This is for the 5th gen Fire and 7th gen Fire
5th gen: amonet-ford-v1.4.1.zip
7th gen: amonet-austin-v1.4.1.zip
What you need:
- A Linux installation or live-system
- A micro-USB cable
If your Fire is on a newer preloader-version (or a 7th gen) you may also need:
- Something conductive (paperclip, tweezers etc)
- Something to open the tablet.
There is an alternative for opening the tablet (only 5th gen), which is described below.
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial adb fastboot
sudo systemctl stop ModemManager sudo systemctl disable ModemManager
NOTE: If you have issues running the scripts, you might have to run them using sudo.
Also try using different USB-ports (preferably USB-2.0-ports)
If you're lucky and have an old preloader (Up to FireOS 5.3.2, thanks @MontysEvilTwin), you can just hold the left volume button while plugging the device in.
If you're on a newer preloader, there are two options:
- Open the device and short the pin marked in the attached photo to ground while plugging in.
- (Only 5th gen) Downgrade to 5.0.1 firmware via adb sideload in Amazon recovery, then proceed to use the left volume button to enter boot-rom.
NOTE: Using option two will brick your device until you have successfully finished the process.
1. Extract the attached zip-file "amonet-ford-v1.4.1.zip" (use "amonet-austin-v1.4.1.zip" for 7th gen) and open a terminal in that directory.
2. start the script:
3. If you have an old preloader or used option 2 above:
Hold the left volume-button and plug the device in.
If you chose option 1, short the device according to the attached photo and plug it in.
NOTE: Make sure the device is powered off, before plugging it in.
NOTE: If you have issues getting a 7th gen into bootrom, read this post by @hwmod
NOTE: For hints, how to access the pins on a 7th gen without removing the shield, check Post 1075 by @shelleyfrank
In lsusb the boot-rom shows up as:
Bus 002 Device 013: ID 0e8d:0003 MediaTek Inc. MT6227 phone
Bus 002 Device 014: ID 0e8d:2000 MediaTek Inc. MT65xx Preloader
dmesg lists the correct device as:
[ 6383.962057] usb 2-2: New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
4. When the script asks you to remove the short, remove the short and press enter.
5. Wait for the script to finish.
If it stalls at some point, stop it and restart the process from step 2.
6. Your device should now reboot into unlocked fastboot state.
9. Use TWRP to flash custom ROM, Magisk or SuperSU
To return back to stock, Go into hacked fastboot-mode, then run
Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
your device will likely not boot anymore (unless you flashed a signed image).
TWRP will patch recovery/boot-images on the fly.
fastboot-step flashes the 5.6.3 boot.img, if your device hangs at the orange fire logo, try wiping cache first.
If that doesn't help, your system is probably incompatible with that image, just flash the right boot.img via TWRP.
This process does not disable OTA or does any other modifications to your system.
You will have to do that according to the other guides in this forum.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Thanks also to @ANDROID2468 and @bibikalka for testing things.
Thanks to @mateo121212 and @hwmod for debugging 7th gen.
Thanks to @MontysEvilTwin for figuring out volume-button access works up to FireOS 5.3.2, and for figuring out that 5.3.2 PL/TZ fix prime video.