yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] 789mod:
When you see "!" Mark

Press power + vol + will recovery show
[Fire HD 8 and HD 10 General] moomph:
No luck. When i boot into the ⚠️ screen, pressing power + vol up (or down) does nothing. I also tried holding the buttons.
[Fire HD 8 and HD 10 General] 789mod:
1. Still press power button and lift botton will recovery show
[Fire HD 8 and HD 10 General] moomph:
Finally got it, thank you!

For anyone else, the trick was holding power and pressing and releasing the VOL up button (or maybe holding VOL and pressing power, I don't remember exactly). This will take you to a recovery mode menu.
[Fire HD 8 and HD 10 General] PRInCEI7:
Hi all

This week I was trying to do a downgrade FireOS 7.3.2.2 to 7.3.1.0

By Dumping the files of an old device and rewriting them on a device with a version of FireOS 7.3.2.2

The device is working but I get a warning ⚠️

I managed to get into the recovery, but I can't get into the device because I think I have to fix the gpt so that you can get into the device

— I have a strange question 😅 Can I reactivate the 'Test Point' vulnerability?

Where is this protection located in which Partition?

I can modify all parts of the device to read and write to any version Fire OS

____

I have another question, can I Disable DM-Verity protection?

And modifying system files only needed to modify one file ‘App in System’ !! How can i do this?
[Fire HD 8 and HD 10 General] 789mod:
Try fromat preloader using SP flash tool
[Fire HD 8 and HD 10 General] PRInCEI7:
Hi all

This week I was trying to do a downgrade FireOS 7.3.2.2 to 7.3.1.0

By Dumping the files of an old device and rewriting them on a device with a version of FireOS 7.3.2.2

The device is working but I get a warning ⚠️

I managed to get into the recovery, but I can't get into the device because I think I have to fix the gpt so that you can get into the device

— I have a strange question 😅 Can I reactivate the 'Test Point' vulnerability?

Where is this protection located in which Partition?

I can modify all parts of the device to read and write to any version Fire OS

____

I have another question, can I Disable DM-Verity protection?

And modifying system files only needed to modify one file ‘App in System’ !! How can i do this?

Does not recognize the mode preloader

Only when I pressing power + vol up

Recognizes adb or fastboot mode but just i can do reboot 😢
[Fire HD 8 and HD 10 General] JJ2017:
You've probably tried already, but might a 'factory reset' from the recovery menu help you boot?

Also, I like the photo of the test points above (reminds me of this thread https://xdaforums.com/t/root-hardmod-root-your-amazon-fire-hd-8-7th-gen.3851617/#post-77823799)

How do you interface with the eMMC memory so you can read/write partitions? USB-serial adapter, maybe?

I've got one of those annoying bootrom disabled HD 10's (2020 production date) - some kind of hardware-mod might be an option - looks like you might have already cracked it?
[Fire HD 8 and HD 10 General] PRInCEI7:
Great idea, but I think it will not work because if I change any file in System , the device will not work because of DM-Verity protection
[Fire HD 8 and HD 10 General] Michajin:
What is the test point vulnerability? 7.3.1.0 and 7.3.1.1 you could boot into the bootrom direct if you had a 2019 version, after 7.3.1.2 you could boot into the bootrom, but you had to disconnect the battery to get into the boot rom, then plug in the battery to give write access. Then wipe the preloader, this will brick it unitl you flash the with the spflash tool.
[Fire HD 8 and HD 10 General] kbl:
Hi All, I've got 2x 2019 (Maverick) tablets that both have gone into brick mode with no modifications attempts on my own. I'd really like just to bring them back to a working condition. They were purchased shortly after the device was released.

The screen is completely black; but I do hear USB sounds cycling (Win10). With USBTreeView I can see COM3 become available for a short period of time. Can I use any of the methods here (or any other suggestions) to bring them back to a working factory config?

In terms of what got them into this state; I'd like to know ... i suspect an Amazon update of sorts... but regardless at this point they are paper weights.
[Fire HD 8 and HD 10 General] Michajin:
If start with trying to see if they are in bootrom mode. Running the fire ISO or linux and doing a lsusb to see what your PC sees. There are options from there. If you bought them before Jan 2020 you can re-install everything.
[Fire HD 8 and HD 10 General] kbl:
Here's what I see:

Bus 001 Device 006: ID 0e8d:0003 MediaTek Inc. MT6227 phone

I got them in Nov 2019 so this sounds promising.
[Fire HD 8 and HD 10 General] StonedEngineer97:
I don't have access to information that I could provide at the moment but that looks correct as well and promising. If you go back <10 pages you should see instructions on how to boot into fire iso and run mtk bypass to downgrade (in your case recover) the units when bootrom is available
[Fire HD 8 and HD 10 General] kbl:
This post have what I need along with FireISO?

https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-84499719

UPDATE#1:

So I got the bypass utility, payloads, SP flash utility as well.

From FireISO, the bypass utility seemed to work fine:

root@fireiso ~/Desktop/bypass_utility-v.1.4.2]# sudo python main.py

[2022-05-27 00:11:43.410928] Waiting for device

[2022-05-27 00:12:19.538243] Found port = /dev/ttyACM0

[2022-05-27 00:12:19.573769] Device hw code: 0x788

[2022-05-27 00:12:19.573883] Device hw sub code: 0x8a00

[2022-05-27 00:12:19.573969] Device hw version: 0xca00

[2022-05-27 00:12:19.574061] Device sw version: 0x0

[2022-05-27 00:12:19.574126] Device secure boot: True

[2022-05-27 00:12:19.574226] Device serial link authorization: False

[2022-05-27 00:12:19.574308] Device download agent authorization: True

[2022-05-27 00:12:19.574425] Disabling watchdog timer

[2022-05-27 00:12:19.575030] Disabling protection

[2022-05-27 00:12:19.632974] Protection disabled

But then running SP Flash started and then bombed about 6 seconds in. I didn't save the output ... but now the device isn't showing up in lsusb. I'm guessing it'll continue to be a paper weight :(

My other tablet is also not showing in lsusb (but I'm not sure it was in exactly the same state as the one i started with anyhow).

UPDATE #2:

Holding Power and Volume buttons seems to have brought it back in lsusb. So I'm at the point where bypass utility appears to do what it needs to do again. But now when I try to run sp flash or kamakiri/bootrom_step.sh it's not finding the device...

Any suggestions most welcome.
[Fire HD 8 and HD 10 General] Dark_AssassinUA:
Cant understand,is possible to downgrade Fire HD 10 2019 from 7.3.2.2 or not?
[Fire HD 8 and HD 10 General] Michajin:
The easy answer is maybe. The it was purchased before January 2020 then likely. You have to have bootrom access....
[Fire HD 8 and HD 10 General] PRInCEI7:
The problem is that when I try to modify any file within the system, the device does not boot. Hex also tried to disable the dm-verty protection, but the device also did not boot. Is there a way to modify the system files? Sometimes when I move a file to the system/priv-app path, the application does not appear and I do not know why
[Fire HD 8 and HD 10 General] JJ2017:
From my limited understanding, I don't think you can 'adjust' System files without tripping dm-verity - I've not heard of a work-around, unfortunately.

What I'd like to know (and I think you might've already tried this) - could we flash the 7.3.1.0 ROM using an eMMC hack to a newer model (one that's bootrom disabled). And if so, could we temp root that device? And even better, maybe get the device into bootrom mode so we can use SPflash Tool / mtkclient? That would be awesome but I don't think it'll work - disabling bootrom was probably a hardware fix (from what I've read on this thread)
[Fire HD 8 and HD 10 General] Rortiz2:
Unfortunately, that's not how it works. That could work, however you might run into problems with RPMB (the initialization phase) because (if I'm not mistaken), the keys are shared between the CPU and the eMMC.

On the other hand, bootrom would still be disabled as the fuse is in the SoC and therefore you would need to replace the CPU as well. If you're interested, something similar to your idea was already done a few months ago with the Amazon Fire TV Stick 4K.​
[Fire HD 8 and HD 10 General] PRInCEI7:
Rortiz2

I tried this method with the Amazon Fire HD 7 9Gen and it worked, I was able to get into TWRP Recovery, with bootrom disabled, and I installed ROM , everything was okay ​

, but with Amazon Fire HD 10-9Gen

It's more complicated, but nothing is impossible I just need to disable DM-verty, any idea I would be happy to try I have a lot of devices + tools ,
[Fire HD 8 and HD 10 General] Rortiz2:
I guess you already tried to use this.
[Fire HD 8 and HD 10 General] PRInCEI7:
Doesn't support Android 11 ,

As for Downgrade, I think it will work, but through the hardware, I will try downgrading from a new version, to old version such as 7.3.2.1 supports root
[Fire HD 8 and HD 10 General] Rortiz2:
maverick uses Android 9.
[Fire HD 8 and HD 10 General] PRInCEI7:
Sorry, yes Android 9, I tried more than one method and could not disable the protection of Dm-verty ,

[Deprecated] Universal DM-Verity, ForceEncrypt, Disk Quota Disabler

The device entering Bootloop
[Fire HD 8 and HD 10 General] rdpeake:
I posted in help, but posting here as it seems this may lead to people with the knowledge.

I have a fire hd 10 2019, and an auto update has corrupted the os and i currently get nothing on screen no matter what combination of buttons i press/hold. I do however get a serial com port when connected to the pc.

I'm assuming this means I'm stuck in the bootloader (or some low level pre-boot step) is there anything I can do to either recover to the installed os, or alternatively get this running without being 'genuine'. Amazon help has just told me to buy a new one, so not much risk in trying to get the hardware working again.
[Fire HD 8 and HD 10 General] blaacksheep:
You could try holding the power button for longer than 10 seconds to ensure it's actually off. Then press and hold volume UP + Power. Release Power button when the Amazon logo appears. Release Volume Up after the recovery menu appears. Use volume Up and Down to highlight 'wipe data/factory reset'. Press power. Highlight 'yes' and press power again. That should get you a factory recovery. If not, repeat the proceedure, but this time wipe the cache first.
[Fire HD 8 and HD 10 General] rdpeake:
As i said before, no combination of holding down power or volume gives me any response on the screen. i have not been able to reach a recovery mode, and the only thing i can see from the hardware to let me know it isn't completely kaput is the usb serial port. Holding down power for 40 seconds or more (as suggested by the documentation for hard power off) and then holding any combination of buttons (power alone, power and volume down, power and volume up) does not show anything on screen.
[Fire HD 8 and HD 10 General] blaacksheep:
Well, it was a thought....
[Fire HD 8 and HD 10 General] rdpeake:
sorry, yes didn't mean to come across so abrupt - kinda bummed at the situation and didn't think to read what my tone would sound like. thanks for the suggestion though.
[Fire HD 8 and HD 10 General] blaacksheep:
No worries. I was looking through the new posts and saw yours. Since you were a new member, I thought I'd offer my (somewhat useless) thoughts. By the way, welcome to XDA!

You may be able to get it into recovery with fastboot. If you've got the drivers installed, you might be able to issue a "fastboot reboot recovery" command to get you to the recovery. (another thought) :unsure:
[Fire HD 8 and HD 10 General] rdpeake:
Thanks for the welcome.

I might be doing something wrong - When plugged in the kindle shows up in windows device manager as a normal USB serial device (working, no errors). but running fastboot shows no devices. Is there a specific driver i need to install here?

the usb ids are vid: 0e8d, PID 0003.
[Fire HD 8 and HD 10 General] blaacksheep:
Have a look on this page for the XDA post on this.

Edit: It seems that driver is very old and they refer you to here instead for a more recent version. I did a search in the forum and found this, which appears to be what you want.
[Fire HD 8 and HD 10 General] rdpeake:
So far as i can tell (not at the pc) it installs a predetermined set of drivers and looks at usb devices without drivers to get the rest. There isn't a driverless device in my device manager, but I'll try that out once I'm back at the pc.
[Fire HD 8 and HD 10 General] blaacksheep:
It may not even do it for you. It's just all I can think of to try and help. Good luck.(y)
[Fire HD 8 and HD 10 General] rdpeake:
yeah, doesn't look like it found any new drivers, and the fastboot tool i was using before was the latest platform tools - so i am guessing it is not in fastboot mode
[Fire HD 8 and HD 10 General] Michajin:
you are in bootrom mode

MediaTek Inc. MT6227 phone USB\VID_0e8d&PID_0003​
[Fire HD 8 and HD 10 General] rdpeake:
Is there a way to recover this device from bootrom mode?
[Fire HD 8 and HD 10 General] Michajin:
should be as long as you dont have a hardware issue. Bootrom is where you can downgrade to the rootable version. You have to use SP tools and i believe the directions are in this thread somewhere.
[Fire HD 8 and HD 10 General] rdpeake:
appologies for the reply to an ancient post - but is there anyway i can use these files (or files from a later dump) to restore my stock kindle fire which has entered a bootrom mode after a failed auto update?

I have sp flash, but not sure on how to use it and scatter files to restore my os or recovery - any steps or instructions would be appreciated (if this would actually work)
[Fire HD 8 and HD 10 General] anonywimp:
Hey guys, I have so far been successful at booting into TWRP on my maverick device one time. After flashing lineageos from the other thread, I was never successful at booting it. I think I only had the one success at getting the temporary bl unlock to work and failed every other time.

There seemed to be like 50 different failure modalities and I was bouncing around between and I never really managed to science out which actions produced which outcomes. After many hours of mashing buttons I stumbled into success without really understanding how.

After that I tried to go back to stock and start over and got the news that my emmc was end-of-life (made sense, I had huge stuttering problems in stock, which kept getting worse and worse over time). At that point I gave up.

It's weird, I never did anything super interesting with the tablet, so I don't see why the emmc should have worn down... come to think of it,I'm not the only one here who experienced something like this. Perhaps, somehow, doing xda-ish things to these tablets causes Amazon to spew endless warnings into auto-rotated logs somewhere, or the emmc's used are counterfeit recycled chips or something?

Regardless, I feel before I give up completely I should try to run badblocks. Or, is there a better way to try to get the emmc to automagically fix itself? Or could I maybe repartition around a non-relocatable bad-block, somehow if that's what turns out to be the problem?

Assuming it's the right tool, does TWRP come with badblocks? If I need to build one for TWRP, would a crossbuild TARGET of "arm-linux-androideabi-gcc" be correct? Or

arm-linux-gnueabi"? Or are the clang prebuilts from the repo blob stork the only way to give birth to working executables for TWRP?

I guess I am not super optimistic about this device, tbh. Probably toast -- maybe that's why the standard temp bl unlock procedure didn't work reliably for me -- although pebcak seems also plausible there. Regardless it feels wrong to just throw the thing in the landfill without trying obvious steps to fix it.

Finally, assuming the emmc is toast, I'm done right? Or is there some work-around like booting from USB OTG or simply repartitioning?

Actually this reminds me of an unrelated question I keep meaning to ask: how come nobody uses kexec to bounce from recovery to system, or from system_a to system_b in these situations? Seems like the obvious way to avoid the bootloader's soup-nazi routine, so I'm guessing these's some reason it can't work?
[Fire HD 8 and HD 10 General] andPS2:
maybe i can get so me help here as in the other thread noone seems to answer

https://xdaforums.com/t/amazing-temp-root-for-mediatek-armv8-2020-08-24.3922213/page-82

i am using the temp root , magisk 21.4 with

safetynet-fix-v2.3.1 and MagiskHidePropsConf-6.1.2 on a firehd 10(10th gen)

but i can't get safetynet to pass (only basic)

did anyone get that to work?

plus higher magisk versions wont work for me ...
[Fire HD 8 and HD 10 General] Khiem Tran:
How to reflash stock rom, preloaded, lk from LineageOS?
[Fire HD 8 and HD 10 General] 789mod:
I thinking download stock fire and rename it from ...bin to .zip and flash from TWRP
[Fire HD 8 and HD 10 General] brzozex:
HI, i have the same issue. Did you manage to unbrick it??
[Fire HD 8 and HD 10 General] Khiem Tran:
I succces downgrade from 7.3.2.2 to 7.3.1.0 with battery connect.

1. Power off device

2. Run python main.py in bypass_utility

4. Hold volume up and connect cable pc to device

5. bypass_utility run succes with message "Protection disabled"

6. Run SPFlash Tool and flash boot, recovery, vendor, system. Wait to finish

7. Hold power button 15s to power off (check Ports in Device Manager windows)

8. Hold volume up and power boot to recovery with triactangle icon

9. Hold power and tap volume up then choose reset factory

10. Reboot
[Fire HD 8 and HD 10 General] 789mod:
This work just in 7.1.0
[Fire HD 8 and HD 10 General] bibikalka:
Does this still need an early HD10 2019 device? Or will any HD10 2019 version work now? Sorry, was out of the loop for a bit ...

@k4y0z, @Kramar111
[Fire HD 8 and HD 10 General] Khiem Tran:
My device
[Fire HD 8 and HD 10 General] 789mod:
Will try it today 🙂
[Fire HD 8 and HD 10 General] Rortiz2:
This only works with early revisions of this device (i.e: the ones with bootrom access).
[Fire HD 8 and HD 10 General] 789mod:
You mean any device after 2020 can't access to bootrom ?
[Fire HD 8 and HD 10 General] tbrar:
Hi Everyone,

I have Fire HD 10(2019) on 7.3.1.0. Can someone please summarize what my options are for installing a custom ROM. I tried going through this thread to figure out how I can install a custom ROM but most of the discussion is around downgrading the ROM to 7.3.1.0 which I guess I don't need.

Thanks a lot
[Fire HD 8 and HD 10 General] Michajin:
Here is the only option. Unfortunately every time you reboot you have to connect to a computer...

https://xdaforums.com/t/rom-unoffic...fire-hd-10-9th-generation-28-02-2022.4410305/
[Fire HD 8 and HD 10 General] rdpeake:
Can these downgrade/recovery options work on a device that doesn't get past boot rom mode?

What steps can i take to reflash any working OS onto a device bricked to boot rom?
[Fire HD 8 and HD 10 General] JJ2017:
What you're asking to do is quite tricky. And there's no guarantee that you could revive the tablet!

An outline of the firmware rollback steps is summarised nicely by @askforehlpo way back in this thread

https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-86532337

For the 1st steps 1-4 I would recommend using the (awesome) FireIso by @k4y0z, you can get it from:

https://github.com/amonet-kamakiri/fireiso/releases

You'd write that to spare usb stick using Rufus and boot into it using your PC's BIOS

(Also worth reading this article for description of what we are doing:

It's now easy to bypass MediaTek's SP Flash Tool authentication

A group of developers has created a Python utility to bypass the authentication routine of MediaTek SP Flash Tool. Check it out now!

www.xda-developers.com

Then you could run the Bypass Utility script (also on Chaosmaster GitHub repo) - and if that returns a positive result - you're ready for next steps.

You will need downgrade files from https://androidfilehost.com/?fid=17248734326145737263

SPFlashtool is a right PITA to use and I can only get the Windows version working properly so I unlocked with FireIso and left tablet on (but still unlocked) while rebooting to Windows to do the format preloader step. You need to run bypass utility again and then finish off the steps

(3-14) as described in the 1st link I provided.

As you can see, it's quite technical! Hope this points you in right direction!

===============================================================

Edit: also, while I'm trying to be helpful, I should mention the brilliant 'mtkclient' which can be found on: https://github.com/bkerler/mtkclient

If you download the live_iso and write to spare USB stick you can boot into an OS with mtkclient preinstalled - all the mtk hacks built in - super easy to use.

I wonder if it might even be possible to revive a borked Maverick just using Mtkclient and a FireOS firmware bin.....:unsure:
[Fire HD 8 and HD 10 General] 789mod:
you can't enter to bootrom after 7.3.1.0

:(
[Fire HD 8 and HD 10 General] rdpeake:
not as big a problem for me as i am bricked to boot rom...
[Fire HD 8 and HD 10 General] 789mod:
If you enter it in bootrom all think will brick
[Fire HD 8 and HD 10 General] rdpeake:
what? my device is already bricked and can't progress pass boot rom... serial com device shows up in device manager when plugged in via usb...
[Fire HD 8 and HD 10 General] 789mod:
I thinking your device product before 2020
[Fire HD 8 and HD 10 General] rdpeake:
the tablet was release in 2019? - but the software failure only happened recently - an update failed and now it doesn't power on passed boot rom
[Fire HD 8 and HD 10 General] JJ2017:
If the 9th Gen HD10 was manufactured in 2019 it is probably vulnerable to the kamakiri hack and can be rolled back. I (and others on here) have done it.

Amazon managed to patch the bootrom in later devices - the Lot No. printed on the back of the case gives a clue to the manufacture year. I have a J936 which can be hacked and a J045 which can't. This was discussed a lot previously in this thread. The thinking is J9xx = 2019 and J0xx = 2020.

If the device is vulnerable it is probably necessary to also remove the rear cover and disconnect battery to enter bootrom mode . I haven't tested that myself tho' - I just took the back off following the guidance of others on here.

TL;DR - should've mentioned in my post above: device must be manufactured in 2019 & rear cover (probably) needs to come off so battery can be disconnected. These are essential requirements to run the exploits.
[Fire HD 8 and HD 10 General] 789mod:
You mean j9 that is searl number ?
[Fire HD 8 and HD 10 General] rdpeake:
the lot number is j940 - and it is already in boot rom mode on usb connection - as that is where it fails in the initialization process... i'm ultimately just trying to get it to boot again, in preference into a normal OS version. at the moment it is just an expensive paper weight.
[Fire HD 8 and HD 10 General] 789mod:
i can ran it agein , but can't enter it to bootrom , i will pm you ok ?
[Fire HD 8 and HD 10 General] fastness2020:
try to downgrade HD 10 gen9, with a Windows 10

got "Protection disabled" with bypass_utility .

But the MS windows 10 shows bluescreen and reboots, for Stop code: WDF_VIOLATION.
[Fire HD 8 and HD 10 General] 789mod:
You must uninstall drivers MTK , and try it if still do that , try other bybass