yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] LifeAsADroid:
So... It's been a while for me with root etc.

Recently got a 2019 HD 10, and it updated before I found this thread... Sadface.

Any hopes for a root method for software 7.3.1.1? Really would only like root to get nova launcher. After that, I'm set. (launcher hijack apk only "kind of" works, not a permanent method).
[Fire HD 8 and HD 10 General] Michajin:
Disabling the Stock launcher after installing a nova or trebuchet, worked for me for a few months and has been stable. You will need to disable OTA's also. You can also disable amazon bloat...

adb shell pm disable-user --user 0 com.amazon.firelauncher

On a side night, i think the hijack might use more resources while disabling should free up ram with lighter launcher running.
[Fire HD 8 and HD 10 General] LifeAsADroid:
Thanks, I'll give this a shot. It was my understanding this command wouldn't work without root.

Edit: not to be a nuisance, but you don't happen to have the commands to disable OTAs and the bloatware as well, do you?

Edit 2: Found a full list HERE
[Fire HD 8 and HD 10 General] Michajin:
Yes, that is a good list. There is skepticism about this user disable level, but from my experience unless you factory reset or take a OTA, they stay disabled.

Click a thanks if i helped...
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
1. Blacklist your Fire tablet IP address from Wi-Fi router settings (can be removed from blacklist).

2. Enable ADB, connect to your PC, and disable OTA apps:

//Enter ADB shell
adb shell

//Disable it
pm disable-user --user 0 com.amazon.device.software.ota
pm disable-user --user 0 com.amazon.device.software.ota.override
pm disable-user --user 0 com.amazon.kindle.otter.oobe.forced.ota
pm disable-user --user 0 com.amazon.settings.systemupdates

3. Go back to Wi-Fi router settings and remove the Fire tablet from blacklist.

To go into Wi-Fi router settings by entering Wi-Fi router IP address, for example, https://192.xxx.xxx.xxx, (Not on other device IP addresses).
[Fire HD 8 and HD 10 General] DB126:
^^ This response has nothing to do with the quoted post. Random guidance for blocking OTA updates which itself seems flawed. Sigh.
[Fire HD 8 and HD 10 General] NerdFire:
Why not just put the tablet into airplane mode? Or do what I did and don't turn on wi-fi until after you disable updates. The point of all three is the same; make absolutely sure you don't try to connect to the net before you run the commands, because as several posters have found out, if you do your Fire will update to 7.3.1.1 and you'll be out of luck when it comes to root access (at least until the next mtk-su update).

I'd have a hard time blacklisting my tablet at the router because I'm at work and the IT department manages the router, not me.

Actually, I take that back. I did manage to get a tablet blacklisted at the router at work once, but that's a different story :D
[Fire HD 8 and HD 10 General] newnewcomputer:
also from the mtk-su thread:

if anyone has received a new Fire HD 10 from Amazon (WorstBuy may have old stock), plz comment on the out-of-box OS version. in the past, Amazon mostly relied on OTA to patch their software; rather than updating the pre-loaded version. :confused:
[Fire HD 8 and HD 10 General] NerdFire:
I got one about a week ago direct from Amazon that shipped with 7.3.1.0. However, I ordered a model with a blue case instead of a black case. If Amazon is shipping tablets that come with 7.3.1.1 out of the box, it could be that the black tablets sell faster than the other colors, and that at some point they had to restock the black tablets and told Quanta-or-whoever-is-their-current-supplier to update the firmware in the new batch to 7.3.1.1, but that the blue, white and red models are still shipping with 7.3.1.0 and will until current stock runs out.

I also did not check the box on the order page that says "Link to my account to simplify setup." No idea whether that made any difference.

Disclaimer: This is all speculation and, as with pretty much anything I post anywhere, one should always mentally append these words to the message:

". . . But then again, I could be wrong."
[Fire HD 8 and HD 10 General] MontysEvilTwin:
Am I correct in thinking that for the bootloader to be unlocked, a specific vulnerability has to exist in a signed LK.bin file for the device in question? Presumably this would be most likely to be the file shipped with OS 7.3.1.0. If the exploit is patched in that version then presumably bootloader unlock is not possible with the current method?

From other posts in this forum it seems that the Fire HD10 (2019) will enter bootrom mode by holding the left volume button down while plugging in the USB cable for both OS 7.3.1.0 (EDIT: unconfirmed) and 7.3.1.1. (EDIT: confirmed - see https://xdaforums.com/showpost.php?p=81267297&postcount=281) - device opening and point shorting is not required. So if the offsets were known for this device, it would be possible to create a version of amonet, downgrade the bootloader files and reset any downgrade protection to prevent device from bricking? I am asking as it would be great to be able to reintroduce the vulnerability to mtk-su to allow bootless root on devices that upgraded to OS 7.3.1.1. Would this be enough, or would the system image have to be patched in some way; could this be done or would this trigger DM-verity? Otherwise would it possible to install hacked fastboot (even if only temporarily) and flash the necessary partition images to revert to OS 7.3.1.0?
[Fire HD 8 and HD 10 General] Michajin:
I could be wrong but i believe if unlock is possible it would be possible from both if exploit is found. Root access can only be be accessed through temp root mtk-su is a script that can be blocked by software. From what i understood there might be a vulnerabiltiy using kamakiri (like the firestick 4k), also from post #296

[MENTION=8978978]Rortiz2[/MENTION]

Rortiz2

"Yup, I looked aswell in the code and seems that addresses are pretty different in maverick. If I recall correctly, those addresses can be readed from a bootrom dump which I think it's possible to dump as I've done in my mt8163 tab (Aquaris_M8):

https://github.com/R0rt1z2/amonet/bl...ayload.py#L123

And well, I don't think flash all the FW tought bootrom is a good idea, it would take 1-2~ days lol.

If we know where Amazon patches mtk-su maybe we can downgrade that. I guess it's the kernel? Or the system?

Regards."

I'm not aware of anyone looking for exploits in the bootroom or preloader. From what i was told the lk exploit is patched. It was also stated to block updates to prevent Amazon from possibly blocking bootrom access (i have taken it apart and access to any shorting but be hard). Likely you have read all t
[Fire HD 8 and HD 10 General] MontysEvilTwin:
I can't claim credit for discovering the button push method for entering bootrom on the Ford, I merely tested a number of bootloader versions until it stopped working. I thought that this button push method might work for the HD8 (2016, 6th gen.) but It didn't with OS 5.3.1.1 (I did not have access to OS 5.3.1.0, the version this tablet first shipped with, as Amazon never released this version for download). I am surprised that this method has crept back in to the HD10 (2019). Presumably it is a common feature that Amazon's developers forgot to block.

At least if it is just boot.img that needs downgrading for mtk-su to work, rather than the system image, this should not to be too large to flash over the bootrom connection. It would be interesting to know if they have instigated RPMB on this device as they have blocked ADB sideloading so may not have bothered.
[Fire HD 8 and HD 10 General] Rortiz2:
Hi,

Thanks for the clarification.

Sadly, ANTI-ROLLBACK seems to be implemented here :(

[ANTI-ROLLBACK] skip processing anti-rollback data
[ANTI-ROLLBACK] Processing anti-rollback data
[ANTI-ROLLBACK] Failed to read block 0
[ANTI-ROLLBACK] image versions in RPMB block:
[ANTI-ROLLBACK] Need to update version
[ANTI-ROLLBACK] Invalid checksum!
[ANTI-ROLLBACK] Checksum validated
[ANTI-ROLLBACK] %s version mismatch!
[ANTI-ROLLBACK] L: %x R: %x
[ANTI-ROLLBACK] All checks passed
[ANTI-ROLLBACK] Updating RPMB block...
[ANTI-ROLLBACK] Unable to update RPMB block (get wc error)
[ANTI-ROLLBACK] Unable to update RPMB block (write error)
[ANTI-ROLLBACK] RPMB block updated:

I wonder if in 7.3.1.1 they updated bootloader/tz/pl, because on ford they sometimes didn't updated those partitions, just boot & system allowing to the user to downgrade the device and get ROOT (i.e: 5.3.2.0 to 5.3.1.0) so RPMB check will not fail.
[Fire HD 8 and HD 10 General] Michajin:
"downgrade bootloader/tz/pl can be dangerous since we don't know if RPMB is checking them"

I can test.... I dont care if i brick one. I have (2) 7.3.1.1, and (1) 7.3.1.0. I just need directions... LOL Let me know if interested..
[Fire HD 8 and HD 10 General] Rortiz2:
Hi,

That looks cool but there's one problem xD. First two stages of bootROM part needs to be ported.

Would be interesting if you can check if the 7.3.1.0 device goes to bootROM by pressing volume + as in 7.3.1.1

---------- Post added at 08:25 PM ---------- Previous post was at 07:28 PM ----------

I've been comparing images from 7.3.1.0 and 7.3.1.1 and found a few stuff...

First of all, looks like if somehow you discover how to sideload the updates, you can't directly install them asit checks for the date at the top of the package :(

(!less_than_int(1573070806, getprop("ro.build.date.utc"))) || abort("E3003: Can't install this package (Wed Nov 6 20:06:46 UTC 2019) over newer build (" + getprop("ro.build.date") + ").");

About the images, looks like they are different in 7.3.1.1 meaning that if you flash 7.3.1.0 lk/pl/tz in a 7.3.1.1 our friend RPMB will fail to verify the images and the device will refuse to boot :(

Using the methods from this thread: https://xdaforums.com/amazon-fire/development/identify-bootloader-version-t3424634 (thanks @bibikalka) I "identified" both 7.3.1.0 and 7.3.1.1 bootloader versions with the command:

hexdump -C -n8 lk.img

(This basically reads the first 8 bytes of the file).

Example from 7.3.1.0 (The red marked bytes are the ones to identify the bl version):

hexdump -C -n8 lk_7.3.1.0.img
00000000 88 16 88 58 [COLOR="Red"]70 fd 08 00[/COLOR] |...Xp...|

This is the list with the version of all known bootloaders at moment, I will update it when new release gets out:

70 FD 08 00 7.3.1.0 (Unreleased)

E0 0E 09 00 7.3.1.1 (1082_0017549245060)

EDIT: See diplomatic's comment.

I attatched both bootloaders too.

I hope this helps.
[Fire HD 8 and HD 10 General] Michajin:
Confirmed

7.3.1.0

ID 0e8d:0003 MediaTek Inc. MT6227 phone
[Fire HD 8 and HD 10 General] diplomatic:
FYI, the info in that thread is all wrong. Those bytes you highlighted are just the size of the image after the header (in little-endian), not version numbers. It seems that rollback versions are encoded towards the bottom of the file, right before the 0x100-byte signature. In LK, that looks like this:

4C 4B 5F 56 45 52 3A [COLOR="Red"]01 03[/COLOR] | LK_VER:.. |

It appears that the rollback versions are the same between both images. (yay?) Also, the PL is identical in both versions. It's this component that makes it possible to enter BR mode with the button. So that's what would have to be patched to disable that. I hope that a BR flashing method is found soon...
[Fire HD 8 and HD 10 General] novatillo:
Has been published a new source code version 7.3.1.2.

https://fireos-tablet-src.s3.amazon...ZX/Fire_HD10_9th_Gen-7.3.1.2-20200224.tar.bz2
[Fire HD 8 and HD 10 General] Kramar111:
And .bin file also

https://www.amazon.com/gp/help/customer/display.html?nodeId=G2JXLC4L34GX73TE

https://fireos-tablet-src.s3.amazon...10_9th_Gen-PS7312_user_1271_0017884837764.bin
[Fire HD 8 and HD 10 General] Rortiz2:
Hey man!

Thanks you very much for that clarification!

That looks better then:) We can safety downgrade the bootloader/pl if we got bootrom exploit working then:good:

If somebody is interested, I made an "automatic tool" that checks the bootloader version and compares if two bootloaders have the same version:

https://github.com/R0rt1z2/get_bl_ver

It requires python3, that's all. Yeah, works in win, osx and linux. Current options are:

- python3 get_bl_ver.py lk.bin to get the bootloader version of 1 lk.
- python3 get_bl_ver.py -c lk1.bin lk2.bin to diff two bootloaders.

Some examples of what can do the tool.

r0rtiz2@r0rtiz2-X540LA:~/Descargas$ python3 get_bl_ver.py -c lk_7.3.1.1.img lk_7.3.1.2.img
I: Comparing two bootloaders...
W: Bootloaders have different version!
I: lk_7.3.1.1.img: 0103 (769)
I: lk_7.3.1.2.img: 0104 (1025)
r0rtiz2@r0rtiz2-X540LA:~/Descargas$ python3 get_bl_ver.py -c lk_7.3.1.1.img lk_7.3.1.0.img
I: Comparing two bootloaders...
I: Bootloaders have the same version: 0103 (769)
r0rtiz2@r0rtiz2-X540LA:~/Descargas$

I hope this makes things easier to check every bootloader version:good:

Regards.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
Is there a typo above? Your results suggest that the lk version is the same for OS 7.3.1.1. and 7.3.1.2.

---------- Post added at 01:42 AM ---------- Previous post was at 01:21 AM ----------

Why do Amazon still publish software updates as '.bin' files when they have removed the ADB sideload option from the recovery menu? Do they use some open source code that obliges them to under the licence conditions?

I remember with the first gen. HD7 you could load an update by placing the update file in the root directory and rebooting the tablet. Have they instigated something like this with the HD10 (9th gen.)?

If they have enabled updating by placing the '.bin' file in the root directory, perhaps this code is present to prevent downgrades by the same method?
[Fire HD 8 and HD 10 General] MontysEvilTwin:
I've highlighted the sections in red and blue. This looks like 7.3.1.2 and 7.3.1.1 are the same (0104) while 7.3.1.0 is different (0103), as written.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
Thanks for the clarification.
[Fire HD 8 and HD 10 General] diplomatic:
I've checked PL and TZ, but it's not obvious where it's located. Since the PL checks itself, it's probably a global variable somewhere in the middle of the image. It's not clear about TZ either. The version might not be externally visible in the image, but queried from TZ at runtime. :confused:
[Fire HD 8 and HD 10 General] ericaiken:
Remote Code Execution.

First off, thanks for all the efforts. I've got a dumb question. I was reading about the new bluetooth vulnerabilty (CVE-2020-0022). it got me thinking about why not use a RCE vulnerability to simply install SU package sitting in a non-privledged location. For that matter there are a number of RCE vulnerabilities, at least for android, not sure about fireOS.

I'm sure this is too simplistic, but sometimes simple is the best approach. At a minimum it might provide the ability to rename some problematic files. (eg OTA updates), or set permissions to cause OTAs to fail.
[Fire HD 8 and HD 10 General] Michajin:
Anyone have anything new with 7.3.1.2. Did anyone check to see if the boot rom is still accessible from connecting power with volume up?
[Fire HD 8 and HD 10 General] ShermanTenor:
Yes it is. (Photo below is incorrect - posted too quickly, but the fastboot screen does appear!)
[Fire HD 8 and HD 10 General] Michajin:
That's recovery. Not the bottom. [MENTION=5398387]ShermanTenor[/MENTION]
[Fire HD 8 and HD 10 General] ShermanTenor:
Sorry - wrong photo, but the fastboot screen works as well.
[Fire HD 8 and HD 10 General] Michajin:
Not fastboot... Bootrom, on lsusb it will show up as a MediaTek Inc. MT6227 phone. The bootrom is what has commonly been exploited to gain access to hacked fastboot to allow flashing.
[Fire HD 8 and HD 10 General] ShermanTenor:
Ahh - sorry, I'm showing my ignorance here. Back to the kids table for me. ;)
[Fire HD 8 and HD 10 General] Kramar111:
Crashing and rebooting

Fire OS 7.3.1.0 (PS7310/940), Bootless root with Magisk and MTK-SU
[Fire HD 8 and HD 10 General] Kramar111:
And init.fosflags.sh from / (just remove .txt in the end)

View attachment init.fosflags.sh.txt
[Fire HD 8 and HD 10 General] Supersonic27543:
Thanks for trying, but it doesn't look like the vulnerability is exploitable on Android unfortunately. :(
[Fire HD 8 and HD 10 General] novatillo:
List of some vulns targeted in the 7.3.1.2 version, obtained by diffing their source code with 7.3.1.1, maybe util in the search for a root method for 7.3.1.1, if anyone knows a exploitation for some of them.

CVE-2018-20961

Desc: In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.

Impact: High. Elevation-of-privilege

Patch: USB: gadget: f_midi: fixing a possible double-free in f_midi

CVE-2020-0009:

Desc: In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This could lead to local escalation of privilege by corrupting memory shared between processes, with no additional execution privileges needed. User interaction is not needed for exploitation.

Impact: High. Elevation-of-privilege

Patch: staging: android: ashmem: Disallow ashmem memory from being remapped

CVE-2019-15214:

Desc: An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.

Impact: Medium, availability of affected item

Patch: ALSA: core: Fix card races between register and disconnect

CVE-11833:

Desc: fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem.

Impact: Medium, information leak.

Patch: ext4: zero out the unused memory region in the extent tree block

CVE-2018-20856:

Desc: An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is mishandled.

Impact: High, uncontrolled modification of some system files or information is possible

Patch: block: blk_init_allocated_queue() set q->fq as NULL in the fail case

CVE-2019-2023, CVE-2019-2181, CVE-2019-2213, CVE-2019-2214:

Desc: In ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller. This could allow an app to add or replace a HAL service with its own service, gaining code execution in a privileged process. And some additionals vulns. due to original patch https://www.synacktiv.com/posts/systems/binder-secctx-patch-analysis.html

Impact: High. Elevation-of-privilege

binder: fix possible UAF when freeing buffer

Patch binder: create node flag to request sender's security context

Unknown:

Desc: Some secure layer related in mediatek video driver

Impact: Unknown

Patch: src/kernel/mediatek/mt8183/4.4/drivers/misc/mediatek/video changes
[Fire HD 8 and HD 10 General] Rortiz2:
BootROM exploit without LK exploit will do nothing here since this tablet will come with DM-Verity for sure. So, if you touch boot/system/recovery will cause a nice brick.;)

Also, seems that mt8183 is an special processor that only runs (will run) this tablet like the CPU of 4K. So I think is more difficult then unless addresses are identical as mt8163.

Regards
[Fire HD 8 and HD 10 General] xyz`:
The bootrom exploit would be totally enough to get tethered unlock working, similar to what's done on iphones. It's just not very convenient to use as you would need to connect to a pc (pc running a patched linux distro, if using kamakiri) every time you need to boot into a custom ROM.
[Fire HD 8 and HD 10 General] Rortiz2:
I see. I didn't know that is possible :p
[Fire HD 8 and HD 10 General] bibikalka:
The bootrom exploit could still help to recover bricks, if that's an issue.

Now, it's most likely Amazon will demand that you update right when you turn it on the first time. And, also, in the past the first devices often shipped with OSes which were never made available as a proper update file. So these early versions could be more engineering focused, and less concern about security giving pressures to ship, with new Android version too!

To make long story short, the best chance to unlock one if you, xyz`, buy it as part of the very first batch, and grab whatever LK/TZ it has on these early devices without letting it update. Fortunately, 4k unlock is very recent, so hopefully the Fire HD10 team at Amazon is too busy with other things to implement the fix in the early devices ;)

Edit: To add, early unlock would definitely inform my Thanksgiving buying. I am lukewarm about another HD10 in the household, but if you de-risk the unlock by the end of November, it's a very different story :D Unlocked Pie Fire tablet would be a very juicy toy!!!
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
USB C Wikipedia: https://en.m.wikipedia.org/wiki/USB-C

Here is a specifications:

-> Pinouts (with attached images from post #26, and also wiew in Wikipedia link)

-> Wiring colors (look at Wikipedia link posted)
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Here is an USB-C pinout (it's a transparent images)
[Fire HD 8 and HD 10 General] Scientiam:
Received mine today.
[Fire HD 8 and HD 10 General] Rortiz2:
Would be nice to see some screenies of new Fire OS;)

Cheers!

EDIT: [MENTION=7104332]k4y0z[/MENTION] [MENTION=9667509]xyz`[/MENTION] FW is up. If you guys can take a look at lk :)

https://fireos-tablet-src.s3.amazon...ate-kindle-PS7311_user_1065_0017549240708.bin

EDIT2: for anyone interested, the device codename is "maverick" (Thanks kai xD):

ro.bootimage.build.fingerprint=Amazon/maverick/maverick:7.0/PS7311/1065N:user/amz-p,release-keys
[Fire HD 8 and HD 10 General] Scientiam:
Your wish is my command:

EDIT: Account needs 10 points on XDA before I can hyperlink:

imgur.com/a/F1RtwpD

My camera quality isn't that good and I gotta head out but I can re-take later or take requests, but first thoughts:

SMOOTH. Much more smoother than the previous HD10 and it's noticeable.

Front/back camera look noticeably different, a bit more flush with the shell this time around. I'll take a pic later with my old case.

I've used mine with a case so I don't remember how the outside plastic felt but this one feels good to hold. That said, fingerprint magnet but what can ya do.

Screen looks quite sharp, mine has a little bit of LCD bleed on the bottom right corner but not too noticeable.
[Fire HD 8 and HD 10 General] Rortiz2:
Cool!!

Can you try mtk-su?

https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595

Cheers!

EDIT: [MENTION=6680544]bibikalka[/MENTION] take a look at the photos of the new fire xD
[Fire HD 8 and HD 10 General] LapjeLuum:
Has anyone tried to choose the Nova as an alternative launcher? With my new Fire HD 10 with FireOS 7 it seems to work, but when i press the Home button it takes about 5 seconds until Nova starts.
[Fire HD 8 and HD 10 General] Scientiam:
I've never rooted my tablet(s), so I don't know the procedure. Here's what I got up to so far, not sure how to proceed any further:

imgur.com/a/nbfVL6W
[Fire HD 8 and HD 10 General] Rortiz2:
Cool.

Do you have telegram or discord? I can try to guide you;)
[Fire HD 8 and HD 10 General] Awesomeslayerg:
Kinda wanna see the guts of this thing
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
We donated to [MENTION=7104332]k4y0z[/MENTION] and [MENTION=9667509]xyz`[/MENTION]: https://xdaforums.com/hd8-hd10/general/donate-to-k4y0z-unbrick-twrp-unlock-t3995201
[Fire HD 8 and HD 10 General] 2Pints:
Does this thing have a functioning GPS sensor? the previous (2017) had, as far as i know a GPS chip, but it was non functional
[Fire HD 8 and HD 10 General] grantdb:
Nope, at least mine doesn't. Oh well