yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Michajin:
Don't know if this is helpful, but the hd10 maverick does boot into the preloader when plugged in,handshakes and holds the preloader on, using the other use bootrom-step.sh. I get the serial mismatch as expected, trying to see if i can get into the bootrom. I got one for $50 so i am willing to do some testing...
[Fire HD 8 and HD 10 General] Rxbird87:
Meh you can choose to believe what you will. I was just giving a heads-up. See the screenshot.

[IMG="mehh"]https://i.imgur.com/NpHnfEQ.jpg[/IMG]

[IMG="meh"]https://i.imgur.com/2H3iimX_d.jpg?maxwidth=640&shape=thumb&fidelity=medium[/IMG]

FYI PLEASE DO NOT POST THIS ON SLICKDEALS. Unless you want all the resellers with bots to buy em all.
[Fire HD 8 and HD 10 General] Michajin:
You got the deal of a lifetime... I can't seem to see this anywhere!
[Fire HD 8 and HD 10 General] Rortiz2:
How does shows up in lsusb?

Did you tried pressing any volume buttons while you plug in the tablet? With old preloaders in Fire 7 2015 aka ford you could enter in bootROM with pressing volume - while connecting it.

Regards.
[Fire HD 8 and HD 10 General] dr_docdoc:
The 7th Gen is also advertised as the “All New Fire HD 10.” I’m still skeptical this is the 9th gen 2019.
[Fire HD 8 and HD 10 General] Michajin:
no i didn't press any buttons. i will try it and see...

lsusb shows

0e8d:2000 MediaTek Inc. MT65xx Preloader

[MENTION=8978978]Rortiz2[/MENTION]

It worked, Volume up and plugging in- script says remove short to continue

lsusb shows

ID 0e8d:0003 MediaTek Inc. MT6227 phone
[Fire HD 8 and HD 10 General] Rortiz2:
Alright, report back how it goes. Maybe Amazon forgot to patch that :D

This probably will not be useful for anything but analyzing lk.bin I found a few commands that seems that had been introduced in Fire OS 7.3.1.0:

fastboot oem flags

fastboot oem logcat

fastboot oem dump-boot-args

Probably this ones will not work since locked bootloader. But just found them interesting:)

Regards.
[Fire HD 8 and HD 10 General] Michajin:
FYI i am on 7.3.1.1

Yes it went into the bootrom!
[Fire HD 8 and HD 10 General] Rortiz2:
Oh my god!!

So we have a chance of downgrade and use mtk-su :highfive:

If you want, we can continue via PM to test a few scripts (without flashing anything obviously).
[Fire HD 8 and HD 10 General] Michajin:
heck yeah... XDA PM?
[Fire HD 8 and HD 10 General] Rortiz2:
Yep.

Regards.
[Fire HD 8 and HD 10 General] dr_docdoc:
Hey y’all!

So, one of the warnings on using the mtk-su root is if system partition write happens, it could brick the device unless we have a way to get into bootrom and flash a recovery (if I’m even saying that correctly, I don’t know).

Either way, is what you’re discussing here related to the ability to unbrick a device and reinstall the Fire OS recovery so the device can be fully recovered to the stock manufacturer delivered status?
[Fire HD 8 and HD 10 General] Rortiz2:
Not exactly.

We're talking about cleaning the RPMB with bootrom exploit and then downgrade to 7.3.1.0.

Regards.
[Fire HD 8 and HD 10 General] Michajin:
there are definitely options from the bootrom if they can be exploited. From the bootrom other devices were able to boot into a hacked fastboot to flash custom recovery's. Lets hope for an easy exploit...
[Fire HD 8 and HD 10 General] dr_docdoc:
Sounds promising! Definitely keep us posted!
[Fire HD 8 and HD 10 General] Rortiz2:
So, actually this is the status:

FireOS 7.3.1.0: Temp Root with mtk-su works. Access to bootROM with volume + uknown.

FireOS 7.3.1.1: Temp root with mtk-su not working. Access to bootROM with volume + works.

Basically, my idea, is use the first stage of the exploit (bootROM) to downgrade tz/lk and clean RPMB (or simply clean RPMB). After that just boot to the recovery and sideload the 7.3.1.0 bin. Get temp root and block OTAS and stay here until full unlock gets released.

This sounds pretty easy but maybe b-rom payload needs modifications for MT8183 as it needs it for sloane (Fire TV 2) to downgrade the RPMB correctly:(

And if I recall correctly, someone said no apply update from sideload/sd is in the stock recovery.

Also we need to keep in mind that Amazon will probably patch this access to bootROM as they done with the Fire 7 2015 in the 5.3.2.0 update;) SO best thing is stay in 7.3.1.0 or 7.3.1.1.

We can't flash unsigned recovery/boot images (i.e: TWRP) because lk expoit is not present. In the past xyz talked about a tethered root with only bootrom exploit. Maybe he can explain a bit more how it works:)

Just throwing ideas.
[Fire HD 8 and HD 10 General] DB126:
Nice score!! Would seem someone made a booboo and you, and anyone else fortunate to see it, are the fortunate beneficiaries.

Honestly can say I have never seen this deep of a discount on contemporary Amazon devices.
[Fire HD 8 and HD 10 General] Rxbird87:
Just check back periodically. Who knows, maybe it'll come back? I was able to do it on multiple days. Easy Christmas gifts this year. Lol

---------- Post added at 05:10 AM ---------- Previous post was at 05:01 AM ----------

It detects as 2019 on PC and the about device shows 9th generation. ?*♂️. I'll just chaulk it up to me being lucky then. Full discloser though as I only opened up two. The rest has been wrapped up.

---------- Post added at 05:12 AM ---------- Previous post was at 05:10 AM ----------

Thanks! It came as "refurbished" but looks brand new. I'm wondering if these are returns and Amazon just wants to get rid of them?
[Fire HD 8 and HD 10 General] Michajin:
For those interested... Might need some help with kamakiri, Thanks [MENTION=8978978]Rortiz2[/MENTION]

[2019-12-21 17:30:34.704598] Waiting for bootrom

[2019-12-21 17:30:44.536277] Found port = /dev/ttyACM0

[2019-12-21 17:30:44.536648] Handshake

[2019-12-21 17:30:44.537112] Disable watchdog

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2019-12-21 17:30:46.545609] Load payload from ../brom-payload/stage1/stage1.bin = 0x27C bytes

[2019-12-21 17:30:46.580207] Let's rock

[Errno 110] Operation timed out

[2019-12-21 17:30:47.581163] Waiting for stage 1 to come online...

Traceback (most recent call last):

File "main.py", line 77, in <module>

main(dev)

File "main.py", line 24, in main

load_payload(dev)

File "/root/Desktop/dghd10v2/modules/load_payload.py", line 85, in load_payload

raise RuntimeError("received {} instead of expected pattern".format(data))

RuntimeError: received b'' instead of expected pattern
[Fire HD 8 and HD 10 General] Supersonic27543:
I got my tablet yesterday and quite happy with it so far, performance and screen quality is nice, and UI is more tolerable because it has a fair amount of Android 9 elements. Still on 7.3.1.0, debloated but not rooted with Magisk yet. (mtk-su is working :))

Now my knowledge in the bootrom exploiting field is quite minimal, but I spent some time browsing the code and trying to understand it, looks like the problem here is the send_usb_response function. It is at 0x55bb in the source, but probably in this device it is somewhere else, and I don't have any idea about how to find it. :(

Yes you recalled correctly, the ADB sideload option is not present :( But isn't it possible to flash the whole firmware through the bootrom? (it will probably be very slow though, if it is even possible) These values are what we probably have to adjust to get this working.

Good luck! :D
[Fire HD 8 and HD 10 General] Rortiz2:
Hey!

Thanks for your response!

Yup, I looked aswell in the code and seems that addresses are pretty different in maverick. If I recall correctly, those addresses can be readed from a bootrom dump which I think it's possible to dump as I've done in my mt8163 tab (Aquaris_M8):

https://github.com/R0rt1z2/amonet/blob/mt8163-aquaris_m8/modules/load_payload.py#L123

And well, I don't think flash all the FW tought bootrom is a good idea, it would take 1-2~ days lol.

If we know where Amazon patches mtk-su maybe we can downgrade that. I guess it's the kernel? Or the system?

Regards.
[Fire HD 8 and HD 10 General] diplomatic:
First of all, have you guys checked if the BR allows simple SP Flash Tool access without authentication? Why go straight for the back door when the front door might be wide open. I mean, it's not likely, but I wouldn't automatically dismiss it. Other mistakes have been made before.

For developing the payload, every chipset needs it's own offsets, parameters, and possibly algorithms. The ones from mt8163/73 or mt8695 are very unlikely to work. My understanding is getting those values is an incremental, progressive process. It would take more than dumping the BR to solve this.

Lastly, if you can downgrade the boot image, that might enable mtk-su. But I suspect it will cause problems if you mix the new vendor (& system) partitions with an old kernel.
[Fire HD 8 and HD 10 General] Rortiz2:
Nice idea, maybe they missed that. I don't have maverick to try so I can't say anything.

Obviously it's not just dump BR. You will need to open up it with a dissembler to find out needed stuff. Also maybe is not in BR, it can be in other places such as Preloader, etc.

About boot image, why you think that? I mean, in my Austin for example, I can boot Fire OS 5.6.1.0 with 5.4.0 kernel. Yeah, maybe it's different here but we can try.

Regards!
[Fire HD 8 and HD 10 General] diplomatic:
Let's just say I noticed some things during my research...
[Fire HD 8 and HD 10 General] Michajin:
I don't know how to use a SP flash tool, so i don't have any idea on how to check authorizations. I am willing to test it though if you can point me the right direction.
[Fire HD 8 and HD 10 General] Speedracer98:
weird thing is your listing says "Sold by: Amazon.com Services, Inc" when i look at the one i bought it says "Sold by: Amazon Digital Services, Inc." I have a feeling the one u bought was a fake?
[Fire HD 8 and HD 10 General] Rxbird87:
Lol. I clearly said I got it from Amazon warehouse...I'll leave it at that. For everyone who ever got in on any of the Amazon Warehouse sales knows what I'm talking about.

Anyways, just waiting on that root as Amazon has enabled all the crap I disabled and this is just an annoying cycle.
[Fire HD 8 and HD 10 General] SweetBearCub:
Which packages did you disable? Perhaps that's the key to understanding how other packages were re-enabled.
[Fire HD 8 and HD 10 General] Michajin:
What apps did you disable? I have had mine disabled for over a month without any change....

Waiting on root? None of them were on FireOS 7.3.1.0?
[Fire HD 8 and HD 10 General] Rxbird87:
I am using the one I updated before I found this thread. The other ones are confirmed to be on 7.3.1.0 after I found that it could be temp root.
[Fire HD 8 and HD 10 General] Michajin:
"Anyways, just waiting on that root as Amazon has enabled all the crap I disabled and this is just an annoying cycle."

What apps did you have disabled that amazon has enabled?
[Fire HD 8 and HD 10 General] bibikalka:
Man, this is a crazy good discovery! Open Sesame ...

Well, at least flashing kernels via BootRom is a quick operation - it's only 16 Mb. If the older kernel is not stable, should be able to go back to the new one via the same procedure.

With BootRom so readily available, one should be able to unlock this in no time (if LK is vulnerable ...). Where are the heavy hitters (@k4y0z & [MENTION=9667509]xyz`[/MENTION] when you need them ... :(
[Fire HD 8 and HD 10 General] Michajin:
FYI... Using SP Flash tool with Diplomatic
[Fire HD 8 and HD 10 General] bibikalka:
Interesting, I've never seen deals like this every before, given that's it's a very new device. Can you check bootcount on the ones you rooted and post here? I just wonder how many times these Fires were used before. Something like this:

shell@suez:/ $ su
root@suez:/ # idme print
...
product_name: 0
productid: 0
productid2: 0841FFFFFFFFFFFFFFFF
region: US
bootmode: 1
postmode: 0
[b]bootcount: 239[/b]
...
root@suez:/ #
[Fire HD 8 and HD 10 General] davidsummers:
So only oem flags works on a locked device, and it doesn't say anything useful ...
[Fire HD 8 and HD 10 General] Supersonic27543:
Hmm, oem flags... I think it was explored somewhere months ago, but if memory serves me right:

1) It should be restricted (quite sure about this)

2) It allows setting some cmdlines

If this is indeed the case might be very good news, I'm delving into the ancient post history now, let's see what I can dig up!
[Fire HD 8 and HD 10 General] Rortiz2:
Yeah, as already I said, it's not going to be pretty useful.

If someone wants to play a bit, the "usage" of that command should be:

oem flags [<type>: <modifier>] <value>

I'm not sure what are replacing this commands but I don't think it will help with bootloader unlock. Maybe (probably not) any of those commands give us a root shell as append-cmdline did in ford in the past:

https://xdaforums.com/amazon-fire/orig-development/root-t3272362

But I repeat, probably all this stuff has been patched and it's probably a loose of time...

Regards.
[Fire HD 8 and HD 10 General] Rortiz2:
Looked a bit deeper and from what I can tell, it just modifies 3 variables that reside inside the mmcblk0boo1 aka "IDME".

First run idme print in a root shell and look for this 3 variables:

dev_flags: 0
fos_flags: 0
usr_flags: 0

Rebooted to fastboot and ran:

r0rtiz2@r0rtiz2-X540LA:~$ fastboot oem flags 1
... (bootloader) fos_flags set to 1
OKAY [ 0.004s]
finished. total time: 0.004s

Rebooted and ran idme print again. This time the "fos_flags" variable changed to 1:

dev_flags: 0
fos_flags: 1
usr_flags: 0

This has been tried in my Fire 7 2017 but since maverick bootloader let's us use the oem flags command I guess it will be the same.

So well, unless those flags enable something interesting I think this way it's a no-go;) Better to go for amonet/kamakiri.

Regards.
[Fire HD 8 and HD 10 General] davidsummers:
Only useful command on that tread was

Which for me is locked. May see if I can download the boot partitions, and see what they contain ...

Oh yes using

I can set usr_flags; but what this sets isn't clear. Also can't do a

only a

- so not clear if the flags make it through to boot. I don't have an idme command ....
[Fire HD 8 and HD 10 General] Rortiz2:
Thanks for testing out:) As expected, that command has been patched.

Are you on 7.3.1.0 or 7.3.1.1?

Can you try this commands:

fastboot oem flags dev_flags:1
fastboot oem flags fos_flags:1
fastboot oem flags usr_flags:1

Regards!
[Fire HD 8 and HD 10 General] davidsummers:
I think I'm on 7.3.1.1 the only command that runs is the usr_flags, the others give locked device.
[Fire HD 8 and HD 10 General] Rortiz2:
Yup so nothing to do:)

As amazon says: usr_flags: # User controllable flags (privilege not required to set)

Is the only flag that can be edited and it doesn't has nothing interesting.

With idme command I mean:

adb shell idme

. Not sure what you where trying. Probably without root shell you can't use the idme command.

Maybe other option would be read directly the variables from /proc. If you want to give a try:

adb shell cat /proc/idme/fos_flags <--- This should print the actual fos_flags that should be 0x0 (0)

adb shell cat /proc/idme/dev_flags <--- Same as fos_flags, should print 0x0 (0)

adb shell cat /proc/idme/usr_flags <--- This should print the variable that we can modify

As always, this doesn't has anything to do with root/bootloader unlock.

Regards!
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
I got the boot images from [MENTION=8132642]diplomatic[/MENTION]'s [URL="https://xdaforums.com/hd8-hd10/general/fire-hd10-2019-t3979343/post81221725]post[/URL] and I patched the images with Magisk. Only use for Fire HD 10 (Maverick) running Fire OS 7.3.1.0.

Instructions in ReadMe.txt text file included in this file.
[Fire HD 8 and HD 10 General] bibikalka:
This is dangerous !!! :mad: If people flash this and inevitably brick their tablet, they won't have any means to recover right now!!!

The stock recovery in hd10 2019 does not allow sideloading stock roms anymore like in the previous models!!!
[Fire HD 8 and HD 10 General] WhaleWithWings:
****, I just got a new Fire HD and I let it update, before seeing this post. Anything I can do? If I were to get another one, is there anyway to prevent it from updating? I didn't see a way to do so, but I wasn't looking for it either.
[Fire HD 8 and HD 10 General] Michajin:
no downgrade available at this time, yes you would need another one if you want to have root currently. yes you can prevent it from updating a few ways. One is to not to connect to wifi (select network then cancel before you add password, go back and skip is avaialble). Then enable ADB from developers settings, then block OTA's
[Fire HD 8 and HD 10 General] peachpuff:
I was in the same boat and i just returned it and got another one, disabled wifi and the update ota's lol
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=9817022]Kctucka[/MENTION], you might want to update the link on the OP to point to the head of one of my temp root threads. And maybe have a separate link to the bootless root guide. The HD10 support is included in the latest mtk-su release.
[Fire HD 8 and HD 10 General] Kctucka:
Done! Thanks for the great work.
[Fire HD 8 and HD 10 General] Wizard12911:
Man, after years of owning non rooted devices I was excited to get into it again, but sadly I let it update lol. Can anyone tell me if bootless root will be updated to work with new firmware ,or is it a more daunting task for some reason? Just curious. Glad to see some support for the new hd10
[Fire HD 8 and HD 10 General] RaNDoMFaQa:
from what i've gleaned, that's not likely, but once it's fully rooted, the situation could change. temporary root means you can extract the partition data. so that's good for developers. return the device for a differant colour and then you should read the thread before you charge it.
[Fire HD 8 and HD 10 General] LordSimal:
Am I correct in the assumption, that

a way how to unlock the bootloader has to be found so

a custom recovery can be installed (like TWRP) and therefore

a way how to root and/or install other ROMs is available

I think I'm not the only one who is kind of sick of the "Amazon Android" which is currently running the tablet.

Even though the Amazon Fire Toolbox removes most of the unnecessary apps and restores some default Android functionality I personally still have problems with some "special" Apps like Nextcloud (but only on the Tablet, not on any other Android devices I have)

I just wanted to ask that because I am curious about the process how this works.
[Fire HD 8 and HD 10 General] DB126:
Largely correct. Each step faces technical and resource hurdles with the first typically being the most challenging.
[Fire HD 8 and HD 10 General] Rxbird87:
https://www.amazon.com/gp/offer-lis...igital_storage_capacity=all&mv_style_name=all

Back again for 35$. Been busy modding car to add this into it. I will post up the boot count when i get a chance. I still havent bothered with temp root yet.

Even though the condition says used - good. They look pretty darn new to me.
[Fire HD 8 and HD 10 General] newnewcomputer:
Swap file n swappiness setting for Fire HD10 2019

tiny swap file n 100 swappiness have been two of many reasons why fire tablets are considered slow n laggy.

w/ root by [MENTION=8132642]diplomatic[/MENTION], i check n happy to report that Fire HD10 2019 has a 512MB zram partition set up for swap n swappiness is set @ 60, the linux default. so that should be good for general use.

the only oddity is that the swap file priority is set to -1 but shouldnt matter as there is just one. u will have to change that if u want to create a second swap file elsewhere.

i did change swappiness on mine to 20 as thats what I used w/ my HD8 2018 n had good experience. i used apps2sd to change it be4 but cuz' of the locked bootloader here, i decide to do it manually by adding a line in the suboot file:

sysctl -w vm.swappiness=xxx

where xxx is a number between 0 and 100; in my case 20. the line must be added after the magisk scripts for root are complete. it will be executed during the next reboot.

thought i would share this tidbit here :)

boot count seems to be stuck at 0 after multiple reboots.

perhaps it is not implemented in the fire OS.
[Fire HD 8 and HD 10 General] DB126:
Yep, right on the money! I have been tweaking ZRAM and/or static swap file settings on rooted Amazon devices for years to great effect. Especially beneficial in low RAM gizmos with limited CPU capacity for compression & decompression (like the Fire 7). Thanks for posting. :)
[Fire HD 8 and HD 10 General] dr_docdoc:
I don't know anything about this, but it sounds like it can increase the performance of my devices.

One question, if I follow the instructions, will the change "stick" and be persistent--even if I DO NOT run bootless root the next time (makes a permanent change to how the system runs regardless if root is loaded again or not on the next boot)?

Thanks!
[Fire HD 8 and HD 10 General] newnewcomputer:
welcome - just sharing something w the community who has provided soooooo much to us all!

not sure i follow - the sysctl command requires root to execute. thats why i added the line in suroot.sh after the magisk scripts which is part of the bootless root.

previous change to swappiness setting doesnt stick after a reboot. if u dont run the bootless root script, there is no root n u cant change the setting. the swap file will still be there w/ swappiness set at 60. for most usages, its probably fine. changing it to 20 is my personal choice. i just posted in case anyone wants to experiment w/ it.
[Fire HD 8 and HD 10 General] DB126:
Nope - need persistent root and a 'helper' app (often a kernel manager) to reinitialize virtual memory settings on boot.
[Fire HD 8 and HD 10 General] wings516:
So am I correct in thinking that this doesn't allow us to install Magisk/TWRP for a permanent method yet?
[Fire HD 8 and HD 10 General] Kctucka:
Magisk can be installed to obtain Bootless Root, if you follow the linked instructions. It's relatively permanent, but Root doesn't start at boot, so there may be some issues with modules there.

The other limit is that you can't modify the system partition since the bootloader is locked, and dm verity is enabled.

Because the bootloader is locked, you can't modify the recovery partition either, so no TWRP.
[Fire HD 8 and HD 10 General] newnewcomputer:
not sure how frequent (if ever) Amazon will override the pm disable on its OTA package n getting tired of checking it in terminal every time (i didnt really keep the tablet in airplane mode!)...here is a dumb way to ensure the pm disable status - by adding this line into suboot.sh:

pm disable-user --user 0 com.amazon.device.software.ota

as usual, it has to be added after root has been obtained by the Magisk scripts. consider it an insurance n peace of mind while we wait 4 the bootloader hack :fingers-crossed:
[Fire HD 8 and HD 10 General] bobjackson.other:
Seems like the update stream on this thread has slowed to a crawl. Is there a secondary site that is working on native android on the Fire HD 10 . Just looking to help/follow the work.
[Fire HD 8 and HD 10 General] newnewcomputer:
given the Fire HD tablets are primarily for US and Europe, xda is the best (n probably only) place to follow any un-lock progress. its way too early to expect custom ROM - bootloader unlock n custom recovery need to come 1st

in the meantime, w/ the "temp" root blocking OTA update/ads n using nova launcher, i have been very happy with its performance.

just relax n enjoy ur tablet while waiting 4 further unlock :)
[Fire HD 8 and HD 10 General] bobjackson.other:
I agree. Just coming home to this thread was exciting for me (yes, that is sad). I am definitely patiently waiting... Just need to find something else to come home and be excited about...

Thanks for your response and I like the meme.
[Fire HD 8 and HD 10 General] HeaDekBatHblu:
We have discussion about fire hd 10 2019 on Russian 4PDA forum.