[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Read this whole guide before starting.

This is for the 7th gen Fire HD10 (suez).

Current version: amonet-suez-v1.1.2.zip

NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.

NOTE: This process will modify the partition-table (GPT) of your device.

NOTE: Your device will be reset to factory defaults (including internal storage) during this process.

What you need:

A Linux installation or live-system

A micro-USB cable

Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

1. Extract the attached zip-file "amonet-suez-v1.1.2.zip" and open a terminal in that directory.

NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by [MENTION=8132642]diplomatic[/MENTION] from here and place (the unpacked binary) into amonet/bin folder

2. Enable ADB in Developer Settings

3. Start the script:

sudo ./step-1.sh

Your device will now reboot into recovery and perform a factory reset.

NOTE: If you are on firmware 5.6.4.0 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)

If you chose the brick option, you don't need to run step-2.sh below:

Make sure ModemManager is disabled or uninstalled:

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

After you have confirmed the bricking by typing "YES", you will need disconnect the device and run

sudo ./bootrom-step-minimal.sh

Then plug the device back in.

It will then boot into "hacked fastboot" mode.

Then run

sudo ./fastboot-step.sh

NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"

NOTE: Make sure you re-enable ADB after Factory Reset.

4. Start the script:

sudo ./step-2.sh

The exploit will now be flashed and your device will reboot into TWRP.

You can now install Magisk from there.

Going back to stock

Extract the attached zip-file "amonet-suez-v1.1-return-to-stock.zip" into the same folder where you extracted "amonet-suez-v1.1.2.zip" and open a terminal in that directory.

You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.

Just use hacked fastboot to

fastboot flash recovery bin/recovery.img

If you want to go back completely (including restoring your GPT):

sudo ./return-to-stock.sh

Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 5.6.3.0 or newer, otherwise you may brick your device)

Important information

In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.

TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.

Very special thanks to [MENTION=9667509]xyz`[/MENTION] for making all this possible and putting up with the countless questions I have asked, helping me finish this.

Special thanks also to [MENTION=3497316]retyre[/MENTION] for porting the bootrom-exploit and for testing.

Special thanks also to [MENTION=8132642]diplomatic[/MENTION] for his wonderfull mtk-su, allowing you to unlock without opening the device.

Thanks also to [MENTION=6680544]bibikalka[/MENTION] and everyone who donated :)

Thanks to [MENTION=7617234]TheRealIntence[/MENTION] and [MENTION=2052551]b1u3m3th[/MENTION] for confirming it also works on the 64GB model.