Fire 7 (2019, mustang) unbrick, downgrade, unlock & root

115 posts
Thanks Meter: 325
By xyz`, Senior Member on 30th June 2019, 09:12 PM
Post Reply Email Thread
Make sure to read this guide completely before starting.

You will lose all data on the tablet, make a backup of important data before you start.

What you need:
- a Linux installation. Don't use a VM! Use a live USB, if you don't have Linux installed, but don't use a virtual machine.
- a microusb cable to connect your tablet to the PC
- (if you go with hw option) some way to open the tablet (pry tool, opening picks, etc)
- (if you go with hw option) something conductive (metal tweezers, a paper clip, a piece of wire, etc)
- (if you go with sw option) mtk-su from
- from this post
- from this post
- update-kindle-NS6312_user_1827_0002517050244.bin: https://fireos-tablet-src.s3.amazona...2517050244.bin

Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work "sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot".

0. Disconnect the tablet and all other Android devices from the PC.
1. Back up whatever important data you have on the device and perform a complete factory reset of the tablet. When going through the initial setup, don't connect to a network (see below on how to do that).
2. Disable or uninstall ModemManager from your Linux installation
3. At this point you need to get your tablet into the bootrom download mode. There are two ways it can be achieved.
a) If your tablet works, you can use the software method (which doesn't require opening the tablet) or the hardware method. Note that if something goes horribly wrong, you might still be required to open up the tablet.
b) If your tablet doesn't boot (bricked), you can only use the hardware method


Software method:
This will get you into bootrom mode by obtaining temporary root and temporarily bricking the device.

1. Download mtk-su from
2. Enable developer mode and USB debugging on the tablet
3. Unzip the mtk-su archive
4. Transfer the executable to your tablet: "adb push arm/mtk-su /data/local/tmp"
5. Run "adb shell"
6. Keep the screen on and run the following commands in the shell on the device:
cd /data/local/tmp
getenforce # Just to confirm it says Permissive
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=/dev/zero of=/dev/block/mmcblk0boot0 bs=512 count=8
This is the sort of output you should see for that step:

[email protected]:~/Downloads/mtk-su $ adb shell
mustang:/ $ cd /data/local/tmp
mustang:/data/local/tmp $ ./mtk-su                                                                                                                                                 
New UID/GID: 0/0
mustang:/data/local/tmp # getenforce                                                                                                                                               
mustang:/data/local/tmp # echo 0 > /sys/block/mmcblk0boot0/force_ro                                                                                                           
mustang:/data/local/tmp # dd if=/dev/zero of=/dev/block/mmcblk0boot0 bs=512 count=8                                                                                                
8+0 records in
8+0 records out
4096 bytes transferred in 0.001 secs (4096000 bytes/sec)
mustang:/data/local/tmp #

Don't close the console just yet.

Hardware method:
This will get you into bootrom mode by opening up the tablet and shorting a point to the ground.

1. Shut your device down and disconnect it from USB
2. Use a pry tool to remove the back shell from the tablet. Start at the bottom and work your way up. There are no cables between the back shell and the motherboard.
3. You will need to get something conductive and temporarily connect a point to the ground. A point suggested by @ggow is: You will need to pop up the metallic shield to access it. Alternatively, there are multiple points on the back of the PCB which also work (marked as CLK/CMD/DAT0).


4. At this point if you went with software method, you should have a root shell open, and if you went with the hardware method you should have a capacitor or a testpoint grounded to the shield.

5. Now, open another terminal on your PC, extract, navigate to it, and run `sudo ./`. It should print "Waiting for the bootrom".
a) For the software method, you should already have the USB cable plugged in. Type "reboot" in the first terminal (the one you that's running "adb shell"). [If you're trying this for the second time because it didn't work for the first time, you won't have an "adb shell" terminal. In that case, just plugging the USB cable in should be enough.]
b) For the hardware method, ensure the short is applied and then plug in the USB cable.

7. You should see the following device appear in your "dmesg" log:

[1141765.113884] usb 3- USB disconnect, device number 59
[1141783.057101] usb 3- new full-speed USB device number 60 using xhci_hcd
[1141783.226498] usb 3- New USB device found, idVendor=0e8d, idProduct=0003, bcdDevice= 1.00
[1141783.226502] usb 3- New USB device strings: Mfr=0, Product=0, SerialNumber=0
[1141783.506877] cdc_acm 3- ttyACM0: USB ACM device
This *must* be the device you see. If you see a "preloader" device instead, your short probably didn't work (for the hw method), or your system inexinexplicably didn't brick (for the sw method). Unplug everything and try again. If the tablet doesn't shut down, you might need to open it up and disconnect the battery.

8. The script should now tell you to remove the short. If you went with hardware method, you do need to remove it first. Otherwise, just press Enter.
9. The script will now proceed to downgrade your device and flash some essential files. Just let it be, it will take about 4 minutes. You should see the following output:

[2019-06-30 02:48:59.334098] Waiting for bootrom
[2019-06-30 02:50:41.179571] Found port = /dev/ttyACM0
[2019-06-30 02:50:41.180204] Handshake

 * * * If you have a short attached, remove it now * * * 
 * * * Press Enter to continue * * * 

[2019-06-30 02:50:49.195782] Init crypto engine
[2019-06-30 02:50:49.214278] Disable caches
[2019-06-30 02:50:49.214801] Disable bootrom range checks
[2019-06-30 02:50:49.229877] Load payload from ../brom-payload/build/payload.bin = 0x46B8 bytes
[2019-06-30 02:50:49.233418] Send payload
[2019-06-30 02:50:49.958957] Let's rock
[2019-06-30 02:50:49.959812] Wait for the payload to come online...
[2019-06-30 02:50:50.904341] all good
[2019-06-30 02:50:50.904714] Check GPT
[2019-06-30 02:50:51.240034] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 22722527)}
[2019-06-30 02:50:51.240157] Check boot0
[2019-06-30 02:50:51.485287] Check rpmb
[2019-06-30 02:50:51.695083] Downgrade rpmb
[2019-06-30 02:50:51.696759] Recheck rpmb
[2019-06-30 02:50:52.591407] rpmb downgrade ok
[2019-06-30 02:50:52.837668] Clear preloader 1
[1 / 1]
[2019-06-30 02:50:52.859908] Clear preloader 2
[1 / 1]
[2019-06-30 02:50:52.882059] Flash lk-payload
[4 / 4]
[2019-06-30 02:50:53.214382] Flash tz
[5547 / 5547]
[2019-06-30 02:52:51.150851] Flash lk
[651 / 651]
[2019-06-30 02:53:05.192112] Inject microloader
[4 / 4]
[2019-06-30 02:53:05.524154] Flash preloader
[271 / 271]
[2019-06-30 02:53:11.525329] Restore preloader
[8 / 8]
[2019-06-30 02:53:11.695348] Reboot to unlocked fastboot

If the script freezes at some point, you will have to restart it. Terminate the script, then immediately run `sudo ./` again. The exploit it set up so that after about 40 seconds of inactivity it would reboot your device and drop you back into the bootrom mode, which the script is waiting for. If you cannot restart the process, you might have to open up the tablet and replug the battery to completely power off the device.

10. You should see a success message: "Reboot to unlocked fastboot". Only proceed if you see the message.
11. Once the device boots to fastboot (check with "fastboot devices"; you should also see amazon logo on the screen.), you can run "sudo ./".
12. At this point the device should boot into recovery, however the screen will be off. Just press the power button twice and the screen should turn on.
13. Success! You now have a custom recovery installed that can be accessed by holding down power and volume down (the leftmost) buttons. At this point if you came here from a custom ROM thread you should probably follow the ROM installation instructions. Alternatively, the next steps will detail installing a stock firmware and rooting it with Magisk.


14. We'll now upload required files to the recovery. On your PC, do:

adb push update-kindle-NS6312_user_1827_0002517050244.bin /sdcard/
adb push /sdcard
adb push /sdcard

15. In the recovery, go to "Install", navigate to "/sdcard" and flash
16. Go to "Wipe" and do the default wipe, then reboot
17. At the Fire setup screen, select your language. On the next screen, Wifi setup, select any password-protected network, then instead of entering the password press "cancel". Now, back at the wifi setup screen, press "Skip setup" and "Skip" in the dialog pop-up again
18. Wait for the update to finish (wait until the updating fire notification disappears)
19. Hold down the power button, press Restart and hold volume down to boot into recovery.
20. In the recovery, go to "Install", navigate to "/sdcard" and flash
21. Press back, select and flash it
22. Once is flashed, press "Reboot System"

Only ever flash boot images from TWRP. Since nothing but TWRP is aware of the exploit, if you try to flash a boot image from Android, it won't have the exploit integrated into it! This includes Magisk as well, so do NOT install or uninstall it from Magisk Manager (However, installing modules should be fine; although it depends on the specific module).

Due to how the exploit works, it takes over the first 0x400 bytes of boot.img/recovery.img. When flashing zips from the recovery, it will transparently remove and then reinstall the exploit when needed. So long as you flash zips from the recovery, you should treat the boot image normally. However, this means that you cannot use any other apps (e.g. FlashFire) to flash the boot or recovery partitions.

To uninstall the hack and revert back to stock:
- Download an update package to your PC (the update-kindle-NS6312_user_1827_0002517050244.bin file)
- Flash from TWRP
- Perform the default wipe
- Reboot to recovery; you should see amazon recovery now
- Select "apply update from ADB" in the recovery menu
- Run "adb sideload update-kindle-NS6312_user_1827_0002517050244.bin" on your PC

Other misc information / troubleshooting:
- If you need to disconnect the battery, use a pair of tweezers to grab the wires and gently pull towards yourself. You can do either with or without the battery connected, however should be done with the battery connected.
- If your device is bricked (e.g. from a downgrade), just follow the steps as-is.
- If you're getting an error like "Serial protocol mismatch", or any other error in bootrom-step, try disabling or temporarily uninstalling ModemManager from your Linux
- To remount /system as rw use "mount -o rw,remount /system". ("mount -o remount,rw /system" will not work)

Thanks to: aftv2-tools contributors for an implementation of mtk download protocol, @diplomatic for mtk-su, @Michajin for testing the instructions.
Attached Files
File Type: zip - [Click for QR Code] (1.2 KB, 6684 views)
File Type: zip - [Click for QR Code] (9.43 MB, 3966 views)
File Type: zip - [Click for QR Code] (14.84 MB, 7914 views)
The Following 41 Users Say Thank You to xyz` For This Useful Post: [ View ] Gift xyz` Ad-Free
30th June 2019, 09:55 PM |#2  
Thanks for your work!

On a side note, I also had adaptive storage on during the process. I was having crashing issues after install. I re-installed the firmware-wiped and booted. I followed the steps to boot without setup. Then booted back into TWRP, flashed magisk, but did not flash finalize. I like access to some of the amazon apps. Once I rebooted (I stayed off wi-fi) I sideloaded a package disabler and disabled the OTA. I registered then disabled the amazon bloat I didn't want. I have installed my sd card as portable this time, just to be safe.

also, TWRP does not have backup and restore options, is this normal on this currently?
The Following 3 Users Say Thank You to Michajin For This Useful Post: [ View ] Gift Michajin Ad-Free
1st July 2019, 10:09 AM |#3  
guizzzmo's Avatar
Senior Member
Thanks Meter: 20
Donate to Me
incredible, i will try that
1st July 2019, 07:02 PM |#5  
guizzzmo's Avatar
Senior Member
Thanks Meter: 20
Donate to Me
hello @xyz
Do you think i can try that throught a linux virtual machine on virtualbox ?
1st July 2019, 07:08 PM |#6  
Originally Posted by guizzzmo

hello @xyz
Do you think i can try that throught a linux virtual machine on virtualbox ?

I unlocked my 7th gen with virtualbox so yes.
The Following User Says Thank You to Rortiz2 For This Useful Post: [ View ] Gift Rortiz2 Ad-Free
2nd July 2019, 11:30 AM |#7  
Junior Member
Thanks Meter: 0
Hi guys, Is there a chance there will be a Nexus ROM released for the Mustang version of the Fire? It's been my preferred ROM on my older Ford model so I'd like to keep using it if possible.
2nd July 2019, 11:44 AM |#8  
DB126's Avatar
Senior Member
Thanks Meter: 9,935
Originally Posted by tangledweb

Hi guys, Is there a chance there will be a Nexus ROM released for the Mustang version of the Fire? It's been my preferred ROM on my older Ford model so I'd like to keep using it if possible.

Mustang uses a different kernel than Ford/Austin; custom ROMs will need to be spun up from different sources. Developer time is scarce; may or may not happen.
2nd July 2019, 01:40 PM |#9  
guizzzmo's Avatar
Senior Member
Thanks Meter: 20
Donate to Me
Finally bricked with software method.

I try to find a picture for where i can make my wire for hardware method.

My battery was empty so i have just disconnect battery and plug usb with paperclip and i have got bootrom.

Great !!
Attached Thumbnails
Click image for larger version

Name:	IMG_20190702_144726.jpg
Views:	4364
Size:	234.2 KB
ID:	4786295   Click image for larger version

Name:	IMG_20190702_145844.jpg
Views:	4360
Size:	238.7 KB
ID:	4786300   Click image for larger version

Name:	IMG_20190702_153432.jpg
Views:	4302
Size:	256.7 KB
ID:	4786360   Click image for larger version

Name:	IMG_20190702_160328.jpg
Views:	4272
Size:	242.1 KB
ID:	4786362  
2nd July 2019, 03:54 PM |#10  
timn_13's Avatar
Flag edmonton
Thanks Meter: 47
much thanks for this, after some fiddling it works perfectly!!

i had some issues getting past the bootrom script part on both my galliumos & debian machines (serial error message, despite apt remove modemmanager) - until i tried an xubuntu liveusb, at which point everything went smoothly and as directed via the software method.

looking very forward to an aosp rom to replace stock and being able to make a twrp backup (i broke my install with magisk, but it was a simple recovery just reflashing fw.bin again). cheers!
2nd July 2019, 07:53 PM |#11  
Junior Member
Thanks Meter: 2
Is it just me or is the hardware point picture coming up as a dead link? Can someone attach the correct point in another image?
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Previous Thread Next Thread