New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming

[StonedEngineer97]

mt8183 is basically the tablet-verision of mt6771, which is already supported by the utility (given you can access brom-mode).
AFAIK it has already been tested on maverick.
It will not allow downgrading lk/pl/tz however, since that would require clearing RPMB (which is not possible with SP-Flash).
Kamakiri could however likely be ported, which includes RPMB-Downgrade code.
You could try to downgrade only boot/system/vendor images and leave lk/pl/tz untouched.

That would open up root for atleast 7.3.1.1 if they can downgrade since lk version was untouched

 

[k4y0z]

That would open up root for atleast 7.3.1.1 if they can downgrade since lk version was untouched

Downgrading only boot/system/vendor might even work for newer versions, since the mtk-su bug is in the boot.img.
So as long as the newer lk can successfully boot the old boot.img that should work.

If someone with root can get me a dump of the gpt and preloader, I could probably create a scatter-file to use with SP-Flash.

EDIT:
gpt would probably suffice, since preloader should be available in the OTA-bins.

for dumping gpt with root:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

 

[newnewcomputer]

Downgrading only boot/system/vendor might even work for newer versions, since the mtk-su bug is in the boot.img.
So as long as the newer lk can successfully boot the old boot.img that should work.

If someone with root can get me a dump of the gpt and preloader, I could probably create a scatter-file to use with SP-Flash.

EDIT:
gpt would probably suffice, since preloader should be available in the OTA-bins.

for dumping gpt with root:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

been done....by @diplomatic already:

https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-81221725

dude can foresee future!

 

[k4y0z]

been done....by @diplomatic already:

https://xdaforums.com/t/new-fire-hd...er-unlock-brainstorming.3979343/post-81221725

dude can foresee future!

No GPT as far as I can tell.
But maybe @dr_docdoc can dump it?

 

[newnewcomputer]

...

for dumping gpt with root:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

sorry - my fault for not seeing gpt not there!

hmm...tried dumping it on my 7.3.1.0 w/ su granted in emulator:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

gave "dd: gpt.bin: Read-only file system"

when i tried to mount w/ rw

mount -o rw, remont /block/mmcblk0

it said "mount: '/dev/block/mmcblk0' not in /proc/mounts"

not sure what im missing as read-only should still allow dumping gpt...

 

[k4y0z]

sorry - my fault for not seeing gpt not there!

hmm...tried dumping it on my 7.3.1.0 w/ su granted in emulator:

dd if=/dev/block/mmcblk0 bs=512 count=34 of=gpt.bin

gave "dd: gpt.bin: Read-only file system"

when i tried to mount w/ rw

mount -o rw, remont /block/mmcblk0

it said "mount: '/dev/block/mmcblk0' not in /proc/mounts"

not sure what im missing as read-only should still allow dumping gpt...

Sorry, the problem is the destination file.
It should probably be something like

dd if=/dev/block/mmcblk0 bs=512 count=34 of=/sdcard/gpt.bin

 

[newnewcomputer]

Sorry, the problem is the destination file.
It should probably be something like

dd if=/dev/block/mmcblk0 bs=512 count=34 of=/sdcard/gpt.bin

Thanks! Here you go

 

[k4y0z]

Here is a scatter, if anyone wants to give it a try.
Try doing Readback first, you can enable ShowByScatter=true in option.ini to get all partitions conveniently listed in the Readback tab.
DON'T EVER SELECT "Format All + Download".
Don't flash lk, preloader, tee1, tee2, sspm_1 (Unless you want to update, there is currently no way back)

 

[k4y0z]

So the scatter file is confirmed working thanks to @bengris32.
He currently has 7.3.1.1 and tried downgrading only the boot.img.
While that did allow using mtk-su, it broke wifi and battery (and probably other drivers).

So what we need now is a full dump of the (unmodified) 7.3.1.0 firmware.
That is:

• system
• vendor
• spmfw
• sspm_1
• cam_vpu1
• cam_vpu2
• cam_vpu3
• tee1/2

we already have boot, recovery, lk and preloader though dumping them again wouldn't hurt.

This can either be achieved using root and dd or using the Readback function in SP Flash.

@Kramar111 @dr_docdoc @newnewcomputer I think you all have 7.3.1.0, if one of you could dump it, that would be great

 

[k4y0z]

Thanks to @Kramar111, we now have a full dump of 7.3.1.0:

1.1 GB file on MEGA

mega.nz

And a little present from me, minimal kamakiri for maverick.
All it does is downgrade RPMB, flashing can be done with SP Flash.
Thanks again to @bengris32 for testing.

 

[StonedEngineer97]

Thanks to @Kramar111, we now have a full dump of 7.3.1.0:

1.1 GB file on MEGA

mega.nz

And a little present from me, minimal kamakiri for maverick.
All it does is downgrade RPMB, flashing can be done with SP Flash.
Thanks again to @bengris32 for testing.

Great little unexpected surprise, so this should theoretically work for any 10" 9th gen with access to bootrom?

1. Downgrade bootrom (kamakiri)
2. Downgrade firmware using Sp-flash (mtk-bypass)

And what about the fix-gpt script? I was roughly trying to follow Fire 7 (2019, mustang) unbrick, downgrade, unlock & root to get an idea of the order but saw no mention of it.

 

[k4y0z]

Great little unexpected surprise, so this should theoretically work for any 10" 9th gen with access to bootrom?

1. Downgrade bootrom (kamakiri)
2. Downgrade firmware using Sp-flash (mtk-bypass)

And what about the fix-gpt script? I was roughly trying to follow Fire 7 (2019, mustang) unbrick, downgrade, unlock & root to get an idea of the order but saw no mention of it.

Yeah, it should.
Order would be the other way around, flash first, then downgrade RPMB.
RPMB downgrade is only needed if you downgrade pl/tee1/tee2/lk/sspm.

fix-gpt is just in case GPT gets corrupted, shouldn't normally be needed.

for RPMB-downgrade better follow https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459/

 

[StonedEngineer97]

Yeah, it should.
Order would be the other way around, flash first, then downgrade RPMB.
RPMB downgrade is only needed if you downgrade pl/tee1/tee2/lk/sspm.

fix-gpt is just in case GPT gets corrupted, shouldn't normally be needed.

for RPMB-downgrade better follow https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-tv-stick-4k-mantis.3978459/

Time to start collecting everything and give it a try.

Thanks again @k4y0z and for jumping in and some major developments

 

[newnewcomputer]

Merry Christ...Happy New....Happy Valentine Day and Chinese New Year!!!

Thank YOU, @k4y0z !!! no idea why im so excited as ive loaded up on HD10 2019 back when Amazon was still shipping 7.3.1.0

for those who have been waiting on this, here is the link to the systemless root by @diplomatic https://xdaforums.com/t/amazing-tem...rmv8-2020-08-24.3922213/page-50#post-82081703

dm-verity still in place means no change allowed in /system


...until...

 

[StonedEngineer97]

...until...

 

[k4y0z]

I have repacked and reuploaded maverick-downgrade-7.0_PS7310_940N.zip
It contains FireOS 7.0/PS7310/940N, scatter file and kamakiri for RPMB downgrade.

Apparently there are multiple versions of 7.3.1.0 and the files originally uploaded here are from version 7.0/PS7310/939N.
Also lk was incomplete.

Thanks again to @Kramar111 for the files

 

[TouchscreenLover1]

Hey guys; a long time ago i was active in the developement section as well, but i have to admit, that i am not longer that fit there. In addition, all the different names of the models and the possibilities to root or not becaus of software number confuse me a bit. I overread some of the postings in here, seing the last one by k4y0z, so now my question is:

Could someone be so kind and tell me 1) if i can root and 2) flash my Fire Tab10 from 2019with current FireoOS Firmware 7.3.1.8 and if so, 3) can someone explain shortly what i have to do with links to the posts or so? I would really appreciate it. I am using Windows 10, if that does make a difference ( read something about linux and exploits and stuff so that confused me tho lol)

7 years ago I tested some software for my One X and Iconia Tab A210 which I thought was annoying enough with all the typing in adb, so I am known to that. But seems like the fire tab is even more complex haha

Greetings Ardian

 

[newnewcomputer]

Hey guys; a long time ago i was active in the developement section as well, but i have to admit, that i am not longer that fit there. In addition, all the different names of the models and the possibilities to root or not becaus of software number confuse me a bit. I overread some of the postings in here, seing the last one by k4y0z, so now my question is:

Could someone be so kind and tell me 1) if i can root and 2) flash my Fire Tab10 from 2019with current FireoOS Firmware 7.3.1.8 and if so, 3) can someone explain shortly what i have to do with links to the posts or so? I would really appreciate it. I am using Windows 10, if that does make a difference ( read something about linux and exploits and stuff so that confused me tho lol)

7 years ago I tested some software for my One X and Iconia Tab A210 which I thought was annoying enough with all the typing in adb, so I am known to that. But seems like the fire tab is even more complex haha

Greetings Ardian

welcome back, Ardian! u picked a good time as there havent been much going on for Fire HD10 2019 since the initial root n subsequent patch!

1) probably but first the fw needs to be rolled back to 7.3.1.0.

1a) current root is achieved after boot n new android restriction called dm-verity remains. so ur root access is somewhat limited; depending on wat u need.

2) current flash requires SP flash tool n has been confirmed to work for 7.3.1.1 -> 7.3.1.0. u may want to wait a bit for ur 7.3.1.8.

3) @k4y0z package above is all u need to roll back to 7.3.1.0. once dats done, u can follow the systemless root method linked in my post above.

again depending on wat u need, u may skip everything n simply tweak ur tab w/ the fire toolbox for windows:

https://xdaforums.com/t/windows-tool-fire-toolbox-v11-1.3889604

 

[k4y0z]

2) current flash requires SP flash tool n has been confirmed to work for 7.3.1.1 -> 7.3.1.0. u may want to wait a bit for ur 7.3.1.8.

Downgrade to 7.3.1.0 should be possible with any version, given we can also downgrade RPMB.
That said, there hasn't been any feedback yet.

3) @k4y0z package above is all u need to roll back to 7.3.1.0. once dats done, u can follow the systemless root method linked in my post above.

Additionally to the package you'll also need the Bypass Utility

 

[TouchscreenLover1]

okay tbh that sounds a bit complicated and I just started to work again, so my time is limited to read through all this. Maybe I'll just stick with the Fire Toolbox; I did that when i got that tablet a year ago, but thelatest software version available at that time was 6.6 lol so i guess there happend much.

Thank you very much to you two, i'll definitely come back to thatpost and try all of that with rooting and stuff.

Greeting