[How To] Downgrade to 4.5.3 so you can root device

[powerpoint45]

Step by step instructional video

Help setting up adb for windows: https://www.youtube.com/watch?v=CyJlmTtLsIg

If you are already running Fire OS 4.5.3 and below, all you need to do is follow this video to root: https://youtu.be/KcQ30qcImJc
Steps:
1. Install the Fire OS 5.0 developer preview. EDIT: Do not do this. If you already have a lollypop ROM installed, use that instead of installing dev preview (You could cause a brick)
2. Enable ADB on your device and set up ADB on your computer
3. Download 4.5.3 firmware: https://kindle-fire-updates.s3.amazonaws.com/update-kindle-20.4.5.3_user_453011120.bin (Mirror coming soon. This download works for the Fire HD7 and HD6)
4. connect device to computer and run "adb reboot recovery"
5. use volume keys and power button to navigate to "Apply update from ADB"
6. from computer type "adb sideload update-kindle-20.4.5.3_user_453011120.bin"
7. from tablet select "wipe data/factory reset"
8. from tablet select "reboot system"
9. Complete setup (do not connect to a wifi network yet)
10. Download KingRoot: http://www.kingroot.net/
11. Download JmzFireHDTool: http://forum.xda-developers.com/fir...ool-jmz-fire-hd-7-tool-gapps-disable-t3113655
12. install both apps. "adb install KingRoot-4.1.0.249-release-nolog-201505211812_105001.apk" and "adb install JmzFireHDTool_v4.apk"
13. Temporarily disable otaverify via adb "adb shell pm block com.amazon.otaverifier" (spelled wrong in video)
14. Connect to wifi so that KingRoot can work
15. Open KingRoot on your device
16. press "try to root"
17. re-enable otaverifier "adb shell pm unblock com.amazon.otaverifier" (spelled wrong in video)
18. Open JMZ Fire Tools and press "Disable OTA's"

Note: If you ever need to upgrade back to lollypop, you should follow these steps so you do not brick device: http://forum.xda-developers.com/fire-hd/general/tools-fire-hd-67-rooting-gapps-t3371242/page4

 

[bibikalka]

Awesome find !!! Here is a direct link to the 5.2.0 update file:
http://forum.xda-developers.com/fire-hd/general/lolipop-ota-capture-t3141810

After the downgrade, install TWRP, and upgrade to 4.5.4 but this time with root and fully working GAPPS:

http://forum.xda-developers.com/fire-hd/general/root-v2-0-fireos-4-5-4-gapps-t3150613
http://forum.xda-developers.com/fire-hd/general/how-to-upgrade-to-4-5-4-twrp-root-t3141648

This way one goes directly to SuperSu, and a clean device with no traces of KingRoot.

 

[powerpoint45]

Awesome find !!! Now, can you install TWRP, and try to upgrade to 4.5.4 while keeping root as per this post:
http://forum.xda-developers.com/showpost.php?p=61329063&postcount=4

This way one goes directly to SuperSu, and a clean device with no traces of KingRoot.

ah yes good idea. I'm hoping someone with ROM development knowledge will start a build. We've got just about everything setup so that a custom ROM can run

Sent from my LG-V480 using Tapatalk

 

[bibikalka]

ah yes good idea. I'm hoping someone with ROM development knowledge will start a build. We've got just about everything setup so that a custom ROM can run

The tricky part is that the unlocked bootloader still needs a signed kernel. Which is pretty constraining. It'd be interesting to replace the boot preloader, but the risks are high.

Upon boot (if connected to PC), the system flashes MT65xx pre-loader. Which seems to indicate that one could start looking into programs such as "Smart Phone Flash Tool" and "MTK Droid Tools" for MTK chipsets.

Another hope is that the 5.0 version would be sufficiently buggy, such that the bootloader can be made to boot unsigned kernels.

 

[powerpoint45]

The tricky part is that the unlocked bootloader still needs a signed kernel. Which is pretty constraining. It'd be interesting to replace the boot preloader, but the risks are high.

Upon boot (if connected to PC), the system flashes MT65xx pre-loader. Which seems to indicate that one could start looking into programs such as "Smart Phone Flash Tool" and "MTK Droid Tools" for MTK chipsets.

Another hope is that the 5.0 version would be sufficiently buggy, such that the bootloader can be made to boot unsigned kernels.

Hashcode has gotten around this issue multiple times with something called a bootstrap but I'm not too sure how it works

Sent from my LG-V480 using Tapatalk

 

[bibikalka]

Btw, any chance you could post the direct link to 5.0 preview (for non-developers), since it's probably behind some registration page or something ...

 

[stuckwithname]

i just signed in with my amazon account, you will need to unroot your fire and reset it as 5.0 is a OTA.

 

[powerpoint45]

Btw, any chance you could post the direct link to 5.0 preview (for non-developers), since it's probably behind some registration page or something ...

I wish I could find that bin file link... I looked for it but could not find a link to the actual bin file.. If ota's download to the sdcard then It could still be accessed but I don't know where it downloads to. If it downloads to the data dir of the app it would be inaccesable since you need to be on the latest update in order to download the 5.0 version and on the latest version we have no root which means no access to data dir

Sent from my LG-V480 using Tapatalk

 

[edgar.vrgs]

this is a great find. but stupid me only have a macbook pro and i cant set up adb. sucks..

 

[powerpoint45]

this is a great find. but stupid me only have a macbook pro and i cant set up adb. sucks..

you can set it up on a mac. Just do a little searching. I know it's plausible

Sent from my LG-V480 using Tapatalk

 

[edgar.vrgs]

you can set it up on a mac. Just do a little searching. I know it's plausible

Sent from my LG-V480 using Tapatalk

i have tried but i cant figure it out

 

[devicer]

It worked perfectly. Thanks

 

[bpeery84]

Despite really wanting root and the possibility of using my already paid for apps from the Play store, I really like the lollipop version of fire os. I do think it's a bit ridiculous they haven't retained the old kindle skin because it's exactly how every real android tablet looks but at this point they should be forced by law to let people use the Play store as they wish. Sort of like how Verizon was once forced to allow tethering without a subscription.

 

[powerpoint45]

It worked perfectly. Thanks

great to hear it!

Sent from my LG-V480 using Tapatalk

 

[powerpoint45]

Despite really wanting root and the possibility of using my already paid for apps from the Play store, I really like the lollipop version of fire os. I do think it's a bit ridiculous they haven't retained the old kindle skin because it's exactly how every real android tablet looks but at this point they should be forced by law to let people use the Play store as they wish. Sort of like how Verizon was once forced to allow tethering without a subscription.

I hear ya

Sent from my LG-V480 using Tapatalk

 

[edgar.vrgs]

so i finally got adb on my mac to work, but now when i am on the last command to install 4.5.3 terminal says it can't read update-kindle-20.4.5.3_user_453011120.bin

has anybody done this on a mac and would like to guide me on what i am doing wrong?

 

[powerpoint45]

so i finally got adb on my mac to work, but now when i am on the last command to install 4.5.3 terminal says it can't read update-kindle-20.4.5.3_user_453011120.bin

has anybody done this on a mac and would like to guide me on what i am doing wrong?

does adb devices list your device. Maybe try re-downloading the update in case of corruption

Sent from my LG-V480 using Tapatalk

 

[-lukin-]

Perfect timing! Lost root last week and hoped for a way to get back. You the man

 

[bibikalka]

I wonder if there is a way to stop the update once it's downloaded, in order to grab the 5.0 update bin from /cache.

This would help to re-pack the update in a way that does not re-write key partitions, then one can have TWRP and root on 5.0

It does sound like 5.0 is a nice update, since it provides stock Android. That's what custom ROMs are usually for, but Amazon will give it away !

 

[DoLooper]

I wonder if there is a way to stop the update once it's downloaded, in order to grab the 5.0 update bin from /cache.

I was wondering the same. Seems like you could rename the otaverifier apk back to (plain) .apk and get the download but by keeping com...otaverifier blocked it wouldn't install. I'm just not sure these developer updates are handled like any other.