yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] weishu:
You can try this: https://speakerdeck.com/retme7/the-...ntional-use-after-free-bugs-in-android-kernel, could you share the poc? Maybe we can work it together.
[Fire HD 8 and HD 10 General] z0oinks1:
Can I downgrade from 7.3.1.2 to 7.3.1.0 to root?

And are there any Lineage ROMS available? Didn't see any in the forum but I could've missed something
[Fire HD 8 and HD 10 General] Michajin:
Yes, the process is not totally refined. But if you bought your device before January 2020. You have to verify you have access to the bootrom.
[Fire HD 8 and HD 10 General] z0oinks1:
I just bought it, so not sure if I would have access
[Fire HD 8 and HD 10 General] Michajin:
99.9% sure you wouldn't. Sorry
[Fire HD 8 and HD 10 General] z0oinks1:
No worries, guess Toolkit will have to do!
[Fire HD 8 and HD 10 General] stickfiretv2020:
I'm currently looking into two methods for the HD 10, still brainstorming it and not tried it on my own units yet - I have working downgrade method to 7.3.1.0 for this device I think, thats if it wasn't a hardware patch on this device. Needs testing, but problem is exploit is major computing exploit not just Android exploit.... Working out what to do about it generally as something I've discovered.

Second method, which doesn't involve a downgrade, is using fbtool on this device. This is likely to be able to turned into a software based fastboot cable. Still ironing out details here:

https://xdaforums.com/t/fire-7-2020-mustang-brainstorming.4295541/

Would need to locate or work out how to produce a patch for fbtool for the HD's SoC, though. Anyone know any githubs which contain MTK Board tools source (i.e. fbtool source) for this SoC?
[Fire HD 8 and HD 10 General] MrZaku086:
hey do you thin this would work?

Mediatek (MTK) Auto TWRP recovery porter by Team Hovatek

If you wish to root your Mediatek Android phone, we'd dropped a guide on rooting using Magisk and stock boot.img at https://www.hovatek.com/forum/thread-21427.html , no custom recovery is required. Se

forum.hovatek.com

this device have the same mtk chip and a custom twrp

BQ Aquaris M8

Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...

twrp.me

or

Android One Second Generation MTK

Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...

twrp.me

or

MT8163

Device trees for mt8163 Processors for amazon and other devices. - MT8163

github.com

or

GitHub - marex/u-boot-mtk: U-Boot MTK mirror

U-Boot MTK mirror. Contribute to marex/u-boot-mtk development by creating an account on GitHub.

github.com

something of this help?

PD: sorry if dont help you but i really want to this device have a lineage os xD
[Fire HD 8 and HD 10 General] Khiem Tran:
I wiped preloader on 7.3.1.8 and device frozen at bootrom. Can anyone upload preloader 7.3.1.8 file?
[Fire HD 8 and HD 10 General] Michajin:
You need to downgrade to 7.3.1.0, you can get root access.
[Fire HD 8 and HD 10 General] Khiem Tran:
I tried using SPFlash to downgrade but I can't write EMMC. It is stopped as shown below.
[Fire HD 8 and HD 10 General] k4y0z:
Try selecting USB mode instead of Serial if you're on Windows.

Also you won't be able to flash all of the partitions using SPFT, the ones that don't work will need to be flashed using kamakiri.

You'll have to rerun the bypass after every action in SPFT.
[Fire HD 8 and HD 10 General] Khiem Tran:
I have done the following

Step1: Plug out battery. Then, hold volume up to bootrom

Step2: Run bypass and format preloader with SPFlash (length 0x100000)

Step3: Plugin battery. Run bypass and flash boot, recovey, vendor, system with SPFlash.

Step4: Run bootrom-step.sh in kamakiri folder.

What should I do next?

Do I have to flash preloader, lk, tee1, tee2m spmfw, sspm_1, cam_vpu1, cam_vpu2, cam_vpu3 using SPFlash?
[Fire HD 8 and HD 10 General] k4y0z:
The latest kamakiri version that I posted somewhere here in this thread, should flash all the partitions, that can't be flashed using SPFT.
[Fire HD 8 and HD 10 General] Khiem Tran:
I mistakenly deleted EMMC_USER Format Length 0x100000. Device frozen at Fire boot logo. LOL
[Fire HD 8 and HD 10 General] k4y0z:
Then you killed the GPT and part of kb partition.

Try running the gpt-fix.sh script in kamakiri to repair the GPT.
[Fire HD 8 and HD 10 General] Khiem Tran:
I access recovery mode to factory reset. It worked successfully.

Thanks all.
[Fire HD 8 and HD 10 General] MrZaku086:
do you unlock the bootloader? or rooted the tablet?
[Fire HD 8 and HD 10 General] INetBowser:
Hey guys,

I need some help regarding the root exploit I'm writing currently. If I manage to get it working, Fire HD 10 9th gen on version 7.3.1.2 (and maybe higher, I need to look into that) should be rootable.

Anyone with a rooted Fire HD 10 9th gen, can you please run this command as root

cat /proc/iomem

and post the output?

Thanks!
[Fire HD 8 and HD 10 General] Khiem Tran:
I downgraded the firmware to 7.3.1.0 to root. Currently, I have not found a way to unlock the bootloader. Root is restricted, cannot remove system app such as Silk browser, FreeTime...
[Fire HD 8 and HD 10 General] blaacksheep:
Unfortunately, Amazon has locked down FireOS pretty firmly. You can disable those apps though. Have you checked out Fire Toolbox?
[Fire HD 8 and HD 10 General] Michajin:
With root access you can use a app disabler. Root works fine. Just can't modify the system apps. I use package disabler with root access to quickly disabled app. Full root would be better, and unlocking would be awesome. We will see, seems development had picked up lately.
[Fire HD 8 and HD 10 General] MrZaku086:
well the 2017 model took many years and in the end you need to some hardware hackery to unlock the bootloader and be free.... maybe that is the route to this tablet some hardware thing to acess to factory mode or something like that and unblock the boatloader is very trashy to amazon bloking the bootloader using a android fork.
[Fire HD 8 and HD 10 General] Michajin:
I have found the shorting method on it, but amazon/mediatek made a hardware change that disable the bootrom. It has been found on anything as of about January of 2020 had the bootrom disabled. The exploit would have to be a totally new route.
[Fire HD 8 and HD 10 General] MrZaku086:
i think that is on part of amazon, tyou can hack very easy another tablets with the same chip.
[Fire HD 8 and HD 10 General] lewmur:
You have to realize that Amazon tablets are very inexpensive because of all the advertising built into them. From their view point, rooting the tablet to get rid of their bloat, is cheating. So, of course, they are going to do their best to prevent it. I do my best to eliminate their bloat, but I don't find their efforts to stop me to be "trashy".
[Fire HD 8 and HD 10 General] Sherl:
Did you end up doing it? I have a Blue Fire HD10 with lot P041. SO wondering can I root mine
[Fire HD 8 and HD 10 General] Michajin:
You can root if you have bootrom access. I had to open mine. Disconnect battery, plug in and see if you can get mediatek phone. It's still limited to the first few months of production. Approximately January 2020.
[Fire HD 8 and HD 10 General] tsupatsupa:
I have Fire HD 10 9th gen with 7.3.1.2 firmware.

I'm able to get to bootrom after removing the battery. How do I proceed to downgrade the firmware to 7.3.1.0? I have the files but not sure how to flash the device.
[Fire HD 8 and HD 10 General] Syco54645:
so is there a guide to downgrade and then obtain permanent root? i have read most of this thread and am left scratching my head.
[Fire HD 8 and HD 10 General] Kramar111:
@tsupatsupa

@Syco54645

https://xdaforums.com/t/new-fire-hd...k-brainstorming.3979343/page-28#post-84498751

https://xdaforums.com/t/new-fire-hd...k-brainstorming.3979343/page-28#post-84499719

and some posts between
[Fire HD 8 and HD 10 General] Syco54645:
Thanks, I am still foggy on this process though. I have both of those downloaded but I am unsure of the steps to get to the point of using them. The thread seems to be full of people trying things and reporting what works and that is what is causing my confusion.

Best I can tell

Remove Battery

Plug device in

Use SP flash to clear the Preloader

Use kamakiri to complete the downgrade
[Fire HD 8 and HD 10 General] Michajin:
OK, open the device

disconnect battery connector (remove the tape piece)

plug device in

Seems you have to dc battery to access bootrom, but you cant write to emmc without the battery connected, when you connect to battery, it goes into preloader. We wiped the preloader then you can stay in bootrom and flash...
[Fire HD 8 and HD 10 General] Syco54645:
What version of SP Flash should we be using? I found version 6.2124.00 but when I try to format the preloader it errors with "Please select flash xml before operation"
[Fire HD 8 and HD 10 General] Michajin:
I can't remember seems like I wiped it with a command. @k4y0z might know
[Fire HD 8 and HD 10 General] Syco54645:
Thanks. It seems I get no life out of the tablet after disconnecting the battery and then plugging it in. I have tried both Linux and Windows. I am much more familiar with Linux so not really sure how to check in windows but in Linux dmesg shows nothing when I plug it in. Curious if I need to power it on first or something, granted I held the power button and it didnt work.
[Fire HD 8 and HD 10 General] Michajin:
Then you probably don't have access. It was limited to the first few months of production. You need to have bootrom access to do anything. Think it was before January 2020
[Fire HD 8 and HD 10 General] Syco54645:
ah ok that makes sense. thanks for helping out.
[Fire HD 8 and HD 10 General] k4y0z:
While I haven't tested every version, probably any version that uses a scatter file and doesn't require an XML will do.

I'd suggest going with a version 5.x.

As @Michajin already said, the prerequisite for any of the modifications is access to brom DL-Mode.

Linux is the preferred OS for running the bypass or kamakiri, it does however require a patched Linux kernel https://github.com/amonet-kamakiri/prebuilt-kernels or FireISO.

Checking access to bootrom DL Mode doesn't require the patch and can be confirmed via lsusb on Linux:

0e8d:0003 MediaTek Inc. MT6227 phone
[Fire HD 8 and HD 10 General] daveaspy:
I've been following this thread to try and recover an unmodified HD10 which was stuck on the fire boot logo but I fear the eMMC is dead. Using recovery I get errors when trying to do factory reset as /cache cannot be mounted - makes me think the storage is corrupt?

I have the MT6227 phone device, finally cleared the preloader with SP Flash tool (after pulling the battery), but did get some intermittent errors about STATUS_STOR_LIFE EXHAUST as I was trying to get this to work. Then I tried gpt-fix which seemed to work ok. bootrom-step.sh said rpmb looked broken but I continued and that all went ok but was no closer to getting me a booting device (back in recovery I still have the cannot mount cache issue)

When I've tried to do these steps again, gpt-fix starts up ok but fails at "flashing GPT" because emmc_write() is giving "device failure". Could the eMMC really be dead? Is there any hope for this device??
[Fire HD 8 and HD 10 General] greenlndr:
I feel really dumb because I can't even install UsbDk_1.0.22_x64.msi It opens but quickly closes. Able to get everything else going. Running python main.py results in:

Tried on my old laptop, same thing. Both Win10 64.

My Fire HD 10 is on 7.0/PS7318/1957N, just want to get rid of the awful Amazon entirely and put custom recovery and standard android.. Any chance of me doing that, without cracking the case open? Screens already broken, it won't survive the surgery. :P
[Fire HD 8 and HD 10 General] Michajin:
No chance, unless you bought it prior to january 2020. If you got it prior to that you can get temp root, but not unlock. There is no unlock, custom recovery, or custom rom. Just a temp root, which cannot modify the system partition.
[Fire HD 8 and HD 10 General] greenlndr:
Oh it's from 2019, for sure. Should I just try to run SP Flash Tool and flash maverick-downgrade-7.0_PS7310_940N? I can't get bypass_utility-v.1.4.2 to work.
[Fire HD 8 and HD 10 General] Michajin:
You have to get into the bootrom to downgrade. Volume (+or- sorry it's been a while) and power worked on 7.3.1.0, 7.3.1.1, and possibly 7.3.1.2. run lsusb verify you see mediatek phone. What os are you on? After 7.3.1.2 you have to disconnect the battery to get into bootrom and connect it to flash emmc.
[Fire HD 8 and HD 10 General] b1n4ry:
im guessing no progress on this?
[Fire HD 8 and HD 10 General] Droid4200:
On the 10HD 2019, not that I have seen. I'm very surprised after all these years.
[Fire HD 8 and HD 10 General] almazen81:
Is there any news for maverick root permanent ؟ I have a problem when I try to downgrade to 7.3.1.0 The operation succeeded, but the touch does not work Note that the previous version was 7.3.1.1 Is there any solution؟
[Fire HD 8 and HD 10 General] StonedEngineer97:
Try reflashing the full load, I think there was downgrade issue with the wifi for a user here and a reflash fixed it
[Fire HD 8 and HD 10 General] almazen81:
I tried to go back to the latest but to find the update I think I will need scatter rom 7.3.1.1
[Fire HD 8 and HD 10 General] almazen81:
I am ready to donate $100 to anyone who permanently root this device(y):cowboy:​
[Fire HD 8 and HD 10 General] Droid4200:
Eh, I know I probably shouldn't engage in this topic because I know developers are probably already trying their hardest, but I would also contribute +50usd if it installs on .12 without hoops, custom recovery to flash without computer would be nice.

If it does happen the Developer may contact me where to send. If this is out of line, sorry, please remove post.
[Fire HD 8 and HD 10 General] @Malware:
Unlock bootloader using adb and root using magisk
[Fire HD 8 and HD 10 General] @Malware:
Unlock bootloader using adb and root using magisk

XDA Forums

Android Forum for Mobile Phones, Tablets, Hardware & App Development

xdaforums.com

How to Install Magisk on your Android Phone

Magisk is a powerful tool that can help you customize some aspects of your phone or even grant you root access. Here's how you can install it!

www.xda-developers.com
[Fire HD 8 and HD 10 General] Rortiz2:
If it was that easy do you think people would donate 100$? Unfortunately to use Magisk you need an unlocked bootloader and we can only archieve bootless root with mtk-su (which limits us from editing the /system partition).
[Fire HD 8 and HD 10 General] MrZaku086:
off topic rooting and unlocking the bootloader of 10 and 11 tablet generation looks more harder that having a 3d sex life than is no vr porn.

good luck i donate my hope because im from argetina and the only thing in my bank account is 0 and hope,
[Fire HD 8 and HD 10 General] almazen81:
This tool works on this device, but after sending dd if file to the device is dead link

Supported devices​

Device	Model	Android Version	Tested
Amazon Fire 7 2017	austin – mt8127_evb1	5.1	Yes
Amazon Fire 7 2015	ford – mt8127_evb1	5.1	Yes
Amazon Fire HD8 2016	giza	5.1	Yes
Amazon Fire HD8 2017	giza	5.1	Yes
Amazon Fire HD10 2017	suez	5.1	Yes
Amazon Fire HD10 2019	maverick	9.0	Yes
Amazon Fire HD10 2021	trona	9.0	No
Amazon Fire TV Stick Basic	tank – mt8127_evb1	5.1	Yes
Amazon Fire TV Stick 4K	mantis	7.1	No
Amazon Fire TV Stick Lite	sheldon	9.0	No
Amazon Fire TV 2 (2015)	sloane	5.1	Yes
Amazon Echo Input	cupcake	7.1	Yes
Amazon Echo Dot 2	biscuit	5.1	No
[Fire HD 8 and HD 10 General] Rortiz2:
Of course the device is dead. The images patched by that tool are supposed to be used with mtkclient to temporarily boot them to temporarily unlock the device. So yeah. It indeed unlocks the bootloader but you need a PC every time you want to reboot the tablet. It's basically some kind of tethered unlock (something like xyz mentioned long time ago).
[Fire HD 8 and HD 10 General] almazen81:
no I have bootrom-step.sh To get the device back to work .I'll try another way and see if it works without dying
[Fire HD 8 and HD 10 General] Rortiz2:
If you want to try it, patch both LK and Preloader and ONLY dd LK to the eMMC. After that, use mtkclient to boot the patched Preloader. If you can't get it to work, I'll provide you more detailed instructions later.
[Fire HD 8 and HD 10 General] almazen81:
Thank you, I'll let you know when I'm free
[Fire HD 8 and HD 10 General] 789mod:
so can edit system.img and refalsh it ?

or i can crash recovery how ?
[Fire HD 8 and HD 10 General] almazen81:
I changed in system But the result is after flashing does not work We really need to disable protection pl
[Fire HD 8 and HD 10 General] blaze2051:
man i really need to unlock BL, and get lineage OS on the Fire HD 10
[Fire HD 8 and HD 10 General] MrZaku086:
we all need the same
[Fire HD 8 and HD 10 General] x3r0.13urn:
I was wondering if there is anyone here had tried whether mtkclient unlock bootloader works for 2019 (or 2021) device? I've searched some thread and found nobody reporting it, yet.
[Fire HD 8 and HD 10 General] 789mod:
can you post video on youtube !
[Fire HD 8 and HD 10 General] x3r0.13urn:
No, I didn't try it. I merely asked if someone else had tried it.

Seems it needed the device to boot into brom. Doubtful it will work without any knowledge to get into brom mode.
[Fire HD 8 and HD 10 General] DB126:
Good luck with that Grasshopper.
[Fire HD 8 and HD 10 General] Sharp_K:
Keep us posted! Please do note that in the post below, I tried executing the arm version instead of the arm64 version and it was indeed executed, so I don't know if that tells you something.
[Fire HD 8 and HD 10 General] Supersonic27543:
[MENTION=6013306]Sharp_K[/MENTION] Oh....can you please run "uname -a" in a terminal and paste the output here?
[Fire HD 8 and HD 10 General] Sharp_K:
ofc.

Linux localhost 4.4.146+ #1 SMP PREEMPT Thu Oct 24 19:03:28 UTC 2019 armv8l Android
[Fire HD 8 and HD 10 General] Supersonic27543:
Well that's a relief, this should support running arm64. :D I feared that this device is running a 32 bit OS on a 64 bit processor, and no one ported that exploit to armv7 yet. Thanks!
[Fire HD 8 and HD 10 General] diplomatic:
Was there anything printed after the "step 4" line if you used R19?
[Fire HD 8 and HD 10 General] Sharp_K:
yes, "Firmware support not implemented".
[Fire HD 8 and HD 10 General] diplomatic:
Well, that's a tiny bit more promising than "This platform is not supported". :) The FW probably still doesn't allow mtk-su access in principle, but now I'm only 90% sure about it rather than like 98%. I think that support can be added but there will be another brick wall down the road....
[Fire HD 8 and HD 10 General] 9volts:
Not for long... https://cloudblogs.microsoft.com/opensource/2019/08/28/exfat-linux-kernel/
[Fire HD 8 and HD 10 General] DB126:
I'm aware of the Open Source direction which was announced this summer. Stating an intention and actually doing it are two different things.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Where's the test point of the Fire HD 10 2019?
[Fire HD 8 and HD 10 General] DARKFiB3R:
Aww crap. I just bought one of these, not realising how new they were, and that they hadn't been rooted yet.

And so, the waiting and hoping begins.
[Fire HD 8 and HD 10 General] Kctucka:
Not sure if this is US only, but they're currently on sale for 100 bucks, with or without Prime!
[Fire HD 8 and HD 10 General] TheLastBoyScout:
Snagged two (one for me and one for the missus) and then an HD7 for the kiddo.

I hate to do it, but my original Nvidia Shield tablet is finally about to die. Random reboots, battery life is in the toilet, and the headphone jack broke about a week ago. She has been a good one.

Hopefully these get rooted soon. I can't stand the thought of going back to Youtube with ads or not being able to play videos with the screen locked.
[Fire HD 8 and HD 10 General] zed011:
Canada too :)
[Fire HD 8 and HD 10 General] pointbob:
so newbie here - is the fire HD 10 2019 rootable? thanksss
[Fire HD 8 and HD 10 General] DB126:
Nope.
[Fire HD 8 and HD 10 General] fanavity:
Hi,

I need a display for my openHAB display. Is it passible to wake up the display on move detection with the front camera? If not. Do you have any ideas how I can use it for openHAB? Thanks for your tips :)
[Fire HD 8 and HD 10 General] SAM4191:
I am trying to do the same thing.

I don't think it's possible to do it with the front camera and the fire hd 10, like most tablets doesn't have a proximity sensor.

So far I got Automate (by llamalab) to wake my screen. Unlock should be possible as well. Now I need to trigger the flow. I'm going to buy a cheap motion sensor, set it up with a low sensibility and trigger the flow over a websocket (maybe ifttt).

You could use the microphone. I read somewhere that someone used it to emulate the function of dttw (doubletap to wake) on their fire tablet.
[Fire HD 8 and HD 10 General] NerdFire:
Not yet. But . . .

we have <indianajones>top men</indianajones> working on it now.

:D
[Fire HD 8 and HD 10 General] Rortiz2:
No, the "unlock bootloader" option of mtkclient won't work here because Amazon isn't using the seccfg partition to handle the bootloader status of their devices. However, all the other options are working correctly (read, write, boot patched images, etc).
[Fire HD 8 and HD 10 General] PRInCEI7:
I tried unlocking the bootloader through MTK TOOL and it worked, I was able to extract MT6771_android_scatter and preloader_maverick.bin ,How do I know if the process has already succeeded or not, by the way I can read and write all system files boot AND lk , recovery.img , etc .

on 7.3.1.0
[Fire HD 8 and HD 10 General] x3r0.13urn:
Try to get into fastboot mode and run "fastboot getvar all", see if there is any "unlocked: yes"
[Fire HD 8 and HD 10 General] Khiem Tran:
You boot to bootloader

adb reboot bootloader

and try some command

fastboot flashing unlock

fastboot flashing unlock_critical

fastboot oem unlock
[Fire HD 8 and HD 10 General] blaacksheep:
adb shell

su

If you get a # at the prompt, you're root. If you get a $, you're not.
[Fire HD 8 and HD 10 General] Rortiz2:
That's just the output of mtk payload which just disables DAA/SLA/SBC until you reboot the device. So no, that's not the bootloader unlock option.
[Fire HD 8 and HD 10 General] Rortiz2:
That won't work either, Amazon removed all these commands (check by yourself by running the GNU strings command over the LK image). They simply allow you to flash the unlock code to the "unlock partition" (which is a small part of the boot1 - idme - area). Note that flashing a big file to the unlock partition can brick the device.
[Fire HD 8 and HD 10 General] x3r0.13urn:
I see. Xiaomi uses similar method actually, behind their "mi flash unlock" tool, and LG too if I recalled correctly. Thanks for the information.
[Fire HD 8 and HD 10 General] lewmur:
What's the possibility that the commands are still there but have just been renamed? Not that it would be an easy task to find the new names.
[Fire HD 8 and HD 10 General] Rortiz2:
There is no possibility. The commands have never been there. I have already decompiled the stock bootloader image with Ghidra and there is not a single reference to any of them.
[Fire HD 8 and HD 10 General] lewmur:
Does that mean that Amazon hasn't left their own techs a "backdoor" to unlock the bootloarder?