yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] sga999:
As I mentioned above, I made two changes to stop OTAs. However, one did download today. But it has not installed, even though I have rebooted several times and have left the tablet idle at times. So are you saying you do not believe those two things are sufficient to stop it from installing? They did not prevent it from downloading which surprised me, so I asked a question about that in that post above.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
That's what I'm referring to, maybe the otacert.zip needs to be dealt with, too, to prevent OTA downloads in the first place.
[Fire HD 8 and HD 10 Original Android Development] SiggiBartman:
Fire 10 won't boot in fireos

I followed this guide and got TWRP working and booted, but when i chose reboot to system my Fire 10 won't get past the Amazon Logo. I tried to install the prerootet stock image and it failed (it hang up at a point). I can boot in twrp at any point, but i can't boot in fireos.
[Fire HD 8 and HD 10 Original Android Development] sga999:
I actually don't mind if it downloads the update since I may need it in the near future anyway. But I sure don't want it to automatically install!

---------- Post added at 10:33 PM ---------- Previous post was at 10:21 PM ----------

I finally got this to work, but not with Linux Live USB creator (LiLi). I found some instructions that told me how to use mkusb while running the non-persistent Ubuntu system. It was a bit of a long, tedious procedure. Then I rebooted that newly created system, and now the menu did show the option to boot the persistent Ubuntu.

I don't know why it didn't work for me with the simpler method (LiLi tool) . I was using the latest version of Windows 10, LiLi tool, and Ubuntu 18.04.2 (I tried several other Ubuntu versions also). Maybe successes were on a different Windows version? No idea.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
I didn't mind it downloading, either, if it didn't delete itself and I could pull the file for [MENTION=8165603]DragonFire1024[/MENTION] to look at.

Strange that LiLi didn't work. I'm using the latest build of Windows 10, too, and Ubuntu 18.10. Worked on the first try.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
You can actually change the certificate in otacerts. Whether it works or not idk. for example copy /system/etc/security/otacerts.zip form the fire 7 custom rom, (or any custom ROM) and replace it on your tablet. The thing is, the original certificate doesn't even match the ota certificate used to do updates. In secure settings, the update certificate matches the generic test keys used to sign most custom ROMs and their otas. Amazon put a 'release key' as their otacert. However it does not match the known public key. So I'm not sure what's going on in that folder.
[Fire HD 8 and HD 10 Original Android Development] sga999:
The OTA file did not delete itself in my case.

This "Universal USB Installer" did create a persistent system for me, while the one in the howtogeek link did not. It's simpler than the mkusb method that I mentioned earlier.

https://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/
[Fire HD 8 and HD 10 Original Android Development] DB126:
Rename DeviceSoftwareOTA.apk (eg: DeviceSoftwareOTA.old). Same time tested method that has been used since FireOS v3 (2012).
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
I did not think of that, thanks!
[Fire HD 8 and HD 10 Original Android Development] Sc4r3Crow:
Hey guys,

I have some problems with flashing TWRP. In my case I've used Oracle VM VirtualBox and Ubuntu 18.10 to start a Linux system. Everything worked fine until point 3. of flashing instruction, it started but has never been completed.

Is there any other way to flash TWRP?

Thanks in advance...
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Use a persistent Linux live environment. It's mentioned a few times in the past few pages.
[Fire HD 8 and HD 10 Original Android Development] Sc4r3Crow:
Thanks alot, it worked now :good:

Now I'm ready for a custom rom... ;)
[Fire HD 8 and HD 10 Original Android Development] sga999:
I'm confused. I mentioned 2 things to stop OTA's from installing in posts 312 and 315, and the renaming method was one of them. You seemed to say you knew those, and then mentioned another way. So I guess you didn't understand what I was saying.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Yeah, I knew of renaming the otacert, not the specific file he mentioned. I think that part went over my head.
[Fire HD 8 and HD 10 Original Android Development] DB126:
No need to screw around with the cert file.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I didn't think so and misunderstood the question. I'm not even sure in the case of Amazon tablets, that cert is even used for anything.
[Fire HD 8 and HD 10 Original Android Development] Sc4r3Crow:
I've wiped Dalvik and Cache before booting to system. Everything worked as it should...
[Fire HD 8 and HD 10 Original Android Development] ganjamu:
Can I use a live usb on my mac to root the device?
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Guess I was misinformed.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Not really. In a normal Android environment I think that certificate would handle an update passed through adb sideload or when a carrier sends an update. Since Amazon uses their own recovery, that certificate doesn't matter. I imagine their certificate is the amz.rsa which without looking, I think is in the same directory.
[Fire HD 8 and HD 10 Original Android Development] DB126:
Plenty of guessing takes place around this and most other Amazon devices. It is easy to be misinformed given the number of misinformed informers.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
[MENTION=7104332]k4y0z[/MENTION] I can't find the replies ATM, but did you look into the 2nd bootloader at all?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
I told you, there is no second bootloader!
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
So the files are lying? So the two I pulled from the device don't exist either? Because I looked right at them both. Kinda hard to do for something that doesn't exist.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
If you are talking about boot0 and boot1 I have explained to you before what these are.

Just because they are called bootX, doesn't make them bootloaders.
[Fire HD 8 and HD 10 Original Android Development] zdev:
Will this guide work on a Fire HD10 (suez) that has been OTA updated with the latest ROM (version 5.6.4.0) from Amazon? Has anyone tried this guide on 5.6.4.0 ?

Thanks
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
When did that update come up? I thought .34 was latest. Guess that Amazon rep wasn't wrong after all.
[Fire HD 8 and HD 10 Original Android Development] zdev:
The Build date is March 28, 2019, 8:50 PM. I don't know when the actual OTA and install happened.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
Those sneaky bastards. Wonder what the changes were.

Still no update here:

https://www.amazon.com/gp/help/cust.../147-2619392-9231712?ie=UTF8&nodeId=202194760
[Fire HD 8 and HD 10 Original Android Development] DB126:
Seen this movie before: https://xdaforums.com/hd8-hd10/deve...-optimized-stock-rom-hd-t3917901/post79298615
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Did you even pull them? Or bother to look? I don't care what boot whatever says. I care what the build file says. So if you don't even intend on looking at any of it, then not sure how you're so convinced I'm wrong. But that's ok. I know what I saw and I know what's in there. But none of that exists either right.

---------- Post added at 07:08 AM ---------- Previous post was at 07:07 AM ----------

If all you've got are insults, take it somewhere else.

---------- Post added at 07:33 AM ---------- Previous post was at 07:08 AM ----------

I want to look at this firmware. If my suspicion is correct, we're getting Miracast...the old school one. The one I've been trying to get working since my first day here. Now that we have access to the kernel, and had a chance to get it working on our own, they pull it out of a hat. The timing of this update fits in perfect line with their Miracast announcement too.
[Fire HD 8 and HD 10 Original Android Development] diplomatic:
Yes, you can bet that he did. Those partitions/regions are central to the boot-ROM exploit. Did you even bother to learn a little bit about how that exploit works? You can be sure that k4y0z knows the storage structure of this tablet inside and out. Why does it matter if one file mentions something that doesn't exist on this particular implementation? Software is never 100% neat and tidy and efficient. There is no harm in referencing a non-existent partition, so no one bothers to clean it up. You're just making some assumptions based on seeing a single mention of something, and then just running with those assumptions.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Oh I've learned plenty. I've learned a very valuable lesson around here to which I'll keep to myself. Perhaps that's what I should have done a long time ago in general. For a second time I've pulled these non existent partitions. So I'll ask someone else somewhere else. I have plenty of other things to do in the mean time. One lesson learned is when someone spends an extensive amount of time telling you you're wrong, it's generally the opposite. So yes I have learned a lot about the exploit. More than I wanted to and wish I hadn't. That's when I saw the real picture. But that's ok. What goes around comes around.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Trying to unbrick my other tablet. It gets to the GPT and spits out a small error..."what happened to your gpt' or "where is your GPT." Im stuck there.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Your GPT is probably corrupted, you need to flash a new one.

You can grab one from one of your working devices:

adb shell su -c \"dd if=/dev/block/mmcblk0 bs=512 count=34 of=/data/local/tmp/gpt.bin\"
adb shell su -c \"chmod 644 /data/local/tmp/gpt.bin\"
adb pull /data/local/tmp/gpt.bin bin/gpt.bin

place it in amonet/bin/gpt.bin

and replace amonet/modules/main.py with the one attached.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Thanks. Will report back the results or lack of them, in an hour or so.
[Fire HD 8 and HD 10 Original Android Development] c6z06vette:
Got root, TRWP up and running, then installed Magisk.....big shout out and thanks:highfive:

I'll delete my wifi settings before I reboot. But have two simple questions:

(1) What's the method to boot to TWRP (Power button & Volume Down at same time)?

(2) What folder are the APK located in? I suppose now I can download Root Browser or another APK to modify the files as well.

Time for some happy tweaking......but really looking forward to a unloaded bootloader like the rest of this group:laugh:
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
1. volume up and power buttons

2. If you're talking about the files in the root directory, those are part of the boot.img. you will need to learn how to get your boot.img, unpack, edit and repack it. Just because we are unlocked, doesn't mean we can't still screw a lot up. Be careful but have fun. You can do A LOT of things with a boot.img, including screwing up.
[Fire HD 8 and HD 10 Original Android Development] DB126:
Huh? Look in system/priv-app/devicesoftwareota folder.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
You were right [MENTION=7104332]k4y0z[/MENTION]. The GPT was messed up. After that step, the whole thing finished. However, the automation stops there. I had to manually type out the rest of the steps and even then it kept rebooting to hacked fastboot. Then I thought...the initial problem is solved so I switched back the two files I moved earlier per your request, and it fixed the rpmb. when done, fastboot wiped data, flashed boot and recovery. Fastboot rebooted to recovery, and it worked. Back to stock and the unlock process finished beautifully. Thank you so much ?????
[Fire HD 8 and HD 10 Original Android Development] c6z06vette:
Thank you both......

Just got all my Android apps running and no Kindle files....now some Prop Build tweaking
[Fire HD 8 and HD 10 Original Android Development] saturated:
Have you or anyone else tried this root and unlock method on 5.6.4.0?

Seems mine updated over night automatically after my first boot. It had asked me if I wanted to update and I said no so I thought it would stay 5.6.3.0 but I guess it still will update itself while idle :/
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You can try if it still works on 5.6.4.0. If it doesn't you can still use the unbrick-procedure in Post #2 to unlock
[Fire HD 8 and HD 10 Original Android Development] sga999:
In this other thread, someone says the offline method worked. See post 177. That doesn't mean this method would work, but it is likely that it would. I don't think many have received this OTA yet, so various methods have not been attempted.

https://xdaforums.com/hd8-hd10/general/hd-10-2017-offline-rooting-t3734860/page18
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
If mtk-su still works on 5.6.4.0, then the unlock should also work.
[Fire HD 8 and HD 10 Original Android Development] sga999:
That thread did not deal with the mtk-su method of rooting so we won't know until someone tries. I guess I am just going on a feeling that it would work since another root method works. That's probably not a good thing to assume.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
If you reboot before wiping or whatever, Google 'rooted activity launcher' download it and see if the it's is still in the app, DeviceSoftwareOTA. If so, go to data/data/DeviceSoftwareOTA and see if there are any bin files in that folder. If so, mind grabbing that ota for me?
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
Can some with twrp catch a link to 5.6.4.0? I finally have a reason to bother backing up and installing twrp ! :D
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
You have a better chance at grabbing the file(s) through the apps database in data/data. With a root activity launcher, you can actually launch the OTA app and control when it downloads and when it installs. Though I don't know if that overrides the automated part or not. You can look for a file like 'smart_battery.xml.' it's nothing to do with a battery. It will stop OTA app from persisting on the internet. Just put a _ after the .xml.
[Fire HD 8 and HD 10 Original Android Development] massimo727:
Testing root access...

uid=0(root) gid=0(root) groups=1000(system),1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),2000(shell),2001(cache),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0

PL version: 5 (5)

LK version: 3 (2)

TZ version: 264 (263)

TZ, Preloader or LK are too new, RPMB downgrade necessary (or brick option used)

Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)

YES

Bricking preloader

8+0 records in

8+0 records out

4096 bytes transferred in 0.004 secs (1024000 bytes/sec)

Flashing LK

[100%] /data/local/tmp/lk.bin

794+1 records in

794+1 records out

407012 bytes transferred in 0.030 secs (13567066 bytes/sec)

Flashing TZ

[100%] /data/local/tmp/tz.img

6952+0 records in

6952+0 records out

3559424 bytes transferred in 0.265 secs (13431788 bytes/sec)

6952+0 records in

6952+0 records out

3559424 bytes transferred in 0.300 secs (11864746 bytes/sec)

Rebooting..., continue with bootrom-step-minimal.sh

What's the next step? I can't get the tablet to turn on.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
It tells you the next step at the end. Do ./bootrom-step-minimal.sh

---------- Post added at 12:40 PM ---------- Previous post was at 12:37 PM ----------

I am having some weirdness that I've not had before, until the latest posted FireOS. Sometimes when I reboot, more so after installing an app into system, the tablet will hang at the orange fire logo. However if I reboot to recovery from that, then flash my boot.img, everything boots fine.
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
"Latest posted"? 5.6.4.0?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Interesting, are you on 5.6.4.0 ?

Seems they updated LK and TZ

Yes, do as [MENTION=8165603]DragonFire1024[/MENTION] says.

Interesting maybe is that the boot.img from 5.6.4.0?

Try getting a logcat to see what is happening.
[Fire HD 8 and HD 10 Original Android Development] Iv0:
well I dunno if it maybe helps someone but I've managed to root the latest FireOS Update (5.3.6.4).

Received my FireHD 10 yesterday and enabled flight mode after downloading the newest version and it updated itself bcs I wasn't at home for a few hours. (yes, shame on me... as you can imagine I was really p*ssed off...)

As I didn't find any clear info if your tutorial also works with the newest version, I thought "f*ck it", let's give it a try and I started with your tutorial (btw. thanks a lof for the great work :cool::good:)

I started with

sudo ./step-1.sh

and I got the message that I'm using a new version and that I should type YES to proceed... so I did it.

It loaded everything but did no factory reset but a reboot.

All I got now was a black screen, nothing else.

As your post#2 (https://xdaforums.com/showpost.php?p=79169423&postcount=2) recommended I checked if I got a connection via USB and yes, I was lucky, so I followed your tutorial again.

Once rebooted my FireHD bootet into TWRP and I flashed Magisk.

After another reboot it made a factory reset via TWRP on it’s own and everything’s running fine!

maybe it help’s someone, maybe at least not to be as stupid as me :angel::angel::D
[Fire HD 8 and HD 10 Original Android Development] GuyInDogSuit:
So we're clear, we're talking about yet another new update? That went from "5.3.6.4," to 5.6.4.0? Or did they just fix the version numbering finally?
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
It looks like RPMB clearing via bricking became necessary less than a month after the unlocking tool was rolled out! :D It's a great thing it's a part of the original code!!!

It feels the scripts need to be more self-explanatory about what will happen after bricking - i.e., totally black screen, and BootROM script required. Otherwise it's not clear from the output that something out of ordinary is about to happen, and most importantly, what to do next. Sometimes these are users totally new to the subject, so there is no pre-existing idea about BootROM/RPMB/etc ;)
[Fire HD 8 and HD 10 Original Android Development] dickersen:
Can you provide me with a copy of the gpt.bin you used? Mine is messed up as well and I don´t have a second tablet to extract it from.

--- EDIT ---

Nvm mind. I managed to run the unbrick procedure after removing the modem manager from my Ubuntu setup. Thanks for the hard work guys.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
Yes, do as [MENTION=8165603]DragonFire1024[/MENTION] says.

If it happens again I will try.

---------- Post added at 01:42 AM ---------- Previous post was at 01:24 AM ----------

One more to unbrick. This one maybe a lost cause. One error "read fail. Can't read EMMC."
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I've been trying to get supersu to work properly on these things. We can't flash it unless you use the modified version on the stock rom thread because we aren't quite 64 bit yet. Flashing the standard zip will bootloop. So I've been experimenting with a totally manual install, including rooting the boot.img so when the apk is installed it doesn't perform the auto install embedded into it. So far, though I don't really know yet, it appears to be a success. One of the issues, I think, was the installation of the 64 bit library file. Either it install it, but in the regular lib folder, or doesn't install it at all or does install but doesn't set proper permissions (guesswork). So I added the necessary files by unpacking and repacking the boot.img. This is not a final version. If anyone is interested in trying it out I can upload the boot.img.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You weren't lucky, the preloader was intentionally bricked, to put the tablet in this state after you typed "YES" to confirm.

The script then tells you to proceed using "bootrom-step-minimal.sh".

Although if you used "bootrom-step.sh" that also works, it just does more steps, that aren't needed and the chance of it failing on the first try is greater.
[Fire HD 8 and HD 10 Original Android Development] massimo727:
I believe I was on 5.6.4.0 [MENTION=7104332]k4y0z[/MENTION] .

This doen't mean I have to open the tablet now...does it?
[Fire HD 8 and HD 10 Original Android Development] DV8:
Can anyone tell me what the differences are with 5.6.4.0? I have my tablet kinda where I want it but if miracast is in the lastest release I will go through the process of rooting all over again.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
No, just follow the instructions.
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
I haven't found the update .bin yet so I can't take a peek
[Fire HD 8 and HD 10 Original Android Development] massimo727:
Thanks for the guide, was able to finish it. Anything I can do to make the tablet more google based?
[Fire HD 8 and HD 10 Original Android Development] BeniS98:
I also performed that step and executed the bootrom-step-minimal.sh. All what i got is a "waiting for bootrom", also after minutes. The tablet is completely dead, i cant turn it on or sth. Does this mean it's definitely bricked now and I can throw it away?
[Fire HD 8 and HD 10 Original Android Development] Michajin:
Something was screwed up in my old SU binary, i installed SUPERSU, did a complete uninstall from settings. I was getting a binary occupied every time i opened it. after the uninstall i got a no root present. Then went back to TWRP, flashed the magisk 18.1 and all good. I did uninstall

com.amazon.kindle.kso

com.amazon.device.software.ota

com.amazon.kindle.otter.oobe.forced.ota

(i should have disabled) last week and it is blocking updates still, is there any full system img's that i can restore full stock and maybe clear up all the crap? Thanks for you help! Anyway to put these back on and disable them?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Yeah, you should be able to just install the 5.6.3.0 update-bin through TWRP (rename it to .zip), do a factory reset and reinstall Magisk
[Fire HD 8 and HD 10 Original Android Development] bibikalka:
[MENTION=7104332]k4y0z[/MENTION]

First of all, thanks again for dedicating your time to this undertaking! The unlocking procedure looks clean and elegant, very professional! We have come a long way from the early days of messing around with Kingoroot! And, Ubuntu for all noobs out there ;)

The need to repartition takes a bit of pre-planning for me :D I shall dust off Flashfire to backup /data which I can then restore via your twrp.

Are there any kernel mods one could do right away without recompiling it?

Also, I noticed only preloader version changed compared to FireOS 5.5.0 (hence bricking during a downgrade for [MENTION=3497316]retyre[/MENTION]), can I then keep my older preloader+TZ, but use your proper LK?

Twrp seems to have lots of tweaks to maintain this unlock, I hope it's well tested in those areas ;)