yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
That's great news. So if it works we could unbrick it even if it's stuck in fastboot without open it?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
That's the idea, just like for suez and karnak alredy exists, just haven't added to the respective OPs yet.
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Thank you that will be great...! You are the best...!:o I will appreciate your help and effort, please let me know when you have it so I can test it and let you know results but really thank you since now.:good:
[Fire HD 8 and HD 10 Original Android Development] marrco:
in fact, the trick is to use the ADB server from windows. First, launch it from a Windows command prompt and then (leaving the windows version running) you can launch the Linux version. But those must be the same server version, so you better use those specific files I linked, or you get a message about a different server version. Further in this thread, there are reports about successfully using those 2 versions to run ste1 and step2

As far as I can tell if you first run the windows version an ADB server stays active and connected to the FIre so that the Linux version just acts as a client, as long as are compatible version.

I did further tests (but I can't run the full hack atm) and all you need is to create an alias in WSL so that when ADB gets run is the compatible version and not the default installed, so the last step of my previous instruction should be changed to create the alias.

hth
[Fire HD 8 and HD 10 Original Android Development] markoajda:
Could you explain this a bit further. How do I downgrade. I ran

sudo systemctl stop ModemManager

sudo systemctl disable ModemManager

and there is no conformation for bricking the device. Where do I select YES. there is no dialog.

Thank you
[Fire HD 8 and HD 10 Original Android Development] vendo:
Hello Sir

I used your guide on my first table and it went wery smooth. On my other tablet also should be Dougles I got this error

sudo ./step-1.sh

Testing root access...

Trying to use mtk-su to get temp root...

Pushing root files

bin/mtk-su: 1 file pushed. 1.8 MB/s (34312 bytes in 0.018s)

bin/minisu.img: 1 file pushed. 4.4 MB/s (1048576 bytes in 0.229s)

bin/busybox: 1 file pushed. 4.0 MB/s (587368 bytes in 0.139s)

Failed critical init step 4

mount: permission denied (are you root?)

Failed critical init step 4

mount: permission denied (are you root?)

Any idea what is wrong? my os is 5.6.4.0
[Fire HD 8 and HD 10 Original Android Development] lantha:
"Patching system image unconditionally"

I have successfully installed the amonet zip to install TWRP. Using TWRP I cleared data and cache and installed Magisk app. Then i tried installing the Lineage ROM but it has been stuck at "Patching system image unconditionally" for hours. How can i get over this?

My device is Amazon Fire 8 (7th Gen) with system image 5.6.4.0.
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Did you wiped system & data?
[Fire HD 8 and HD 10 Original Android Development] lantha:
Yes I did that twice.
[Fire HD 8 and HD 10 Original Android Development] koop1955:
[MENTION=7104332]k4y0z[/MENTION] Just wanted to say thanks and make a suggestion for some people. I run Win 10 64-bit, I enabled WSL support, downloaded Ubuntu from the Windows Store and using BASH through PowerTools I ran the Step-1 and Step-2 .sh commands. My tablet rebooted to TWRP, I installed Lineage and I could not be happier.

For anyone running Win10, try using Bash: https://www.thewindowsclub.com/how-to-run-sh-or-shell-script-file-in-windows-10
[Fire HD 8 and HD 10 Original Android Development] lantha:
Did you install Magisk?
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Try this:

Boot to TWRP.

Go to wipe.

Advanced wipe.

Select data, system, cache and dalvik cache.

Swipe for format them.

Now go to Format Data.

Type "yes" and swipe to format data.

Now go to install.

Select the ROM, flash it.

Select G-APPS and do the same.

And finally if you want root flash Magisk.

Wipe dalvik cache.

Reboot.
[Fire HD 8 and HD 10 Original Android Development] vendo:
How did you root device on 5.6.4.0?
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Sir, is it too hard to unbrick the fire hd partially dissembling it? I already open my tablet but I do not know how to unbrick it in hardware, what should I do?, even my fire hd 8 does not want to charge and do not know why :(
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
The point that needs to be shorted to run bootrom-step.sh is on the back of the board.

Check the instructions here how to access it.
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Ok, I am going to read it carefully, thanks for the guidance:o:good:
[Fire HD 8 and HD 10 Original Android Development] lantha:
Thank you. This worked like a charm. :)

---------- Post added at 11:57 AM ---------- Previous post was at 11:56 AM ----------

Easy. Just followed the instructions .
[Fire HD 8 and HD 10 Original Android Development] Supersonic27543:
I don't think it is a 5.6.4.0 thing as I rooted in 5.6.4.0 too. It's probably a minor patch applied to 5.6.4.0 that prevents the root.
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Hi, me again, sorry for bothering...:( Do you know how can I recharge my fire HD? Because is bricked it does not want to charge, so I wonder if I disconnect something to recharge it and do the process suggested, I already open and identify the points that needs to short tp28 and ground under the pcb
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
It doesn't need to be charged for the bootrom-step, the battery doesn't even have to be connected.
[Fire HD 8 and HD 10 Original Android Development] HJMB02:
Ok Will test to see what happens, thank you one more time ?
[Fire HD 8 and HD 10 Original Android Development] Roger W:
Thanks for these scripts! I got it unlocked and installed the custom ROM. But then I encrypted the tablet (that worked), and found that the TWRP provided in these tools can't decrypt Data. Is the TWRP fork that this came from in active development?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
The TWRP fork has been synced with TWRP-repos recently and will be resynced when an update is due.

That isn't the issue though, encryption is device-specific and support in TWRP needs to be implemented which isn't easy especially with mediatek.

So It's probably not going to happen, at least not by me.

BTW, you can find the fork here:

https://github.com/chaosmaster/android_bootable_recovery
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Isn't the encryption support added in BoardConfig.mk? I don't know, maybe It's not the case:confused:

If you want, I have enabled encryption support on an mt6753 tablet and my BQ M8 (MT8163) uses it and is working. If you want to take a look at repos:

https://github.com/R0rt1z2/android_device_bq_freezerlte/blob/android-6.0/BoardConfig.mk#L46

https://github.com/R0rt1z2/android_device_bq_aquaris_m8/blob/android-6.0/BoardConfig.mk#L46

Maybe this doesn't help in nothing but since they share same SOC maybe has something to do.:p

Regards.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Thanks, I actually have this in BoardConfig:

TW_INCLUDE_CRYPTO := true
TW_CRYPTO_USE_SYSTEM_VOLD := true

I think the problem is that TWRP is 64-bit but the system is only 32-bit, so it can't properly link the libraries.

Didn't look much deeper into it though.
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Haha no problem, glad to help you:o

I don't know if 64 bit recovery will have effect in /data but maybe.

Try with this flags if you can:

TW_INCLUDE_CRYPTO := true
TW_CRYPTO_FS_TYPE := "ext4"
TW_CRYPTO_REAL_BLKDEV := "/dev/block/platform/mtk-msdc.0/by-name/userdata"
TW_CRYPTO_MNT_POINT := "/data"
TW_CRYPTO_FS_OPTIONS := "nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered"

Regards!:good:
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
This doesn't have anything to do with data...

This will cause twrp to try and use the vold on system, which is a 32-bit binary and since TWRP is build in 64 bit and doesn't support multilib it can't.

TW_CRYPTO_USE_SYSTEM_VOLD := true
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
I see.. Now I understand what you meant..

Since vold that is in /system is 32 bit and TWRP 64 as you said will not work.

I assume that if you use 64 bit vold in a 32 bit will crash so not a good idea. :rolleyes:

Maybe including a 64 bit vold in TWRP helps?:confused: Just for throw ideas.

There's any specific reason of why are you using system vold?

Regards.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Well yeah, so crypto will work...

We don't have amazon vold in 64-bit.

And it will also depend on some libraries we don't.

I guess I could build TWRP in 32-bit, not sure if that will cause issues with 64-bit ROMs though.

You are using that as well:

https://github.com/R0rt1z2/android_device_bq_aquaris_m8/blob/android-6.0/BoardConfig.mk#L51
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Yes I'm using it.

But mine is decrypting correctly. The difference is that bq vold is 64 bit. So you are right, 64 vold will do the trick.;)

Also 32 bit TWRP, I tought that but IDK if as you said cause issues with 64 bit ROMS.

So definelety or 32 bit TWRP or working 64 bit based vold. Give a try to 32 bit TWRP.

Regards.
[Fire HD 8 and HD 10 Original Android Development] markoajda:
This is getting a bit OT.

Can this device still be unlocked with September update 5.6.4.0 (636559820)? Thanks.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You can probably downgrade to the older 5.6.4.0 via stock recovery.

Or use the hardware-method that would require taking the device apart.
[Fire HD 8 and HD 10 Original Android Development] vendo:
I can test it out, will I risk full and permanent brick? Any link to the HOW TO do the recovery process?

Amazon employs an anti-rollback mechanism which could permanently brick your device if you flash an older version through adb sideload.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Unbricking would require taking the device apart and using the scripts in this thread.

The anti-rollback will only brick if any of lk, tz or preloader have changed, which they typically only do if the version-number changes (even if the minor-version changes it typically doesn't brick)

To make sure you can compare these 3 files from both firmware-images to know if it might brick.

If the files are different, that doesn't necessarily mean it will brick, the reverse however is true.

If they are the same it will not brick.
[Fire HD 8 and HD 10 Original Android Development] vendo:
thank you, what version would you recommend me to use if I`m on the latest version on Fire 8 7th gen? And where to download it?
[Fire HD 8 and HD 10 Original Android Development] markoajda:
Here's the link if you're willing to try https://www.amazon.com/firehd87thgensoftwareupdate (update-kindle-50.6.3.6_user_636558520) and report back. Can anyone confirm this is the last verion before the September update (build 636559820)?
[Fire HD 8 and HD 10 Original Android Development] vendo:
Nope , it did not work, the unit is dead, won`t see AMAZON logo nothing. What can I do now?
[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Now time to open the device for unbrick it.

Enviado desde mi WAS-LX1A mediante Tapatalk
[Fire HD 8 and HD 10 Original Android Development] Kyusaku:
Scripts worked like a charm, was running 5.4.0.0, now on Lineage. The only hiccup I ran into was using the arm64 mtk-su, after the failed attempt to install TWRP I replaced the file with the arm copy and worked. Amazing stuff!
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You need to short TP28 to ground, not to VCC as you have mentioned.

Your picture shows it correctly.

Use the tools from this thread.

Leave the battery detached during bootrom-step and reconnect it, when bootrom-step was successful.

Then run fastboot-step.
[Fire HD 8 and HD 10 Original Android Development] vendo:
I so far managed to do following but I`m sucked on 'bad gpt" and do not know what do next , here is what I did

1. sudo ./bootrom-step.sh from amonet folder , success

2. sudo fastboot flash boot boot.img , boot.img file from MEGA, success

3. sudo fastboot flash system system-a.img, system-a.img from MEGA, success

4. sudo ./bootrom-step.sh from amonet-res folder, FAILDE for bad gps

pi@raspberrypi:~/Downloads/amonet-res $ sudo ./bootrom-step.sh

[2019-09-19 16:50:37.113459] Waiting for bootrom

[2019-09-19 16:50:53.602840] Found port = /dev/ttyACM0

[2019-09-19 16:50:53.606052] Handshake

[2019-09-19 16:50:53.612663] Disable watchdog

* * * Remove the short and press Enter * * *

[2019-09-19 16:50:55.943715] Init crypto engine

[2019-09-19 16:50:56.133017] Disable caches

[2019-09-19 16:50:56.136114] Disable bootrom range checks

[2019-09-19 16:50:56.258861] Load payload from ../brom-payload/build/payload.bin = 0x4690 bytes

[2019-09-19 16:50:56.298783] Send payload

[2019-09-19 16:51:02.630561] Let's rock

[2019-09-19 16:51:02.636187] Wait for the payload to come online...

[2019-09-19 16:51:03.794470] all good

[2019-09-19 16:51:03.795991] Check GPT

[2019-09-19 16:51:04.179457] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'lk': (16384, 1024), 'lk2': (17408, 1024), 'boot_x': (18432, 32768), 'recovery_x': (51200, 34816), 'tee1': (86016, 10240), 'tee2': (96256, 10240), 'metadata': (106496, 80896), 'kb': (187392, 2048), 'dkb': (189440, 2048), 'MISC': (191488, 1024), 'reserved': (192512, 16384), 'system': (208896, 3306496), 'cache': (3515392, 868352), 'userdata': (4383744, 25700352)}

Traceback (most recent call last):

File "main.py", line 125, in <module>

main()

File "main.py", line 69, in main

raise RuntimeError("bad gpt")

RuntimeError: bad gpt

5. I ran sudo ./gpt-fix-16G.sh and it went OK , then I ran step 4. above and got GPT error

6. I can now boot into Recovery which is a progress. unit will not boot it will stuck on Amazon logo, When I tried to sideload bim I got insuficient right.

then I did

7. sudo ./bootrom-step-minimal.sh

8. sudo ./fastboot-step.sh

and booted into TWRP

I though I have it done, but now my digitizer is not working and I can not operate TWRP.

Could the non working digitizer be just side-effect of improper recovery process? Could this be fixed via SW?

all I did so far is in the script attached
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Don't flash files from MEGA or run the stuff from amonet-res.

All you need is in the OP of THIS thread.

As said earlier you need to run bootrom-step.sh (or gpt-fix if your GPT is corrupt) after that you need to run fastboot-step.sh.

This will bring you into TWRP, from were you can install a ROM.
[Fire HD 8 and HD 10 Original Android Development] vendo:
I have it, I`m in TWRP but my digitizer is not responding. Perhaps I have demaged from of the flex cables?
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Make sure the cable is properly connected, it's the one at the top center near the camera.

You can use an USB-Mouse via OTG as a workaround.
[Fire HD 8 and HD 10 Original Android Development] vendo:
I have it! I`m running Lineage using TP28 hardmode downgrading from 636559820 using files and guide from k4y0z in this OP!

The digitizer started working when I put back the 4 screws and fully assembled unit.

I got confused with one of your posts this week to follow this guide and it threw me off the road. I spent time uploading image from MEGA and all the other crap.

https://xdaforums.com/hd8-hd10/orig-development/fire-hd8-2017-amonet-debrick-root-t3897841

So basically I could have saved my self a lot of trouble by just using

1. sudo ./bootrom-step.sh

2. sudo ./fastboot-step.sh

and be in TWRP

thank you so much! I was so close to throw this to a dumpster.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Yes that would have been all you need.

Sorry for confusing you, I pointed you there for the instructions on finding the TP28, since I still need to add the instructions for unbricking to this thread.

Glad it all worked out for you in the end.
[Fire HD 8 and HD 10 Original Android Development] vendo:
thank you again, Im no where close giving you advice but having a separate section for the "wire" method discribing the dismateling steps in little more detail to encourage folks + the SW guide in simple steps would help I think. In the end it could be a quick job if you know what you are doing and the disassembly is really easy compare to other products.

Once again thank you for your assistance.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Was planning to do that in Post #2 on this thread like I did on suez:

https://xdaforums.com/hd8-hd10/orig-development/unlock-fire-hd-10-2017-suez-t3913639

Just haven't gotten around to do that yet.
[Fire HD 8 and HD 10 Original Android Development] Korin67:
Hello, thank you for the very useful project. I am new here and plan to install TWRP to my HD 8. Before I leap, I would like to make sure the required steps for my better understanding of step-1 and step-2. Sorry if this is an FAQ.

My HD 8 is not rooted, I copied mtk-su binary to amonet/bin folder. Should I rename it to mtk-su.bin or not?

I went thorough the contents of step-1 and step-2. I know 'adb' well, but not 'get_root'. I think it uses mtk-su, but where 'get_root' shell/command locates? I cannot find it in amonet folder.

Thank you for your time.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
You don't need to rename the file, just place it into the bin folder.

the get_root function is defined in the file functions.inc
[Fire HD 8 and HD 10 Original Android Development] vendo:
Wire root process

after updating my tablet to the latest version Fire OS 5.6.4.0 (build 636559820) which does not have SW root I have decided to open up the unit and use hardware method which works on all versions of firmware

What you will need

1. wire

2. plastic tool as in the picture below to open the unit.

3. linux machine, I used Raspberry Pi 3+ and Raspbian.

Process:

1. remove SD card from the fire HD to avoid breaking it during the opening process ( yes it happened to me, luckily just 16GB card )

2. use plastic tool to detach display from plastic rear chassis. It is very easy and safe process.

3. Remove 4 screws from the motherboard.

4. detach digitizer ( yellow ) cable and rear camera using plastic tool.

5. You can leave display flex cable, battery and speaker ( soldered ) connected.

6. turn montherboard on the other side so it lays on the battery. There is a small adhesive pad on the left side of PCA, use plastic tool to start lifting the board from that side.

7. find pad TP28 and prepare you Linux PC now

8. DOwnload amonet-douglas-v1.1.zip from OP of the thread , extract.

9. run, it will take a while to update your linux distribution to the latest version.

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

10. Get your self into the Amonet folder ( most licely Downloads/Amonet ) folder where you extracted ZIP from OP.

11. run

sudo ./bootrom-step.sh

12. you should see this msg on the screen

[2019-02-07 14:35:59.478924] Waiting for bootrom

13 Now here is the tricky part which will require some practice. You have to short TP28 with grond ( the big pad neer TP28 ) and while doing it connect USB cable to the PC. Here is how I did it.

14. So I was holding the wire in the left hand and used right hand to plug slowly USB cable into the montherboard. ( not easy I know, but you will get there )

15. If you did it right you will see a message on the screen to Release the short wire and hit ENTER.

16. wait till the scripts does its think and when you see this you are in fasboot. Look at the scrren, you should see AMAZON logo and small text on the bottom "fastboot xyz etc..." Don1t unplug table, keep going.

[2019-02-07 12:11:05.621357] Reboot to unlocked fastboot.

17. run this script

sudo ./fastboot-step.sh

18. Your unit should boot into TWRP

19. Assemble back the unit so digitizer will work.

20 boot into TWRP and install Lieage, GAPPS and Magisk. Install Lineage ZIP file from here. https://xdaforums.com/hd8-hd10/orig-development/rom-lineage-12-1-t3953677
[Fire HD 8 and HD 10 Original Android Development] TraderJack:
Thanks everyone who worked on this. My Fire has been laying dormant for months and I've just broken it out to do this.

I have a couple questions:

1) I have gone ahead and run the unlock process and have TWRP and root running now. My Fire says it is on 5.6.4.0 (636558520).

At this point, is my bootloader fully unlocked and I no longer need to worry about upgrading/downgrading/using custom ROMs? Am I fully protected from getting myself into a situation where I can't root/flash ROMs again? Or do I need to make sure I never upgrade past 5.6.4.0?

2) I would like to start experimenting with debloating (right now I have just frozen some apps, nothing irreversible), and also trying out perhaps the Lineage ROM.

Is there some type of backup I need to take of my device to ensure I can get it back to FireOS stock if I need to? Or can I just flash a stock image and then (optionally) run the "Going back to stock" process from the OP?

thanks
[Fire HD 8 and HD 10 Original Android Development] OGIGA:
Came from 5.4.0.0 from 2017 December and put on Lineage just now. Very happy, thanks OP! Used arm64/mtk-su and worked fine.

The only part that confused me was that step-1.sh made me think it was supposed to reboot into recovery after the script (echo "Rebooting into Recovery", adb reboot recovery).
[Fire HD 8 and HD 10 Original Android Development] bmemoret:
failed -- on very recent build of 5.6.4.0

I tried it on my Fire HD 8 (2017), running Fire OS 5.6.4.0 (build 636559820), but it fails at the first step, with the following output:

Testing root access...

Trying to use mtk-su to get temp root...

Pushing root files

bin/mtk-su: 1 file pushed. 1.6 MB/s (38736 bytes in 0.024s)

bin/minisu.img: 1 file pushed. 4.8 MB/s (1048576 bytes in 0.210s)

bin/busybox: 1 file pushed. 4.8 MB/s (587368 bytes in 0.117s)

Failed critical init step 4

mount: permission denied (are you root?)

Failed critical init step 4

<< now repeats these last two lines over and over >>

DId Amazon update 5.6.4.0 to close one of the exploits? The build shows it was automatically downloaded and installed Sept. 16, 2019, just 4 days ago.

PS. Sorry: known problem for MTK-SU (listed as error output for most recent firmware versions). Evidently, Amazon did do something. So I guess I will have to open the case...
[Fire HD 8 and HD 10 Original Android Development] vendo:
Yes Amazon patched it! read through this post, use Wire method above
[Fire HD 8 and HD 10 Original Android Development] pacallen:
I ran into the same problem - mothballed my fire hd 8 2017 a while back but it was still on and updating so I came back to it on 5.6.4.0 build 636559820 as well. The exploit has been patched.

However, the hardware method still works and was actually fairly easy (biggest pain was removing the back of the tablet) - see Vendo's post above. I just installed Ubuntu into a VM and ran through the steps. Took me a few hours but now I'm running Lineage OS 12.1 and it feels like a new tablet.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
1) It should be mostly safe to upgrade or downgrade, since TWRP takes care of blocking changes to LK, PL and TZ.

2) Flashing stock firmware should be enough to get in stock state.