[Fire HD 6 and 7 General] Rortiz2:
Read this whole guide before starting.

This is for the 4th gen Fire HD6 / HD7 (ariel).

Current relase: amonet-ariel-v1.1

NOTE: To update to the current release if you are already unlocked, just flash the zip in TWRP.

NOTE: This process will modify the partition-table (GPT) of your device but WON'T WIPE userdata.

Requirements:​

A Linux installation or live-system (if using the preloader way).

A MicroUSB cable to connect the tablet to the computer.

​

Instructions for people with TWRP / Cyanogenmod Recovery:​

NOTE: If you don't have TWRP installed but FireOS is still accessible, follow instructions on

this thread

.

Download the latest amonet package from the attachments section of this post.

Copy the ZIP to the internal storage of the device or copy the file to an USB storage.

If you haven't already, make sure to update to TWRP 3.0.2 (or flash this image to recovery).

Reboot the device to TWRP, go to the Install section and choose the previously copied amonet ZIP.

Wait for the ZIP to flash. If unlocked successfully, device will reboot to TWRP 3.1.1-0.

Instructions for people with no TWRP / Unbricking:​

NOTE: If you use this method to unlock the device you don't need to flash the unlock-zip previously linked.

NOTE: This will only work with < 5.3.1.0 bootloaders. Anything newer will cause the script to fail (won't work).

Download the latest amonet package from the attachments section of this post.

Extract the ZIP file and open a terminal in the output folder.

Prepare the environment, disable modemmanager and install the required packages:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

If you're on the latest FireOS version and the stock recovery is accessible, sideload the FireOS 4.5.3 stock firmware.

Start the script with the sudo ./bootrom-step.sh command and connect the tablet (turned off) to the PC.

If you get could not open port /dev/ttyACM0 or similar,

read the second post

.

Once the script finishes, the device should reboot to hacked fastboot mode. Then finish by using sudo ./fastboot-step.sh and press enter.

Wait for the script to finish. If unlocked successfully, device will boot to TWRP 3.1.1-0.

Going back to stock:​

NOTE: This method requires you to be running a ROM with SuperSU installed, otherwise it won't work.

NOTE: This will downgrade your bootloaders to 4.5.3, restore the original GPT layout but keep TWRP 3.1.1.

Download the latest amonet package from the attachments section of this post.

Extract the ZIP file and open a terminal in the output folder.

Prepare the environment, disable modemmanager and install the required packages:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

Connect your device to the PC and make sure ADB is enabled.

In the previously opened terminal, run sudo ./return-to-stock.sh and press enter.

Once you're back to TWRP, flash FireOS 4.5.3 (+ SuperSU) or use my prerooted FireOS 5 based ROM.

DO NOT FLASH ANYTHING ELSE AS YOU'LL BRICK THE DEVICE.

Important information:​

NOTE: This has nothing to do with the unlock process, it's merely informative.

In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.

TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

This device has no BootROM mode as it has been disabled by Amazon. Attempting to short random pins will only kill the device completely, so do not even try to open it. If you erase TEE1/TEE2 or corrupt your GPT, the device will hard brick, rendering it irreparable.

For developers, UART access is available through the JDEBUG pads, as illustrated in the attached pictures for HD6 and HD7. By default, kernel logs are not displayed to UART since this is disabled by LK.

However, with the exploit installed, you can forcefully enable them by flashing a custom MISC image. You can generate (and flash) this image using the following command(s):

dd if=/dev/zero of=misc-uart.bin bs=1 count=32
echo -ne "UART_PLEASE" | dd of=misc-uart.bin bs=1 seek=16 conv=notrunc
fastboot flash MISC misc-uart.bin

It is still advised to disable OTA.

​

Contributors:​

@Rortiz2

@bibikalka

@k4y0z
​

Additional thanks to:​

@kip_dynamite - for his generous (device) donation, HD6 work has been possible thanks to him.

@xyz` - for making all this possible and releasing the original amonet exploit for karnak.

@spenceboy98 - for building TWRP 3.0.2 for ariel. His trees helped me boot a newer TWRP image.

@powerpoint45 - for finding the correct UART (TX) pin. It was very similar on the HD7 and without UART I wouldn't have been able to debug the exploit.
​

Source code:​

https://github.com/R0rt1z2/amonet/tree/mt8135-ariel

https://github.com/amazon-oss/android_bootable_recovery

https://github.com/amazon-oss/android_device_amazon_ariel

https://github.com/amazon-oss/android_device_amazon_mt8135-common