[Fire HD 8 and HD 10 General] Azaze666:
Amazon did what? Kill Brom? No guys i have to disagree:

I'm on Fire HD8 2018 FireOS 7.3.2.7, here is what i tried:

i first tried MTK-bypass with the tab, triggering the click on the mobo, it did nothing, so i tried mtkclient (yes people said amazon doesn't use seccfg and? i don't care), note preloader on the command was extracted from my stock firmware exact version:

python3 mtk da seccfg unlock --preloader '/home/x/Scaricati/preloader.bin'

MTK Flash/Exploit Client Public V2.0.0 Beta (c) B.Kerler 2018-2023

Preloader - Status: Waiting for PreLoader VCOM, please reconnect mobile to brom mode

Port - Hint:

Power off the phone before connecting.

For brom mode, press and hold vol up, vol dwn, or all hw buttons and connect usb.

For preloader mode, don't press any hw button and connect usb.

If it is already connected and on, hold power for 10 seconds to reset.

....Port - Device detected :)

Preloader - CPU: MT8163()

Preloader - HW version: 0x0

Preloader - WDT: 0x10007000

Preloader - Uart: 0x11002000

Preloader - Brom payload addr: 0x100a00

Preloader - DA payload addr: 0x201000

Preloader - CQ_DMA addr: 0x10212c00

Preloader - Var1: 0xb1

Preloader - Disabling Watchdog...

Preloader - HW code: 0x8163

Preloader - Target config: 0x5

Preloader - SBC enabled: True

Preloader - SLA enabled: False

Preloader - DAA enabled: True

Preloader - SWJTAG enabled: True

Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False

Preloader - Root cert required: False

Preloader - Mem read auth: False

Preloader - Mem write auth: False

Preloader - Cmd 0xC8 blocked: False

Preloader - Get Target info

Preloader - BROM mode detected.

Preloader - HW subcode: 0x8a00

Preloader - HW Ver: 0xcb00

Preloader - SW Ver: 0x1

Preloader - ME_ID: 06D714A0ACFA2E68EFA696CD633970F0

DA_handler - Device is protected.

DA_handler - Device is in BROM-Mode. Bypassing security.

PLTools - Loading payload from mt8163_payload.bin, 0x258 bytes

Exploitation - Kamakiri Run

Exploitation - Done sending payload...

PLTools - Successfully sent payload: /home/x/Scaricati/mtkclient-1.52/mtkclient/payloads/mt8163_payload.bin

Port - Device detected :)

DALegacy - Uploading legacy da...

DALegacy - Uploading legacy stage 1 from MTK_DA_V5.bin

legacyext - Legacy DA2 is patched.

legacyext - Legacy DA2 CMD F0 is patched.

Preloader - Jumping to 0x200000

Preloader - Jumping to 0x200000: ok.

DALegacy - Got loader sync !

DALegacy - Reading nand info

DALegacy - Reading emmc info

DALegacy - ACK: 0402a1

DALegacy - Setting stage 2 config ...

DALegacy - DRAM config needed for : 00000000000000000000000000000000

DALegacy

DALegacy - [LIB]: OK (0x0)

That said i went to try the amonet exploit:

sudo ./bootrom-step.sh

[2024-05-31 23:32:23.287918] Waiting for bootrom

[2024-05-31 23:32:43.628677] Found port = /dev/ttyACM0

[2024-05-31 23:32:43.629032] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2024-05-31 23:32:47.635403] Init crypto engine

[2024-05-31 23:32:47.653290] Disable caches

[2024-05-31 23:32:47.653576] Disable bootrom range checks

[2024-05-31 23:32:47.665527] Load payload from ../brom-payload/build/payload.bin = 0x4888 bytes

[2024-05-31 23:32:47.666437] Send payload

[2024-05-31 23:32:48.329015] Let's rock

[2024-05-31 23:32:48.329970] Wait for the payload to come online...

[2024-05-31 23:32:48.861079] all good

[2024-05-31 23:32:48.861963] Check GPT

Traceback (most recent call last):

File "/home/x/Scaricati/amonet/modules/main.py", line 213, in <module>

main()

File "/home/x/Scaricati/amonet/modules/main.py", line 124, in main

switch_user(dev)

File "/home/x/Scaricati/amonet/modules/main.py", line 80, in switch_user

block = dev.emmc_read(0)

^^^^^^^^^^^^^^^^

File "/home/x/Scaricati/amonet/modules/common.py", line 193, in emmc_read

raise RuntimeError("read fail")

RuntimeError: read fail

I was unable to initialize emmc but i can enter brom and watchdog didn't kick me out, I honestly think that unlocking bootloader is still possible.