yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] PatchWorkH:
I think I mostly follow how to do this. Just regarding step 7. How do you run the exploit? Do you just copy this "/data/local/tmp/20165195/Matrix /data/local/tmp/20165195 2" into the terminal or do I go to that folder on the tablet and run it there?

And once this is done does it require the step of bricking/downgrading the firmware (5.6.9.0.)?

Sorry, I'm clueless with things like this.
[Fire HD 8 and HD 10 Original Android Development] mhump711:
You have to extract both zip into that folder. This is step 2 and 3. Then type in "/data/local/tmp/20165195/Matrix /data/local/tmp/20165195 2" without the quotes. Then the cmd prompt goes weeeee.

I had to do the downgrade part then step-1.sh.
[Fire HD 8 and HD 10 Original Android Development] PatchWorkH:
Okay, just an update for future readers. I managed to follow smartypantsuk's guide to root my 7th gen fire hd 10 on firmware 5.6.9.0. and then followed the guide on page 1.

Required a bit of troubleshooting during the firmware downgrade (just reading the comments in this thread). But I got it working in the end.

I have Lineage OS on it now and everything seems to be working.

--

Edit: Well after spending a day with Lineage OS 16, I decided to go back to Fire OS. There were a couple issues that just made it not worth it for me right now. Perhaps in the future. But at least I was able to get rid of the Fire Launcher.

--

Thanks
[Fire HD 8 and HD 10 Original Android Development] digixmax:
Can you please elaborate on how to do the downgrade part?

TIA.
[Fire HD 8 and HD 10 Original Android Development] digixmax:
Is the "brick option" built into the step-1.sh script -- or is it to be done via the commands in the hidden section showed above, or by using the shell script brick.sh in brick-suez.zip?
[Fire HD 8 and HD 10 Original Android Development] luk2009:
I have the same problem.

fire hd 10 7th gen

fire os 5.6.4.0
[Fire HD 8 and HD 10 Original Android Development] PatchWorkH:
Yes, from what I recall I got a prompt after running step-1.sh.

Then I followed the steps in the hidden section. Except this part:

sudo systemctl stop ModemManager

sudo systemctl disable ModemManager

I ran this before running step-1.sh.

Honestly I don't know what it does or how important it is or whether it makes a difference where you run it. But I did it before because after you run step-1.sh you seem to be locked into running the other commands.
[Fire HD 8 and HD 10 Original Android Development] bruces2:
Greetings,

I'm trying to root this old tab. As I follow instructions I get the following issue.

pi@rpi4:~/Downloads/amonet $ sudo ./step-1.sh

Testing root access...

Trying to use mtk-su to get temp root...

Pushing root files

bin/mtk-su: 1 file pushed. 3.6 MB/s (65144 bytes in 0.017s)

bin/minisu.img: 1 file pushed. 6.5 MB/s (1048576 bytes in 0.153s)

bin/busybox: 1 file pushed. 7.0 MB/s (989184 bytes in 0.135s)

Failed critical init step 4

This firmware cannot be supported

Failed critical init step 4

This firmware cannot be supported

Failed critical init step 4

This firmware cannot be supported

Is it possible the reason is I'm on a Raspberry Pi 4???

(Fire 10 7th gen os 5.6.8.0)
[Fire HD 8 and HD 10 Original Android Development] Michajin:
You have to root a different way. I think Kingo root still works. Mtk-su is blocked in your firmware.
[Fire HD 8 and HD 10 Original Android Development] digixmax:
See this post.
[Fire HD 8 and HD 10 Original Android Development] bruces2:
Jumping there now... Thanks...
[Fire HD 8 and HD 10 Original Android Development] Shawn2024:
I do run the command but it says command not found
[Fire HD 8 and HD 10 Original Android Development] papasuez:
So maybe I bricked my device. I opened it up ... shortened it, but than I get this:

❯ ./bootrom-step.sh

[2022-03-08 10:03:47.456901] Waiting for bootrom

[2022-03-08 10:04:28.313253] Found port = /dev/cu.usbmodem1101

[2022-03-08 10:04:28.318765] Handshake

[2022-03-08 10:04:28.319743] Disable watchdog

* * * Remove the short and press Enter * * *

[2022-03-08 10:04:33.339103] Init crypto engine

[2022-03-08 10:04:33.362762] Disable caches

[2022-03-08 10:04:33.363542] Disable bootrom range checks

[2022-03-08 10:04:33.377770] Load payload from ../brom-payload/build/payload.bin = 0x4820 bytes

[2022-03-08 10:04:33.379738] Send payload

[2022-03-08 10:04:34.026249] Let's rock

[2022-03-08 10:04:34.027187] Wait for the payload to come online...

[2022-03-08 10:04:34.031013] all good

[2022-03-08 10:04:34.031180] Check GPT

Traceback (most recent call last):

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 192, in <module>

main()

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 95, in main

switch_user(dev)

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 56, in switch_user

block = dev.emmc_read(0)

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/common.py", line 196, in emmc_read

raise RuntimeError("read fail")

RuntimeError: read fail

Looks like the GPT is gone or defect... any ideas?

I also tried to manipulate the main.py and inject the mantis fixgpt method and tried to flash the mantis-gpt, but this failed with:

[2022-03-08 10:25:45.819348] Flashing GPT

Traceback (most recent call last):

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 197, in <module>

main()

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 90, in main

flash_binary(dev, "../bin/gpt-mantis.bin", 0, 34 * 0x200)

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 37, in flash_binary

flash_data(dev, data, start_block, max_size=0)

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/main.py", line 28, in flash_data

dev.emmc_write(start_block + x, data[x * 0x200:(x + 1) * 0x200])

File "/Users/papasuez/Downloads/amonet-suez-v1.1.2/amonet/modules/common.py", line 215, in emmc_write

raise RuntimeError("device failure")

RuntimeError: device failure
[Fire HD 8 and HD 10 Original Android Development] Shawn2024:
I downgraded my device and then bricked and I tried following the bricking method but on terminal it keeps saying command not found, when I put sh in front it says cant open name.sh
[Fire HD 8 and HD 10 Original Android Development] papasuez:
what command?
[Fire HD 8 and HD 10 Original Android Development] Shawn2024:
bootrom-step-minimal.sh
[Fire HD 8 and HD 10 Original Android Development] Shawn2024:
Im not sure if the rest of the commands works aswell
[Fire HD 8 and HD 10 Original Android Development] Anhnguyen0103:
I have the same issue it stuck on Check gpt and it gave me the same message

Somebody please help me with this
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
There are bootrom-patched devices out there, you need to make sure that your device is vulnerable, like this:

-don't run any script from amonet

-Power off, apply short, keep it + connect usb

-take a look at lsusb in a terminal while keeping the short.

A vulnerable device will show up as:

Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone

and it will stay right there until you release the short.

Patched devices show also up as phone during boot, but only for a second...

If you can't get a 'stable' phone message in lsusb while shorting, then it's patched.
[Fire HD 8 and HD 10 Original Android Development] Anhnguyen0103:
Where can i find this bootrom-patched

And also thank you for reply
[Fire HD 8 and HD 10 Original Android Development] pascal009:
Need HELP!

Hello everybody,

Today I have tried this approach on Fire HD 10 7th Gen (2017) running Fire OS 5.6.7.0 Build 657612520, MT8173 suez, Android 5.1.1 (Lollipop).

Having followed all preparation steps, I connected the device to my Ubuntu box and started "sudo ./step-1.sh".

The first error message stated

"Testing root access...

Trying to use mtk-su to get temp root...

No mtk-su found, you can get it here: https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595".

I know I put the mtk-su_r23.zip binary in "amonet/bin" directory per the instructions. I figured that the script actually requires the "mtk-su"

binary itself rather than the zip archive. So I put the respective mtk-su file in the "amonet/bin" directory and re-run "sudo ./step-1.sh".

At this point the script started with the following log in the terminal window:

Testing root access...

Trying to use mtk-su to get temp root...

Pushing root files

[100%] /data/local/tmp/mtk-su

bin/mtk-su: 1 file pushed. 2.0 MB/s (60840 bytes in 0.029s)

[ 6%] /data/local/tmp/minisu.img

....................................................................

[100%] /data/local/tmp/minisu.img

bin/minisu.img: 1 file pushed. 5.4 MB/s (1048576 bytes in 0.184s)

[ 6%] /data/local/tmp/busybox

....................................................................

[100%] /data/local/tmp/busybox

bin/busybox: 1 file pushed. 4.7 MB/s (989184 bytes in 0.202s)

Failed critical init step 4

This firmware cannot be supported

...................................................................

Failed critical init step 4

This firmware cannot be supported

That's where I got. I had to stop the shell command because it was just generating the same error message.

Luckily, the device seems to be untouched.

Now I have a few questions and I hope somebody can clarify them for me.

1. Does this error mean I am out of luck and my device cannot be rooted by this method or any other for that matter?

2. Is this because mtk-su allows for a temp root for Fire HD 10 (2017) up to Fire OS 5.6.4.0 Build 636558520 only (as it was stated

in the original post for temp root based on mtk-su vulnerability)? This seems to contradict to reports in https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-8-2018-karnak-amonet-3.3963496/page-47 where users reported success with

Fire HD 8 2018 (8th gen), FireOS 7.3.2.2 whereas mtk-su is supporting up to Fire OS 6.3.0.1 only for Fire HD 8 (2018).

Please. Can somebody help me understand where I stand with my device?

Peace,

pascal009
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Reextract the ZIP while in Linux onto Desktop or fix the execute-permissions (chmod)

Make sure the short is removed when the script tells you to and that nothing is damaged.

You need another method for gaining temporary root access:

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-10-2017-suez.3913639/post-85824221
[Fire HD 8 and HD 10 Original Android Development] ggow:
Hello, @k4y0z,

Hope all is good.

I would like to rebuild TWRP for suez with encryption support.

I have got a copy of your twrp minimal device tree and recovery repo (android-9).

I tried the android-7.1 branch which I already have synced for other devices, it built and ran but it couldn't see any storage devices.

Did you build it out with minimal-manifest-twrp and if so which branch?

EDIT: opened up the the recovery and saw you used android-5.1 branch
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
IIRC i was using omni-minimal-5.1.

Might require some changes for newer branches.

Possibly

sys.usb.ffs.aio_compat=1
[Fire HD 8 and HD 10 Original Android Development] ggow:
Cool, I'm going to have a go at updating to minimal-7.1.

There were quite a number of build errors in the 5.1 branch, probably due to things moving on, which makes it a worthwhile exercise.
[Fire HD 8 and HD 10 Original Android Development] ggow:
I tried the fastboot boot command and got back:

$ fastboot boot recovery.img
Sending 'boot.img' (15170 KB) OKAY [ 0.725s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed

Do you think it's possible to this working (really useful for debugging)?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
If it doesn't work in hacked fastboot, I'm not sure there is much I can do unfortunately.

I think Amazon removed the command entirely, after it was used to root ford initially.
[Fire HD 8 and HD 10 Original Android Development] pascal009:
Hooray!

I was able to finish up the process at the top of this thread and my suez is now rooted and TWRP-ed.

It appears the mtk-su vulnerability had been patch in my device. k4y0z kindly pointed me to an alternative method for rooting the suez devices. I followed this method to root my device and then returned to step-1 script at the top of this thread. I still had to open the back cover to disconnect the battery during the execution of step-2.sh. This was the hardest part for me to do without breaking the glass or the case. Then step-2 script pick up and finished with the TWRP interface.

My heartfelt thanks go out to k4y0z for pointing me to an alternative rooting method and to smartypantsuk for the marvelously detailed and clear guide for it

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-10-2017-suez.3913639/page-73#post-85824221

Peace,

pascal009
[Fire HD 8 and HD 10 Original Android Development] digixmax:
Hm, I had thought per the OP "NOTE: If you are on firmware 5.6.4.0 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all). If you chose the brick option, you don't need to run step-2.sh below"
[Fire HD 8 and HD 10 Original Android Development] pascal009:
You are correct. What I meant is the second command after bricking the device, i.e. "sudo ./bootrom-step-minimal.sh".

Sorry, my bad. I was too excited.
[Fire HD 8 and HD 10 Original Android Development] Klenz39:
Sorry if this is unrelated. What happen if in the recovery I used ubuntu image for raspberry pi?

1. Will i overwrite the TWRP?

2. If the TWRP corrupted or deleted, will it be possible for me to install it again?
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
Nothing, it won't install at all I guess, as there is probably a device check in the update script...
[Fire HD 8 and HD 10 Original Android Development] Klenz39:
thank you @Sus_i . I found this link which they have same chipset and most of the hardware. Could not find a method to install the image though.

https://archlinuxarm.org/platforms/armv8/mediatek/acer-chromebook-r13.
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
Reboot to hacked fastboot means that you need to run sudo./fastboot-step.sh

You may do this again, open it up and so on...

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-10-2017-suez.3913639/post-79169423

but don't forget to do the steps from this guide, i.e. all steps incl. to short the mentioned point...

2017 Fire HD 10: Unbricking from anti-rollback

Disclaimer: To go through with this, you will have to open up your device to get access to the back of the PCB. This is not for everyone. If you encounter issues, I (or the others here) will try to help you, but the risk is all yours. First...

xdaforums.com

-> make sure you run sudo ./bootrom-step.sh at step 6.

If you get a note about hacked fastboot, you need to run the sudo ./fastboot-step.sh

In twrp install a new rom (before any reboot), then wipe data.

Good luck ;)
[Fire HD 8 and HD 10 Original Android Development] pascal009:
Thank you Sus-i! Much obliged. You always give me hope I CAN beat it.

I am glad I left the device disassembled (just a couple of screws on PCB and the battery.

A question, though - if I get a note about hacked fastboot after sudo ./bootrom-step.sh in step 6, can I run sudo ./fastboot-step.sh with the battery and LCD disconnected?
[Fire HD 8 and HD 10 Original Android Development] Jemus:
I flashed a few devices back in the days so I am not new to that but need a little help how to get LineageOS flashed on my Fire HD 10 2017 running 5.7.0.0. I read the OP in the ROM thread and it linked to this guide here, telling that before flashing the ROM, the bootloader has to ne hacked. I am a little bit confused, are these the right steps?:

1) Enable ADB on tablet and connect it to linux installation

2) Download and unpack "amonet-suez-v1.1.2.zip"

3) cd into the unzipped folder and run sudo ./step-1.sh

4) As I am on 5.7.0.0 I would proceed by sudo systemctl stop ModemManager and sudo systemctl disable ModemManager, type "yes" and disconnect

5) run sudo ./bootrom-step-minimal.sh, plug the device back in

6) run sudo ./fastboot-step.sh, reenable ADB

7) run sudo ./step-2.sh, even though I understood that this was not necessary as I was on a newer OS than 5.6.4.0 and therefore did steps 4-6??

Now I might have installed TWRP and an unlocked device and could cony the ROMs zip on a USB drive, connect that to the Fire HD 10, boot into TWRP and flash the ROM?
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
The guide says (just behind the bootrom-step thing):

Then run the fastboot-step... :)
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
No need to reenable adb after #6, device will boot into twrp with adb always enabled...

No, don't to run step-2

Yes.

There is a step you missed somehow (place it infront of a connect device to your PC), lets call it 1a:

You need a working superuser install in order to get the scripts from OP working, i.e. you need to root the OS with 'kingo root' or 'kingroot' or the offline root method from here:

HD 10 (2017): Offline rooting

Update: While this still works, there's an easier method here. Please try that first. Disclaimer #1: KingoRoot, dr.fone, and most other one-click rooting tools are characterized as malware. Should you use these tools? That decision is yours and...

xdaforums.com

Reason is that the 'Rapid Temporary Root for HD 8 & HD 10' a.k.a. MTK SU root is patched and no longer working.
[Fire HD 8 and HD 10 Original Android Development] Jemus:
@Sus_i

I thought I got all the needed programms on the linux system by sudo apt install python3 python3-serial adb fastboot dos2unix. But you are right, I didn't mention that step. So concluding from what you wrote I would do the following steps. Or do I have to run through the whole offline rooting tutorial before starting with my mentioned steps?:

1) sudo apt install python3 python3-serial adb fastboot dos2unix

2) Enable ADB on tablet and connect it to linux installation

3) Download and unpack "amonet-suez-v1.1.2.zip"

4) cd into the unzipped folder and run sudo ./step-1.sh

5) As I am on 5.7.0.0 I would proceed by sudo systemctl stop ModemManager and sudo systemctl disable ModemManager, type "yes" and disconnect

6) run sudo ./bootrom-step-minimal.sh, plug the device back in

7) run sudo ./fastboot-step.sh
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
You are still missing the step I have mentioned in my last posting.

You see, in order to get the step-1 script to work, the tablet must have root access... in earlier fireOS versions that was possible via temp mtk-su but amaz. patched it. But there are some other root methods you can do instead, like the offline root method I've linked above or kingoroot. The step1 script will only work, if you are able to call su in adb shell. If that is too much of a hassle, open it up and go the shorting way...
[Fire HD 8 and HD 10 Original Android Development] kmsi:
Hello, i accidentally flashed TWRP recovery image via flashify app on lineageos, and I can't boot into recovery mode now (but still can boot into lineageos). I tried to follow this thread to reinstall TWRP, but ./step_1.sh didn't work, maybe because my device is on lineageos, not fireos. Any idea to reinstall TWRP to my device?

I think backing up recovery.img in flashify app from other unlocked device, and flashing that image would help, as it seems I accidentally blown up some bootloader-related hack. Can someone provide backed-up recovery.img for me? 😉

* Recovery.img back up procedure: Install "Official TWRP App", and run "Backup existing recovery" menu
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
You can download the amonet zip from OP, grab the twrp.img out of the bin folder and flash it with hacked fastboot:

fastboot flash recovery_x bin/twrp.img

If your tablet is rooted, you can flash the image also with dd via adb shell.
[Fire HD 8 and HD 10 Original Android Development] kmsi:
I know it's weird, but it says remote: the command you input is restricted on locked hw.

My bootloader should be unlocked when I installed lineageos before, right?

I think I messed up something with flashify app, but even ./step-1.sh fails on my lineageos-installed device ;(

This is only for the "suez" - Amazon Fire HD 10 (2017) - , your device is a "lineage_suez"

If I remove device check code, then it says:

Spoiler content hidden.

Tried dd if=/sdcard/twrp_suez_3.6.1-9.0.img of=/dev/block/platform/soc/11230000.mmc/by-name/recovery_x via adb shell, but didn't worked. I think it's not an hacked recovery image issue, but somewhat related to bootloader hack.
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
You need to use amonets

sudo ./boot-fastboot.sh

in order to boot into hacked fastboot.

Run the command above, then connect the tablet (make sure its powered off infront the connect).

Then the fastboot flash works... or you can also use the fastboot-step if you like, will flash twrp and boot into it.
[Fire HD 8 and HD 10 Original Android Development] kmsi:
Aha, there's separate hacked bootloader, I see. Thanks for the reply.

Preloader and boot into hacked bootloader worked, but sudo ./boot-fastboot.sh took me into infinite lineageos boot animation and TWRP is still broken. I think broken recovery hack is causing the problem.

Is there any way to flash recovery hack (I think it's related to bin/boot.payload, but I wonder how can I flash it) with hacked bootloader? Or should I open my device and follow unbrick procedure?

Edit: Nah, maybe something's broken, and now I got amazon boot loop. I should try unbrick procedure haha.

Anyway, thank you!
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
About the 'AssertionError: the last partition is not userdata, refusing modification' error, it's because your gpt is already modded. You can try to disable the gpt thing in the main.py...
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Better just go straight to step-2.sh
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
You may have damaged something, the ribbon or something else...

Thats fine

If you've got no flash errors at the fastboot-step, thats fine also.

The black screen doesn't mean that the tablet isn't booting.

This shows clearly that the Android Kernel is up and running...

Problem isn't on the linux side or about the unlock scripts...

Take a close look at the ribbon and so on...

Try to use the boot-recovery script, then take a look if you can use adb shell and check lsusb again.
[Fire HD 8 and HD 10 Original Android Development] likwidchz:
Hiya everyone,

I'm having a weird time trying this. I have two tablets **Both FIRE HD-10's 2017 editions

Tablet 1 = firmware 5.3.7.0 Nov 17th 650601220

Tablet 2 = firmware5.6.6.0 May 14th 654620620

I'm trying to execute the mtk-su exploit. Ive tried the R22 and R23 releases and all of them spit out

Both of the tablets do exactly the same thing, see the output below.

user@OldHPNoteBook:/usr/src/suez/amonet/r22/arm64$ adb push mtk-su /data/local/tmp

mtk-su: 1 file pushed. 3.7 MB/s (65216 bytes in 0.017s)

user@OldHPNoteBook:/usr/src/suez/amonet/r22/arm64$ adb shell

shell@suez:/ $ cd data/local/tmp

shell@suez:/data/local/tmp $ chmod 755 mtk-su

shell@suez:/data/local/tmp $ ./mtk-su

Failed critical init step 4

1|shell@suez:/data/local/tmp $

What's the scoop with the exploit? Let me know if I'm doing something weird.

Thank you,

Take care.
[Fire HD 8 and HD 10 Original Android Development] pascal009:
Been there. The mtk-su vulnerability most likely was patched for these versions. You need to use a different method to get a temporary root before executing step-1.sh. Look here (just the "Root the tablet" part).

3ch01c.github.io/docs/how-to-setup-amazon-fire-hd10.md at master · 3ch01c/3ch01c.github.io

Tools and guides for doing software development, data analytics, online privacy, and other things. - 3ch01c/3ch01c.github.io

github.com

Once you get a temporary root successfully go back to beginning of the amonet OP.

Good luck!