yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
zero seconds if your tablet was properly rooted to being with which yours is not

unroot the device either though superSU's settings

or

go back to stock and start again

this process will not work with root solutions other then superSU or magisk *

*if you already have root you do not need to use the mtk-su binary remove it from the folder

and rtfm
[Fire HD 8 and HD 10 Original Android Development] aleks79:
I have exactly the same issue. mount command didn't run successfully, so su command isn't available.
[Fire HD 8 and HD 10 Original Android Development] emanresu2:
OK I followed this and thought my kindle fire hd 10 was broken, but it magically started working after probably 100 tries or so. I get mmc read errors, serial errors, and more. But it just worked on one of the tries.

I had to use the non-minimal shell script and it worked. If anyone is facing troubles, I suggest to try that before even thinking of opening your device. Try with different USB cables and different ports on ur PC.
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
I unrooted with superSU

---------- Post added at 10:14 PM ---------- Previous post was at 10:07 PM ----------

Does anyone have a script or something to make sure and completely unroot my device, I have re loaded stock rom after unrooting and still have the same issue, if I run it without mtk-su it ask for me to input it.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Can you mount it manually? Go into /data/local/tmp then do:

./mtk-su

umount /system/xbin

./busybox mount minisu.img /system/xbin

What happens when you run those? You might need to do losetup -d /dev/block/loop0 at some point to remove the old loopback device.
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
Where would data/local/tmp be at?
[Fire HD 8 and HD 10 Original Android Development] DB126:
^^^

Please don't post/paste lengthy logs and for gawd sakes don't quote a wall of text. Anything langer than a screen or two on a mid-range phone should go in an attachment.
[Fire HD 8 and HD 10 Original Android Development] aleks79:
Yes, it worked! Thank you!

Have next chalenge (

# ./bootrom-step-minimal.sh

[2019-05-04 22:37:55.284644] Waiting for bootrom

[2019-05-04 22:38:11.074070] Found port = /dev/ttyACM3

[2019-05-04 22:38:11.074346] Handshake

Traceback (most recent call last):

....

File "/home/semen/Downloads/amonet/amonet/modules/common.py", line 98, in _writeb

return self.dev.read()

...

raise SerialException('device reports readiness to read but returned no data (device disconnected?)')

serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected?)
[Fire HD 8 and HD 10 Original Android Development] mhardyman:
Magisk asking to update.. Is it safe?
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Hang on, you still need to do the Android part, step 1, the one that bricks it. But as a quick test, can you see if plain su works in adb shell? If not, what is the output of echo $PATH

?
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
Im the one who posted this issue and I'm having difficulty understanding how to run the commands you suggested. Can you please explain to me dumbed down.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
[MENTION=9667536]nikothebarber[/MENTION], you run those commands after opening adb shell and doing cd /data/local/tmp . That wasn't a solution. I'm just trying to get to the bottom of the problem. (No offense, but I think [MENTION=9907101]aleks79[/MENTION] can help me quicker with that.) If you can get into the shell, can you tell me the output of echo $PATH and whether entering su opens a root shell?
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
nikothebarber@ubuntu:~$ sudo -i
[sudo] password for nikothebarber:
root@ubuntu:~# echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

nikothebarber@ubuntu:~$ su
Password:
su: Authentication failure
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
[MENTION=9667536]nikothebarber[/MENTION], I'm asking about PATH from the tablet. You need to log in to adb shell first. Have you tried the mounting commands I listed?
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
not sure how to do log in adb shell? sudo -l -i

or what Im not sure what to do, if you could send me exact code to copy paste
[Fire HD 8 and HD 10 Original Android Development] aleks79:
Already did this step successfully. Have black screen after step-1. Tried different ports and usb cables, no luck yet.

lsusb sees it.

---------- Post added at 12:56 PM ---------- Previous post was at 12:50 PM ----------

It started to work for me right after I did your commands manually (minisu was mounted). It didn't work previously when I tried to mount it to temp dir either. The only difference that I see is that I tried to mount it with mtk-su -c "blahblahblah" instead of firing it directly)

./mtk-su umount /system/xbin

./busybox mount minisu.img /system/xbin
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Yes. Download only, then reboot to TWRP and flash manually.
[Fire HD 8 and HD 10 Original Android Development] freealta:
I made the mistake of selecting the "recommended" option displayed from magisk, boot loop after update. Went back into TWRP and flashed the previous version 18.1, then download 19.1 and flashed via twrp.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Please make sure ModemManager is disabled or uninstalled (I have just added a note to the OP):

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

[MENTION=8132642]diplomatic[/MENTION]

Did something change in the handling of mtk-su -c <command>?

[MENTION=9667536]nikothebarber[/MENTION]

Can you try using an older release of mtk-su?
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
Yes if you can lead me to a download?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Check out the attachments in the mtk-su thread.
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
Yeah no luck with hay I tried three earlier versions
[Fire HD 8 and HD 10 Original Android Development] aleks79:
Tried it and it's hanging in Handshake step without any further progress.

lsusb shows it as MediaTek Inc. MT6227 phone
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Try pressing the power button for 20+ seconds to make sure it is powered off.

Then start the script and plug it in.
[Fire HD 8 and HD 10 Original Android Development] aleks79:
Thank you so much for your patience, but looks like I'm very lucky on every step )

Completed this step and do see Hacked fastboot mode on the screen but have no progress now on <waiting for device> in fastboot-step.sh

dmesg shows me

[17611.407186] usb 1-3: Product: Android

[17611.407188] usb 1-3: Manufacturer: Amazon

[17611.407190] usb 1-3: SerialNumber: G000NP059134052E

with lsusb

Bus 001 Device 038: ID 1949:0280 Lab126, Inc.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Are you running fastboot-step with sudo?

Also try powering it off and back on then plug it back in. (It should start in hacked fastboot mode)
[Fire HD 8 and HD 10 Original Android Development] aleks79:
yes, running with sudo

Package: android-tools-fastboot

Source: android-tools

Version: 4.2.2+git20130529-5.1

fastboot devices doesn't show my anything
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
That's strange, since dmesg/lsusb seem to indicate it being properly detected.

You can try using the current fastboot from here.
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
can someone connect to my computer and try see if they are able to do anything?

Perhaps with Teleconsole?
[Fire HD 8 and HD 10 Original Android Development] aleks79:
Thank you so much one more time. Yes, I upgraded fastboot and already installed Magisk!
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
lucky
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Nope. :)

If it's not just a weird coincidence, it could be something about their Linux environment. Like something different about the shell or shell commands, or adb itself. But in any case, I think your get_root() function that calls mtk-su could be more robust. For example, before calling the mount command, call umount. And don't make it an infinite loop (have a max number of tries). A couple miscellaneous suggestions: in the line adb shell su -c id | grep uid=0\(root\), you could instead check the output of 'id -u' for "0" directly (no need for grep, which could be another possible point of failure). And those quotes are not needed around the mtk-su command. It never supported them. (I still suggest you go with temporary su/daemonsu instead of mounting an image. ;) )
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I had the same issue. I had been using both because of an older Amazon tablet 8.9. the -i function works to call it to fastboot if recovery is broked.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
With your tablet connected to PC, can you run:

adb shell

Then inside the shell do:

cd /data/local/tmp

./mtk-su

umount /system/xbin

./busybox mount minisu.img /system/xbin

If that succeeds, continue with step-1.sh
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
She11 returns with asking for device authorization and to check my device but I dont have any pop ups and its connected as I can access it in file manager
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Then try sudo adb shell
[Fire HD 8 and HD 10 Original Android Development] shiyon:
passed "Check GPT" of "bootrom-step.sh". takes two days.

I was writing impulsively. Thank you.

USB cable was a new, the gold plating was stripped off.:o
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
same thing
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I'm still stuck. I can't get the tablet to do anything unless I run the bootrom-step-minimal.sh. anything else, regardless of the battery trick that got me this far, I get either "expected data but got something else" or "can't read emmc". The tablet does persist bootrom after the handshake though, regardless if the script completes or not.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Well, you managed to get it somehow when you did the script.....

Try 'sudo adb kill-server' and start over
[Fire HD 8 and HD 10 Original Android Development] jobrien2001:
Hello,

I am a little confused in the instructions and need some guidance.

I have successfully executed in 3 "sudo ./fastboot-step.sh" and the tablet rebooted into TWRP.

However in 4 says i should run step-2.sh and THAT should place me in TWRP... but I was already there at step 3!

Moreover, when i run step-2.sh. it prompts me "Found "_x" suffix, it looks like you are rerunning step-2.sh and asks me if i wish to continue.

Should i proceed to running step-2.sh?

I aborted and waiting for feedback to continue.

Thanks.
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
So I went over to windows and did root with the automatic .bat that was made for mtk-su I have root again, now back on ubuntu , i just got shell to run from amonet location.

---------- Post added at 02:23 PM ---------- Previous post was at 02:15 PM ----------

so back to it not loading the locations to run script because permissions.

Bricking preloader
/system/bin/sh: can't create /sys/block/mmcblk0boot0/force_ro": Permission denied
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
I wonder why [MENTION=9907101]aleks79[/MENTION] was able to run the mount command from inside mtk-su shell, but couldn't do it using mtk-su -c.

I will take your suggestions into consideration for the next update.

No idea why bootrom-minimal would work but bootrom-step wouldnt.

The only difference is, that bootrom-minimal skips flashing TZ and LK, because it assumes that has been done in step-1.sh.

What "battery-trick" exactly are you referring to?

Just leaving the battery disconnected should work?

You said you were able to get an amazon-logo.

You could try modifying the scripts to flash an amazon-stock-recovery and see if you can flash stock from there.

Depending on weather a downgrade is necessary you run either bootrom-step-minimal.sh + fastboot-step.sh or you continue with step-2.sh.

The only thing doing the bootrom-procedure doesn't do is writing the backup-GPT.

You could run step-2.sh to fix that.
[Fire HD 8 and HD 10 Original Android Development] jobrien2001:
Thank you. I want t offer some feedback for people downgrading from 5.6.0.4 following the procedure.

After running "sudo ./step-1.sh" my device was bricked and "sudo ./bootrom-step-minimal.sh" was not successful recognizing the device.

I had to follow the unbrick guide (open the tablet, disconnect battery, short, and run sh script) and that was successful getting me to hacked fastboot screen.

It was smooth sailing after that.

Now waiting on roms :D
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
[MENTION=7104332]k4y0z[/MENTION]

so I ended up looking at nicks device remotely something screwy was going on

It was not bricking properly so I manually ran the brick commands from a shell on the device as well as manually flashed the lk and tz from the sell on the device

I got the first stage deployed it booted into hacked fastboot but would not show up on the host machine after a reboot it went into a boot loop and was unable to get it back to hacked fast boot

ill have him try again from a stock load but I suspect the problem is the machine hes doing it from some usb weirdness
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Me either. It's like only half the device is awake or falls asleep before the script fully deploys. The battery trick that got me to even boot at all was to short the point with it unplugged and when it asks if I did step one brick to press enter, I reattached the battery and quickly pressed enter on a computer to run the script and it went through flawlessly. If I do it any other way it does not read emmc or returns invalid data or none at all as posted before. I know the battery isn't dead or it's not a power issue because the device will persist in bootrom infinitely unless I unplug it.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Seems like something is wrong with the way their shell or adb interprets quotes in the script....

EDIT:

The problem is right there after force_ro. There shouldn't be a " in that file name. Somehow that quote character gets copied literally into the adb's shell command. Maybe update your adb or bash...
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
fixed

he was using ubuntu xenial and it was not working at all switched to mint and got stage one to run first time but was really flakey

had to have him boot a different distro, had issues executing the first stage

linux just was not playing nice on his laptop (fought random device disconnects protocal errors generally unhappy)

ended up doing the last fastboot step from windows could not get fastboot to transfer recovery under nix was crashing

was not user error was a ****ty laptop combined with some screwy usb chipset bug
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
I think this might be at least part of the problem. The adroid-tools* packages are obsolete. The proper packages to install are "adb" and "fastboot". On Ubuntu 16.04, the aforementioned packages have outdated tools.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Yes that's what happened to me, but took me a while to finally figure that out. You can simply download the platform tools package extract and install the adb and fastboot binaries to /user/bin with a+x permissions. You can then use them anywhere. Then just cd back into the folder to use the others. If you're clevar enough you can even use the ndk and cross compile your own set. (Can even be done for arm to run on tablets).
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
I have run the process 5 times on mint 19.xx without issue using the same repo's

there is something about mainline ubuntu screwing with it, may not be all of the problem but you are correct it is some of it

as I said once he go mint running it worked fine until it hit the fastboot step and then fastboot was crashing and the device would not show in lsusb

so ended up completing the process from windows via fastboot commands, interestingly did have trouble sideloading the stock firmware as well

up there with the stranger things, I have ever seen but it might be specific to his chipset as it works on my old lga1551 mint box without issue everytime

there was some patches for fastboot/adb made for some usb3 chipsets causing this exact behavior and I do not know if they were ever merged into the version available
[Fire HD 8 and HD 10 Original Android Development] nikothebarber:
Well can anyone explain why parental controls keeps popping up every time I hit the hardware navigate buttons especially the circle button. Making it impossible to do anything. I tried the tool box that blocks it but it's still firing
[Fire HD 8 and HD 10 Original Android Development] Kctucka:
Did you disable anything? Or was it like that immediately after you flashed the exploit?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
It is passed on purpose, but su should filter it out:

adb shell su -c \"echo 0 \> /sys/block/mmcblk0boot0/force_ro\"

In my tests this worked with minisu, magisk and supersu

I have updated the OP to refer to adb and fastboot packages instead.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Wait, so you were able to boot into FireOS? step-1.sh only works when you're in FireOS.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
But in that distro and versions of Ubuntu after 16.x, the platform-tools packages are up-to-date. They simply point to the corresponding adb and fastboot packages. So the tools you were using were updated anyway. The problem is with Ubuntu 16.x (and lower).

OK, then I think it's actually adding its own backslash or something so that the quote is actually read verbatim by su. In the lines where you don't have the backslash, this adb does not separate the words into different arguments, and instead seems to add its own quotes to the command line. Suggest checking the version of adb in your script...
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
it still didn't work correctly past step 1 tho adb was still flakey and fastboot was outright freezing on flashing recovery

and I used the universe repo which should be the same across both mint and ubuntu

the solution is probably just to make the step 1 script wget the latest platform tools

either way a flaming warning is in order
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
No. I can't boot past white amazon logo. Diplomatic suggested I modify the script to try to reflash stock recovery. Pointer on that?
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
[MENTION=8165603]DragonFire1024[/MENTION], I did? Don't remember saying that....

If you want to modify something and you say minimal works for you, try going to main.py and comment out the lines with "switch_user(dev)" under "if not minimal", like this:

if not minimal:
# 7) Downgrade tz
log("Flash tz")
# switch_user(dev)
flash_binary(dev, "../bin/tz.img", gpt["tee1"][0], gpt["tee1"][1] * 0x200)

# 8) Downgrade lk
log("Flash lk")
# switch_user(dev)
flash_binary(dev, "../bin/lk.bin", gpt["lk"][0], gpt["lk"][1] * 0x200)

Then try again...
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Will try when I get home. Also I can't fond the reply at the moment, and maybe it was directed to someone else, but I do recall someone saying that in the same reply thread.
[Fire HD 8 and HD 10 Original Android Development] mhardyman:
Done that, says Magisk not installed, but seem to still have root.

Weird
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Download the uninstaller, flash it, reboot and reflash. If coming from supersu, I found it easier to go back to stock before rooting with Magisk. That said, I do too much work on my device to use magisk so I stick with supersu. Besides I have a permanently rooted boot.img regardless of that so I really don't even need either of the two, just the binaries to launch the daemon and busybox, both of which can be placed into the IMG if you know where they go. We just need the management apps to manage the root apps we have installed.
[Fire HD 8 and HD 10 Original Android Development] Kctucka:
What's the benefit of using supersu over Magisk for your purposes?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
I think that was me who suggested trying to flash a stock recovery.

Given that you can see the white amazon logo it means that you have a working LK, but it's likely not the LK that works with this exploit.

To flash a stock recovery replace these lines in modules/main.py

switch_user(dev)
flash_binary(dev, "../bin/boot.hdr", gpt["recovery"][0], gpt["recovery"][1] * 0x200)
flash_binary(dev, "../bin/boot.payload", gpt["recovery"][0] + 223223, (gpt["recovery"][1] * 0x200) - (223223 * 0x200))

with

switch_user(dev)
flash_binary(dev, "../bin/recovery.img", gpt["recovery"][0], gpt["recovery"][1] * 0x200)

and place a recovery.img into bin folder (You can find it in the return-to-stock zip)

The stuff inside if not minimal isn't executed in the minimal script.

Also why do you suggest commenting out switch_user(dev)?

That would mean it will flash to boot0 instead of user-part because the last switch before that is

switch_boot0(dev)
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Right, my idea was to make those changes and run the non-minimal bootrom script. But never mind... Just scrap that whole thing. I didn't realize it was switched to boot0 before that code. Thanks of pointing that out. Also, that's not the problem code anyway. Don't do that mod, [MENTION=8165603]DragonFire1024[/MENTION].

I looked at DragonFire's script output, and the error actually shows that it's crashing at switch_user(dev) in this segment:

if len(sys.argv) == 2 and sys.argv[1] == "minimal":
log("Running in minimal mode, assuming LK and TZ to have already been flashed.")
log("If this is correct (i.e. you used \"brick\" option in step 1) press enter, otherwise terminate with Ctrl+C")
input()
minimal = True

# 1) Sanity check GPT
log("Check GPT")
switch_user(dev)

But it's going through fine with minimal(?). So what does that mean? The main difference in the minimal version is that the script waits for user input before continuing. Something to do with timing, maybe. I would try to put an input() before switch_user(dev) (in main.py):

# 1) Sanity check GPT
input()
log("Check GPT")
switch_user(dev)

And then run the regular bootrom script. You will have to press enter at the beginning. And see what happens...
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
That's actually a pretty good idea, I didn't think about the input() in the minimal-script.

I think this may actually enable you to run the non-minimal script [MENTION=8165603]DragonFire1024[/MENTION]
[Fire HD 8 and HD 10 Original Android Development] mhardyman:
Thanks, but you lost me at uninstaller!

I assume you mean your return to stock zip in one of the first posts.

Not sure how I still have root, magisk is saying I don't. Never rooted with SuperSU

Doh.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Alright. I'll do this today and see what happens.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Still have the same result. Just boots to the white Amazon logo when the minimal script finishes and I do fastboot step. Still can't get the regular bootrom step to work.