yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Lestwist50:
Update manually a Rooted 2017 Fire 10

Well, tonight's will be FUN. I am going to manually use OS from the 2019 Fire 2019 into my 2017 Fire 10 :o Cross my fingers! Then use the Amazon Fire toolbox 6.x ..well it didn't work for me settings /update ,main memory file.
[Fire HD 8 and HD 10 General] Rortiz2:
Bad idea.. CPU is different, and kernel it's device-specific. Do what you want but you'll get a nice brick;)

Cheers!
[Fire HD 8 and HD 10 General] Supersonic27543:
That is very strange, maybe Amazon stopped binary executing from adb overall. Still we should be able to bundle it up in an app. Working on it! :)
[Fire HD 8 and HD 10 General] lewmur:
I opened mine up but when i tried to release the lock on the main ribbon cable, a tiny piece of the plastic broke off. I'm afraid of breaking it completely, so I can't get to the other side.
[Fire HD 8 and HD 10 General] k4y0z:
I'd probably go with these ones first (I'm just guessing based on their location compared to suez)
[Fire HD 8 and HD 10 General] Michajin:
I am am trying to install sp flash tool in fireISO but i am having issues. Any help would be appreciated..

/root/Desktop/SP_Flash_Tool-5.1916_Linux/./flash_tool: error while loading shared libraries: libpng12.so.0: cannot open shared object file: No such file or directory
[Fire HD 8 and HD 10 General] k4y0z:
Please use a newer version of SP Flash Tool, v5.2052 should run fine IIRC.
[Fire HD 8 and HD 10 General] Michajin:
yes that worked on the sp-tool, Just to be clear, goto download tab, load the scatter file and select them all, then hit download? I am not sure what i am doing....
[Fire HD 8 and HD 10 General] k4y0z:
It should already select everything, but yes, just don't select "Format All"
[Fire HD 8 and HD 10 General] Michajin:
Well while i am having some issues flashing... i did manage to get into the bootrom of a 7.3.1.7. First try actually.... I dont have pictures, but i thought i saw some. It readily accessible from the back by the shield that has a antenna by it. I didn't have to pull the board... ALuminum foil on the pins and "mediatek inc MT6227 phone" . The fireISO didnt have the room to unzip the rom so i am having to take a step back and find out while the storage is so small on a 32gb flash... The spflash wont look at anyting but the flash drive...
[Fire HD 8 and HD 10 General] Michajin:
wrong info
[Fire HD 8 and HD 10 General] Michajin:
Nevermind, your script saw the preloader. "trying to crash" etc...

"protection disabled"

Bootrom is loaded....

Once i can figure out the SPflash tool, i should be able to flash 7.3.1.0 over 7.3.1.7
[Fire HD 8 and HD 10 General] StonedEngineer97:
Windows might be able to give you a more stable experience

Could you take a picture of the pin you used? I can give it a try today
[Fire HD 8 and HD 10 General] k4y0z:
That's some great news, maybe you can mark it up in the pictures provided here or here

FireISO doesn't have any persistent storage, maybe you can just mount a second USB-stick for storage.

Alternatively you can run the bypass-utility and sp flash on windows.
[Fire HD 8 and HD 10 General] Michajin:
So in windows...

C:\bypass1>python main.py

[2021-02-21 16:26:41.816126] Waiting for device

[2021-02-21 16:26:50.178982] Found port = COM3

[2021-02-21 16:26:50.214340] Device hw code: 0x788

[2021-02-21 16:26:50.215438] Device hw sub code: 0x8a00

[2021-02-21 16:26:50.215438] Device hw version: 0xca00

[2021-02-21 16:26:50.216441] Device sw version: 0x0

[2021-02-21 16:26:50.216441] Device secure boot: True

[2021-02-21 16:26:50.217439] Device serial link authorization: False

[2021-02-21 16:26:50.217439] Device download agent authorization: True

[2021-02-21 16:26:50.219869] Disabling watchdog timer

[2021-02-21 16:26:50.223285] Disabling protection

[2021-02-21 16:26:50.286191] Protection disabled

But i get this from the flash tool. What am i doing wrong?
[Fire HD 8 and HD 10 General] Michajin:
on a side note, it no longer boots, but if i short those pins i can get into the bootrom (mt6627).
[Fire HD 8 and HD 10 General] k4y0z:
To be honest, I thought that issue was fixed, not sure why it complains about lk.

Try unchecking LK and only flash the other partitions.

After flashing all the others, you can try again flashing just LK.

That will be because of the anti-rollback, but if you flashed the old preloader already you should be able to now use the volume-button to get brom-access.

You'll have to run the kamakiri rpmb downgrade after downgrading the firmware.
[Fire HD 8 and HD 10 General] Michajin:
confirmed the volume works, but i have to have the battery unplugged... I tried unchecking lk, now i get the error on that is looking for a signed image (tee1).

how do i run the kamakiri rpmb downgrade ?
[Fire HD 8 and HD 10 General] k4y0z:
Mhh, that's strange, try unchecking all the images it complains about and flashing them after the others were flashed.

Let me know if there's any others it complains about.

the rpmb-downgrade is included in the ZIP as well.

I'm not sure if it will run on windows (you can try running the main.py), in FireISO just run the bootrom-step.sh similar to what you're familiar with on the FireTV devices.
[Fire HD 8 and HD 10 General] Michajin:
i have been over here (see pic) but it seems that the script could have crashed the preloader and forced it into bootrom. Seems like the battery disconnected might also help, using volume up and plugging in now boots the bootrom. But currently i am bricked... LOL at your own risk! lol
[Fire HD 8 and HD 10 General] k4y0z:
The PL-crashing doesn't typically work on amazon-devices unfortunately.
[Fire HD 8 and HD 10 General] Michajin:
so maybe the shorting helped, i know it reboots and see bootrom with the short? Seems like the battery disconnected is making a difference too...

So it did not fault after turning off lk tee1 and tee2. But i dont see anyting happening. How long does this take and is there a way to know it is flashing?
[Fire HD 8 and HD 10 General] k4y0z:
Disconnecting the battery does typically help when interacting with brom.

Just to be certain, you are using the files from here?

You should see a progress-bar at the bottom of SP Flash if I'm not mistaken.
[Fire HD 8 and HD 10 General] Michajin:
yes. it took like 30 minutes to unzip it... maybe something is corrupted? There are some files that flash complete successfully when flashing; system, boot, recovery etc... going to download and unzip again...
[Fire HD 8 and HD 10 General] k4y0z:
For anyone else who's going to try this,

I just wanted to add that the issue currently is likely that the lk and tee images aren't trimmed properly, which is why it complains about the signature/verified images.

For LK you can try the attached one, for tee we'll have to see.

Anyway, as long as you have access to brom-mode you can always go back to another firmware ;)

EDIT:

This one should have the correct size, I confirmed it by checking the header.

Same goes for the tee.img that is included, it should have the correct size.
[Fire HD 8 and HD 10 General] StonedEngineer97:
So I gave those points a try, both pin at a time and a piece of foil but I ended up either booting right through or getting an unrecognized usb message but no mediatek device in libusb filter list.

Using Windows 10, latest updates
[Fire HD 8 and HD 10 General] k4y0z:
What about the "unrecognized USB message" ?

You could try using a linux-system (such as FireISO) and running something like

watch -n 0.1 "lsusb |grep -i 0e8d"

then watch if you see the device appear.

Not sure how you could do something similar on windows, you want to watch out for a device with VID = 0e8d and PID = 0003
[Fire HD 8 and HD 10 General] Michajin:
I had like 2 seconds to add it when it showed up in the list. Unplugging the battery seemed to help. When I was shorting the foil it would reboot too. Seems like it said serial device in the filter list. Only saw it for a second... Maybe I got lucky? I was in fireISO when I did this
[Fire HD 8 and HD 10 General] StonedEngineer97:
Going to give it another try on fireiso but it does sound like I might just be missing it
[Fire HD 8 and HD 10 General] StonedEngineer97:
Yeah I might just be missing right past it, will give it a few more tries
[Fire HD 8 and HD 10 General] msolomos:
hello,

Joined the forum nearly 10 years ago.

Am really into home automation.

Using a Fire tablet 2019 with Fire Os 7.3.1.8. No access to Internet.

Using it as a wall tablet for my smart home dashboard.

My biggest problem, which has make me loose my sleep, is that it keeps going to sleep.

It drives me mad! The tablet is constantly connected to power.

I have activate the stay awake option under developer options but it doesn't seem to work.

Has any folk find a way to disable sleep mode?
[Fire HD 8 and HD 10 General] StonedEngineer97:
So I got my hands on another tablet on 7.3.1.5 but both tablets error out in the Python script with error:

TypeError: unhashable type: 'SysFS'

when trying to add a port on line 69 of device.py

The watch command shows both devices come up as mt65xx preloader before the script throws the error
[Fire HD 8 and HD 10 General] k4y0z:
If you get the preloader device (VID = 0e8d and PID = 2000) the EMMC isn't shorted properly (preloader is still loaded from EMMC).

It absolutely needs to be the MediaTek Inc. MT6227 phone device (PID = 0003)
[Fire HD 8 and HD 10 General] StonedEngineer97:
I'll double check the PID soon.

I saw that there was a new release of fireiso you mentioned for the same issue on github so I thought I'd also boot that
[Fire HD 8 and HD 10 General] StonedEngineer97:
Tried again, you were right the pid shows up as 2000

I'll try a few test points more systematically then a piece of foil without taking it fully apart but if anything there's a whole other side to try too 😂
[Fire HD 8 and HD 10 General] StonedEngineer97:
So Ive got the board out now and tried all the big test pads and then the smaller ones on the back but was only able to boot with PID:2000. Either I missed it or it could be possible it needs multiple pads pulled low?

I get status 7024 in the print out trying to use the mtk-bypass, I assume this status is connected to the incorrect boot up mode.

[2021-02-26 02:23:02.438956] Waiting for device
[2021-02-26 02:23:04.845053] Found port = /dev/ttyACM0

[2021-02-26 02:23:04.965864] Device hw code: 0x788
[2021-02-26 02:23:04.965982] Device hw sub code: 0x8a00
[2021-02-26 02:23:04.966090] Device hw version: 0xca00
[2021-02-26 02:23:04.966210] Device sw version: 0x0
[2021-02-26 02:23:04.966324] Device secure boot: False
[2021-02-26 02:23:04.966432] Device serial link authorization: False
[2021-02-26 02:23:04.966534] Device download agent authorization: False

[2021-02-26 02:23:04.966674] Found device in preloader mode, trying to crash...

[2021-02-26 02:23:04.970847] status is 7024

[2021-02-26 02:23:04.998765] Waiting for device

Also I noticed unlike @Michajin my device info shows secure boot and daa as false if that means anything
[Fire HD 8 and HD 10 General] INetBowser:
I'm also not able to get into brom and have been trying to short various pins (on the upper side of the board only). My idea was to also hold vol+/vol- while shorting pin, maybe this can help.

Or: I also found an old document from MTK that describes the BootROM/boot process (but rather poorly). It mentions a BOOT pin (GPIO0) that needs to be shorted while booting to get into BootROM.
[Fire HD 8 and HD 10 General] k4y0z:
Usually one should be enough.

Did you unplug the battery as @Michajin suggested?

And what about the pins on the front?

Status 7024 is DAA_SIG_VERIFY_FAILED, that's because you're in preloader.

It always says false there (in preloader) for SBC/SLA/DAA on amazon-devices.
[Fire HD 8 and HD 10 General] StonedEngineer97:
Yep, all ribbon cables and power unplugged, only power to the board is from the usb.

Some points would stop the board from booting outright so I put the tablet back together to make sure it still booted normally.

I really hope brom isn't disabled at a hardware level.

I'll try one more time to cycle through the points and whatever else looks interesting soon
[Fire HD 8 and HD 10 General] INetBowser:
Hm, I have the problem that, whenever I disconnect the mainboard from the battery and boot it via USB power, it seems to get into a bootloop even when I'm not shorting any pins (it does some weird coil whine near SoC area in cyclic manner). Does it happen to you too?
[Fire HD 8 and HD 10 General] StonedEngineer97:
Yeah I get that same boot loop but I try to use that to my advantage by shorting the pads and seeing if it boots with the correct PID while it's looping (I ran that watch command that was recommended earlier)

... Unless the boot loop is what's stopping it from booting into brom?

E:
[Fire HD 8 and HD 10 General] INetBowser:
Yeah, thats what im thinking too right now. Maybe someone knows better, but could it be that when disconnecting the battery, some circuit on the mainboard (maybe the IC used for charging the battery) prevents execution unless it can detect a battery? I know that for example my old S3 Neo doesnt boot unless there is a battery in it.

Btw, my fire hd 10 currently is on 7.3.1.2, so this doesnt seem like some software issue.
[Fire HD 8 and HD 10 General] StonedEngineer97:
Sorry I'm on mobile and can't annotate the pictures right now but I did notice the Suez board has 2 contacts that it makes when the board is fully assembled near the volume buttons

But the maverick board only has one on the vol - side even though it has the pads for the other button

Anyone know what those do?
[Fire HD 8 and HD 10 General] k4y0z:
Not sure, but it's probably best to unplug before testing a new point.

Yeah, it's likely the tablet will not fully boot without a battery attached.

For accessing bootrom that shouldn't matter though.

Probably antenna-connectors.
[Fire HD 8 and HD 10 General] newnewcomputer:
can i ask a dumzb question - when ur guys open up the tab n pull the MB out, is there a "CLK" marked like this from @xyz`

when i searched for MTK bootrom online, someone posted an exploit using the same CLK test point. it was not specified which tab but MTK8163 was in the Fire HD 8 2018. so they hired a summer intern; probably told him to read up @xyz` and @k4y0z exploit. Their hack only worked like 1 out of 5 times but wrote up a nice "disclosure" and sent it off to MediaTek.

There’s A Hole In Your SoC: Glitching The MediaTek BootROM

This research was conducted by our intern Ilya Zhuravlev, who has returned to school but will be rejoining our team after graduation, and was advised by Jeremy Boone of NCC Group’s Hardware &…

research.nccgroup.com

i love the part MediaTek ignored them at first ("dude its old news - ppl been using it to hack our biggest customer, Amazon's tab!") most of the timing discussion went over my head but it was an interesting read nonetheless.

based on the report date and MediaTek's response, it doesnt sound like any patch would be on the HF10 2019's MT8183 chip. so i think the chance is good that the right test point can get us in Bootrom here.
[Fire HD 8 and HD 10 General] StonedEngineer97:
I didn't see anything labeled but there were 4 test points on the bottom right (on the side with the battery connector) that seemed like they were for debug
[Fire HD 8 and HD 10 General] k4y0z:
That picture is from karnak (Amazon Fire HD 8 - 2018). Unfortunately one of the few Amazon devices, that have labeled testpoints.

The blogpost you linked to is a different (and rather sophisticated) attack on the bootrom.
[Fire HD 8 and HD 10 General] retyre:
Of the few posters who have tried this exploit, only one has been able to reach BootROM. Given there are only a few points on the board to test, we can rule out user error. When did each poster purchase the device? Perhaps we can identify the range of serial numbers that (won't) work.
[Fire HD 8 and HD 10 General] StonedEngineer97:
The 7.3.1.2 I have, I bought brand new through Amazon last month so it's possible there was a hardware revision but don't know why the os wouldn't have been updated as well

The 7.3.1.5 I got off eBay (the one used for testing) I'm not really sure but it had a sticker on the inside with a date of November 2018 which I assume is a date manufacture for that part
[Fire HD 8 and HD 10 General] Michajin:
I have successfully downgraded from 7.3.1.7 to 7.3.1.0. with @k4y0z guiding me through. I am currently updating my other tablet (from 7.3.1.1 to current) to identify how i was able to get into the bootrom. I will follow up in the next day or two..
[Fire HD 8 and HD 10 General] Michajin:
Ok.. Just updated from 7.3.1.1 to 7.3.1.8 = May the Android Gawds be looking out... :)
[Fire HD 8 and HD 10 General] retyre:
Not sure this was needed. You just need to open up your device and confirm you can short the EMMC to get into BootROM mode and, if so, locate the point on the PCB. Odds are you should be able to since your initial FireOS version suggests an SoC with older BootROM code that would allow BootROM access via USB.
[Fire HD 8 and HD 10 General] Michajin:
@StonedEngineer97

Turns out no shorting is needed... the battery being disconnected with power up will get you into bootrom, but you cant write without the battery... You plug in the battery, it goes to preloader. We wiped the preloader then we can flash.... Work in progress...
[Fire HD 8 and HD 10 General] Michajin:
OK, open the device

disconnect battery connector (remove the tape piece)

plug device in

shorting isnt required. Seems you have to dc battery to access bootrom, but you cant write to emmc without the battery connected, when you connect to battery, it goes into preloader. We wiped the preloader then you can stay in bootrom and flash... Working on the step by step....
[Fire HD 8 and HD 10 General] StonedEngineer97:
Interesting, i had the battery disconnected but was only getting pid:2000 and stuck at "trying to crash preloader" before getting status 7024

If the battery is the only thing that needs to be disconnected it may be possible there were hardware revisions since release.

Hopefully your success gets more people to give it a try
[Fire HD 8 and HD 10 General] Michajin:
all of mine where purchased the first couple months of the release. I ran the main.py in windows and volume up with battery disconnected then plugged in, and right into bootrom it went ... then wiped the preloader, to make it easier. then flashed in sp tools, then ran the kamakari script on fireISO.
[Fire HD 8 and HD 10 General] INetBowser:
Like @StonedEngineer97 , im also not able to get into bootrom when disconnecting the battery, even when holding volume+/volume- button (tried both).

Im running Fire HD 10 (9th gen) with 7.3.1.2 (Serial number: G001 1J06 0356 04PE).

Edit: bought mine in october 2020.
[Fire HD 8 and HD 10 General] k4y0z:
If I understood correctly, the trick was to have the battery disconnected and hold volume up while plugging in.

Then again, there should also be a way to short EMMC, and if that hasn't worked for you it's possible BROM-DL-Mode is disabled on yours.

EDIT:

@StonedEngineer97 you also mentioned that during your testing on some of the testpoints the device didn't boot up at all.

Do you remember which these where? If BROM-DL-Mode is indeed disabled, that's exactly what would happen if EMMC is shorted.
[Fire HD 8 and HD 10 General] Michajin:
I know when I was shorting it with aluminum foil it would reboot into bootloader also, but I was not shorting to the shield it was pin to pin with aluminum foil. The picture where i was shorting is earlier in the thread. I was leaving usb plugged in, battery disconnected and shorting the pins and i would see the bootloader also. I thought this might have what caused my initial brick. When i was bricked, and the battery was plugged in, i would get preloader for like 2 seconds then nothing and no device.
[Fire HD 8 and HD 10 General] StonedEngineer97:
yeah, mine goes into the same boot loop with the battery disconnected. I had a look at both of mine and they have lot codes J0xx so testing with older models could narrow down when the revision was made

I dont remember the exact points but they were in the area you had circled initially after referencing suez. could anything be done to reverse this change if we could narrow down what was changed?

sounds like we're experiencing different behavior with the same setup, will be interesting to see some tests with early 2020 models
[Fire HD 8 and HD 10 General] StonedEngineer97:
So i tried it again with the battery disconnected, and the point identified by @Michajin (short across the resistor, not the pads below) and that stops the preloader bootloop but doesnt boot again until i let go of the vol + button so it sounds like bootrom dl is disabled in later revisions
[Fire HD 8 and HD 10 General] k4y0z:
What happens, if you press only the vol + button without shorting anything (with battery disconnected)?
[Fire HD 8 and HD 10 General] StonedEngineer97:
Pid 2000 and the script keeps trying to crash preloader
[Fire HD 8 and HD 10 General] INetBowser:
Cant get into bootrom. Tried already (with disconnected battery):

- shorting pins to shield

- shorting pin-to-pin

- holding vol+/vol- while plugging usb in

Seems like bootrom is disabled in my unit.
[Fire HD 8 and HD 10 General] blaze2051:
so 7.3.1.7 can be rolled to 7.3.1.0 with out bricking? could you list a step by step guide
[Fire HD 8 and HD 10 General] Michajin:
Well it seems the exploit to downgrade is limited to early releases of the HD10 Maverick. I bought all 3 of mine the first few months of its release. When i received mine, two were on 7.3.1.0 and the other was on 7.3.1.1. I did the temp root on one and let the other 2 update. During these tests we found that i could downgrade. Keep in mind, downgrading only give access to mtk-su (Temp root) and not unlocking. If you are interested in testing to see if you can downgrade, run a amonet script where you see "waiting for bootrom" Open the device and disconnect battery, pressing volume up (button closest to power button) and plug in the device into the usb (you should see remove short to continue). Do not continue, but in another terminal run a lsusb and verify you see a mediatek 6227 phone. This is the bootrom. If you have access to it, you are in the can downgrade group and i would be more than happy to assist. IT being a temp root and what appears to be a limited amount of people, i worry that instructions could cause bricks.
[Fire HD 8 and HD 10 General] bibikalka:
Can you give us an idea what YOUR serial numbers are? We have 1 report about NO BootRom:

Im running Fire HD 10 (9th gen) with 7.3.1.2 (Serial number: G001 1J06 0356 04PE).

Edit: bought mine in october 2020.

I have a device here that I also bought in Oct 2020, same 7.3.1.2 (a sale at Target store). I was actually digging through the units to get the lowest serial, LOL. Serial number is G001 1J06 0344 XXXX (last 4 are obfuscated). Am I out of luck?
[Fire HD 8 and HD 10 General] bibikalka:
Just catching up on things I've missed. Can I seamlessly downgrade 7.3.1.2 to 7.3.1.0 using the new MTK Bypass and doing mtk-su ? I should be OK keeping the higher version LK/TEE/etc, those were usually forgiving within a certain range of versions.

Are there any show stoppers? I don't see that 7.3.1.2 image downgrade to 7.3.1.0 was ever tested, but are there any reasons it would not work?
[Fire HD 8 and HD 10 General] Michajin:
I will look for the numbers tonight. Everything is still tied to access to the bootrom. I was able to downgrade a 7.3.1.2 and a 7.3.1.7. Then i updated one to the 7.3.1.8 and downgraded is ack to 7.3.1.0. It was the full image. SP tools would only let me flash system, boot, recovery, and Vendor. The rest was done through k4y0z's script. I found that i could access the bootrom with the battery disconnected, volume + and plugging in USB (as soon as you plug in the battery, it goes into preloader). I have yet to find anyone else who can do this, I also have a shorting point, but it only has worked for me so far (i tested the shorting over 5 times). See if you can find access to the bootrom you should have access to downgrade.