[Fire HD 8 and HD 10 Original Android Development] Rortiz2:
Read this whole guide before starting.

This is for the 5th gen Fire HD10 / HD8 (thebes / memphis).

Current relase: amonet-thempis-v1.1

NOTE: This has only been tested on the HD8 2015, however, it should work with the HD10 2015 as well.

NOTE: To update to the current release if you are already unlocked, just flash the zip in TWRP.

NOTE: This process will modify the partition-table (GPT) of your device but WON'T WIPE userdata.

Requirements:​

A Linux installation or live-system.

A MicroUSB cable to connect the tablet to the computer.

Unlocking / Unbricking:​

NOTE: Downgrading will temporarily brick your device, this is expected and a good sign.

NOTE: If your device is bricked already you can try to do skip to step 5 directly.

Download the latest amonet package from the attachments section of this post.

Extract the ZIP file and open a terminal in the output folder.

Prepare the environment, disable modemmanager and install the required packages:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

Reboot to the stock recovery and sideload the FireOS 5.0.1 stock firmware (this will temporarily brick your device).

Start the script with the until sudo ./bootrom-step.sh; [ $? -ne 1 ]; do :; done command, connect the device to the PC and hit "Reboot now".

If you get could not open port /dev/ttyACM0 or similar,

read the second post

.

Once the script finishes, the device should reboot to hacked fastboot mode. Then finish by using sudo ./fastboot-step.sh and press enter.

Wait for the script to finish. If unlocked successfully, device will boot to TWRP 3.1.1-0.

Important information:​

NOTE: This has nothing to do with the unlock process, it's merely informative.

In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.

TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

This device has no BootROM mode as it has been disabled by Amazon. Attempting to short random pins will only kill the device completely, so do not even try to open it. If you erase TEE1/TEE2 or corrupt your GPT, the device will hard brick, rendering it irreparable.

For developers, UART can be forcefully enabled by flashing a custom MISC image. You can generate (and flash) this image using the following command(s):

dd if=/dev/zero of=misc-uart.bin bs=1 count=32
echo -ne "UART_PLEASE" | dd of=misc-uart.bin bs=1 seek=16 conv=notrunc
fastboot flash MISC misc-uart.bin

It is still advised to disable OTA.

​

Contributors:​

@Rortiz2

@k4y0z
​

Additional thanks to:​

@Interval0043 and @ToadCultist - for testing the exploit on the Amazon Fire HD8 2015.

@xyz` - for making all this possible and releasing the original amonet exploit for karnak.
​

Source code:​

https://github.com/R0rt1z2/amonet/tree/mt8135-thempis

https://github.com/amazon-oss/android_bootable_recovery

https://github.com/amazon-oss/android_device_amazon_thempis

https://github.com/amazon-oss/android_device_amazon_mt8135-common