New Fire HD10 2019 Bootless Root Method + Bootloader Unlock Brainstorming

Search This thread
By:
Advanced…
MrZaku086

MrZaku086

Senior Member
Apr 8, 2021
184
41
stickfiretv2020 said:
I'm currently looking into two methods for the HD 10, still brainstorming it and not tried it on my own units yet - I have working downgrade method to 7.3.1.0 for this device I think, thats if it wasn't a hardware patch on this device. Needs testing, but problem is exploit is major computing exploit not just Android exploit.... Working out what to do about it generally as something I've discovered.

Second method, which doesn't involve a downgrade, is using fbtool on this device. This is likely to be able to turned into a software based fastboot cable. Still ironing out details here:

Would need to locate or work out how to produce a patch for fbtool for the HD's SoC, though. Anyone know any githubs which contain MTK Board tools source (i.e. fbtool source) for this SoC?
Click to expand...
Click to collapse


hey do you thin this would work?

forum.hovatek.com

Mediatek (MTK) Auto TWRP recovery porter by Team Hovatek

If you wish to root your Mediatek Android phone, we'd dropped a guide on rooting using Magisk and stock boot.img at https://www.hovatek.com/forum/thread-21427.html , no custom recovery is required. Se
forum.hovatek.com forum.hovatek.com

this device have the same mtk chip and a custom twrp

BQ Aquaris M8

Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...
twrp.me

or

Android One Second Generation MTK

Disclaimer:Team Win strives to provide a quality product. However, it is your decision to install our software on your device. Team Win takes no ...
twrp.me

or

github.com

MT8163

Device trees for mt8163 Processors for amazon and other devices. - MT8163
github.com github.com

or

github.com

GitHub - marex/u-boot-mtk: U-Boot MTK mirror

U-Boot MTK mirror. Contribute to marex/u-boot-mtk development by creating an account on GitHub.
github.com github.com

something of this help?

PD: sorry if dont help you but i really want to this device have a lineage os xD
 
  • Like
Reactions: grantdb and Kramar111
K

Khiem Tran

Member
Mar 4, 2020
27
10
k4y0z said:
You will need to wipe preloader in SP Flash (or enter BROM by shorting) for mmc-write to work in kamakiri.





Then use the attached kamakiri, which instead of just clearing RPMB will flash the missing partitions that couldn't be flashed with SP Flash (Unfortunately it's quite slow compared to SP Flash)
Click to expand...
Click to collapse
I wiped preloader on 7.3.1.8 and device frozen at bootrom. Can anyone upload preloader 7.3.1.8 file?
 
K

Khiem Tran

Member
Mar 4, 2020
27
10
Michajin said:
You need to downgrade to 7.3.1.0, you can get root access.
Click to expand...
Click to collapse

I tried using SPFlash to downgrade but I can't write EMMC. It is stopped as shown below.
Capture.PNG


Capture1.PNG
 
K

k4y0z

Senior Member
Nov 27, 2015
1,468
2,058
  • Like
Reactions: Kramar111, Khiem Tran and Michajin
K

Khiem Tran

Member
Mar 4, 2020
27
10
k4y0z said:
Try selecting USB mode instead of Serial if you're on Windows.
Also you won't be able to flash all of the partitions using SPFT, the ones that don't work will need to be flashed using kamakiri.
You'll have to rerun the bypass after every action in SPFT.
Click to expand...
Click to collapse

I have done the following

Step1: Plug out battery. Then, hold volume up to bootrom
Step2: Run bypass and format preloader with SPFlash (length 0x100000)
Step3: Plugin battery. Run bypass and flash boot, recovey, vendor, system with SPFlash.
Step4: Run bootrom-step.sh in kamakiri folder.

What should I do next?

Do I have to flash preloader, lk, tee1, tee2m spmfw, sspm_1, cam_vpu1, cam_vpu2, cam_vpu3 using SPFlash?
 
Last edited:
K

k4y0z

Senior Member
Nov 27, 2015
1,468
2,058
Khiem Tran said:
I have done the following

Step1: Plug out battery. Then, hold volume up to bootrom
Step2: Run bypass and format preloader with SPFlash (length 0x100000)
Step3: Plugin battery. Run bypass and flash boot, recovey, vendor, system with SPFlash.
Step4: Run bootrom-step.sh in kamakiri folder.

What should I do next?

Do I have to flash preloader, lk, tee1, tee2m spmfw, sspm_1, cam_vpu1, cam_vpu2, cam_vpu3 using SPFlash?
Click to expand...
Click to collapse
The latest kamakiri version that I posted somewhere here in this thread, should flash all the partitions, that can't be flashed using SPFT.
 
  • Like
Reactions: Kramar111, Khiem Tran and Michajin
I

INetBowser

Member
Dec 4, 2020
12
6
Hey guys,

I need some help regarding the root exploit I'm writing currently. If I manage to get it working, Fire HD 10 9th gen on version 7.3.1.2 (and maybe higher, I need to look into that) should be rootable.

Anyone with a rooted Fire HD 10 9th gen, can you please run this command as root
Code: 
cat /proc/iomem
and post the output?

Thanks!
 
Last edited:
  • Like
Reactions: MrZaku086
Michajin

Michajin

Senior Member
Oct 23, 2012
1,390
559
blaacksheep said:
Unfortunately, Amazon has locked down FireOS pretty firmly. You can disable those apps though. Have you checked out Fire Toolbox?
Click to expand...
Click to collapse
With root access you can use a app disabler. Root works fine. Just can't modify the system apps. I use package disabler with root access to quickly disabled app. Full root would be better, and unlocking would be awesome. We will see, seems development had picked up lately.
 
  • Like
Reactions: Khiem Tran, MrZaku086 and blaacksheep
MrZaku086

MrZaku086

Senior Member
Apr 8, 2021
184
41
Michajin said:
With root access you can use a app disabler. Root works fine. Just can't modify the system apps. I use package disabler with root access to quickly disabled app. Full root would be better, and unlocking would be awesome. We will see, seems development had picked up lately.
Click to expand...
Click to collapse
well the 2017 model took many years and in the end you need to some hardware hackery to unlock the bootloader and be free.... maybe that is the route to this tablet some hardware thing to acess to factory mode or something like that and unblock the boatloader is very trashy to amazon bloking the bootloader using a android fork.
 
Michajin

Michajin

Senior Member
Oct 23, 2012
1,390
559
MrZaku086 said:
well the 2017 model took many years and in the end you need to some hardware hackery to unlock the bootloader and be free.... maybe that is the route to this tablet some hardware thing to acess to factory mode or something like that and unblock the boatloader is very trashy to amazon bloking the bootloader using a android fork.
Click to expand...
Click to collapse
I have found the shorting method on it, but amazon/mediatek made a hardware change that disable the bootrom. It has been found on anything as of about January of 2020 had the bootrom disabled. The exploit would have to be a totally new route.
 
  • Like
Reactions: MrZaku086
MrZaku086

MrZaku086

Senior Member
Apr 8, 2021
184
41
Michajin said:
I have found the shorting method on it, but amazon/mediatek made a hardware change that disable the bootrom. It has been found on anything as of about January of 2020 had the bootrom disabled. The exploit would have to be a totally new route.
Click to expand...
Click to collapse
i think that is on part of amazon, tyou can hack very easy another tablets with the same chip.
 
L

lewmur

Senior Member
Apr 30, 2011
3,084
626
MrZaku086 said:
well the 2017 model took many years and in the end you need to some hardware hackery to unlock the bootloader and be free.... maybe that is the route to this tablet some hardware thing to acess to factory mode or something like that and unblock the boatloader is very trashy to amazon bloking the bootloader using a android fork.
Click to expand...
Click to collapse
You have to realize that Amazon tablets are very inexpensive because of all the advertising built into them. From their view point, rooting the tablet to get rid of their bloat, is cheating. So, of course, they are going to do their best to prevent it. I do my best to eliminate their bloat, but I don't find their efforts to stop me to be "trashy".
 
  • Like
Reactions: juandarr
You must log in or register to reply here.

Similar threads

D
Rapid Temporary Root for HD 8 & HD 10
Replies
1K
Views
462K
ABC00012345
ABC00012345
B
[TUT] ROOT HD10 (2017), HD8(2016-2017) - EASY SuperSu
Replies
642
Views
305K
mayur.3.92
mayur.3.92
S
[MASTER THREAD] Fire HD 8 (2017) (7th Generation)
Replies
1K
Views
319K
G
gatorman8787
B
[CHAT] HD10 (2017) - custom ROM brainstorming:
Replies
548
Views
84K
F
FireSlayer_SD10
S
[GUIDE][NO ROOT][7TH GEN/OLDER] Disable System Apps on Fire HD 7/8/10:
Replies
387
Views
224K
C
CuF

Top Liked Posts

24 Hours All time

New posts