yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Michajin:
You can go to the new thread. I believe you should stick with magisk 20.3 though. You need a root manager to control it root, follow the instructions. The instructions add init-d which runs a script at boot up that allows for root access more permanently. With mtk-su you basically only have root in shell. The bootless root exploits this to use magisk as a root manager. The bootless root basically runs the same thing but makes it automatic and give you control of root. It has its limitations though. Follow the thread for more information.

Did you get a sucess message for the following?

pm disable-user --user 0 com.amazon.device.software.ota

pm disable-user --user 0 com.amazon.device.software.ota.override

---------- Post added at 01:48 PM ---------- Previous post was at 01:38 PM ----------

Full disclosure. Anything you do that could potential brick your device with root access could be non-recoverable. The device is not unlocked, only has stock recovery (to wipe data). Currently i am unaware of any exploits to unlock or any flaws have been found to get it unlocked. On that note, i am also unaware if any developers are even interested at this point. You can easily change launchers and give a more Android feel (install alternate launcher first), you can easily disable apps (look up what apps are safe, there is a thread for disabling hd10 (2019) apps. The bootless root usually runs its routine on mine with the init-d about 5-10 after boot. So magisk doesn't have root instantly.. just to give you some information. I do not know what your skill set is, or what your goal is for having root..
[Fire HD 8 and HD 10 General] gdroid666:
"Did you get a sucess message for the following?

pm disable-user --user 0 com.amazon.device.software.ota

pm disable-user --user 0 com.amazon.device.software.ota.override"

i believe so , you tell me

here is what i got so far

[IMG="2019 fire HD 10 OT updates blocked"]https://i.postimg.cc/5tDkKPmW/2019-fire-HD-10-OTA-updates-blocked.png[/IMG]

and for mtk-su verbose logging

[IMG="2019 fire HD 10 mtk-su install verbose log"]https://i.postimg.cc/jdd6YH2W/2019-fire-HD-10-verbose-logging-MTK-install-temproot.png[/IMG]

my skill is not very high

for now i am just looking to preserve the lower FW just in case there are developments like a custom rom or xposed framework mainly for youtube ad block and background play (yes i know there is vanced but for some reason no matter what i try on my HD 8 2018 micro g does not work and i can't log in to my account)

i thought i saw someone in this thread say that PM disable didn't work for them and that their tablet got updated still , and you said something about needing root permission r/w to rename the OTAupdate.apk to something to be 100% safe from an update

so that is basically the only reason i want root right now

i didn't do it on m fire HD 8 and now i am stuck with no root unless i open the device
[Fire HD 8 and HD 10 General] Michajin:
The rename option is not working on the temp root. I have been using user disable for over 6 months and have not taken an update. PM hide is different, the app can be reactivated easily. I think it was some confusion over how people were disabling the OTA (like using hide) and type of disable they were using (disabling updates (apps) in dev options), I have blocked updates on firetv's for years doing the disable method. (until amazon blocked disable commands). Either way, it seems to be the only option currently to disable apps. I use a package disabler from the play store just to make it faster and verify the adb disable worked.

But yes, re-naming or uninstalling the OTA is probably the safest option overall if available, but it is not working on temp root.

Your disable was good (says status user-disabled), i find it odd you can't get vanced to work. You might not have the right mocro-g for you version of vanced. I have vanced on my non-rooted hd10. I would stay away from xposed and magisk modules until there is a full unlock with TWRP.
[Fire HD 8 and HD 10 General] gdroid666:
yeah i meant PM disable i typed hide by mistake

i was reading back and i saw that it said temp root should be done 1st before PM disable OTAupdate

but i did the ADB PM disable OTA updates before i install emtk-su temp root

should i do it again now that i have temp root?

and i forgot i do want to to change the launcher also ,

so what happens if amazon overrides the disable commands and upadates the tablet then it will revert back to fire launcher and i will need to use launcher hijack?

i would really rather be safe than sorry and rename them to blockedOTAupdate.apk etc.

but i am having trouble following the majick guide , i never used majisk before ,only super su and i don't know how to create the directories int he proper place with the ADB commands

can you help me or is there more specific guide that is more step by step so i can rename the OTA update apk.s ?

launcher hijack on the HD is a mess it takes almost a full minute to work and i keep seeing fire launcher now it used to work better then it stopped working like it did before and now NOVA launcher on the HD 8 does not work at all for app switching anymore

i hit the square app switcher button and i see my apps that are running but i cant switch to any of them ,i have to us the icon on the home screen or in the app drawer to get back tot them its a PITA , and i want to avoid that happening on this tablet
[Fire HD 8 and HD 10 General] Michajin:
You can not do the re-naming of the OTA, IT DOES NOT WORK on temp root.

Install your launcher, then run this...

adb shell pm disable-user --user 0 com.amazon.firelauncher

once you disable them, they have never been enabled again on any of MY devices. I going offline for a while. I can help you out to install the rootless boot tomorrow. Give it a try, follow the directions. Mostly just putting files in proper places. STEP-BY-STEP. There is no risk here, try it, reboot and see if you have magisk enabled.

Magisk is root manager with features. It is a SU manager with addon functions similar to that of xposed, but it is systemless and can hide root from apps that root detection.
[Fire HD 8 and HD 10 General] gdroid666:
ok thanks i will wait till tomorrow,

yes i understood that renaming is not possible with temproot

i am afraid to try majisk right now i thought it could brick the the device if not done right

so in need temp root to install permanent root or bootless root right , if i unplug my tablet from the PC will the temp root still be there when i plug it in again? or will i need to do it over?

i will look over the majisk threads again and see if i can get a better understanding of the install process

also is there a command i can tpe to see if i still have temproot?
[Fire HD 8 and HD 10 General] Michajin:
It is a temp root solution. The temp root always allows a shell root access, without a root manager, none of your apps will have access. The bootless root just runs the mtk-su program and the magisk manages the root access. You don't need to do the process again. The init-d will run it automatically from the device and magisk will manage it. That is the best way i can explain it. The temp root and the bootless root are the same but now with magisk you have control of it. Never update magisk through the manager, you need an unlocked device to modify the boot.img.
[Fire HD 8 and HD 10 General] gdroid666:
ok so if i install makisk i can grant the write permission to the folders so i can rename the OTAupdate.apk correct?

and you are saying there is no brick risk unless i try and update majisk from OTA through the app but installing it should be safe

i am just wondering without majisk in the event that what happened to that other unfortunate user in this thread that had amazon update his fire OS

will the fire launcher stay disabled ,i assume if i get updated then they will put the fire launcher back and i will have no more ability to temp root and disable it again

so i want to make sure it is 100% blocked
[Fire HD 8 and HD 10 General] Michajin:
NO. The rename does not work, from the bootless root

"LIMITATIONS

Cannot modify boot partition unless bootloader is unlocked

Cannot modify system/vendor partitions unless boot partition is altered"

There is no brick risk trying to install magisk from the bootless root method.

The risk is trying to update magisk from magisk, but if you follow the directions, it will never prompt you to update.

The app is fine, modules do not work, it is working like SU user was used. To manage root access...

I HAVE DISABLED THE LAUNCHER AND OTAS WITH THIS USER DISABLE FOR OVER 6 MONTHS, I HAVE NOT UPDATED. MY LAUNCHER HAS STAYED THE SAME (Trebuchet launcher). THE ONLY WARNING IS THAT IF YOU DO A FACTORY RESET, THEN VERIFY THEY ARE STILL DISABLED.
[Fire HD 8 and HD 10 General] gdroid666:
ok thanks

sorry the posts by that other user got me a little confused

so then i have done all that i can possible do to block the updates already

i installed nova and disabled fire launcher it's working great , so much better and launcher hijack

so basically there is not really any benefit to installing magisk right now since it wont allow me to rename the update .apk's

and there are no working modules as of yet so i am safe to enable wifi and install the play store

as long as i don't factory reset the device then amazon should not be able to force an OTA update

i thought it was like the 2018 fire HD 8 where you got temp root then that allowed you to install permanent root
[Fire HD 8 and HD 10 General] Michajin:
No there is not a need for it unless you have a app that requires root access. We are a long way from having any custom rom on this device.

Yes, you are fine to connect to wifi. You can verify this by checking for updates in settings>Device Options> System updates (should just close settings) without checking (looks like a crash).

On a side note, the other devices you needed root access to get to the bootrom, there is a error where they left it accessible on both the first (2) OTA's without needing root on the hd10 (2019) . The other option with those devices, require shorting or root to access it. The HD8 (2018) the shorting points are right behind the cover which comes off rather easy. just an FYI.
[Fire HD 8 and HD 10 General] gdroid666:
ok so i was looking at this other thread here and this says there are 2 other apk's related to OTA updates

https://xdaforums.com/hd8-hd10/general/guide-remove-amazon-apps-fire-10-hd-2019-t4009547

adb shell pm disable-user --user 0 com.amazon.kindle.otter.oobe.forced.ota

and

adb shell pm disable-user --user 0 com.amazon.settings.systemupdates

should i go ahead and disable these as well ?
[Fire HD 8 and HD 10 General] Michajin:
They are not OS updates. But feel free to disable whatever you want. I know one of these makes you unable to register your tablet for use of amazon apps.
[Fire HD 8 and HD 10 General] newnewcomputer:
hope everyone is safe n sound......w/ loads of time to tinker toys like the Fire HD 10 :D

not sure why it wasnt mentioned in this thread but [MENTION=8132642]diplomatic[/MENTION] has released a new root script which allows a newer version of Magisk (20.x+) here. in his words:

"

NEW FEATURES

MagiskHide & SafetyNet pass now work under Android 9

Modules pass minimum version check

Faster and more efficient loading

Logging works properly

"

for fire HD 2019 running Android 9 , using Magisk v20.3 or higher may crash. i use 20.2 n it works fine. i dont use any banking apps so i havent tested the hide n safetynet but the script execution at boot-up feels faster.

same restrictions as the previous script: mts-su only works on Fire OS 7.3.1.0. w/o a bootloader unlock, system folder n its files cannot be modified. root access will allow disable of Amazon apps (OTA update being the most important one!), install a new launcher n so on.

i decide to keep Magisk at 20.2 so i disable the update in Magisk manager w/ the custom setting from suboot method.

i just saw this today but others in that threat have reported good results on Fire HD 2019. thought i would share it here. dont forget to click Thanks for [MENTION=8132642]diplomatic[/MENTION]!
[Fire HD 8 and HD 10 General] Scientiam:
Coming back since release, how has rooting progressed so far?

Is the "Rapid Temporary Root for HD 8 & HD 10" guide up-to-date or is there more information? I see [MENTION=5792427]newnewcomputer[/MENTION] posted some information regarding newer versions of Magisk, but I'm wondering if there's been any changes to the method in the previous guide.

Sorry for the newbie questions.
[Fire HD 8 and HD 10 General] newnewcomputer:
me a newbie myself :D

if u are coming back since release, ur root progress will depend on whether u have disabled firmware update on ur Fire HD10 2019.

as stated in [MENTION=8132642]diplomatic[/MENTION]'s thread, mtk-su only works on HD10 2019 of 7.3.1.0 which was the release firmware. Amazon quickly released 7.3.1.1 which patched the exploit n anything newer is patched as well.

even w/ 7.3.1.0, mtk-su only grants temporary root. however diplomatic wrote a script file which allowed headless root (magisk)during boot-up (n an updated script 4 better performance mentioned in my post above.) u have full adb access. w/o bootloader unlock n dm-verity, u cant make any change to system folders n files e.g. cant install adaway.

someone mentioned a few pages earlier dat theres no active effort in a BL unlock; which is a bummer as i thought the early root access after release provided a nice head start. i remember early discussion of an amonet-type exploit COULD be done but then there was also an unsolicited project which may have turned some developers away :(
[Fire HD 8 and HD 10 General] Scientiam:
Dang, I'm on 7.3.1.2, so I'm out of luck when it comes to any form of rooting?

Has anyone managed to create any custom ROM's or is that well out of the picture as well?
[Fire HD 8 and HD 10 General] newnewcomputer:
no root unless a new exploit is found for 7.3.1.2, no custom ROM or recovery until a bootloader unlock is found.

ur best bet of customization is the Amazon toolbox; go check out the thread here. many ppl are happy w wat it allows n OP is very helpful there. good luck!
[Fire HD 8 and HD 10 General] diplomatic:
You can use AdAway.... don't need to make changes to system. Just let Magisk mount a systemless hosts file with the proper module. I think it's actually built into MM's settings...
[Fire HD 8 and HD 10 General] asciix:
First, thank you diplomatic for your awesome work. I have the bootless root working on Magisk 20.4, and tried the systemless hosts module in the MagiskManager. However, the device needs a reboot to enable the module, and the module doesn't load (disappears) on a reboot. Does anyone know a way around this?
[Fire HD 8 and HD 10 General] diplomatic:
Hi [MENTION=5425953]asciix[/MENTION],

Have you had Magisk 18 installed before? The old Magisk data might conflict with the new version. You will need to follow the last step in the bootless guide to clear out Magisk's data directory and set up MM again. That'll take a few reboots, but that's the price of admission...
[Fire HD 8 and HD 10 General] asciix:
Awesome, I deleted the /data/adb directory and reinstalled MM and now the systemless module is working fine.

Thank you so much! [MENTION=8132642]diplomatic[/MENTION]
[Fire HD 8 and HD 10 General] newnewcomputer:
Thank YOU, [MENTION=8132642]diplomatic[/MENTION]! i remember seeing the systemless host option in MM but wasnt sure how it worked w/ adaway. i follow ur direction n can confirm that it works! :good:

so for Fire HD 10 9th gen, IF it has OS 7.3.1.0 (n i have seen ppl said they received 7.3.1.1 out-of-box from Amazon), then ur mtk-su + magisk at boot will provide semi-permanent root access. the magisk script takes a few seconds after boot to execute which may be problematic for apps dat require immediate root. it does provide full adb access n allow systemless host file for ad block.

root access will be lost after any OS update to 7.3.1.0. its very important to block Amazon's update. pm disable com.amazon.device.software.ota seems to work well enough. i put that in the boot-up script just in case Amazon re-enables it. another line i added recently would delete any ota package that may have been downloaded before its install.

adaway n OTA block are the top two things i want to do w/ root. other improvements such as nova launcher n Play store do not even require root.

thanx again [MENTION=8132642]diplomatic[/MENTION]! been using this daily n very happy w its performance. will see if sum1 can develop a BL unlock.
[Fire HD 8 and HD 10 General] Supersonic27543:
Hey,

As a note, I'm still looking for ways to unlock this :) I'm currently trying to reverse engineer the LK to figure out what the "flash unlock" command does if it succeeds (has this been done already?) Also, depending on the functions Amazon used, there may be RSA timing flaws. I'm not sure because I didn't succeed in modifying the LK image to a reversible format yet, please let me know if someone knows a way to do this (I've not been in touch with the current status of the community for some time :p)

Good luck!
[Fire HD 8 and HD 10 General] k4y0z:
If it's anything like on the other devices, unlocking would work by storing the signed unlock_code in idme/boot1.

On boot the signature is checked and if the content matches the unlock_code (which is a hardware-based value) it would be unlocked.
[Fire HD 8 and HD 10 General] Supersonic27543:
Ouch, so if I understand that correctly, looks like it would be impossible to go anywhere with that unless somehow the unlock_code retrieval could be tampered with or the RSA(?) algorithm Amazon uses here has an unsafe implementation. :(

Thank you for the information!
[Fire HD 8 and HD 10 General] k4y0z:
Has anyone tried porting amonet (or if that doesn't work kamakiri) to this device?

Earlier reports even mentioned, that bootrom could be easily accessed using the volume button.
[Fire HD 8 and HD 10 General] Supersonic27543:
No research had been made on any of the bootrom exploits for this as far as I know. Indeed, bootrom mode could be accessed using the volume button (I also tested that a while ago in my device) If I remember correctly this is also possible in the updated version not vulnerable to mtk-su.

Also it should be possible to boot to meta/factory modes (if it is useful at all) using the preloader handshake script. I tested FASTBOOT but too scared to try the other ones because reflashing is not an option :p
[Fire HD 8 and HD 10 General] k4y0z:
Probably nothing bad will happen, it should basically fall back to normal boot, if no "factory.img" is present.

In amonet I am repurposing factory and advanced factory mode for the boot-recovery and boot-fastboot scripts.
[Fire HD 8 and HD 10 General] Kramar111:
[MENTION=7104332]k4y0z[/MENTION]

Please help us with kamakiri , BootROM dump, etc.

Fire HD 10 2019 can boot into this modes

VID, PID
0e8d, 0003	bootrom
0e8d, 2000	preloader
0e8d, 2006	? (after handshake2.py, adb shell+, su- :) ONLY IF adb key is accepted before
18d1, d001	recovery (adb unauthorized)
1949, 03f0	fastboot
1949, 03f2	normal boot or adb?
1949, 03f8	before 03f2 on normal boot
1949, 03fb	poweroff (USB HID)
[Fire HD 8 and HD 10 General] Michajin:
I can confirm on Fire OS 7.3.1.0 and Fire OS 7.3.1.1 the volume button while plugging in boots into bootrom. I did some testing with Diplomatic and Rortiz. I can't remember the details, but I was told amonet wouldn't work, but kamakiri might.
[Fire HD 8 and HD 10 General] k4y0z:
[MENTION=8132642]diplomatic[/MENTION] [MENTION=8978978]Rortiz2[/MENTION]

Can you tell how exactly amonet was tested?
[Fire HD 8 and HD 10 General] Michajin:
I will try look up the details in the morning (est clocks). I'm not sure who had me check. I know I did something with sp tools. Sorry for the lack of details.... It was back in like December. I'll follow up with details if they don't remember.
[Fire HD 8 and HD 10 General] Supersonic27543:
I tried to boot into factory and it seems to get stuck on the Amazon logo (it's possible to long press power to reboot back into normal boot)

PS: ADB access is possible in this mode, so this is likely the "unknown" mode above in [MENTION=5728225]Kramar111[/MENTION]'s table. Looks like it stops at an early boot stage (only the vold service is running)
[Fire HD 8 and HD 10 General] Michajin:
"Quote:

Originally Posted by Michajin

[2019-12-21 17:30:34.704598] Waiting for bootrom

[2019-12-21 17:30:44.536277] Found port = /dev/ttyACM0

[2019-12-21 17:30:44.536648] Handshake

[2019-12-21 17:30:44.537112] Disable watchdog

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2019-12-21 17:30:46.545609] Load payload from ../brom-payload/stage1/stage1.bin = 0x27C bytes

[2019-12-21 17:30:46.580207] Let's rock

[Errno 110] Operation timed out

[2019-12-21 17:30:47.581163] Waiting for stage 1 to come online...

Traceback (most recent call last):

File "main.py", line 77, in <module>

main(dev)

File "main.py", line 24, in main

load_payload(dev)

File "/root/Desktop/dghd10v2/modules/load_payload.py", line 85, in load_payload

raise RuntimeError("received {} instead of expected pattern".format(data))

RuntimeError: received b'' instead of expected pattern

Quote:

Originally Posted by Rortiz2

Quote:

Give a try to this one... Is based on amonet-kamakiri:

://drive.google.com/XXXXXXX

Regards.

Not good news man... This means amonet needs modifications to work in maverick. I already ported it to my tab (non-amazon) and worked, but took me a lot of time to find out the correct addresses... Also I don't have any idea how kamakiri works...

Cheers.
[Fire HD 8 and HD 10 General] k4y0z:
That looks like you were testing kamakiri.

Neither amonet nor kamakiri will work without modifications.

The first thing to do is to check if bootrom allows writing to the crypto-hw.

That's what amonet does.
[Fire HD 8 and HD 10 General] Michajin:
I was wrong, forgot the details.

He had me try a couple. Yes, looks like it would need addressing, i seen he said that. I think this is the results from the first bootrom-step he had me try...

[2019-12-21 16:55:02.428359] Waiting for bootrom

[2019-12-21 16:55:27.039462] Found port = /dev/ttyACM0

[2019-12-21 16:55:27.040004] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2019-12-21 16:55:29.045446] Init crypto engine

Traceback (most recent call last):

File "main.py", line 162, in <module>

main()

File "main.py", line 111, in main

load_payload(dev, "../brom-payload/build/payload.bin")

File "/root/Desktop/dghd10/modules/load_payload.py", line 103, in load_payload

init(dev)

File "/root/Desktop/dghd10/modules/load_payload.py", line 11, in init

dev.write32(CRYPTO_BASE + 0x0C0C, 0)

File "/root/Desktop/dghd10/modules/common.py", line 160, in write32

self.check(self.dev.read(2), b'\x00\x01') # arg check

File "/root/Desktop/dghd10/modules/common.py", line 87, in check

raise RuntimeError("ERROR: Serial protocol mismatch")

RuntimeError: ERROR: Serial protocol mismatch

[root@sysresccd ~/Desktop/dghd10]# lsusbe

bash: lsusbe: command not found

[root@sysresccd ~/Desktop/dghd10]# lsusb

Bus 002 Device 051: ID 0e8d:0003 MediaTek Inc. MT6227 phone

---------- Post added at 12:52 PM ---------- Previous post was at 12:43 PM ----------

How do i check if it allows writing to the crypto-hw?

SPFT gave me this (Diplomatic had me check this)

Bootrom-

ERROR:STATUS_SEC_AUTH_NEEDED (0xC0030012)

I don't know if it is relevant... in preloader i get

ERROR:STATUS_BROM_CMD_SEND_DA_FAIL (0xC0060003)

the bottom says Download DA 100%
[Fire HD 8 and HD 10 General] Ktulu89:
Is it possible to root my HD 10 running Fire OS 7.3.1.2?
[Fire HD 8 and HD 10 General] Michajin:
No root is available on 7.3.1.1+. Root is only currently available on Fire OS 7.3.1.0 (Via the mtk-su exploit).

---------- Post added at 04:16 PM ---------- Previous post was at 04:15 PM ----------

But that doesnt limit you much to install play store, change launchers, disable apps (and OTAs).