Amazon Fire HD 10 9th gen (2019) -- Fire OS 7.3.1.6 root possible?

Search This thread

dizzymon

Senior Member
Apr 26, 2017
61
9
I just bought this tablet on black Friday recently and I was wondering if the rapid root method noted on this other thread would work? I don't like amazon's bloatware on it.

 

lewmur

Senior Member
Apr 30, 2011
1,738
374
I just bought this tablet on black Friday recently and I was wondering if the rapid root method noted on this other thread would work? I don't like amazon's bloatware on it.

Your own post says "up to ... 6.3.0.1". Any recentl tablet is going to be above that, so, no it won't work. The best way to debloat is with the "Toolbox"
 

Droid4200

Member
Oct 19, 2019
34
2
East Coast USA
Nexus 6
Moto G7
I got one when amazon was doing there amazon day for cheap, too bad it comes with newestest firmware. I haven't used it yet since it can't be rooted or roms yet. I hope someone comes up with something soon
 

Attachments

  • IMG_20201025_135139.jpg
    IMG_20201025_135139.jpg
    3 MB · Views: 333

Michajin

Senior Member
Oct 23, 2012
1,230
480
I was just thinking , has anyone tried to open one of these and serial/UART flash to downgrade firmware to a rootable firmware?

I am able to boot into the bootrom through the other exploits on fire devices, the bootrom is how every fire device has been unlocked in the last 2years. No one really has put much effort into unlocking it though. Running the exploit and plugging in to PC during the "waiting for bootrom" would boot it right into the bootrom (lsusb detects mediatek phone), but that is as far as i got as the exploit would have to be set up i believe similar to the firestick4k exploit. I have 2 rooted and one that is not rooted. The mtk-su exploit was blocked on first update. But the mtk-su is a temp root and you can not change the system folder. i havent checked any device higher than 6.3.1.2, I am not sure if you can still boot into it. Either way, it seems that the bootrom for this device was not blocked on the firmware. I believe there is a unlock option here, but i am not the one to figure it out...
 

lewmur

Senior Member
Apr 30, 2011
1,738
374
... i havent checked any device higher than 6.3.1.2, I am not sure if you can still boot into it. Either way, it seems that the bootrom for this device was not blocked on the firmware. I believe there is a unlock option here, but i am not the one to figure it out...
That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.
 

Michajin

Senior Member
Oct 23, 2012
1,230
480
That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.
i dont know if anyone has tried to check to see if the bootrom is available on newer OS. But no one has written code to unlock if there is a bootrom exploit. I will update one this week and see if it will still boot into the bootrom. The mtk-su was just a temp root. The bootrom exploit has potential for full unlock, root, and TWRP... Has anyone try to access it on 7.3.1.6?
 

Michajin

Senior Member
Oct 23, 2012
1,230
480
That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

Looks like they killed the bootrom access since.. i don't know what version killed it.. I am on 6.3.1.7 now. I can only see the preloader now...
 

newnewcomputer

Senior Member
Mar 26, 2014
74
56
That says it all. The current OS version are all higher than that and that no longer works. So far, no one has succeeded in rooting the current OS and you can't downgrade.

@k4y0z has done it again! come join the party @ https://forum.xda-developers.com/t/...k-brainstorming.3979343/page-28#post-84499719


Looks like they killed the bootrom access since.. i don't know what version killed it.. I am on 6.3.1.7 now. I can only see the preloader now...

7.3.1.1 -> 7.3.1.0 confirmed. need more ppl 2 test out other fw rev.
 

Michajin

Senior Member
Oct 23, 2012
1,230
480
@k4y0z has done it again! come join the party @ https://forum.xda-developers.com/t/...k-brainstorming.3979343/page-28#post-84499719




7.3.1.1 -> 7.3.1.0 confirmed. need more ppl 2 test out other fw rev.
i can give it a shot this weekend if i have a device that is on 7.3.1.1. But so few people got access to root or 7.3.1.1, unlocking may be moot if no developers have a want to make a rom. On that note, there should be a shorting method to access the bootrom. Amazon disabled the volume/power on trick somewhere between 7.3.1.2 and 7.3.1.7, not sure what version disabled the easy way. so what all does this do? just downgrade for accessibility to root? What do i need to do this, do i need access to bootrom to downgrade? Trying to read through the posts i got a little lost. I have 3 Mavericks and one is rooted. What would you like me to try, can you give me a step by step. Guess i am asking what rom are you looking for to attempt a downgrade from ? Let me know i will give it a shot, i just have my mavericks in a drawer right now...
 

newnewcomputer

Senior Member
Mar 26, 2014
74
56
... so what all does this do? just downgrade for accessibility to root? What do i need to do this, do i need access to bootrom to downgrade? Trying to read through the posts i got a little lost. I have 3 Mavericks and one is rooted. What would you like me to try, can you give me a step by step. Guess i am asking what rom are you looking for to attempt a downgrade from ? Let me know i will give it a shot, i just have my mavericks in a drawer right now...

all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!
 

Michajin

Senior Member
Oct 23, 2012
1,230
480
all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!

Do you need access to the bootrom to use this? If someone can find access to the bootrom on a updated rom this exploit has a further chance to develop into a custom rom. I suspect the old shorting method should be possible, but i have no idea where to look on the board. I have had it apart before but didn't see anything standing out... but anyways i am charging up my mavericks to see what i have, i know i have a 7.3.1.0, a 7.3.1.1 and a 7.3.1.7. So to be clear, boot into bootrom (volume down and plug in) then run the bypass and rollback? I will test the 7.3.1.1 since i know this one is more likely to succeed
 
Jan 27, 2021
42
12
Do you need access to the bootrom to use this? If someone can find access to the bootrom on a updated rom this exploit has a further chance to develop into a custom rom. I suspect the old shorting method should be possible, but i have no idea where to look on the board. I have had it apart before but didn't see anything standing out... but anyways i am charging up my mavericks to see what i have, i know i have a 7.3.1.0, a 7.3.1.1 and a 7.3.1.7. So to be clear, boot into bootrom (volume down and plug in) then run the bypass and rollback? I will test the 7.3.1.1 since i know this one is more likely to succeed
Yeah there was a successful downgrade from 7.3.1.1 already, it has the same lk/pl as 7.3.1.0 but I haven't been able to get into the bootrom on 7.3.1.2, might need to look into shorting a pin.

I think bootrom through the volume button was killed before 7.3.1.7 though
 
  • Like
Reactions: Michajin

Michajin

Senior Member
Oct 23, 2012
1,230
480
all mine are on 7.3.1.0 so i havent gone thro' the procedure myself. its early n only got 1 confirmed successful case so far (the hack was just put together n tested last few days).

@k4y0z thinks it should work on fw rev. newer than 7.3.1.1. first is to run the bypass utility; then the rollback. if it works out, ur tab will now be running 7.3.1.0 which allows the mtk-su root.

looks like someone has just tried n run into a problem...will need to see how it works out in that thread. good luck!
Do i need to run the bypass utility in linux? I am not familiar with this tool... Have any step by step instructions? i will do my 7311 then i will open my other on 7317 and start looking for a short option (i dont care if i destroy one of these testing, lol). I am going to go deep into it in the morning...
 

k4y0z

Senior Member
Nov 27, 2015
1,429
1,835
Do i need to run the bypass utility in linux? I am not familiar with this tool... Have any step by step instructions? i will do my 7311 then i will open my other on 7317 and start looking for a short option (i dont care if i destroy one of these testing, lol). I am going to go deep into it in the morning...

@Michajin The bypass-utility will run fine on windows, check the README how to set up python and libusb on windows.
I'm not sure if the kamakiri-RPMB Downgrade will work on windows though.
You can use FireISO for both, it should have everything included.

Steps would be:
  1. Run bypass-utility to disable authentication.
  2. Use SP Flash Tool to flash 7.3.1.0
  3. If it doesn't boot due to anti-rollback, run the kamakiri RPMB-downgrade
As for the shorting, there are some options on the back of the board.
Compare with suez (Fire HD 10 - 2017)
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    After seeing a few results, it seems the hardware fix was put into play. I had 2 access points to get into the bootrom when i was on 7.3.1.7/8 before downgrading. I believe the bootrom was disabled on devices. Looking for anyone who has a device purchased before 09/2020. Downgrading to 7.3.1.0 can be completed if you have access to the bootrom. Bootrom access was available to me with the battery disconnected, volume + and then plugging in. There is a shorting option that was working also (fairly easy but doesn't seem necessary with the access). At this point i had to format the preloader because it wouldnt read the emmc without the battery, but the battery when plugged in would load the preloader. Thanks to @k4y0z for his fantastic work. I will be donating a maverick and sloane for his efforts to support us all!
    1
    Do you need access to the bootrom to use this? If someone can find access to the bootrom on a updated rom this exploit has a further chance to develop into a custom rom. I suspect the old shorting method should be possible, but i have no idea where to look on the board. I have had it apart before but didn't see anything standing out... but anyways i am charging up my mavericks to see what i have, i know i have a 7.3.1.0, a 7.3.1.1 and a 7.3.1.7. So to be clear, boot into bootrom (volume down and plug in) then run the bypass and rollback? I will test the 7.3.1.1 since i know this one is more likely to succeed
    Yeah there was a successful downgrade from 7.3.1.1 already, it has the same lk/pl as 7.3.1.0 but I haven't been able to get into the bootrom on 7.3.1.2, might need to look into shorting a pin.

    I think bootrom through the volume button was killed before 7.3.1.7 though
    1
    I can confirm bootrom through the volume button on v7.3.1.7 is not working.
    1
    I have one I bought in July 2020 it has 7.3.1.5 on it. I tried some stuff but not sure if I am doing everything right or not so I would need a step-by-step of what to do.
    What have you tried? The easiest way I have found is to run fireISO and the bootrom-step. When you see "remove short to continue" (but don't hit enter) in another terminal run a lsusb, if you see medtek phone 6227, you are in the bootrom. On my devices I opened the device unplugged the battery. While pressing the volume+ plugging into the usb. The other way is a shooting method that seems reliable for me. But I don't think that with work out the plugging in doesn't. Unplug the tablet or hit ctrl-c to cancel. Have you ever used fireISO or amonet?
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone