, modules) and 2 files (bootrom-step.sh and fastboot-step.sh).

If all the files are there you can try to chmod 755 bootrom-step.sh and run without sudo:

chmod 755 bootrom-step.sh
./bootrom-step.sh
[Fire HD 8 and HD 10 Original Android Development] masterpost2004:
Thanks nujak

Yes I was the right location when I typed the commands. With help from t0x1cSH the issue has been sorted! I used "chmod +x bootrom-step.sh" and everything is fine now :)

btw is there an easier way to short TP28 to ground? I mean without the need to remove the screws?
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
No.
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
Dear Friends

after i flash system-a.img and boot.img that given in this thread i got bootloope i try to use boot from ota last version but nothing is happen can any one help me??
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Can you boot to fireos recovery? If yes, flash last FW available and then, root with MTK-SU.

Regards!
[Fire HD 8 and HD 10 Original Android Development] Viral_Weaponry:
it worked

after a very long time without signing in here I just signed in to say thank you very much. Your draft is amazing and it worked for me, I was able to recover my tablet from the shape of a beautiful brick.

in case you are interested in my terminal logs, see here: unable to post links... pm me if you would like the link to be sent via pm

Again, thank you very much for sharing your knowledge. Greatly appreciated!
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
thank you my friend i just put the battery slot right and now working thank you very much
[Fire HD 8 and HD 10 Original Android Development] skirfan:
HELP ME

I broke my tab Fire hd 8 and in india no store is interested to repair mine:crying::crying::crying::crying:. Saw this post and wanted to try I am facing some problems HELP ME.

1.how to short see these pics and try to explain me please ibb.co/k5s0y79

ibb.co/nrWKv6h

2 found TP28 at last but how to short to ground whereis that big pad near TP28. I cant understand:confused::confused:

3.Should i connect the battery during these steps

Make sure that you are trying to explain ME(15 yrs). please i want to try. and why did they lock fastboot. Thank you. HELP ME :confused::confused::confused::confused:
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
battery must be disconnected
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Add this to first post. Will be useful for a lot of people.
[Fire HD 8 and HD 10 Original Android Development] skirfan:
Again help me

Keep getting error of init crtpto engine even after uninstalling modem manager. :confused:

It Solved by stopping modem manager
[Fire HD 8 and HD 10 Original Android Development] skirfan:
Usb keeps connectig and disconnecting

after running bootrom script in amonent res folder the usb startrd to connect and disconnect. the id of the device is changed too.

See pics i have attached

https://ibb.co/HTKLxHd

https://ibb.co/SQmMHQf

I cannot do a usb pass through to flash system and boot image. please help me:confused::confused:

The connection is only held for 2 secs
[Fire HD 8 and HD 10 Original Android Development] skirfan:
Last step Please help

I have installed preloader and vcom drivers but when I try to do a usb pass through to vmbox it say the device can't be attached see pics posted on my previous comment. The last step to flash system and boot IMG to boot my device and iam stuck. Tomorrow I have holiday so give me a advice I will definitely try. I accept that I don't know anything about these developer things because I am still a student. Still I came this far please it's last step help.:crying:
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Try doing the process in a Live USB.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Run bootrom.sh with sudo:

sudo ./bootrom.sh
[Fire HD 8 and HD 10 Original Android Development] WreckItRalphie:
Cheers

Argh rookie mistake

That worked :)

Thanks for the help
[Fire HD 8 and HD 10 Original Android Development] ferralis:
troubles booting

ok so I followed the guide for the kingoroot and somehow screwed up my tablet. Upon boot it was stuck on the fire logo forever.

so I attempted to sideload what I thought was the correct .bin file, but after turning it off after the boot, all I've got is a screen that doesn't appear to turn on.

unfortunately this method doesn't seem to be working, maybe i'm doing something wrong?

So I'll just go through my steps.

a. download hd8autoimg.zip via https://xdaforums.com/hd8-hd10/orig...brick-root-t3897841/post78868608#post78868608

b. run

sudo ./autoimg.sh update-kindle-50.6.2.6_user_626533320.bin supersu

b_1. (this creates boot.img and system.img)

1. unplug tablet

2. pop tablet internals out from back hard shell via pry tool

3. unscrew 4 screw on the top edge of the board

4. pop out camera module (lift up on the silver connector its attached to)

5. use pry tool to remove touch connector (has qr code on it) it will easily pop out of its holder

6. remove battery connector by pulling up on it with pry tool

7. now only the display connector (next to the battery) should be connected

8. connect one end of usb into the board

9. in folder that i unzipped hd8autoimg.zip

cd armonet
sudo ./bootrom-step.sh

10. short TP28 with one hand, plug in usb with the other

11. hopefully prompted to remove short and press enter, otherwise unplug usb and retry 9-10

12. at this point i don't really see anything on the screen or whatever, I assume that's ok? (somewhat confused by step7)

13.

cd ../
sudo fastboot flash boot boot.img
sudo fastboot flash system system.img

14. wait

15. unplug usb to computer

16.

cd armonet-res
sudo ./bootrom-step.sh

17. short TP28 with one hand, plug in usb with the other

18. hopefully prompted to remove short and press enter, otherwise unplug usb and retry 16-17

18. wait until its done?

19. screen is still off

20. plug battery back in

21. try to turn on -- hear a sound (maybe sounds like out of battery sound? not sure, but I tried charging it for 30 minutes and nothing happened) and screen continues to stay blank

22. not sure now what to do, I've tried 3 times I'm wondering if I'm missing a step or something

any ideas for things for me to try?
[Fire HD 8 and HD 10 Original Android Development] M.rom:
i tried everything but i'm always stuck at [B]waiting for bootrom[/B]
[Fire HD 8 and HD 10 Original Android Development] M.rom:
it's work for me finally
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
There was errors during the process?
[Fire HD 8 and HD 10 Original Android Development] ferralis:
None, it went similar to the posted stdout in the initial post.

It's possible I broke something when I opened it up and shorted it i guess... but other than that I have

no idea what I could have done wrong! :(
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
I'm sorry but it looks like a hardware error. Recheck that all is in his correct place. If it's stills like this, connect the tablet in the computer, type lsusb and post the output.
[Fire HD 8 and HD 10 Original Android Development] hagemegane:
Hi,

my fire hd 8(2018) was updated to 6.3.1.2, but i wanted to downgrade to 6.3.0.1.

So i sent 6.3.0.1 firmware to fire hd 8 via "apply update from ADB" in recovery mode(long press pwr button with vol down button), then completely hard bricked...

Can i unbrick by this post's method?
[Fire HD 8 and HD 10 Original Android Development] t0x1cSH:
you should refer to https://xdaforums.com/hd8-hd10/orig-development/fire-hd-8-2018-downgrade-unlock-root-t3894256
[Fire HD 8 and HD 10 Original Android Development] hagemegane:
oh, i posted to this thread by mistake!

sorry.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Yikes...I hope you get your tablet recovered, but I just wanted to say that that answers my question from another thread. So downgrading via recovery is not an option. I guess the hardware method is the only way to root this firmware now...
[Fire HD 8 and HD 10 Original Android Development] AmznUser444 Dev:
Wipe it all data and cache first before downgrade.