yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Rortiz2:
If you read my comments above, you will see that they use a partition called unlock (which is not a real partition, but a small sector of the boot1 partition) to store the unlock code. So yeah, their "backdoor" (if you can call it like that) is basically (something like) fastboot flash unlock unlock.bin (where unlock.bin is a file with the unlock code, probably encrypted with their RSA keys).

Other than that, there is something new that Amazon implemented in its newer models (2019 generation and newer) called "Temporary Unlock". Which is kind of an unlock limited by (some amount of) reboots:

amzn_get_temp_unlock_idme_data
amzn_get_temp_unlock_idme_cert
%s: Failed to get temp unlock codes
amzn_get_temp_unlock_idme_code
%s: Failed to get temp unlock cert
%s: Verify temp unlock cert fail, ret = %d
Device is temporarily unlocked, %d reboots remaining
amzn_verify_temp_unlock_code
[Fire HD 8 and HD 10 General] nyzer:
Hey starting from scratch here with a 2019 Maverick on 7.3.1.6. A few questions since I have been completely out of rooting for a long time (life). I'm used to TWRP. but this seems a bit more complex. Would it better to use my RPi instead of my W10 laptop to do this?

I have a feeling I will mess it up completely, but I really want LOS. Is there an easy step by step to follow?
[Fire HD 8 and HD 10 General] 789mod:
Hi friend , are you sure the twrp is work correctly ?
[Fire HD 8 and HD 10 General] Michajin:
so questions.... I have a maverick with the temp root. I haven't seen anything with unlocking become available. I seen you can get a temp unlock, is is possible to use the temp unlock to get permanent root, or even TWRP replacement for recovery? Can this be exploited to at least change the system files? really not much hope of development without a full root answer.....
[Fire HD 8 and HD 10 General] Rortiz2:
Temporary Unlock

The short answer to that question is yes. While mtk-su allowed us to acquire a bootless root, temporary unlocking allows us to modify the /system partition, install alternative recovery images, and other things that break image verification in the boot chain.

However, there's a big con with this method, since every time you want to reboot (or boot) the device, you will need a computer to load the patched preloader through the USB (with the help of mtkclient or kamakiri).

The idea was originally suggested 2 years ago by xyz` in this post but nobody bothered to test it, probably because back then there was no kamakiri for MT8183 (which was later ported by k4y0z).

The process is simple, but it may be risky if something goes wrong. In short, temporary unlocking consists of flashing a modified bootloader (LK) image (which bypasses boot and recovery verification) to then load a patched Preloader image (which in this case, bypasses the LK/TEE/SCP verification) with the help of the previously mentioned tools (mtkclient or kamakiri).

You can flash the modified bootloader image with dd + mtk-su or using mtkclient/kamakiri as mentioned above (note that after flashing the LK image and rebooting, the device will not boot anymore unless you restore the original LK image or you boot the patched preloader).

After flashing the patched LK image, the last step is to start the modified Preloader. The best way to do this is with mtkclient using:

sudo python3 mtk plstage --preloader=preloader_patched.bin.

After doing so, the device should boot as if it was bootloader unlocked.

Unlocked (similar to hacked) fastboot mode is available, but it is quite tricky to access. If you want to access it, you need to use handshake2.py, a little tool created by k4y0z a long time ago. To use this tool, you just need to run mtkclient cmd to start the patched preloader and immediately run the tool with FASTBOOT as the first argument.

So if you want to access unlocked fastboot, the ideal cmd would be:

sudo python3 mtk plstage --preloader=preloader_patched.bin; python3 handshake2.py FASTBOOT

I've attached two patched images (LK/PL) that used to work the last time I tried them. Please note that I am not responsible for bricked/dead devices.
[Fire HD 8 and HD 10 General] regancipher:
I'm guessing easiest thing is just try and get some money back for this? Found one in the drawer and was hoping maybe someone had figured out how to unlock the bootloader and rid me of this awful FireOS trash...if you guys can't work out how to, I doubt anyone can
[Fire HD 8 and HD 10 General] Michajin:
I find it's a lot better of you charge the launcher and disable bloat. Getting lineage is a totally stretch right now.
[Fire HD 8 and HD 10 General] xFaultx:
Just bought a 2019 fire tab from a coworker who rarely used it, unfortunately it is on 7.3.1.9 . I understand i can't do the temporary root, but what can I do? Can i do the bootless root? Or even just the toolkit?

From poking around it seems there might be a rollback method, but I'm unclear. I have done nothing to the tablet, except try to get on to see what version it's running
[Fire HD 8 and HD 10 General] regancipher:
Yeah I did that, but sold it anyway. I wait for Realme pad custom roms and get that instead
[Fire HD 8 and HD 10 General] Rortiz2:
Nice choice, Amazon to Realme, lol.
[Fire HD 8 and HD 10 General] regancipher:
Trying to remove everything I can from the Amazon ecosystem. The amount of telemetry is just too invasive - anything I can put an alternative OS on is preferable
[Fire HD 8 and HD 10 General] Rortiz2:
Yeah, good luck unlocking a Realme device
[Fire HD 8 and HD 10 General] Rortiz2:
TWRP booted on maverick with the temporary unlock (credits to @bengris32)
[Fire HD 8 and HD 10 General] 789mod:
All best I love you 💞
[Fire HD 8 and HD 10 General] Khiem Tran:
Can you install other os?
[Fire HD 8 and HD 10 General] Rortiz2:
Yes, it should be possible as well
[Fire HD 8 and HD 10 General] bengris32:
Hey everyone!

Thanks to the temporary bootloader unlock by Rortiz2, I have been able to successfully create trees and boot an unofficial LineageOS 18.1 build.

This is a highly unstable build, but it proves that custom development is possible for this tablet!
[Fire HD 8 and HD 10 General] StonedEngineer97:
Coming back to this thread after a few months, I have 2 tablets manufactured after they disabled brom access, is this temporary unlock still possible or only for certain conditions?
[Fire HD 8 and HD 10 General] Rortiz2:
The temporary unlock is only possible if bootrom access is present, so if your units were manufactured after Amazon disabled bootrom you won't be able to use it.
[Fire HD 8 and HD 10 General] 789mod:
When you will able to download twrp and os to this Amazon
[Fire HD 8 and HD 10 General] Michajin:
With this, does it boot normally or do you need a computer to load the patched preloader through the USB to get boot up to lineage?
[Fire HD 8 and HD 10 General] Rortiz2:
You still need a computer to load the patched preloader.
[Fire HD 8 and HD 10 General] askforehlpo:
would you like to share the twrp recovery.img you used thanks
[Fire HD 8 and HD 10 General] bengris32:
Unofficial TWRP for maverick

You'll want to perform these steps only when you have temp unlocked your device.

Getting into fastboot mode can be quite difficult when you have to boot your device with mtkclient every time, here is the easiest way.

1. Hold Volume up while temp booting the device to get into the stock recovery.

2. From the stock recovery, select "Reboot to bootloader"

3. Plug the device in again and wait for mtkclient to boot the device.

4. Now in fastboot mode, you can flash the TWRP with

fastboot flash recovery twrp-maverick.img

5. Reboot the device with

fastboot reboot

6. Hold volume up once again while booting the device with mtkclient, and this time you should have booted in to TWRP.

Good luck! TWRP build is attached.
[Fire HD 8 and HD 10 General] askforehlpo:
could you also share the rom you build , that would be realy nice i tried to install some gsi roms but no success ?
[Fire HD 8 and HD 10 General] 789mod:
Can you tell me how to flash lk from root ?

I mean from dd on this device
[Fire HD 8 and HD 10 General] Rortiz2:
He already did: https://xdaforums.com/t/rom-unoffic...eageos-18-1-28-02-2022.4410305/#post-86512485
[Fire HD 8 and HD 10 General] Rortiz2:
adb push lk_patched.bin /data/local/tmp/
adb shell
<run mtk-su>
dd if=/data/local/tmp/lk_patched.bin of=/dev/block/platform/bootdevice/by-name/lk
sync
exit
[Fire HD 8 and HD 10 General] 789mod:
This just in 7.3.1 ?
[Fire HD 8 and HD 10 General] PRInCEI7:
I have a problem on Windows does not work , and on the Mac does not recognize Is there a solution?
[Fire HD 8 and HD 10 General] askforehlpo:
The handshake.py dont work on my Windows install too but you can use the Buttons to get in the fastbootmode.

1. Hold Volume up while temp booting the device to get into the stock recovery.

2. From the stock recovery, select "Reboot to bootloader"

on every restart you need to use the patched preloader

python mtk plstage --preloader=preloader_patched.bin
[Fire HD 8 and HD 10 General] PRInCEI7:
Thanks for help 🙏🌹
[Fire HD 8 and HD 10 General] askforehlpo:
The handshake.py dont work on my Windows install too but you can use the Buttons to get in the fastbootmode.

1. Hold Volume up while temp booting the device to get into the stock recovery.

2. From the stock recovery, select "Reboot to bootloader"

on every restart you need to use the patched preloader

python3 mtk plstage --preloader=preloader_patched.bin

no Problem :)
[Fire HD 8 and HD 10 General] whitebear99:
How about trona hd10 11th bro. I'm waiting so------long :)
[Fire HD 8 and HD 10 General] PRInCEI7:
I need OS 7.3.1.0 I tried but I can't find it
[Fire HD 8 and HD 10 General] askforehlpo:
First you have to check if you can access the bootrom!

GitHub - MTK-bypass/bypass_utility

Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.

github.com

Install python (64-bit)(select "Add Python X.X to PATH")

Install UsbDk (64-bit)

Install pyusb, json5 with command:

1.Plug out battery

2. connect to the PC

3.Push the volume up Button

4. run the Bypass_Utility main.py

If you get Protection Disabled your good to go!

Downgrade to 7.3.1.0

What you need:

-Sp-Flash 5.xx

-Mediatek drivers

-kamakiri

-Fireos

Releases · amonet-kamakiri/fireiso

ISO with patched kernel for kamakiri and amonet. Contribute to amonet-kamakiri/fireiso development by creating an account on GitHub.

github.com

1. Run bypass

2.Format preloader with SPFlash (length 0x100000)

3.Plugin the Battery

4.Run bypass again

5.In Sp-Flasher select Download

6.Select the scatter_maverick.txt

7.select just boot, recovery, vendor, system,

8.push the Download Button

9.use rufus to make live usb from the fireOS.iso

10.Boot the OS

11.Download kamakiri

12.connect the phone

13.run the kamakiri script

bootrom-step.sh

14.Follow the instrution from kamakiri

Now you Have Sucsefully Downgraded

LineageOS ROM

https://xdaforums.com/t/rom-unoffic...eageos-18-1-28-02-2022.4410305/#post-86512485
[Fire HD 8 and HD 10 General] Khiem Tran:
I run

dd if=/data/local/tmp/lk_patched.bin of=/dev/block/platform/bootdevice/by-name/lk

then power off and run

sudo python3 mtk plstage --preloader=preloader_patched.bin; python3 handshake2.py FASTBOOT

and it freezes as shown below
[Fire HD 8 and HD 10 General] 789mod:
Try turn on phone and turned of and try this
[Fire HD 8 and HD 10 General] Khiem Tran:
It freezes as shown below . And device boot to FireOS, not to fastboot
[Fire HD 8 and HD 10 General] 789mod:
I also freesz on this but re first commend will turn on
[Fire HD 8 and HD 10 General] Khiem Tran:
Here are my steps and it works fine.

1.Flashing a modified bootloader (LK) image (which bypasses boot and recovery verification)

adb push lk_patched.bin /data/local/tmp/

adb push mtk-su /data/local/tmp/

adb shell

cd /data/local/tmp

chmod 755 mtk-su

./mtk-su

su

dd if=/data/local/tmp/lk_patched.bin of=/dev/block/platform/bootdevice/by-name/lk

sync

exit

2. Turn off device

3. Load a patched Preloader image (which in this case, bypasses the LK/TEE/SCP verification) with the help of the previously mentioned tools (mtkclient or kamakiri).

sudo python3 mtk plstage --preloader=preloader_patched.bin

4. Wait FireHD screen shown [LK] jump to K64 0x40080000 and immediately hold Volume up while temp booting the device to get into the stock recovery.

5. From the stock recovery, select "Reboot to bootloader"

6. Plug the device in again and wait for mtkclient to boot the device.

7. FireHD screen shown fastboot mode, you can flash the TWRP with

sudo fastboot flash recovery twrp-maverick.img

sudo fastboot reboot
[Fire HD 8 and HD 10 General] PRInCEI7:
Thanks it’s work 👍
[Fire HD 8 and HD 10 General] 789mod:
.((10.connect run the kamakiri script))

What that means ??
[Fire HD 8 and HD 10 General] PRInCEI7:
Use this kamakiri-flash-v3 All problems will be fixed, and then the device will work normally

https://xdaforums.com/attachments/kamakiri-flash-v3-zip.5241189/
[Fire HD 8 and HD 10 General] 789mod:
Just use bootrom or but rom and gptfix ?
[Fire HD 8 and HD 10 General] PRInCEI7:
1 - gptfix

And

2-bootrom
[Fire HD 8 and HD 10 General] 789mod:
When I use so flash still stop on 100 download da
[Fire HD 8 and HD 10 General] PRInCEI7:
Can you take a screenshot of the problem?
[Fire HD 8 and HD 10 General] 789mod:
Still this
[Fire HD 8 and HD 10 General] 789mod:
can you pust video for this

you mean do this in rufus ??

8.install fireOS on a USB

9.Boot the OS
[Fire HD 8 and HD 10 General] askforehlpo:
yes rufus
[Fire HD 8 and HD 10 General] askforehlpo:
if you use fireos its simpler if not you need to patch the kernel ?
[Fire HD 8 and HD 10 General] 789mod:
I flash fire os by so flash tool , just system vendor boot

But the device still black screen :(
[Fire HD 8 and HD 10 General] Sus_i:
@askforehlpo said that you may use the fireISO from here:

GitHub - amonet-kamakiri/fireiso: ISO with patched kernel for kamakiri and amonet

ISO with patched kernel for kamakiri and amonet. Contribute to amonet-kamakiri/fireiso development by creating an account on GitHub.

github.com

otherwise (if you wont use this fireISO) you would need to apply a kernel patch to your linux setup... (idk if this is true for maverik).
[Fire HD 8 and HD 10 General] 789mod:
I will try it
[Fire HD 8 and HD 10 General] StonedEngineer97:
There is a built copy available under the releases section as well

Release v2.0.0 · amonet-kamakiri/fireiso

ISO with patched kernel for kamakiri and amonet. Contribute to amonet-kamakiri/fireiso development by creating an account on GitHub.

github.com
[Fire HD 8 and HD 10 General] 789mod:
I have Ubuntu Linux , should I use this Linux in link ?
[Fire HD 8 and HD 10 General] askforehlpo:
yes the linux in the link is needed to use kamakiri without problems
[Fire HD 8 and HD 10 General] 789mod:
????? why this
[Fire HD 8 and HD 10 General] Michajin:
I am sorry I do not fully understand. At what point does it always require a tethered boot? If I use the temp unlock, install twrp and magisk, will I have to use a tethered boot every time or just to access the unlocked tablet? I am looking to have permanent root. I want to do this, but at what point will i have to use the temp unlock tether boot every time?
[Fire HD 8 and HD 10 General] JJ2017:
Need Help!

Have been following the above instructions to downgrade to 7.3.1.0 (thanks @askforehlpo) but when I get to step 14 (Kamakiri / bootrom-step.sh) I didn't get a reboot, so I tried a different version: "kamakiri-flash-v3" (from post https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-86544653, thanks @PRInCEI7) and it did go through the update steps and to reboot - but now it's stuck at "fire" logo with three cycling dots - even after several hours.

When I go back to SpFlash Tool (after runing MTKbypass, obviously!) I can't flash anything because it gives "PMT changed for the ROM" error - see attached photo

Anyway, I'm completely stuck because I didn't do a full read-back in Flash Tool before I started (which was really stupid, I know!). I can't get to recovery either. Anyone got suggestions?
[Fire HD 8 and HD 10 General] 789mod:
Remove preloader select
[Fire HD 8 and HD 10 General] askforehlpo:
do you solve this ?
[Fire HD 8 and HD 10 General] 789mod:
Yes .
[Fire HD 8 and HD 10 General] JJ2017:
Thanks for your reply - yes, that does stop the error but when I try and flash Boot / Recovery / Vendor / System in Flash Tool - without Preloader ticked - I'm stuck forever at the red bar "Download DA 100%" point - but nothing happens.

Looking at the logs, Flash Tool is talking to the tablet but it gets stuck, for some reason.

If I extract Preloader bin from the latest firmware can I at least get back to a working tablet somehow?!
[Fire HD 8 and HD 10 General] 789mod:
Try last spflash tool I think is version 5.204 if still this error try mtk driver
[Fire HD 8 and HD 10 General] 789mod:
Use Linux in the link and burn it Rufus
[Fire HD 8 and HD 10 General] ymarkus:
Hey, how did you solve this? Mine always errors out at [3/34]. Is my emmc broken?
[Fire HD 8 and HD 10 General] 789mod:
Hi , you must clear preloader from spflash tool after this

Use Linux In link this will fixed --

I think gpt in preloader.bin is different from gpt in bootrom (bin/gpt)
[Fire HD 8 and HD 10 General] ymarkus:
Thank you, but I still have some issues.

I'm using the FireISO live USB and this is what I try:

1. disconnect battery

2. start mtk bypass tool

3. Plugin USB (seems to work):

[2022-03-29 11:56:53.685168] Waiting for device

[2022-03-29 11:57:00.277275] Found device = 0e8d:0003

[2022-03-29 11:57:00.342747] Device hw code: 0x788

[2022-03-29 11:57:00.342823] Device hw sub code: 0x8a00

[2022-03-29 11:57:00.342858] Device hw version: 0xca00

[2022-03-29 11:57:00.342885] Device sw version: 0x0

[2022-03-29 11:57:00.342922] Device secure boot: True

[2022-03-29 11:57:00.342950] Device serial link authorization: False

[2022-03-29 11:57:00.342976] Device download agent authorization: True

[2022-03-29 11:57:00.343008] Disabling watchdog timer

[2022-03-29 11:57:00.343546] Disabling protection

[2022-03-29 11:57:00.356603] Protection disabled

4. open SP flash tool and select Scatter file from `maverick-downgrade-7.0_PS7310_940N`

5. Go to Format and select `Manual Format Flash` and `EMMC_BOOT_1` and Length: `0x10000` but nothing happens

6. Set mode to UART and try again, this shows error:

BROM Exception! ( ERROR : STATUS_EXCEED_AVALIABLE_RANGE (-1073479669) , MSP ERROE CODE : 0x00.

Any idea what I'm doing wrong?
[Fire HD 8 and HD 10 General] 789mod:
😡😡😡

But this 0x100000

Nooot 1000
[Fire HD 8 and HD 10 General] ymarkus:
I'm sorry, I don't understand :( In my SP_Flash_Tool-5.1916_Linux I can only put HEX numbers, I can not put `1000`
[Fire HD 8 and HD 10 General] 789mod:
Use sp flash tool in Windows and message me on direct
[Fire HD 8 and HD 10 General] ymarkus:
OK, thank you very much. I will try! Give me a moment, I have to set it up...
[Fire HD 8 and HD 10 General] 789mod:
Thanks

Any problems message me on direct
[Fire HD 8 and HD 10 General] dmmat:
folks, pls help me https://xdaforums.com/t/amazon-fire-hd-10-gen-9-2019-bricked.4435329
[Fire HD 8 and HD 10 General] Michajin:
Go to post 796 to get into unlocked fastboot or . Post 550 has the full bin file for flashing. What did you do to get stuck in the bootrom (that is mediatek phone 6227)? I would recommmend you dont take any updates if you get it to boot on 7.3.1.0. I am also assuming you have a linux system...
[Fire HD 8 and HD 10 General] 789mod:
Friend , you need to downgrade and gpt and bootrom will fix
[Fire HD 8 and HD 10 General] dmmat:
nothing, the tablet was on the shelf for about a month, then just did not turn on, the battery voltage is normal (after charge).
[Fire HD 8 and HD 10 General] dmmat:
i have [Errno 5] Input/Output Error when i run bootrom-step.sh or gpt-fix.sh
[Fire HD 8 and HD 10 General] 789mod:
That is normally , because your device have patch preloader

, Just back to stock preloader Will fix

Fromat preloader in spflash tool

1. Disable Auth

2. Format preloader (0x10000)

Was posted by @askforhelp
[Fire HD 8 and HD 10 General] Michajin:
You might be able just to open it and pull the battery. Holding the power button for about 10 seconds might get it out of it as well.
[Fire HD 8 and HD 10 General] dmmat:
no affect
[Fire HD 8 and HD 10 General] dmmat:
more info pls
[Fire HD 8 and HD 10 General] 789mod:
Have you Telegram?
[Fire HD 8 and HD 10 General] dmmat:
check pm
[Fire HD 8 and HD 10 General] 789mod:
I think there are short in this device will enter to bootrom
[Fire HD 8 and HD 10 General] Michajin:
There is but pulling the battery did the same, but you have to plug it back on to have write access from the work I did with k4y0z downgrading.
[Fire HD 8 and HD 10 General] 789mod:
In all version 😒 ?
[Fire HD 8 and HD 10 General] Michajin:
I should mention that the bootrom was totally disabled and not accessible after January 2020 on new devices. Anything before that could be downgraded to the root vulnerable 7.3.1.0. think I had one on 7.3.1.7 that was downgraded. It was a mediatek patch that disabled it I think.
[Fire HD 8 and HD 10 General] 789mod:
I know that all

Thinx friend
[Fire HD 8 and HD 10 General] 789mod:
Plz correct path preloader 0x100000

Not 1000000
[Fire HD 8 and HD 10 General] dmmat:
same issue with SP flash tool on windows STATUS_EXCEED_AVALIABLE_RANGE
[Fire HD 8 and HD 10 General] 789mod:
No flash just system vendor recovery only .

Other partition will flash from gpt-fix
[Fire HD 8 and HD 10 General] moomph:
I'm trying to get into fastboot mode and wondering if I'm doing something wrong or if my Fire HD 10 is simply incapable of this. First question - can someone describe what fastboot mode should look like? Second, when people talk about some HD 10s not having "bootrom access", does this mean the fastboot menu?

I'm fairly confident my HD 10 is on 7.3.1. Due to modifications to prevent background upgrades, I can no longer access the upgrade firmware settings menu to confirm my current version, but I can successfully run mtk-su.

I have overwritten the LK image running dd, and I am able to boot using

sudo python3 mtk plstage --preloader=preloader_patched.bin

. However, holding VOL UP button, whether at initial boot or after I see [LK] jump to K64 0x40080000 doesn't make a difference.

I should also note that I ran bypass_utility and it reported protection was NOT disabled.
[Fire HD 8 and HD 10 General] Michajin:
If your device was sent out after January 2020 your likely out of luck.
[Fire HD 8 and HD 10 General] moomph:
Received it on Jan 9 2020. Kills me, as this is a replacement for a December order that I accidentally updated to 7.3.1.1.

How would I confirm that I'm out of luck?
[Fire HD 8 and HD 10 General] Michajin:
You are in luck probably. The best course of action would be opening the hd10 disconnecting the battery to get into the bootrom. Then plugging it in to wipe the preloader during the downgrade process. I can give more info tomorrow. What version is it on now? I can try to help tomorrow more....
[Fire HD 8 and HD 10 General] 789mod:
Of mtk-su running all think will done

I mean you patch lk

However , you can't do anything mtk-su not working
[Fire HD 8 and HD 10 General] moomph:
789mod, I'm not following what you're saying, could you clarify?

mtk-su is definitely working. It prints out `UID: 0 cap: 3fffffffff selinux: permissive` and I'm able to su into root. Likewise, I think I successfully patched lk, as the device no longer boots unless I run `sudo python3 mtk plstage --preloader=preloader_patched.bin` from a connected computer.

Half the time I boot, I see the Amazon logo, and half the time I do not. In both cases, debug text appears in the lower left corner of the screen showing boot process. When the Amazon logo appears, the device boots normally, when it doesn't, the screen eventually goes blank.

If I hold the VOL up button before boot, I see a ⚠️. If I hold VOL up at any other point of boot, it has no effect.

I'm trying to get the device into fastboot mode so that I can install TWRP, but I don't think it's working. I assume I should be seeing something to indicate i'm in fastboot mode, like the image of the Android with its flap open.