• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming

Search This thread

SweetBearCub

Senior Member
Dec 27, 2007
95
46
Damn my tablet updates automatically to 7.3.1.1 at the initial process. I hope it will be possible to downgrade the os :)

Before ordering my tablet, I read in other places on the forum that you had to be very careful when ordering the tablet, and on the order page, uncheck the option to link the tablet to your account, which would stop it from logging into WiFi via passwords saved to your Amazon account.

Upon receiving it, cancel the setup by selecting a password protected WiFi, backing out of entering the password, and clicking on the "Skip setup" option that would then appear. Then, once you're in the OS (still not connected to WiFi), enable developer options and ADB debugging, and use the pm disable commends to set various updater packages to disabled. (Fire Toolbox can help)

Without doing these things, at a minimum, the tablet would try to update itself.
 
  • Like
Reactions: peachpuff

dr_docdoc

Member
May 2, 2017
49
22
Waiting for TWRP, because device support Project Treble ARM64 A or ARM_binder64 A (don't know yet, without trying to flash ARM64 A GSI rom), and with Treble this tablet seems very hot deal :)

So I just read up on Project Treble. Seems like it allows stock Android on top of driver code for the device hardware. Is that what you're expecting here? To be able to install stock, virgin Android OS on this device with all the hardware having the drivers through this Project Treble architecture?

If not (and even if so) could you explain a little more about why you think Project Treble will be a "very hot deal," as you suggested? I'd like to learn more!

Thank you!
 

diplomatic

Senior Member
Mar 12, 2017
1,410
1,885
Also a word of caution to those who install Magisk, be extremely careful about what you do with the root privileges. It is not hard to accidentally write something to a verified partition (like system or boot, I think some apps do that without any warning when you give them root privileges) and there's NO WAY to recover your device if you do because we don't have a bootrom exploit to unbrick yet (Amazon removed the ADB reflash option) and you'll have to return the device.
Good luck! :)

Great point! My intention for the bootless root method is to use it only if you have some way to recover the software outside of the OS. So for this tablet, this is all done at fairly significant risk. But that being said, there are some safeguards built in. For example, the boot partition device file is obfuscated so that you can't easily install a Magisk update to it. Also, the system/vendor partitions with verity enabled cannot be easily mounted with write access, which is standard behavior. I recommend only starting Magisk on demand and carefully monitoring what is being done with root access.
 
Last edited:
  • Like
Reactions: dr_docdoc

newnewcomputer

Senior Member
Mar 26, 2014
77
56
it works!!!

me 3/4/5 or whatever - gained temp root on Fire OS 7.3.1.0 w/ @diplomatic new mtk! :D
also installed Magisk following his guide but the limitations:
"
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
"

glad i read that cuz' the very 1st thing i wanna do w/ root was to rename com.amazon.device.software.ota but that file is in /system

its currently dis-abled by the pm disable-user command but my understanding is that Fire OS can override that. permanent sol'n is to rename that package. Because the temp root only works for 7.3.1.0, if an OTA update slips by, Magisk's root access will be gone!

now that i see how important it is to NOT allow the OTA, i might just keep my HD 10 2019 in airplane mode till its BL is unlocked!

thanx again to @diplomatic!!!
edit: just saw the post above - do u read minds too?! lol
 
Last edited:
  • Like
Reactions: diplomatic

MontysEvilTwin

Senior Member
Nov 4, 2016
250
93
me 3/4/5 or whatever - gained temp root on Fire OS 7.3.1.0 w/ @diplomatic new mtk! :D
also installed Magisk following his guide but the limitations:
"
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
"

glad i read that cuz' the very 1st thing i wanna do w/ root was to rename com.amazon.device.software.ota but that file is in /system

its currently dis-abled by the pm disable-user command but my understanding is that Fire OS can override that. permanent sol'n is to rename that package. Because the temp root only works for 7.3.1.0, if an OTA update slips by, Magisk's root access will be gone!

now that i see how important it is to NOT allow the OTA, i might just keep my HD 10 2019 in airplane mode till its BL is unlocked!

thanx again to @diplomatic!!!
edit: just saw the post above - do u read minds too?! lol
How about the command "pm uninstall -k --user 0 <name of package>"? I know this will disable system apps because it was possible to use this command without root up until Fire OS 5.4.0.0, but does not delete the package from the system folder. It would be good to get opinions on this as I CANNOT GUARANTEE that this will not trigger DM-Verity.

---------- Post added at 01:59 AM ---------- Previous post was at 01:52 AM ----------

So here are some images extracted from the stock 7.3.1.0 FW, courtesy of @dr_docdoc. I trimmed the extra partition data. It would great if @k4y0z or @xyz` could take a look at them.
Is there likely to be any possibility of downgrading OS 7.3.1.1 to OS 7.3.1.0? Or is root going to be dependent on a bootloader unlock becoming available? I presume it is not possible to use a non-hacked fastboot to revert to the earlier version?
 
Last edited:

diplomatic

Senior Member
Mar 12, 2017
1,410
1,885
Is there likely to be any possibility of downgrading OS 7.3.1.1 to OS 7.3.1.0? Or is root going to be dependent on a bootloader unlock becoming available? I presume it is not possible to use a non-hacked fastboot to revert to the earlier version?

I can't tell you much about that yet. It would probably depend on whether there is a boot-ROM exploit to be found. Well, both downgrade and standard root would depend on that. And that's not really my department. :)
 
  • Like
Reactions: Michajin

newnewcomputer

Senior Member
Mar 26, 2014
77
56
How about the command "pm uninstall -k --user 0 <name of package>"? I know this will disable system apps because it was possible to use this command without root up until Fire OS 5.4.0.0, but does not delete the package from the system folder. It would be good to get opinions on this as I CANNOT GUARANTEE that this will not trigger DM-Verity.

good point - pm uninstall likely will not trigger DM-Verity but not sure myself either. more importantly how effective it is depends on how Fire OS re-enables/re-installs those packages n we dont know that :(

i do remember the disable system apps capability in 5.3.0.0 as i have a HD 8 running just that! OTA updates n amazon ads never come back for 2+ yrs - i have to go home to check n see if that was done via pm uninstall, disable, or hide command.
 

DB126

Senior Member
Oct 15, 2013
15,274
10,048
... pm uninstall likely will not trigger DM-Verity but not sure myself either.
Will not trigger dm-verity exception as nothing is uninstalled (changed) in the system partition.

---------- Post added at 12:46 PM ---------- Previous post was at 12:44 PM ----------

How is the best way to be updated the moment a stable root/lineageOS is released for the new 2019 10" fire?
Follow this thread and related topics in XDA.
 
  • Like
Reactions: archos5005

davidsummers

Member
Dec 9, 2019
12
1

doah - no luck for me:
1|maverick:/data/local/tmp $ ls -l
total 36
-rwxrwxrwx 1 shell shell 34200 2019-01-01 06:00 mtk-su
maverick:/data/local/tmp $ ./mtk-su -v
armv8l machine
Failed critical init step 4
Firmware support not implemented

I guess mine must have been updated, as its been on wifi here. How do I check? Anyway hopefully now that root has been achieved once, ways to unlock others with be found ...
 
Dec 19, 2019
5
0
got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file
 

dr_docdoc

Member
May 2, 2017
49
22
got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file

This happened to me, too.

Go into reset menu option and do a full system reset (reinstall fresh system wiping everything).

If update didn’t happen, then it will reinstall 7.3.1.0.

From there, be sure to block the OTA services as outlined in earlier post (I think #147) BEFORE you log in to a WiFi router. That’s working for me so far.
 
  • Like
Reactions: Error500
Dec 19, 2019
5
0
This happened to me, too.

Go into reset menu option and do a full system reset (reinstall fresh system wiping everything).

If update didn’t happen, then it will reinstall 7.3.1.0.

From there, be sure to block the OTA services as outlined in earlier post (I think #147) BEFORE you log in to a WiFi router. That’s working for me so far.

i logged in as root, went to /data/ota_package and deleted what looked to be the bin file update as well... going to make really sure... any updates on lineage movement with the temp root? seems like the thread has quieted down a lot!

keep up the good work people!
 

voidling42

Member
Jan 28, 2012
5
0
Skipping initial setup without OTA update

got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file
I also tried to avoid the update and was successful by accident... thought I let you know how:

Usually the setup wizard forces you to connect to a wifi before it lets you proceed to the launcher. I was very carefully trying to figure out what to do on my firewall so I would be able to avoid the OTA update. As I am not an expert in tcpdump, mitmproxy and so on, this took a few tries. After the third time connecting to a wifi without access to WAN (aka the internet) it let me skip the remainder of the setup process.

So thanks to my guest wifi without internet access and not registering the tablet to my amazon account at checkout, I now have 7.3.1.0 Fire HD10 tablet that never accessed the internet.

It may well be that failing to set up a wifi for a few times also allows you to skip the initial setup process.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    Unlock bootloader using adb and root using magisk
    If it was that easy do you think people would donate 100$? Unfortunately to use Magisk you need an unlocked bootloader and we can only archieve bootless root with mtk-su (which limits us from editing the /system partition).
    2
    This tool works on this device, but after sending dd if file to the device is dead link

    Supported devices​

    DeviceModelAndroid VersionTested
    Amazon Fire 7 2017austin – mt8127_evb15.1Yes
    Amazon Fire 7 2015ford – mt8127_evb15.1Yes
    Amazon Fire HD8 2016giza5.1Yes
    Amazon Fire HD8 2017giza5.1Yes
    Amazon Fire HD10 2017suez5.1Yes
    Amazon Fire HD10 2019maverick9.0Yes
    Amazon Fire HD10 2021trona9.0No
    Amazon Fire TV Stick Basictank – mt8127_evb15.1Yes
    Amazon Fire TV Stick 4Kmantis7.1No
    Amazon Fire TV Stick Litesheldon9.0No
    Amazon Fire TV 2 (2015)sloane5.1Yes
    Amazon Echo Inputcupcake7.1Yes
    Amazon Echo Dot 2biscuit5.1No
    Of course the device is dead. The images patched by that tool are supposed to be used with mtkclient to temporarily boot them to temporarily unlock the device. So yeah. It indeed unlocks the bootloader but you need a PC every time you want to reboot the tablet. It's basically some kind of tethered unlock (something like xyz mentioned long time ago).
    1
    Is there any news for maverick root permanent ؟ I have a problem when I try to downgrade to 7.3.1.0 The operation succeeded, but the touch does not work Note that the previous version was 7.3.1.1 Is there any solution؟
    Try reflashing the full load, I think there was downgrade issue with the wifi for a user here and a reflash fixed it
    1

    I am ready to donate $100 to anyone who permanently root this device(y):cowboy:

    1

    I am ready to donate $100 to anyone who permanently root this device(y):cowboy:

    Eh, I know I probably shouldn't engage in this topic because I know developers are probably already trying their hardest, but I would also contribute +50usd if it installs on .12 without hoops, custom recovery to flash without computer would be nice.
    If it does happen the Developer may contact me where to send. If this is out of line, sorry, please remove post.
  • 11
    mtk-su for OS 7.3.1.0

    I just uploaded the latest mtk-su (a thing that gives you temp root) in the Temp root thread. It only supports the original OS. No solution yet for the updated version, but hoping a downgrade or unlock method will be found.
    8
    Can you take apart (remove back cover) your newest Fire HD 10 and post the motherboard pictures with test point like CLK, DAT0, CMD and removed metal shield.

    AmznUser444,

    I’m actually going to respectfully ask you to stop responding to my posts and stop asking me for anything. I will no longer reply to your posts other than to make this request.
    8
    Thanks to @Kramar111, we now have a full dump of 7.3.1.0:

    And a little present from me, minimal kamakiri for maverick.
    All it does is downgrade RPMB, flashing can be done with SP Flash.
    Thanks again to @bengris32 for testing.
    8
    I have repacked and reuploaded maverick-downgrade-7.0_PS7310_940N.zip
    It contains FireOS 7.0/PS7310/940N, scatter file and kamakiri for RPMB downgrade.

    Apparently there are multiple versions of 7.3.1.0 and the files originally uploaded here are from version 7.0/PS7310/939N.
    Also lk was incomplete.

    Thanks again to @Kramar111 for the files :)
    7
    7.3.1.0 Images

    So here are some images extracted from the stock 7.3.1.0 FW, courtesy of @dr_docdoc. I trimmed the extra partition data. It would be great if @k4y0z or @xyz` could take a look at them.