[Fire HD 8 and HD 10 General] Azaze666:
View attachment 6111192

Yes you are not dreaming, It's not true that Amazon has killed brom, (for models made before 2020 i think) I found a way to use amonet exploit on new firmware versions. Mali GPU exploit is not needed anymore. But let's get into the detail. A side note first, entering brom is tricky, you may need many tries to get in it, 99% of the times you will surely get in preloader, continue to try. First of all you have to run MTKClient with the tablet in brom mode, to put it in brom, open the tablet, disconnect the battery and short on the motherboard the click spot with ground using a paperclip or something like that as shown here:

(image is not mine, if the author wants, he can tell me and i will add credits). Anyway while shorting connect the tab to the pc, MTKClient will start to work. If it stucks on disabling watchdog means the device is on preloader: Disconnect the device, press ctrl+c and try everything again, if everything is correct this will be the output:

....Port - Device detected :)
Preloader - CPU: MT8163()
Preloader - HW version: 0x0
Preloader - WDT: 0x10007000
Preloader - Uart: 0x11002000
Preloader - Brom payload addr: 0x100a00
Preloader - DA payload addr: 0x201000
Preloader - CQ_DMA addr: 0x10212c00
Preloader - Var1: 0xb1
Preloader - Disabling Watchdog...
Preloader - HW code: 0x8163
Preloader - Target config: 0x5
Preloader - SBC enabled: True
Preloader - SLA enabled: False
Preloader - DAA enabled: True
Preloader - SWJTAG enabled: True
Preloader - EPP_PARAM at 0x600 after EMMC_BOOT/SDMMC_BOOT: False
Preloader - Root cert required: False
Preloader - Mem read auth: False
Preloader - Mem write auth: False
Preloader - Cmd 0xC8 blocked: False
Preloader - Get Target info
Preloader - BROM mode detected.
Preloader - HW subcode: 0x8a00
Preloader - HW Ver: 0xcb00
Preloader - SW Ver: 0x1
Preloader - ME_ID: 06D714A0ACFA2E68EFA696CD633970F0
DA_handler - Device is protected.
DA_handler - Device is in BROM-Mode. Bypassing security.
PLTools - Loading payload from mt8163_payload.bin, 0x258 bytes
Exploitation - Kamakiri Run
Exploitation - Done sending payload...
PLTools - Successfully sent payload: /home/x/Scaricati/mtkclient-1.52/mtkclient/payloads/mt8163_payload.bin
Port - Device detected :)
DALegacy - Uploading legacy da...
DALegacy - Uploading legacy stage 1 from MTK_DA_V5.bin
legacyext - Legacy DA2 is patched.
legacyext - Legacy DA2 CMD F0 is patched.
Preloader - Jumping to 0x200000
Preloader - Jumping to 0x200000: ok.
DALegacy - Got loader sync !
DALegacy - Reading nand info
DALegacy - Reading emmc info
DALegacy - ACK: 0402a1
DALegacy - Setting stage 2 config ...
DALegacy - DRAM config needed for : 00000000000000000000000000000000
DALegacy
DALegacy - [LIB]: OK (0x0)

if MTKClient says EMI Code not accepted i would run the process again. If the output is like the one i showed you should be good. Then Run bootrom-step.sh and after this, connect battery, disconnect the device from pc and do the trick to put the device in brom again shorting click with ground using a paperclip and in the meantime connect the usb cable, what matters is that the device shouldn't lose electrical power, if it does watchdog state will be resetted. If you did everything correctly bootrom-step.sh will detect the device again and the exploit will (or should after some tries) go flawessly, let me show the output:

sudo ./bootrom-step.sh
[2024-06-06 01:09:55.945583] Waiting for bootrom
[2024-06-06 01:12:15.694420] Found port = /dev/ttyACM0
[2024-06-06 01:12:15.695033] Handshake
[2024-06-06 01:12:15.695761] Disable watchdog

* * * Remove the short and press Enter * * *

[2024-06-06 01:12:17.235164] Init crypto engine
[2024-06-06 01:12:17.253422] Disable caches
[2024-06-06 01:12:17.253901] Disable bootrom range checks
[2024-06-06 01:12:17.270075] Load payload from ../brom-payload/build/payload.bin = 0x45C0 bytes
[2024-06-06 01:12:17.272094] Send payload
[2024-06-06 01:12:18.073671] Let's rock
[2024-06-06 01:12:18.074447] Wait for the payload to come online...
[2024-06-06 01:12:19.136395] all good
[2024-06-06 01:12:19.136755] Check GPT
[2024-06-06 01:12:19.501153] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 53016543)}
[2024-06-06 01:12:19.501357] Check boot0
[2024-06-06 01:12:19.775889] Check rpmb
[2024-06-06 01:12:19.985173] Downgrade rpmb
[2024-06-06 01:12:19.987184] Recheck rpmb
[2024-06-06 01:12:20.881263] rpmb downgrade ok
[2024-06-06 01:12:20.881518] Flash lk-payload
[4 / 4]
[2024-06-06 01:12:21.241442] Flash preloader
[288 / 288]
[2024-06-06 01:12:27.680495] Flash tz
[6732 / 6732]
[2024-06-06 01:14:51.960182] Flash lk
[685 / 685]
[2024-06-06 01:15:06.881561] Inject microloader
[4 / 4]

The device should reboot to hacked fastboot. After this run: sudo ./fastboot-step.sh

sudo ./fastboot-step.sh
Sending 'boot' (12686 KB) OKAY [ 0.520s]
Writing 'boot' OKAY [ 0.576s]
Finished. Total time: 1.138s
Sending 'recovery' (12686 KB) OKAY [ 0.516s]
Writing 'recovery' OKAY [ 0.609s]
Finished. Total time: 1.133s
Rebooting into recovery OKAY [ 0.002s]
Finished. Total time: 0.203s

If you don't see the recovery in a few seconds, try pressing the power button twice

After this you can either follow the original amonet guide and downgrade to 6.3.0.0 flashing:https://mega.nz/#!FI1HSI5T!2zUAeiW9I-eH3Ph0Ar10_2nioNIm0ilSnNYgOG9YPNE or flash lineage, if you flash stock and magisk (you can flash latest one) flash finalize to remove amazon unwanted stuff:https://xdaforums.com/attachments/finalize-zip.4694754/

Credits for every file on this guide and the original amonet exploit belongs to @xyz` i only "own" (if we can say that) the watchdog bypass method discovery, MTKClient belongs to https://github.com/bkerler

Obliviously use the old amonet after MTKClient:https://github.com/bkerler/mtkclient (I'd suggest you to git clone it rather than using the one from releases which is outdated) for this method:https://xdaforums.com/attachments/amonet-v2-tar.4696148/

Here the amonet I used, the exact files, I packed them and uploaded:https://xdaforums.com/attachments/amonet-i-used-zip.6114493/

Proof that I was indeed on FireOS 7.3.2.7:https://xdaforums.com/data/video/4564/4564220-aa34bb76cb635a76cf947e09f3c05401.mp4

Spoiler content hidden.