yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
Hi. No, for me kingoroot worked fine, root 9820 took 2 min.

I mentioned that thread, because [MENTION=3061852]gerg004[/MENTION] reports that he used it to root the latest 9920. Maybe you missed his posting to you?

On 5.2.6.4 and higher, the mtk.su is patched, also LK and TZ is updated. That's the reason the script can't get root via mtk.su and from what I've read the brick.sh (to brick via fastboot) is patched too. Without root, the script can't do it's magic, i.e. the non-opening method won't work without root.

You see, the brick is used, by the non-opening method, to alter/damage the preloader. At startup the soc's bootrom tries to run the preloader and if that fails, it stops at the bootrom, can't continue the boot process.

If you open the device and short, you don't brick it at all. You only short it at the mentioned pad. In the end, it's the same here, the bootrom process can't run the preloader, as the emmc isn't aviable while shorting it out.

However, it's necessary to get into bootrom, as a big part of the exploit relies on that.

The OP tells:

If you are already rooted, continue with the next step, otherwise get mtk-su

Since mtk.su is patched (the temp. root solution), only way to continue with the steps is if you already rooted... ;)

For sure you can open the tablet too and do the shorting.

As soon as you complete the OP, mtk-su / kingoroot / or whatever root isn't needed at all.

The OP gains you bootloader unlocked magisk and twrp. Way better than the old root.
[Fire HD 8 and HD 10 Original Android Development] Nosepull:
No, the OP does not say you have to open it, it says you have to brick it, which is a software thing, as far as I understand it.

However, an updated OP for the newer firmwares would be really great, as this thread gets confusing, at least for me. I've rooted lots of Android devices before, but never an Amazon device, and the process is not really clear for me.
[Fire HD 8 and HD 10 Original Android Development] michi1051:
Also errors :-/

127|shell@suez:/data/local/tmp $ ./Matrix /data/local/tmp 2

<WSRoot><Command>0</Command></WSRoot>

<WSRoot><InitResource>0</InitResource></WSRoot>

Decrypt Success: /data/local/tmp/fileWork

Output File Name: /data/local/tmp/fileWork.

<WSRoot><Decrypt>0</Decrypt></WSRoot>

extracting: /data/local/tmp/Bridge_wsroot.sh

extracting: /data/local/tmp/krdirtyCow32

extracting: /data/local/tmp/krdirtyCow64

extracting: /data/local/tmp/libsupol.so

extracting: /data/local/tmp/my.sh

extracting: /data/local/tmp/mysupolicy

extracting: /data/local/tmp/patch_script.sh

extracting: /data/local/tmp/root3

<WSRoot><Decompression>0</Decompression></WSRoot>

execute string: /data/local/tmp/root3 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6ffffffe arg 0x600

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6fffffff arg 0x1

ro.build.version.sdk :22

ro.product.cpu.abi :arm64-v8a

is x64

execute string: /data/local/tmp/krdirtyCow64 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6ffffffe arg 0xd30

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6fffffff arg 0x1

path : /data/local/tmp/

path : /data/local/tmp

[*] path_script:/data/local/tmp/patch_script.sh /data/local/tmp

rm: /data/local/tmp/load: No such file or directory

supolicy v2.76 (ndk:armeabi) - Copyright (C) 2014-2016 - Chainfire

Patching policy [/data/local/tmp/sepolicy] --> [/data/local/tmp/load] ...

libsepol.policydb_read: policydb magic number 00000000 does not match expected magic number 0xf97cff8c or 0xf97cff8d

- Failure!

Unable to open /data/local/tmp/load: No such file or directory
[Fire HD 8 and HD 10 Original Android Development] cyexdeah:
Thanks to k4y0z's guide, gerg004's tip about offline rooting (use it instead of often mentioned temp rooting), VMware+Ubuntu and a bit courage, I can confirm that I managed to root my Fire HD 10, 7th Gen, 5.6.4.0 636559920 (automatically installed Dec 12th), and install TWRP & Magisk.

The intentional bricking made me also nervous, but if you follow the steps, it works.
[Fire HD 8 and HD 10 Original Android Development] roko prc305:
Bootloop?

Hello, I guess I have ruined my tablet, the only thing I see is a white amazon logo and in the lower left corner there is a small arrow that follows the recovery mode. The tablet constantly restart. can someone help me, please?
[Fire HD 8 and HD 10 Original Android Development] Thibor69:
I am trying to regain root and twrp. I have followed the OP guide 100%. I had to open my device

due to my high build number (5.6.4.x). I followed the guide 100% from post #1 / #2, and it all

worked out just fine up until the last part of the guide when you issue the final script.

.

This is

what I did

and

what I got after

the unbricking and received : RPMB Downgrade ok :

.

[ DONE ]Unplug the USB

[ DONE ]Put the device back together

[ DONE ]Reboot the device into Hacked FastBoot Mode

.

The device screen shows - Hacked FastBoot Mode: (0)

So Ih continued with : sudo ./fastboot-step.sh

.

The result is this:

.

fastboot: core/libsparse/sparse.cpp:131: int write_all_blocks

(struct sparse_file *, struct output_file *): Assertion `pad >= 0' failed.

./fastboot-step.sh: line 9: 3698 Aborted (core dumped) fastboot flash recovery_x bin/twrp.img

[root@sysresccd ~/amonet-suez-v1.1.2/amonet]#

.

So I got a FAIL in line #2 .... Why ? PLEASE help me I am just stuck now in Hacked FastBoot Mode.

Thank You all.

.
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
Yeah, I've got the same message, as reported a few weeks ago ;)

It's an error in the included fastboot version.

The fireISO was originally intended for the firestick 4k...

Solution that worked for me: use an ubuntu 18.04 ISO for this last fastboot-step,

and run this commands:

sudo add-apt-repository universe
sudo apt update
sudo apt install python3 python3-serial adb fastboot dos2unix
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

After that, extract the suez amonet from k4y0z, open a terminal in the extracted folder and run the fastboot-step...
[Fire HD 8 and HD 10 Original Android Development] Thibor69:
Awesome - I will try this later today and report back my outcome.

** UPDATE ** - This worked perfectly. Thank you @Sus_i

Cheers

.
[Fire HD 8 and HD 10 Original Android Development] Thibor69:
Working - Root TWRP - 5.6.4.0 build 9920

I just wanted to report on another successful installation of root and TWRP on a Fire HD 10" running the latest FireOS and latest build.

.

[ FireOS 5.6.4.0 Build ...9920]

.

Unfortunately I did have to open the case and short the pcb but it was SUPER EASY to do. I also ran into some misunderstandings with

the guide in the OP but k4y0z has done an amazing job here and I thank him for the guide. Also thanks to @Sus_i for helping me many

times to fully understand the guide and what it does.

Bottom line is if you have a Fire HD 10" and need Root / TWRP and your device is bricked or not, if you follow this guide

VERY CLOSE

you will be able to recover just fine.

Couple Tips:

If you use Fire.ISO it is fine but you

might

need to use Ubuntu for the LAST step in the guide. ## SEE NOTE 01

If you do have to open your device you will need to follow 2 guides ( Post #1 and Post #2 )

If you have to short your PCB it could take 1 try or it could take 25 try's but it is simple and quick

Do NOT try to update Magisk via the Magisk APK or you will boot loop. Only update via TWRP and Magisk20.zip

Be very careful you do not strip the tiny screws on the PCB and watch the speaker wire doesnt get pulled off

## NOTE 01 ##

- If you do end up using Ubuntu to finish the fastboot-step.sh please remember to do this before you execute the fastboot script:

.

sudo add-apt-repository universe
sudo apt update
sudo apt install python3 python3-serial adb fastboot dos2unix
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

.

After you done that:

Extract amonet (from k4y0z OP)

Open a terminal in the extracted folder.

Run the fastboot-shell.sh script

[ DONE ]

If you run into any trouble, just ask here and some nice person will help ... If I am around you can PM any question also.

Cheers

.

THiBOR69

.
[Fire HD 8 and HD 10 Original Android Development] k1ndlef4cker:
what linux distrobution should i use
[Fire HD 8 and HD 10 Original Android Development] Michajin:
This is a live disk, burn it to a USB or CD, boot from it, run the scripts...

Use this , it is set up with everything you need. It works great... It was created by the OP k4y0z

https://github.com/amonet-kamakiri/fireiso/releases

---------- Post added at 10:44 AM ---------- Previous post was at 10:37 AM ----------

I did the whole unlock with the fire ISO. Maybe i updated fastboot from the fire.iso?
[Fire HD 8 and HD 10 Original Android Development] Thibor69:
It seems that for some people Fire.ISO is all you need. For other people we can not get the last script to work unless we

switch to Ubuntu 19.x - As soon as I switched to Ubuntu I was able to run fastboot-step.sh just fine.

.

I guess just try it all with Fire.ISO and if needed then switch to Ubuntu at the fastboot-step part OR just use Ubuntu

from the start. See my post for tips.

.

I DO recommend Fire.ISO though, it makes things very easy.

.

.
[Fire HD 8 and HD 10 Original Android Development] LivinOne:
Are you doing anything before you run brick-9820.sh?

... I'm enabling ADB (testing and it works fine) but it will not Brick (results in quote below).

Thx for the help!
[Fire HD 8 and HD 10 Original Android Development] Michajin:
i don't think it is ruined. What were you doing prior to cause a bootloop? Were you rooted, unlocked, in the process, or what? Can you access recovery (is it stock recovery or TWRP)? Volume up and power will boot into recovery. Worst case you have to open your tablet and do the shorting method, but there are options... Just need some details on what the issue it....
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
You may read his post again, I can't see any sign that a brick-9820 script was used ;)

He did the offline root method (as a replacement for the patched mtk.su) and followed the OP (i.e. follow the type YES + bootrom-step-minimal variant).
[Fire HD 8 and HD 10 Original Android Development] cyexdeah:
I don't know which "brick-9820.sh" you mean. I followed only the steps in the 1st post (after offline rooting with 'Matrix' which I also linked) with amonet-suez-v1.1.2.zip, i.e. these:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
sudo ./step-1.sh
sudo systemctl stop ModemManager # only for >= 5.6.4.0 which my device was
sudo systemctl disable ModemManager # only for >= 5.6.4.0 which my device was
sudo ./bootrom-step-minimal.sh # only for >= 5.6.4.0 which my device was
sudo ./fastboot-step.sh # only for >= 5.6.4.0 which my device was

That's all, no other steps, no alternative files, no step-2.sh or alike. Of course you have to follow the OP instructions as to where you need to plug/unplug. Once in TWRP I could install Magisk as .zip, etc.

Note the original warning in the OP:
[Fire HD 8 and HD 10 Original Android Development] roko prc305:
hello, thank you for your feedback. My build was 5.6.4.0 9920. I have now opened my tablet and short the pcb. For flashing I used the live usb Ubuntu 19.04, everything went ok, Post # 998 from Thibor69 gave me the courage to open the tablet. I have now installed Lineage OS 12.1, :D everything is going well.

Thank you all
[Fire HD 8 and HD 10 Original Android Development] Nosepull:
Another success without opening the device:

Amazon Fire HD10 which has regularly received all Amazon updates (i.e. 9920)

Offline rooting

Soft brick

TWRP

LOS 12.1

all done from an Ubuntu 19.10 computer

...took me not more than half an hour (maximum). Thanks to you all!
[Fire HD 8 and HD 10 Original Android Development] 911medic:
OK, here's my experience getting this unlock done on an updated (9920) Fire HD 10 (2017/Suez). I did NOT have to open the device. Many thanks to k4y0z, Sus_i, gerg004, and others that have contributed to this thread!

First, I successfully rooted the device using the offline rooting method in the first post here. A couple of items regarding this method:

The post says you will end up with a "c folder with 12 files" in it when you have prepared it correctly, and that copying "the files from the SuperSU_18+ folder into the 20165195 folder" would "overwrite wsroot.sh." There was no wsroot.sh file in the 20165195 folder to be overwritten, and I ended up with more than 12 files in my c folder, but had all 12 of the files listed. Everything worked fine.

The post says to "copy all the files from the c folder to the Fire's internal storage (/sdcard)." You actually copy the entire c folder to the tablet, not just the files in it.

Second, with root achieved, even updated devices (so far) can unlock using the OP in this thread, without having to open the device. I had an old Linux machine that I fired up. It was running Linux Mint 18.3. I hadn't used it in quite some time, so I got it fully updated, and went to work.

I installed/updated python3, PySerial, adb, fastboot, and dos2unix as instructed.

I disabled ModemManager as instructed.

I downloaded and unzipped "amonet-suez-v1.1.2.zip" on the Linux machine and enabled ADB in developer settings on the tablet, and connected the two devices via the micro USB cable.

The OP states to open a Terminal in the extracted "amonet-suez-v1.1.2.zip." To clarify, extracting this file leaves you with two folders, amonet and META-INF. You open the Terminal in the amonet folder. (Maybe this is obvious to most, but it threw me off a little bit.)

I ran the step-1.sh script, and after doing a factory reset it detected that I had a version that needed to be downgraded via the temporary brick. It prompted me to type YES to confirm the brick, and the tablet appeared to shut off.

I disconnected the tablet from the Linux machine, and ran the bootrom-step-minimal.sh script.

I then plugged the tablet back in, and waited for it to 'boot into "hacked fastboot" mode,' but nothing happened. I had to hold the power button down to get the device to boot back up. It did not boot back up on its own. (Again, maybe this should be obvious, but it was not to me.)

I ran the fastboot-step.sh, and it hung on "waiting for device." Nothing happened. I remember reading some other posts where people had issues at this point, if their version of ADB was not current. Despite me updating ADB on Linux Mint 18.3, it was NOT the most current version. I upgraded the Linux machine to Mint 19.3, and lo & behold, the ADB version was newer, so I tried the script again, and it worked! The device booted into TWRP, and from there I was able to flash Magisk and boot into an unlocked and rooted Fire HD 10 (2017/Suez).

I have since installed the Lineage 12.1 ROM, and am enjoying a faster tablet with a nearly stock Android experience.
[Fire HD 8 and HD 10 Original Android Development] Thibor69:
## Stuff hidden to compact post - Click to View -

The post says you will end up with a "c folder with 12 files" in it when you have prepared it correctly, and that copying "the files from the SuperSU_18+ folder into the 20165195 folder" would "overwrite wsroot.sh." There was no wsroot.sh file in the 20165195 folder to be overwritten, and I ended up with more than 12 files in my c folder, but had all 12 of the files listed. Everything worked fine.

The post says to "copy all the files from the c folder to the Fire's internal storage (/sdcard)." You actually copy the entire c folder to the tablet, not just the files in it.

Second, with root achieved, even updated devices (so far) can unlock using the OP in this thread, without having to open the device. I had an old Linux machine that I fired up. It was running Linux Mint 18.3. I hadn't used it in quite some time, so I got it fully updated, and went to work.

I installed/updated python3, PySerial, adb, fastboot, and dos2unix as instructed.

I disabled ModemManager as instructed.

I downloaded and unzipped "amonet-suez-v1.1.2.zip" on the Linux machine and enabled ADB in developer settings on the tablet, and connected the two devices via the micro USB cable.

The OP states to open a Terminal in the extracted "amonet-suez-v1.1.2.zip." To clarify, extracting this file leaves you with two folders, amonet and META-INF. You open the Terminal in the amonet folder. (Maybe this is obvious to most, but it threw me off a little bit.)

I ran the step-1.sh script, and after doing a factory reset it detected that I had a version that needed to be downgraded via the temporary brick. It prompted me to type YES to confirm the brick, and the tablet appeared to shut off.

I disconnected the tablet from the Linux machine, and ran the bootrom-step-minimal.sh script.

I then plugged the tablet back in, and waited for it to 'boot into "hacked fastboot" mode,' but nothing happened. I had to hold the power button down to get the device to boot back up. It did not boot back up on its own. (Again, maybe this should be obvious, but it was not to me.)

I ran the fastboot-step.sh, and it hung on "waiting for device." Nothing happened. I remember reading some other posts where people had issues at this point, if their version of ADB was not current. Despite me updating ADB on Linux Mint 18.3, it was NOT the most current version. I upgraded the Linux machine to Mint 19.3, and lo & behold, the ADB version was newer, so I tried the script again, and it worked! The device booted into TWRP, and from there I was able to flash Magisk and boot into an unlocked and rooted Fire HD 10 (2017/Suez).

@911medic Thank you for taking the time to post your results & observations. I am sure it will help many people !!

Awesome !! Lineage is pretty cool. I am glad it all worked out for you.

Cheers

######### NEXT POST ##########

Did you read the OP ? Read

very closely

or you will have a lot of troubles. The file(s) you need are listed there. If you want Fire.ISO do a search in this thread for it. Or just click me

Yes you can.

I dont understand this 3rd question .....

Cheers
[Fire HD 8 and HD 10 Original Android Development] k1ndlef4cker:
So,i rooted my kf using this video:https://www.youtube.com/watch?v=de9faze7kf8 on firmware 5.3.7.0 and how do i flash twrp??

and can i flash using flashify.

THANKS:confused:
[Fire HD 8 and HD 10 Original Android Development] Nosepull:
You read the OP and the last few posts?!
[Fire HD 8 and HD 10 Original Android Development] SacredDeviL666:
Thread Cleaned.

Kindly stop on topic and be respectful to each other.

Forum Rules

Thanks

SacredDeviL666.
[Fire HD 8 and HD 10 Original Android Development] k1ndlef4cker:
Thanks for tell me the rule.I will NOT break the rule

Gửi từ Fire của tôi bằng cách sử dụng Tapatalk
[Fire HD 8 and HD 10 Original Android Development] bizass:
I had the same thing happen.

Fire OS 5.6.0.1 that was previously rooted (Kingoroot) I did a factory reset and tried this method.

Step 1 worked and detected the previous root and continued on.

Step 2 no errors

rebooted into TWRP

installed magisk

rebooted

White Amazon logo boot loop.

The going back to stock options listed in the beginning did not work with TWRP, my guess is they will only work if you can boot into Fire OS.

I installed lineageOS successfully, but the lack of headphones was a deal killer, and it wasn't fully functional yet.

I was able to go back to stock OS this way:

Download the stock bin file from here:

https://xdaforums.com/hd8-hd10/general/firmware-update-fire-hd-10-7th-gen-t3926806

5.6.0.1 did NOT work for me.

5.6.1.0 did.

boot into TWRP

Wipe everything

connect to your PC (I was able to do this in windows 10)

put TWRP into sideload mode

From my PC:

adb sideload update-kindle-40.6.0.5_user_605485120.bin

once it finished, reboot.

Booted into fireOS. I accidentally connected to wifi the first time and it started to download an update, I quick powered it off and rebooted into recovery, TWRP was still there, so I wiped data and rebooted

Next I installed Magisk via TWRP, to get the file there: adp push Magisk-v20.2.zip /sdcard/

Rebooted, disabled OTAs, installed google apps, and debloated.

Hope this helps!
[Fire HD 8 and HD 10 Original Android Development] TonytheEE:
Old Fire HD10 Version 5.3.7.0

Hey Guys,

I'm hoping someone can help out. I've got the HD10 7th Gen. I don't have the 5.6.4.0 that everyone seems to be using here. I just factory reset my Fire (had done some Toolbox stuff to it prior, but I want a pure android experience). It factory reset to v5.3.7.0, so I tried this Root solution: https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595

But I got the Init Step 4 message. Then, I found the brick/unbrick method (This Thread) and got the updated Brick-suez (Page 83 or so) and tried running it.

I'm running the latest Ubuntu in VM. I was able to run scripts, and I see the tablet in the console in ADB Fastboot devices (took some figuring with the VM USB, but I got there). I get into fastboot (which I understand to be restarting to the recovery menu, then selecting reboot to bootloader. No one made it clear up to this point that I saw) and run brick.sh. It detects, and I get the following:

Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)
YES
Bricking PL Header
Check Instructions on device

The Device now says "USB Transferring..."

target reported max download size of 114294784 bytes
Sending 'brick' (112012 KB)...
FAILED (data write failure (Timer expired))
Finished. Total time: 57.169s

The Tablet then reboots normally and I'm back at the Amazon ROM. I was hoping to put Lineage 14 on it. Or at this point, get as far as Root and TWRP.

I rebooted, re-mounted and tried again, but the same thing pops up (slightly different total time).

I have no idea what else to do. No one seems to have had this problem. Do I need to unplug it while I start the brick?

Any help is appreciated. I'd rather not install the OTA updates, then have to crack open the case because of it...

Thanks,

Tony
[Fire HD 8 and HD 10 Original Android Development] stolirocks:
I'm pretty sure you can't do it in a vm. Saw that in this thread somewhere.
[Fire HD 8 and HD 10 Original Android Development] TonytheEE:
I see. Thanks for the prompt reply. Someone on here did say that they did, but maybe they had their VM USB setting different. Bummer. I was so close...

So, I need to make a distro that runs off a USB and boot into it from another PC (or my own...) by changing the boot order, yes?
[Fire HD 8 and HD 10 Original Android Development] daigodude:
Hey all, I'm having the issue where both bootrom-step.sh and bootrom-step-minimal.sh get stuck on "Waiting for bootrom". I'm on a Kindle Fire HD 10 7th Gen which was running 5.3.7.0. I can't get it to continue by holding the power button and I am running those scripts with sudo. When I check with lsusb I still see it come up in bootrom-mode. I was hoping someone could help me out.

Thanks!