yashsingh1/xdaforums huggingface dataset:
[Fire General] antoinejr1111:
I am trying to start the hardware method by using sudo ./bootrom-step.sh on Linux Mint and I keep getting this type of error:

[2021-08-24 15:09:42.721988] Waiting for bootrom

[2021-08-24 15:10:01.076317] Found port = /dev/ttyACM0

[2021-08-24 15:10:01.114536] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

Traceback (most recent call last):

File "main.py", line 161, in <module>

main()

File "main.py", line 82, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/aj/Downloads/amonet-mustang/modules/load_payload.py", line 99, in load_payload

dev.write32(0x10007008, 0x1971) # low-level watchdog kick

File "/home/aj/Downloads/amonet-mustang/modules/common.py", line 147, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

File "/home/aj/Downloads/amonet-mustang/modules/common.py", line 84, in check

raise RuntimeError("ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch

If someone could help me with this, much would be appreciated.
[Fire General] Michajin:
make sure you are in bootrom not preloader. Run lsusb, meditek phone is the bootrom.... The exploit was blocked fairly early in production.
[Fire General] antoinejr1111:
How do I get to bootrom?
[Fire General] antoinejr1111:
I short the exact point and it doesn't work. I'm using a screwdriver to short the point and it's not working.
[Fire General] antoinejr1111:
Totally bought mine at March of 2021 so it won't work. Are there ways to do it with the revised model of this tablet or am I stuck with Fire OS forever?
[Fire General] Rortiz2:
Unless a new exploit appears (which is unlikely, unfortunately) I think that (as you said) you'll be stuck with FireOS forever.
[Fire General] :
does any one know how 2 Transfer the executable to your tablet? As the command did not work.
[Fire General] 19deke55:
I got to the point after adb shell command and tried the "./mtk-su" and have this error:

"127|mustang:/data/local/tmp $ ./mtk-su

Failed critical init step 3: Not a typewriter

setns failed:: Permission denied

New UID/GID: 2000/2000"

My Fire is not unlocking/rooting.

It is 9th generation with 7.1.3.7 version

Any ideas gratefully welcome.

I would have tried the shorting method too but I have no way of holding the short and typing commands at the same time which is what I read in the instructions...
[Fire General] :
The command code does not work. adb push arm/mtk-su /data/local/tmp
[Fire General] poopy3112:
pls help me when i try to run this code

cd /data/local/tmp

./mtk-su

getenforce # Just to confirm it says Permissive

echo 0 > /sys/block/mmcblk0boot0/force_ro

dd if=/dev/zero of=/dev/block/mmcblk0boot0 bs=512 count=8

it just say permission denied???
[Fire General] Rortiz2:
What's the exact output of ./mtk-su?
[Fire General] poopy3112:
what? do you mean the location
[Fire General] Rortiz2:
No. You are supposed to run

./mtk-su

inside the ADB shell. I'm asking you for the output of that command.
[Fire General] poopy3112:
oh i didnt know you had to do that
[Fire General] waylo:
Hi everyone,

Started perusing this thread after my toddler became of age and started getting interested in this tablet. It is practically unusable in its native state due to its sluggishness!

From what I've read, the hardware version is important because the HW exploit was patched in later versions. Just a few questions for the veterans in the thread:

1. I purchased mine in Nov of 2019. Does this mean the hardware exploit will probably work?

2. I couldn't turn off the software updates until just now, so I'm on the latest Fire OS 7.3.2.1. Does this prevent the software exploit from working now?

Thanks for any direction.
[Fire General] Findabayr:
reboot? thanks
[Fire General] Soniciso1:
Fire 7 9th gen on 7.3x. software method absolutely would not work (not a noob and did everything right.) I ended up doing the hw method and it was actually a ****load faster and worked first try. I soldered the wire to the point and then fastened it with heavy duty body tape and loosened the screw and fastened it in until I need to unfasten. I left it soldered in until I was 100% done flashing all my files then I fully desoldered the wire and put the case back. I attached a photo of the wire install for reference. Unless someone can prove otherwise I'm pretty sure the software method won't work on the 7 9th gen end of life (EOL) firmware. I get why cell phones need locked bootloader's but have no clue why it's necessary to lock them on tablets and ATV devices. I actually did all this on a HP Chromebox g1 that I threw mr Chromebox a cfw on and installed ubuntu 20 on it (which worked 100% out the box) all I did extra was apt install adb, apt install fastboot, apt install pip3, pip3 install pyserial, and disabled modem manager. After I satisfied those prerequisites and jumped the bootloader point every step worked with not 1 issue. Hope it helps.
[Fire General] thisisnotatest:
Shell output after

mustang:/ $ cd /data/local/tmp

mustang:/data/local/tmp $ ./mtk-su

Failed critical init step 3

1|mustang:/data/local/tmp $ getenforce # Just to confirm it says Permissive

Enforcing

mustang:/data/local/tmp $ echo 0 > /sys/block/mmcblk0boot0/force_ro

/system/bin/sh: can't create /sys/block/mmcblk0boot0/force_ro: Permission denied

1|mustang:/data/local/tmp $ dd if=/dev/zero of=/dev/block/mmcblk0boot0 bs=512 count=8

dd: /dev/block/mmcblk0boot0: Permission denied

Fire OS 7.3.2.1 - Just updated because original post didn't say there was anything wrong with updating.

Do I have to try HW method?
[Fire General] thisisnotatest:
Out of the 7-8 inch Kindles, which generation/years are the easiest to flash? (by ease I'm including unlocking/rooting/availability of stable roms etc)
[Fire General] thisisnotatest:
How did you get the metal backing in the first pic off?

EDIT:

Metal casing comes off quite easily when you work it from the bottom
[Fire General] thisisnotatest:
Its also called a heat shield for anyone wondering. When shorting connect the conducter to a dot and the casing of the heatshield.
[Fire General] thisisnotatest:
How do I find out if I have the revised version?
[Fire General] thisisnotatest:
Having problems taking of the metal casing...the heat shield? How did you get it off?
[Fire General] Phil750123:
Just keep trying, be patient with it but firm. Takes more effort than you think but with a decent plastic pry tool work around the edge going round a few times and itl come off eventually. Heating it with a hairdryer might help if your really struggling
[Fire General] thisisnotatest:
Thanks a lot. Just done it. Now going forward will it work with 7.3.2.1? I know you can come back from softbrick but what are the chances of hard brick?
[Fire General] Rortiz2:
Just try to follow the procedure, if you get can't see "MT6627" under lsusb while shorting it's probably patched.
[Fire General] thisisnotatest:
I got

[2021-09-19 22:08:01.830606] Waiting for bootrom

[2021-09-19 22:14:51.117273] Found port = /dev/ttyACM0

[2021-09-19 22:14:51.156682] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

Traceback (most recent call last):

File "main.py", line 161, in <module>

main()

File "main.py", line 82, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/xxx/Downloads/Package/amonet-mustang/modules/load_payload.py", line 99, in load_payload

dev.write32(0x10007008, 0x1971) # low-level watchdog kick

File "/home/xxx/Downloads/Package/amonet-mustang/modules/common.py", line 147, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

File "/home/xxx/Downloads/Package/amonet-mustang/modules/common.py", line 84, in check

raise RuntimeError("ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch
[Fire General] thisisnotatest:
Nothing happened so disconnected usb, then battery then reconnected both. black screen but the amazon sounded went off twice. then terminal gave:

[2021-09-19 22:16:30.914182] Waiting for bootrom

[2021-09-19 22:16:43.735687] Found port = /dev/ttyACM0

[2021-09-19 22:16:43.736460] Handshake

run lsusb

sudo /home/xxx/Downloads/Package/amonet-mustang/bootrom-step.sh

Traceback (most recent call last):

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 501, in read

'device reports readiness to read but returned no data '

serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):

File "main.py", line 161, in <module>

main()

File "main.py", line 79, in main

handshake(dev)

File "/home/xxx/Downloads/Package/amonet-mustang/modules/handshake.py", line 9, in handshake

dev.handshake()

File "/home/xxx/Downloads/Package/amonet-mustang/modules/common.py", line 97, in handshake

c = self._writeb(b'\xa0')

File "/home/xxx/Downloads/Package/amonet-mustang/modules/common.py", line 92, in _writeb

return self.dev.read()

File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 509, in read

raise SerialException('read failed: {}'.format(e))

serial.serialutil.SerialException: read failed: device reports readiness to read but returned no data (device disconnected or multiple access on port?)
[Fire General] thisisnotatest:
screen is back on now but only boots into amazon recover with down and power
[Fire General] Soniciso1:
Bro the hw method was a million times easier than the sw method. I literally had 0 luck with mtk-su. I kept getting errors. The hw method worked first try after soldering a wire to the test point and grounding it to a chassis screw. The heat shield was very simple to pry off. I took a knife (very carefully!) Put it sideways between the main heat shield and the one next to it and used the second shield as leverage to pry the main shield off. Took very little effort. Once the first side popped off the rest came off by hand. I tried tweezers and paperclip to perform the jump but no dice. Soldering the wire to the test point and grounding it with a screw was the only thing that worked. I'm thinking about maybe installing a push switch on to the point and a ground so I can always have access to bootloader mode as I almost ****ed up and updated my device. It almost updated when booting the stock rom I flashed from the OP. It almost updated when I booted the stock rom (as it mentions to do in the first step after you have twrp running.). I avoided this when I saw "updating" on the screen shortly after I setup wifi by holding down power. Once back in twrp I removed the stock rom provided in the first post and replaced it with lineage 14.1 and Gapps. So instead of flashing in the order of first post I did this : 1-flash lineage14.1 2- flash Gapps then wipe dalvik and cache and reboot. Then reboot back into twrp using vol and power and flash finalize then flash magisk and reboot. Do not ever use magisk to install magisk to the device. Instead grab latest magisk rename it from .apk to .zip and flash it via twrp. Flashing magisk using the apk and within AOS will result in a bootloop no matter what rom you use. I tried a few dif ones. So far the best and last one I will install is 14.x. I tried 17 beta but it ran stupid slow and I suspect the dev will not update it due to hw limitations. Then I tried the one before it and it had slight speed improvement but still not what I was looking for. Going to 14 did the trick. Basically if you're gonna use any custom rims get anything based on Android 7 only as android 8 9 and 10 are not supported even stock due to slow hw. Hell even my Nokia 8.1 can't support android 12 and it's similar to my pixel 4a.
[Fire General] Soniciso1:
Hw method isn't patched pretty sure it's not possible to patch it without a hardware change which I believe was done in newer models. My 7 was on the end of life firmware when I started this venture. The sw method was infact patched after 6.3.x. the hw method worked flawlessly when executed properly. By properly I mean solder the wire to the test point and don't use tweezers or paper clip. I didn't have luck with my tweezers. Same tweezers I hacked a Nintendo Wii with years back. The point is just too damn tiny. Also don't use anything thicker than 30awg as you will def pull that trace out then would need to find a alt point.
[Fire General] Rortiz2:
I'm sorry to tell you that you are not right. If you read this thread, you will see, that many people with new HW revisions have not been able to unlock their tablets (i.e: this thread). I would not recommend soldering the pads unless you know what you're doing and you have enough knowledge to do it since a few people have killed their devices by soldering these pads (see FireTV 2 unlock thread as an example.).
[Fire General] thisisnotatest:
Gonna wait for root via toolbox...if that ever comes lol.
[Fire General] zippzYT:
any way to do this on latest fireos 7
[Fire General] niscy:
TL;DR: any chance someone could briefly explain what pwning options I have with a 2019 Fire 7 that was acquired in early 2021? Doesn't look good, right?

I have only little experience pwning Android devices ... when I did it in the past it was

quite straight forward because I always bought Nexus devices for this purpose. However, I'm not afraid to get my hands dirty to tame this nasty little data-leaking beast.

Given I'm quite deep into the privacy rabbit hole at this point, I will probably not turn it on while it still has traces of FireOS installed ... do you think I will ever be able to use it, and how?
[Fire General] stickfiretv2020:
After months of slowly calculating this I finally have some solutions for the latter hw revised devices!

Option 1:

Randomly poke at area near the emmc chip, yes seriously... I did it on one that I was trying to scrape the pcb tracks on, after tearing off pads near emmc by accident. It now doesn't boot but I get bootrom output!?! bootrom is halting (as seen on uart) and its error message is varying based on changes to inserted microSD (i.e. change partition names on card and I get different error from bootrom), i.e. I think I got bootrom booting from microSD - I don't think these newer devices have bootrom DL mode at all anymore, replaced by microSD boot instead. The damage to board is likely the cutting of one of the eMMC tracks that has done this, need a microscope to see where i cut exactly on the pcb.

Problem I now have is how do I partition a microSD card to match the eMMC's layout and flash Android onto the card? Anyone got good instructions? It is MTK Bootrom MicroSD boot mode not preloader/lk.bin boot Android from MicroSD mode. I think I need to partition EMMC_BOOT0 EMM_RPMB EMMC_USER etc like Jedec standard, or like armbian.

There is a second option but I wont go into that as it is very hard! requires special circuit made from arduino/microcontroller and a really clever hack for fire 7 2020, for fire 10 2020 it may only need hack still waiting to try it on my pads, holding back testing it because of this dead fire 7 i've been trying to fix instead.
[Fire General] garnet2k:
Hi all,

I just bought fire 9 gen. build 0021274103684. Fire OS 7.3.2.1

I did try the software method but I got:

t430 arm # adb shell
mustang:/ $
mustang:/ $
mustang:/ $ cd /data/local/tmp
mustang:/data/local/tmp $ ./mtk-su
Failed critical init step 3
1|mustang:/data/local/tmp $ exit

So I guess it has to be the hardware method.

I did try to short the pin under the heat sink. But it is so small it is almost invisible (<< 0.5 mm).

This is what I see in lsusb.

t430 arm # lsusb
...
Bus 001 Device 024: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
...

So it seems something is wrong for me to see the preloader.

I ran

t430 amonet-mustang # ./bootrom-step.sh
[2021-11-28 19:59:36.053397] Waiting for bootrom
[2021-11-28 19:59:37.406137] Found port = /dev/ttyACM0
[2021-11-28 19:59:37.432679] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/vasil/Downloads/kindle fire 7 nov21/amonet/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/vasil/Downloads/kindle fire 7 nov21/amonet/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/vasil/Downloads/kindle fire 7 nov21/amonet/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

And nothing good happens. It is either that above or it freezes at

[2021-11-28 19:59:37.432679] Handshake

and doesnt go further.

I try to hold the wire to the pin as good as I can. Also if I dont short the pin and just plug the tablet to the USB (from powered off, same as above) the same result is present: RuntimeError: ERROR: Serial protocol mismatch

Any suggestions are appreciated.
[Fire General] Michajin:
you don't have access to the bootrom. mediatek made a change early in production of mustang, anything bought from amazon after January 2020 likely has the bootrom blocked.
[Fire General] _stoffl:
I have sucessfully unlocked my device. Is it now possible to install the latest fire os version (7.3.2.1) via TWRP? Already tried, but got a boot loop. Did I miss something?

Thanks!
[Fire General] Michajin:
i dont believe you can run the latest fireOS on it. last i saw is you need to stay on fireOS 6. There is a lineage 16.0 build you can flash, which is the same android 9 as fireOS 7. But their are some bugs in the rom.
[Fire General] ProtoPropski:
shell@austin:/ $ cd /data/local/tmp
shell@austin:/data/local/tmp $ ./mtk-su
Failed critical init step 1
Incompatible platform
etenforce # Just to confirm it says Permissive <
Enforcing
shell@austin:/data/local/tmp $ echo 0 > /sys/block/mmcblk0boot0/force_ro
/system/bin/sh: can't create /sys/block/mmcblk0boot0/force_ro: Permission denied
d if=/dev/zero of=/dev/block/mmcblk0boot0 bs=512 count=8 <
dd: /dev/block/mmcblk0boot0: Permission denied

I keep getting this whenever I try to follow the software route, I managed to push the mtk-su as described, although it doesn't want to work.

I have a Kindle Fire 7 (7th Gen) I dunno what's up?
[Fire General] ISaxon:
As another potential software only route, would it be possible to use mtkclient for a Fire 7 9th Gen?
[Fire General] stettlev:
If there is anyone still getting the serial protocol mismatch error, I was able to successfully flash my device by just commenting the runtime error line. That said I don't know if I was just lucky or what, so I wouldn't try it until you've tried everything else and if you're not worried about bricking the device. Also, I got error immediately after the handshake message and before the "remove short" message, it that makes a difference.

Line 86 of Common.py in modules:

if test != gold:
#raise RuntimeError("ERROR: Serial protocol mismatch")
[Fire General] crookedview:
I tried just commenting out the RuntimeError line and putting

pass

in its place. I get to:

[2021-12-29 18:52:01.124756] Init crypto engine
[2021-12-29 18:56:21.455480] Disable caches
[2021-12-29 18:56:31.467138] Disable bootrom range checks

and it ends up bombing out with:

struct.error: unpack requires a buffer of 4 bytes

The raise RuntimeError line of the common.py script that I have is on line 84 though?

This is on a brand new Fire 7 tablet I received today. I assume it's going to be a headache to do anything with this device.
[Fire General] 19deke55:
I must admit that I find the Fire a bit slow even though it's the ninth generation I've got. If the system was more easily replaced I'm sure a lightweight ROM would see it but along nicely and be more of a joy to use.
[Fire General] Clubby_G:
Hello all. For some reason I have a habit of tweaking my tablet devices over the Xmas holidays after Black Friday deals and digging out my older models. I usual brick a tablet or two :) I went down the rabbit hole with my Fire 7 9th generation, and after using the hardware method to unlock bootloader mentioned in this thread, I was able to install a few different flavors of LOS. After finding out the camera did not work on LOS 16, I tried flashing back to the latest FireOS 7.3.2.2, which I d/l'd from Amazon. I got stuck in the Amazon white logo boot loop, and after some digging, it seems that it is not possible to use TWRP with FIre OS 7. I tried many different ways with fastboot and sideload to recover the stock OS, but no luck.

I was able to load up 6.3.1.2 mentioned at the beginning of this thread, but when I go to SYSTEM UPDATES to view info about the OS, I just get a blank screen.

So my questions:

1) How would I actually load stock .bin file from Amazon without TWRP? All the methods I have found using TWRP and then deleting / wiping it do not seem to work.

2) If I need to stay with 6.3.1.2, (which is actually pretty cool and works with Fire Tool Box), is it expected behavior that I can not do any OTA or other updates and I am stuck with this particular version?

Thanks in advance, and I appreciate all the effort put into this community.
[Fire General] i.REN:
Trying to get linux setup and none of this garbage works. Very frustrated.

sudo apt install python3 python3-serial fails even though my pc is connected to the router via a physical cable.

The other two android-tools-adb android-tools-fastboot result in E: Unable to locate package android-tools-adb E: Unable to locate package android-tools-fastboot

I have no idea what I'm doing here. I guess I'll just send the damn device back and forget about what I was wanting to use it for. Sucks. I suck.
[Fire General] i.REN:
Yep I think I figured out my mistake. As an Ubuntu Noob I had no idea that there is folders above the home folder where I was placing the adb files. I discovered the folders in root when trying to get the driver for my wireless usb network adapter installed. It failed at "sudo make" because for some reason it doesn't like the Makefile that is in the wifi adapter's driver folder. I have no idea how to fix this. Even connecting directly to the modem wired still doesn't give internet access. I've hit a wall here.
[Fire General] i.REN:
I'm not able to get sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot to work.

There's no access to the internet despite being successfully connected to the router with both wireless and wired. There is no default gateway and dns. I don't know how to add these. Using Linux Mint on a usb drive.
[Fire General] bbarnes1:
I'm seeing the same issue.

I have a kindle that has been sitting for a few years, it was still on 6.2.1.3. I made sure to sideload it to the exact build that mtk-su needed.

I tried the software method and at the ADB reboot command i got a dead black screen no power up. So i moved onto the hardware method.

I've got a jumper wire soldered to the back of the board on DAT0 (tried CLK as well) and ground it when plugging the device in.

I'm using an Arch linux installation, 'lsusb' shows the device as a MediaTek Phone MT..... the eMMC is not showing in 'fdisk -l' or 'lsblk'

If the battery is unplugged, Arch will recognize the device as a MediaTek Phone regardless of the jumper being grounded. If the battery is plugged in and the jumper isn't ground, the device is not recognized. Connecting the jumper to ground recognizes the device again as MediaTek Phone.

Is my eMMC fried, or is the device not going into bootrom? I've tried commenting different things in the script but any time the eMMC routine is called it fails.

Any words of wisdom?
[Fire General] i.REN:
Pushing the mtk-su arm folder doesn't work.

Maybe because it updated without me realizing it?

I'm hesitant to attempt the hardware method as I'm still able to return this device. It doesn't appear to me much of an improvement over my 2015 Fire 7 anyway. I'm thinking I should never have bought it.
[Fire General] Fmstrat:
Are there any options for new purchases with 7.3.2.1?