I'm going to lead you through installing Hashcode's 2nd-Bootloader and TWRP in order to start flashing custom ROMs and make backups. First, let's go over the basics and why I'm doing this in the first place. I wrote this guide to be used on a Windows computer, but as long as you can do the same things on Mac/Linux, the whole guide applies. If there are any issues, please first refer to the troubleshooting portion at the end of the guide. The 8.9 version of the device does not need the factory cable to enter fastboot mode.
+Note: As of Amazon OS update 8.3.1+, there has been a lot of issues with rooting and flashing the 2nd-bootloader. Many users reported bootloops during the completion of the guide. Those with tablets running 8.3.1 or higher, please proceed with caution. I strongly recommend you make backups in Step 2.
===== 1. Why do we need a 2nd bootloader? =====
The stock Amazon bootloader doesn't play nice with Android even though it has Android at its core. We can still use fastboot commands with it, but other than that, it's quite locked-down. In other words, normal exploits used to unlock the bootloader on other Android devices, for example, like the Nexus series by Google or the handsets by HTC don't apply here. In order to use the same features, like a custom ROM, custom kernel, custom recovery, we must bypass Amazon's software by installing a 2nd bootloader.
===== 2. Why are you posting a tutorial? =====
I'm doing this because the lack of a guide means that people like myself, who are not proficient developers, keep running into issues and some ended up bricking their devices. This means that they end up with a heavy paperweight, with no chance of fixing, other than hoping that they're lucky with a fastboot cable (not the one that came with the device) and find their way back to the beginning. I'm sick of seeing so many questions about the exact same issues so I thought, why not just make a guide everyone can follow and thus make the world a better place.
===== 3. Do I need any special equipment/knowledge? =====
You don't need any special equipment, provided that you follow this guide word-for-word and be careful. I successfully installed the 2nd-Bootloader + TWRP and flashed CM10.1, within minutes. The key is make sure you don't miss anything, and if you're not sure, don't make any random guesses. As far as knowledge, yes, and no. Know what you're dealing with. Anything underneath the ROM has the chance to brick the device, so know what you're getting into.
===== 4. Can't I just use FireFireFire or another automatic tool to install the bootloader + TWRP? =====
Definitely not. This is the exact reason why there are so many threads in the Q&A section about bricked devices in the first place. Never use a tool that wasn't made for the version of your tablet. The Kindle Fire (1st gen), the Kindle Fire 2 (2nd gen), and the Kindle Fire HD 7" & 8.9" (3rd gen) are not the same devices, at all. Due to the way the bootloader behaves, flashing the files that are only compatible for the Kindle Fire 2 on a Kindle Fire HD 7" will definitely brick it. This is because the bootloader is so-named for a program that checks the booting process before the device actually boots, and if there are any bad sectors that don't match, the device won't boot.
How do you avoid this? By following guides like mine, and first knowing exactly what model you have. Yes, the Kindle Fire 2 and the Kindle Fire HD 7" look similar, and Amazon seriously have problems with their naming method, but a bit of research tells you that the Kindle Fire HD actually contains an HD resolution screen, 1280x800 for the 7" and 1920x1200 for the 8.9". Also, ONLY the Kindle Fire HD 7" and 8.9" models have a front-facing camera while the other models don't have one at all. If you want to be sophisticated about it, you can use working fastboot to identify the tablet.
+Note: if you know 100% that you have the right model, skip to Step 1 and begin the guide. This part is only for those with knowledge of fastboot and would like to confirm scientifically that they have the right model. You don't need to know how to use ADB or fastboot in order to successfullly complete the guide and install custom ROMs:
In CMD, type:
fastboot -i 0x1949 getvar product
===== 5. What is Android SDK, ADB, and Fastboot? =====
Android SDK is a package with the tools for an Android developer to modify devices and collect data to help them create builds and maintain a device. Included in the package is what we commonly use around here in the development world, called ADB (Android Debug Bridge) and Fastboot. ADB allows a computer to communicate with a device by means of a USB cable, allowing a developer to push and pull data between the two devices, and this is the way some root methods are discovered.
Fastboot is the term we use to refer to a diagnostic tool built into Android. This is because fastboot is the first thing a developer turns to when their device is bricked. Factory cables are designed to power the devices into fastboot, and that's all they're really good for. While ADB is for communication between two devices, pushing and pulling data, fastboot is all about writing data into the partitions on a device. We call this process "flashing". This is only for the 7 version of the device, the 8.9 version does not require the factory cable.
Generally, ADB commands in command prompts start with "adb" (i.e. "adb reboot bootloader" which commands a typical Android device to boot into bootloader mode, another name for fastboot mode). ADB commands can only be used when both devices are fully booted up, and ADB debugging is selected on the Android device. After the device boots into fastboot, the device no longer recognizes ADB commands, only fastboot commands. Likewise, in fastboot mode, commands begin with "fastboot" (i.e. "fastboot oem unlock" which unlocks the bootloader on many Android devices). While in fastboot mode, the only safe way to exit is by typing "fastboot reboot" although the usual power button will be fine for most cases.
On the Kindle Fire HD 7" and 8.9", you will notice that the fastboot commands look something like this: "fastboot -i 0x1949 flash boot boot.img" ("flash" is the command to flash a file, "boot" is the partition to flash the file into, and "boot.img" is the image file containing the booting information). The reason why there's a "-i 0x1949" is simply because of the locked-down bootloader. After we install the 2nd-bootloader, this part commands the device to flash the files into the stock bootloader, because the 2nd-bootloader doesn't accept fastboot commands.
To install the Android SDK and be able to use ADB + fastboot, go to this link: Android SDK. After you hit download, just be patient, and you will need a video reference to help set up the package properly, so click here: Video on Installation of Android SDK. To check if it installed properly, once you're done with the video, open up a command prompt (for Windows, hold the Windows key + R, and type cmd, then hit Enter), and type either "adb" or "fastboot" and hit Enter. For both cases, you should get a block of text that tells you what each command does.
To check if your device can work with ADB, enable ADB on the device (may be called USB debugging), and connect it to the computer. If there are any drivers installing, let them finish. Then, on the command prompt, type "adb devices" and hit Enter. If your ADB drivers work, you should see a line of letters and characters. Same thing with fastboot. Always do this check before you start messing around to make sure your devices are receiving the commands.
===== 6. How do I boot into fastboot mode? =====
This relies on you having a working device (as long as it can boot at all, you're good). If you wish to enter fastboot mode to flash system images like new versions of TWRP or restore Amazon OS 8.1.4 if you've got freezing or bootloops, then you need a regular USB cable that came with the device, or any other mini-USB cable that fits the device and the computer. Again, you need to have Android SDK installed before you can use fastboot. Turn the device off, and leave it unplugged. Go to your computer, open command prompt, and type this:
fastboot -i 0x1949 getvar product
fastboot -i 0x1949 reboot
+Note: Some users reported not being able to root on later software versions, so check for 8.1.4 in your Settings, if it's higher than that, you may have some trouble, which is why I provided 3 methods.
Before you can do anything else, you need to root the device first. Rooting is the process of acquiring superuser (administrator) access on a Linux system, allowing you to modify just about anything with regards to software. It is generally very safe to do, provided you follow the correct guides and you use the correct tools, and if there are no tools, the knowledge to manually root the device. On many other Android devices, rooting also installs a custom recovery, but the Kindle Fire HD 8.9" is different. You must root first before you do any modifications.
Go to this thread: QEMU Root by sparkym3, and download the necessary attachments. Use any decompressing software to unzip the files, and install the Kindle Fire HD 8.9" ADB drivers (this may fail, no need to worry). Then jump to your device, go to Settings and turn on ADB, then plug it into your computer. At this time, your computer should report that the ADB Composite Interface has been installed. What this means is that your ADB drivers work. Go ahead and use that thread's instructions to root the device.
Alternatively, you can use this if the first method failed: Root_with_Restore_by_Bin4ry, same idea. Make sure your ADB drivers are working, and that ADB is turned on in Settings. Open the RunMe.bat file, choose option 1. Now it will ask for your Amazon account password to restore, go ahead and type in your password and proceed. After the device reboots, it will be sluggish, now run the first method again, and you'll be back to normal with root.
You can aso try this: Root Kindle Fire HD with Windows
To check if you're rooted, when the device is on, go to the Amazon Appstore, install "ES File Manager" or any other root application, you want to see the window asking for superuser permissions. Once it installs, open it, go to settings, and turn on root browsing. If it asks for superuser permissions, you have root access, and you can move on to the next step. If the root programs say you have root, but you don't see the window asking for the permission, remember to go to the app listing, and tap on superuser to initialize the daemon, then try to check for root again.
1. Download the root tools from the threads
2. Proceed to root by using the provided tools
3. Check if you successfully have root access using any root application
Once you're rooted successfully, you need to grab the files we'll need for the installation. Go to Hashcode's thread: Kindle Fire 2nd-bootloader + TWRP for the Kindle Fire HD 8.9. Download ONLY two files: the TWRP recovery image, and the freedom-boot image. That's all, and transfer both of those to the root of the sdcard, now you can move on to Step 3: Installation if you wish to skip backing up.
I will go through the steps to backup. Remember that it is not mandatory that you do this; should you follow the guide very closely, you do not require backing up whatsoever. This just serves as an extraneous step for those who feel comfortable working with ADB and would like to participate in modding the device, in which case these files would come in handy in case the device is bricked. Again, it is NOT mandatory.
Connect the device to the computer through a normal USB cable, turn on ADB through settings. Open up the command prompt (CMD) on your computer: hold down the Windows key, and press R. This will open up Run, type "cmd" and hit Enter. Now, enter the following lines of code one-by-one, wait for a line to finish before going to the next one.
adb shell su -c "dd if=/dev/block/mmcblk0boot0 of=/sdcard/boot0block.img" adb shell su -c "dd if=/dev/block/platform/omap/omap_hsmmc.1/by-name/boot of=/sdcard/stock-boot.img" adb shell su -c "dd if=/dev/block/platform/omap/omap_hsmmc.1/by-name/recovery of=/sdcard/stock-recovery.img" adb shell su -c "dd if=/dev/block/platform/omap/omap_hsmmc.1/by-name/system of=/sdcard/stock-system.img" mkdir C:\KFHD8Backup adb pull /sdcard/stock-boot.img/ [C:\KFHD8Backup] adb pull /sdcard/stock-recovery.img/ [C:\KFHD8Backup] adb pull /sdcard/stock-system.img/ [C:\KFHD8Backup]
If you need to flash these to restore the device in case you have bricked it, boot into fastboot mode. Place the folder and the files in it back to the C: drive before attempting to restore (if you know how to use the cd command, feel free to change the location of the files). Once you're in fastboot, start with the first line of code to command CMD to locate the backups folder, then proceed with the second, one-at-a-time:
cd C:/KFHD8Backup fastboot -i 0x1949 flash boot stock-boot.img fastboot -i 0x1949 flash recovery stock-recovery.img fastboot -i 0x1949 flash system stock-system.img fastboot -i 0x1949 reboot
Also, know that these files, when flashed through fastboot, will revert your device back to the state of when these backups were made, so once you have TWRP, these files are no longer important. The backups you make in TWRP will be just as useful, and can save you both time and patience. If, however, you want to revert to a completely stock Amazon OS software for warranty purposes, or to redo this process for any reason, they will come into play because these backups retain your apps and your settings. Otherwise, use the KFHD System Restore Tool to go completely stock.
After you have backed-up (optional), and you have the two needed files on the sdcard (TWRP image and freedom-boot image, ignore the Amazon OS and the stack override files), you can move on to step three.
1. Go to Hashcode's 2nd-bootloader thread
2. Download both the required files and move them to sdcard
3. Use ADB to make backups (optional)
4. Use fastboot to restore the images you backed up if there are issues
You might have noticed that Hashcode made a pretty extensive thread to help you flash the bootloader, but another coder has since developed an automatic app to do all the work for you: FireFlash. Go ahead and download the .apk file. Move that file to the sdcard, and on the device, install it using "ES File Manager" (tap on that file) or "Easy Installer" (after it finishes scanning, select it and install), both found on the Amazon Appstore. You will then find it in the applications listing, go ahead and open it.
The first thing you notice is that there are spots to plug in files for different partitions. This is where those files from Hashcode come into play. Plug the freedom-boot.img into the boot partition space, plug the TWRP recovery.img into the recovery partition, and make sure to hit "apply stack". If you are NOT on the 8.1.4 bootloader (you'll see red letters warning you), then hit the check box next to that to flash the 8.1.4 bootloader, otherwise you'll see a red screen after you reboot. If you don't see that warning, you're fine, move on.
Check that "disable recovery auto update" box, leave everything else alone, unplug the cable, and hit flash (the first option). You will see a progress window, and just hit OK. Then, turn off the device. Now, when you turn it on, this is the way to enter recovery every time: the moment you turn it on, you'll see the yellow Kindle title. Immediately hold down the Volume Up button (leftmost from the power button) before it turns blue, and once it does, count to three in your head and let go and you'll see the TWRP splash logo. Once you're in TWRP, you're done. Just hit reboot, and everything's finished. Now you can browse the 8.9" Development forum for custom ROMs.
If you want to save space, you can now go ahead and delete all the files we just used; you no longer have a need for any of them. Keep FireFlash, though, because in the future you might want to update TWRP, then leave everything blank, plug the update image into the recovery partition and hit flash. Only use Hashcode's TWRP builds as of now, because he specifically altered those builds to work on the Kindle Fire HD 7" and 8.9" so the official ones on the TWRP site won't work. If you flash those (especially the "blaze" codename), you will brick the device, so don't do it!
1. Download FireFlash and install on device using file manager or installer
2. Plug in the required files in the correct areas, and check the necessary checkboxes
3. Flash, and boot into TWRP to confirm successful installation of both 2nd-Bootloader and TWRP recovery
This is what you've been waiting for, the ability to load custom ROMs. You have a few choices at this point in time. This list contains (somewhat, if not) stable releases only:
1. CyanogenMod 11 by Hashcode (AOSP, Android 4.4 KitKat)
2. ParanoidAndroid Port by jb2kred (AOKP, Android 4.2.2 Jelly Bean)
3. PAC-man by goldflame09 (AOKP, hybrid of CM + PA, Android 4.3 Jelly Bean)
4. CM11/SGT7 by twa-priv (CM + Samsung Galaxy Tab 7 mods, Android 4.4 KitKat)
Once you have the .zip files for the ROMs with GApps (Google apps, like Play Store), place them on the sdcard, and turn off the device. Turn it on, hold Volume-Up before the logo turns blue, and enter TWRP. Once there, immediately do two things: make a backup, and after that, wipes: system, factory reset, cache, and Dalvik cache. After these two things are done, go ahead and flash the .zip file, and wait for it to finish. After it finishes, go ahead and again, wipe cache and Dalvik cache, then reboot. After you rebooted, wait 5 minutes, then reboot again, and you're all done!
Now, in case your custom ROM doesn't automatically include GApps, and you would know if you boot up and you don't see Play Store or Google Maps in the app drawer, follow this. Go to this link. You will notice a table, and on the left side, you see the CM version that corresponds to the Android version number. All the custom ROMs should use the row that corresponds to the Android version. For example, CM10.1 runs 4.2.2, CM10.2 runs 4.3, so click on the one that corresponds. If your ROM runs 4.2.2, use the 4.2.2 row, etc. After you finish downloading that .zip file, move it to the sdcard, and boot into TWRP. From there, if you want to be fancy, wipe cache and Dalvik cache before flashing, but you don't have to unless there are problems after you restart. If there are problems, like freezing on boot, or crashing, then boot back into TWRP and wipe the two cache partitions.
Generally, you only need to flash the file and you're done, but you can never be too safe. This also applies to ROMs: if you're moving from ROM to ROM, say Ubuntu Touch to CM10.1, you MUST wipe EVERYTHING except the sdcard itself, and this includes the "Factory Reset" option. However, if you're moving from one update of a ROM to another, say a nightly of CM10.1 to a newer nightly of CM10.1, you can just simply flash the update over the old one, no wiping needed (this is called dirty-flashing). However, again, if you notice problems afterward, simply boot back in TWRP and wipe the two cache partitions. Remember to always make backups before you make changes to an otherwise stable build. If there are issues that you can't seem to resolve, you can always restore back to the previous build.
1. Download .zip for ROM + GApps and move to sdcard
2. Boot into TWRP, make backups, and wipe the necessary partitions
3. Flash ROM, and wipe cache + Dalvik cache, then reboot
4. Wait for 5 minutes after successful reboot, then reboot again
5. If there's no GApps for your ROM, use the link to download the proper version.
6. Move the file to sdcard, then boot into TWRP and flash.
7. Reboot, and if there are problems, reboot back into TWRP and wipe cache partitions.