yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] newnewcomputer:
scroll back to around post# 200 on this thread n u will see that mtk-su was working for 7.3.1.0 which was the initial release OS for fire HD 10 2019. Amazon released 7.3.1.1 update within day n patched mtk-su.

u cant check the difference cuz' 7.3.1.0 was not available at either github nor amazon:

Source Code Notice for Kindle E-Readers and Fire Tablets - Amazon Customer Service

In accordance with certain free and open source software licenses, Amazon is pleased to make available to you for download an archive file of machine readable source code (

www.amazon.com

7.3.1.1 is the oldest available
[Fire HD 8 and HD 10 General] StonedEngineer97:
Thanks, makes it easier to track
[Fire HD 8 and HD 10 General] StonedEngineer97:
New to the scene and I'm just beginning to dig through the old posts, thanks.

Could the release version not be extracted?

I also thought I read about cve 20192215 being exploitable on atleast 7.3.1.2 so I was going to give that another look too
[Fire HD 8 and HD 10 General] newnewcomputer:
welcome :)

yes, 7.3.1.0 recovery can be extracted (not sure if it had been pulled and posted) but w/o root AND unlocked BL, u probably cannot roll back from 7.3.1.2

a number of exploits were discussed during the initial release but Amazon pleasantly surprised us by not patching mtk-su at first. so fire HD 10 2019 was rooted in record time. just as quickly though, 7.3.1.1 was pushed out and closed that. there was a note about boot rom remained accessible. have not heard any exploit for 7.3.1.2 or later.

good luck!
[Fire HD 8 and HD 10 General] StonedEngineer97:
Yeah probably won't be able to roll back so looks like we have to take the hard way.

Looking at the patch level there's a few vulnerabilities that could be exploited on lower firmwares but it's like going in blind.

I was going to take a look this week but seems like I'd need to get lucky with offsets or have some way to read the logs.

Anyone have any suggestions for setting up an environment to debug?
[Fire HD 8 and HD 10 General] newnewcomputer:
start from post# 226 - dats when @diplomatic confirmed mtk-su working :) he also posted the various root partitions in a later post. u can start from there. i saw some discussion about potential downgrade from 7.3.1.1 to 7.3.1.0. The previous gen of fire HD 8 and 10 were first unlocked by hard-wiring a test point on its PCB. Based on the partition info learnt, software unlock was developed. That was how we got custom recovery and ROM on those tabs.

u can learn more by checking the various unlock threads under "Original Android Development" here. unfortunately there has not been the same interest level so far for HD10 2019. just saying that it can be done - good luck!
[Fire HD 8 and HD 10 General] StonedEngineer97:
I think I've read through all the relevant development.

I think current state suggests a bootloader exploit might be a big jump but I was thinking about digging for a temporary root exploit. Might be the easiest (relatively) to get a known vulnerable poc working first or trying to implement a cve (mostly at an interest level speed)

I know 7.3.1.2 is still a Jan 2020 build and the security patch suggests an even older level to start at.

Anyone else working on this or thinking about digging into this?
[Fire HD 8 and HD 10 General] StonedEngineer97:
Anyone know if the MTK-bypass utility by chaosmaster would work for the HD10. It sounds like it opens up downgrade options for anyone that has access to the bootloader if I didn't misunderstand it.

Overview link: https://megafon929.github.io/mtk
[Fire HD 8 and HD 10 General] novatillo:
It looks like there is no mt8183 exploit yet, but maybe someone can contribute one, https://tinyhack.com/2021/01/31/dissecting-a-mediatek-bootrom-exploit/
[Fire HD 8 and HD 10 General] Droid4200:
Has anyone even tried to root with kingroot on PC ? I tried last night, didn't think it would work, and noticed it said "0 request" was I the first person? I also send them an email asking them to try and look for a root if possible. The PC is the better way if you didn't already know, not the .apk. Maybe a few more people should send them them an email as well so its not just one person asking and being over looked.
[Fire HD 8 and HD 10 General] StonedEngineer97:
If there was an exploit for the mt8183, would the next step be a downgrade? I know 7.3.1.0 was never released as a binary. Or could this just open up all development?

Is bypassing sla and da enough to flash any image? How would this affect dm-verity?
[Fire HD 8 and HD 10 General] diplomatic:
FYI, chaosmaster is XDA's own @k4y0z. And he just made a thread about that tool: https://xdaforums.com/t/mod-dev-mediatek-mtk-auth-bypass-sla-daa-utility.4232377/

Yeah, I think if there was a custom bootrom hack for the mt8183, it would be enough to downgrade and then get temp root via mtk-su. AFAIK this tablet does expose the boot-rom USB mode. Yes, the 7.3.1.0 package is not available to download, but that's not much of a problem. Plenty of people are using that version and someone could just dump and post the needed images, if they haven't already...
[Fire HD 8 and HD 10 General] k4y0z:
mt8183 is basically the tablet-verision of mt6771, which is already supported by the utility (given you can access brom-mode).

AFAIK it has already been tested on maverick.

It will not allow downgrading lk/pl/tz however, since that would require clearing RPMB (which is not possible with SP-Flash).

Kamakiri could however likely be ported, which includes RPMB-Downgrade code.

You could try to downgrade only boot/system/vendor images and leave lk/pl/tz untouched.
[Fire HD 8 and HD 10 General] StonedEngineer97:
That would open up root for atleast 7.3.1.1 if they can downgrade since lk version was untouched
[Fire HD 8 and HD 10 General] k4y0z:
Downgrading only boot/system/vendor might even work for newer versions, since the mtk-su bug is in the boot.img.

So as long as the newer lk can successfully boot the old boot.img that should work.

If someone with root can get me a dump of the gpt and preloader, I could probably create a scatter-file to use with SP-Flash.

EDIT:

gpt would probably suffice, since preloader should be available in the OTA-bins.

for dumping gpt with root:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin
[Fire HD 8 and HD 10 General] newnewcomputer:
been done....by @diplomatic already:

https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-81221725

dude can foresee future! :LOL:
[Fire HD 8 and HD 10 General] k4y0z:
No GPT as far as I can tell.

But maybe @dr_docdoc can dump it?
[Fire HD 8 and HD 10 General] newnewcomputer:
sorry - my fault for not seeing gpt not there!

hmm...tried dumping it on my 7.3.1.0 w/ su granted in emulator:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

gave "dd: gpt.bin: Read-only file system"

when i tried to mount w/ rw

mount -o rw, remont /block/mmcblk0

it said "mount: '/dev/block/mmcblk0' not in /proc/mounts"

not sure what im missing as read-only should still allow dumping gpt...
[Fire HD 8 and HD 10 General] k4y0z:
Sorry, the problem is the destination file.

It should probably be something like

dd if=/dev/block/mmcblk0 bs=512 count=34 of=/sdcard/gpt.bin
[Fire HD 8 and HD 10 General] newnewcomputer:
Thanks! Here you go 😀
[Fire HD 8 and HD 10 General] k4y0z:
Here is a scatter, if anyone wants to give it a try.

Try doing Readback first, you can enable ShowByScatter=true in option.ini to get all partitions conveniently listed in the Readback tab.

DON'T EVER SELECT "Format All + Download".

Don't flash lk, preloader, tee1, tee2, sspm_1 (Unless you want to update, there is currently no way back)
[Fire HD 8 and HD 10 General] k4y0z:
So the scatter file is confirmed working thanks to @bengris32.

He currently has 7.3.1.1 and tried downgrading only the boot.img.

While that did allow using mtk-su, it broke wifi and battery (and probably other drivers).

So what we need now is a full dump of the (unmodified) 7.3.1.0 firmware.

That is:

system

vendor

spmfw

sspm_1

cam_vpu1

cam_vpu2

cam_vpu3

tee1/2

we already have boot, recovery, lk and preloader though dumping them again wouldn't hurt.

This can either be achieved using root and dd or using the Readback function in SP Flash.

@Kramar111 @dr_docdoc @newnewcomputer I think you all have 7.3.1.0, if one of you could dump it, that would be great :)
[Fire HD 8 and HD 10 General] k4y0z:
Thanks to @Kramar111, we now have a full dump of 7.3.1.0:

1.1 GB file on MEGA

mega.nz

And a little present from me, minimal kamakiri for maverick.

All it does is downgrade RPMB, flashing can be done with SP Flash.

Thanks again to @bengris32 for testing.
[Fire HD 8 and HD 10 General] StonedEngineer97:
Great little unexpected surprise, so this should theoretically work for any 10" 9th gen with access to bootrom?

1. Downgrade bootrom (kamakiri)

2. Downgrade firmware using Sp-flash (mtk-bypass)

And what about the fix-gpt script? I was roughly trying to follow Fire 7 (2019, mustang) unbrick, downgrade, unlock & root to get an idea of the order but saw no mention of it.
[Fire HD 8 and HD 10 General] k4y0z:
Yeah, it should.

Order would be the other way around, flash first, then downgrade RPMB.

RPMB downgrade is only needed if you downgrade pl/tee1/tee2/lk/sspm.

fix-gpt is just in case GPT gets corrupted, shouldn't normally be needed.

for RPMB-downgrade better follow https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459/
[Fire HD 8 and HD 10 General] StonedEngineer97:
Time to start collecting everything and give it a try.

Thanks again @k4y0z and for jumping in and some major developments
[Fire HD 8 and HD 10 General] newnewcomputer:
Merry Christ...Happy New....Happy Valentine Day and Chinese New Year!!! :LOL:

Thank YOU, @k4y0z !!! no idea why im so excited as ive loaded up on HD10 2019 back when Amazon was still shipping 7.3.1.0 :p

for those who have been waiting on this, here is the link to the systemless root by @diplomatic https://xdaforums.com/t/amazing-tem...rmv8-2020-08-24.3922213/page-50#post-82081703

dm-verity still in place means no change allowed in /system

...until...
[Fire HD 8 and HD 10 General] k4y0z:
I have repacked and reuploaded maverick-downgrade-7.0_PS7310_940N.zip

It contains FireOS 7.0/PS7310/940N, scatter file and kamakiri for RPMB downgrade.

Apparently there are multiple versions of 7.3.1.0 and the files originally uploaded here are from version 7.0/PS7310/939N.

Also lk was incomplete.

Thanks again to @Kramar111 for the files :)
[Fire HD 8 and HD 10 General] TouchscreenLover1:
Hey guys; a long time ago i was active in the developement section as well, but i have to admit, that i am not longer that fit there. In addition, all the different names of the models and the possibilities to root or not becaus of software number confuse me a bit. I overread some of the postings in here, seing the last one by k4y0z, so now my question is:

Could someone be so kind and tell me 1) if i can root and 2) flash my Fire Tab10 from 2019with current FireoOS Firmware 7.3.1.8 and if so, 3) can someone explain shortly what i have to do with links to the posts or so? I would really appreciate it. I am using Windows 10, if that does make a difference ( read something about linux and exploits and stuff so that confused me tho lol)

7 years ago I tested some software for my One X and Iconia Tab A210 which I thought was annoying enough with all the typing in adb, so I am known to that. But seems like the fire tab is even more complex haha

Greetings Ardian
[Fire HD 8 and HD 10 General] newnewcomputer:
welcome back, Ardian! u picked a good time as there havent been much going on for Fire HD10 2019 since the initial root n subsequent patch!

1) probably but first the fw needs to be rolled back to 7.3.1.0.

1a) current root is achieved after boot n new android restriction called dm-verity remains. so ur root access is somewhat limited; depending on wat u need.

2) current flash requires SP flash tool n has been confirmed to work for 7.3.1.1 -> 7.3.1.0. u may want to wait a bit for ur 7.3.1.8.

3) @k4y0z package above is all u need to roll back to 7.3.1.0. once dats done, u can follow the systemless root method linked in my post above.

again depending on wat u need, u may skip everything n simply tweak ur tab w/ the fire toolbox for windows:

https://xdaforums.com/t/windows-tool-fire-toolbox-v11-1.3889604
[Fire HD 8 and HD 10 General] k4y0z:
Downgrade to 7.3.1.0 should be possible with any version, given we can also downgrade RPMB.

That said, there hasn't been any feedback yet.

Additionally to the package you'll also need the Bypass Utility
[Fire HD 8 and HD 10 General] TouchscreenLover1:
okay tbh that sounds a bit complicated and I just started to work again, so my time is limited to read through all this. Maybe I'll just stick with the Fire Toolbox; I did that when i got that tablet a year ago, but thelatest software version available at that time was 6.6 lol so i guess there happend much.

Thank you very much to you two, i'll definitely come back to thatpost and try all of that with rooting and stuff.

Greeting
[Fire HD 8 and HD 10 General] StonedEngineer97:
[root@sysresccd /run/media/root/Untitled/New Folder/bypass_utility-1.4.1]# python main.py
[2021-02-18 02:23:32.867601] Waiting for device
Traceback (most recent call last):
File "main.py", line 213, in <module>
main()
File "main.py", line 42, in main
device = Device().find()
File "/run/media/root/Untitled/New Folder/bypass_utility-1.4.1/src/device.py", line 28, in find
new = self.serial_ports()
File "/run/media/root/Untitled/New Folder/bypass_utility-1.4.1/src/device.py", line 69, in serial_ports
result.add(port)
TypeError: unhashable type: 'SysFS'

I gave the downgrade a try today and cant get past the first step. I've tried to run the bypass utility script on windows, kali and fireiso but the farthest ive gotten is the error above.

on windows i couldnt get the device to boot to the bootloader to install the libusb drivers, it would boot to the amazon logo. kali couldnt find the device, im assuming since the kernel isnt patched. finally the above is from fireiso.

has anyone else given this a try yet?

edit: i got the tablet into bootloader and fastboot on windows but i didnt see any mediatek devices when installing the usb filter
[Fire HD 8 and HD 10 General] Kramar111:
@StonedEngineer97

bypass_utility/README.md at master · MTK-bypass/bypass_utility

Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.

github.com

Power off tablet - run filter wizard (or script) - press Vol+ & plug usb cord.

Working on Windows 10.

By the way you need to boot into bootrom, not bootloader
[Fire HD 8 and HD 10 General] StonedEngineer97:
The exact steps I followed. Can't get it to go into bootrom.

It shows up as a general USB device at the bootloader and fastboot menus but otherwise no bootrom.

Going to give it another try tomorrow
[Fire HD 8 and HD 10 General] k4y0z:
Device needs to be in bootrom-mode, in that mode the display will remain off.

What firmware-version are you on?

It's possible amazon disabled the volume-button to enter brom (Like they did on all the other devices)

In that case however it should still appear as preloader on USB.
[Fire HD 8 and HD 10 General] Supersonic66:
Same issue here. I'm on 7.3.1.6
[Fire HD 8 and HD 10 General] StonedEngineer97:
7.3.1.2

I thought it was confirmed for brom mode but I can't get it to work

edit

7.0/PS7312/1271N specifically
[Fire HD 8 and HD 10 General] k4y0z:
It is confirmed for brom mode.

But first you need to enter brom mode.

If amazon indeed disabled the volume-button (which someone else will need to confirm), that will likely require opening the device and shorting the EMMC.
[Fire HD 8 and HD 10 General] lewmur:
My tablet is running 7.3.1.6 and I've used the Toolbox to make it a useable Android tablet. So don't really need root. But in the interest getting the tablet to the point where it will accept custom ROMs, I'm willing to test things. I've succeeded in opening the tablet and I'm happy to note there is no GLUE involved. So I know I can do the "short" fix if need be.

After reading through the thread, I'm totally confused on what exact steps to take. I have both Win 10 and Mint 20.1 boxes. Can someone please post a step by step guide of what to do to test starting from 7.3.1.6?
[Fire HD 8 and HD 10 General] k4y0z:
First step would be to confirm, that you can access brom-mode.

On early versions of FireOS on maverick that could be achieved by powering the device off and pluging it into USB while holding one of the volume-buttons (not sure which button).

It's possible this method has been disabled by Amazon on more recent versions of the OS.

On a linux system, the device will present it self in lsusb like this:

Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone

Alternatively brom-access can be achieved by shorting the EMMC.

That is shorting one of the EMMCs signal-lines (CMD, CLK, DAT0) to ground.

I do not know if anyone has yet identified any of these on maverick.

They are typically close to either the EMMC itself or the CPU.

On some devices they are even labeled.

It's also possible that Amazon disabled the brom-mode completely on later batches of hardware, as they have done on other devices (onyx, mantis, mustang and karnak).
[Fire HD 8 and HD 10 General] lewmur:
I can boot to recovery mode by holding Vol Up and Power. From there, I can reboot to bootloader. When I do that, the only thing on the screen is at the very bottom, in white, it says "Fastboot mode." I know how to use ADB and Fastboot from either Linux or Windows. Is this where I need to be? BTW, I think you have to enable Developer mode in order to get this to work.
[Fire HD 8 and HD 10 General] k4y0z:
Neither Recovery nor Bootloader/Fastboot are what is needed.

Developer options will not help either.
[Fire HD 8 and HD 10 General] lewmur:
OK. With cable plugged into my Linox box, I held down Vol up and plugged the cable into the tablet. This took be to Recovery. With Vol Down, it just boots system. So I guess I need someone to post a pic of what on the MB I need to short to gnd.
[Fire HD 8 and HD 10 General] k4y0z:
Can you take pictures of the board?

Both sides ideally?
[Fire HD 8 and HD 10 General] lewmur:
Not today. I will when I get some time to take it apart. Might be a couple of days.
[Fire HD 8 and HD 10 General] Supersonic66:
I‘ve got mine open now. Is this helpful?
[Fire HD 8 and HD 10 General] k4y0z:
Unfortunately I can't see much there.

Will either be under one of the shields or on the backside.
[Fire HD 8 and HD 10 General] Haldi4803:
I tried that, but windows gets an "unknow device" error and then boots normally. As if button is not pressed at all.

Might be missing USB drivers for this specific mediatek device ?

Running 7.3.1.6

Edit: Guess not:
[Fire HD 8 and HD 10 General] k4y0z:
Just to add to this, the board-layout doesn't look too dissimilar to suez (Fire HD 10 2017), which has a working testpoint on the backside of the board:

https://xdaforums.com/t/2017-fire-h...ti-rollback.3896616/#lg=post-78826233&slide=0
[Fire HD 8 and HD 10 General] StonedEngineer97:
Tried again today and holding vol+ and plugging the power in on 7.0/PS7312/1271N only boots it into recovery. libusb also still shows generic device.

Word of caution to anyone opening their tablet, make sure to get a kit with small torx bits.

Got mine apart now too but I won't have anything smaller than a T6 for a few days to get to the backside.
[Fire HD 8 and HD 10 General] newnewcomputer:
front n back of Fire HD10 2019 motherboard; courtesy of ebay...there are a few possibilities for test point:

edit: found another set of pics on ebay...need to have the shield removed to see markings on PCB. unless someone is feeling lucky...
[Fire HD 8 and HD 10 General] mickeyvnminnie:
I have a weird issue. I installed the Chrome apk. It worked fine. However, when I went to the settings page of Chrome, it froze. Any ideas?
[Fire HD 8 and HD 10 General] Muezick:
Just got mine in today.

This tablet definitely feels like it would be way better with a stripped down clean install of Android 9.0
[Fire HD 8 and HD 10 General] Muezick:
Big oof. SD cards still can't be ExFAT. Restricted to FAT32 on a 2019 device.

Damn Amazon.
[Fire HD 8 and HD 10 General] grantdb:
It froze for me as well when i selected the dark theme but works fine without using dark mode.
[Fire HD 8 and HD 10 General] kaiomatico:
Can anyone please test the dolphin emulator with the "easy" to run game mario kart double dash or maybe soul calibur? It would be great to know if the tablet is able to run something like this before buying! Thanks!
[Fire HD 8 and HD 10 General] DB126:
ExFAT must be licensed from Microsoft. It's not a freebie that can just be incorporated into a public build.
[Fire HD 8 and HD 10 General] mickeyvnminnie:
Where do I change the mode of Chrome? Sorry I'm new to this.
[Fire HD 8 and HD 10 General] Sharp_K:
I'm also stuck at this point. Was faitly hopeful to root it and get rid of the amazon launcher. Oh well. Hopefully some devs get interested in the device.
[Fire HD 8 and HD 10 General] Rortiz2:
Seems that something it's deleting the file. Probably some service from Amazon that they implemented to avoid us from executing binary files with 755 permissions.

There's now way.

Cheers!
[Fire HD 8 and HD 10 General] Sharp_K:
Would that be the case? I used the command "ls" to list all files after trying to execute it, and it was still there, so I'm not sure what's up. Btw, do you mean that there is no way to root now?
[Fire HD 8 and HD 10 General] Rortiz2:
What about

ls -all

to see what permissions has it?

You could try with

chmod 777

too.

If not we can try termux;)

Cheers!
[Fire HD 8 and HD 10 General] Sharp_K:
This is what I get from ls -all

total 52
drwxrwx--x 2 shell shell 4096 2019-11-08 10:49:57.721273378 -0500 .
drwxr-x--x 4 root root 4096 2019-09-20 08:09:10.507604835 -0500 ..
-rwxr-xr-x 1 shell shell 42832 2019-01-01 01:00:00.000000000 -0500 mtk-su

After using chmod 777 (it also failed, it said there was no file)

total 52
drwxrwx--x 2 shell shell 4096 2019-11-08 10:49:57.721273378 -0500 .
drwxr-x--x 4 root root 4096 2019-09-20 08:09:10.507604835 -0500 ..
-rwxrwxrwx 1 shell shell 42832 2019-01-01 01:00:00.000000000 -0500 mtk-su

I've downloaded Termux, what's next?
[Fire HD 8 and HD 10 General] Rortiz2:
Here:

https://xdaforums.com/showpost.php?p=79354350&postcount=2

Cheers!
[Fire HD 8 and HD 10 General] Sharp_K:
No suck luck. Check screenshot. I copied directly the binary file to my device storage, didn't downloaded and unzipped internally. So far, I've used the arm64.

Now I just tried the arm version through adb, and I got a "Failed critical init step 4".

I guess that's better than no file detected, though I'm not so sure.

edit: okay, so I now downloaded and unzipped the file internally, tried the terminal route and no luck either. I tried toused arm version through termina and I got the same step 4 error.
[Fire HD 8 and HD 10 General] Rortiz2:
Yup, sounds like Amazon Patched mtk-su. Not very impressive... We have other ways tho;)

https://xdaforums.com/v20/help/root-cve-2019-2215-t3979341

Pinging some ppl working with that exploit that might help here [MENTION=7860599]Supersonic27543[/MENTION] :)

Cheers!
[Fire HD 8 and HD 10 General] Supersonic27543:
I tried that on HD8 2017 but getting the problematic address pointer error. (usually means that it's not vulnerable D: Maybe it would work on this one though) Or maybe it just requires more customization to work on Amazon kernels. Can someone please try running the binary (attached) on this device and post the output here?

BTW I'm going to buy this tablet on Black Friday if this gets a root method by then. :)

Good luck!
[Fire HD 8 and HD 10 General] Sharp_K:
I tried the binary file on my hd10 2019 and I got "No such file or directory". I tried both 755 and 777 permissions without luck. All of these through adb. edit: tried the terminal route and same thing. Thanks for you attention! :)