All images have been re-uploaded to imgur. I tried to add pictures into the post itself but it looked horrible and xda is too slow for me to experiment with.
All images have been re-uploaded to imgur. I tried to add pictures into the post itself but it looked horrible and xda is too slow for me to experiment with.
I'm stuck - anyone got any advice?!
Please see photo - procedure stuck at communication stage. Card reader flashing blue - which gives me hope - but disk management program (Windows) is frozen. I've waited 20 mins+ at this point - do I just keep waiting or does the error message on the tablet screen mean it's doomed?
Any thoughts, anyone?!
Please see photo - procedure stuck at communication stage. Card reader flashing blue - which gives me hope - but disk management program (Windows) is frozen. I've waited 20 mins+ at this point - do I just keep waiting or does the error message on the tablet screen mean it's doomed?
Any thoughts, anyone?!
Attachments
It is not doomed. The error is the card reader and tablet CPU trying to talk to the eMMC at the same time, causing both of them to fail to get anything useful out. Thus, Windows freezes and the tablet reports errors about not being able to read things. If you hold power on the tablet for a while it'll shut down, or you can pop the power cable out and put it back in. Then, retry the procedure. I'm sorry that I don't have a more reliable way to get the eMMC to detect on Windows, I spent countless hours plugging it in and unplugging it, trying every menu option and every combination of buttons and timing.. it wasn't fun and this is the best I could come up with. Hopefully it'll end up working for you!
To summarize:
1. Unplug the SD card from the reader.
2. Hold power button for a while (15 to 30 seconds, the screen will go black) or unplug the power cable from the motherboard and plug it back in
3. Start again holding down power and volume-down, and plug in the SD card right after you select enter bootloader. Generally, there's a period of time where the screen is black between the time you click the button and the time "Fastboot mode" appears at the bottom of the screen. If you plug the card in during that period it seems to read well.
Thank you for putting your faith in this mod!
Last edited:
Brilliant - thanks for the reply - I will keep repeating procedure until it connects without errors. I thought the blue flashing light on the card reader was a breakthrough moment but unfortunately not! The saga continues......
This is awesome, been waiting a long time for this.
Trying to avoid having to mess around with soldering onto the pins of a microSD adapter... What Ive been trying to do is, after carefully more or less cutting the adapter in half, getting the exposed pins to mate with a rj-45 plug. Seems like a good idea since the pitch/layout of the pins is identical, but I cant seem to get them to make solid contact. Idk, might mess around with it more later.
Failing that, I think Ill just order an "SD card extension" and use that. Can't post a link because of the new account restriction, but if you do a search on amazon you'll see a bunch for around $6-7 usd. Also curious if theres enough room in the hd8's chasis to just leave it attached.
Edit: Got the RJ45 plug and mutilated sd-adapter mated, just had to file down the top of the plug a bit so that the indents werent quite so deep. I'd post pictures, but again
new account.
Trying to avoid having to mess around with soldering onto the pins of a microSD adapter... What Ive been trying to do is, after carefully more or less cutting the adapter in half, getting the exposed pins to mate with a rj-45 plug. Seems like a good idea since the pitch/layout of the pins is identical, but I cant seem to get them to make solid contact. Idk, might mess around with it more later.
Failing that, I think Ill just order an "SD card extension" and use that. Can't post a link because of the new account restriction, but if you do a search on amazon you'll see a bunch for around $6-7 usd. Also curious if theres enough room in the hd8's chasis to just leave it attached.
Edit: Got the RJ45 plug and mutilated sd-adapter mated, just had to file down the top of the plug a bit so that the indents werent quite so deep. I'd post pictures, but again
new account.
Last edited:
Couldn't something like this be used instead of messing with tearing apart and soldering an SD card adapter?
https://www.digikey.com/product-detail/en/sparkfun-electronics/TOL-09419/1568-1041-ND/5140806
Or:
https://www.newegg.com/Product/Product.aspx?Item=9SIABV776P5219
https://www.digikey.com/product-detail/en/sparkfun-electronics/TOL-09419/1568-1041-ND/5140806
Or:
https://www.newegg.com/Product/Product.aspx?Item=9SIABV776P5219
Last edited:
The newegg link is broken, but what I was looking at was microSD extensions. They're male to female connected by a ribbon cable. Could just cut the female end off, strip back the wires a bit and solder onto the board from there.
Thanks so much for this comment - had everything working in the guide then got stuck at the Fire logo on re-boot. Needed 'ln -r' to get symlink working.
Fire successfully rooted - got there eventually - see photo for output to 'su' in terminal editor. Awesome. Can't wait to de-bloat tomorrow!
Many thanks to <br /> (and everyone else who help achieve this) - great mod - most difficult for me was Part 3 'Hardware mod' - once everything soldered properly comms with PC was actually quite straightforward.
Attachments
Amazing work.. so happy for you!! Did you manage to get the SD to read on the PC using the route I mentioned or did you do it another way?Thanks so much for this comment - had everything working in the guide then got stuck at the Fire logo on re-boot. Needed 'ln -r' to get symlink working.
Fire successfully rooted - got there eventually - see photo for output to 'su' in terminal editor. Awesome. Can't wait to de-bloat tomorrow!
Many thanks to (and everyone else who help achieve this) - great mod - most difficult for me was Part 3 'Hardware mod' - once everything soldered properly comms with PC was actually quite straightforward.
To whoever was asking, those adapters should be fine. I was just going for the cheap and available route. Most people probably have a micro SD adapter lying around that they never use.
I used your method of rebooting to bootloader and quickly inserting the SD card.
I struggled for ages at this stage but I think the breakthrough was getting the wiring spot-on: checking everything soldered nicely and no shorting wires - it was so easy for the soldering to break off - I went over this many, many times! When I knew wiring good things started to happen - and if the tablet got stuck going into (but not reaching Fastboot) - i could quickly remove / insert the SD card into the reader and usually get communication with PC (windows) as you describe in your guide. I was getting this quickly towards the end: easy once you get the knack!
In my desperate times I also tried the 'handsake.py' method as referenced by DVBMan earlier in this thread - but I couldn't get that working (bit beyond my experience, probably)
Can you provide more detail on how to disconnect the camera and remove the motherboard? I've got 2 of these that have dead USB connectors due to mishandling by kids.
The camera cable has a black piece of tape over it. I peeled that up and saw white paper tear off underneath it, and what looks like a ribbon cable running to the underside of a metal shield.
The camera cable has a black piece of tape over it. I peeled that up and saw white paper tear off underneath it, and what looks like a ribbon cable running to the underside of a metal shield.
Yes, remove the black tape. There is a white QR code on the back of the camera, which is what the torn paper was. The ribbon cable goes to a rectangle on the motherboard. You can grab both sides of that with your fingernails or some tweezers and pop it right off. Just pull upwards from the motherboard. It doesn't take much force.
The power cable that goes to the battery works in the same fashion. The best way to unhook that cable is to get something like a pair of tweezers, go underneath the battery wires, and then pull upwards away from the motherboard. It will pop out.
The LCD connector (to the left of the power connector) has a hinge that must be undone; on the opposite side of the ribbon cable, use your fingernail or tweezers to get under the plastic bit and pop it up. It will turn 90 degrees so that it is pointing up. At that point the ribbon cable can slide out, but since it is such a tight fit the only way to slide it out is by removing the motherboard from the cable rather than the other way around.
The touch screen connector has a ribbon cable that goes into a smaller version of what you had to deal with on the LCD connector, but with one added annoyance; where you see the microchip inside the ribbon cable (the larger, square portion of the ribbon cable), there is adhesive underneath. You can peel the ribbon cable up from the motherboard but make sure to release the latch first, then slowly work something thin under the cable to help peel it up.
I hope this helps.
Worth trying this Mod on Fire 8th gen?
@ <br /> - do you think this will work? Isn't the new hardware pretty much the same as 7th gen?
I'm tempted to have a go.
BTW: Rooted 7th gen will run Xposed as detailed in Fire HD10 post by retyre (https://forum.xda-developers.com/hd8-hd10/general/hd-10-2017-xposed-t3722252) - Flashfire works too.
However, DragonFire1024's framework-res.apk (https://forum.xda-developers.com/hd...ot-restore-stock-battery-stats-power-t3849341) definitely doesn't - but that was for HD10 so that's why I got stuck at 'Fire' logo on reboot! Managed to restore tablet with ADB sideload update but, of course, root lost :crying: !!!
@ <br /> - do you think this will work? Isn't the new hardware pretty much the same as 7th gen?
I'm tempted to have a go.
BTW: Rooted 7th gen will run Xposed as detailed in Fire HD10 post by retyre (https://forum.xda-developers.com/hd8-hd10/general/hd-10-2017-xposed-t3722252) - Flashfire works too.
However, DragonFire1024's framework-res.apk (https://forum.xda-developers.com/hd...ot-restore-stock-battery-stats-power-t3849341) definitely doesn't - but that was for HD10 so that's why I got stuck at 'Fire' logo on reboot! Managed to restore tablet with ADB sideload update but, of course, root lost :crying: !!!
No, don't bother with this, unless you have a plan to defeat dm-verity. Fire OS 6, which is based Android 7, implements integrity checking for every block on the system partition. So merely mounting system in read/write mode will modify it, causing the device to refuse to boot.
Oh, I see. That's a shame
Could take sometime before a work-around is found then. Thanks.Did anyone find a reliable way of getting the SD card reader to recognize the flash?
I triple checked the wiring and tried plugging in the SD card into the reader anywhere from immediately when I press `Reboot to bootloader` to waiting for screen to go blank, I did this like 20 times so far and while most of the times reader will start to blink the LED, I haven't had luck of seeing the SD card getting mounted.
Also I've found a easier way (at least for me) to modify the SD card. Using a copper tape and cutting a thin traces, you can solder one piece directly on the SD pins and then use the other end to solder wires so they are not blocking you from inserting the card into the reader. See the image attached.
I triple checked the wiring and tried plugging in the SD card into the reader anywhere from immediately when I press `Reboot to bootloader` to waiting for screen to go blank, I did this like 20 times so far and while most of the times reader will start to blink the LED, I haven't had luck of seeing the SD card getting mounted.
Also I've found a easier way (at least for me) to modify the SD card. Using a copper tape and cutting a thin traces, you can solder one piece directly on the SD pins and then use the other end to solder wires so they are not blocking you from inserting the card into the reader. See the image attached.
Sounds like you're really close to getting it - don't give up! I've attempted this mod several times now and the mounting stage is the sticking point - literally hours of time required!!
I can only guess your wiring isn't 100% spot on - blinking blue light is usually really good sign. Try really quickly removing and inserting SD card at this point, if it won't mount.
I played about with some copper tape on the main board to make the wiring easier - didn't work for me so took it out and soldered wires to test points - then it was OK. Maybe the copper tape is your problem?
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
62
Amazon Fire HD 8 (7th Gen) Hardmod Root Guide
I have successfully rooted the Amazon Fire HD 8 (7th Gen), and I want to help you do it too! This is not an easy root, but it's as easy as it can be. The aim for this root was to get at least one working method in order to help aid the development of an easier software root in the future. Countless people from the xda-developers forums worked together to make this root method possible. This thread is where everything started. In no particular order, I want to thank for their help:
@Supersonic27543, @DragonFire1024, @teixeirap, @diplomatic, @richaardvark, @t0x1cSH, @Qiangong2, @MontysEvilTwin, @TheRealIntence, @Snigglez, @ambush_boy, @cybersaga, @gamblodar, @adidasos
… and everyone else who I missed. You're all amazing. Thank you!
I sunk a couple hundred dollars into finding this exploit, so if it works for you please consider helping me recuperate the costs. I want to find an exploit for the newer 8th gen tablets but cannot keep spending money like this. If nothing else, please give this post a thumbs up!
Start Here
Remember, this is a hardware root, so you will need experience with a soldering iron. All the hardware modifications needed for this tablet are pretty easy even if you have never soldered before. However, especially in the case of hardware modifications, there is a chance you can permanently brick your tablet. If you follow this guide, don't hold me responsible if you break things.
This guide will be improved as time goes on. Please reply with any questions or comments and I will help out where I can! Let's get started
General Procedure:
- Preparation - Gather the materials, build an SD card adapter, etc.
- Disassembly - Take the tablet apart and turn over the motherboard
- Hardware Modifications - Soldering the SD card adapter to the board
- Communication - Getting the device to talk to your computer
- Software Modifications - Installing SuperSU by hand
- Testing and Cleanup - Checking for root, removing the SD card adapter, reassembly.
1. Preparation
You will need:
- An SD card reader that can read in 1-bit mode. This one will work. If you already have a reader you'd like to try, find a working SD card and referring to this diagram use some electrical tape to cover up pins 1, 2, and 9 (DAT 1-3). If you plug in the card and it still reads, then the reader will work.
- A micro-sd card adapter. This will be taken apart so you can solder to the inside.
- A soldering iron, solder, and experience.
- Some thin wire. I like to use some 28 AWG magnet wire since it has an insulative enamel coating to prevent short circuits.
- A small phillips head screwdriver to remove the motherboard.
- Either a linux-based computer or a virtual machine running linux through which you can mount a raw physical disk from the host computer. VirtualBox can do this and I will show you how.
- Experience using Linux commands and mounting partitions.
- SuperSU version 2.79.
Modifying the SD Card Adapter
Pry apart the SD card adapter. You need to connect wires to CMD, GND, CLK, and DAT0. Give yourself at least a few inches of length to work with. Here are some images to help you figure it out:
- SD Card Pinout (Ignore column SPI. VSS = GND).
- SD Card Adapter Internals
I recommend putting some tape on the wires and writing what they are so you don't lose track after putting the adapter back together (or in my case, wrapping tape around the adapter because I broke the shell).
Also, you will need to either make sure that the sliding lock on the side of the adapter is still there (or fill it in so that there's no more indent) or take apart your SD card reader and ground the read-only pin so that the reader allows you to write to the card. (Grounding it makes it writable, having it open makes it read-only). This pin is located to the far left of the reader when the opening is facing you and the card is facing up.
2. Disassembly
Use a pry tool to take apart the tablet at the seam. There are no ribbon cables connecting the back cover to the front so you can just pull it off. Start at the bottom, and pull upwards so that the fulcrum is on the top of the tablet where the USB port is. This is the easiest way to get it off.
Next, unscrew the screws near the top of the board. Remove the tape covering the camera and disconnect the camera. It just pops off with your pry tool. There is a battery connector at the bottom right, an LCD connector at the bottom left, and a touch screen connector at top center. The battery connector pops out without lifting any hinges. Use tweezers to get underneath the wires and pop it up out of the slot. Lift up the hinge on the touch screen connector and use something very thin to get underneath the glued down ribbon cable. Be careful not to break things. Once it's free from the glue, slide the ribbon cable sideways to pull it out from the connector. Lift the hinge on the LCD connector.
Now, take the board from the top and lift upwards. Stick something under the board to break free some of the glue underneath while you pull upwards. This time the fulcrum of the motherboard is where the LCD and battery connector are. Do be cautious, there are speaker wires at the bottom right to be aware of. Once you have it lifted up most of the way, you can slide it out from under the plastic parts near the power connector and fold it sideways towards the right side of the tablet. The speaker wires act as a hinge.
If all goes well you should be looking at the back of the motherboard right now.
3. Hardware Modifications
Solder the wires from the sd card adapter to the respective test points in this diagram. VSS means GND. Once done with this, fold the motherboard back over and plug the ribbon cables back in. Plug in the power cable last. Loosely put the tablet back into its cover so that you don't crush the wires you just soldered, but also to protect the tablet from short circuiting on your table or something.
4. Communication
Plug your SD card reader into your computer, but do not plug in the SD card adapter. Power up your tablet with the volume down button pressed. At the recovery, use the volume keys to navigate to "Enter bootloader" but DO NOT press power yet.
You need to be ready. Within half a second of pressing power you need to plug the SD card adapter into the reader. This is the most reliable way I have gotten the reader to talk to the eMMC chip.
If all goes well you will see all the partitions appear on your computer. On Windows, check disk manager to see them all. On Ubuntu, use the disks program. When on Windows, it will pop up probably 20 different windows asking you to format drives. CLICK NO. And no and no and no and .... You do not want to format your eMMC lmao. Now just leave the card plugged in and don't touch the tablet. Don't even breathe on it.
5. Software Modifications
Mounting the drive:
Ok this is the most difficult part. On Windows you need to get a linux virtual machine. I prefer to use Ubuntu for this. I also use VirtualBox to run the VM and I can't help you if you don't use it. If you are already using Linux this will make things easier, but if you must use Windows, then you need to mount the eMMC on your virtual machine.
To do this, open a command prompt as an Administrator and navigate to "C:\Program Files\Oracle\VirtualBox". Using disk manager, find what disk number (left side) the SD card reader is mounted on. Then, run this command:
Code:VBoxManage internalcommands createrawvmdk -filename "C:\Users\<user_name>\firehd8.vmdk" -rawdisk \\.\PhysicalDrive#
Where the # at the end is the disk number you found earlier (mine was 2), and "<user_name>" is obviously the name of your account. This should make a vmdk file on your desktop and be successful. Then you can open your VirtualBox settings for your VM, go to Storage, SATA, and add an existing drive being that vmdk file that just got created. Now boot the machine, and the drive will disappear off Windows but will reappear inside the VM. Please note that VirtualBox must be running as an administrator.
Now, in linux, mount the system partition (it should be about 1.5GB and will usually be partition 14). Open a terminal into it.
Writing SuperSU:
Did I say the last part was most difficult? Well this one is most time-consuming and most easy to do wrong. Here we go! Extract your SuperSU zip that you downloaded. You only need to keep two folders: common and arm64. You will copy the files from these folders into the system partition and set permissions as follows.
Note: When you see 4 numbers like 0644, this is referring to the permissions to set via chmod.
Note 2: When you see something like ubject_r:system_file:s0, this is referring to the extended attribute security.selinux which can be set with this command:
(Get setfattr by installing the attr package)Code:sudo setfattr -n security.selinux -v "u:object_r:system_file:s0" FILENAME
Or on most Ubuntu systems, this command will work too:
Code:chcon u:object_r:system_file:s0 FILENAME
Note 3: All files copied or created will be owned by root:root. If you use sudo for these commands or do them as root, you'll be fine.
- Create a directory at /system/app/SuperSU (0644 ubject_r:system_file:s0)
- Copy common/Superuser.apk to /system/app/SuperSU/SuperSU.apk (0644 ubject_r:system_file:s0)
- Copy common/install-recovery.sh to /system/etc/install-recovery.sh (0755 ubject_r:system_file:s0)
- Create symlink from /system/bin/install-recovery.sh to /system/etc/install-recovery.sh
- Copy arm64/su to /system/xbin/su (0755 ubject_r:system_file:s0)
- Copy arm64/su to /system/xbin/daemonsu (0755 ubject_r:system_file:s0)
- Copy arm64/supolicy to /system/xbin/supolicy (0755 ubject_r:system_file:s0)
- Copy arm64/libsupol.so to /system/lib64/libsupol.so (0644 ubject_r:system_file:s0)
- Move /system/bin/app_process to /system/bin/app_process_backup
- Create symlink from /system/bin/app_process to /system/xbin/daemonsu
- Create an empty file at /system/etc/.installed_su_daemon (0644 ubject_r:system_file:s0)
That's it! Now properly unmount and eject your SD card and boot up your device.
6. Testing and Cleanup
If all goes well you'll find a SuperSU app on your homescreen. Run it and it will probably tell you to update the su binary. Do so, restart, and then you should have root! Congrats! Make sure to go into settings and set it to grant rather than prompt.
Power down your device, unplug the cables, flip the board, desolder the wires, flip the board again, plug in the cables, put your camera back in, and then screw it all back together and slap on the back cover. You did it!
Extra Info and Troubleshooting
I will add troubleshooting steps here as time goes on.
Should you need them, here are the eMMC dumps from the 16GB and 32GB variants:
6This is beautiful!!! I have to get some basic supplies, but I am excited to try this out! I'd just about given up hope that this device would ever be rooted, but you made it happen! Definitely not the easiest root process, but maybe it will eventually lead to easier ways to obtain root. Thank you again for your hard work and dedication (and to everyone else as well!) on this!! ??
Haha yay! It makes me happy to see people excited over this. That's what I was hoping for in the long run. I saw the progress thread struggling and thought I could try and help out on the hardware side. It turned out to be a hobby I never knew I needed; something to look forward to each day that made my life a little more exciting. I'm really proud of how far we've come
And you're right, it's definitely not the easiest. I want to make a video tutorial sometime. I have little experience making video tutorials so we'll see.5
Thanks so much for this comment - had everything working in the guide then got stuck at the Fire logo on re-boot. Needed 'ln -r' to get symlink working.
Fire successfully rooted - got there eventually - see photo for output to 'su' in terminal editor. Awesome. Can't wait to de-bloat tomorrow!
Many thanks to <br /> (and everyone else who help achieve this) - great mod - most difficult for me was Part 3 'Hardware mod' - once everything soldered properly comms with PC was actually quite straightforward.
5I looked into rooting my kidd fire 8 a few months ago in order to install a better experience and discovered the lack of root. So instead i end up doing the nova, launcher block method another parent did and after a month i pulled it off cause it was just so janky. So i look again yesterday to look into options and low and behold.
Then i read, "you'll need a soldering iron" in the instructions which caused me to start laughing hysterically, alarming my family. Not that I have issues soldering, as an audio engineer soldering and I go way back.
Its funny because......
HOW IN THE **** UNDER ALL THAT IS HOLY DID YOU ALL DISCOVER THIS? I read XDA daily and i wasn't even aware of roots that required modifying the hardware beyond the old AMD chips and using pencil graphite to reconnect to traces. Wow, just ****ing wow.5
Yes, but only if the cause of the brick is firmware corruption... which doesn't seem likely. But even then, I think it's worth trying since you have nothing to lose.
