yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
I'd probably just create a tar.gz from data to (external) sdcard and restore it later, but haven't tried it myself.

No idea, that's for someone else to figure out :p

Why would yout wan't to keep the old preloader/tz? That could result in issues with DRM or WiFi.

I also noticed there was an older preloader (don't remember what version) that used different certificates to verify LK, so I'd advise against that.

Anyway you could always still downgrade using bootrom. Because I knew you'd ask, I actually implemented a "brick" option in step-1.sh to get into bootrom without opening.

bootrom-step will also flash preloader as last step, so should it stall in the middle you should still get into bootrom without opening the device. (If it get's stuck in bootrom you can just hold the power-button for 20+ seconds)

Most of them aren't strictly necessary and are to be considered more of a safeguard Amazon didn't even implement themselves (i.e. protecting you from a downgrade-brick).

All in all I'd say this exploit is probably better protected than the other amonet-based exploits.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
This took me a while to figure out what I was missing. I had to install 1 package (I cant recall the name of it, but it was dosunix or something like that) It took me 2 hours to figure it out. I had to read every bit of the script and the output of it too. Once I installed that, the process actually was really smooth. Now if we can't update the kernel (stock) does that mean we can't get onto a custom one? We do have pretty much the whole source for everything on the HD 10. Thank you for doing this for us. :)
[Fire HD 8 and HD 10 Original Android Development] TheRealIntence:
Why should we not be able to flash a custom kernel?

Since we all the sources needed to make a custom rom, someone just needs to create source trees on order to be able to compile a custom rom and then we finally can get rid of bloated FireOS.
[Fire HD 8 and HD 10 Original Android Development] obvious:
Are there any hurdles to getting this running with twrp etc on hd8 2017/2018?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Yeah that would be dos2unix. It's actually in the apt install command I posted.

I also added it to the packages listed above for clarification just know.

Of course you can update the kernel/install a custom one.

That's pretty much the whole idea ;)

A Magisk-patched kernel is also a custom kernel.

I actually have a working Kernel-source laying around, and tested by compiling lime kernel-module because I thought I had to dump memory. Turned out I didn't need it after all.

Will see if I push the kernel-tree to my github as well.

For the HD8 2018 see here
[Fire HD 8 and HD 10 Original Android Development] obvious:
Gotcha. Mine's the HD8 2017 unfortunately , though it's pretty much the same hardware as far as i know
[Fire HD 8 and HD 10 Original Android Development] Newt182:
Thanks for this it worked perfectly. I did have to manually copy over and install Magisk Manager after following the process but no issues. Used the latest dist of ubuntu in a VM in VM Ware.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Thanks for the feedback.

BTW, has anyone tested this on a 64GB yet?
[Fire HD 8 and HD 10 Original Android Development] b1u3m3th:
I am about to.
[Fire HD 8 and HD 10 Original Android Development] DV8:
Working on it now.

Worked like a champ.
[Fire HD 8 and HD 10 Original Android Development] TheRealIntence:
Tested and it works flawlessly
[Fire HD 8 and HD 10 Original Android Development] Wall.swe:
This is great!

I have a few questions though..

1. I'm on 5.6.0.1 and rooted(kingroot) and have superSU installed. Should I factory reset and update before following your guide or am I good to go?

2. Is it possible to do this procedure via a bootable USB with Ubuntu?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Either should work, if you wan't to play it safe do the update first.

Yes
[Fire HD 8 and HD 10 Original Android Development] b1u3m3th:
Worked perfectly for me as well! Thank you so much for this!
[Fire HD 8 and HD 10 Original Android Development] DV8:
Tried to install Magisk keeps erroring out says signature of zip file is invalid. Downloaded with Magisk Manager.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Re-download it I suppose.
[Fire HD 8 and HD 10 Original Android Development] b1u3m3th:
It flashed for me without a problem. I downloaded it from within Magisk manager as well.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You need to run bootrom-step-minimal.sh and THEN plug the device in.

I'll make the instructions more clear, as the new amazon-firmware requires different steps.
[Fire HD 8 and HD 10 Original Android Development] BeniS98:
It was my mistake... I forgot to run the script as sudo. Now everything works fine and my device is finally rooted.

Is it safe to perform OTA updates? What will happen if I do them?
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
You will loose root if you update via any amazon update that hasn't been modified by one of us to re root your tablet when it installs. You can only flash magisk in twrp. SuperSU won't flash without looping.

---------- Post added at 03:48 AM ---------- Previous post was at 03:40 AM ----------

Looks like I solved the issue. Placed a file in the wrong spot. Moved it, set permissions and everything is ok. Issue hasn't repeated since.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Amazon's help site lists the "latest" update for the 7th gen HD 10 now as 5.3.6.8. WTF? Wasn't 5.6.4.0 the last one? I'm so confused by these numbering issues.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Probably just continuing with the typo. My guess is they probably create their bins like I do zips with SuperRs tool. If so, the version numbers are incrimental and will go up based on the previous set values. So in other words, they didn't change anything in those values between the last and most recent versions.
[Fire HD 8 and HD 10 Original Android Development] DB126:
More version identifier sloppiness. Likely 98% of the user base could care less; apparently Amazon falls into the same bucket.
[Fire HD 8 and HD 10 Original Android Development] sga999:
I had already run the steps in this thread, so I had unlocked, rooted (I was already rooted from Diplomatic's thread), and installed TWRP. I had also installed Magisk Manager and Magisk 18.1 zip. When I saw that the new OTA was available, I downloaded it, flashed it and Magisk 18.1 in TWRP. Everything is working fine. So I don't think we need to get a modification from "one of us", unless I'm misunderstanding something.

After that, I disabled OTAs again with the rename method and build.prop modification, just to be safe.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I don't trust flashing the entire bin. And I usually remove lines related to flashing anything but system. I've always been told and stand by it, never flash a update.bin fresh off the press. I'll stand corrected if need be, but it's just asking for trouble if you don't at least modify the script. With that said, what version are you now on?

Edit: also, I'm having battery drain issues on the version with the typo. Am I able to downgrade brick, run the tool to fix anti rollback? If so would that allow me to be on the downgraded version or would I have to reflash the latest when done?
[Fire HD 8 and HD 10 Original Android Development] retyre:
From the OP: "TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work)."
[Fire HD 8 and HD 10 Original Android Development] sga999:
System Updates shows that I'm running Fire OS 5.6.4.0 (636558520), build date March 28, 2019, 8:50 PM.

As [MENTION=3497316]retyre[/MENTION] said, the OP said there are no problems with the image files (my LK file still shows the 5.6.3.0 value). And I read somewhere else (sorry, not sure which thread), that there are no concerns about TWRP getting overwritten with the original recovery.
[Fire HD 8 and HD 10 Original Android Development] FOLOL2011:
Hello guys,

Thank you very much for this thread. My exp :

It worked on my Fire HD 10 version 5.6.2.0 that was rooted

I had a supersu that was converted to system app

So before step 2, I had to go back into supersu settings and change to no asking : grant automatically otherwise the "adb shell su -c id" in get_root() would hang

Also tried to install magisk module xposed but it didn't boot ( hanging at fire screen ) so before playing with Magisk, Magisk Manager for Recovery Mode is a must-have module :)

I wonder if it would better to swith to SELinux permissive first ?
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
has anybody considered backporting the fireOS for the HD8 to the HD10

there similar SOC's now that we have bootloader access it should be relatively easy
[Fire HD 8 and HD 10 Original Android Development] JustusIV:
How can i tell the version number of the tablet after i disabled the OTA app. I believe this is the spot to look at it.

I have peaked at build.prop however i believe it to have an inaccurate number in there.

The build.prop has a version of 5.3.6.4 but i updated as far as i could go on march 30th, which i thought was 5.6.2.0
[Fire HD 8 and HD 10 Original Android Development] DB126:
You're fine w/patched TWRP. That said, every device and root/unlock solution is different; best not genericize the guidance specific to this gizmo.
[Fire HD 8 and HD 10 Original Android Development] sga999:
The Fire HD 10 is the only Amazon tablet that I have. So I wasn't trying to genericize. I was just trying to respond to the specific post that said we needed to ask for a modified ota from "one of us".
[Fire HD 8 and HD 10 Original Android Development] DB126:
Don't get your panties in a bunch. Simple statement intended to prevent future readers from making false assumptions. Enjoy your device.

And yes, the "one of us" branding was irritating as it inferred a gaggle of geek lords charged with protect a hapless user flock. :rolleyes:
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Ok so I have 1 fire 10 left, the very first one I bricked. I get EMMC read error, it can't read it. the tablet is in preloader mode confirmed by lsusb as seen below:

dragon@dragonfire:~/amonet-suez/amonet$ lsusb
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 002: ID 0461:4d8a Primax Electronics, Ltd
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 009 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 008 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 007 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 006 Device 002: ID 046d:c52f Logitech, Inc. Unifying Receiver
Bus 006 Device 020: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
Bus 006 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

dragon@dragonfire:~/amonet-suez/amonet$ sudo ./bootrom-step.sh
[2019-04-18 12:34:05.878393] Waiting for bootrom
[2019-04-18 12:34:15.954127] Found port = /dev/ttyACM0
[2019-04-18 12:34:15.959039] Handshake
[2019-04-18 12:34:15.959845] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-04-18 12:34:19.281482] Init crypto engine
[2019-04-18 12:34:19.301003] Disable caches
[2019-04-18 12:34:19.301477] Disable bootrom range checks
[2019-04-18 12:34:19.313700] Load payload from ../brom-payload/build/payload.bin = 0x4820 bytes
[2019-04-18 12:34:19.317232] Send payload
[2019-04-18 12:34:19.877309] Let's rock
[2019-04-18 12:34:19.878069] Wait for the payload to come online...
[2019-04-18 12:34:19.882049] all good
[2019-04-18 12:34:19.882427] Check GPT
Traceback (most recent call last):
File "main.py", line 192, in <module>
main()
File "main.py", line 95, in main
switch_user(dev)
File "main.py", line 56, in switch_user
block = dev.emmc_read(0)
File "/home/dragon/amonet-suez/amonet/modules/common.py", line 196, in emmc_read
raise RuntimeError("read fail")
RuntimeError: read fail
dragon@dragonfire:~/amonet-suez/amonet$
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
this is probably useful then

https://xdaforums.com/hd8-hd10/development/2017-fire-hd-10-unbricking-anti-rollback-t3896616

honestly, I would just solder a wire to that blue point and run it out the case then you have something you can brick unbrick as many times as you want

so long as you don't trash the preloader

I just ground mine on the usb port housing or better yet you could put a microswitch in the there and drill a small hole

unbrickable mod
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
? How does that help?
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
because its not really in preloader mode

iv had this happen on a couple of mediatek devices

they will report as being in preloader mode and then refuse to allow writing

usually, a pin needs to be pulled low to get write access back usually either clk or WP
[Fire HD 8 and HD 10 Original Android Development] FOLOL2011:
Thank you the old approach of [MENTION=503818]tdk[/MENTION]friend works. Xposed is on my fire hd 10 now
[Fire HD 8 and HD 10 Original Android Development] retyre:
Preloader and Boot-ROM are two different modes. Write commands in preloader mode have been disabled for years now. The writing is now being done in Boot-ROM mode.

[MENTION=8165603]DragonFire1024[/MENTION]: You show the device in preloader mode in your screenshot, but thereafter present the output from Boot-ROM. If your emmc is corrupt, you should be able to obtain a read out (of a-few-blocks-at-a-time) from a working emmc (you have written about possessing multiple 2017 HD 10 devices) and dump it to the corrupt emmc (in Boot-ROM mode, of course).
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Ok how do I go about doing that?
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
I wish.

So you just update via OTA, which flashes just fine automatically in TWRP? Or did you have to find the file and flash it manually? Confused on how that would work.

Edit: Can't update anyway. The download bar fills, then starts over again, repeatedly.
[Fire HD 8 and HD 10 Original Android Development] tylerhole:
I was able to update to 5.6.4.0 using ota no issue. TWRP still intact, flashed magisk 19 no issue. rooted and running fine.

Sent from my SM-G9650/DS running stang5litre Pie ROM
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Just got home, tried downloading it here, and it just said "last update failed" and restarted the downloaded as soon as the bar filled, again. Trying again for the umpteenth time.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
[MENTION=8165603]DragonFire1024[/MENTION], I've got the direct link for updates!

https://www.amazon.com/firehd107thgensoftwareupdate

Downloaded it, renamed to zip, flashed in TWRP along with Magisk 19, then rebooted. Root is still good, though I had some "components" left to install, six in fact. Tapped "update" six times, with a pause each time, and a 10-second wait after the sixth, then the message disappeared and said I was up-to-date. I noticed, however, that my home and recents buttons were gone, and my notifications shade wouldn't pull down. I read somewhere that LauncherHijack needed to be removed then reinstalled, so I did that, then rebooted. All is good. I'm at 5.6.4.0.
[Fire HD 8 and HD 10 Original Android Development] c6z06vette:
guys......having an issue trying to get root to stick

I'm using a raspberry pi3 with all the software needed for adb. adb devices showing when calling out in terminal.

This is a 7th gen. Fire HD10 on version 5.6.1.0 (no updates from purchase).

Here is my output:

pi@rp3_bathroom:~ $ adb push /home/pi/Documents/adb/root/arm64 /data/local/tmp/

/data/local/tmp/arm64/: 1 file pushed....pped. 1.2 MB/s (34424 bytes in 0.027s)

pi@rp3_bathroom:~ $ adb shell

shell@suez:/ $ cd /data/local/tmp

shell@suez:/data/local/tmp $ chmod 755 mtk-su

shell@suez:/data/local/tmp $ ./mtk-su -v

param1: 0x3000, param2: 0x10000, type: 9

Building symbol table

kallsyms_addresses pa 0x40aa1f00

kallsyms_num_syms 66739, addr_count 66739

kallsyms_names pa 0x40b24600, size 832223

kallsyms_markers pa 0x40bef900

kallsyms_token_table pa 0x40bf0200

kallsyms_token_index pa 0x40bf0600

Patching credentials

init_task VA: 0xffffffc000e36960

Possible list_head tasks at offset 0x368

0xffffffc020120368 0xffffffc050388ee8 0x000000000000008c

comm offset 0x5d8 comm: swapper/0

Found own task_struct at node 1

real_cred VA: 0xffffffc05b865c00

Parsing sel_read_enforce

ffffffc00027ef50+04: ADRP x0, 0xffffffc000f42000

ffffffc00027ef50+1c: LDR [x0, 2116]

selinux_enforce VA: 0xffffffc000f42844

Setting selinux_enforce

Selinux is already permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@suez:/data/local/tmp # ls

arm64

busybox

minisu.img

mtk-su

shell@suez:/data/local/tmp # ls -a

arm64

busybox

minisu.img

mtk-su

shell@suez:/data/local/tmp #

Did this at least 5 times with no luck. Thanks for your help as I'm missing something!
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
The stick?

Not sure, what you're trying to do here :confused:

If you want temp-root, then follow the instructions in the mtk-su thread.

If you want to unlock, then why are you running mtk-su manually?
[Fire HD 8 and HD 10 Original Android Development] c6z06vette:
According to the OP I thought I'm suppose to have root

first

according to this: "NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by [MENTION=8132642]diplomatic[/MENTION] from here and place (the unpacked binary) into amonet/bin folder".

Therefore I ran the mtk-su in adb shell. I checked permissive with this command "getenforce" and the result is permissive. Then I went to the unlock method in this OP.

I'm obviously overthinking something......
[Fire HD 8 and HD 10 Original Android Development] tylerhole:
From the mtk-su root thread

As mentioned, what this tool does is give you a temporary root shell with Selinux enforcement disabled to do with as you please.

Once you gain root with it then do the steps in this thread.

Sent from my SM-G9650/DS running stang5litre Pie ROM

---------- Post added at 09:51 AM ---------- Previous post was at 09:48 AM ----------

And if you want permanent root after you unlock it flash magisk in TWRP

Sent from my SM-G9650/DS running stang5litre Pie ROM
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
As far as I know, there are no labeled points on the HD 10. Anyways I've tried a few times and can't get past the write error. Using the other tool brings back an error along the lines of 'got data. Expected something else'
[Fire HD 8 and HD 10 Original Android Development] Shadow Death:
Just ran it and everything went flawless. :D
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Trying to raise one from the dead :(
[Fire HD 8 and HD 10 Original Android Development] Shadow Death:
Mine is still on 5.3.6.4 so this may have something to do with it. I did the process ass mentioned by others. I setup a virtualbox with ubuntu 19.04 then installed Guest additions, then Virtualbox extensions, then changed the USB protocol to 3.0 in the VM settings since my tablet was connected via USB3.0. Then in that same VM settings I mounted the tablet so that the VM would take the tablet every time.

Then I ran the process in OP step by step. Once it was done I installed Magisk 19 as it was mentioned here and updated magisk manager to 7.1.1 (Latest). I can honestly say this tablet is way smoother and faster than it was with SuperSU installed using the other root method.

What I did was install the launcher of my choosing then use Titanium Backup to freeze the amazon launcher. No Launcher Hijack needed. Cut the middleman. :D
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
That is really weird, if it goes into preloader it means the EMMC should still be accessible (since the preloader is loaded from EMMC).

And even if it was corrupt, it should at least get to the message, where it says "What's wrong with your GPT".

You can try disconnecting everything that isn't essential (Battery, display, cameras etc), leave it like that for a bit and then try again.

I'm not sure how you can read this into that sentence:confused:

It clearly says, IF you are already rooted to just run step-1.sh.

And if you are not rooted, to just place the mtk-su binary into the amonet/bin folder and then run step-1.sh

Nowhere does it say, that being rooted is a requirement.

Again, that is totally unnecessary, you don't need to root, before doing the unlock.
[Fire HD 8 and HD 10 Original Android Development] Sc4r3Crow:
Can you please state exact filename of amazon launcher as it is shown in tb? I just don't want to freeze the wrong file ;)
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
doing this from a vm is asking for a brick

the virtual box USB filter does bad things to device communication ask me how I know
[Fire HD 8 and HD 10 Original Android Development] Shadow Death:
Home Pages is what it shows up as in Titanium Backup.

Yep. I don't recommend other people try it. I bought mine as a toy so it didn't matter too much if it bricked on me.

I will say that my experience was pretty Rock solid.
[Fire HD 8 and HD 10 Original Android Development] Sc4r3Crow:
I've found amazon launcher in tb and freezed it...everything is working fine until now :good:
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
if you have the special offers variant

once rooted

pm uninstall -k --user 0 com.amazon.kindle.kso

no more adds

anybody gotten xposed to work

I tried sdk22 arm64 and all it did was softbrick it
[Fire HD 8 and HD 10 Original Android Development] Shadow Death:
Cool, I messed up the first time by using Amazon toolbox to remove the launcher. It's nothing against the dev of that toolkit, it just didn't play well with my tablet. Every time I hit the home button I would get a notification about parental controls. I had to go through his apps code and figure out how he disabled the launcher and reverse it.

The rest of his toolbox works great though. :)
[Fire HD 8 and HD 10 Original Android Development] cuilidh:
I think Im bricked

The process was working, got to step-1.sh, the script stated I had a FireOS that was too new (5.6.4.0), and went through the bricking process. The system bricked, and I continued to follow the steps, but even after sudo ./bootrom-step-minimal.sh completed, the system only booted to the white amazon logo screen ( with => HACKED FASTBOOT mode: (0) -xyz, k4y0z at the bottom of the screen). It just sits there. I tried rebooting, same. Soft reboot, same. If I try to use the ./bootrom-step.sh process it gives me a ("ERROR: Serial protocol mismatch").

Is there anything I can do? It seems like its "soft bricked", but I cant get it booting past this.

Thanks for your help,

Kevin
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You need to run

sudo ./fastboot-step.sh
[Fire HD 8 and HD 10 Original Android Development] cuilidh:
I actually ran it, the system rebooted into TWRP and I was able to recover back to the original image.

What did I miss?
[Fire HD 8 and HD 10 Original Android Development] Legitsu:
is the tablet force powering on when connected via usb a side effect of the exploit ?
[Fire HD 8 and HD 10 Original Android Development] DB126:
Happens with every Fire I have owned going back to 2nd gen. Custom ROMs or various root tools can suppress behavior if desired.
[Fire HD 8 and HD 10 Original Android Development] Shadow Death:
I suspect it's an Android 5.0 feature. I remember my old Nexus phones that ran Android 5.0 had the same issue.