yashsingh1/xdaforums huggingface dataset:
[Fire General] colossalpause:
Hi there,

I'm working through the hardware method, but I keep running into a runtime error every time I run ./bootrom-step.sh:

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/ubuntu/Downloads/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/ubuntu/Downloads/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/ubuntu/Downloads/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

I've tried disabling and uninstalling modemmanager, but no luck so far. I've tried grounding the circled piece with a paperclip, but that doesn't seem to be working. Could anyone provide any assistance? Thanks in advance!
[Fire General] piepre:
Hello,

I tried the software method on a new device (correct firmware), after typing "reboot" I got nothing in the bootrom step :( (cannot see the the device with lsusb or dmesg), so I opened the device and tried the hardware method without success.

There are not entries in dmesg, when I plug in the usb cable (tried with and without connected battery). I tried Ubuntu (installed on my PC and Laptop), Sysrescd (Live CD) and Debian Buster (my server). Is there another pin I could try to short?

---------- Post added at 11:20 AM ---------- Previous post was at 11:17 AM ----------

you should start bootrom-step.sh with sudo:

sudo ./bootrom-step.sh
[Fire General] colossalpause:
Hey, thanks for getting back to me. I should have clarified that I was using sudo, my apologies. Just in case, I went in and tried again with sudo to be sure with no luck.
[Fire General] Michajin:
There is some suspicions that amazon or mediatek removed the bootrom option from newer devices. how old is the device, what fireOS are you on? are you using a live disk or bootable linux?
[Fire General] colossalpause:
I picked up the tablet new about a week ago, and it's running Fire OS 6.3.1.5. I'm using Ubuntu on a live USB.
[Fire General] Michajin:
well you could only do the shorting method (if it works). You see "waiting for bootrom" in the terminal and what does the tablet do you plugging in during the shorting?
[Fire General] colossalpause:
Hey, thanks for helping out. Whenever I plug it in, this is the output:

[2020-05-25 18:38:37.295788] Waiting for bootrom
[2020-05-25 18:40:29.831912] Found port = /dev/ttyACM0
[2020-05-25 18:40:29.867044] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/ubuntu/Downloads/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/ubuntu/Downloads/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/ubuntu/Downloads/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
[Fire General] Michajin:
That tells me it sees something, either preloader or bootrom. You would would just have "waiting for bootrom" if no device was seen. lINE 84 IS THIS

def check(self, test, gold):

if test != gold:

raise RuntimeError("ERROR: Serial protocol mismatch")
[Fire General] colossalpause:
Gotcha, thanks. Any recommendations for how to proceed? Really appreciate your helping out with this.
[Fire General] diegoalefe:
This is happening with me also, same erro (message and lines) and also Im in the latest software 6.3.1.5

---------- Post added at 12:55 AM ---------- Previous post was at 12:14 AM ----------

I checked the variable values

test = b''

gold = b'\x00\x01'

thats why it do not pass, but I dont know how to make test be like gold in order to function work
[Fire General] ali ba:
Has this been confirmed?

I just received a new Fire 7 and no amount of shorting could move past the "Serial protocol mismatch" error.

Tried with various points labeled CLK, CMD or DAT0 on the back of the PCB.
[Fire General] DB126:
There have been no positive reports from those attempting short method on recently acquired devices. Data points are stacking up in the wrong direction.
[Fire General] Vinsanity_52:
Im having the same issue. I have two of these tablets. One worked with the short method and the other one gives me this error

Edit: CLK on the back of the motherboard worked for the tablet with the error
[Fire General] colossalpause:
Awesome, glad to hear you got it working. Where is CLK on the back? I haven’t been able to spot it.
[Fire General] ZeepXanflorp42:
Bummer. I should have gone through the whole thread before attempting this. I got a refurb Fire 7 2019 last week from Amazon as a replacement for an old 2017 (2 yr warranty). I first went through the mandatory Amazon login/registration to enable dev mode and usb debugging then immediately did the software method hoping to avoid opening the device. I experienced what many have noted where issuing the reboot command as root makes the device unresponsive. I then switched to the hardware method and tried with the pin at the front of the motherboard and the "CLK" and "CMD" pins at the back. There's no changes in either lsusb output or dmesg log when plugging in the device. I've tried on both a dedicated Ubuntu machine and through lubuntu liveusb on a different machine. As a sanity check I tested several USB ports and other devices and made sure lsusb and dmesg pick up other usb devices.
[Fire General] Vinsanity_52:
So when you open up the tablet you'll see the top side of the motherboard. The CLK pin is on the back of it. You have to unscrew the mother board and disconnect the ribbon cables to flip it over.
[Fire General] lllsondowlll:
Mind telling us what ribbons to remove? Atleast one of them is orange and attached to a chip that appears to be glued down, and there isn't any slack to flip the board. Can you be more specific?

[IMG="Fire HD 7 Board"]https://i.imgur.com/6RaSVvC.jpg[/IMG]
[Fire General] Vinsanity_52:
Sorry, kinda left out the magnet at the top attached to the red and black wire with no slack. So there is two options for that. You could either de-solder the wires from the mother board, or do cut a small piece of the frame so you can remove the motherboard. I didn't feel like going with the soldering method, so I removed the small piece holding some of the wire in place. I don't really understand the point of this besides not allowing you to simply remove the magnet. There are some hooks that keep the wire in place along with the piece of the frame. Also the magnet is held by double sided tape which held its adhesiveness when I took it off an put it back in its slot and it stayed in place.

1. To start from the top remove battery, and the easy to remove ribbon cables(the screen and the main camera).

2. Remove screws that are holding the mother board in.

[IMG="Ribbons and screws"]https://i.imgur.com/SHdpqV0.jpg?1[/IMG]

3. remove glue holding the magnet wires in place.

4. take a sharp knife(I used a Swiss army but I think a xacto knife could work as well.) and cut away the tiny piece holding in the wires.

5. remove magnet with a pry tool.

*note: you can just unsolder the leads next to the screen ribbon cable.

[IMG="Frame remove"]https://i.imgur.com/0rUl6b4.jpg[/IMG]

6. There are friction locks holding the board in place. use a pry tool on the bottom ones near the charging port and buttons.

[IMG="firction locks"]https://i.imgur.com/MN5FpWr.jpg[/IMG]

7. Remove mother board by sliding it toward the charging port/buttons. The motherboard should come free.

8. flip the board over and apply a short to CLK and GND. you dont need the battery for the short step. If CLK doesn't work, try CMD or DAT0.

[IMG="CLK"]https://i.imgur.com/Ifzikue.jpg[/IMG]

9. If you don't see the error, and you get "Reboot to unlocked fastboot" at the end, then congrats it work!

10. before running "sudo ./fastboot-step.sh" disconnect the usb chord so you can flip the board back over, and reconnect the battery.

Hopefully that helps! let me know if there's anything else that wasn't clear.

Edit: not sure if the photos posted right. Here is the link for the photos. https://imgur.com/a/IfHfQMz
[Fire General] gil_happy:
Today I tried following this post (using the software method) on a Fire 7 I received today (9th generation on 6.3.1.2), I had the 2 shells open on my PC (one for the 'adb' commands and the other to run the sudo ./bootrom-step.sh from the amonet-mustang.zip).

When I ran the ./bootrom-step.sh, I did receive the "Waiting for the bootrom" prompt and it still shows that. Then I typed 'reboot' (after performing all of the original steps) from the first terminal (the adb terminal) and when then happened, I heard the USB disconnect noise from my PC and then the Fire 7 turned off. It will no longer turn on no matter how long I hold the power-on button.

A couple of things:

- Which terminal window should I have seen the 'dmesg' or rather which window should I have run the 'dmesg' command?

- What is the next step or how do I fix? My tablet seems like it is currently 'dead'

Thanks in advance!
[Fire General] crenntive:
Ok so I followed the directions on the first post. I get to the part where I apply the dd changes and reboot the device via ADB unfortunately after that the device will not actually boot back up. Thinking this was a fluke I followed the directions again and did them by hand this time. now I have 2 tablets that will not boot at all. No detection by the scrip or adb and no display at all . I did the normal hold power for 40,30 and 20 seconds with and without the power attached and even holding the volume up or down buttons. still nothing. Have I just perma bricked my new tablets ? Any help welcome. TIA
[Fire General] wodgey:
I believe the "software method"stopped working many months ago and the only option is the hardware method (shorting to ground, one of the data\clk traces). I haven't had to perform this method though so my knowledge is only from what I've read in this thread.

I also believe, from reading this thread, that the pins mentioned in the original post no longer work, instead having to use traces on the back of the motherboard.
[Fire General] Klerrtery:
Today I tried again, this time i tried to short each of the CLK/CMD/DAT0 points to ground on the back on the PCB. Still no luck.

I'm going to give up for now.

I will wait for a new linux kernel exploit that could be used for the software method.
[Fire General] lovetocode999:
Does anyone know of any pins that still work for the hardware method on newer Fire 7s? I just ordered a new Fire 7 from Amazon and would like to root it, which is why I am wondering :)
[Fire General] Ian1331:
Another new tablet hard bricked... Tried software method and got it to "reboot" to a black screen but the script didn't recognize it. Tried the HW method now with the suggested pin, CMD, DAT0 and CLK points but nothing brings any activity. Nothing on the screen, nothing in lsusb or dmesg. Completely unresponsive in Linux and Windows. The script never goes past "waiting for bootrom". I've also tried lubuntu and Linux mint on 2 different laptops and 2 different usb cables. I've had the battery disconnected overnight with no change.

If anyone has any wild ideas it's pretty much ready for the trash.
[Fire General] DB126:
If new from Amazon return as 'defective' for a courtesy exchange.
[Fire General] Ian1331:
Yeah its only 2 days old but I had to cut the plastic frame for the magnet lead and whatnot. I guess they ain't checking. Good call tho, I'll fire up an exchange and wait on a more reliable method.
[Fire General] DB126:
Don't count on that "more reliable method". The days of easy root on modern (Android based) devices are over as anyone watching the actions of Google and hardware manufactures can attest. Optimists see a 'pause' as they plead for help from (cough) magical developers; reality suggests otherwise.
[Fire General] shell79:
boot loop after fastboot-step.sh

I have two devices. The first one worked perfectly. The second one got stuck in boot loop.

bootrom-step.sh works.

fastboot-step.sh works.

No errors till now. But now i get a boot loop. It only shows the amazon logo and reboots. I've done all the steps twice (hardware method) but i don't have any progress. Anyone have an idea?
[Fire General] Michajin:
Did you flash anything in TWRP?
[Fire General] shell79:
Never saw TWRP. i ran the two shell scripts and i got the boot loop directly after the second script.
[Fire General] Michajin:
did the fastboot.sh script say success?
[Fire General] shell79:
Yes, both scripts ran without any error.
[Fire General] Michajin:
Are you unlocked, TWRP installed and rooted?

---------- Post added at 04:33 PM ---------- Previous post was at 04:32 PM ----------

Xposed works for anyone insterested...
[Fire General] Michajin:
Are there any plans to get TWRP to back-up and restore?
[Fire General] xyz`:
Not from me, nope.
[Fire General] Michajin:
ok thanks... thanks for your help again.
[Fire General] mrmazak:
you can most likely use dd from twrp terminal to make backups if desired. Also should be able to use a script to do it. Much like the one in this post.

Backup with script and temp root
[Fire General] Michajin:
I'll give it a try, Thanks!
[Fire General] wlewin:
sorry, just seeing this. Yes, yes and Yes.
[Fire General] tangledweb:
Hi All,

I'm getting stuck at the following section, I've tried restarting the process but no avail:

[2019-07-13 18:29:13.839961] Waiting for bootrom

[2019-07-13 18:29:28.651393] Found port = /dev/ttyACM0

[2019-07-13 18:29:28.652066] Handshake

[2019-07-13 18:29:28.652945] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-07-13 18:29:34.920881] Init crypto engine

[2019-07-13 18:29:34.951033] Disable caches

[2019-07-13 18:29:34.951641] Disable bootrom range checks

The screen just sits like that nothing else. Is there any debugging that I can collect?
[Fire General] TrueRoze:
Okay so I got up to the `dd` part of the tutorial (was doing software method). Didn't continue the tutorial after for a little while because I had to leave the house, brought the tablet with me. I hard-rebooted it because something wasn't working in an app and now my tablet doesn't respond to anything (holding power for 40s, plugging in to power, plugging into computer). Do I have to do hardware method now?
[Fire General] mrmazak:
The not responding , is the expected condition, it is covered in step 6a on the guide.

You should be able to continue the guide at that point
[Fire General] TrueRoze:
Hey! I ran the bootrom script with my tablet plugged into my laptop. It hangs on “waiting for bootrom”. What do I do from here?
[Fire General] mrmazak:
It says to plug in USB when it says waiting for boot rom. So try that way, not with it plugged whole time

Not sure.
[Fire General] TrueRoze:
Okay thank you! I’m going to try this
[Fire General] TrueRoze:
Didn’t work :/

I plugged in the USB cord after running the script and it hung at waiting for bootrom :/

Any other ideas?
[Fire General] mrmazak:
Well. Only what I can see from the op. And that is to use the hardware method. Open device and use a short, while plugging in
[Fire General] TrueRoze:
Alright, I did the HW method and it worked! I have a few questions now:

Can I install a custom launcher?

How do I remove system apps, and remove ads?

OpenGApps or install the old method? (4 apks)
[Fire General] mrmazak:
With root you can do most any app uninstall if you want. But carefully, some apps should not be removed

Use this guide as reference. There is a section for mustang.

https://xdaforums.com/amazon-fire/general/root-remove-forever-lockscreen-ads-t3824551

As for playstore. Maybe because you have twrp, (please seek some more input first) maybe can try to flash gapps
[Fire General] black.kahder:
A reminder that today is Amazon Prime day and these tablets are on sale for $30 each, or two for $50. At $25 each, they are basically disposable. Also now I can have a tablet the same color as one of those green Acer PCs from the late 90s.

I greatly enjoy my Fire 7 austin tablet with ggow's Lineage 12 ROM. I don't have to worry about taking it outside or into my garage, unlike my expensive tablets.
[Fire General] SirDigitalKnight:
Just ordered one for $29.99 plus $10 off for signing up for prime and using the Prime app. Will try this unlocking and root when it comes in. Thx for the post OP!
[Fire General] MontysEvilTwin:
Just rooted my Prime day tablet. Thanks for this. Trying to be clever, I put all the files needed onto a micro SD card, but in TWRP it was not possible to mount an SD card. It lists 'Storage' three times under 'Mount' but none of these are mountable. I was lucky though, if you connect the SD card using a USB OTG cable and USB SD card adapter, 'Storage 1' appears under 'Mount' and this can be accessed by navigating into 'auto1-1' in the File Manager.
[Fire General] Michajin:
Hold the power off button for about 20 seconds, this will force a shutdown... Then Volume (up or down, cant remeber right now) and power, this will boot you into recovery. Chances one device was on a higher OS and you need to get into TWRP to boot a more later FireOS or Lineage. If the fastboot step completed then the unlock is complete and TWRP got flashed to replace amazon recovery.
[Fire General] shell79:
Thats exactly my problem. It doesn't work. I only get this bootloop.
[Fire General] LKJEFoi234:
Care to elaborate? I'd love to hear what's in store for the future.
[Fire General] DB126:
Aside from the increasingly difficulty obtaining root on BL locked devices the rewards may be muted for those looking to use their rooted devices for 'real' work.

https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/
[Fire General] msblight1:
Quote unrelated

Hey, I've been following this thread and others like it bc I got a 9th gen fire 7 and have wanted to root it. I made an account recently so I could interact with these posts.

I tried the software method, but my firmware is not supported, and so I turned to the hardware method. Part of the hardware method is removing the heat shield over the SoC, but it was never specified by OP, or ggow, and I could not find anything in the comments of this post for the life of me that discussed removing the heat shield.

You seem like an experienced member who has spent a lot of time on this thread. Do you know how to remove the heat shield? I believe that once I have that done, I'll know everything that I need to to successfully complete the hardware method as outlined by OP.

Also, I am new and will admit to not knowing these things, but how do you mention a user without quoting them?
[Fire General] DB126:
I don't own this device so can't speak from direct experience. Other posters imply the shield is flexible and easily releases via multiple pinch points.
[Fire General] drrocktopus:
I successfully rooted mine with the hardware method a couple months ago (thanks to everyone in this thread!) and i remember the heat shield was a little tricky but I was able to pry it off - it is stuck on there with adhesive.
[Fire General] WangGang:
Am trying to use hardware method. Did you need a heat gun to remove the heatshield?

EDIT: There's not any adhesive :/
[Fire General] drrocktopus:
I didn't need a heat gun, mine was stuck on there with that double sided cushioned tape.
[Fire General] colonels1020:
Also getting the serial protocol error. I've tried all of the possible shorts on the board that I can think of. Any ideas?

If i change common.py to:

def check(self, test, gold):

if test != gold:

print()

It will bypass that check and get a little further, but runs into the following error:

struct.error: unpack requires a buffer of 4 bytes
[Fire General] amkdeath:
I Can confirm hardware method did not work for me on 32gb "w/special offers" direct from Amazon

Ordered a no-ads version which is a bit more expensive from best buy for pickup today will test

Tried all available test points on the bottom of the board to no avail.

There has got to be some way to get it to bootrom I feel though, for factory QA purposes. Maybe they changed the routine so it requires a different trigger.

Could be as simple as going high instead of low.. Or could be some combination of high/lows

If anyone has any ideas I'm happy to test

Update :

Got a 16gb "no special offers" version from best buy

Did not bother with software method, did not boot up the tablet. Immediately opened it out of the box, and shorted CLK pin on the back

After bootrom step, I did not disconnect the USB (since my battery was disconnected), twisted the board to set it back into place then reconnected the battery and other ribbon cables.

Then ran fast boot step

Was able to successfully run both scripts, got into TWRP

Flashed lineage

I'm not sure if the success of this one was due to it being:

A) more expensive version compared to the "With special offers" version from Amazon directly

B) older Rev board since it was sitting in best buy inventory vs. The one I bought direct from bezos

Or

C) because I cut traces or bricked the first one with sw method before trying hw

Thoughts?
[Fire General] metaplop:
half bricked ?

Hello. I own a fire7 mustang and it seems bricked. No way to power on. But if I plug it I see:

[45105.690646] usb 1-3: new full-speed USB device number 36 using xhci_hcd
[45105.843229] usb 1-3: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[45105.843234] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[45105.845471] cdc_acm 1-3:1.0: ttyACM0: USB ACM device

during ./bootrom-step.sh I get:

[2020-07-28 00:04:16.506321] Check GPT
Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 87, in main
switch_user(dev)
File "main.py", line 57, in switch_user
raise RuntimeError("what's wrong with your GPT?")
RuntimeError: what's wrong with your GPT?

I saw in other threads that I should flash gpt.bin file but I found nowhere these file for the mustang version of Fire7. Any idea where to find it ?

I can have another (running) fire 7, is there a way to extract that file (if possible without doing risky invasive manipulations as it is not mine) ?

Thanks.
[Fire General] jcruz942:
Has anyone tried rooting after the Fire OS 7 update?
[Fire General] SJ33:
Hello,

I have a Fire 7 2019 coming in a few days. I am going to assume that it has the latest firmware and thus the software method won't work (what is the highest compatible firmware?). I'm looking at doing the hardware method. I gather I have to ground the point shown in the picture in the OP What specificially does this entail? I'm not a complete electronics newbie, I understand the concept of grounding, but do I literally just touch this point with a piece or metal? Or wire it to something to force ground?
[Fire General] DB126:
Simple touch is fine; lots of discussion in this and similar threads if you need more detail (use search function)
[Fire General] jcruz942:
I can confirm that even after flashing the Fire OS 7 update and running stock ROM/recovery for a few days I was still able to achieve root and unlock the boot loader. I just had to use the hardware method as listed in OP and followed the instructions.

Note:

Note I wasn't testing a rooted fire os 7. I was just testing to see if even after updating for FS 7 it was still possible to use this method to root.