yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] fastness2020:
Got "Protection disabled" with bypass_utility under [FireISO]

1, download the fireiso-2.0.0-amd64.iso from https://github.com/amonet-kamakiri/fireiso/releases,

2, burn the the iso image to a blank DVD. boot the computer into fireiso liveCD, with an DVD drive .

3, load all the files to a USB flash drive, USB32GB, mounted automatically at /run/media/root/USB32GB/

4, bypass_utility-v.1.4.2 is unzipped, saved in a USB flashdrive, in the folder /bypass, mounted as /run/media/root/USB32GB/bypass/

5, exploits_collection-1.6.zip is unzipped, saved in the folder /bypass too

[root@fireiso ~]# python3 --version

Python 3.9.1

[root@fireiso ~]# python3 -m pip --version

pip 20.3.1 from /usr/lib/python3.9/site-packages/pip (python 3.9)

[root@fireiso ~]# python3 -m ensurepip --default-pip

Looking in links: /tmp/tmpdmgv09oh

Requirement already satisfied: setuptools in /usr/lib/python3.9/site-packages (53.0.0)

Requirement already satisfied: pip in /usr/lib/python3.9/site-packages (20.3.1)

[root@fireiso ~]# python3 -m pip install pyusb pyserial json5

Requirement already satisfied: pyusb in /usr/lib/python3.9/site-packages (1.1.1)

Requirement already satisfied: pyserial in /usr/lib/python3.9/site-packages (3.5)

Requirement already satisfied: json5 in /usr/lib/python3.9/site-packages (0.9.5)

[root@fireiso ~]# cd /run/media/root/USB32GB/bypass/

[root@fireiso /run/media/root/USB32GB/bypass]# su root

[root@fireiso /run/media/root/USB32GB/bypass]# python3 ./main.py

[2022-09-30 20:36:25.552713] Waiting for device

[2022-09-30 20:36:36.062088] Found port = /dev/ttyACM0

[2022-09-30 20:36:36.203511] Device hw code: 0x788

[2022-09-30 20:36:36.309112] Device hw sub code: 0x8a00

[2022-09-30 20:36:36.419109] Device hw version: 0xca00

[2022-09-30 20:36:36.529119] Device sw version: 0x0

[2022-09-30 20:36:36.639113] Device secure boot: True

[2022-09-30 20:36:36.749112] Device serial link authorization: False

[2022-09-30 20:36:36.859110] Device download agent authorization: True

[2022-09-30 20:36:36.969128] Disabling watchdog timer

[2022-09-30 20:36:37.079595] Disabling protection

[2022-09-30 20:36:37.244340] Protection disabled

[root@fireiso /run/media/root/USB32GB/bypass]#

[root@fireiso /run/media/root/USB32GB/bypass]# cd /run/media/root/USB32GB/SP_Flash_Tool-5.1916_Linux/

[root@fireiso /run/media/root/USB32GB/SP_Flash_Tool-5.1916_Linux]# lsusb

...

Bus 003 Device 012: ID 0e8d:0003 MediaTek Inc. MT6227 phone

...

Now, how to run the SP_Flash_Tool-5.1916_Linux with this fireiso liveCD ?
[Fire HD 8 and HD 10 General] 789mod:
You must uninstall MTK drive , or disable sugrediver
[Fire HD 8 and HD 10 General] 789mod:
Pm me
[Fire HD 8 and HD 10 General] Arilan:
Ok im mad confused when its comes to this.

Fireiso 2.00 doesn't launch into XFCe I had to revert to using Fire ISO 1.00.

Any issues with using that version?

Also not sure after running the spflash to flashing the recovery , boot vendor & system. Do I need to power the device off and run the bypass again before connecting it to a device with Fireiso so I can run the scripts?

*do i really need to remove the battery?
[Fire HD 8 and HD 10 General] Michajin:
Not sure about all of this, pulling the battery gets you into bootrom, but access to the preloader you need the battery. From what I experienced when we developed the downgrade.... Been a while to remember all the details though. I don't think the version is matters. All this is going to do is give you a temp root access. Not a unlock....
[Fire HD 8 and HD 10 General] Arilan:
well i finally got it working and downgraded to 7.3.1.0 and i went ahead and pushed the MTK-su file and i keep getting this ./mtk-su: no such file or directory.

I can see the file in there so maybe i did something wrong :|
[Fire HD 8 and HD 10 General] Rortiz2:
You're pushing the wrong binary. You need to use the 'arm' one.
[Fire HD 8 and HD 10 General] Cpt.mactavish:
Is it possible to downgrade from

7.3.2.6 to 7.3.1.0??​
[Fire HD 8 and HD 10 General] Cpt.mactavish:
@k4y0z sir, I'm really sorry to mention u....would u be kind enough to let me know if downgrading to 7.3.2.6 is possible..

Mine says Lot J036 in back
[Fire HD 8 and HD 10 General] kountzero:
Late to the game here, ty for all the work so far. I have 2 mavericks , one virgin, one bricked. The 2nd seems to boot loop at the boot of preloader stage. I can access it with mtkclient and flash the partitions. But the ./bootrom-step and gpt scripts both fail at the 2nd stage loader with errror 5. Bypass works without the battery connected but flash_tool doesn't connect after the battery is connected. I think the partitions table is messed up somehow. Could someone list ALL the tables and what is flashed in what. Particularly the kb one at the start of the flash. Should it be zeroed out? Thanks. Edit. Scratch that, I had the wrong lk file flashed and after I flashed a full rom in flash-tool it worked as expected.
[Fire HD 8 and HD 10 General] Lestwist50:
Wow, you guys are working hard here keep blasting away to put a custom ROM in this tablet Maverick fire10 2019 like you guys did with 2017 models I will be waiting.
[Fire HD 8 and HD 10 General] webhook:
Same question, but with 7.3.1.2. My model is also a J036.
[Fire HD 8 and HD 10 General] Michajin:
No. It was released after January 2020.
[Fire HD 8 and HD 10 General] bibikalka:
Check out the non-root version of Vanced YouTube, it removes ads, and has some other nice features.
[Fire HD 8 and HD 10 General] dr_docdoc:
Hey all! Grateful onlooker here . . .

It’s almost Thanksgiving, the Fire HD 10 2019 has prices at $99 upon us, and the ability to root this device . . . ?

Anyone aware of progress on a root exploit to this device yet? I know when I got the HD 8 2016, I found out too late that an earlier root was available if I didn’t OTA. I had to wait another year or so before the next exploit came out.

Either way, I’m likely picking up a cool bunch’o’these for the entire fam, but I hoped to learn of a factory exploit before I power one up and the device goes through its OTA updates.

Thanks in advance to all you smart folks! ?
[Fire HD 8 and HD 10 General] DB126:
Not at present. Will probably attract some attention given specs and low price point which increases odds of finding/exploiting a vulnerability. That said, the bar is rising and interest falling on rooting latest generation of Android gizmos. A noisy enthusiast community will take exception to such remarks but reality and numbers don't lie.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
Does anyone know how to enter recovery mode with the new HD10 (2019)? I have tried all the button combinations I can think of but it either just boots normally or gives a white triangle with an exclamation mark.
[Fire HD 8 and HD 10 General] TheLastBoyScout:
I've used the rooted version of Vanced YouTube for so long I completely forgot about the non-rooted version. I'll take a look at it. Thanks!
[Fire HD 8 and HD 10 General] Supersonic27543:
BTW do we have a way to run arm64 binaries yet? I think the current version I have of the CVE-2019-2215 exploit should work on these tablets provided that they don't have October patches yet. It will require changing the offsets, but I'm going to extract them tomorrow. None of it will be useful without a way to actually run the exploit though. :( I had to stop the development of the app I mentioned earlier because of unavoidable reasons. I can still work on the exploit, but I definitely can't port this to arm32 by myself. Would be great if someone who owns the tablet can do some sleuthing about this. Thanks!

---------- Post added at 11:30 PM ---------- Previous post was at 11:28 PM ----------

When it gives the white triangle, try pressing Power+Vol Up, maybe this will give the recovery menu. :)
[Fire HD 8 and HD 10 General] diplomatic:
Since the kernel is arm64 but the userspace is limited to arm, I think you can make it work if you compile the executable with all static libraries. That way it would not depend on linker64, which is the file it can't find when you run a 64-bit program.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
You are right. Press Power and Volume Up (with tablet powered down) until you get the white triangle then press and hold down Power, then Volume Up again. For some reason they have removed the option to apply an update by ADB. Perhaps they have had too many bricks returned to them because of anti-rollback being triggered?

The tablet comes with Fire OS 7.3.1.0 but updates quickly to OS 7.3.1.1 on wifi. I wonder if the original software is vulnerable to the bootrom exploit? If this does get rooted soon it would be good to grab a copy of the original preloader. Hopefully neither version is patched for the above-mentioned exploit (CVE-2019-2215). I remember with the Fire 7 (2019), before it was discovered that the original software could have the bootloader unlocked, there was a way of running Magisk (version 18, I think) without altering the system partition and triggering DM-Verity.
[Fire HD 8 and HD 10 General] Supersonic27543:
Thanks for the advice! Will try tomorrow when I get some free time. :D

That would certainly make it very harder to recover from soft bricks that are not recoverable with a factory reset. :( Can you please check the security patch your version has? Also yes, if we couldn't unlock the bootloader we can still get root (albeit somewhat limited) with that method if the exploit works. :)
[Fire HD 8 and HD 10 General] MontysEvilTwin:
From the recovery log, the security patch date is 2018-08-05, but it also refers to version 7.3.1.0. so this may be for the version the tablet ships with. Is there another way of finding this information on a non-rooted tablet?
[Fire HD 8 and HD 10 General] dr_docdoc:
Actually, I do have a question besides the root status (and for sure, I’m ROOTin’ for you guys and gals to succeed)!

On a serious note, can anyone confirm if you can use scrcpy with the new fire hd 10 2019? Does it work flawlessly, not work, or something on between?

Thanks again in advance!
[Fire HD 8 and HD 10 General] Supersonic27543:
I think "getprop ro.build.version.security_patch" from ADB shell should work. If it doesn't try "cat /system/build.prop | grep security" and look for entries that could be interesting. Good luck!
[Fire HD 8 and HD 10 General] MontysEvilTwin:
I ran "getprop ro.build.version.security_patch" from within a terminal emulator on the tablet and it returned the following date: 2018-10-5.
[Fire HD 8 and HD 10 General] Supersonic27543:
2018!? Sorry for asking again but can you confirm again that it is not 2019? Because it will be extremely strange for an Amazon device to have a security patch more than a year outdated. :confused: Thank you very much!

---------- Post added at 04:09 PM ---------- Previous post was at 04:01 PM ----------

On a further note, does anyone who knows about the bootrom exploit think that these tablets will get unlocked eventually? I'm not familiar with the technical details of the bootrom exploit, so I'm not sure whether this device will be vulnerable or not. I'm just scared that I will make the mistake of buying an unrootable device again for the third time. :( Thank you.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
Yes, the date is correct.
[Fire HD 8 and HD 10 General] Supersonic27543:
That is very interesting. Thank you!
[Fire HD 8 and HD 10 General] DB126:
Not at all...actually quite common on initial hardware releases vs refreshes; best exploits often happen early in the life cycle. Depends on practices from whereever Amazon sources these cheap gizmos; I'm sure you can connect the dots.
[Fire HD 8 and HD 10 General] Supersonic27543:
Yes that would make sense, I was basing it on my HD 8 2017 with MT8163 which had a reasonably well maintained public source. (Also the HD 10 2017 which was(is?) vulnerable to DirtyCOW despite much later security patches comes to mind...)

Can someone with the HD10 2019 please try running the attached binary? (It is not really a .img but I renamed it because XDA does not allow uploading extension-less files, feel free to remove the .img) I'm not expecting it to give a root shell because it is not customized yet but I just want to see if it executes at all. Good luck!

EDIT: Looks like the kernel source isn't released yet. Very unfortunate :( I'm going to try to extract the offsets with a disassembler, but as I'm low on bandwidth currently and can't download the full update (here) would really appreciate it if someone could download and extract it, and upload just the kernel image. (should be boot.img or kernel.img, let me know if neither of those are present) Thanks!
[Fire HD 8 and HD 10 General] demoneg:
Happy to help

I am out of town for few days but I can try on Saturday, hope it won't brick my device, I am sure I have the 2019 version and I did manage to stop the update on time, so I am on Aug. security patch.
[Fire HD 8 and HD 10 General] Supersonic27543:
It only writes to RAM so I can safely say that nothing bad should happen except possibly the device rebooting or freezing up. Thanks!
[Fire HD 8 and HD 10 General] Michajin:
Per my source it is believed Maverick has a root available. Just need someone to set it up.... So if you havent disabled updates, you should..... Amazon started blocking this in the last 2 weeks on other devices.

https://xdaforums.com/t/potential-a...-8th-12th-gen-affected.4574635/#post-88416149
[Fire HD 8 and HD 10 General] webhook:
I'd already disabled OTA updates LOL! I'm still stuck with the Fire Toolbox while I cry in my corner for root with my 2020 Fire HD 10 9th Gen (mavericks),
[Fire HD 8 and HD 10 General] bibikalka:
We kind of need somebody to blend the prior MTK exploit with this new one - unfortunately, people with skills seem to have scattered a bit, may take a bit of time ...
[Fire HD 8 and HD 10 General] MrZaku086:
put a bounty in the exploit something like 100usd or something like that it may solve it.
[Fire HD 8 and HD 10 General] t2quan90:
chào bác, bác có thể cho sđt kết bạn zalo ko mình hỏi một chút

sđt mình 0975567506
[Fire HD 8 and HD 10 General] audischrauber:
Just for confirmation as I am not sure anymore after reading through the 50 pages :-) Is there a way for a 2019 maverick / J045 to unlock the bootloader ? What about the temporary unlock mentioned in #796 ?
[Fire HD 8 and HD 10 General] Michajin:
No sorry
[Fire HD 8 and HD 10 General] audischrauber:
That's a pitty. Am I right with my assumption that the last upgradable Fire is a gen. 9 / maverick with a serial / LOT J9xx ? Means any newer generation (>9) is locked ?
[Fire HD 8 and HD 10 General] Michajin:
Correct, unless another exploit is found.
[Fire HD 8 and HD 10 General] Dominater:
Is it impossible J941 maverick 7.3.2.9 to 7.3.1.0 downgrade?
[Fire HD 8 and HD 10 General] Michajin:
No, I think it possible. Just takes some time. You have to see if bootrom is accessible, based off a j19, it should be.
[Fire HD 8 and HD 10 General] Michajin:
Let me look into it. I didn't remember now. If it was purchased in 2019 it should have it.
[Fire HD 8 and HD 10 General] Dominater:
1. main.py doesnt execute by some error

modulenotfounderror: no module named 'serial'

modulenotfounderror no module named 'serial.serialutil'

so i pip install serial and pip install pyserial to solve this

2. next error is runtime error: default config is missing

so i download https://github.com/MTK-bypass/exploits_collection

3. now another new error Permission denied

B:\bypass>python main.py

[2024-03-14 13:53:58.092191] Waiting for device

[2024-03-14 13:54:07.726915] Found port = COM5

[2024-03-14 13:54:08.020548] Device hw code: 0x788

[2024-03-14 13:54:08.020548] Device hw sub code: 0x8a00

Traceback (most recent call last):

File "B:\bypass\main.py", line 213, in <module>

main()

File "B:\bypass\main.py", line 44, in main

config, serial_link_authorization, download_agent_authorization, hw_code = get_device_info(device, arguments)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "B:\bypass\main.py", line 176, in get_device_info

log("Device hw sub code: {}".format(hex(hw_sub_code)))

File "B:\bypass\src\logger.py", line 8, in log

with open("bypass_utility.log", "a") as out:

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

PermissionError: [Errno 13] Permission denied: 'bypass_utility.log'

log in file

[2024-03-14 13:53:58.092191] Waiting for device

[2024-03-14 13:54:07.726915] Found port = COM5

[2024-03-14 13:54:08.020548] Device hw code: 0x788

what should i do
[Fire HD 8 and HD 10 General] Dominater:
PS B:\bypass> python main.py

[2024-03-14 14:15:54.247391] Waiting for device

[2024-03-14 14:16:07.462305] Found port = COM6

[2024-03-14 14:16:07.500049] Device hw code: 0x788

[2024-03-14 14:16:07.500049] Device hw sub code: 0x8a00

[2024-03-14 14:16:07.501060] Device hw version: 0xca00

[2024-03-14 14:16:07.501060] Device sw version: 0x0

[2024-03-14 14:16:07.501060] Device secure boot: True

[2024-03-14 14:16:07.501060] Device serial link authorization: False

[2024-03-14 14:16:07.501060] Device download agent authorization: True

[2024-03-14 14:16:07.502567] Disabling watchdog timer

[2024-03-14 14:16:07.502567] Disabling protection

Traceback (most recent call last):

File "B:\bypass\main.py", line 213, in <module>

main()

File "B:\bypass\main.py", line 58, in main

result = exploit(device, config.watchdog_address, config.payload_address, config.var_0, config.var_1, payload)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "B:\bypass\src\exploit.py", line 32, in exploit

udev = usb.core.find(idVendor=0x0E8D, idProduct=0x3)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "C:\Users\Parin\AppData\Local\Programs\Python\Python311\Lib\site-packages\usb\core.py", line 1309, in find

raise NoBackendError('No backend available')

usb.core.NoBackendError: No backend available

I've only seen a different error once, I couldn't reproduce it and still don't know what's wrong.

still can not solved permission problem
[Fire HD 8 and HD 10 General] Michajin:
Start here. you have to downgrade to get mtk to work. There are about 4-5 pages of info after that, that should get you the answers you need.

https://xdaforums.com/t/new-fire-hd...k-brainstorming.3979343/page-28#post-84499719
[Fire HD 8 and HD 10 General] nonetrix:
I got this tablet as a hand me down gift. Seems to be some discussion about a new possible method, what is that about? I wouldn't mind experimenting and trying to get it work perhaps sounds fun. Also what is the current process exactly to getting LinageOS and possibly reverting it? Seems like GPU decode is broken, but what about GPU in general? I don't plan to really use this device so I don't really care much about lost functionality, maybe can be a device to watch YouTube videos might be nice still screen doesn't seem terrible. My other suggestions is maybe trying the dirty pipe bug, I think that could give us permanent root perhaps but the boot loader likely would be still locked. But I find it interesting that it doesn't gray out OEM unlocking it just instantly disables it maybe it could be overcome it permanently enable it or something idk. I'm not really experienced with Android stuff besides installing LinageOS on my Pixel 6a, installing Cyanogen Mod on Fire Phone (lol), and installing King Root on old Galaxy which was probably spyware 😅 Linux is definitely more my strong suit
[Fire HD 8 and HD 10 General] nonetrix:
Ignore this I don't know how to delete things, I'm kinda new here 😅
[Fire HD 8 and HD 10 General] PRInCEI7:
I have a problem with the new version of mtkclient. This problem appears. Is there a solution?

python mtk plstage --preloader=preloader_patched.bin
[Fire HD 8 and HD 10 General] nightreign:
I did everything up to step 8, but when I went to boot from OS the device no longer powers on. I do notice bypass is detecting the device and the flasher is able to format and download so I don't think the device is completely dead
[Fire HD 8 and HD 10 General] demoneg:
sweet! I will let you know! I hope it has the bug already ;)
[Fire HD 8 and HD 10 General] MontysEvilTwin:
I ran su98 in a terminal emulator. The output is here:

:/data/user/0/jackpal.androidterm/app_HOME $ ./su98
MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0x0
CHILD: task_struct_ptr = 0x0
CHILD: Finished write to FIFO.
CHILD: **fail** problematic address pointer, e.g., 0
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
MAIN: **fail** retrying
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0x0
CHILD: task_struct_ptr = 0x0
CHILD: Finished write to FIFO.
CHILD: **fail** problematic address pointer, e.g., 0
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
MAIN: **fail** retrying
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0x0
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0x0
CHILD: Finished write to FIFO.
CHILD: **fail** problematic address pointer, e.g., 0
MAIN: **fail** retrying
Failed to leak data: error
1|:/data/user/0/jackpal.androidterm/app_HOME $

I have also attached a zip containing the boot image from OS 7.3.1.1.
[Fire HD 8 and HD 10 General] Supersonic27543:
Nice, I think that there is a high chance that it is vulnerable! Also, thank you very much for the boot image, trying to extract the offsets now.
[Fire HD 8 and HD 10 General] bibikalka:
Hurry up!!! :D

I need to decide if I should buy this tablet by Cyber Monday, or the ship will have sailed ...
[Fire HD 8 and HD 10 General] dr_docdoc:
Super excited at all the positive outlook here!

I just picked up 7 of these babies last night for $99 each and 10% back getting store card.

We gonna do YouTube channel family gaming with Android Mobile apps (hence why I asked if anyone can verify SCRCPY works on unrooted version - I'm assuming and hopeful it will).

I have yet to even unbox these because I'm not 100% sure how to stop any OTA updates as soon as I connect to WIFI (can anyone give clear instructions on how to turn these on and use WITHOUT registration and/or OTA updates)?

I just want to be sure I keep the virgin factory OS installed so as to not ruin any of my chances at ROOTING once y'all figure this out.

Thanks again for all your big brains out there!
[Fire HD 8 and HD 10 General] Supersonic27543:
I ordered the tablet just because of the horribly old security patch. Hopefully this wouldn't be my third unrootable device. I never learn. :p The thing is I'm not very familiar with a disassembler so I can't even figure out how to set Ghidra up properly. I'm sure I'll figure it out in time but probably not very quickly (I think tomorrow or the day after that)

---------- Post added at 11:34 PM ---------- Previous post was at 11:16 PM ----------

I don't see any reason for scrcpy to not work :) I've never tried it in an Amazon device though.

Unfortunately disabling OTA requires first disabling the OTA apps, and Amazon usually blocks them from being disabled by normal ways. You can complete the setup without connecting to WiFi though, and it will also allow you to skip registration.

(I'm not sure if this is still possible on the newer devices, and you will have to keep the device disconnected from WiFi to stop updates until someone finds a way to disable OTA)

Also be careful while doing this if you selected "Link to Amazon account" option while buying the device (it is selected by default) the device may connect to your WiFi network automatically without password from the saved data on the Amazon account.

What you have to do is, when you enter the WiFi login step of the setup, tap any password protected WiFi network, and when you get the password prompt, hit the back button. You should return to WiFi select screen but there should be a new button saying "SKIP" (or something along that lines) in the bottom of the screen. You can use that button to close the setup.

Good luck!