• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming

Search This thread

I am ready to donate $100 to anyone who permanently root this device(y):cowboy:

Eh, I know I probably shouldn't engage in this topic because I know developers are probably already trying their hardest, but I would also contribute +50usd if it installs on .12 without hoops, custom recovery to flash without computer would be nice.
If it does happen the Developer may contact me where to send. If this is out of line, sorry, please remove post.
 
  • Like
Reactions: almazen81

@Malware

Member
Nov 14, 2021
43
3
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie:

https://arstechnica.com/gadgets/201...hd-10-tablet-costs-149-and-charges-via-usb-c/

I most certainly don't need any more fire tablets in my life, but this does look pretty cool. I wonder how hackable it is :p

Update 12/27/2019:
See post below for temporary root method from @diplomatic:

https://forum.xda-developers.com/hd...xperimental-software-root-hd-8-hd-10-t3904595

Note that this is only compatible with the firmware fresh out of the box. Do not let it update if you want temporary root.

You can also make use of bootless root for a more permanent root solution (though, you cannot modify the system partition):

https://forum.xda-developers.com/showpost.php?p=79626434&postcount=135
Unlock bootloader using adb and root using magisk
 

@Malware

Member
Nov 14, 2021
43
3
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie:

https://arstechnica.com/gadgets/201...hd-10-tablet-costs-149-and-charges-via-usb-c/

I most certainly don't need any more fire tablets in my life, but this does look pretty cool. I wonder how hackable it is :p

Update 12/27/2019:
See post below for temporary root method from @diplomatic:

https://forum.xda-developers.com/hd...xperimental-software-root-hd-8-hd-10-t3904595

Note that this is only compatible with the firmware fresh out of the box. Do not let it update if you want temporary root.

You can also make use of bootless root for a more permanent root solution (though, you cannot modify the system partition):

https://forum.xda-developers.com/showpost.php?p=79626434&postcount=135
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie:

https://arstechnica.com/gadgets/201...hd-10-tablet-costs-149-and-charges-via-usb-c/

I most certainly don't need any more fire tablets in my life, but this does look pretty cool. I wonder how hackable it is :p

Update 12/27/2019:
See post below for temporary root method from @diplomatic:

https://forum.xda-developers.com/hd...xperimental-software-root-hd-8-hd-10-t3904595

Note that this is only compatible with the firmware fresh out of the box. Do not let it update if you want temporary root.

You can also make use of bootless root for a more permanent root solution (though, you cannot modify the system partition):

https://forum.xda-developers.com/showpost.php?p=79626434&postcount=135
Unlock bootloader using adb and root using magisk
 

Rortiz2

Senior Member
Mar 1, 2018
2,259
1,551
Barcelona
Unlock bootloader using adb and root using magisk
If it was that easy do you think people would donate 100$? Unfortunately to use Magisk you need an unlocked bootloader and we can only archieve bootless root with mtk-su (which limits us from editing the /system partition).
 

MrZaku086

Member
Apr 8, 2021
34
7
off topic rooting and unlocking the bootloader of 10 and 11 tablet generation looks more harder that having a 3d sex life than is no vr porn.

good luck i donate my hope because im from argetina and the only thing in my bank account is 0 and hope,
 

almazen81

Member
Aug 15, 2017
10
4
40
iraq
This tool works on this device, but after sending dd if file to the device is dead link

Supported devices​

DeviceModelAndroid VersionTested
Amazon Fire 7 2017austin – mt8127_evb15.1Yes
Amazon Fire 7 2015ford – mt8127_evb15.1Yes
Amazon Fire HD8 2016giza5.1Yes
Amazon Fire HD8 2017giza5.1Yes
Amazon Fire HD10 2017suez5.1Yes
Amazon Fire HD10 2019maverick9.0Yes
Amazon Fire HD10 2021trona9.0No
Amazon Fire TV Stick Basictank – mt8127_evb15.1Yes
Amazon Fire TV Stick 4Kmantis7.1No
Amazon Fire TV Stick Litesheldon9.0No
Amazon Fire TV 2 (2015)sloane5.1Yes
Amazon Echo Inputcupcake7.1Yes
Amazon Echo Dot 2biscuit5.1No
 

Rortiz2

Senior Member
Mar 1, 2018
2,259
1,551
Barcelona
This tool works on this device, but after sending dd if file to the device is dead link

Supported devices​

DeviceModelAndroid VersionTested
Amazon Fire 7 2017austin – mt8127_evb15.1Yes
Amazon Fire 7 2015ford – mt8127_evb15.1Yes
Amazon Fire HD8 2016giza5.1Yes
Amazon Fire HD8 2017giza5.1Yes
Amazon Fire HD10 2017suez5.1Yes
Amazon Fire HD10 2019maverick9.0Yes
Amazon Fire HD10 2021trona9.0No
Amazon Fire TV Stick Basictank – mt8127_evb15.1Yes
Amazon Fire TV Stick 4Kmantis7.1No
Amazon Fire TV Stick Litesheldon9.0No
Amazon Fire TV 2 (2015)sloane5.1Yes
Amazon Echo Inputcupcake7.1Yes
Amazon Echo Dot 2biscuit5.1No
Of course the device is dead. The images patched by that tool are supposed to be used with mtkclient to temporarily boot them to temporarily unlock the device. So yeah. It indeed unlocks the bootloader but you need a PC every time you want to reboot the tablet. It's basically some kind of tethered unlock (something like xyz mentioned long time ago).
 

almazen81

Member
Aug 15, 2017
10
4
40
iraq
Of course the device is dead. The images patched by that tool are supposed to be used with mtkclient to temporarily boot them to temporarily unlock the device. So yeah. It indeed unlocks the bootloader but you need a PC every time you want to reboot the tablet. It's basically some kind of tethered unlock (something like xyz mentioned long time ago).
no I have bootrom-step.sh To get the device back to work .I'll try another way and see if it works without dying
 

x3r0.13urn

Senior Member
Nov 1, 2012
152
50
I was wondering if there is anyone here had tried whether mtkclient unlock bootloader works for 2019 (or 2021) device? I've searched some thread and found nobody reporting it, yet.
 
  • Like
Reactions: 789mod

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    I was wondering if there is anyone here had tried whether mtkclient unlock bootloader works for 2019 (or 2021) device? I've searched some thread and found nobody reporting it, yet.
    No, the "unlock bootloader" option of mtkclient won't work here because Amazon isn't using the seccfg partition to handle the bootloader status of their devices. However, all the other options are working correctly (read, write, boot patched images, etc).
    3
    No, the "unlock bootloader" option of mtkclient won't work here because Amazon isn't using the seccfg partition to handle the bootloader status of their devices. However, all the other options are working correctly (read, write, boot patched images, etc).

    I tried unlocking the bootloader through MTK TOOL and it worked, I was able to extract MT6771_android_scatter and preloader_maverick.bin ,How do I know if the process has already succeeded or not, by the way I can read and write all system files boot AND lk , recovery.img , etc .

    on 7.3.1.0



    1. Turn Off Phone
    2. Hold VOL+ And VOL- Then Insert Usb Cable
    3. Phone must have battery inside!
    Waiting For Device . . .

    Device : Found
    CPU : MT6771/MT8385/MT8183/MT8666(Helio P60/P70/G80)
    HW version : 0x0
    WDT : 0x10007000
    Uartt : 0x11002000
    Brom addr : 0x100a00
    DA addr : 0x201000
    CQ_DMA addr : 0x10212000
    Var : 0xa
    Disabling Watchdog ... OK
    HW code : 0x788
    Target config : 0xe5
    SBC enabled : True
    SLA enabled : False
    DAA enabled : True
    SWJTAG enabled : True
    Root cert required : False
    Mem read auth : True
    Mem write auth : True
    Cmd 0xC8 blocked : True
    HW subcode : 0x8a00
    HW Ver : 0xca00
    SW Ver : 0x0
    ME_ID : 7E864FD67136F5E51530A192CBC36CB4
    Auth Bypass : OK
    Device : Found
    Device Protected : OK
    BROM mode : Connected
    Successfully received DA : OK
    DRAM config needed for : 150100424a544434
    Sending EMI data : OK
    Uploading stage 2 : Done
    Successfully stage 2 : OK
    EMMC FWVer : 0x0
    EMMC ID : BJTD4R
    CID : 150100424a5444345203d7decaaa861d
    EMMC Boot1 Size : 0x400000
    EMMC Boot2 Size : 0x400000
    EMMC GP1 Size : 0x0
    EMMC GP2 Size : 0x0
    EMMC GP3 Size : 0x0
    EMMC GP4 Size : 0x0
    EMMC RPMB Size : 0x400000
    EMMC USER Size : 0x747c00000
    DA-CODE : 0x888F0
    DA Extensions successfully : OK

    [Process Complete !] Elapsed Time : 12m: 01s
    2
    man i really need to unlock BL, and get lineage OS on the Fire HD 10
    2
    Does that mean that Amazon hasn't left their own techs a "backdoor" to unlock the bootloarder?
    If you read my comments above, you will see that they use a partition called unlock (which is not a real partition, but a small sector of the boot1 partition) to store the unlock code. So yeah, their "backdoor" (if you can call it like that) is basically (something like) fastboot flash unlock unlock.bin (where unlock.bin is a file with the unlock code, probably encrypted with their RSA keys).

    Other than that, there is something new that Amazon implemented in its newer models (2019 generation and newer) called "Temporary Unlock". Which is kind of an unlock limited by (some amount of) reboots:
    Code:
    amzn_get_temp_unlock_idme_data
    amzn_get_temp_unlock_idme_cert
    %s: Failed to get temp unlock codes
    amzn_get_temp_unlock_idme_code
    %s: Failed to get temp unlock cert
    %s: Verify temp unlock cert fail, ret = %d
    Device is temporarily unlocked, %d reboots remaining
    amzn_verify_temp_unlock_code
    2
    I tried unlocking the bootloader through MTK TOOL and it worked, I was able to extract MT6771_android_scatter and preloader_maverick.bin ,How do I know if the process has already succeeded or not, by the way I can read and write all system files boot AND lk , recovery.img , etc .

    on 7.3.1.0
    That's just the output of mtk payload which just disables DAA/SLA/SBC until you reboot the device. So no, that's not the bootloader unlock option.
  • 11
    mtk-su for OS 7.3.1.0

    I just uploaded the latest mtk-su (a thing that gives you temp root) in the Temp root thread. It only supports the original OS. No solution yet for the updated version, but hoping a downgrade or unlock method will be found.
    8
    Can you take apart (remove back cover) your newest Fire HD 10 and post the motherboard pictures with test point like CLK, DAT0, CMD and removed metal shield.

    AmznUser444,

    I’m actually going to respectfully ask you to stop responding to my posts and stop asking me for anything. I will no longer reply to your posts other than to make this request.
    8
    Thanks to @Kramar111, we now have a full dump of 7.3.1.0:

    And a little present from me, minimal kamakiri for maverick.
    All it does is downgrade RPMB, flashing can be done with SP Flash.
    Thanks again to @bengris32 for testing.
    8
    I have repacked and reuploaded maverick-downgrade-7.0_PS7310_940N.zip
    It contains FireOS 7.0/PS7310/940N, scatter file and kamakiri for RPMB downgrade.

    Apparently there are multiple versions of 7.3.1.0 and the files originally uploaded here are from version 7.0/PS7310/939N.
    Also lk was incomplete.

    Thanks again to @Kramar111 for the files :)
    7
    7.3.1.0 Images

    So here are some images extracted from the stock 7.3.1.0 FW, courtesy of @dr_docdoc. I trimmed the extra partition data. It would be great if @k4y0z or @xyz` could take a look at them.