New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming

[SweetBearCub]

Damn my tablet updates automatically to 7.3.1.1 at the initial process. I hope it will be possible to downgrade the os

Before ordering my tablet, I read in other places on the forum that you had to be very careful when ordering the tablet, and on the order page, uncheck the option to link the tablet to your account, which would stop it from logging into WiFi via passwords saved to your Amazon account.

Upon receiving it, cancel the setup by selecting a password protected WiFi, backing out of entering the password, and clicking on the "Skip setup" option that would then appear. Then, once you're in the OS (still not connected to WiFi), enable developer options and ADB debugging, and use the pm disable commends to set various updater packages to disabled. (Fire Toolbox can help)

Without doing these things, at a minimum, the tablet would try to update itself.

 

[CaptR3dBeard]

OK using mtk-su_r19.zip


is r19 the right one to use?

No, download the one from this thread
https://forum.xda-developers.com/hd...hd-8-hd-10-t3904595/post81211881#post81211881

 

[dr_docdoc]

Waiting for TWRP, because device support Project Treble ARM64 A or ARM_binder64 A (don't know yet, without trying to flash ARM64 A GSI rom), and with Treble this tablet seems very hot deal

So I just read up on Project Treble. Seems like it allows stock Android on top of driver code for the device hardware. Is that what you're expecting here? To be able to install stock, virgin Android OS on this device with all the hardware having the drivers through this Project Treble architecture?

If not (and even if so) could you explain a little more about why you think Project Treble will be a "very hot deal," as you suggested? I'd like to learn more!

Thank you!

 

[diplomatic]

Also a word of caution to those who install Magisk, be extremely careful about what you do with the root privileges. It is not hard to accidentally write something to a verified partition (like system or boot, I think some apps do that without any warning when you give them root privileges) and there's NO WAY to recover your device if you do because we don't have a bootrom exploit to unbrick yet (Amazon removed the ADB reflash option) and you'll have to return the device.
Good luck!

Great point! My intention for the bootless root method is to use it only if you have some way to recover the software outside of the OS. So for this tablet, this is all done at fairly significant risk. But that being said, there are some safeguards built in. For example, the boot partition device file is obfuscated so that you can't easily install a Magisk update to it. Also, the system/vendor partitions with verity enabled cannot be easily mounted with write access, which is standard behavior. I recommend only starting Magisk on demand and carefully monitoring what is being done with root access.

 

[newnewcomputer]

it works!!!

me 3/4/5 or whatever - gained temp root on Fire OS 7.3.1.0 w/ @diplomatic new mtk!
also installed Magisk following his guide but the limitations:
"
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
"

glad i read that cuz' the very 1st thing i wanna do w/ root was to rename com.amazon.device.software.ota but that file is in /system

its currently dis-abled by the pm disable-user command but my understanding is that Fire OS can override that. permanent sol'n is to rename that package. Because the temp root only works for 7.3.1.0, if an OTA update slips by, Magisk's root access will be gone!

now that i see how important it is to NOT allow the OTA, i might just keep my HD 10 2019 in airplane mode till its BL is unlocked!

thanx again to @diplomatic!!!
edit: just saw the post above - do u read minds too?! lol

 

[diplomatic]

7.3.1.0 Images

So here are some images extracted from the stock 7.3.1.0 FW, courtesy of @dr_docdoc. I trimmed the extra partition data. It would be great if @k4y0z or @xyz` could take a look at them.

 

[MontysEvilTwin]

me 3/4/5 or whatever - gained temp root on Fire OS 7.3.1.0 w/ @diplomatic new mtk!
also installed Magisk following his guide but the limitations:
"
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
"

glad i read that cuz' the very 1st thing i wanna do w/ root was to rename com.amazon.device.software.ota but that file is in /system

its currently dis-abled by the pm disable-user command but my understanding is that Fire OS can override that. permanent sol'n is to rename that package. Because the temp root only works for 7.3.1.0, if an OTA update slips by, Magisk's root access will be gone!

now that i see how important it is to NOT allow the OTA, i might just keep my HD 10 2019 in airplane mode till its BL is unlocked!

thanx again to @diplomatic!!!
edit: just saw the post above - do u read minds too?! lol

How about the command "pm uninstall -k --user 0 <name of package>"? I know this will disable system apps because it was possible to use this command without root up until Fire OS 5.4.0.0, but does not delete the package from the system folder. It would be good to get opinions on this as I CANNOT GUARANTEE that this will not trigger DM-Verity.

---------- Post added at 01:59 AM ---------- Previous post was at 01:52 AM ----------

So here are some images extracted from the stock 7.3.1.0 FW, courtesy of @dr_docdoc. I trimmed the extra partition data. It would great if @k4y0z or @xyz` could take a look at them.

Is there likely to be any possibility of downgrading OS 7.3.1.1 to OS 7.3.1.0? Or is root going to be dependent on a bootloader unlock becoming available? I presume it is not possible to use a non-hacked fastboot to revert to the earlier version?

 

[diplomatic]

Is there likely to be any possibility of downgrading OS 7.3.1.1 to OS 7.3.1.0? Or is root going to be dependent on a bootloader unlock becoming available? I presume it is not possible to use a non-hacked fastboot to revert to the earlier version?

I can't tell you much about that yet. It would probably depend on whether there is a boot-ROM exploit to be found. Well, both downgrade and standard root would depend on that. And that's not really my department.

 

[newnewcomputer]

How about the command "pm uninstall -k --user 0 <name of package>"? I know this will disable system apps because it was possible to use this command without root up until Fire OS 5.4.0.0, but does not delete the package from the system folder. It would be good to get opinions on this as I CANNOT GUARANTEE that this will not trigger DM-Verity.

good point - pm uninstall likely will not trigger DM-Verity but not sure myself either. more importantly how effective it is depends on how Fire OS re-enables/re-installs those packages n we dont know that

i do remember the disable system apps capability in 5.3.0.0 as i have a HD 8 running just that! OTA updates n amazon ads never come back for 2+ yrs - i have to go home to check n see if that was done via pm uninstall, disable, or hide command.

 

[archos5005]

Hopefully XDA devs will be motivated to root this one. Sounds worth the effort.

YES! I love the speed on it, but would rather have a a fully Google Tablet, not FireOS. How is the best way to be updated the moment a stable root/lineageOS is released for the new 2019 10" fire?

 

[DB126]

... pm uninstall likely will not trigger DM-Verity but not sure myself either.

Will not trigger dm-verity exception as nothing is uninstalled (changed) in the system partition.

---------- Post added at 12:46 PM ---------- Previous post was at 12:44 PM ----------

How is the best way to be updated the moment a stable root/lineageOS is released for the new 2019 10" fire?

Follow this thread and related topics in XDA.

 

[davidsummers]

No, download the one from this thread
https://forum.xda-developers.com/hd...hd-8-hd-10-t3904595/post81211881#post81211881

doah - no luck for me:

1|maverick:/data/local/tmp $ ls -l
total 36
-rwxrwxrwx 1 shell shell 34200 2019-01-01 06:00 mtk-su
maverick:/data/local/tmp $ ./mtk-su -v
armv8l machine
Failed critical init step 4
Firmware support not implemented

I guess mine must have been updated, as its been on wifi here. How do I check? Anyway hopefully now that root has been achieved once, ways to unlock others with be found ...

 

[peachpuff]

nm...

 

[CaptR3dBeard]

doah - no luck for me:

How do I check?

Settings>Device Options>System Updates

 

[davidsummers]

Settings>Device Options>System Updates

Odd - that goes back to the settings menu for me!

 

[SweetBearCub]

Odd - that goes back to the settings menu for me!

As far as I know, that means that you have at least 1 of the 3 possible OTA apks disabled. Not sure which one, though, off the top of my head.

 

[bobjackson.other]

got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file

 

[dr_docdoc]

got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file

This happened to me, too.

Go into reset menu option and do a full system reset (reinstall fresh system wiping everything).

If update didn’t happen, then it will reinstall 7.3.1.0.

From there, be sure to block the OTA services as outlined in earlier post (I think #147) BEFORE you log in to a WiFi router. That’s working for me so far.

 

[bobjackson.other]

This happened to me, too.

Go into reset menu option and do a full system reset (reinstall fresh system wiping everything).

If update didn’t happen, then it will reinstall 7.3.1.0.

From there, be sure to block the OTA services as outlined in earlier post (I think #147) BEFORE you log in to a WiFi router. That’s working for me so far.

i logged in as root, went to /data/ota_package and deleted what looked to be the bin file update as well... going to make really sure... any updates on lineage movement with the temp root? seems like the thread has quieted down a lot!

keep up the good work people!

 

[voidling42]

Skipping initial setup without OTA update

got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file

I also tried to avoid the update and was successful by accident... thought I let you know how:

Usually the setup wizard forces you to connect to a wifi before it lets you proceed to the launcher. I was very carefully trying to figure out what to do on my firewall so I would be able to avoid the OTA update. As I am not an expert in tcpdump, mitmproxy and so on, this took a few tries. After the third time connecting to a wifi without access to WAN (aka the internet) it let me skip the remainder of the setup process.

So thanks to my guest wifi without internet access and not registering the tablet to my amazon account at checkout, I now have 7.3.1.0 Fire HD10 tablet that never accessed the internet.

It may well be that failing to set up a wifi for a few times also allows you to skip the initial setup process.