ohhh thank you very very much that is very kind from you.
that is mean when i start this method for 32GB must save gpt in new folder and 16GB in other folder??
ohhh thank you very very much that is very kind from you.
that is mean when i start this method for 32GB must save gpt in new folder and 16GB in other folder??
I am changing the scripts, so it will use the devices serial-number for the gpt-folder so another mixup won't happen again.
Just give me a moment.
I have uploaded a new version:
Changelog
Version 1.1 (02.09.2019)
@deathlessster
To fix your device download amonet-douglas-v1.1.zip and amonet-douglas-gptfix.zip.
Extract both into the same directory.
Then run
Changelog
Version 1.1 (02.09.2019)
- Add system_image to TWRP
- Add serialno to GPT-folder to avoid mixups between 16G and 32G
- Add scripts to fix GPT
@deathlessster
To fix your device download amonet-douglas-v1.1.zip and amonet-douglas-gptfix.zip.
Extract both into the same directory.
Then run
Code:
sudo ./gpt-fix-16G.shThe only difference is the support of sytem_image backup/restore in TWRP.
Update can be done by flashing the ZIP in TWRP.
Thank you my friend that is great work my device now back to live .
But now i need to flash twrp again use ./step-1.sh but i get this error
root@khalid:/home/khalid/Downloads/amonet-douglas-v1.1/amonet# sudo ./step-1.sh
Testing root access...
uid=0(root) gid=0(root) context=u:r:init:s0
PL version: 6 (6)
LK version: 2 (2)
TZ version: 259 (259)
Your device will be reset to factory defaults...
Press Enter to Continue...
Dumping GPT
34+0 records in
34+0 records out
17408 bytes transferred in 0.001 secs (17408000 bytes/sec)
/data/local/tmp/gpt.bin: 1 file pulled. 0.3 MB/s (17408 bytes in 0.059s)
Modifying GPT
[2019-09-04 18:43:52.412512] Input GPT:
[2019-09-04 18:43:52.420744]
[2019-09-04 18:43:52.420854] Sector size (logical): 512 bytes
[2019-09-04 18:43:52.420956] Disk identifier (GUID): BE9E3536-6B98-4084-A368-36B21A533077
[2019-09-04 18:43:52.421043] Partition table holds up to 128 entries
[2019-09-04 18:43:52.421130] This partition table begins at sector 2 and ends at sector 33
[2019-09-04 18:43:52.421215] First usable sector is 34, last usable sector is 30535646
[2019-09-04 18:43:52.421298] Other partition table is at sector 30535679
[2019-09-04 18:43:52.421380]
[2019-09-04 18:43:52.421697] Number Start (sector) End (sector) Size Name
[2019-09-04 18:43:52.422832] 1 1024 7167 3.00 MiB proinfo
[2019-09-04 18:43:52.427961] 2 7168 16383 4.50 MiB PMT
[2019-09-04 18:43:52.429934] 3 16384 17407 512.00 KiB lk
[2019-09-04 18:43:52.430545] 4 17408 18431 512.00 KiB lk2
[2019-09-04 18:43:52.432040] 5 18432 51199 16.00 MiB boot_x
[2019-09-04 18:43:52.432653] 6 51200 86015 17.00 MiB recovery_x
[2019-09-04 18:43:52.434786] 7 86016 96255 5.00 MiB tee1
[2019-09-04 18:43:52.435431] 8 96256 106495 5.00 MiB tee2
[2019-09-04 18:43:52.435949] 9 106496 187391 39.50 MiB metadata
[2019-09-04 18:43:52.438351] 10 187392 189439 1024.00 KiB kb
[2019-09-04 18:43:52.439673] 11 189440 191487 1024.00 KiB dkb
[2019-09-04 18:43:52.442733] 12 191488 192511 512.00 KiB MISC
[2019-09-04 18:43:52.443378] 13 192512 208895 8.00 MiB reserved
[2019-09-04 18:43:52.444125] 14 208896 3515391 1.58 GiB system
[2019-09-04 18:43:52.444639] 15 3515392 4383743 424.00 MiB cache
[2019-09-04 18:43:52.445373] 16 4383744 30084095 12.25 GiB userdata
[2019-09-04 18:43:52.450785] 17 30084096 30309375 110.00 MiB boot
[2019-09-04 18:43:52.451318] 18 30309376 30534655 110.00 MiB recovery
[2019-09-04 18:43:52.571000]
[2019-09-04 18:43:52.580472] Regenerate primary and backup GPT from input
[2019-09-04 18:43:52.580657] Writing regenerated GPT to gpt-D01EB0A014660Q99/gpt.bin.gpt
[2019-09-04 18:43:52.581705] Writing regenerated backup GPT to gpt-D01EB0A014660Q99/gpt.bin.bak
[2019-09-04 18:43:52.582690] Writing backup GPT offset to gpt-D01EB0A014660Q99/gpt.bin.offset
Traceback (most recent call last):
File "modules/gpt.py", line 323, in <module>
main()
File "modules/gpt.py", line 277, in main
part_list_mod1 = modify_step1(part_list)
File "modules/gpt.py", line 181, in modify_step1
assert partition['name'].decode("utf-16le").rstrip("\x00") == "userdata", "the last partition is not userdata, refusing modification"
AssertionError: the last partition is not userdata, refusing modification
root@khalid:/home/khalid/Downloads/amonet-douglas-v1.1/amonet#
when i use your method to fix gpt my device boot to hack BL & i flash my modify system.img & boot.img from ota but i can not flash stock rom by sideload because no stock recovery or twrp in my device
You need to run
Code:
sudo ./fastboot-step.shafter running the gpt-fix.
Or if you can still boot your system, just run
Code:
sudo ./step-2.shthanks my friend i send stock recovery.img by dd command and now i get stock recovery but i flash boot.img to boot i will try to flash it to boot_x and try to get twrp by step-2 thanks again
I am not following you. Why do you flash stock recovery?
Just use TWRP to do everything you need.
Don't ever flash to boot or recovery using fastboot as it will overwrite the exploit.
This is all mentioned in the OP
Last edited:
Ok i flash stock recovery because i can not get twrp by step-2 may be i do some wrong steps i will try again thank you for your time
turns out that there was a problem with ours build,
revert back to Fire OS is completely harmless and won't break your TWRP installation or any future rom you want to install.
using the @k4y0z unlock method is the safest way to do any modification or restore the tablet.
about the "rare partition", my tablet had the corrupted gpt way before the unlock so i'm 100% shure that the unlock procedure is safe and with it you can fix your hd8 2017 gpt if you have a similar problem
So I'll ask again, can you still boot FireOS?
If so, what happens when you run step-2.sh?
If you can't boot FireOS can you still boot hacked fastboot?
If so, what happens when you run fastboot-step.sh?
Well, no obvious way.
Check the changelogs.
My versioning scheme typically consists of x.y.z
Where a change in x would indicate changes to the exploit itself (lk-payload).
A change in y would indicate an update to TWRP (or possibly PL/TZ).
A change in z would indicate changes only in the scripts/installation procedure.
Last edited:
now i thing i get big problem when i use the gpt fix command and the last line say reboot to unlocked fastboot my device boot to amazon logo without hacked BL and go to bootloop
about first time when i fix my device and i boot to fireos successfully after flash boot.img to boot not to boot_x .
when i try to use step-1 to get twrp i get error that i send it before and i try to use step-2 same error coming
that is all
Note: the gpt fix command now not work without sort to tp28
Why are you even running the gpt-fix again? Your gpt was already fixed.
It's normal that you have to short TP28 because the preloader isn't bricked.
Please describe exactly what state your device is currently in?
What happens when you boot normally?
What happens when you try to boot recovery via the volume-buttons?
In any case you should be able to unbrick by shorting TP28 and running
Code:
sudo ./bootrom-step.shSimilar threads
Top Liked Posts
-
There are no posts matching your filters.
-
61Read this whole guide before starting.
This is for the 7th gen Fire HD8 (douglas).
Current version: amonet-douglas-v1.2.zip
NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
NOTE: This process will modify the partition-table (GPT) of your device.
NOTE: Your device will be reset to factory defaults (including internal storage) during this process.
What you need:
- A Linux installation or live-system
- A micro-USB cable
Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
Code:sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial adb fastboot dos2unix
1. Extract the attached zip-file "amonet-douglas-v1.1.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings
3. Start the script:
Code:sudo ./step-1.sh
Your device will now reboot into recovery and perform a factory reset.
NOTE: If you are on a firmware newer than 5.6.4.0, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you don't need to run step-2.sh below:
NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"
NOTE: Make sure you re-enable ADB after Factory Reset.
4. Start the script:
Code:sudo ./step-2.sh
The exploit will now be flashed and your device will reboot into TWRP.
You can now install Magisk from there.
Going back to stock
Extract the attached zip-file "amonet-douglas-return-to-stock.zip" into the same folder where you extracted "amonet-douglas-v1.0.zip" and open a terminal in that directory.
You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.
Just use hacked fastboot to
Code:sudo fastboot flash recovery bin/recovery.img
If you want to go back completely (including restoring your GPT):
Code:sudo ./return-to-stock.sh
Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 5.6.4.0 or newer, otherwise you may brick your device)
Important information
In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)
Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Thanks to @t0x1cSH and @breakfastofsecrets for testing.18Yesterday i managed to root updated FireOS and install Lineage 12.1, so, here's my story
Version 5.6.6.0 build 654620620,
on Linux KDE Neon.
- Installed python3, PySerial, adb, fastboot dos2unix as described in this and other posts.
Code:sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial adb fastboot dos2unix - Downloaded the following attachments from the first post : amonet-douglas-v1.2.zip and brick-douglas.zip
- Extract both files to the same folder
- Enable Developer options and enable ADB (inside debugging options) on Amazon tablet
- Plug in the tablet (has to be turned on)
- Now comes the commands execution part. So, open the terminal in Linux (lines that start with // are comments and should not be run from command line - if you copy paste)
Code:sudo systemctl stop ModemManager && sudo systemctl disable ModemManagerCode:adb devices // there should be an item listed // to be sure, you can unplug and run it again, if it's empty, // ou know tablet can connect, so plug in the tablet backCode:adb reboot bootloader // reboots the tablet and awaits commandsCode:sudo ./brick.sh // type YES, hit enter // it will take a couple of minutes (around 3-5min in my case) // watch the tablet for success message, it should be displayed there if everything works // but also, watch your terminal...if it gives you error message similiar to: // ==> [I][U]failed with error message that it can't write somewhere[/U][/I] // you have to try with brick-9820 scriptCode:sudo ./brick-9820.sh // it will take a couple of minutes, similar to above step
NOTE : after either of the above commands (which one succeeds) POWER OFF THE TABLET and DO NOT try to turn it back on. It should stay powered off!!
Code:sudo ./bootrom-step.sh // this will take some time (in my case around 5-10 minutes) // will give you message similar to "awaiting device connection" and nothing else... // although nothing seems to happen, just wait a bit and watch the terminal, it will soon start displaying the process // it should then reboot the tablet, but in my case, that did not happen, so i had to do it manually... // NOTE that althought tablet seems to be "off", it isn't, so press power btn and hold for 5 sec to turn it off // after that click and hold volume up button (when in portrait mode it is the right one, the one closest to power btn) // and immediately after that press and hold the power btn until amazon logo shows itself // it should then show in bottom left corner HACKED FASTBOOT after a few seconds
Code:sudo fastboot devices // there should be a device listed // if not, you should run (in the extracted directory that you are in): ./bin/fastboot devices // if sudo fastboot devices does not show your device but ./bin/fastboot works, you have to edit the fastboot-step.sh file and change the fastboot commands to ./bin/fastbootCode:sudo ./fastboot-step.sh // takes a couple of minutes (1-3 min in my case) // reboots the device
after that you should be in TWRP
NOTE when in TWRP:
DO NOT RESTART tablet before the following
(or amazon fire os will overwrite TWRP and you will be reset to factory default with fireOS, losing everything you've done and starting from scratch...
when it happened to me, the brick-9820.sh didn't work anymore and had to use brick.sh script)
-allow modifications
-format data,system,cache partitions, go to wipe->advanced wipe-> repair/format (something like that), select each of the 3 partitions aformentioned and format to ext4
-if you've done it correctly, there should not be any red warnings
-after that go to wipe, select all partitions and wipe them (just to be sure)
-tablet should be connected and TWRP should be left on
on PC
-download Lineage 12.1 ROM from https://xdaforums.com/hd8-hd10/general/discussion-root-progress-fire-hd-8-t3743024
-download opengapps from https://opengapps.org/
- put them inside amonet-douglas-v1.2 folder where you've extracted the prior ZIP files (just to be clear, you can put them anywhere, but i like to keep it all inside the working directory)
-go to terminal
Code:adb push lineage-12.1-20200614-UNOFFICIAL-douglas.zip /sdcard adb push open_gapps-arm64-5.1-nano-20200624.zip /sdcard
now the files are on the tablet
- in TWRP go to INSTALL, go to /sdcard folder if not in it
- first install Lineage ROM from zip
- then install GApps from zip
hope it works!
I'm glad i've finally rooted it, thank you all for the great content here!13Wire root process
after updating my tablet to the latest version Fire OS 5.6.4.0 (build 636559820) which does not have SW root I have decided to open up the unit and use hardware method which works on all versions of firmware
What you will need
1. wire
2. plastic tool as in the picture below to open the unit.
3. linux machine, I used Raspberry Pi 3+ and Raspbian.
Process:
1. remove SD card from the fire HD to avoid breaking it during the opening process ( yes it happened to me, luckily just 16GB card )
2. use plastic tool to detach display from plastic rear chassis. It is very easy and safe process.
3. Remove 4 screws from the motherboard.
4. detach digitizer ( yellow ) cable and rear camera using plastic tool.
5. You can leave display flex cable, battery and speaker ( soldered ) connected.
6. turn montherboard on the other side so it lays on the battery. There is a small adhesive pad on the left side of PCA, use plastic tool to start lifting the board from that side.
7. find pad TP28 and prepare you Linux PC now
8. DOwnload amonet-douglas-v1.1.zip from OP of the thread , extract.
9. run, it will take a while to update your linux distribution to the latest version.
10. Get your self into the Amonet folder ( most licely Downloads/Amonet ) folder where you extracted ZIP from OP.Code:sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial adb fastboot dos2unix
11. run
12. you should see this msg on the screenCode:sudo ./bootrom-step.sh
Code:[2019-02-07 14:35:59.478924] Waiting for bootrom
13 Now here is the tricky part which will require some practice. You have to short TP28 with grond ( the big pad neer TP28 ) and while doing it connect USB cable to the PC. Here is how I did it.
14. So I was holding the wire in the left hand and used right hand to plug slowly USB cable into the montherboard. ( not easy I know, but you will get there )
15. If you did it right you will see a message on the screen to Release the short wire and hit ENTER.
16. wait till the scripts does its think and when you see this you are in fasboot. Look at the scrren, you should see AMAZON logo and small text on the bottom "fastboot xyz etc..." Don1t unplug table, keep going.
17. run this scriptCode:[2019-02-07 12:11:05.621357] Reboot to unlocked fastboot.
18. Your unit should boot into TWRPCode:sudo ./fastboot-step.sh
19. Assemble back the unit so digitizer will work.
20 boot into TWRP and install Lieage, GAPPS and Magisk. Install Lineage ZIP file from here. https://xdaforums.com/hd8-hd10/orig-development/rom-lineage-12-1-t39536778@willgaj did you enter bootloader mode on the Fire ? Powerdown and then Press VolUp + Power, wait until you see "Enter Recovery" , then select "Bootloader".
Heres how it worked out for me:
Files I used:
amonet-douglas-v1.2.zip from first Page of this Thread:
https://xdaforums.com/attachments/amonet-douglas-v1-2-zip.4845269/
Unpack the Archive to a separate Folder.
brick-douglas.zip from first Page of this Thread:
https://xdaforums.com/attachments/brick-douglas-zip.4825253/
Unpack the Archive to a separate Folder.
MTK-su (i used te 64 bit) from here:
https://xdaforums.com/t/rapid-temporary-root-for-hd-8-hd-10.3904595/
Unpack and copy to the MTK-su from the 64 Bit folder to the “bin” folders of the previous unpacked folders.
Unlock steps:
- Reboot FireHD8 to Recovery (Power Off device, then hold VolUp + Power)
- Select Facotry Reset then Wipe Cache
- Reboot to Bootloader
- You will see the balck screen with “Fastboot” in the lower corner.
- Open Terminal from “brick-douglas” folder an enter “sudo ./brick.sh
” - Check Display output for the “Disconnect USB and Powerdown” Message and do so when prompted
(If theres an Error see below Step 12)
- Open Terminal from “amonet-douglas-v1.2” foder.
- Enter “sudo ./bootrom-step.sh"
- Reconnet USB
- Wait until the bootrom step is finished
- Enter “sudo ./fastboot-step.sh”
- You will end up in TWRP
If theres an error let the FireHD Reboot and do the “Apps and Data Optimization” at the Welcome Install Screen Powerdown the FireHD and enter Bootloader again.
- Open Terminal from “brick-douglas” folder
- Enter “sudo ./brick-8920.sh”
- Check Display output for the “Disconnect usb and powerdown” message and do so when prompted.
- Enter “sudo ./bootrom-step.sh
- Reconnet USB
- Wait until the bootrom step is finished.
- Enter “sudo ./fastboot-step.sh"
- You will end up in TWRP
Lineage OS installation:
Prepare a Micro SD Card with: Lineage OS (Search the forum for the douglas (FireHD 8 7.Gen) or suez (FireHD 10 7Gen) Version, Gapps (ARM64, 7.1, nano) and Magisk and insert in FireHD.
In TWRP Format Data and Wipe data, system, cache.
Install Rom, gapps and magisk
Reboot to Lineage OS
Hardware Method:
If you got stuck somewhere in the middle or the Exploit doesn’t work try the hardware method.
I somehow bricked my HD10 , I think I disconnected the USB because I was to unpatient.
For the Hardware method, you need to open the Tablet, use a prytool or a Creditcars / Knife to remove the backcover, just gently pry around the bezel until the screen pops out.
You need to unscrew the mainboard and gently flip it over , on the HD10 I didn’t had to remove any wire , just be carefull with the speakers and put a piece of cardboard or plastic on the back between the mainboard and battery so it will not shorten or puncture the battery.
Find the CLK pin (theres several pictures on the forum for your specific device) use a piece of wire or paperclip to shorten from a ground plane or the SD Card slot housing to the clock pin. This works best if you got someone that will help you.
- Connect USB to the Tablet, but leave it unplugged on the Computer side.
- Make sure the Tablet is powered down (Press and hold Power button for 30 seconds)
- Open Terminal from “amonet-douglas-v1.2” foder.
- Enter “sudo ./bootrom-step.sh”
- Now shorten CLK to ground and hold it.
- Ask a kind person to plug in the USB cable on the Computer now.
- The Terminal will tell you to remove the wire when ready.
- Press enter and wait for bootrom-step.sh to finish.
- If an error during bootrom step occurs , just retry
- After bootrom step is finished, enter “sudo ./fastboot-step.sh”
- You will end up in TWRP
PS: I directly installed LOS 14.1 on the HD8 , on the HD10 i i used LOS 12.1 because LOS 14.1 is missing Camera Support on the HD10 in fact loosing the camera shouldnt trouble too much as the picture quality is horrible anyways. As for now I am happy to have a running Android on the tabs and don´t need to worry amazon giving me headaches every few weeks when updating CrapOS and redndering my configuration unuseable , i got 14 HD8/10 deloyed around the house as input devices for Homeautomation (running Habpannel).
One thing to mention when switching to LOS, is that you can´t use apps that need to be certified anymore, like Netflix, Banking etc.
Good luck!
PPS: Thanks a lot to k4y0z and his fellas for the great job!
opec8Recently there was a sale on this Fire hd 8 gen 7 for $20 at Woot so I brought it so I tried to hack. It is hard to find a one with the firmware 5.6.4.0 or lower so this is how I got it to work. Honorable mention to Opec who actually got the instructions right so I modified his instructions a little to fit everything in.
A) amonet-douglas-v1.2.zip from first Page of this Thread:
https://xdaforums.com/...p.4845269/
Unpack the Archive to a separate Folder.
B) brick-douglas.zip from first Page of this Thread:
https://xdaforums.com/...p.4825253/
Unpack the Archive to a separate Folder.
1) Boot from a live version of linux (I used Ubuntu mate Lts 20.04) or you can install linux in your computer.
2) Run the following commands to install tools;
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
3) Disable modem manager
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
4) Reboot FireHD8 to Recovery (Power Off device, then hold VolUp + Power)
5) Select Factory Reset then Wipe Cache
6) Reboot to Bootloader. You will see the black screen with "Fastboot" in the lower corner.
7) Connect your usb cable to the tablet.
8) Open Terminal from "brick-douglas" folder an enter "sudo ./brick.sh (note that you are actually bricking your fire tablet in order to recover)
9) Check Display output for the "Disconnect USB and Powerdown" Message and do so when prompted. Proceed to step 10 if there no problems, but it didn't work for me.
*** Note if you see an error and the FireHD Reboot and do the "Apps and Data Optimization" at the Welcome Install Screen Powerdown the FireHD and enter Bootloader again.
a) repeat steps 4-7
b) Enter "sudo ./brick-8920.sh" instead of brick.sh
c) You should see Display output for the "Disconnect usb and powerdown" message and do so when prompted.
10) Open Terminal from "amonet-douglas-v1.2" foder.
11) Enter "sudo ./bootrom-step.sh"
12) Reconnect USB while your tablet is off.
13) Wait until the bootrom step is finished
14) Enter "sudo ./fastboot-step.sh"
15) You will end up in TWRP
16) Prepare a microsd card with Lineage OS 15.1 or 14.1 with the rom and gapps and install Lineage OS.
https://xdaforums.com/...1.4328503/
https://xdaforums.com/...1.4195349/
