×
FORUMS
Remove All Ads from XDA

[UNLOCK][ROOT][TWRP][UNBRICK][DOWNGRADE] any Fire 7.

756 posts
Thanks Meter: 830
 
By k4y0z, Senior Member on 13th February 2019, 07:10 PM
Post Reply Email Thread
Page 1 of 113 1 2 3 11 51 101 Last
Read this whole guide before starting.

This is for the 5th gen Fire and 7th gen Fire

Current Version
5th gen: amonet-ford-v1.4.1.zip
7th gen: amonet-austin-v1.4.1.zip

What you need:
  • A Linux installation or live-system
  • A micro-USB cable

If your Fire is on a newer preloader-version (or a 7th gen) you may also need:
  • Something conductive (paperclip, tweezers etc)
  • Something to open the tablet.

There is an alternative for opening the tablet (only 5th gen), which is described below.

Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
Code: 
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot
Make sure ModemManager is disabled or uninstalled:
Code: 
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)

If you're lucky and have an old preloader (Up to FireOS 5.3.2, thanks @MontysEvilTwin), you can just hold the left volume button while plugging the device in.
If you're on a newer preloader, there are two options:
  1. Open the device and short the pin marked in the attached photo to ground while plugging in.
  2. (Only 5th gen) Downgrade to 5.0.1 firmware via adb sideload in Amazon recovery, then proceed to use the left volume button to enter boot-rom.

NOTE: Using option two will brick your device until you have successfully finished the process.

1. Extract the attached zip-file "amonet-ford-v1.4.1.zip" (use "amonet-austin-v1.4.1.zip" for 7th gen) and open a terminal in that directory.
2. start the script:
Code: 
sudo ./bootrom-step.sh
It should now say Waiting for bootrom.

3. If you have an old preloader or used option 2 above:
Hold the left volume-button and plug the device in.
If you chose option 1, short the device according to the attached photo and plug it in.

NOTE: Make sure the device is powered off, before plugging it in.

NOTE: If you have issues getting a 7th gen into bootrom, read this post by @hwmod

NOTE: For hints, how to access the pins on a 7th gen without removing the shield, check Post 1075 by @shelleyfrank

NOTE:

In lsusb the boot-rom shows up as:
Code: 
Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone
If it shows up as:
Code: 
Bus 002 Device 014: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.

dmesg lists the correct device as:
Code: 
[ 6383.962057] usb 2-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00

4. When the script asks you to remove the short, remove the short and press enter.

5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.

6. Your device should now reboot into unlocked fastboot state.

7. Run
Code: 
sudo ./fastboot-step.sh
8. Wait for the device to reboot into TWRP.

9. Use TWRP to flash custom ROM, Magisk or SuperSU

To return back to stock, Go into hacked fastboot-mode, then run
Code: 
sudo ./stock-recovery.sh
Your device should reboot into amazon recovery. Use adb sideload to install stock image from there.

NOTE:
Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
your device will likely not boot anymore (unless you flashed a signed image).
TWRP will patch recovery/boot-images on the fly.

NOTE:
fastboot-step flashes the 5.6.3 boot.img, if your device hangs at the orange fire logo, try wiping cache first.
If that doesn't help, your system is probably incompatible with that image, just flash the right boot.img via TWRP.


NOTE:
This process does not disable OTA or does any other modifications to your system.
You will have to do that according to the other guides in this forum.


Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Thanks also to @ANDROID2468 and @bibikalka for testing things.
Thanks to @mateo121212 and @hwmod for debugging 7th gen.
Thanks to @MontysEvilTwin for figuring out volume-button access works up to FireOS 5.3.2, and for figuring out that 5.3.2 PL/TZ fix prime video.
Attached Thumbnails
Click image for larger version Name: fire7-brom.jpg Views: 16730 Size: 106.2 KB ID: 4704934   Click image for larger version Name: 7th-gen-bootrom.jpg Views: 16542 Size: 154.8 KB ID: 4706230  
Attached Files
File Type: zip amonet-fire7-v1.2.zip - [Click for QR Code] (18.68 MB, 1890 views)
File Type: zip amonet-fire7-7th-gen-v1.2.1.zip - [Click for QR Code] (19.01 MB, 2282 views)
File Type: zip amonet-ford-5th-gen-v1.3.zip - [Click for QR Code] (18.76 MB, 662 views)
File Type: zip amonet-ford-v1.4.zip - [Click for QR Code] (14.21 MB, 276 views)
File Type: zip amonet-austin-v1.4.zip - [Click for QR Code] (14.41 MB, 314 views)
File Type: zip amonet-ford-v1.4.1.zip - [Click for QR Code] (14.21 MB, 6182 views)
File Type: zip amonet-austin-v1.4.1.zip - [Click for QR Code] (14.41 MB, 7740 views)
Submit to XDA Portal Quick Reply Reply
The Following 81 Users Say Thank You to k4y0z For This Useful Post: [ View ] Gift k4y0z Ad-Free
 
 
13th February 2019, 07:11 PM |#2  
OP Senior Member
Thanks Meter: 830
 
Donate to Me
More
Features.
  • Uses 5.3.2 Preloader/TZ for easy access to bootrom (using left volume button/only 5th gen)
  • Uses 5.6.3 LK for full compatibility with newer kernels.
  • Hacked fastboot mode lets you use all fastboot commands (flash etc).
  • Boots custom/unsigned kernel-images (need to be patched)
  • Sets androidboot.unlocked_kernel=true (enables adb root-shell)
  • For the devs: sets printk.disable_uart=0 (enables debug-output over UART).

NOTE: Hacked fastboot can be reached via TWRP.

NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
Use TWRP for autopatching.
Attached Thumbnails
Click image for larger version Name: amonet.jpeg Views: 4324 Size: 109.8 KB ID: 4704941   Click image for larger version Name: hacked-fastboot.jpeg Views: 4352 Size: 60.4 KB ID: 4704942   Click image for larger version Name: hacked-bl.jpeg Views: 4272 Size: 10.3 KB ID: 4705075   Click image for larger version Name: twrp.jpeg Views: 3842 Size: 81.7 KB ID: 4705076  
Submit to XDA Portal Quick Reply Reply
The Following 19 Users Say Thank You to k4y0z For This Useful Post: [ View ] Gift k4y0z Ad-Free
13th February 2019, 07:12 PM |#3  
OP Senior Member
Thanks Meter: 830
 
Donate to Me
More
Version 1.4 (25.03.2019)
  • Update TWRP to twrp-9.0 sources
  • Implement downgrade-protection for LK/PL/TZ
  • Add scripts to enter fastboot/recovery in case of bootloop
  • Automatically restore boot-patch when you boot into recovery

Version 1.3 (20.03.2019)Version 1.2.1 (17.02.2019)
  • Fix bug in 7th gen.

16.02.2019
  • Now also unlock for the 7th gen

Version 1.2 (14.02.2019)
  • Updated TWRP to contain new microloader..
  • Added TWRP shell command reboot-amonet to reboot into hacked fastboot.

Version 1.1 (14.02.2019):
  • Fixed bug, caused when flashing large images via hacked fastboot.
  • Include stock recovery.img and script to flash back.

Source Code:
https://github.com/chaosmaster/amonet
https://github.com/chaosmaster/andro...table_recovery
Submit to XDA Portal Quick Reply Reply
The Following 11 Users Say Thank You to k4y0z For This Useful Post: [ View ] Gift k4y0z Ad-Free
13th February 2019, 07:35 PM |#4  
Rortiz2's Avatar
Senior Member
Flag Terrassa, Barcelona
Thanks Meter: 352
 
More
Ohh thanks!
Submit to XDA Portal Quick Reply Reply
13th February 2019, 09:31 PM |#5  
ANDROID2468's Avatar
Senior Member
Flag Nashville
Thanks Meter: 100
 
More
Anyone who wants to update to the latest FW without undoing the unlock you can get it here

I'm also releasing a customized fire os that I'm calling "fire os revamped" ( comes with nova launcher and other enhancements) it will be on xda soon
edit: here it is.
Sent from my VS986 using XDA Labs
Submit to XDA Portal Quick Reply Reply
13th February 2019, 11:51 PM |#6  
Pix12's Avatar
Senior Member
Thanks Meter: 29
 
More
So I can do this without opening it up if I'm on a newer version?

---------- Post added at 06:44 PM ---------- Previous post was at 06:34 PM ----------

So my 5.1.1 Fire, which I believe was originally on 5.0.1 worked.

---------- Post added at 06:51 PM ---------- Previous post was at 06:44 PM ----------

I mean it worked without having to brick or open it up.
Submit to XDA Portal Quick Reply Reply
14th February 2019, 01:34 AM |#7  
Senior Member
Flag Verona
Thanks Meter: 267
 
More
Quote:
Originally Posted by k4y0z

Read this whole guide before starting.
...

@k4y0z awesome work ! My congratulations again for the great achievement and implementation.
Your solution is letting users revive their "bricks" and make them free to use their gadget as they wishes.

There is still some quirk I have on the 7th Gen tablets with the "microloader" code, though it works well
with the 5th Gen, so I am assuming that something can be improved on the 7th Gen and maybe in general.

Your work opens up to new ROMS and other possible use of the tablet for things I have been dreaming about
for long time, having Linux load from µSDCard, from SSD on OTG or from the network (BOOTP/DHCP/NFS ... ).

I know this will take some time and effort but now more than ever I feel the target objective is on sight.
The first thing would be rebuild a completely modular kernel, maybe a more recent one (4.x).

Quote:

Make sure ModemManager is disabled or uninstalled:

Code: 
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
...

In all Linux OS the correct way for a normal user to gain read/write access to the serial ports (UARTs) is to make himself a member of the "dialup" group.
You can do this by issuing once the following command (two alternatives given here, use only one):
Code: 
sudo adduser MY_USER_NAME dialout
or
Code: 
usermod -a -G dialout MY_USER_NAME
This avoids using "sudo" and having to type password several times to gain permission to access the serial device,
it also solved many issues I was having due to multiple concurrent access to the Serial Ports and/or USB Ports from
various software and devices (Bluetooth, Camera, Phones, Digital Signing, Crypto Cards, Prolific/FTDI serial converters ... ).

And this is another suggestion for those continuously testing phones and tablets ...
To avoid trashing the tablet connectors due to continuous connect/disconnect of the USB cables I highly recommend
using the following type of USB Multiport Hub with power switches or similar (there are both USB 2.0 and USB 3.0 versions)
they are inexpensive and really unique in its type having an on/off switch for every port effectively help to avoid damaging connectors.

Have a good hacking night.

.:HWMOD:.

---------- Post added at 02:34 AM ---------- Previous post was at 02:17 AM ----------

Quote:
Originally Posted by Pix12

So I can do this without opening it up if I'm on a newer version?

---------- Post added at 06:44 PM ---------- Previous post was at 06:34 PM ----------

So my 5.1.1 Fire, which I believe was originally on 5.0.1 worked.

---------- Post added at 06:51 PM ---------- Previous post was at 06:44 PM ----------

I mean it worked without having to brick or open it up.

This is the proof that it was possible to make the hack available to a bigger group of users.
Another big achievement obtained by the awesome @k4y0z though in my tests this is not
always possible yet, more testing will probably reveal the reason and let's improve on that.

This is especially annoying on the 7th Gen tablets but I keep hoping a simpler way would help there.
Disconnecting the battery does the difference at times and that means just removing two small screws.

.:HWMOD:.
Submit to XDA Portal Quick Reply Reply
The Following 4 Users Say Thank You to hwmod For This Useful Post: [ View ] Gift hwmod Ad-Free
14th February 2019, 01:39 AM |#8  
DB126's Avatar
Recognized Contributor
Thanks Meter: 9,105
 
More
Quote:
Originally Posted by k4y0z

Read this whole guide before starting.

This is for the 5th gen Fire.
It can also be used to root a 7th gen, but there are some differences.
It's best you wait for a separate guide how to use this to root your 7th gen.
:
:
Very special thanks to @xyz' for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Thanks also to @hwmod@ANDROID2468 and @bibikalka for testing things.

Outstanding contribution. Clear, concise and relevant to a broad community with appropriate acknowledgements. This is what XDA is all about.
Submit to XDA Portal Quick Reply Reply
The Following 7 Users Say Thank You to DB126 For This Useful Post: [ View ] Gift DB126 Ad-Free
14th February 2019, 01:50 AM |#9  
OP Senior Member
Thanks Meter: 830
 
Donate to Me
More
Quote:
Originally Posted by hwmod

@k4y0z
There is still some quirk I have on the 7th Gen tablets with the "microloader" code, though it works well
with the 5th Gen, so I am assuming that something can be improved on the 7th Gen and maybe in general.

What quirks other than the non-functional screen?
Have you tested what I suggested in the other thread?

Quote:

In all Linux OS the correct way for a normal user to gain read/write access to the serial ports (UARTs) is to make himself a member of the "dialup" group.

That would be the "correct" way of course, I just assumed people where using live-systems, so sudo seems like the easier solution.
Submit to XDA Portal Quick Reply Reply
14th February 2019, 05:00 AM |#10  
Senior Member
Flag Verona
Thanks Meter: 267
 
More
Quote:
Originally Posted by k4y0z

What quirks other than the non-functional screen?
Have you tested what I suggested in the other thread?


That would be the "correct" way of course, I just assumed people where using live-systems, so sudo seems like the easier solution.

Yes I tried to use the file "boot.7th.patched.img" you shared and the UART but the tablet doesn't boot up,
it crashes as soon as the "microloader.bin" is executed, the logs says something like "undefined, aborting"
instead of printing the heading "microloader by xyz. Copyright 2019" as it does with the 5th Gen.
It doesn't print the message "Something went horribly wrong!" that the code print if an error is detected.
It seems the error has to do with a wrong load address, after the error the processor registers are dumped.

Two things I noticed the first shouldn't be a problem but all the image wrappers contains a residual
from the mt8163 platform, the parameters "bootopt=64S3,32N2,32N2". It is present also in "microloader.bin".
I understand that probably it doesn't do anything bad on our Fire mt8127 platform but removing these would
also ensure that possible behaviours are also removed and we don't have that "cmdline" parameter hanging
around without a precise scope.

The second thing is that it seems to me the "boot.7th.patched.img" you shared and asked me to try doesn't
come from version 5.6.3 of the firmware and that may be another point which might break the loading
process and the version mismatches I am seeing on the 7th Gen.

So we don''t have a native "preloader" for the 7th Gen that allow booting images as we have for the 5th Gen so
we are forced to use the one we have from 5th Gen but the we have no matching secondary loader and that
might be another reason we are having a hard time replicating the process that run smoothly on the 5th Gen.

However, even on the 7th we have gained "root" by using the "SuperSu" and also the TWRP seems to be working
well and following that path also the touch screen problems do not show up and everything run natively correct.

Now, what's happen when we face the update route is still unknown, however we will soon learn that since this
evening my 5th Gen downloaded as much as 18 components that needed to be updated on 5.6.3.

I captured them all and have saved the 18 pieces, all are "apk" files, no ".zip" and no ".bin" files.

I am going to download the update version you released today and the patched TWRP and
tomorrow I will restart testing everything again and will let you know if something changes and if there are
further improvements for the 7th Gen.

One request I have is: where can I put more kernel "cmdline" parameters as you did with "printk_disable_uart=0" ?

That's all for now, thank you again for the nice surprises !

.:HWMOD:.
Submit to XDA Portal Quick Reply Reply
14th February 2019, 05:11 AM |#11  
OP Senior Member
Thanks Meter: 830
 
Donate to Me
More
Quote:
Originally Posted by hwmod

Yes I tried to use the file "boot.7th.patched.img" you shared and the UART but the tablet doesn't boot up,
it crashes as soon as the "microloader.bin" is executed, the logs says something like "undefined, aborting"
instead of printing the heading "microloader by xyz. Copyright 2019" as it does with the 5th Gen.
It doesn't print the message "Something went horribly wrong!" that the code print if an error is detected.
It seems the error has to do with a wrong load address, after the error the processor registers are dumped.

Ok that shouldn't happen, it should at least get further than that.
You are testing it with the 5th gen preloader/lk correct?
Maybe I messed something up creating the image.
I have attached a new one from the 7th 5.6.3 firmware.
Please use the new version 1.1 of the package I just updated a few minutes ago.
(It uses different addressing).

Quote:
Originally Posted by hwmod

Two things I noticed the first shouldn't be a problem but all the image wrappers contains a residual
from the mt8163 platform, the parameters "bootopt=64S3,32N2,32N2". It is present also in "microloader.bin".
I understand that probably it doesn't do anything bad on our Fire mt8127 platform but removing these would
also ensure that possible behaviours are also removed and we don't have that "cmdline" parameter hanging
around without a precise scope.

I don't think that will cause any issues, the kernel should at least load and print something to UART.
It's not even loading the microloader correctly. (which should work, since it works for TWRP)

Quote:
Originally Posted by hwmod

One request I have is: where can I put more kernel "cmdline" parameters as you did with "printk_disable_uart=0" ?

I will have to think about that, the flags would need to be stored somewhere.
Sadly the 5.6.3 bootloader doesn't suppoert "oem append-cmdline" anymore.
Attached Files
File Type: zip boot.7th.zip - [Click for QR Code] (4.61 MB, 234 views)
Submit to XDA Portal Quick Reply Reply
The Following User Says Thank You to k4y0z For This Useful Post: [ View ] Gift k4y0z Ad-Free
Post Reply Subscribe to Thread
Page 1 of 113 1 2 3 11 51 101 Last

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread


Top Threads in Fire Android Development by ThreadRank

loading