Amazon Fire HD 10 9th gen (2019) -- Fire OS 7.3.1.6 root possible?

[dizzymon]

I just bought this tablet on black Friday recently and I was wondering if the rapid root method noted on this other thread would work? I don't like amazon's bloatware on it.

Rapid Temporary Root for HD 8 & HD 10

Software root method for Mediatek MT816x, MT817x and MT67xx! A tool that gives you a temporary root shell with Selinux permissive to do with as you please STATUS Confirmed Working Fire HD 8 8th gen (2018) (thanks xyz`) -- up to Fire OS 6.3.0.1...

forum.xda-developers.com

 

[lewmur]

I just bought this tablet on black Friday recently and I was wondering if the rapid root method noted on this other thread would work? I don't like amazon's bloatware on it.

Rapid Temporary Root for HD 8 & HD 10

Software root method for Mediatek MT816x, MT817x and MT67xx! A tool that gives you a temporary root shell with Selinux permissive to do with as you please STATUS Confirmed Working Fire HD 8 8th gen (2018) (thanks xyz`) -- up to Fire OS 6.3.0.1...

forum.xda-developers.com

Your own post says "up to ... 6.3.0.1". Any recentl tablet is going to be above that, so, no it won't work. The best way to debloat is with the "Toolbox"

 

[dizzymon]

I used toolbox but I can't seem to get other web browsers to install. Any ideas?

 

[Droid4200]

I got one when amazon was doing there amazon day for cheap, too bad it comes with newestest firmware. I haven't used it yet since it can't be rooted or roms yet. I hope someone comes up with something soon

 

[dizzymon]

Toolbox got rid of all the amazon things from the UI but the browser remains an issue.

 

[lewmur]

Toolbox got rid of all the amazon things from the UI but the browser remains an issue.

I don't have an issue. Chrome is working fine on my HD 10 2019. OS ver 7.3.1.6

 

[Gary_O]

Toolbox got rid of all the amazon things from the UI but the browser remains an issue.

I was able to install Vivaldi, from the Google Play Store.

 

[Droid4200]

I got one when amazon was doing there amazon day for cheap, too bad it comes with newestest firmware. I haven't used it yet since it can't be rooted or roms yet. I hope someone comes up with something soon

I was just thinking , has anyone tried to open one of these and serial/UART flash to downgrade firmware to a rootable firmware?

 

[Michajin]

I was just thinking , has anyone tried to open one of these and serial/UART flash to downgrade firmware to a rootable firmware?

I am able to boot into the bootrom through the other exploits on fire devices, the bootrom is how every fire device has been unlocked in the last 2years. No one really has put much effort into unlocking it though. Running the exploit and plugging in to PC during the "waiting for bootrom" would boot it right into the bootrom (lsusb detects mediatek phone), but that is as far as i got as the exploit would have to be set up i believe similar to the firestick4k exploit. I have 2 rooted and one that is not rooted. The mtk-su exploit was blocked on first update. But the mtk-su is a temp root and you can not change the system folder. i havent checked any device higher than 6.3.1.2, I am not sure if you can still boot into it. Either way, it seems that the bootrom for this device was not blocked on the firmware. I believe there is a unlock option here, but i am not the one to figure it out...

 

[lewmur]

... i havent checked any device higher than 6.3.1.2, I am not sure if you can still boot into it. Either way, it seems that the bootrom for this device was not blocked on the firmware. I believe there is a unlock option here, but i am not the one to figure it out...

That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

 

[Michajin]

That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

i dont know if anyone has tried to check to see if the bootrom is available on newer OS. But no one has written code to unlock if there is a bootrom exploit. I will update one this week and see if it will still boot into the bootrom. The mtk-su was just a temp root. The bootrom exploit has potential for full unlock, root, and TWRP... Has anyone try to access it on 7.3.1.6?

 

[Michajin]

That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

Looks like they killed the bootrom access since.. i don't know what version killed it.. I am on 6.3.1.7 now. I can only see the preloader now...

 

[newnewcomputer]

That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

@k4y0z has done it again! come join the party @ https://forum.xda-developers.com/t/...k-brainstorming.3979343/page-28#post-84499719

Looks like they killed the bootrom access since.. i don't know what version killed it.. I am on 6.3.1.7 now. I can only see the preloader now...

7.3.1.1 -> 7.3.1.0 confirmed. need more ppl 2 test out other fw rev.

 

[Michajin]

@k4y0z has done it again! come join the party @ https://forum.xda-developers.com/t/...k-brainstorming.3979343/page-28#post-84499719




7.3.1.1 -> 7.3.1.0 confirmed. need more ppl 2 test out other fw rev.

i can give it a shot this weekend if i have a device that is on 7.3.1.1. But so few people got access to root or 7.3.1.1, unlocking may be moot if no developers have a want to make a rom. On that note, there should be a shorting method to access the bootrom. Amazon disabled the volume/power on trick somewhere between 7.3.1.2 and 7.3.1.7, not sure what version disabled the easy way. so what all does this do? just downgrade for accessibility to root? What do i need to do this, do i need access to bootrom to downgrade? Trying to read through the posts i got a little lost. I have 3 Mavericks and one is rooted. What would you like me to try, can you give me a step by step. Guess i am asking what rom are you looking for to attempt a downgrade from ? Let me know i will give it a shot, i just have my mavericks in a drawer right now...

 

[newnewcomputer]

... so what all does this do? just downgrade for accessibility to root? What do i need to do this, do i need access to bootrom to downgrade? Trying to read through the posts i got a little lost. I have 3 Mavericks and one is rooted. What would you like me to try, can you give me a step by step. Guess i am asking what rom are you looking for to attempt a downgrade from ? Let me know i will give it a shot, i just have my mavericks in a drawer right now...

all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!

 

[Michajin]

all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!

Do you need access to the bootrom to use this? If someone can find access to the bootrom on a updated rom this exploit has a further chance to develop into a custom rom. I suspect the old shorting method should be possible, but i have no idea where to look on the board. I have had it apart before but didn't see anything standing out... but anyways i am charging up my mavericks to see what i have, i know i have a 7.3.1.0, a 7.3.1.1 and a 7.3.1.7. So to be clear, boot into bootrom (volume down and plug in) then run the bypass and rollback? I will test the 7.3.1.1 since i know this one is more likely to succeed

 

[StonedEngineer97]

Do you need access to the bootrom to use this? If someone can find access to the bootrom on a updated rom this exploit has a further chance to develop into a custom rom. I suspect the old shorting method should be possible, but i have no idea where to look on the board. I have had it apart before but didn't see anything standing out... but anyways i am charging up my mavericks to see what i have, i know i have a 7.3.1.0, a 7.3.1.1 and a 7.3.1.7. So to be clear, boot into bootrom (volume down and plug in) then run the bypass and rollback? I will test the 7.3.1.1 since i know this one is more likely to succeed

Yeah there was a successful downgrade from 7.3.1.1 already, it has the same lk/pl as 7.3.1.0 but I haven't been able to get into the bootrom on 7.3.1.2, might need to look into shorting a pin.

I think bootrom through the volume button was killed before 7.3.1.7 though

 

[SubparBob]

I can confirm bootrom through the volume button on v7.3.1.7 is not working.

 

[Michajin]

all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!

Do i need to run the bypass utility in linux? I am not familiar with this tool... Have any step by step instructions? i will do my 7311 then i will open my other on 7317 and start looking for a short option (i dont care if i destroy one of these testing, lol). I am going to go deep into it in the morning...

 

[k4y0z]

Do i need to run the bypass utility in linux? I am not familiar with this tool... Have any step by step instructions? i will do my 7311 then i will open my other on 7317 and start looking for a short option (i dont care if i destroy one of these testing, lol). I am going to go deep into it in the morning...

@Michajin The bypass-utility will run fine on windows, check the README how to set up python and libusb on windows.
I'm not sure if the kamakiri-RPMB Downgrade will work on windows though.
You can use FireISO for both, it should have everything included.

Steps would be:

1. Run bypass-utility to disable authentication.
2. Use SP Flash Tool to flash 7.3.1.0
3. If it doesn't boot due to anti-rollback, run the kamakiri RPMB-downgrade

As for the shorting, there are some options on the back of the board.
Compare with suez (Fire HD 10 - 2017)