[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2016 (giza) - Fire HD 8 and HD 10 Original Android Development

Read this whole guide before starting.
This is for the 6th gen Fire HD8 (giza).
Current version: amonet-giza-v1.3.zip
NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
NOTE: This process will modify the partition-table (GPT) of your device.
NOTE: Your device will be reset to factory defaults (including internal storage) during this process.
What you need:
A Linux installation or live-system
A micro-USB cable
Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
1. Extract the attached zip-file "amonet-giza-v1.2.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings.
3. Start the script:
Code:
sudo ./step-1.sh
Your device will now reboot into recovery and perform a factory reset.
NOTE: If your PL/TZ/LK versions are too new, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you don't need to run step-2.sh below:
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
After you have confirmed the bricking by typing "YES", you will need disconnect the device and run
Code:
sudo ./bootrom-step-minimal.sh
Then plug the device back in.
It will then boot into "hacked fastboot" mode.
Then run
Code:
sudo ./fastboot-step.sh
NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"
NOTE: Make sure you re-enable ADB after Factory Reset.
4. Start the script:
Code:
sudo ./step-2.sh
The exploit will now be flashed and your device will reboot into TWRP.
You can now install Magisk from there.
Going back to stock
Extract the attached zip-file "amonet-giza-v1.2.zip" and open a terminal in that directory.
You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.
Just use hacked fastboot to
Code:
sudo fastboot flash recovery bin/recovery.img
If you want to go back completely (including restoring your GPT):
Code:
sudo ./return-to-stock.sh
Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there.
Important information
In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)
Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @xyz` for making all this possible and releasing the original amonet exploit for karnak.
Special thanks also to @k4y0z for making all this possible and porting the exploit to 64 bit devices.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Special thanks also to @lovaduck for all the testing.

Unbricking
If Recovery OR FireOS are still accessible there are other means of recovery, don't continue.
If your device shows one of the following symptoms:
It doesn't show any life (screen stays dark)
You see the white amazon logo, but cannot access Recovery or FireOS.
If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).
Make sure the device is powered off, by holding the power-button for 20+ seconds
Start bootrom-step.sh
Plug in USB
In all other cases you will have to open the device and partially take it apart.
1. Extract the attached zip-file "amonet-giza-v1.2.zip" and open a terminal in that directory.
2. Start the script:
Code:
sudo ./bootrom-step.sh
It should now say Waiting for bootrom.
If you're lucky and have an old preloader (Up to FireOS 5.3.2.0), you can just hold the left volume button while plugging the device in.
If you're on a newer preloader, there are two options:
Open the device and short the marked pin (CLK) in the attached photo to ground while plugging in.
Downgrade to 5.3.1.0 firmware (google drive mirror) via adb sideload in Amazon recovery, then proceed to use the left volume button to enter boot-rom.
NOTE: Using option two may brick your device until you have successfully finished the process.
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it fails at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:
sudo ./fastboot-step.sh
The device should reboot to TWRP. Format data and use TWRP to flash a custom ROM, Magisk or SuperSU.
Checking USB connection
In lsusb the boot-rom shows up as:
Code:
Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone
If it shows up as:
Code:
Bus 002 Device 014: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.
dmesg lists the correct device as:
Code:
[ 6383.962057] usb 2-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.0

Source Code:
https://github.com/R0rt1z2/amonet-giza
https://github.com/R0rt1z2/android_device_amazon_giza
https://github.com/chaosmaster/android_bootable_recovery

Reserved #1

Great job by Roger, everything worked very much at first attempt while I tested. Now I have revived an old tablet that was not in use anymore!
I would advise everybody trying this process to keep in mind that things can always go wrong, but you have nothing to lose anyways. Hack at your own risk.
So good luck with the mod, and again, kudos to @Rortiz2

I get the following when running step 1:
This is only for the "giza" - Amazon Fire HD 8 (2016) - , your device is a "full_giza"
Click to expand...
Click to collapse
Is there much of a difference between the two and if not should I just edit the check in step-1.sh & step-2.sh?

cultofrobots said:
I get the following when running step 1:
Is there much of a difference between the two and if not should I just edit the check in step-1.sh & step-2.sh?
Click to expand...
Click to collapse
Oh well, my fault, let me fix that.
EDIT: Fixed the product check, use the v1.1 package.

Wrong thread.... deleted.

Rortiz2 said:
Oh well, my fault, let me fix that.
EDIT: Fixed the product check, use the v1.1 package.
Click to expand...
Click to collapse
That worked. Thanks.

thankssssss my frind , but i want root for fire hd8 5gen veeeeeerynessry sory bad englash
also i can buy it form you pleassss

789mod said:
thankssssss my frind , but i want root for fire hd8 5gen veeeeeerynessry sory bad englash
also i can buy it form you pleassss
Click to expand...
Click to collapse
Unfortunately, the Amazon Fire HD8 2015 (thebes) uses MT8135 which is pretty different to MT8163. Since I don't own the device, I can't really help you with that.

Rortiz2 said:
Unfortunately, the Amazon Fire HD8 2015 (thebes) uses MT8135 which is pretty different to MT8163. Since I don't own the device, I can't really help you with that.
Click to expand...
Click to collapse
have you any way to root these ) fire HD 10 5gen ?
I need it to my wrok
my work it unlockbootloader

Hi. I have a problem on Step 2
adb: error: cannot stat 'bin/boot0short.img': No such file or directory
Click to expand...
Click to collapse
I checked bin directory and really didn't found boot0short.img. Maybe it should be generated by the script. I checked code and didn't found any other mentions about this file...
What I doing wrong?

sancho_sumy said:
Hi. I have a problem on Step 2
I checked bin directory and really didn't found boot0short.img. Maybe it should be generated by the script. I checked code and didn't found any other mentions about this file...
What I doing wrong?
Click to expand...
Click to collapse
I've updated the main post with the v1.2 version, can you try with that one, please?
(https://forum.xda-developers.com/attachments/amonet-giza-v1-2-zip.5405917/)

Rortiz2 said:
I've updated the main post with the v1.2 version, can you try with that one, please?
(https://forum.xda-developers.com/attachments/amonet-giza-v1-2-zip.5405917/)
Click to expand...
Click to collapse
Now I have a brick...
Dark screen after "Rebooting into TWRP"
Dark screen, device didn't responce on power button...

sancho_sumy said:
Now I have a brick...
Dark screen after "Rebooting into TWRP"
Dark screen, device didn't responce on power button...
Click to expand...
Click to collapse
Bricked after running the 1.2 version? That makes no sense, unless your RPMB was updated. What's the output of "lsusb" when you plug in the tablet to the computer"?

Rortiz2 said:
Bricked after running the 1.2 version? That makes no sense, unless your RPMB was updated. What's the output of "lsusb" when you plug in the tablet to the computer"?
Click to expand...
Click to collapse
Yes. I run Step 2 from 1.2 version.
After "Rebooting into TWRP" screen off and didn't on anymore.
It's not listed in lsusb:
[email protected]:~/Downloads/amonet-giza-v1.2$ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 5986:2113 Acer, Inc Integrated Camera
Bus 001 Device 005: ID 0bda:c024 Realtek Semiconductor Corp. Bluetooth Radio
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Click to expand...
Click to collapse
After plug in to USB dmesg:
usb 1-3: USB disconnect, device number 7
Click to expand...
Click to collapse
Is there any chances to fix it? :-(

sancho_sumy said:
Yes. I run Step 2 from 1.2 version.
After "Rebooting into TWRP" screen off and didn't on anymore.
It's not listed in lsusb:
After plug in to USB dmesg:
Is there any chances to fix it? :-(
Click to expand...
Click to collapse
don't worry
first short your devices after this
2. sudo ./boot-fastboot.sh
the screen still black
after that
unplug your USB write sudo ./ fastboot-step.sh and plug it
and wait 1sec
will successfully..
thank

789mod said:
don't worry
first short your devices after this
2. sudo ./boot-fastboot.sh
the screen still black
after that
unplug your USB write sudo ./ fastboot-step.sh and plug it
and wait 1sec
will successfully..
thank
Click to expand...
Click to collapse
do you have any detailed instruction how to short it?

sancho_sumy said:
do you have any detailed instruction how to short it?
Click to expand...
Click to collapse
before short ,
try this commands
sudo ./boot-fastboot.sh
and wait 3sec
and
sudo ./fastboot-step.sh

Related

[Q] Root Xoom with linux ?

i ditched windows ages ago and i will never look back i am sick and tierd of waiting on moto uk to push ics. i use to have the dell streak and i rooted that but i was on windows then how do i root my xoom with linux mint is it possible and can any point me in the right direction please
Stand by, I will give you all the tools and options you need to do so, I could draft something tomorrow morning.
Sent from my PG86100 using Tapatalk
Thank you megabiteg Still learning linux but i Love it
megabiteg said:
Stand by, I will give you all the tools and options you need to do so, I could draft something tomorrow morning.
Sent from my PG86100 using Tapatalk
Click to expand...
Click to collapse
well, it isn't that hard since everything you really need on your computer ist fastboot and a way to push a file to an sdcard (fat formatted)...
Just go here, download and install the android sdk from there. Make sure the commands adb and fastboot are in your path. (test by issuing adb devices, shold return a list of attached android devices with usb debugging turned on)
After that, just follow these instructions. I am not sure if you need to run fastboot as root, but you'll see
Cheers for the info just by any chance do you know the commands still learning Linux
llama-power said:
well, it isn't that hard since everything you really need on your computer ist fastboot and a way to push a file to an sdcard (fat formatted)...
Just go here, download and install the android sdk from there. Make sure the commands adb and fastboot are in your path. (test by issuing adb devices, shold return a list of attached android devices with usb debugging turned on)
After that, just follow these instructions. I am not sure if you need to run fastboot as root, but you'll see
Click to expand...
Click to collapse
elsworth1983 said:
Cheers for the info just by any chance do you know the commands still learning Linux
Click to expand...
Click to collapse
thought you ditched windows ages ago?
anyhow... don't have linux set up atm, so this will from memory and might contain some errors... Also, never tried mint, I always stuck to debian or debian-derivates...
anyhow, lets try this:
first, use your package management-system to install a jre (java runtime environment.
If that is set up, install the android sdk:
Code:
$ cd ~
$ wget http://dl.google.com/android/android-sdk_r17-linux.tgz
$ sudo su
[enter your su-password]
# cd /usr/local
# tar xfzv ~[yourusername]/android-sdk_r17-linux.tgz
# ./android-sdk-linux/tools/android
a window should open up and list some files available for download. Just select "Android SDK Platform-tools" and hit "Install 1 package...".
once that's finished (might take a while), close the Android SDK Manager and you should get back to your shell.
Code:
# ln -s /usr/local/android-sdk-linux/platform-tools/adb /usr/local/bin/adb
# ln -s /usr/local/android-sdk-linux/platform-tools/fastboot /usr/local/bin/fastboot
# exit
$ rm android-sdk_r17-linux.tgz
now, connect your xoom to your computer and enable usb debugging in the settings of your xoom. If you issue adb devices, you should get something like
Code:
List of devices attached
043c12343456476547 device
if you receive something like bash: adb: command not found, something went wrong somewhere. Try the same using sudo: sudo adb devices if that doesn't fix it please write another post.
Also, if you encounter an error after entering any of the comments above, please do not continue until you resolved that error. (For example ask for a solution here)
And, since you are still learning to use linux: whenever instructions contain a $ or # at the beginning of a line, DO NOT ENTER THESE. They are just there to tell you to issue that command as normal user ($) or superuser (#)
/EDIT: btw: there may be an easier way to do this if you just want to use adb/fastboot this once: you could try to simply download the adb and fastboot- binaries and put these into the folder with your recovery.img-file. Might work, not sure about that, though. Also, since I don't have linux installed on my machine atm, I can't provide you with a link to these binaries.
cheers for all your help will give this a go "Dont want to back to windows
Android SDK manger log
Error Stopping ADB server failed (code-1)
Connected the xoom and did adb devices and it listed the xoom with no errors in the terminal Thank you again ? Were do i go from here now
glad to read it's working
just follow the instructions in this thread That will help you to install a custom recovery and root your xoom. It will not, however, install a custom rom. To do that, you'd also need to download a custom rom (usually comes in a flashable .zip-file), place that on an acutal sd-card which you're gonna put into your xoom, and install that file from within the custom recovery. Just make sure you grab a rom that works with your xoom (for example, you shouldn't put a us-4g-rom onto a wifi-only-xoom and vice versa)
have i done something wrong
god-WE174AA-ABU-s5306uk god # adb reboot bootloader
god-WE174AA-ABU-s5306uk god # fastboot oem unlock
fastboot: command not found
The problem i seem to be having is when the xoom is on i type <adb reboot bootloader> The xoom reboots to the fastboot screen after that no commands work and when i do ADB devices in the terminal the device list is empty ?
elsworth1983 said:
have i done something wrong
god-WE174AA-ABU-s5306uk god # adb reboot bootloader
god-WE174AA-ABU-s5306uk god # fastboot oem unlock
fastboot: command not found
Click to expand...
Click to collapse
have you done the # ln -s /usr/local/android-sdk-linux/platform-tools/fastboot /usr/local/bin/fastboot? The error you're getting seems to suggest that it can't find the fastboot application? What happens if you type /usr/local/android-sdk-linux/platform-tools/fastboot oem unlock?
elsworth1983 said:
The problem i seem to be having is when the xoom is on i type <adb reboot bootloader> The xoom reboots to the fastboot screen after that no commands work and when i do ADB devices in the terminal the device list is empty ?
Click to expand...
Click to collapse
that is expected. adb is only available while android is booted up, fastboot is the protocol to use while in bootloader mode. As indicated before, I suspect that your computer can't find the fastboot application (on the computer).
Cheers for all the info i went back and started all from the top again only thing i am struggling with is Flashing the recovery now lol i get
god-WE174AA-ABU-s5306uk god # adb reboot bootloader
god-WE174AA-ABU-s5306uk god # fastboot flash recovery recovery-solarnz-100611-1150.img
error: cannot load 'recovery-solarnz-100611-1150.img'
I have it on a memory card which i checked which was working
elsworth1983 said:
Cheers for all the info i went back and started all from the top again only thing i am struggling with is Flashing the recovery now lol i get
god-WE174AA-ABU-s5306uk god # adb reboot bootloader
god-WE174AA-ABU-s5306uk god # fastboot flash recovery recovery-solarnz-100611-1150.img
error: cannot load 'recovery-solarnz-100611-1150.img'
I have it on a memory card which i checked which was working
Click to expand...
Click to collapse
The recovery image needs to be on your pc. It doesn't matter where on your pc as long as you can access it and know where it is.
Fastboot works by sending the image over the usb cable. Once you start flashing roms, those will need to be on your sd card within the xoom.
all i can say is thank you for all the information every 1 is giving me my head is mashed lol so if i put recovery-Tiamat-R4c-100611-1150-cwm.img on the desktop what would the terminal code be
kofrad said:
The recovery image needs to be on your pc. It doesn't matter where on your pc as long as you can access it and know where it is.
Fastboot works by sending the image over the usb cable. Once you start flashing roms, those will need to be on your sd card within the xoom.
Click to expand...
Click to collapse
depends on where your desktop is If it is in ~/Desktop/, then the correct command should be
Code:
fastboot flash recovery ~/Desktop/recovery-Tiamat-R4c-100611-1150-cwm.img
error: cannot load '/root/Desktop/recovery-Tiamat-R4c-100611-1150-cwm.img'
ARRRR i am really loosing the will to live ;-)
What am doing so wrong its lucky am not bold yet been trying this all day
elsworth1983 said:
error: cannot load '/root/Desktop/recovery-Tiamat-R4c-100611-1150-cwm.img'
ARRRR i am really loosing the will to live ;-)
Click to expand...
Click to collapse
if the graphical interface, where do you see the file located?
elsworth1983 said:
error: cannot load '/root/Desktop/recovery-Tiamat-R4c-100611-1150-cwm.img'
ARRRR i am really loosing the will to live ;-)
Click to expand...
Click to collapse
Sounds to me like you are running the commands as root. You likely have also downloaded the recovery image as a normal user. This means the '~' shortcut for the home directory is pointing you to someplace where the file is not.
Try using "fastboot flash /home/Your username/Desktop/recovery-Tiamat-R4c-100611-1150-cwm.img"
I have put the file on the desktop ? is that what u mean

Bootloader unlock

Not needed..............
@jmz will this work on OS 4.5.2
krazyace35 said:
@jmz will this work on OS 4.5.2
Click to expand...
Click to collapse
I don't see why it wouldn't as I am on 4.5.3 and it worked.
jmz said:
I don't see why it wouldn't as I am on 4.5.3 and it worked.
Click to expand...
Click to collapse
Cool thanks I'll give it a try and thanks for this unlock tutorial
jmz said:
You will need a linux box or python installed on windows. Find instructions on the web for that.
Step 1: Download attachment
Step 2: Run command and make note of code return
Code:
adb shell cat /sys/block/mmcblk0/device/manfid
Step 3: Run command and make note of code return
Code:
adb shell cat /sys/block/mmcblk0/device/serial
Now you should have 2 sets of numbers. first should be in the format of 0x0000XX where XX is numbers. And the other is 0xSSSSSSSS.
So now use the downloaded file and execute (obivously replacing the entries with what was returned above.
Code:
./cublock.py XX SSSSSSSS
This will tell you you have unlock.signed now. So move that to your fastboot/adb directory and then reboot to bootloader and issue this command
Code:
adb reboot-bootloader
fastboot -i 0x1949 flash unlock unlock.signed
Once done, get back to android and do the following:
Code:
adb shell
su
idme print
You should now see unlock_code: AAAAAAAA and on and on.
Now go flash my TWRP build in OG dev
Original credit goes to @dpeddi & @vortox for the exploit. I did nothing to this code and it is all their work. So give them thanks
Click to expand...
Click to collapse
Sorry for the noob-ish question. How do you get adb to recognize the fire? When I type "adb devices" there are no devices present.
ryanyz10 said:
Sorry for the noob-ish question. How do you get adb to recognize the fire? When I type "adb devices" there are no devices present.
Click to expand...
Click to collapse
do steps 1 through 6 in this thread
http://forum.xda-developers.com/fire-hd/general/root-supersu-stable-appstore-custom-t3113311
Question
Sorry for another question. When I type ./cublock.py, I get ". is not recognized as an internal or external command".
Sorry again for being annoying lol
ryanyz10 said:
Sorry for another question. When I type ./cublock.py, I get ". is not recognized as an internal or external command".
Sorry again for being annoying lol
Click to expand...
Click to collapse
if on windows you need to get python installed
jmz said:
if on windows you need to get python installed
Click to expand...
Click to collapse
I've got python 3.4.2 installed. Which version would you recommend?
After some researching, people have said that python doesn't work very well on Windows 10, which is what I'm on right now.
jmz said:
You will need a linux box or python installed on windows. Find instructions on the web for that.
Step 1: Download attachment
Step 2: Run command and make note of code return
Code:
adb shell cat /sys/block/mmcblk0/device/manfid
Step 3: Run command and make note of code return
Code:
adb shell cat /sys/block/mmcblk0/device/serial
Now you should have 2 sets of numbers. first should be in the format of 0x0000XX where XX is numbers. And the other is 0xSSSSSSSS.
So now use the downloaded file and execute (obivously replacing the entries with what was returned above.
Code:
./cublock.py XX SSSSSSSS
This will tell you you have unlock.signed now. So move that to your fastboot/adb directory and then reboot to bootloader and issue this command
Code:
adb reboot-bootloader
fastboot -i 0x1949 flash unlock unlock.signed
Once done, get back to android and do the following:
Code:
adb shell
su
idme print
You should now see unlock_code: AAAAAAAA and on and on.
Now go flash my TWRP build in OG dev
Original credit goes to @dpeddi & @vortox for the exploit. I did nothing to this code and it is all their work. So give them thanks
Click to expand...
Click to collapse
Hi jmz,
I have a question here- all that was in your ZIP file was the cublock.py file.
Are we supposed to use this with the rest of draxie's tools in the HDX thread? If so, I was able to get an 'unlock.img' file, but nothing called 'unlock.signed'
maybe you didn't upload all the attachments we needed?
either way, thanks soooo much for your work !
edouble312 said:
Hi jmz,
I have a question here- all that was in your ZIP file was the cublock.py file.
Are we supposed to use this with the rest of draxie's tools in the HDX thread? If so, I was able to get an 'unlock.img' file, but nothing called 'unlock.signed'
maybe you didn't upload all the attachments we needed?
either way, thanks soooo much for your work !
Click to expand...
Click to collapse
sorry, with that tool you only get the unlock.img . I need to correct the post
In my linux box 'cuber' module, required by cublock.py, is not installed; is this the correct source? https://github.com/benesch/cuber
One more question: I forgot to block OTA update so my HD6 updated to 4.5.4, loosing root permissions. What I should do? Need to wait KingRoot supports the new software version or can I proceed to unlock bootloader and install twrp? Or could install, if available, a 4.5.3 recovery through dd? Very thanks.
I sense many roms being ported very soon...
Sure hope so!
I used the tools (cuber) in this post:
http://forum.xda-developers.com/kin...tools-create-unlock-img-fix-boot-img-t3050689
So i generated unlock.img, but i am still unable to enter fastboot mode,
i tried changing boot to 4002, i rooted and tried to execute fastboot file, nothing works tbh, how do you suppose i fix this?
thanks in advance
robert896 said:
So i generated unlock.img, but i am still unable to enter fastboot mode,
Click to expand...
Click to collapse
Need more info: Your computer OS, tablet device model (Settings>Device Options), Fire OS version (Device Options>System Updates). Tell exactly what happens when you run: adb reboot-bootloader.
DoLooper said:
Need more info: Your computer OS, tablet device model (Settings>Device Options), Fire OS version (Device Options>System Updates). Tell exactly what happens when you run: adb reboot-bootloader.
Click to expand...
Click to collapse
ok im on ubuntu 15.04 got full adb and fastboot (they work on other devices) --- fire os 4.4.3---device model, kfhd 3rd gen
i also have windows 7 x64 dual booted with full adb and fastboot set up also
when i do adb reboot-bootloader, it restarts but doesnt enter fastboot ,, it boots into normal mode
robert896 said:
device model, kfhd 3rd gen
Click to expand...
Click to collapse
These unlock instructions are for Fire HDs (4th gen). You need a fastboot cable for KFSOWI. Try G+ KFSOWI modding.
I am new to the tablet scene. This is my very first tablet. I would like to root the device and install custom recovery and hopefully custom Rom. Is this the first thing I do or should I start somewhere else?

[UNLOCK] Tuliptool: unlock, TWRP, and custom boot

First let's get the warnings out of the way:
This is a dangerous tool. It can render your device permanently unusable.
If you use it, your warranty will likely be void.
You accept all responsibility for the consequences.
This is not an official ZTE unlock tool. The official ZTE unlock tool is in another thread.
Acknowledgments
Special thanks to @rombdeta for providing the OEM programmer binary. This would not be possible without his help.
What is tuliptool?
This tool allows you to:
Check status of your boot loader
Unlock your boot loader
Lock your boot loader
Install a custom recovery
Install a custom boot image
NOTE WELL
The first rule of intelligent tinkering is to save all the parts.
Always backup your partitions before writing new contents, so that you can get back to where you started.
Never write both boot and recovery in one session. Always make sure that you can boot into the other partition in case something fails.
Locking and unlocking will erase all user data. Make sure you backup first!
The zip includes:
tuliptool for Linux
tuliptool for Win64
tuliptool for Win32
tuliptool for MacOS
Preparation
1. Extract the package.
You will find the binary files listed above. Note: This is a command line utility, so you must open a command prompt to run it.
2a. Setup for Linux
Create a file named /etc/udev/rules.d/99-qcom.rules with this content exactly as shown:
SUBSYSTEM=="usb", ATTRS{idVendor}=="05c6", GROUP="plugdev"
Ensure your login user is in the plugdev group.
2b. Setup for Win32/Win64
Download zadig.
Connect your device in EDL mode (see below).
Windows will want to install the Qualcomm USB driver. We won't be using it so you can cancel if you wish, but it won't hurt anything.
Run zadig. Find device 05c6:9008 and install the WinUSB driver for it.
Disconnect the device.
2c. Setup for MacOS
No setup should be necessary.
3. Download boot and/or recovery files to flash.
You will find these in other threads in this section.
Connecting in EDL mode
Via adb
This should work for all models, but you need adb access.
adb reboot edl
Via key combo
If you have a US model device (or the aboot from a US model device) you may use the key combo:
Power off and unplug the device.
Hold both volume buttons.
Plug device into your PC.
Wait about 3 seconds and release the buttons.
Note: There will be no feedback on the device -- no lights, no vibration, nothing. The only way to verify that the device is in EDL mode is that device 05c6:9008 is visible on the PC.
Usage: (un)locking
After some testing, it appears that the Axon 7 Mini is not locked in any way. In other words, unlocking seems to be completely unnecessary. This section is mostly provided for completeness.
tuliptool lock status
tuliptool lock unlock
tuliptool lock lock
Usage: reading boot/recovery
Note command line options have changed
tuliptool read boot
tuliptool read recovery
Usage: writing boot/recovery
Note command line options have changed
tuliptool write boot <filename>/I]
tuliptool write recovery <filename>
So, for example, to write a TWRP image, run:
tuliptool write recovery tulip-twrp-7.1-r1.img.
Multiple operations
This is a "one shot" tool. After performing an operation, it will reset the device with a 5 second countdown. If you wish do perform multiple operations (eg. backup, unlock, flash), simply hold down the volume buttons while the device resets and it should go back to EDL mode.
Download
tuliptool.zip
md5=58f34850005510b51a832d27a6bce607
Common problems
Device not found: first enter EDL mode, then run the tool.
Device is visible in device manager or lspci but cannot be found by the tool: connect directly to the PC, not through a hub.
Windows says bad file descriptor: the WinUSB driver is not installed.
Linux says permission denied: your login user is not in the plugdev group.
Why call it tuliptool?
Tulip is the device "code name" for the Axon 7 Mini (at least the US version).
first! it's nice to see someone working on the lesser-known devices for once, thanks love!
okay so on that note everything goes perfectly, right up until i try to actually run the tool lol. installing the driver through Zadig does fine, and from everything i can tell, the PC recognizes it. i mean, it's in EDL and everything. what's going wrong? running the tuliptool-win64.exe just opens and closes instantly, and opening a command prompt in the directory just tells me that tuliptool is not a valid command/operation blah blah blah. it's probably something simple but i'm kind of trying to get all over this so :good:
Perhaps try running it as administrator? I'm heading home from work and then I'll be taking a shot at this myself.
I just tried on a Windows 10 virtual machine and it works perfectly.
This is a commandline program so you open a command prompt and type eg:
tuliptool-win64.exe lock status
Meme Queen said:
first! it's nice to see someone working on the lesser-known devices for once, thanks love!
okay so on that note everything goes perfectly, right up until i try to actually run the tool lol. installing the driver through Zadig does fine, and from everything i can tell, the PC recognizes it. i mean, it's in EDL and everything. what's going wrong? running the tuliptool-win64.exe just opens and closes instantly, and opening a command prompt in the directory just tells me that tuliptool is not a valid command/operation blah blah blah. it's probably something simple but i'm kind of trying to get all over this so :good:
Click to expand...
Click to collapse
tdm said:
I just tried on a Windows 10 virtual machine and it works perfectly.
This is a commandline program so you open a command prompt and type eg:
tuliptool-win64.exe lock status
Click to expand...
Click to collapse
so it's gone past that, but now it fails to unlock with an unknown error. checking unlock status after returns "Failed to send programmer: failed to read packet". i have to unplug it and go back into EDL mode, and when i check the lock status, it says unlocked and not tampered. when i try to go ahead with flashing TWRP, it crashes with this:
Sending programmer...Connecting to programmer...log: [email protected] [email protected]
log: [email protected] [email protected]
log: Finished sector address 0
log: Finished sector address 0
log: Finished sector address 0
Writing recovery ...
terminate called after throwing an instance of 'std::runtime_error'
what(): No error
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
I guess im stuck waiting for the update.zip because Zadig is refusing to install drivers. no matter what i do it will not install drivers. it keeps telling me "Remote Source Not Allocated: Driver install Aborted"
Hmm, looks like something strange is going on there. I'll take a look tomorrow.
Meme Queen said:
so it's gone past that, but now it fails to unlock with an unknown error. checking unlock status after returns "Failed to send programmer: failed to read packet". i have to unplug it and go back into EDL mode, and when i check the lock status, it says unlocked and not tampered. when i try to go ahead with flashing TWRP, it crashes with this:
Sending programmer...Connecting to programmer...log: [email protected] [email protected]
log: [email protected] [email protected]
log: Finished sector address 0
log: Finished sector address 0
log: Finished sector address 0
Writing recovery ...
terminate called after throwing an instance of 'std::runtime_error'
what(): No error
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
Click to expand...
Click to collapse
tdm said:
Hmm, looks like something strange is going on there. I'll take a look tomorrow.
Click to expand...
Click to collapse
thanks! if there's any information you want me to provide, just let me know.
I cannot get my device to boot into EDL mode, everytime I try it gets stuck on the splash screen. Can anyone help?
pxzei said:
I cannot get my device to boot into EDL mode, everytime I try it gets stuck on the splash screen. Can anyone help?
Click to expand...
Click to collapse
Yeah, try pressing the power button for 10 seconds, until the display turns off, hold down VOL + and enter recovery "power down" and try to enter edl again
Ok. Now ive retraced my steps and found that letting the qualcomm drivers install will not allow the WinUSB drivers to install in Windows 7. Once I told Windows update to not install the qualcomm drivers Zadig was able to install drivers successfully. Now that the drivers are installed, Device is in EDL (im assuming this because screen is black but my computer is recognizing the device), I run the Tuliptool and it keeps telling me "Device Not Detected" . I cant seem to get it to find the device but i can see it in Device Manager just fine. And it shows the WinUSB drivers are installed correctly, any insight on to what I may be doing wrong?
There won't be any lights or other indication that the phone is on when it's in EDL mode. But you should see the device in device manager, as USB id=05c6:9008. I don't normally run windows so I can't give detailed steps to find that.
You may need to have admin privileges to talk to USB devices, I'm not sure.
MrWhite0429 said:
Ok. Now ive retraced my steps and found that letting the qualcomm drivers install will not allow the WinUSB drivers to install in Windows 7. Once I told Windows update to not install the qualcomm drivers Zadig was able to install drivers successfully. Now that the drivers are installed, Device is in EDL (im assuming this because screen is black but my computer is recognizing the device), I run the Tuliptool and it keeps telling me "Device Not Detected" . I cant seem to get it to find the device but i can see it in Device Manager just fine. And it shows the WinUSB drivers are installed correctly, any insight on to what I may be doing wrong?
Click to expand...
Click to collapse
tdm said:
There won't be any lights or other indication that the phone is on when it's in EDL mode. But you should see the device in device manager, as USB id=05c6:9008. I don't normally run windows so I can't give detailed steps to find that.
You may need to have admin privileges to talk to USB devices, I'm not sure.
Click to expand...
Click to collapse
Device Shows connected and drivers installed under device manager.
Command prompt is being run as so:
Start --> type cmd ---> Right click on Command prompt ---> Run as Administrator
cd C:\users\admin\desktop\tuliptool
C:\users\admin\desktop\tuliptool> tuliptool-win64.exe lock status
Device Not Detected
---------- Post added at 03:59 AM ---------- Previous post was at 03:38 AM ----------
UPDATE:
I found that I had to use a USB 3.0 hub in order to get the phone to be detected.
Once detected I ran commands as followed.
tuliptool-win64.exe lock unlock
(The unlocking procedure said it failed, phone bootlooped three times, then it showed as unlocked when I ran the Lock status command)
tuliptool-win64.exe read boot
(This created the backup-boot.bin file in the directory)
Tuliptool-win64.exe read recovery
(This created a backup-recovery file in the directory)
tuliptool-win64.exe write boot
Its at this point here I get a Runtime Error as well. The entire process comes to a halt.
Thsnks, tried that, but no luck. It's still stuck on the splash screen.
Update: The device is running B09 7.1.1, The charger seems to be ZTE authentic. Single sim variant. If you need more info, let me know.
rombdeta said:
Yeah, try pressing the power button for 10 seconds, until the display turns off, hold down VOL + and enter recovery "power down" and try to enter edl again
Click to expand...
Click to collapse
tdm said:
This is not an official ZTE unlock tool. ZTE will likely be providing an official boot loader unlock in the coming few days. You should wait for that if you have any reservations about modifying your device.
[/B][/COLOR]
Click to expand...
Click to collapse
Awesome you got the tool out, I think I am going to wait for the 'Official' tool so if I ever need to send it in for repair in the next 2 years I can say 'well I used your tool' lol
Can't wait to see the roms @tdm, keep it up and I think the mini is going to get a lot more interesting.
I'd like to get a bloat removed(if any) and more lightweight faster rom on mine, maybe try the latest cyanogenmod or w/e they call it now and AOKP, etc.
New roms without MiFavor would be awesome too and ones that improve performance!
ZTE
@tdm, do you think zte will also be giving the official boot loader unlock soon? If not I will use yours that looks solid, but just thought I would ask first.
CRAFTER0302002 said:
@tdm, do you think zte will also be giving the official boot loader unlock soon? If not I will use yours that looks solid, but just thought I would ask first.
Click to expand...
Click to collapse
First post:
"This is not an official ZTE unlock tool. ZTE will likely be providing an official boot loader unlock in the coming few days. You should wait for that if you have any reservations about modifying your device."
Okay I've uploaded a new version of the tool with better error handling and better error messages (particularly for the Win64 version). I successfully wrote TWRP using the Win64 version. Please check the OP for the new link and download it again.
@Meme Queen and @MrWhite0429 please try again. I think the problem was that you didn't copy tulip-twrp-7.1.1.img to recovery.bin.
I can modify the tool to take a filename as a parameter if that helps with the confusion.
Edit: Also fixed a typo in the OP which had the wrong filename in the example. This may have been the source of the confusion.
tdm said:
Okay I've uploaded a new version of the tool with better error handling and better error messages (particularly for the Win64 version). I successfully wrote TWRP using the Win64 version. Please check the OP for the new link and download it again.
@Meme Queen and @MrWhite0429 please try again. I think the problem was that you didn't copy tulip-twrp-7.1.1.img to recovery.bin.
I can modify the tool to take a filename as a parameter if that helps with the confusion.
Edit: Also fixed a typo in the OP which had the wrong filename in the example. This may have been the source of the confusion.
Click to expand...
Click to collapse
as in rename to recovery.bin?
Yes, that.
MrWhite0429 said:
as in rename to recovery.bin?
Click to expand...
Click to collapse

Unlocking Bootloader [Incomplete]

Note: It would be great to keep this page open while following through on your PC instead of your phone as you'll be rebooting and resetting your phone by following this procedure.
Click to expand...
Click to collapse
Prerequisites:
ADB (Android Debugging Bridge) tools for your OS (Windows/Linux/Mac)
Windows
Mac
Linux
Custom Recovery Image (TWRP or some other that you prefer):
(Official TWRP web hosted version) Nokia 6.1 (2018)
Download from American Mirrors
Download from EU Mirrors
USB Cable to Connect the phone to the computer
The Phone: Nokia 6.1 (2018) (preferably Fully Charged)
The device drivers (for Windows and Mac)
A good and active Internet Connection
An active Email address and client to quickly view it.
In this tutorial I'll be referring to Linux terminal, Mac Terminal & Windows Command prompt/Powershell simply as terminal.
Click to expand...
Click to collapse
Installing adb and fastboot
Google hosts zips including only adb and fastboot. You can set these up for use with the instructions below.
On Windows
Download the (Windows.zip) from Google.
Extract it somewhere - for example, %USERPROFILE%\adb-fastboot
• On Windows 7/8:
1. From the desktop, right-click My Computer and select Properties
2. In the System Properties window, click on the Advanced tab
3. In the Advanced section, click the Environment Variables button
4. In the Environment Variables window, highlight the Path variable in the Systems Variable section and click the Edit button
5. Append ";%USERPROFILE%\adb-fastboot\platform-tools" to the end of the existing Path definition (the semi-colon separates each path entry)
• On Windows 10:
1. Open the Start menu, and type “advanced system settings”
2. Select “View advanced system settings”
3. Click on the Advanced tab
4. Open the “Environment Variables” window
5. Select the Path variable under “System Variables” and click the “Edit” button
6. Click the “Edit Text” button
7. Append ";%USERPROFILE%\adb-fastboot\platform-tools" to the end of the existing Path definition (the semi-colon separates each path entry)
• Install the device drivers linked in prerequisites (or from Nokia support site), and reboot.
On MacOS
Download the MacOS (Darwin.zip) from Google.
Extract it somewhere - for example, ~/adb-fastboot.
Add the following to ~/.bash_profile:
Code:
if [ -d "$HOME/adb-fastboot/platform-tools" ] ; then
export PATH="$HOME/adb-fastboot/platform-tools:$PATH"
fi
Log out and back in.
On Linux
Download the (Linux.zip) from Google.
Extract it somewhere - for example, ~/adb-fastboot.
Add the following to ~/.profile:
Code:
if [ -d "$HOME/adb-fastboot/platform-tools" ] ; then
export PATH="$HOME/adb-fastboot/platform-tools:$PATH"
fi
Log out and back in.
You may also need to set up udev rules: see (this repository) for more info.
Setting up adb
To use adb with your device, you’ll need to enable developer options and USB debugging:
1. Open Settings, and select “About”.
2. Tap on “Build number” seven times.
3. Go back, and select “Developer options”.
4. Scroll down, and check the “Android debugging” entry under “Debugging”.
5. Plug your device into your computer.
6. On the computer, open up a terminal/command prompt and type adb devices.
7. A dialog should show on your device, asking you to allow usb debugging. Check “always allow”, and choose “OK”.
Congratulations! adb is now ready to use with your device.
Unlocking the bootloader
Note: The steps below only need to be run once per device.
Code:
Warning: Unlocking the bootloader will erase all data on your device! Before
proceeding, ensure the data you would like to retain is backed up to your PC and/or
your Google account, or equivalent.
1. Make sure your computer has working fastboot and adb.
2. Enable USB debugging & OEM unlocking on your device under Settings->Developer Options. Incase you don't see Developer Options, then you need to unlock it by tapping Build Number 7 times in Settings->About Phone.
3. Get the current status of your bootloader:
Open a terminal on the PC and boot the device to fastboot mode by typing:
Code:
adb reboot bootloader
Once the device is in fastboot mode, verify your PC finds it by typing:
Code:
fastboot devices
If you see "no permissions fastboot" or "<waiting for device>", try running
Code:
fastboot
as root/Administrator.
From the same terminal, type the following command to get the bootloader status:
Code:
fastboot oem device-info
4. Follow the instructions at (Nokia Support) to unlock your bootloader, you will need to register at this site with a working/active email to proceed. They'll verify your device using an app to issue a validation code.
Note: If your device is not supported by the Nokia Bootloader Unlock
website, you will need to use an alternative bootloader unlock method.
Installing a custom recovery using fastboot
1. Make sure your computer has working fastboot and adb.
2. Enable USB debugging & OEM unlocking on your device under Settings->Developer Options. In case you don't see Developer Options, then you need to unlock it by tapping Build Number 7 times in Settings->About Phone. This needs to be done again due to resetting of your phone.
3. Download recovery - visit twrp.me to obtain the latest version of Team Win
Recovery Project for your device. Nokia 6.1 (2018) does have an official TWRP recovery that you can find here: Nokia 6.1 (2018) [PL2] respectively.
4. Connect your device to your PC via USB.
5. Open a terminal on the PC and boot the device to fastboot mode by typing:
Code:
adb reboot bootloader
6. Once the device is in fastboot mode, verify your PC finds it by typing:
Code:
fastboot devices
If you see "no permissions fastboot" or "<waiting for device>" , try running
Code:
fastboot
as root/Administrator.
7. Boot into TWRP temporarily:
Code:
fastboot boot twrp.img
8. Use adb to push the zip onto your device:
Code:
adb push twrp.zip /
9. Go to `Install` option on the TWRP menu and browse to the zip (Scrolling to the bottom should have the zip) and install the zip. The zip will install TWRP to both boot slots. Installing TWRP at this time will remove root if you are currently rooted.
If you accidentally flash TWRP to your device using fastboot instead of temporarily booting the image, you will need to download the latest factory image for your device and reflash the boot image.
Click to expand...
Click to collapse
This command assumes the recovery image is present in your current working directory (Check using `DIR` on command prompt or `ls` command on terminal)
If it isn't you can change your current directory to the directory containing the recovery image or copy/move the recovery image to your current working directory.
10. Now reboot into recovery to verify the installation:
That's all folks. You may now root your phone, or even flash a custom ROM. I suggest getting openGapps for the custom ROM if you wish to use Google play services on the custom ROM.
Popular adb commands
Code:
adb shell
Launches a shell on the device accessed through the terminal on your computer.
Code:
adb push <local> <remote>
Pushes the file <local> to <remote>
Code:
adb pull <remote> [<local>]
Pulls the file <remote> to <local>. If <local> isn’t specified, it will pull to the current folder.
Code:
adb logcat
Allows you to view the device log in real-time. You can use adb logcat -b radio to view radio logs, and adb logcat -C to view logs in colour
Code:
adb install <file>
Installs the given .apk file to your device
<local> refers to location on your computer (like c:\\Users\%USERPROFILE%\adb-fastboot on windows or ~/adb-fastboot on unix based OS), while <remote> refers to location on your android device (like "/sdcard/", without quotes)
Reserved
What do you do if oem unlocking in developer is greyed out? TA-1045
@toxicmender The official bootloader unlock was only released to the Nokia 8. So, what is the point posting it here?
Or have they silently added the 6.1?
singhnsk said:
@toxicmender The official bootloader unlock was only released to the Nokia 8. So, what is the point posting it here?
Or have they silently added the 6.1?
Click to expand...
Click to collapse
Unfortunately no, they haven't, removed the [incomplete] tag prematurely after reading it somewhere.
Currently only known way to unlock Nokia 6.1 seems to be to flash signature file.bin from these guys for fee.
at Step 4:
Code:
fastboot flash signature signature_file.bin
Also it has follow up instructions for flashing TWRP for anyone who has successfully unlocked their bootloader, since flashing TWRP is a bit different from most other phones
toxicmender said:
Unfortunately no, they haven't, removed the [incomplete] tag prematurely after reading it somewhere.
Currently only known way to unlock Nokia 6.1 seems to be to flash signature file.bin from these guys for fee.
at Step 4:
Code:
fastboot flash signature signature_file.bin
Also it has follow up instructions for flashing TWRP for anyone who has successfully unlocked their bootloader, since flashing TWRP is a bit different from most other phones
Click to expand...
Click to collapse
Why would you make start this thread then? It is completely pointless and misleading.
It is like making a post saying that there are flying cars and marking it [Incomplete]. It is just ****ing stupid.
I hope you drop your 6.1 and break it so you make **** posts in other phone forums instead of this one.
cmaxwe said:
.
I hope you drop your 6.1 and break it so you make **** posts in other phone forums instead of this one.
Click to expand...
Click to collapse
Hey now, there is really no need for that level of hostility. He knew they were doing unlocks for at least one Nokia phone, and me may not have known that they didn't have it for the 6.1.
Please don't talk to peope like that if they make a simple mistake when trying to provide info and help out the community. We're all human.
toxicmender said:
Unfortunately no, they haven't, removed the [incomplete] tag prematurely after reading it somewhere.
Currently only known way to unlock Nokia 6.1 seems to be to flash signature file.bin from these guys for fee.
at Step 4:
Code:
fastboot flash signature signature_file.bin
Also it has follow up instructions for flashing TWRP for anyone who has successfully unlocked their bootloader, since flashing TWRP is a bit different from most other phones
Click to expand...
Click to collapse
Honestly if there was a good amount of roms available for this phone I would gladly pay the $5 to unlock bootloader, although that method leaves me with questions. does that method survive ota? Does it actually work? Can it relock and unlock without paying again?
Is there really not that many people on here willing to try unlocking and flashing the many gsi roms available?
cmaxwe said:
Unfortunately no, they haven't, removed the [incomplete] tag prematurely after reading it somewhere.
Currently only known way to unlock Nokia 6.1 seems to be to flash signature file.bin from these guys for fee.
at Step 4:
Why would you make start this thread then? It is completely pointless and misleading.
It is like making a post saying that there are flying cars and marking it [Incomplete]. It is just ****ing stupid.
I hope you drop your 6.1 and break it so you make **** posts in other phone forums instead of this one.
Click to expand...
Click to collapse
It's not like there isn't a way, there is, just not a transparent method. Somehow those (refer to link in reply) are able to generate and send the signature file allowing you to unlock the phone, how it works or if your bootloader be locked again after updating is unknown to me ATM
mymeatb18 said:
Unfortunately no, they haven't, removed the [incomplete] tag prematurely after reading it somewhere.
Currently only known way to unlock Nokia 6.1 seems to be to flash signature file.bin from these guys for fee.
at Step 4:
Honestly if there was a good amount of roms available for this phone I would gladly pay the $5 to unlock bootloader, although that method leaves me with questions. does that method survive ota? Does it actually work? Can it relock and unlock without paying again?
Is there really not that many people on here willing to try unlocking and flashing the many gsi roms available?
Click to expand...
Click to collapse
Well the ROM development begins after an Official TWRP recovery, so the chances are there might be some. I'm not clear on the the OTA being able to relock the bootloader either since I was running Pie update when I got to know about it.
thread closed as per OP request

[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2018 (karnak) amonet-3

Read this whole guide before starting.
This is for the 8th gen Fire HD8 (karnak).
Current version: amonet-karnak-v3.0.1.zip
This is based on @xyz`s original work, but adds some features such as reboot to hacked BL.
It also intends to simplify the installation process.
If you are already unlocked you can simply update by flashing the ZIP-file in TWRP.
NOTE: If you are on a firmware lower than 6.3.1.2 this process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
What you need:
A Linux installation or live-system
A micro-USB cable
Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
Code:
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
1. Extract the attached zip-file "amonet-karnak-v3.0.1.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings
3. Start the script:
Code:
sudo ./fireos-step.sh
NOTE: If you are on a firmware newer than 6.3.0.1, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
WARNING: There have been numerous reports that would indicate a hardware-change that doesn't allow access to the bootrom.
When bricking these devices there is currently no known way to unbrick.
This makes the hardware-method currently the safest option.
To brick firmware 6.3.1.2 use the attached brick-karnak.zip, boot into fastboot
Code:
adb reboot bootloader
and run
Code:
./brick-6312.sh
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
After you have confirmed the bricking by typing "YES", you will need disconnect the device and run
Code:
sudo ./bootrom-step.sh
Then plug the device back in.
The device will reboot into TWRP.
You can now install Magisk from there.
Going back to stock
Extract the attached zip-file "amonet-karnak-return-to-stock.zip" into the same folder where you extracted "amonet-karnak-v3.0.1.zip" and open a terminal in that directory.
Then run:
Code:
sudo ./return-to-stock.sh
Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 6.3.0.0 or newer, otherwise you may brick your device)
Important information
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.)
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Thanks to @Kaijones23 for testing.
Unbricking / Unlocking with Firmware 6.3.1.2+
If Recovery OR FireOS are still accessible (or your firmware is below 6.3.1.2) there are other means of recovery, don't continue.
If your device shows one of the following symptoms:
It doesn't show any life (screen stays dark)
You see the white amazon logo, but cannot access Recovery or FireOS.
If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).
Make sure the device is powered off, by holding the power-button for 20+ seconds
Start bootrom-step.sh
Plug in USB
In all other cases you will have to open the device.
Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
Open the device and short the pin marked in the attached photo to ground while plugging in.
1. Extract the attached zip-file "amonet-karnak-v3.0.zip" and open a terminal in that directory.
2. start the script:
Code:
sudo ./bootrom-step.sh
It should now say Waiting for bootrom.
3. Short the device according to the attached photo and plug it in.
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
7. Run
Code:
sudo ./fastboot-step.sh
8. Wait for the device to reboot into TWRP.
9. Use TWRP to flash custom ROM, Magisk or SuperSU
Checking USB connection
In lsusb the boot-rom shows up as:
Code:
Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone
If it shows up as:
Code:
Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
instead, you are in preloader-mode, try again.
dmesg lists the correct device as:
Code:
[ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00
Reserved #2
Reserved #3
This is very cool @k4y0z!
Now we can use boot-recovery.sh & boot-fastboot no?
Regards!
Rortiz2 said:
This is very cool @k4y0z!
Now we can use boot-recovery.sh & boot-fastboot no?
Regards!
Click to expand...
Click to collapse
Yes, that is also supported.
k4y0z said:
NOTE: If you are on a firmware lower than 6.3.1.2 this process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
NOTE: If you are on a firmware newer than 6.3.0.1, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)[/COLOR]
Click to expand...
Click to collapse
So do you need to open the case to run this exploit on the newest firmware, or can you just brick to install older lk/preloader, and go from there?
Kctucka said:
So do you need to open the case to run this exploit on the newest firmware, or can you just brick to install older lk/preloader, and go from there?
Click to expand...
Click to collapse
On 6.3.1.2 mtk-su has been fixed, so unless you already have root (or another way to get temp-root is found), bricking isn't an option and you will have to open the case.
If you do have root the script will do the bricking for you.
@k4y0z For people who already used the steps in xyz's thread and are running your TWRP and LineageOS, is there anything here that we're missing? Or is this just a new method to arrive at the same results?
jibgilmon said:
@k4y0z For people who already used the steps in xyz's thread and are running your TWRP and LineageOS, is there anything here that we're missing? Or is this just a new method to arrive at the same results?
Click to expand...
Click to collapse
k4y0z said:
This is based on @xyz`s original work, but adds some features such as reboot to hacked BL.
It also intends to simplify the installation process.
If you are already unlocked you can simply update by flashing the ZIP-file in TWRP.
Click to expand...
Click to collapse
Additionally it adds support for the boot-recovery and boot-fastboot scripts.
And a script to enable UART output for the kernel.
So nothing essential if you are already using the updated TWRP.
Ran this pup on a unit that I was keeping unrooted (aside from occational temp root via mtk-su) as a control but was becoming painful to use/maintain. Also missed TWRP. Worked like a champ with zero issues ... aside from stumbling over my own stupidity. Used Lubuntu live 18.04 and Magisk 19.3/7.3.2. Staying on FireOS 6.3.0.1 (w/hijacks) for now until a fully vetted custom ROM becomes available.
Thanks for the great tool and accompanying guidance.
I have added unbricking/bootrom instructions in Post #2
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
bibikalka said:
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
Click to expand...
Click to collapse
I think yeah:
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
Click to expand...
Click to collapse
So I got a HD8 2018 today and it came with OS version that forced me to connect to WiFi and update itself. I was pretty pissed but I used this guide to get root easily.
I had Arch based linux installed which gave problems while running script, so I made bootable Ubuntu usb and that worked fine. Thank you everyone involved in developing this hack.
madman said:
So I got a HD8 2018 today and it came with OS version that forced me to connect to WiFi and update itself. I was pretty pissed but I used this guide to get root easily.
I had Arch based linux installed which gave problems while running script, so I made bootable Ubuntu usb and that worked fine. Thank you everyone involved in developing this hack.
Click to expand...
Click to collapse
For future reference you can avoid the presumed forced WiFi connect by putting in a bogus password; once authentication fails a 'skip' option will appear.
bibikalka said:
@k4y0z
If I flash your zip, can I then flash Amazon update as is? Will your TWRP manage the bootloaders/etc when flashing the stock ROM?
Click to expand...
Click to collapse
Rortiz2 said:
I think yeah:
Click to expand...
Click to collapse
Yes, exactly.
Rortiz2 said:
I think yeah:
Click to expand...
Click to collapse
k4y0z said:
Quote:
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
Yes, exactly.
Click to expand...
Click to collapse
OK - tried to upgrade to the latest update-kindle-Fire_HD8_8th_Gen-NS6312_user_1852_0002517056644.bin using the suggestions above, and got a hardcore Amazon logo bootloop.
My actions. I had the old unlock, so I flashed the zip in this thread first. New TWRP showed up - so far so good. Then I flashed the Amazon update zip as is, thinking the updated TWRP would do its magic. Flashed Magisk, tried to reboot. No go - Amazon logo bootloop. No recovery either. So it feels that I lost the unlock, and, perhaps LK & preloader & TZ got overwritten with the new versions from the Amazon update zip.
Any recovery here other than opening the case?
bibikalka said:
OK - tried to upgrade to the latest update-kindle-Fire_HD8_8th_Gen-NS6312_user_1852_0002517056644.bin using the suggestions above, and got a hardcore Amazon logo bootloop.
My actions. I had the old unlock, so I flashed the zip in this thread first. New TWRP showed up - so far so good. Then I flashed the Amazon update zip as is, thinking the updated TWRP would do its magic. Flashed Magisk, tried to reboot. No go - Amazon logo bootloop. No recovery either. So it feels that I lost the unlock, and, perhaps LK & preloader & TZ got overwritten with the new versions from the Amazon update zip.
Any recovery here other than opening the case?
Click to expand...
Click to collapse
That is strange, I've had no issues installing that firmware unmodified through TWRP.
So you can't boot neither normal or recovery?
Does it say something in the corner when trying to boot recovery?
You can try the boot-fastboot.sh script to get into hacked fastboot.
k4y0z said:
That is strange, I've had no issues installing that firmware unmodified through TWRP.
So you can't boot neither normal or recovery?
Does it say something in the corner when trying to boot recovery?
You can try the boot-fastboot.sh script to get into hacked fastboot.
Click to expand...
Click to collapse
Cannot boot anywhere - no message about booting recovery either. When you tried installing unmodified firmware, was that on HD8 2018, or some other tablet? I wonder if perhaps there are some differences with HD8 2018 given that it's Nougat.
I will try the hacked fastboot, but most likely - will have to open the case.

Categories

Resources