yashsingh1/xdaforums huggingface dataset:
[Fire General] JoelleEmmily:
If you're seeing the Amazon logo, the tablet's version of BIOS is loading... if it's dying immediately, that sounds like the bootloader has become corrupted somehow, or the flash memory is damaged or inaccessible. Carefully examine all traces(dark green lines) around everything you put an instrument near... pay extra close attention to the square chip in the same area as a rectangular one, not the big square with the little square. It's close to the power connector. I'm pretty sure that chip is the flash memory. If a resistor or capacitor has been damaged, the unit might work for a short period. Damaged traced don't necessarily have to be completely gouged out, dented or scratched one's can just as easily stop the unit from working.

Check all the cables too. My device refused to boot if I had anything unplugged... I don't know why it thought it needed the camera connected to function, but it wouldn't even power with it unplugged. Even if they LOOK connected properly, check them closely, the connects are so small, and comparatively so long, that even the slightest angle will cause strips to touch the wrong contact. Simply disconnecting and reconnecting can do wounder for making sure those things are seeded properly. If you removed the PCB to get at the pin on the underside, make sure all those mesh contacts are making good contact, and that there's no paper or other debris under there. Also, checking to make sure one of the switches(power, volume, ect) isn't jammed, is worth doing. Finally, make sure nothing's in the CD card cage, even a tiny bit of solder knocked off the bootloader pin, could be enough to cause a short in there, or anywhere for that matter... I good blow never hurt nothing.

If you can't find any physical damage to the PCB, touch the chips while the power is on to feel if they warm more than usual. Normally, they shouldn't heat up too terribly much, especially if the device is dong nothing... but if they've been shocked by static or something, they could warm rapidly... they may also stay cold, but that's less common. Also make sure the contact pad you used to enable bootloader access, hasn't been accidentally pealed up slightly. It might be hard to see, you might need magnification, just make sure you can't see ANY copper in that area. If there is physical damage... these units are really far to cheap to consider running bypasses or soldering new chips on...

If it's software, I'm afraid your options are just as limited. There MAY be a JTAG interface somewhere in the mess of pins, but I haven't read anyone who's isolated them... Without a low level physical connection into the system, you're at the mercy of USB and MAYBE Frankensteining your way into the flash chip... which is not impossible, in fact its rather easy once you get access... but all those tiny little pins are a gigantic pain in the face... Beyond that, there's not much I can suggest... Sorry.

EDIT:

Oh, and run dmesg -w while you connect the USB, it'll show you if the device brings up the interface for even a moment.
[Fire General] ad333:
Thanks for the detailed info. I gave up. 2 out of 3 aint bad :)
[Fire General] Phil750123:
Hi All

First attempt and managed to get it working, just wanted to add a few notes to some troubles i had, hope it helps others.

using ubuntu live cd, couldnt install adb so i had to download the file structure manually (on another xda thread just google it) and copy it over, no big deal but meant i had to put ./ infront of any fastboot or adb command.

Modemanager i had to disable and then stop via cmds

systemctl disable ModemManager.service

systemctl stop ModemManager.service

Tried software version no luck with firmware, did the hardware method. Easy enough, pry around the outside with a thin plastic tool, snap it off. Just pull hard at the heat shield and go around it and if it will come off, its tougher than it looks. Put a metal paper clip, one end on what the diagram shows, the other end touching the metal shrink around the outside. keep it face down and plug in the usb and it worked first time.

I had an error with step 11, when i ran the fastboot command i got an error saying couldnt find fastboot, the issue was the fastboot-step.sh needed editing to put ./ infront of anything that had fastboot (lines 5 6 and 7 from memory) this will be needed on anyone who doesnt install adb/fastboot directly.

Then everything ran fine but got stuck on fire boot screen, had to load back into twrp and factory reset again for it to work.

Hope that helps anyone, but dont be scared to give it ago.
[Fire General] JoelleEmmily:
Could you share a pic of your chipset please? Or copy down the info?

EDIT: And the PCB version number? It's located just above the power connector.
[Fire General] Phil750123:
sadly the chipset numbers have faded off with the heatpads, it isnt a recently brought one, no idea when it was brought though as its for a family member.

pcb is: a1926_mb_pcb_v7
[Fire General] wodgey:
If you copy the ADB/fastboot files into /bin/ (or any other explicitly defined path) then you won't need the proceeding ./

Also, as you're using a live CD, the systemctl disable won't do anything, unless you've configured your usb drive for persistent changes (stuff you do, remains after a reboot). Systemctl stop will be sufficient.

I removed it using apt, on my permanent install but then couldn't tether to my phone mobile data using usb (the clue there is in the name "modem manager" lol)
[Fire General] :
that is confusing af
[Fire General] lfischer:
Hardware method not working with 6.3.1.5

Hi,

I can confirm the errors described by several others in the last few pages, it seems repoducable (unplug usb; start bootrom-step.sh; dis-/reconnect battery; short pin; connect usb).

Output of script:

sudo ./bootrom-step.sh
[2020-11-25 00:02:30.134081] Waiting for bootrom
[2020-11-25 00:04:01.504235] Found port = /dev/ttyACM0
[2020-11-25 00:04:01.534734] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/lukas/Downloads/fire7-9th-gen-lineageOS/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/lukas/Downloads/fire7-9th-gen-lineageOS/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/lukas/Downloads/fire7-9th-gen-lineageOS/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

Serial number: GCC0X808037200EX

Build number: 0003658074244

edit: On closer inspection it seems that the error only appears if the short was not placed properly and dmesg shows the "preloader" device. When the short is there, then no device gets registered (dmesg) at all.

Any updates on this issue?

Thanks!
[Fire General] :
I have some knowledge of rooting, and I have been researching this topic with the hope that my tablet could be rooted until I found this thread. However, I still don't quite understand some of the instructions for this :confused: so if anyone that knows how to do this has the time to hit me up on discord to walk me through the steps( of the software method) I would greatly appreciate it. Discord is NightmareRider#4701. Thanks :good::good::good:
[Fire General] JoelleEmmily:
I believe Amazon has altered their devices' Boot Rom(BIOS) to not load if file system errors are detected. the original hardware method, I believe, relied on the the device entering a recover mode if the flash memory was corrupt or inaccessible. On these new builds, it appears as though, if the device sees any errors, it stops its startup procedures. I don't believe any physical changes have been made to the PCBs, as all tracing I've been able to observe, through other's photographs, I do not currently have an example of an older unit, are identical. Noticeably different however, is that Amazon has seemed to have sourced memory and flash chips from a different company, although the pinouts for these chips are identical to the older models.

It really annoys me that Amazon has drunk Apple's koolaid when it comes to their devices. There is absolutely no need to lock a device and render the root system inaccessible to the end user. It could only generate sales for their device to highly customizable... I also believe this newest modification is in flagrant violation to right to repair laws and legislation.
[Fire General] :
So does this still work? Also if it does , does it work on os 7?
[Fire General] wodgey:
No. Apparently the amonet hack isn't compatible and will cause boot-loops.

I've tried to flash os7 to my device after unlocking and it indeed boot-looped.

I've not tried to revert to stock and flash as I don't want to lose root
[Fire General] JoelleEmmily:
It works on hardware made before 2020, it may not work on early units upgraded after February 2020.
[Fire General] magiccooupons:
This seems about right. I had two Fire 7s (first one I managed to damage the PCB by chipping one of the chips off) and neither one worked with the hardware method, even with trying CLK, CMD, DATA0 as suggested in this post.

Such a shame really, because I ordered a HD 8 one on Prime day as well and didn't realise it couldn't be rooted, at least saw that there was a way to do it for the 7 but didn't really research it properly :/ ah well, cheap as hell so not much lost and will serve their purpose really being dumb Home Assistant controllers.
[Fire General] Fav Fine:
any one know how to get the latest mtk-su arm? Have r23 is there another as on mustang 7.3.1.5 KFMUWi and fails.
[Fire General] Xsavi:
In regards to the low-level watchdog kick the some users are experiencing, I indeed had to remove my battery to get it into bootrom mode. It took several tries, but it ended up working. I have the 2019 version for anyone wondering.

It seems I had to short both solder points to ground. I used a flathead screw driver to make that happen.
[Fire General] NicoSwag:
I'm having the exact same problem, have you been able to fix it?
[Fire General] dragonxpc:
I have an issue when I run: ./bootrom-step.sh

[2020-12-25 23:50:38.673735] Waiting for bootrom

[2020-12-25 23:53:07.913784] Found port = /dev/ttyACM0

Traceback (most recent call last):

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 265, in open

self.fd = os.open(self.portstr, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)

FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "main.py", line 161, in <module>

main()

File "main.py", line 76, in main

dev.find_device()

File "/tmp/amonet-mustang/modules/common.py", line 80, in find_device

self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)

File "/usr/lib/python3/dist-packages/serial/serialutil.py", line 240, in __init__

self.open()

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 268, in open

raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))

serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'

The message in dmesg is the following:

[54151.161858] usb 1-3: New USB device found, idVendor=1949, idProduct=03c8, bcdDevice= 2.23

[54151.161861] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3

[54151.161862] usb 1-3: Product: KFMUWI

[54151.161864] usb 1-3: Manufacturer: Amazon

[54151.161866] usb 1-3: SerialNumber: G0W0XJ08025401AW

[54169.871928] usb 1-3: USB disconnect, device number 8

[54347.921452] usb 1-3: new high-speed USB device number 9 using xhci_hcd

[54348.070494] usb 1-3: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00

[54348.070499] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0

[54348.070502] usb 1-3: Product: MT65xx Preloader

[54348.070506] usb 1-3: Manufacturer: MediaTek

[54348.134204] cdc_acm 1-3:1.1: ttyACM0: USB ACM device

[54348.339386] cdc_acm 1-3:1.1: failed to set dtr/rts

[54348.339487] usb 1-3: USB disconnect, device number 9

How can I fix this issue?
[Fire General] misterthankyouplease:
Hi. First, are you trying SW or HW method? SW has been patched for a while, and recent boards don't seem to allow HW method either. Read this thread back a few pages.

Second, The main issue is your device registering as " MT 65xx Preloader ." This means you haven't accessed the bootrom which is needed for the exploit. This was mentioned in OP, make sure to read thoroughly.

Third, use spoilers to post long walls of text.

Good luck!
[Fire General] misterthankyouplease:
Thanks for the detailed instructions. I recently acquired a Fire 7 2019, and the board is slightly different (see pics). Send to be rev 1.1, and CLK, CMD and DAT0 do not short to BootROM :(
[Fire General] Michajin:
There isn't another one, amazon blocked the exploit....

Amazon Fire HD 10 2019 -- up to Fire OS 7.3.1.0 only
[Fire General] dragonxpc:
Hi, First I couldn't make the method work by sw. I got:

mustang:/data/local/tmp $ ./mtk-su

Failed critical init step 4

This firmware cannot be supported

I'm using the HW method.

Secondly, I going to try again the short, probably it didn't work.

Thanks for the info
[Fire General] bicheondev:
How can I make sure if my tablet was made before 2020?
[Fire General] bicheondev:
I could really apprciate you if you can help me with the hardware method.
[Fire General] jdmillard:
What is the latest here. I have a brand new Fire 7 mustang 9th gen running 6.3.1.5 (Amazon OS build date was February 12 of last year, 2020)

I'm getting this at the mtk-su step:

mustang:/data/local/tmp $ ./mtk-su
Failed critical init step 4
This firmware cannot be supported

Is the mtk-su exploit no longer valid?

Any insight is much appreciated.
[Fire General] misterthankyouplease:
Mtk-su exploit no longer works (if your device came with 6.1.3.5). Hardware method for your device probably doesn't work as well. Amazon smashing our hopes of actually using this device :(
[Fire General] jdmillard:
Sad :(

But thanks for the info.
[Fire General] Pakistaniboy442:
Why Do We Need Linux Dont We Just Need Adb For The Process. ("Its Not Easy For Me To Use Linux On My Laptop")
[Fire General] josephjohnkarl:
Has anyone been able to root the update version Fire 7 9th Gen with OS 7.3.1.5?
[Fire General] -ANDROlD-:
Anyone successfully root Fire 7 9th gen version: 6.3.1.5 with hardware method?

I've only been able to see the usb mount as a preload device but I might not have the best contact on the trace.
[Fire General] plascoch:
I guess that either nobody can help or this is completely dead as no-one has made a reply
[Fire General] Michajin:
MY guess is you are in preloader not bootrom. Run a lsusb (you should see something like MediaTek phone6227) if you see preloader you hav eto keep tryign the short. Seems like the exploit got blocked on these chips possibly. But there is a new development going on that might open up a downgrade.... Regardless you have to find a way to access the bootrom....
[Fire General] Derkaramma:
I literally spent the past two days tearing my tablet apart to get the HW method working after the SW method didn't and I just read that its not compatible with the newer ones or ones that were updated. None of my contacts worked. I just want to use the damn thing 😥😭😩
[Fire General] yarsne33:
Im putting in the virtualbox right now. I would love to recognise If i flash your VERSION, i wont have any problem? If its eu and my smartphone its from Latin America?. I dont thoughts having a special firmware as lengthy that my phone dont ruin.
[Fire General] Mvd120:
Hi everyone,

I'm fairly new to this scene and have a fire tab 7 purchased in November of 2020 running fire os 7.

If I'm to understand this thread correctly, and other similar threads around here, the software root was patched a long time ago and the hardware trick was also patched in the entire line of fire tablets starting in feburary 2020. So this leads me to think that its not possible at the moment to downgrade or flash a custom recovery to this tablet?

Is this true and is there any development ongoing that I can keep a look out for? Thanks!
[Fire General] techboi1902020:
i need help to root mine please anyone

please im despirate i hate fire os
[Fire General] klamation:
Mine was an older one so I'm not sure which version you have; verify your FireOS version with what's already been talked about.

Even if you can't root and install a custom ROM, I think the current models still let you sideload APKs like the Google Play store, so if you can do that and install your own launcher, that could give it a new look.
[Fire General] Michajin:
Unless you bought your tablet pre-February 2020 chances are you don't have root or unlock exploit. Like @klamation said, Changing launchers and play store mostly give you the same as a custom rom. You can also disable bloatware.... Just takes some effort. Doesn't seem like mustang was a big seller so it might be a while before (if ever) an exploit is found....
[Fire General] stickfiretv2020:
Moved to:

https://xdaforums.com/t/fire-7-2020-mustang-brainstorming.4295541/
[Fire General] stickfiretv2020:
Del
[Fire General] klamation:
Unfortunately, I don't have the hardware necessary to test as you're explaining. Curious about the bug though, you might as well try reporting it to the Android project if you believe this affects all AOSP, and not just Lineage.
[Fire General] stickfiretv2020:
Should affect everything in IT not just android. Generic new tool to gain system access with. Also know of two more serious bugs with Nix and Windows but neither are appropriate to talk about here. Need to work out best way to communicate them as they are very major (affects billions of systems...) On this system the android bug can cause this level of brick (i could of bricked it even worse by the bug, was using bug to see if i could get mtk-su working by downgrade to 6.3.1.2 - was thinking it might be software patch for emmc short, much more likely this was hardware patch as well as software)
[Fire General] stickfiretv2020:
was to me.... something todo with best value
[Fire General] o1hitman1o:
I am having the exact same issue. Did you ever come up with a solution?
[Fire General] klamation:
I come from a tech support background, so my first thought is, what did you do that got you into a state like this? If you can provide details, it could help.
[Fire General] o1hitman1o:
Nothing at all. Like in the post from metaplop the device would just not power on one day. It was on the charger and was fully charged. Prior issues were that when it would sit for prolonged periods of time it of no use but charging, it would be in a black screen state and would not turn on with just the power button. I would have to hold left vol and power to boot into TWRP and the reboot into system. This most recent time it had been days before it had been used. I have checked the battery voltage and it does have 4.1v. When plugged in it is recognized as

[10998.804702] usb 1-6.1: new full-speed USB device number 91 using xhci_hcd

[10999.025205] usb 1-6.1: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00

[10999.025206] usb 1-6.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0

[10999.032575] cdc_acm 1-6.1:1.0: ttyACM0: USB ACM device

This is with out even grounding the pin on the board. Not sure if that is an issue or not. I have done it both ways though with the same result.

I have another Fire 7 same model (M8S26G) and I was able to extract the gpt.bin from that one (Attached to this post) with insturctions from this post k4y0z post

I then tried to flash this to the non booting device by adding "flash_binary(dev, "../bin/gpt.bin", 0x0, 0x800*0x200)" to main.py but this is the output, I get to Check GPT and it stops at 3/34 then shows the remainder of the output.

Spoiler content hidden.

Not quite sure where i what it wrong here. i am not sure if the peramiters are correct with what I added to main.py

flash_binary(dev, "../bin/gpt.bin", 0x0, 0x800*0x200)

Maybe k4y0z would have a better idea?
[Fire General] klamation:
That "emmc_write" faiure.... I have a ford Fire 7 that had the same thing that happened, and it turned out the storage was bad. It's currently a brick, unable to boot in any way, so I suspect yours might be heading down that same fate. You could try an "adb shell" from bootloader mode and see if you can do anything on it, but that looks like what I experienced.

Might be time to consider using the trade-in 20% discount, if you want another Fire tablet. Maybe Prime Day discounts would help, like $45 for the HD8, but I think all the current models are unhackable.
[Fire General] o1hitman1o:
I was afraid of that. Thank you for your feedback on this.
[Fire General] stickfiretv2020:
This might be possible if fbtool does what I think, which is to use fbtool to boot into fastboot (it pushes preloader and lk.bin into SRAM or RAM)

Then use fastboot to boot a modified boot.img from microSD, which loads its other partitions like system from microSD.

I.e. you can boot up your Fire using USB to use the microSD to load Android.

Still investigating fbtool though...

https://xdaforums.com/t/fire-7-2020-mustang-brainstorming.4295541/
[Fire General] stickfiretv2020:
They are all brickable by MITM or one click brick though, pretty sure of it.
[Fire General] stickfiretv2020:
I wonder if this might trigger any GPT repair processes in the kernel which then cannot fully execute on a locked OS like Android (.i.e. designed for linux)?
[Fire General] Bandor:
Hello,

i tryed to root my fire 7 gen9 with the software method.

- It print "Waiting for the bootrom" (#1 Nr.5)

- Then i type "reboot" (#1 Nr.6)

The display remain black.

Now i can not power on the fire 7.

I tried the hardware methode (i open the fire and connect the proposed point with the ground; This tread #22 https://xdaforums.com/t/root-fireos...g-method-working.3937209/page-2#post-79683131).

But i still can not power on the fire 7.

What can i do?
[Fire General] Cowbouy:
cant download the mtk-su_r22 or 23 or even r21 can anyone help
[Fire General] Bandor:
I can download it without any problems.

With the link from #1

https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213

Then scroll down a little bit and click on the link "Release 23"

See on the picture.

Is this what you mean?
[Fire General] Cowbouy:
thanks
[Fire General] axiolite:
If you haven't already sorted it out, disconnect the battery and try the hardware method from the very beginning.
[Fire General] slacka123:
@xyz`

Can you please update the instructions to add a link to

twrp-mustang-3.3.1-0.zip

https://xdaforums.com/amazon-fire/orig-development/recovery-twrp-touch-recovery-fire-7-t3949114

I've been using it for over a year now. It adds backup and recovery options that I've found to be useful. Other might benefit like @thebigphatmaster who are having problems backing up without it.

https://xdaforums.com/t/rom-testing-mustang-lineage-16-0-12-mar-2021.4234211/page-3

Thanks!
[Fire General] thebigphatmaster:
I'm retrospectively grateful for this!