yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] vjunk:
I haven’t seen the "restricted on locked hw" message before. Then again, I’ve only unlocked two Fire HD 8 tablets so far. A few things to double-check:

The tablet is the Fire HD 8, 7th gen/2017 version, code name douglas.

You are using amonet-douglas-v1.2.zip, not the 1.0 or 1.1 version.

The Fire OS version is newer than 5.6.4.0. (I believe mine were 5.7.0.0.)

If it’s 5.6.4.0 or older, follow the original procedure in the first post since there is no need to temporarily brick the device.

Note, if Amazon released a new version in the past few months, they may have patched the flaw that allows bricking the tablet with this method. If so, there may not be a way around it without opening up the tablet.

mtk-su was copied from the arm64 directory to the brick-douglas/amonet/bin directory.

If all of the above is correct, the only thing I can think of is trying sudo ./brick.sh instead of sudo ./brick-9820.sh. If you do, run sudo ./bootrom-step-minimal.sh instead of sudo ./bootrom-step.sh in Step 14.

If that doesn’t work, perhaps @k4y0z can provide some advice. If not, @Rortiz2 knows these devices very well and may have an idea (although his expertise is more in building the ROMs for these).

Good luck!
[Fire HD 8 and HD 10 Original Android Development] SynPolka:
Is it method still work on fire os 5.7.1.0?
[Fire HD 8 and HD 10 Original Android Development] ApathyImp:
i was able to do it on 5.3.7.0, which is considerably older and i had to use the modified instructions @vjunk provided in the more recent replies on this board.

realistically the only way to know for sure is to try it and see what happens, but that does run the risk of potentially permanently bricking your device so i would suggest you only do so if you’re experienced, knowledgeable, and fully accept that risk of losing the device completely if things go wrong.

if i were to make an educated guess though, i would say it is increasingly less likely to work with each newer update from amazon as this is the kind of thing that security patches tend to target. so it might not be worth the hassle, but that is something you will have to decide for yourself.
[Fire HD 8 and HD 10 Original Android Development] SynPolka:
Thank for your reply ,Apathylmp,and I will try vjunk´s method as soon as I can get an Ubuntu PC.

And in addition,I don't know how my fire could get update from 5.6.4.0 to 5.7.1.0 when the most of amazon device services are unavailable in China.
[Fire HD 8 and HD 10 Original Android Development] SynPolka:
OK,and I have already tried @vjunk 's method,and the method still work on fire os 5.7.1.0.Thans for everybody's help.
[Fire HD 8 and HD 10 Original Android Development] ApathyImp:
nice! thanks for updating everyone, good to know it’s still working on [more] current versions.
[Fire HD 8 and HD 10 Original Android Development] kaizoku_:
I have a douglas hd8 which I rooted succesfully using the guide here, then installed and ran LineageOS from Rortiz2's build on this thread.

It was working alright, but wanting to upgrade I built LineageOS from source using the repos at github.com/mt8163-dev.

I flashed the ROM I built, thinking I could always re-flash the build I had working, but now I can't boot into TWRP or recovery at all.

Unfortunately the ROM I built is also not loading the launcher so, the tablet is kinda unusable at this point.

Holding volume down while booting shows:

=> RECOVERY mode...

but then it boots back to LineageOS.

Fastboot just says it's locked if I attempt to reflash TWRP or boot it from RAM:

~/android/hd8/amonet ▓▒░·········································
❯ ./bin/fastboot flash recovery_x ./bin/twrp.img
target reported max download size of 114294784 bytes
Sending 'recovery_x' (13196 KB)...
OKAY [ 0.625s]
Writing 'recovery_x'...
FAILED (remote: the command you input is restricted on locked hw)
Finished. Total time: 0.647s

~/android/hd8/amonet ▓▒░·········································
❯ ./bin/fastboot boot ./bin/twrp.img
Downloading 'boot.img'
OKAY [ 0.619s]
booting
FAILED (remote: the command you input is restricted on locked hw)
Finished. Total time: 0.684s

I also can't write TWRP from LineageOS since I don't have su and mtk-su doesn't work

douglas:/ $ /data/local/tmp/mtk-su
Failed critical init step 4
This firmware cannot be supported

Before I screw this up more, any suggestions?

Can I get into the hacked fastboot without TWRP?

Am I totally hosed?
[Fire HD 8 and HD 10 Original Android Development] SynPolka:
Have you ever tried the"adb reboot recovery" command?
[Fire HD 8 and HD 10 Original Android Development] kaizoku_:
Yeah, that has the same result as holding "volume down". It just fails to load recovery and reboots into LineageOS.
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
Hey Everyone! I am a new user of XDA, so bear with me. I have the Fire HD 8 7th Gen 16GB. I have working over the last few months (Yes, Months!) to get the tablet working. So far I have had no success.

Background​

When I got the tablet, it was working somewhat. The previous owner said that it was working the night before, but didn't turn on the next morning. I suspected that it ran out of power during an update... When I first got it, I tried to power it up. It turned on to the Fire Logo and then turned off (It was stuck in a boot loop). I went into recovery mode and viewed the logs. It appeared that it was failing to boot due to the error '/dev/tty0: No such file or directory'. There was also some error about a RTC problem. I had no idea what that meant. I did a factory reset but it didn't change anything. Next, I booted into fastboot and ran sudo ./brick-9820.sh after downloading brick-douglas.zip. After that, the screen has not turned on... I can not get into recovery or fastboot. Only the bootrom when shorting pin TP28 with ground.

What I have tried​

Running gpt-fix16G.sh from Douglas fails with bad gpt. Running sudo ./bootrom-step.sh from the Douglas zip file while shorting pin TP28 has this output:

Spoiler content hidden.

Thanks in advance! :)
[Fire HD 8 and HD 10 Original Android Development] Hanululu:
1. I can't find the file for rooting. Can I leave out step 1. orange, if I only want to unlock / twrp the fire? (The goal is to install a LineageOS, but root is not necessary).

2. (Just to be clear: it is correct to use amonet-douglas-v1.2.zip, while the guide talks about using v1.1, right? I consider it isn't updated and only v1.0 is needed in special case return to stock)

Edit: Ok, found an answer to q1, in the master thread: "You can flash Magisk using TWRP after bootloader unlock"

3. Stuck with WSL 2 and USBIPD. Installed the USB driver from Amazon. adb devices in wsl doesnt see the device, but adb in windows does see it... :/

4. Gonna try again with Virtual Box
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
Your probably going to be best off booting a live Ubuntu USB if possible... Like Ubuntu 22.04.3 Desktop. Good luck! :)
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
Same Problem Here... Did you ever resolve it?

@Rortiz2 , @vjunk @DragonFire1024 , @k4y0z - Any idea?

EDIT1: MtkClient works fine with it... it can rw all partitions... trying to flash generated gpt using it..
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
Anyone?? :confused:
[Fire HD 8 and HD 10 Original Android Development] hothanh:
my douglas ver fire os is 5.7.1.0. Anyone know how to downgade to 5.6.4.0? and where i can download os 5.6.4.0

I want install lineageos. the 1st post required os 5.6.4.0

thank you
[Fire HD 8 and HD 10 Original Android Development] hothanh:
My device is 5.7.1.0. Could anyone can help me how to downgrade Thank
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
Try this to start. It probably will not work but if it does then you have root access. Also maybe try this.
[Fire HD 8 and HD 10 Original Android Development] sbussinger:
Just a note to say thank you to vjunk and the rest of the people on this thread. I followed vjunk's instructions on the previous page and successfully installed TWRP , Magisk, and rooted my Fire HD 8 (2017) while running FireOS 5.7.1.0.

For what it's worth, I did it from a Windows 11 machine running the Windows Subsystem for Linux (WSL) with Ubuntu. The main trick to doing that was using usbipd-win to map the USB ports to the WSL.

Thanks again!
[Fire HD 8 and HD 10 Original Android Development] honeybadger1650:
On the same version but when running sudo ./step-1.sh I get "Failed critical init step 3". You used the regular ARM version of mtk-su or arm64? Also it was mtk-su_r23 yes? Clicking the link on page 1 gives a 404 so I got it from https://xdaforums.com/t/amazing-temp-root-for-mediatek-armv8-2020-08-24.3922213/ instead.
[Fire HD 8 and HD 10 Original Android Development] sbussinger:
It's been awhile now, but I got the file mtk-su_r23.zip from the same place you did. I'm 95% sure I used the arm64 version (everything else I've used are 64 bit versions). Good luck!
[Fire HD 8 and HD 10 Original Android Development] luhgarlicbread:
Yoooo on number 7 I didn't read it fully and I disconnected the USB before holding the power down button. Now it appears as if my tablet is bricked. What can I do?

EDIT: NVM! I just had to run bootrom step then fastboot step. Thanks y'all! God bless!!!
[Fire HD 8 and HD 10 Original Android Development] nikki_sp:
hello everybody!

i'm new and after 43 pages i wonder if i can install any lineage in my amazon fire douglas 5.7.1.?

thank you from Spain!
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Yes, you can. Just follow the instructions in the first post and you should be good to go. I'm also from Spain and I can guide you through Telegram if you want to.​
[Fire HD 8 and HD 10 Original Android Development] nikki_sp:
te he mandado un privado, gracias!
[Fire HD 8 and HD 10 Original Android Development] tgptgp:
I had come across this recently and worked great for me.

To enable adb on all network interfaces
[Fire HD 8 and HD 10 Original Android Development] geoduck0:
Kindle HD8 gen7 , Douglas.

Was stuck on fire boot up screen and showed GPT error on recover screen.

Bricked device using brick-9820

I have tried running GPT-fix 16g and 32G

at a loss of what to try now
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
I had the EXACT same issue. I tried fixing for months just as a hobby, but never got it working...
[Fire HD 8 and HD 10 Original Android Development] geoduck0:
when I run LSUSB the HD8 GEN7 fire shows as a " MediaTek Inc. MT6227 phone"
[Fire HD 8 and HD 10 Original Android Development] geoduck0:
Ran Boot-Recovery sh and received ready to read but no data

Any suggestions on what to do next ..
[Fire HD 8 and HD 10 Original Android Development] long2905:
this works great for me as of June 6th 2024. the download link helps too as the one in the main thread died already. im having trouble downloading opengapps and bitgapps core though as the download speed is extremely slow for some reason.
[Fire HD 8 and HD 10 Original Android Development] TheHitMan:
Download BiTGApps from here.

BiTGApps

Google Apps Package

bitgapps.io
[Fire HD 8 and HD 10 Original Android Development] gugugu89:
I followed the guide above but on bootrom-step i have error and the Fire si on bootloop on AMZ logo

Does anyone have a clue? Do i need to open physically the Fire to debrick?

thanks!

laboratorio3@Laboratorio3-Ubuntu:~/Scaricati/amonet-douglas-v1.2/amonet$ sudo ./bootrom-step.sh

[2024-06-12 20:20:19.117246] Waiting for bootrom

[2024-06-12 20:20:39.545977] Found port = /dev/ttyACM0

[2024-06-12 20:20:39.584691] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

b''

b'\x00\x01'

Traceback (most recent call last):

File "/home/laboratorio3/Scaricati/amonet-douglas-v1.2/amonet/modules/main.py", line 256, in <module>

main()

File "/home/laboratorio3/Scaricati/amonet-douglas-v1.2/amonet/modules/main.py", line 129, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/home/laboratorio3/Scaricati/amonet-douglas-v1.2/amonet/modules/load_payload.py", line 123, in load_payload

dev.write32(0x10007008, 0x1971) # low-level watchdog kick

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/laboratorio3/Scaricati/amonet-douglas-v1.2/amonet/modules/common.py", line 163, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "/home/laboratorio3/Scaricati/amonet-douglas-v1.2/amonet/modules/common.py", line 90, in check

raise RuntimeError("ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
If you can access fastboot mode, you can try using the brick script (which can be downloaded from the OP). Otherwise, you'll need to open the tablet and short the required pins. It's not a big deal, but be careful not to damage the screen flex cable.​
[Fire HD 8 and HD 10 Original Android Development] gugugu89:
I think is a desperate situation..

here it is:

1. I removed the cover and detached the battery connector (to be sure no power). When I connect the battery and try to switch on the "low battery" icon appears.

2. Connecting the cable to charge the battery (I suppose), fire continuously reboot on Amz logo

3. Try to force shutdown sometimes work, sometimes not but the when i connect cable/switch on I'm in the step 2

4. No change to get into fastboot mode

Which is the pin to be shorted? I can't find the thread with the procedure/images.

many thanks!
[Fire HD 8 and HD 10 Original Android Development] A Cool User:
It's TP28. Take a look at this for more information :).
[Fire HD 8 and HD 10 Original Android Development] bankerjoe:
Very late to this game. Thank you so so much for the amazing and thorough guides for completing this (I'm a noob/not developer person really at all).

That said, I too had to do the hardware short method (TP28). The instructions in the OP did not work, nor did the "brick-douglas" instructions of post #625 ("sudo ./brick.sh" didn't run, gave some error I don't recall; "sudo ./brick-8920.sh" however, did, but then I couldn't execute "sudo ./bootrom-step.sh" - I don't remember why).

Anyway, I have two questions. The first is, in order to do the TP28 short method from Post 154, in pulling back the motherboard I managed to break/disconnect two of the speaker wires. I can't say I really care, but I'm guessing the repair requires soldering, yes?

Secondly, re: Magisk, I'm a little unclear. That can be installed via TWRP, and not gum up the works for the exploits and such? Am I understanding that correctly? I did try to, anyway, without really thinking about it (I did it after installing Lineage 17.1 and BiTGApps Core), but I don't think it took/stuck.

TYIA
[Fire HD 8 and HD 10 Original Android Development] bankerjoe:
So with Magisk, I got a (system?) message saying "" Upgrade to full Magisk to finish the setup.". I, however, have not executed because somewhere in this thread I think someone had mentioned by doing such they corrupted something preventing them from using their tablet. Did I understand correctly? And if so, what's the next step?

TYIA
[Fire HD 8 and HD 10 Original Android Development] 404error60k:
I have a fire hd 8 7th generation on fire OS 5 and 5.7.1.0. I have the original charger and a not powerfull windows 11 pc, i have also a USB key. It's my first root i want lineage OS for android 8.0 or 7.0. Sorry for the bad english i am french. Please tell me what i have exactly to do like if i have to use a linux, tell me how to install on my bad pc, please answer quickly
[Fire HD 8 and HD 10 Original Android Development] BLCollier:
Hoping y'all Android geniuses can help.

I have a Douglas that surplus to my mother in law's requirements, so I'm trying to see if I can get some actual use from it. But I am 100% failing to make any progress with rooting & reflashing this device. It's falling down right at the first hurdle: getting root.

It's been running 5.7.1.0 since long before it came into my hands, so had no chance to prevent further updates.

So... I've followed the original instructions on page 1, @vjunk's instructions from a few pages back, and the mtk-su instructions here (had to download the binary from this thread, but I'm using the latest r23 version).

But whether I push mtk-su over manually or run the step-1.sh script, I get the same two errors: "Failed critical init step 4" and "Firmware support not implemented".

The "Amazing Temp Root for MediaTek" thread indicates that this means mtk-su is blocked:

And the original "Rapid Temporary Root for HD 8" thread says that this device is not supported on the Fire OS version I'm running:

However... Other users have reported success on a 5.7.1.0 device when following the same instructions as I'm trying to follow, such as @sbussinger:

If it makes any difference, I'm also using WSL and I've forwarded the relevant USB device to WSL using usbipd and the WSL USB Manager GUI.

I don't have the original USB cable for the device, it was thrown away long long ago, but the one I'm using has no problem creating an ADB shell connection and properly reports the device to the host operating system.

Normally I'd assume that software root exploits have been patched out in this OS version, but other users have reported success with the same version. So.... am I missing something?!
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
Ok my friend i will test it soon as possible

Thank you every much
[Fire HD 8 and HD 10 Original Android Development] qbikashgurung:
Ok that makes sense! Thanks for that. I now have gapps installted.

Although, when using your guide, I used the 64bit version of mtk-su (99% sure).

Will this cause problems? I flashed the latest magisk after and things seem to be fine, apps that need root are ok.

Should I replace the mtk-su on my device with the 32bit version? I can't find the exact location of where it is installed to.

Perhaps it's just used temporarily and then Magisk adds its own su binary...? No idea :D

Thanks
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Both versions of mtk-su work and it is only used temporary to aid in the unlock-process.
[Fire HD 8 and HD 10 Original Android Development] Supersonic27543:
Wow, thank you!!!! Finally after 2 years we have an unlocked tablet with TWRP! I didn't participate here for months and this is a great surprise, so again thank you for all the people who helped this happen in some way, you are all amazing :angel:
[Fire HD 8 and HD 10 Original Android Development] marrco:
Is it possible to run that using windows 10 WSL ?

With this method WSL (debian) is recognizing my tablet and i'm able to issue (from wsl prompt) command like "adb reboot":

1) windows : download from https://xdaforums.com/android/software-hacking/tool-mini-adb-fastboot-2019-06-30-t3944288/ the actual windows version (atm Mini_ADB_&_Fastboot_v1.1.2-Portable.zip) unzip and "Open CMD.exe"

2) in that window run

adb devices

and keep that prompt window open

3) iin a WSL prompt install the add tools for linux from https://developer.android.com/studio/releases/platform-tools

wget https://dl.google.com/android/repository/platform-tools_r29.0.3-linux.zip
unzip platform-tools_r29.0.3-linux.zip
cd platform-tools
./adb devices

and you get the same device attached. Now from that WSL prompt you can issue all adb commands AFAICT.

is there anything else needed as a prerequisite to run this hack in WSL and not from a real linux machine? I suppose aliasiing adb to this specific version, or replacing wsl provided adb and fastboot could be the next step
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
So this is working?!

I wonder why flashing gpt failed.

Can you please try again manually on the device with serial D01EB0A014660Q99

adb push gpt-D01EB0A014660Q99/gpt.bin.step2.bak /data/local/tmp/
adb shell su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro"
adb shell su -c "dd if=/data/local/tmp/gpt.bin.step2.bak of=/dev/block/mmcblk0 bs=512 seek=30777311"
adb shell su -c "echo 1 > /sys/block/mmcblk0boot0/force_ro"
[Fire HD 8 and HD 10 Original Android Development] slinson:
thank you so much!!
[Fire HD 8 and HD 10 Original Android Development] helpsliprich:
I made a backup in twrp, removed a bunch of system apps and couldn't boot the home screen just the background. Went to restore the twrp back up and it fails at 31 percent.

Anyone got advice? Think I have to wait for a rom :/
[Fire HD 8 and HD 10 Original Android Development] DB126:
Field reports suggest WSL does not reliably communicate with (usb) devices in fastboot mode. WSL2 may work better given native kernel. Haven't tried it myself; just regurgitating what I've heard.
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
thanks my friend

every thing work very good no problem found but i make this steps before start step-2 :

1- i remove the 2 folders that produced in step-1 ( gpt and gpt-regen)

2- start step-2

i have 5 devices and i do this steps for each one and every thing is ok without problem

Note :my 5 devices have same serial no.

---------- Post added at 07:20 PM ---------- Previous post was at 07:14 PM ----------

if you still have twrp. flash stock rom from amazon but rename it from bin to zip and flah it by twrp install

i thing this will help you

---------- Post added at 07:32 PM ---------- Previous post was at 07:20 PM ----------

i use ubuntu for win10 and i can run step-1 and step-2 from linux shell in windows 10
[Fire HD 8 and HD 10 Original Android Development] helpsliprich:
Do you happen to know where I can find a Douglas rom?
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
https://www.amazon.com/firehd87thgensoftwareupdate
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Removing the folders shouldn't be necessary, since I added the serial-number to the folder-names.

Why do your devices have the same serial-number?

I still don't understand why flashing the backup-gpt failed.

In the last file I gave you that command has been commented out.
[Fire HD 8 and HD 10 Original Android Development] deathlessster:
also i do not know and why my devices have same serial No. i have 5 devices with 16 GB and 5 with 32 GB and all devices have same serial and some devices that come to me have 000000000000000 serial.

if i leave gpt and gpt-regen and run step-2 the device stuck on amazon logo but when deleted before run step-2 the device success
[Fire HD 8 and HD 10 Original Android Development] kip_dynamite:
Worked perfectly for my 32gb douglas tablet.

Used my pi3 as I had no other linux machine lying around :D

You guys are awesome!
[Fire HD 8 and HD 10 Original Android Development] qbikashgurung:
I just want to add for others, no need to use a 'real' system - I use vmware and downloaded ubuntu-18.04.3-desktop-amd64.iso, it worked fine for me in a vm.
[Fire HD 8 and HD 10 Original Android Development] markoajda:
I'm on 5.6.4.0 is that ok do I need to downgrade?
[Fire HD 8 and HD 10 Original Android Development] Supersonic27543:
I tried with my 5.6.4.0 device and it worked just fine. :)
[Fire HD 8 and HD 10 Original Android Development] BlackMN:
TWRP for what as dont have a ROM ? Sorry i'm noob.
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Thanks Sir but What happend if I am bricked and adb is disabled and I am not able to turn on the fire and enter in settings to enable it, also I only can enter in fastboot mode because adb is not recognized due to adb is not enable it by default l, the only way I see I can handle something is from fastboot but when I an trying to flash something fastboot says unable to flash because your tablet is locked hw. :( if you have any possible solution to reflash even the stock firmware with fastboot with adb oem disabled would be great, I appreciate your possible help and answer sir.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Is your device unlocked? Then try the boot-fastboot.sh to enter hacked fastboot.

If not you currently would have to paritaly disassemble the device to unbrick.

I may have another solution soon, given that you can still access locked fastboot.

Also, please don't quote the entire OP!