yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] bibikalka:
OK, have you tried to only downgrade system, boot, recovery, and Vendor from 7.3.1.2 to 7.3.1.0, leaving the rest at 7.3.1.2, and seeing if it works fully? You could even test 7.3.1.7 downgraded to 7.3.1.0, but only those 4 partitions. If that works OK, there is a nice way for everybody to have root!

I am thinking if all versions give you BootRom, that means that there was a hardware change past some serial numbers. Your BootRom access is never disabled, through the volume button, which sits in the preloader (?). To be fair, there is only 1 other report trying the BootRom method, so perhaps there could have been a user error.

Until BootRom gives some magical access (bootloader unlock!), there is really no point in chasing it.

Edit:

Actually, given that you can get always into BootRom on your devices, can you try the old trick with zeroing out the preloader to get into BootRom (check the partition name first!)

echo 0 > /sys/block/mmcblk0boot0/force_ro

dd if=/dev/zero of=/dev/block/mmcblk0boot0

echo 'EMMC_BOOT' > /dev/block/mmcblk0boot0

If that works with temporary root, it would be possible to get into BootRom without opening the device.
[Fire HD 8 and HD 10 General] k4y0z:
What would be the point of that?

You need bootrom access or an already rooted device to achieve that anyway.

Yes, wiping preloader will get you into bootrom on a device that doesn't have bootrom mode disabled.

On a device, that has it disabled this would lead to a permanent brick (as happened to some on karnak).

If you already have temp root that probably means you are already on 7.3.1.0, so no point in accessing bootrom by wiping PL either.
[Fire HD 8 and HD 10 General] samdotci:
I'm in the same situation as you with the tablet entering bootrom with the battery disconnected and holding the volume + button - purchased the device in November 2019!

Currently, however, sitting on a semi-bricked device... Had the same issue with SP Flash Tool only permitting system, boot, recovery, etc. to be flashed and it considering the other files to be unverified.

Tried using k4y0z's script but unfortunately receive an error writing to the eMMC just after it confirms both the 1st and 2nd stage of loading the payloads have come online. I've tried reconnecting the battery whilst it's in the bootrom but makes no different. Have also tried using the FireISO to do this, both the original and the new, along with Windows 10, but doesn't seem to make any difference to the ability to write to the eMMC.

Did you have any similar issues with yours?
[Fire HD 8 and HD 10 General] k4y0z:
You will need to wipe preloader in SP Flash (or enter BROM by shorting) for mmc-write to work in kamakiri.

Then use the attached kamakiri, which instead of just clearing RPMB will flash the missing partitions that couldn't be flashed with SP Flash (Unfortunately it's quite slow compared to SP Flash)
[Fire HD 8 and HD 10 General] Michajin:
Exactly what i had. Everytime i plugged in the battery it went into preloader, but you can't write to emmc without the battery. Follow k4y0z's direction above.

Thank you, this confirms i am not the only one that has access to downloading! What version were you on?
[Fire HD 8 and HD 10 General] Michajin:
g001 2c05 9496 XXXX

g001 1j05 9395 XXXX

g001 1j05 9457 XXXX

All 3 have accessible bootroms, but after 7.3.1.2 accessing bootrom is different. You have to disconnect the battery while pressing vol+ and plugging in USB. 7.3.1.1 and 7.3.1.0 the battery did not matter. I have a shorting option that works but there isnt a point in my opinion cause if the vol + and plugging in (without battery) dont work, i believe the bootrom is disabled...
[Fire HD 8 and HD 10 General] bibikalka:
OK, thanks! I misunderstood the fact that to flash system/boot partitions one needs BootRom already to be accessible.

Is your 2c05 device a different color/memory configuration from 1j05's ? Wonder if it's 05 vs 06 making the difference. 1j06 was reported not to respond with BootRom. The shorting point might still work, unless they had a quick hardware revision. At least, why don't you post your image for reference?
[Fire HD 8 and HD 10 General] Michajin:
It was a plumb one that I got right when people started saying the black ones were coming with 7.3.1.1. It came with 7.3.1.0. I am not really all that experienced on how to do what you are asking about posting my image, what image? I have never tested shorting on my 2c05, so i check it.. i can send you a picture of what i shorted on my other ones to access the bootrom and do more testing on this one.... but it very well could be the 05 vs 06 you suggest... Just had someone else say they could acces it same as i did, curious what their SN was...

@samdotci
[Fire HD 8 and HD 10 General] bibikalka:
Don't worry about 2c05, any picture is good for shorting points (the ones you already tried, from 1j05). I just wanted to figure out if 2c actually meant color, and not hardware revision. So looks like it's potentially 05 vs 06 issue.
[Fire HD 8 and HD 10 General] Michajin:
i sent a private message... your risk... lol
[Fire HD 8 and HD 10 General] samdotci:
Pretty sure I was on 7.3.1.7. I updated it to the latest available back in December!

My serial number is G001 2D05 9376 XXXX, so it could support the 05/06 situation?
[Fire HD 8 and HD 10 General] samdotci:
Thank you so much for the explanation - that worked perfectly! Had some issues with my device being stuck at the "Fire" logo when turning it on, but a factory reset from the recovery menu cleared that up. Would have investigated further to resolve that but I had no data to lose on the device anyway. Managed to successfully downgrade to 7.3.1.0!
[Fire HD 8 and HD 10 General] bibikalka:
@k4y0z @INetBowser @StonedEngineer97 @Michajin @samdotci @Kramar111

I was thinking, would deep discharge of the battery do the same thing as battery removal for the purpose of accessing BootRom? At first, let it drain normally, then go into fastboot, and leave it there so it drains some more, and does not boot. Anyway, just a thought to avoid opening up the devices ...

For data collection purposes, I looked into getting more specific info on the hardware. The bulk of it is stored in /prod/idme. Here are the commands:

adb shell
cd /proc/idme
for f in board_id manufacturing device_type_id productid productid2 serial; do echo $f; cat $f; echo ""; done

Here is my output (X is obfuscation). If you have several devices, and some of these IDs are the same on more than 1, please don't obfuscate those. I cannot tell what is unique from a single device, and thus probably obfuscated a bit too much.

board_id
003F001400010019
manufacturing
PSN=P001P30303XXXXXX FSN=5919835XXXXXX
device_type_id
A1ZB65LA390I4K
productid
0
productid2
1241FFFFFFFFFFFFFFFF
serial
G0011J060344XXXX

Could you all post yours? Hopefully we can figure out BootRom accessibility a bit more accurately.
[Fire HD 8 and HD 10 General] Kramar111:
@bibikalka

Spoiler content hidden.
[Fire HD 8 and HD 10 General] k4y0z:
To further confirm @bibikalkas color-theory, is your device a different color than black or plumb? (Since it's neither 1J nor 2C, but 2D)

Most of these (besides serial and possibly PSN, FSN) shouldn't be device-specific.
[Fire HD 8 and HD 10 General] bibikalka:
OK, looks like board_id is OK to reveal fully.Here is mine (003F001400010019):

Spoiler content hidden.

I am thinking something must be updated hardware-wise if they disabled BootRom. It's either in the board (new revision?), or the MTK chip itself. Unless there is more memory that can be written by Amazon to disable BootRom during initialization (fuses?). But they don't seem to be able to disable that remotely via new versions.

The serial number is changing, but should not something else change as well if hardware is different?

Update: Here is a link to another Maverick: http://newandroidbook.com/ddb/Maverick/

[ro.build.version.name]: [Fire OS 7.3.1.0 (PS7310/940)]

Something tells me he should be able to get root, LOL
[Fire HD 8 and HD 10 General] k4y0z:
It's very likely just an efuse for disabling brom-mode that is burned during manufacturing.

On mantis (Fire TV Stick 4K) the latest firmware actually looks like they're preparing to burn the fuse with a future update.
[Fire HD 8 and HD 10 General] bibikalka:
Seriously??? I got to root my mantis ASAP then. Or the root is lost forever!
[Fire HD 8 and HD 10 General] INetBowser:
board_id
003F00140001XXXX
manufacturing
PSN=P001P30303XXXXXX FSN=5924307XXXXXX
device_type_id
A1ZB65LA39XXXX
productid
0
productid2
1241FFFFFFFFFFFFFFFF
serial
G0011J060356XXXX

seems like i leaked my own serial earlier lol. a quick question: can something happen now that i leaked it?😂
[Fire HD 8 and HD 10 General] bibikalka:
Other than Amazon sending a Predator drone to take you out (they know where you live by your serial number) - NOTHING :D

Could you post your full board_id, it should be OK to share ? If anything, I think serial number & board ID are the keys to understand which devices cannot do BootRom.
[Fire HD 8 and HD 10 General] Michajin:
1.

board_id

003F001400010019

manufacturing

PSN=P001P30394XXXXXX FSN=5696591XXXXXX

device_type_id

A1ZB65LA39XXXX

productid

0

productid2

1241FFFFFFFFFFFFFFFF

2.

board_id

003F001400010019

manufacturing

PSN=P001P30393XXXXXX FSN=5632550XXXXXX

device_type_id

A1ZB65LA39XXXX

productid

0

productid2

1241FFFFFFFFFFFFFFFF

3.

board_id

003F001400010019

manufacturing

PSN=P001P30394XXXXXX FSN=5670586XXXXXX

device_type_id

A1ZB65LA39XXXX

productid

0

productid2

1251FFFFFFFFFFFFFFFF
[Fire HD 8 and HD 10 General] Michajin:
@bibikalka, post: 84608059, member: 6680544"]

I was thinking, would deep discharge of the battery do the same thing as battery removal for the purpose of accessing BootRom? At first, let it drain normally, then go into fastboot, and leave it there so it drains some more, and does not boot. Anyway, just a thought to avoid opening up the devices ...

The only way i could get into bootrom was the battery disconnected. But the only way i could write to the emmc was to have power on the battery. That is why we formatted the preloader at that point. It may have been possible to write after the shorting method, but i never tried it. This was my experience anyways while on any version 7.3.1.2 or higher. 7.3.1.1 will boot right into bootrom.
[Fire HD 8 and HD 10 General] castone123:
Plum 2c, on 7.3.18.
[Fire HD 8 and HD 10 General] samdotci:
My device is white, so could explain the 2D difference, Not sure if serial numbers differ based on location either, but mine is produced for Amazon EU (as printed on the back of the tablet).
[Fire HD 8 and HD 10 General] samdotci:
My output from my white device purchased in late-2018 is below:

Spoiler content hidden.
[Fire HD 8 and HD 10 General] bibikalka:
Again, you got the magic 059 in your serial number.

On the other hand, board_id seems the same for everybody. I've asked for board_id on Fire4k thread, to see if it stayed the same when BootRom got disabled.

Some people think Amazon can kill BootRom on demand. @xyz` claimed it's a hardware thing (from Mantis thread):

Anyway, hopefully we can get more clarity in the near future.
[Fire HD 8 and HD 10 General] newnewcomputer:
all mine were bought within a few months of release n all shipped from Amazon w/ 7.3.1.0. so my data cant help to identify any hw change made to disable bootroom but it may help to confirm the "color and storage code" in serial number.

Blue 64MB:

G001 2E05 9393 xxxx

White 32MB:

G001 2D05 9375 xxxx

Plum 64MB:

G001 2F05 9436 xxxx

Black 64MB:

G001 1K05 9427 xxxx

so the "05" could be a board rev code and the letter before "05" could be the color n storage code. all of 'em have the same board id of 003F001400010019 and device type id of A1ZB65LA390I4K.

pic is from the blog linked earlier. based on that, bootrom is so early in the boot process that any change in its access must be hardware; not by a firmware rev. Amazon can disable the volume button access from a board rev though.

according to the blog, MediaTek never implemented any patch on bootrom exploit on existing chips. so the question is whether there is still a test point exploit in newer Fire HD10 to allow bootrom access.
[Fire HD 8 and HD 10 General] Michajin:
Almost all the amazon devices being sold after March of 2020 started coming with the bootrom disabled. It was identified in the hd8 (2018) thread and i think they had some identification to tell if you could still unlock. The hd8 started bricking with the wiping of the preloader.
[Fire HD 8 and HD 10 General] Michajin:
The test points on my hd10 work for me, but not others. 7.3.1.2 disabled access with just volume+ and plugging in, but access is still available with the battery disconnected.
[Fire HD 8 and HD 10 General] INetBowser:
board_id
003F001400010019
[Fire HD 8 and HD 10 General] k4y0z:
The Volume-Button access is implemented in Preloader not in Bootrom.

Bootrom is HW and can't be changed, but it can be configured via efuses, these are one-time-programmable and once set cannot be reversed.

Disabling BROM-Access is not really a fix of the vulnerability, but more of a mitigation , so in that sense xyz is right in saying that it can only be fixed in HW.
[Fire HD 8 and HD 10 General] bibikalka:
Right, there is a "lot code" that was used for Karnak. My lot code for HD10 is J034 (it's on the orange packaging box right under the serial number). See this image for an example:

https://xdaforums.com/attachments/packet-jpg.5003531/

So if you try the method and succeed/fail, please post your serial and lot code. I wonder if any of 060 devices can be BootRom'ed.
[Fire HD 8 and HD 10 General] Michajin:
I didnt have the boxes, but it does say on the back of them.

J939 (black)- bootrom success Downgrade success

J945 (black)-bootrom success Downgrade sucesss

J949 (plum)-bootrom success (did not attempt downgrade, on 7.3.1.0)
[Fire HD 8 and HD 10 General] INetBowser:
Mine has J035 (black).
[Fire HD 8 and HD 10 General] k4y0z:
These look a lot, like they could be year and week of production.

I.E J939 being 39th week of 2019.

J035 being 35th week of 2020 etc.
[Fire HD 8 and HD 10 General] lewmur:
So, mine being J946, it is likely it will be downgradeable? I've been trying to follow this thread but I'm having a hard time with it. If a tablet IS downgraded, can it be rooted? If so, is there a single method for doing it or does if differ with different builds? Can it be done without removing the MB?
[Fire HD 8 and HD 10 General] Michajin:
Yes looks very likely to be downgraded.

Yes, but it is a temp root (mtk-su)

It is a different method to get it downgraded, but the root is the same. Mtk-su

Depends on what version fireOS you are on. Worse case is opening the device, but you don't need to pull the motherboard. Just unplug the battery.

You are trying to access the bootrom, on Linux it shows up as a mediatek phone 6227.
[Fire HD 8 and HD 10 General] lewmur:
Thanks for the reply. I'm on 7.3.1.6 I have both Win 10 Pro and a Mint 21.1 desktop, so which ever is easier. I have used the Toolbox to get rid of the Amazon bloat, so I don't have any pressing need for root . But being a born tinkerer, I'd like to know how just for the fun of it and to be ready in case anyone comes up with a custom ROM.
[Fire HD 8 and HD 10 General] StonedEngineer97:
So I looked my serial numbers and my newer tablet on 7.3.1.2 has an 1J06 in the serial number and lot J038 (38th week of 2020?)

And the 7.3.1.5 has a 1J05 in the serial number and lot J017 (17th week) which suggests I should be able to get into bootrom on this one atleast based on the serial number
[Fire HD 8 and HD 10 General] Michajin:
You would need to run a different version of linux to actually run the script. But you can verify you have root access by pulling the cover (running any amonet script, but dont hit enter to continue if you get past the waiting for bootrom). Wither the cover remove disconnect the battery, run the bootrom-step.sh (you should see waiting for bootrom). With the battery disconnected, press volume up and plug in to mint PC, at this point you should see remove short to continue. Open another terminal and type lsusb to see if you have a mediatek phone 6227 on the list or a preloader. The MediaTek phone is the device in bootrom. This would verify you have access to downgrading. Being a temp root, it really doesn't give you access to a custom rom or system modifications. Being you are happy with the current tablet seems like a lot of work at this point. The idea is to get the tablet unlocked so it opens it up to a custom recovery and lineage. If you just interested in root, i can explain how to do it...
[Fire HD 8 and HD 10 General] Michajin:
j017 might be too late. I have not seen any success in the 2020 series yet. Have you tried the battery unplugged, vol+ on the j017 device?
[Fire HD 8 and HD 10 General] bibikalka:
1J05 serial says "YES", j017 lot says "NO". Who is gonna win??? :)
[Fire HD 8 and HD 10 General] Michajin:
I guess we wait to see. My gut tells me maybe.... Lol
[Fire HD 8 and HD 10 General] retyre:
Lot numbers are more likely to be chronological than serial numbers, but it's all a guess. This is like going online to find out your current weather when ... you can just walk out the door and find out firsthand? You have the device. Open it up and tell us what you find. Michajin has told us there isn't even a need to short a point on the PCB to enter BootROM.
[Fire HD 8 and HD 10 General] lewmur:
Why would I need a different version of Linux?
[Fire HD 8 and HD 10 General] k4y0z:
You need a patched linux-kernel for kamakiri to work.

You can either patch your own, use one of the prebuilt kernels or use FireISO.

I have never tested kamakiri on Windows, so I don't know if it will work on Windows.
[Fire HD 8 and HD 10 General] blaze2051:
Lineage Os 17.1 would be a god send since amazon wants to keep all their devices stuck in a 32bit environment and no way to install native 64bit apps
[Fire HD 8 and HD 10 General] INetBowser:
Can someone with root access on their Fire HD 10 (preferably 9th gen) run this command and post the output. I'm currently working on an exploit and would really appreciate every help.

maverick:/ # grep "Kernel code" /proc/iomem
[Fire HD 8 and HD 10 General] Michajin:
maverick:/ # grep "Kernel code" /proc/iomem

40080000-41123fff : Kernel code
[Fire HD 8 and HD 10 General] INetBowser:
Thanks! If I manage to get the exploit fully working there would be a possible root for Fire OS 7.3.1.2, maybe also for higher versions.
[Fire HD 8 and HD 10 General] StonedEngineer97:
Are you looking at badbinder?
[Fire HD 8 and HD 10 General] INetBowser:
No, I'm trying to use CVE-2021-0399. I already have a kernel heap double-free primitive but I don't know how to continue right now. I tried to use KSMA (Kernel Space Mirror Attack) but it seems it got fixed already. Is here someone that knows a little bit about linux kernel exploitation that could help out?

EDIT: typo
[Fire HD 8 and HD 10 General] JJ2017:
Just to confirm what's already been discussed in this thread:

(e.g. https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-84610817)

Looks like Amazon have successfully 'hardware' disabled BootRom on the newer editions of Maverick. I've had the board out from a newer model (SN: G001 2B06 04XX XXXX) and tried to test-point pretty much everything front and back (OK, I exaggerate, but I've tried all the likely areas).

It will load into Preloader OK but even when Ubuntu 'thinks' it sees "Mediatek Phone" - if you run 'lsusb' all you see is listed is "Lab126, Inc"

I tried the same BootRom trick on a Suez model and it was pretty easy to find a working test-point so I think I'm doing it properly.

... So looks like Amazon have won this round, no Kamakiri this time (n)
[Fire HD 8 and HD 10 General] Michajin:
The bootrom only comes on for a second. You need to run a script to stop it. If you are seeing phone you have access. Lab126 is different. The bottom was disabled about March 2020. I have successfully shorted this, posted earlier in this thread. Shorting isn't needed though. Volume + with the battery unplugged, then plugging in to USB gives you access, providing your device is older. Tested on 3 units.
[Fire HD 8 and HD 10 General] JJ2017:
IIRC, your 3 units were early ones? I've got a recent version (SN: '06' and Lot: J045) - seems likely I'm BootRom disabled.

When I use @k4y0z 's FireIso I don't even see 'Mediatek Phone' anywhere. And I can't get your battery unpluged / volume+ method to work - even using Suez (only with battery in will a button press combo get me into BootRom on that device). What is the the 'script to stop' you mention to access BootRom? Maybe that's what's missing for me (I've not come across that in the thread - can you help me with a link?)
[Fire HD 8 and HD 10 General] Michajin:
This volume plug in access would only apply to maverick. I thought you said you saw mediatek phone? When I access the bootrom, as soon as I plug in the battery, it goes to preloader, then to lab126. I just used the fire stick 4k script to stop boot. But likely yes your bootrom is disabled I have not seen anyone with that newer number have access.
[Fire HD 8 and HD 10 General] k4y0z:
Might want to give @diplomatic a ping.

If you see "Mediatek Phone" your device is vulnerable.

Testpoint for suez is well-known and documented.

I am not aware of any button combination to enter bootrom on suez.
[Fire HD 8 and HD 10 General] Juppy99:
Thank you! I was able to successfully downgrade my HD 10 purchased in Dec. 2019 running 7.3.1.7 to 7.3.1.0 and unbricked it using this script!
[Fire HD 8 and HD 10 General] TheTrueJayTwenty:
Also have a maverick J045. Just posting to stay up to date lol. Also willing to try anything on this device as I got it pretty cheap.
[Fire HD 8 and HD 10 General] newnewcomputer:
if u dont mind, plz post ur serial number. given ur purchase date, it probably looks like xxxx xx05 9xxx xxx.

anyone else purchase one in 2020 is able to roll back? seems like all successes are bought in 2019 so far.
[Fire HD 8 and HD 10 General] mozgoeb:
October 2020. 32Gb white. LOT P032. S/N: ХХХ 2D06 0325 ХХХХ

I can try to downgrade it from 7.3.1.8. If you point me how to do it.
[Fire HD 8 and HD 10 General] newnewcomputer:
ur chance is not good as Amazon made a change in early 2020 to block access to bootrom. so if u are happy w/ urs, u may not want to try.

if u really wanna, first thing is to check for bootrom access. i havent done it myself as mine had 7.3.1.0 but from @Michajin "...If you are interested in testing to see if you can downgrade, run a amonet script where you see "waiting for bootrom" Open the device and disconnect battery, pressing volume up (button closest to power button) and plug in the device into the usb (you should see remove short to continue). Do not continue, but in another terminal run a lsusb and verify you see a mediatek 6227 phone. This is the bootrom."

if u dont have bootrom, stop, close the tab back up n be happy :)
[Fire HD 8 and HD 10 General] Juppy99:
yep! as you guessed my serial does have those numbers in it!
[Fire HD 8 and HD 10 General] mozgoeb:
I guess that sooner or later I will need root (for example for tasker). And I'll have to try to downgrade. =(

"remove short" == "release buttons"???
[Fire HD 8 and HD 10 General] Michajin:
This is just to see if you have bootrom access. Just don't hit enter to continue on PC. Run the lsusb and see if you have mediatek phone (bootrom) or preloader. Do not connect the battery power, if you do it always goes right into preloader. If you have mediatek phone, your device can be downgraded.
[Fire HD 8 and HD 10 General] Haldi4803:
How do you decode Serial number into production date?

Mine is XXXX 1J06 0343 XXXX

bought on 13 October 2020.

Lot: J034

Edit:

These look a lot, like they could be year and week of production.

mhmmm. Guess i'd have to open it to know for sure.
[Fire HD 8 and HD 10 General] Michajin:
Lot numbers seem to indicate date of production for sure. Knowing when i bought mine and tham all being J9XX when i got mine were last couple months of 2019 and january of 2020. I have yet to see any success for anything that is J0-00+