yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
this is my output script for step-2

khalid@DESKTOP-B1I4TKE:/mnt/d/fire hd 8 2017 ar/amonet-douglas-v1.1/amonet$ ./step-2.sh

Testing root access...

uid=0(root) gid=0(root) context=u:r:init:s0

Looking for partition-suffix

lrwxrwxrwx root root 2010-01-25 13:49 recovery_tmp -> /dev/block/mmcblk0p18

Flashing exploit

bin/boot.hdr: 1 file pushed. 0.3 MB/s (4096 bytes in 0.015s)

bin/boot.payload: 1 file pushed. 5.1 MB/s (492132 bytes in 0.092s)

8+0 records in

8+0 records out

4096 bytes transferred in 0.001 secs (4096000 bytes/sec)

961+1 records in

961+1 records out

492132 bytes transferred in 0.032 secs (15379125 bytes/sec)

8+0 records in

8+0 records out

4096 bytes transferred in 0.001 secs (4096000 bytes/sec)

961+1 records in

961+1 records out

492132 bytes transferred in 0.032 secs (15379125 bytes/sec)

Flashing LK

bin/lk.bin: 1 file pushed. 3.7 MB/s (485988 bytes in 0.126s)

949+1 records in

949+1 records out

485988 bytes transferred in 0.035 secs (13885371 bytes/sec)

Flashing TZ

bin/tz.img: 1 file pushed. 2.5 MB/s (3307008 bytes in 1.238s)

6459+0 records in

6459+0 records out

3307008 bytes transferred in 0.289 secs (11442934 bytes/sec)

6459+0 records in

6459+0 records out

3307008 bytes transferred in 0.308 secs (10737038 bytes/sec)

Flashing Preloader

bin/boot0short.img: 1 file pushed. 3.4 MB/s (143020 bytes in 0.040s)

279+1 records in

279+1 records out

143020 bytes transferred in 0.014 secs (10215714 bytes/sec)

bin/preloader.bin: 1 file pushed. 5.9 MB/s (138924 bytes in 0.022s)

271+1 records in

271+1 records out

138924 bytes transferred in 0.014 secs (9923142 bytes/sec)

Flashing final GPT

gpt-D01EB0A014660Q99/gpt.bin.step2.gpt: 1 file pushed. 1.6 MB/s (17408 bytes in 0.010s)

34+0 records in

34+0 records out

17408 bytes transferred in 0.002 secs (8704000 bytes/sec)

Flashing final GPT (backup)

gpt-D01EB0A014660Q99/gpt.bin.step2.bak: 1 file pushed. 2.5 MB/s (16896 bytes in 0.006s)

dd: /dev/block/mmcblk0: Invalid argument

Flashing TWRP

bin/twrp.img: 1 file pushed. 3.3 MB/s (13512704 bytes in 3.955s)

26392+0 records in

26392+0 records out

13512704 bytes transferred in 1.458 secs (9267972 bytes/sec)

Rebooting into TWRP

khalid@DESKTOP-B1I4TKE:/mnt/d/fire hd 8 2017 ar/amonet-douglas-v1.1/amonet$

and also i witt attach my gpt

and also i extract amonet-fix to amonet-1.1 as you say before i told you i use this method on 32 GB with out problems and also idelete gpt folder for 32gb befor star 16 gb and also delete my computer cache and also i use this method on win10 and linux with same result

i send this script after i used to 16gb device and stock to amazon logo

also i try to boot manually to twrp but nothing happen

thanks for your time

and what this line mean ???

Flashing final GPT (backup)

gpt-D01EB0A014660Q99/gpt.bin.step2.bak: 1 file pushed. 2.5 MB/s (16896 bytes in 0.006s)

dd: /dev/block/mmcblk0: Invalid argument
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
If you try to get google play and service use amazon fire toolbox v6.0

https://xdaforums.com/hd8-hd10/development/official-amazon-fire-toolbox-v1-0-t3889604
[Fire HD 8 and HD 10 Original Android Development] qbikashgurung:
Ok sure I know I can install it like that. But flashing gapps is better right. (Not sure why, but I read it is better)

What I mean from my earlier post, I believe there is a problem with the TWRP that is included in the OP - if it thinks our device is ARM and not ARM64?

Is it a TWRP bug?
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
Humm may be not supported to this device same as customize rom i also waiting for answer
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
The hardware is 64-bit, but the OS is only 32-bit.

Something is going wrong here, when trying to write the backup-gpt.

Can you please try with the attached step-2.sh and send me the output?
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
Ok my friend i am ready to test it and thank for your time

Testing root access...

uid=0(root) gid=0(root) context=u:r:init:s0

Looking for partition-suffix

lrwxrwxrwx root root 2010-01-29 09:50 recovery_tmp -> /dev/block/mmcblk0p18

Flashing exploit

bin/boot.hdr: 1 file pushed. 0.3 MB/s (4096 bytes in 0.014s)

bin/boot.payload: 1 file pushed. 3.1 MB/s (492132 bytes in 0.151s)

8+0 records in

8+0 records out

4096 bytes transferred in 0.001 secs (4096000 bytes/sec)

961+1 records in

961+1 records out

492132 bytes transferred in 0.026 secs (18928153 bytes/sec)

8+0 records in

8+0 records out

4096 bytes transferred in 0.001 secs (4096000 bytes/sec)

961+1 records in

961+1 records out

492132 bytes transferred in 0.044 secs (11184818 bytes/sec)

Flashing LK

bin/lk.bin: 1 file pushed. 4.0 MB/s (485988 bytes in 0.116s)

949+1 records in

949+1 records out

485988 bytes transferred in 0.027 secs (17999555 bytes/sec)

Flashing TZ

bin/tz.img: 1 file pushed. 3.8 MB/s (3307008 bytes in 0.836s)

6459+0 records in

6459+0 records out

3307008 bytes transferred in 0.178 secs (18578696 bytes/sec)

6459+0 records in

6459+0 records out

3307008 bytes transferred in 0.233 secs (14193167 bytes/sec)

Flashing Preloader

adb: error: cannot stat 'bin/preloader.hdr0': No such file or directory

khalid@DESKTOP-B1I4TKE:/mnt/d/fire hd 8 2017 ar/amonet-douglas-v1.1/amonet$

I write command like this

./step-2-test.sh

Good night
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
I am sorry, I have sent you the wrong file, it already includes some changes that aren't in the current amonet.

Please use the attached zip-file and give me the output of step-2.sh
[Fire HD 8 and HD 10 Original Android Development] Crosby87mvp:
I get "waiting for bootrom" when i try every script what do I do to get past that I tried everything I need to run the gpt fix script

Edit: nevermind got this to work after using the return-to-stock.sh it took a few tries
[Fire HD 8 and HD 10 Original Android Development] spikked27:
Yep my device is listed and I was able to flash twrp but the tablet just hangs at the amazon logo when trying to boot into recovery
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
How did you flash it and on which partition?

Try it like this:

fastboot flash recovery_x twrp.img
fastboot erase userdata
fastboot flash MISC boot-recovery.bin
fastboot reboot

In case you get still a bootloop at the logo, try again with:

fastboot flash recovery_x twrp.img
fastboot format userdata
fastboot flash MISC boot-recovery.bin
fastboot reboot

Grab the images out of the amonet.zip from bin folder.
[Fire HD 8 and HD 10 Original Android Development] mobaddict:
I used the brick 9820 and do as told to remove the connection and power off. But upon doing the bootrom-step.sh and reconnecting, nothing happens and it looks like the tablet is in permanent brick. Any ideas on how to fix this?
[Fire HD 8 and HD 10 Original Android Development] Sus_i:
Check lsusb while connected, if you can see something like mtk phone, preloader or fire device
[Fire HD 8 and HD 10 Original Android Development] mobaddict:
Weird, I guess it needed to rest because I tried it again and it was now successful. Maybe just issue in the wired connection. Thanks for replying.
[Fire HD 8 and HD 10 Original Android Development] kvjajoo:
Hi All,

I am running Fireos 5.7.0.0 on my 2017 Fire HD 8 (7 Gen). But when i run step-1.sh i get below error. I am using Ubuntu Desktop 22.04 running over VirtualBox 7.

kvjajoo@ubuntudesktopvm:~/Downloads/amonet$ sudo ./step-1.sh
Testing root access...

Trying to use mtk-su to get temp root...
Pushing root files
bin/mtk-su: 1 file pushed. 0.6 MB/s (65144 bytes in 0.099s)
bin/minisu.img: 1 file pushed. 0.7 MB/s (1048576 bytes in 1.344s)
bin/busybox: 1 file pushed. 0.7 MB/s (587368 bytes in 0.763s)
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
^C
kvjajoo@ubuntudesktopvm:~/Downloads/amonet$ adb devices
List of devices attached
G090ME0672570NKW device

Any ideas on what's happening ??
[Fire HD 8 and HD 10 Original Android Development] jonpjingleheimler:
Hi. Is there by any chance a adb command that can boot into hacked bootloader? I found a newer version of twrp and flashed the image to recovery in the original twrp. the new twrp does nothing and does not have a reboot to hacked bootloader option. I'm on Lineage 17 and it boots properly. I can boot to regular fastboot also but that seems rather pointless. any advice would be welcome. If the wifi allowed me to connect to more than a hotspot I'd simply stay on the os im stuck on now
[Fire HD 8 and HD 10 Original Android Development] jonpjingleheimler:
Post in thread '[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)' https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-8-2017-douglas.3962846/post-80287339

This worked for me.
[Fire HD 8 and HD 10 Original Android Development] j10hx40r:
@k4y0z, @Rortiz2, @xyz` I am trying to port this to Echo dot 2nd Gen (mt8163) and can use some help. I have no experience of reverse engineering or binary exploitation. Still I was able to figure some things out.​

For the preloader and LK included in https://d1s31zyz7dcc2d.cloudfront.n...it_puffin-NS6555_user_4310M_0008087721594.bin, I tried reverse engineering the same and was able to patch them to boot into an unlocked device when booting from USB. I have figured out some of the addresses needed for lk-payload and microloader as follows

get_device - 0x4bd190ec

cache_clean - 0x4bd1eac0

fastboot app - 0x4bd21158

I am struggling to create the ROP chain used in inject_microloader.py. Could you guys please help me out with this

PS: I have enabled full root adb access on this device with dm-verity disabled using fos_flags (0xA3) and have also disabled selinux using dev_flags (0x40) so I can easily test any changes on the device.
[Fire HD 8 and HD 10 Original Android Development] tim.baxter@talktalk.net:
Thank you so much for your flashing method. None of the others which I tried got as far as running any scripts to transfer files!

The only time I was confused was when I ran your "sudo ./fastboot-step.sh

// takes a couple of minutes (1-3 min in my case)

// reboots the device"

I got a conflicting message on my Fire screen which told me to disconnect and reboot. I ignored it and got TWRP. The Lineage file I found no problem and downloaded. But the GAPPS file was more difficult. It wasn't until I read the actual filename to be installed that I googled it and downloaded it. Even then I could only find a previous version (3 months, that is) which installed successfully. Google Play services has just updated and all seems tickety-boo. Thank you so much again.
[Fire HD 8 and HD 10 Original Android Development] CuF:
Did you go here and select the pico, arm64, 8.1 for LineageOS 15.1 and 10 for LineageOS 17.1?

The Open GApps Project

OpenGApps.org offers information and pre-built packages of The Open GApps Project. The Open GApps Project is an open-source effort to script the automatic generation of up-to-date Google Apps packages. All Android versions and platforms supported.

opengapps.org
[Fire HD 8 and HD 10 Original Android Development] Thomas131:
Hi!

Thanks for the exploit!!

I have "unlocked" my douglas using this hack and installed LineageOS 17.1. How to install magisk - the normal way doesn't work and patching boot_x had no effect.

Thanks in advance!

Thomas
[Fire HD 8 and HD 10 Original Android Development] danzew:
Leaving the content up so can laugh, but resolved on own. WSL needs USBIPD to see the attached tablet, if others also experience same as I.
[Fire HD 8 and HD 10 Original Android Development] danzew:
Hi ChaosLord, We might be in similar boat. I too have a Gen7. From the OP it makes mention that if you have newer OS then 5.6 you need to brick and downgrade:

so my question is, after grabbing the arm64 version of rapid temp root file, as directed to place in bin folder, I run the step-1.sh and get a repeating error that

so were you ever prompted to brick device as instructions hint at? I feel either some directions got lost with edits over time, or the script is failing before it can ask me to brick. Any thoughts?
[Fire HD 8 and HD 10 Original Android Development] chaosl0rd:
Hi Danzew,

i tried the exact same at the beginning and got the same error (Failed critical init step 4), so i never got to the brick part and then got to the offline root method because everywhere is written down that it would work.
[Fire HD 8 and HD 10 Original Android Development] danzew:
duplicate my apologies
[Fire HD 8 and HD 10 Original Android Development] NeelFromYT:
I recently tried to root my fire hd8. but when I tried to boot into twrp using advanced restart, it shows recovery mode, then exits and boots normally. Please help bro
[Fire HD 8 and HD 10 Original Android Development] danzew:
can you point me at this offline root? So i read thru the whole thread, there was someone back in october with same issue but OP had already stopped replying to the thread. want to give your attempt a try because you had the impressive log to share... I attempted using the brick shell scripts (both independently, both fail to create the temp root shell to get TWRP installed. other then the other fellow who was successful on satuday, I'd say missing something.

Edit: i'm going to try the hardware root option, as that does still seem to have the most success. I'll try and find or will create if succssful a tutortial where the pictures haven't expired https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-8-2017-douglas.3962846/post-80287339
[Fire HD 8 and HD 10 Original Android Development] danzew:
Neel, did everything go per instruction up until the attempt to boot into TWRP? that might just require a couple more attempts at running the steps from 4 I believe.... I'm unable to get a finger on my issue, but have read al 40 pages, so just passing what other, wiser folks have shared
[Fire HD 8 and HD 10 Original Android Development] NeelFromYT:
Yeah everything worked fine up until TWRP. Technically I even got into Lineage OS, but when I tried to get into recovery to flash Magisk I wasn't able to even boot into recovery
[Fire HD 8 and HD 10 Original Android Development] NeelFromYT:
I'm gonna try running from step 4 again
[Fire HD 8 and HD 10 Original Android Development] chaosl0rd:
Hi again,

the offline root i mentioned is this one:

3ch01c.github.io/docs/how-to-setup-amazon-fire-hd10.md at master · 3ch01c/3ch01c.github.io

Tools and guides for doing software development, data analytics, online privacy, and other things. - 3ch01c/3ch01c.github.io

github.com
[Fire HD 8 and HD 10 Original Android Development] NeelFromYT:
mate how long does running step 4 usually take?
[Fire HD 8 and HD 10 Original Android Development] Caffeine81:
First of all thank you @k4y0z very much for this unlock/root method! 🫶 I had to use the brick method because I had a newer Fire OS but all worked nicely! 👍🏼 I just have a problem with Magisk. I tried to install Magisk 25.2 with the custom recovery method via TWRP. The installation went through but I was stuck in a boot loop afterwards, seeing the Amazon logo over and over. I had to flash LineageOS again to fix the boot loop and ended up using SuperSU for root but I would prefer Magisk. Any idea why it's not working?
[Fire HD 8 and HD 10 Original Android Development] VladimirMoskalenko:
After following the guise, I got stuck on step 9 with this in my console:

Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)

YES

Bricking PL Header

Check instructions on device

Sending sparse 'brick' 1/1 (484 KB) OKAY [ 0.034s]

Writing 'brick' FAILED (remote: 'the command you input is restricted on locked hw')

fastboot: error: Command failed
[Fire HD 8 and HD 10 Original Android Development] bequest333:
Hi

I became <waiting for device> in fastboot-step.sh, but it was solved by the following method.

Edit <fastboot-step.sh> (-i 0x1949)x4

#!/bin/bash

set -e

echo "Your device will be reset to factory defaults..."

echo "Press Enter to Continue..."

read

fastboot -i 0x1949 flash recovery_x bin/twrp.img

fastboot -i 0x1949 erase userdata

#fastboot format userdata

fastboot -i 0x1949 flash MISC bin/boot-recovery.bin

fastboot -i 0x1949 reboot

echo ""

echo "Your device will now reboot into TWRP."

echo ""
[Fire HD 8 and HD 10 Original Android Development] cmskipsey:
Been trying to do this for my Fire HD 8 (2017) but when I run step-1.sh I get this

Failed critical init step 4
Firmware support not implemented

I've done a bit of investigating - tablet has USB debugging enabled in developer options, adb can see the device and force it to reboot into the bootloader. Even when it goes into fastboot - when I run fastboot devices its listed...

Firmware is Fire OS 5.7.0.0

What am I missing? What else can I try?
[Fire HD 8 and HD 10 Original Android Development] ApathyImp:
i'm having the same problem, the tablet auto-installed OTA updates to 5.3.7.0 and has another update queued. i just turned the power off completely since stock doesn't let you turn off updates (eff you so much amazon).

@k4y0z are we just completely stuck at this point, or is there a workaround? really appreciate all the work you've done on this!
[Fire HD 8 and HD 10 Original Android Development] CuF:
I ran into this too. IIRC, when it tries to connect to wifi, select a wifi, but don't log in. It will then give you the option to cancel the update since there is no internet.

Otherwise, if the firmware is newer than 5.6.4.0, you have to brick the unit and roll back the firmware.
[Fire HD 8 and HD 10 Original Android Development] ApathyImp:
right, but isn’t the tool supposed to do that for us? maybe i misunderstood but that’s definitely how i interpreted the instructions.
[Fire HD 8 and HD 10 Original Android Development] orangetreefrog4:
How exactly would I downgrade the device or is it an automated part of the scripts?

My device is a Douglas (right one for this guide) on "Fire OS 5.7.0.0" if that affects anything.
[Fire HD 8 and HD 10 Original Android Development] orangetreefrog4:
If these two messages are the same attempt, it means process failed because you are a Linux shell for Windows, which is basically a stripped-down virtual machine.

Virtual machines cannot use exploits such as this (and the Checkm8 exploit for iOS) because of problems with the passthrough.

All you need to do, if you can recover your device, is to use a usb or other storage medium to create a live bootable system of a Linux repo and do this tutorial on there as this has direct access to the device instead of through some sort of windows driver.
[Fire HD 8 and HD 10 Original Android Development] orangetreefrog4:
Anyone attempted from Fire OS 5.7.0.0?
[Fire HD 8 and HD 10 Original Android Development] rredbeard:
Just did mine yesterday with 5.7.0.0. Follow this from earlier in the thread as it worked for me: https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-8-2017-douglas.3962846/post-86043773

Just as a side note, I used brick-9820.sh

Also, after flashing I installed LineageOS 17.1. Having an issue with that, as the file manager is unable to unzip files from within LineageOS. Like I can’t extract files or move them from one folder to another. Anyone else had anything like that happen?
[Fire HD 8 and HD 10 Original Android Development] htc-8925:
I bought a "for parts only" pair of what I thought were supposed to be two fire 7 5th gen tablets from eBay for $20. To my surprise one of these fire hd8 7th gen showed up. SD card reader burnt, unresponsive, wouldn't charge or show signs of life (heavily water damaged). I just needed to get this all out in public forum I guess, but I've been battling addiction for the last two years, my wife attempted suicide in feb of this year and three of our kids moved out. I lost my job, I'm about to be homeless with my now even further damaged disabled wife- but reading all these threads here on XDA and elsewhere deeply inspired me (the amphetamines helped too) to take this water-damaged piece of poo tablet and make a proper, working, usable tablet that I JUST got working 100% at 0420 on this 12th day of May, 2023. Fully functional, speakers, bluetooth, headphone jack, buttons, screen- everything but the SD slot (I can solder, but this **** is TINY and kinda intimidating, plus where the heck do you but a replacement MOLEX micro-SD card reader for a 2017 Amacrap tablet??)

If I can take a piece of junk and make it shine, anybody can do this if they READ AS INSTRUCTED and never give up.
[Fire HD 8 and HD 10 Original Android Development] hayabusa777:
Hello, I managed to flash my Fire Hd 8 2017 5.7.0.0 with Lineag 17.1 without opening the device to make a short circuit, it was enough with the software method, thanks to the developers, great work, I have on a small laptop Linux installed, I always got hacked up to recovery, when trying to use sudo ./fastboot.sh, the command was not found. I then read that Fastboot was not installed in Linux. Installed and it worked, reboot and got into Trwp.Maybe it will help someone with the same problem, small mistake, big effect.With open gapps I deleted the app size.txt file in the zip file and then I was able to install gapps in trwp, otherwise the error 70 came up, rezize file system didn't help.The only thing that doesn't work right for me now is whatsapp, the message comes with a delay, the call comes in very briefly and then I can't make a call
[Fire HD 8 and HD 10 Original Android Development] CuF:
You didn't need to double post across two threads. If you read the first post here...

Known issues

:

Front camera and video recording
[Fire HD 8 and HD 10 Original Android Development] hayabusa777:
ok sry for double post, thanks for the help, now have 15.1 installed
[Fire HD 8 and HD 10 Original Android Development] CuF:
Did that fix your issue?
[Fire HD 8 and HD 10 Original Android Development] hayabusa777:
Yes
[Fire HD 8 and HD 10 Original Android Development] CuF:
Glad to hear it. That issue is the reason I'm sticking with 15.1 as well.
[Fire HD 8 and HD 10 Original Android Development] chamelo003:
Can this be performed on fire os 5.7.0.0?
[Fire HD 8 and HD 10 Original Android Development] nuclear_bullet:
vjunk, THANK YOU. I was one of many that was probably stuck on that step scratching my head. THANK YOU again, I'm staring at TWRP on my Fire HD 8 Douglas!!!
[Fire HD 8 and HD 10 Original Android Development] ApathyImp:
@vjunk thank you soooooo much! this was exactly what we needed to get unstuck. you are a scholar and a gentleperson!~
[Fire HD 8 and HD 10 Original Android Development] OctaneZ:
Thank you @vjunk for updating the guide....

I am running into trouble still. No problem getting into fastboot with `adb reboot bootloader`

but when I run the brick commands I get:

sudo ./brick-9820.sh
Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)
YES
Bricking PL Header
Check instructions on device

< waiting for any device >
Sending sparse 'brick' 1/1 (12 KB) OKAY [ 0.018s]
Writing 'brick' FAILED (remote: 'the command you input is restricted on locked hw')
fastboot: error: Command failed

But whether I reboot into recover or using ADB I can't get past this "restricted on locked hw"

any advice?