yashsingh1/xdaforums huggingface dataset:
[Fire General] wodgey:
How?

I've only been able to get boot loops or non booting Amazon logo.

I tried exactly the same as I'd performed previously, namely pushing the .bin file and renaming as .zip.

By what means did you upgrade to fireOS7 and then how did you apply root?

My findings were documented in the thread in"general"section, announcing the pi release.

Edit 2 add link to thread I mentioned

https://xdaforums.com/amazon-fire/general/mustang-fireos-7pie-released-t4147349/post83326267
[Fire General] jcruz942:
Sorry for any confusion. That's what I meant I wasn't running a rooted fire os 7. I was just confirming that if you update from stock fire os 6 to stock fire os 7, it is possible to use the hardware method to root, which would put you on the stock Amazon version used for rooting. I haven't tried running a rooted fire os 7.
[Fire General] wodgey:
Ok. Understood now.

After a morning of 'epic fail', I saw your post and thought you might shed some light.

Going back to what you've actually performed, rather than my misinterpretation - Which pin were you grounding, for the hardware method to work? The pin listed in the original post, or the other pins on the back of the board, detailed in subsequent posts?

I'm still confuzzled though as to why my attempts were fruitless. I can only suspect that the update injects some changes to the system somehow. Perhaps bootloader (although, if so, why not incorporate protection against this hack?), Partition table (possible I suppose) or other.

Or perhaps I'm just a combination of incompetent and stupid :)
[Fire General] jcruz942:
I'm using the pin listed in the original post. As for the reason your attempts didn't work, I'm not sure that is way out of my scope lol.
[Fire General] wodgey:
Yeah mine too. I can follow a tutorial like a champion but I've very little understanding of device trees and bootloader etc.

I posted the results of my failed attempts in the hope that someone more knowledgeable might suggest which log files to investigate and that error messages found within might guide my efforts.

Did you try the software method before the hardware method? If so, did you try using the updated mtk-su binary? I know this is often updated because after rooting my fire 7 last year, I also tried using the temp-root on my Sony Android TV (without success though)
[Fire General] jcruz942:
No, only tried the hardware method.
[Fire General] wodgey:
Ah ok. Well I suppose I could try it out. I've not needed to do the HW method. I got my device months ago, back when the software method still worked. Since then I've always had access to twrp as my recovery
[Fire General] Apathy772:
Thank you thank you thank you

Easiest thing I have ever done, AMAZING WORK!!!!!!:good::good::cowboy::cool:
[Fire General] buletini:
Can I apply this guide to Kindle Fire 7 (2017)?
[Fire General] wodgey:
No. Different method is needed
[Fire General] adopotato:
Did you get a response to this or find a solution?
[Fire General] diplomatic:
Get the result from the latest version of mtk-su and check for a possible explanation in the FAQ section at the beginning of this thread...
[Fire General] FiftyWookies:
I'm guessing you never got past this?

I'm may be in the same boat.

Brand-new tablet. Nothing in lsusb, nothing in dmesg. Root worked, but on reboot it seems bricked. Pulling battery did nothing, short via pin didn't help.

I suppose it was inexpensive anyway. :/
[Fire General] Firecracker987:
I went with the HW method and I get the following error, any idea what the problem might be?

I'm using linux mint and I have uninstalled modemmanager

e@ebox:~/tmp/KindleFire/amonet-mustang$ sudo ./bootrom-step.sh
[2020-09-03 08:14:39.338028] Waiting for bootrom
[2020-09-03 08:16:13.999839] Found port = /dev/ttyACM0
[2020-09-03 08:16:14.039267] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/e/tmp/KindleFire/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/e/tmp/KindleFire/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/e/tmp/KindleFire/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
[Fire General] pottoparktavius:
Stuck on Handshake

Hey, has anyone had the error where they're stuck on Handshake after it recognizes the device?
[Fire General] rtg20:
wish I'd seen this thread before starting. got a Fire 7 from Amazon on Fri, was really excited to root it, nothing worked - took the motherboard out and used the pins on the back per the more recent posts but it's still not working.

is it worth trying this procedure on a Fire 8? I want to debloat, get rid of the ads, and install Google Play. thanks.
[Fire General] wodgey:
You can debloat and install play store without root.

Debloat you can do via ADB shell, using the pm disable method (scripts available if you Google search).

Play store you can install using four APK's. Been a while but I think they're the services framework, play store, accounts manager and one other.

I'd install play store before doing the debloat though, so that you can install alternative launcher before disabling fire launcher.

Good luck
[Fire General] rtg20:
thanks for the reply. is the debloat procedure you describe durable? I tried it ages ago but the ads and crap were all back after a few days :(
[Fire General] wodgey:
Yes I believe so. You'll disable the app that is responsible for re-enabling all that rubbish and also the ota update, so unless you perform a reset\wipe or manually perform an update, you should be fine.

I'm lucky, in that I installed twrp before Amazon did whatever they did to block doing so but I'm running fireOS debloated as it fits my needs better than the lineage ROM that's available. I've not had anything return that's unwanted.

I've removed all the Amazon crap though (including Alexa, prime video, Amazon shopping etc though, so I can't comment on how it'll work if you leave any of these enabled. The debloat script probably disables 20-30 apps\services so it's fairly comprehensive.
[Fire General] rtg20:
Ok it seems to be working. Thanks! I disabled all Amazon stuff and installed Nova launcher too. Only problem is that the keyboard is stuck on Asian and I can't change it, has anyone else had that problem? Thanks.
[Fire General] wodgey:
Nope. I've not experienced that. Although one of my first installs after installing any new device is always gboard (Google keyboard). Swiftly followed by a hosts file based adblocker and YouTube vanced.

For keyboard, perhaps you might download the APK for a keyboard and try ADB install.
[Fire General] rtg20:
Thanks. I figured it out. Solution was to re-enable Amazon's keyboard. Working great now! Thanks again
[Fire General] YodaDude2011:
Can we install Xposed Framework? I'm running the lineage OS rom too. And is there an update to TWRP from 3.2.3-0?
[Fire General] orchid666:
Have tried 3 different tablets on 3 different machines and all different cables on all suggested shorting points. Preloader only. Can't get into bootrom mode. I assume the board rev or something else has changed on the 2020 models as none of them will flash. Has anyone manged to do this on a 2020 fire 7?
[Fire General] HuaweiUser6:
After trying the latest update 1961_0018354776452.bin the tablet goes into a bootloop, and had to revert to stock. My question is, is there a fix for this? Or am i stuck using stock for now?
[Fire General] HellfireXD:
Error on hardware method.

Hello, Using the hardware method i get an error when I remove the jumper going from the PIN to the shielding.

OS: Ubuntu 20.04.1 LTS

Device:

Amazon fire 7 9th Gen

Firmware: 6.3.1.5

sudo ./bootrom-step.sh
[2020-10-05 00:42:10.274210] Waiting for bootrom
[2020-10-05 00:44:20.712277] Found port = /dev/ttyACM0
[2020-10-05 00:44:20.743502] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *

Traceback (most recent call last):
File "main.py", line 161, in <module>
main()
File "main.py", line 82, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/home/ubuntu/android/amonet-mustang/modules/load_payload.py", line 99, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
File "/home/ubuntu/android/amonet-mustang/modules/common.py", line 147, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
File "/home/ubuntu/android/amonet-mustang/modules/common.py", line 84, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

This is my dmesg

[Oct 5 00:44] usb 1-1.2: new high-speed USB device number 4 using ehci-pci
[ +0.110424] usb 1-1.2: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice= 1.00
[ +0.000006] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ +0.000003] usb 1-1.2: Product: MT65xx Preloader
[ +0.000002] usb 1-1.2: Manufacturer: MediaTek
[ +0.022382] cdc_acm 1-1.2:1.0: Zero length descriptor references
[ +0.000021] cdc_acm: probe of 1-1.2:1.0 failed with error -22
[ +0.040187] cdc_acm 1-1.2:1.1: ttyACM0: USB ACM device

Any help with this issue would be greatly appreciated.

I plan on using this to run an app for my baby monitor but the app doesn't work on the amazon corrupted version of android this thing runs stock.
[Fire General] amkdeath:
I just tried this on a mustang I grabbed from the same local best buy and HW method no longer works.

Get serial protocol mismatch error.

I have a handful of successfully unlocked mustang devices. Is there any way to leverage them to be able to get root on the newer one?
[Fire General] MicroO:
Same error on mine.

I did this process on my previous Fire 7 9th gen (back in December 2019) - this one (as a replacement for my last one) came with 6.3.1.5 installed, mtk-su doesn't work (error 4).

I have til January to send the old one back, so hopefully by then we'll have a new way of doing this!
[Fire General] 12th Planet:
I got it to work.. I too got this error.. after I reran the exploit.. It wouldn't work until I ran fastboot bin and booted into TWRP
[Fire General] noffo:
mtk-su doesn't work on the latest firmware, selinux is enforcing.

None of the shorting works, no usb handshake happens if any of the shorts are attempted. Tried the trace tap shown in the pictures, and tried CLK, CMD, and DATA0 all day long. Tried dead shorts, and resisted shorts.

If someone who knows these things wants me to try anything, I'm happy to try anything. I bought this thing strictly to experiment on.
[Fire General] zumand:
Current models

What is the current Kindle Fire model that can be rooted?
[Fire General] ad333:
Windows laptop

Hi all, firstly thanks to all the amazing insights on this thread. There are some right geniuses on here no doubt but the people who care enough to create content and share knowledge are in the 1%. You rock.

I am semi computer literate, but have never done anything with Linux knowingly. I have a windows 10 laptop.

Do I need to 'build' a Linux machine specifically to do this or can I run something over Windows? If the latter is an option, please can someone point me to the recommended steps so I can then follow these steps?

With Windows I have certain diagnostic skills, but with installing linux I have none (yet)

Mucho appreciated

A
[Fire General] sol-invictus:
I do have the exact same situation, tried the hardware method!

[MENTION=9667509]xyz`[/MENTION] Is this a problem with FireOS version 6.3.1.5? Any other way to get LineageOS to the device? :)
[Fire General] wodgey:
No you don't actually need to install\build a Linux system onto your laptop, you can just use a "live CD" (misnomer these days as almost everyone uses a USB thumb drive) to boot into a full Linux distro. - most computers offer a bios boot menu, when pressing F2, Delete, F12, or another key during boot time (Google search your model of laptop with the words "usb boot menu", to aide you in finding how to boot from a device other than your primary drive. You'll have needed to do this if you've ever needed to perform a clean reinstall of Windows).

You could use a virtual machine (such as virtualbox) instead but you'd need to allow sole access to the phone device, passed through to the virtual machine ,which you'd need to do twice. Once for the devices' hardware ID for the tablet in Android mode and then again for the device ID's once tablet has rebooted into fastboot mode (if you've ever flashed a ROM to a phone before, you'll have likely noticed that you need different drivers to communicate with your phone when booted, to those for when the device is in bootloader mode). This is why using a "live CD" is much easier.

I'd recommend downloading the installer for "Linux Mint 20 Cinnamon" as it feels very similar to Windows and is one of the most popular distributions, so any niggles\queries you have, will undoubtedly have been experienced\solved by others before you. The "installer" is actually a "live CD" anyway so you can play around without actually installing.

Someone with a diagnosticians mindset will likely enjoy learning new systems and skills. I much prefer my Linux partition on my laptop, to my windows partition. In fact, I only ever boot to my windows partition when gaming (infrequently) or to have MS Office in front of me, when clients need tech support with outlook\Excel.

Good luck
[Fire General] ad333:
Thanks :)

---------- Post added at 06:44 AM ---------- Previous post was at 06:20 AM ----------

Hello

Is the local video issue still current.

Does that equate to not being able play my kids cartoons from micro SD through VLC player please?

Best regards

A
[Fire General] n8henrie:
Thanks to all the amazing people working on this project!

Just wanted to post a word of warning to newbies like me -- I think I've bricked my new 2019 Fire 7 trying the hardware method. I was also getting the `ERROR: Serial protocol mismatch` error initially, tried a few times including disconnecting the battery, and now it shows no signs of life whatsoever -- screen does not light up at all, tried holding the power button for >30 secs or usb + volume button, adb can't connect at all, not showing up with `lsusb` (though just realized I need to check dmesg as well). I think it's done for and assume that I must have slipped and shorted the wrong thing and fried it.

Thankfully I bought this specifically to tinker with and knew this was a possibility, but still a bit of a bummer. For those considering the hardware method, take the warnings seriously!

EDIT: Nothing appears on dmesg with multiple cables on multiple computers. I think it's a goner.
[Fire General] ad333:
Shorting

Hi all

Isn't this fun :D

Just asked my 6 year old (who I am doing this for) to find a magnifying glass as I've lost my glasses and am getting the Serial protocol mismatch, so am thinking I'm not shorting it correctly...

"Why don't you use the iPad Daddy" - genius.

Close up pic here.

https://postimg.cc/kBv7q01R

I have tried the point on the right of the two dots in the red circle.

This is me in action (Before attaching power)::cowboy:

https://postimg.cc/pyx24VkM

Questions!

1) Am I doing something stoopid?

2) Please can someone mark up in a photo any all short options on the top of the PCB, and also the under side? I REALLY don't want to take it out if I don't have to.... (plus I have two more devices to trash :) ).

Thanks all

A

---------- Post added at 07:59 AM ---------- Previous post was at 07:51 AM ----------

I am at a similar place to you; I saw the recovery menu a few times then nothing.

Power was dead....

Try charging then do a long press Power button, with laptop connected.

For me it then booted into Fire OS! So it might not be dead.

IF you get Amazon logo repeatedly cycling I had that as well, so goes to show it might NOT be dead.
[Fire General] analgeizer:
Checked several times with hardware method for fire 7 (2019) i got a week ago.

When placed a short correctly, this tablet won't recognized as USB device at all.

I suspect that amazon changed the boot sequence of the mediatek chip to avoid entering bootrom mode.

Same model i've bought on Dec. 2019, this method worked just fine. Successfully installed TWRP for four times.
[Fire General] ad333:
Tablet was bought July 2019 though.. are you suggesting they have updated the device via a system update to stop this since then?
[Fire General] wodgey:
I don't know of any problem playing local video files using VLC. I can't help with this question.
[Fire General] ad333:
Help?

Any advice to my post 25th October 2020, 07:59 AM much appreciated.

Thanks

A
[Fire General] TUISTERa:
Hello, is the process from First post still working ? I just received my new mustang, it came with 6.3.1.5 and security patch from 1 September 2019 . I see that last posts are for failed unlock with 6.3.1.5 and I am afraid that i will brick it if i follow the procedure...
[Fire General] ad333:
For me jury is out. I'm trying as well speak but am newbie... I'm not convinced I'm doing it right but haven't bricked it yet. Just keep rebooting Linux rather than the device by mistake:crying::crying:

---------- Post added at 11:36 AM ---------- Previous post was at 11:11 AM ----------

omg... something is happening:D

---------- Post added at 11:45 AM ---------- Previous post was at 11:36 AM ----------

It worked !!!! WHOOP WHOOP

Please note my devices are a year old.

---------- Post added at 12:25 PM ---------- Previous post was at 11:45 AM ----------

I’ve just done 3 successfully. I suspect a lot of people are just having problems, rather than it not being possible.

High level steps I followed to help others with hardware method.

Installed Linux Mint Cinnamon on USB drive

Used Window 10 boot options to boot into Mint (type ‘boot’ in windows 10 search and you get the boot options menu)

Ran this sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot

Ran this sudo apt-get purge modemmanager

Installed this: https://xdaforums.com/and...armv8-t3922213 on Mint

Installed this: amonet-mustang.zip on Minte

Attached cable PC to Fire 7 and set usb options to file transfer (and set ‘USB controlled by to ‘Connected device’ but didn’t seem to work, but not sure if it did in background).

Ran adb push arm/mtk-su /data/local/tmp (this installs ADB to the Fire I think so USB cable attached at this point)

Unplugged USB from device

CD to /amonet-mustang

Ran sudo ./bootrom-step.sh

Attached paper clip

- 1 end to the right hand sliver dot within the red spot I circled in this image:

https://postimg.cc/kBv7q01R

- 1 end to the frame of the heat shield

https://postimg.cc/pyx24VkM

Message on command prompt says move the short if attached (which I did)

Pressed enter.

Sent payload……

Took me many attempts to get this far but after I did, I did 2 other devices first time. So I must have been going wrong before.

I think the key thing was that once I got the USB ‘file transfer’ set, I was looking at the fire a lot and messing with the power/volume buttons but I ONLY needed to unplug the cable, run sudo ./bootrom-step.sh, attach the paper clip, and then plug in the cable.

Thanks to all who added value to this thread and wodgey who responded to my query at the start
[Fire General] wodgey:
Congrats on your success.

Feels good, doesn't it, when you succeed?
[Fire General] ad333:
Defo :)
[Fire General] ad333:
Onwards to Lineage

For newbies like me who move on to Lineage:

https://xdaforums.com/amazon-fire/orig-development/rom-lineage-14-1-t3957329

I would pay attention to the comments about installing Nano version of Google APPS.

After lots of messing around I would install the following via TWRP.

Lineage

Nano GAPPS

Google Keyboard APK

The Wifi / SOD fix

Screen tearing fix

... before booting into Lineage for the first time.
[Fire General] ZenM:
Sry to bother but do you mean you got pass the "ERROR: Serial protocol mismatch" (reported by diff people on pages https://xdaforums.com/amazon-fire/o...019-mustang-unbrick-downgrade-t3944365/page43 and 42 of this thread) ?

If so could you elaborate a bit more on your solution?

Thanks
[Fire General] ad333:
One of my 3 tablets has just died.

It was working happily other than the SOD issue on Lineage which I had patched but was about to re-patch.

I have tried everything I can think of to bring it back to life.

Any one mind doing a list of tricks please?
[Fire General] wodgey:
Unplugging\replugging battery and seeing what's listed for hardware ID's for lsusb.

Does fastboot devices show anything being attached? How about ADB devices (in case device is working but dead screen)?

That's the first few things I'd try.

What have you tried already?
[Fire General] ad333:
Thanks for replying

I now get the amazon logo for 2 seconds then nothing.

I've tried

- holding power for long periods

- holding power and volume (down) for long periods

- Tried the above with USB attached

- Tried pulling the 6 power inserts out and the circuit thing.

With laptop attached 'lsusb' and adb devices doesn't show anything.

Thanks
[Fire General] wodgey:
Ok. That's certainly not something I've seen with mine.

I'd try going down the "paperclip grounding method" and see if running the script again brings the device back to life.

That's all I can offer I'm afraid.

Sorry
[Fire General] wodgey:
Edit 2 add

Did you try fastboot devices?
[Fire General] JoelleEmmily:
New Tab, Old Tricks

Hello! So... I recently purchased a Fire 7 for the sole purpose of installing custom firmware, and I've been having identical problems as everyone near the end of the thread. It's running version 6.3.1.5, it's a 9th gen, the about section says it's build is 000365874244, though I'm not sure that information is even useful, it could refer to the hardware configuration, something in the software, or literally nothing... I took it apart almost right out of the box, but I did try the software hack after a while in an act of mild desperation. It did connect, did transfer files, so the unit is working proper at least. However, no matter which pad I jump, the device does not behave as outlined in the guide.

There are a few specifics which might be interesting. Grounding CMD or DAT0 does nothing, the unit boots, loads, and enables the same outward facing USB device as if it were fresh from the box. Grounding CLK causes the USB serial to output only NULL data. And grounding the pad under the shielding on the back of the PCB, causes it to be completely unresponsive. With the unmarked pad grounded, it won't boot, shows no USB interface, but will return to normal if unjumped with no other intervention required. It does not however, reinitialize the USB interface until well within the boot procedure unless the cord is remove and reinserted, then it acts normally.

To be sure I was getting the best conductivity when jumping the pads, I soldered a length of wire to each pad individual and in turn, except for the one under the shield... my soldering skills are not good enough to not destroy the contact if I tried... put the unit mostly back together, and followed the instruction. For the shielded pad, I used a bit of stiff wire and just held it in place. The chipset used is slightly different on my model, though positioning and size seem identical... though discrete components used are slightly different.

Not looking for any information specifically, I'm about 98% sure I can't really do anything differently aside from probing every pin to see what happens... Seems I own a 50 dollar fly swatter for the time being.

"https://drive.google.com/file/d/1g_nQ-CBM3anUzHT3GZqukDZ55f2-ZgSB"