[UNLOCK][ROOT][TWRP][UNBRICK][DOWNGRADE] Fire 7 (ford and austin).

Search This thread
I had 5.3.4.0 and flashed to the linked 5.0.1 on mine just fine. Looks like your download was corrupted. Try downloading again.

Weird; I just fresh downloaded the image and have a SHA256 sum of 77ed0a394e51a5955586a8bd276de646a40c69fff799c48fe95a1e1509f6e756.
Is yours the same? I downloaded with and without VPN and both files had this hash.

Edit: I'd like to note that I'm using the 7th gen and it fails at 47%
 
Last edited:

mrmazak

Senior Member
Jun 16, 2013
3,214
1,326
Tried another cable, I still got the same issue. The only other linux hardware I have available is a raspberry pi, not sure if that's recommended or not.

Several people have commented here that they had better results using a raspberry pi for this .
So yes it is OK
 

rlowens

Member
Dec 1, 2016
36
12
Weird; I just fresh downloaded the image and have a SHA256 sum of 77ed0a394e51a5955586a8bd276de646a40c69fff799c48fe95a1e1509f6e756.
Is yours the same? I downloaded with and without VPN and both files had this hash.

Edit: I'd like to note that I'm using the 7th gen and it fails at 47%

Correction: My 5th gen Fire 7 was on 5.3.6.4, not 5.3.4.0 that you said yours was on (which I don't even see listed on https://en.wikipedia.org/wiki/Fire_OS#List_of_Fire_OS_versions ). Maybe update to the latest FireOS version first?

My copy of the "update-kindle-37.5.2.2_user_522053820.bin" has an MD5 checksum of 2690f679bc0a67c655c48857aa451345 (in case anyone needs that) and an SHA256 checksum of 77ED0A394E51A5955586A8BD276DE646A40C69FFF799C48FE95A1E1509F6E756 which matches yours.
 
  • Like
Reactions: TheKindleMCPEGuy

k4y0z

Senior Member
Nov 27, 2015
1,429
1,837
Weird; I just fresh downloaded the image and have a SHA256 sum of 77ed0a394e51a5955586a8bd276de646a40c69fff799c48fe95a1e1509f6e756.
Is yours the same? I downloaded with and without VPN and both files had this hash.

Edit: I'd like to note that I'm using the 7th gen and it fails at 47%

As mentioned in the OP, downgrading only works with the 5th gen.
 
  • Like
Reactions: TheKindleMCPEGuy

Faststainvenom YT

New member
Dec 23, 2018
3
0
Failed adb update

So, for some reason whenever I go to apply an update via adb it gets to about 40% and then the kindle (Fire HD 8 7th gen) says:

E: failed to verify whole-file signature
E: signature verification failed
Installation aborted.

I have no idea why it is happening and I can't find any q/a about this anywhere. Please help.
 
Last edited:

Michajin

Senior Member
Oct 23, 2012
1,246
486
So, for some reason whenever I go to apply an update via adb it gets to about 40% and then the kindle (Fire HD 8 7th gen) says:

E: failed to verify whole-file signature
E: signature verification failed
Installation aborted.

I have no idea why it is happening and I can't find any q/a about this anywhere. Please help.

I would start in the fire hd8 thread...
https://forum.xda-developers.com/hd8-hd10

ask for help there... i only have fire 7 (5th) and fire 8hd(8th).
 

Dan_firehd

Senior Member
Sep 14, 2017
167
81
How to open Fire 7 7th Gen (Austin) backcover

OK how in the love of God do I get this thing opened? All I have managed to do is take chunks out of the case trying to separate it to do the wire short thing.......

For Fire 7 7th Gen (i.e. Austin), this guy was able to open the back cover by using his finger nail !! My finger nail is not that strong, so I used a small screw driver instead.

https://www.youtube.com/watch?v=kOu_2po6EkA
 
Last edited:

alarmdude9

Senior Member
Oct 24, 2010
238
20
Summerville
You sir are awesome. Thank you for the link to the video. Google sent me to ones for a different Fire evidently and I was trying to open the almost imperceptible crease at the very top.....


For Fire 7 7th Gen (i.e. Austin), this guy was able to open the back cover by using his finger nail !! My finger nail is not that strong, so I used small screw driver instead.

https://www.youtube.com/watch?v=kOu_2po6EkA


---------- Post added at 09:55 PM ---------- Previous post was at 09:14 PM ----------

Ok got it opened up and ripped part of the shield of and of course I get an error....

[email protected]:/media/schism/TI10673200G1/arcs/temp/amonet-austin-v1.4.1/amonet$ sudo ./bootrom-step.sh
[2019-05-05 21:53:14.160943] Waiting for bootrom
[2019-05-05 21:53:36.788524] Found port = /dev/ttyACM0
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 265, in open
self.fd = os.open(self.portstr, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)
FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 156, in <module>
main()
File "main.py", line 72, in main
dev.find_device()
File "/media/schism/TI10673200G1/arcs/temp/amonet-austin-v1.4.1/amonet/modules/common.py", line 83, in find_device
self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)
File "/usr/lib/python3/dist-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'
[email protected]:/media/schism/TI10673200G1/arcs/temp/amonet-austin-v1.4.1/amonet$

What am I missing?
 

whereismyhat

Member
Oct 1, 2009
39
1
Did anyone find a fix for this?
I shorted VDD1 to the shield with a 330 ohm resistor.
It seemed to work ok and then gave me an error, output is below:

Code:
[2019-05-04 19:59:02.445571] Init crypto engine
[2019-05-04 19:59:02.505998] Disable caches
[2019-05-04 19:59:02.506991] Disable bootrom range checks
[2019-05-04 19:59:02.540426] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-05-04 19:59:02.544347] Send payload
[2019-05-04 19:59:04.065221] Let's rock
[2019-05-04 19:59:04.067195] Wait for the payload to come online...
[2019-05-04 19:59:04.524608] all good
[2019-05-04 19:59:04.525235] Check GPT
Traceback (most recent call last):
  File "main.py", line 156, in <module>
    main()
  File "main.py", line 82, in main
    switch_user(dev)
  File "main.py", line 53, in switch_user
    block = dev.emmc_read(0)
  File "/home/amonet/modules/common.py", line 193, in emmc_read
    raise RuntimeError("read fail")
RuntimeError: read fail

It appears to be stuck in bootrom mode without being able to complete the setup.
I have tried running again, then disconnecting the battery and re-running. Nothing seems to allow it to either complete or the get back out of bootrom mode.

the device shows:
Code:
Bus 001 Device 022: ID 0e8d:0003 MediaTek Inc. MT6227 phone

I don't think I've damaged anything physically on the device.
Does anyone have any ideas?
Thanks

I am running into this exact same issue, this is my second board attempting this, the first one i knocked off a cap when trying to take the sheild off, now i am stuck here.... using linux mint on a secondary computer, and when i got this i tried the VCC1 pin (not much of a pin just 2 tiny caps) to ground, and i got this exact error.

Please halp
 

ppfearn

Member
Aug 2, 2010
9
0
Several people have commented here that they had better results using a raspberry pi for this .
So yes it is OK

Ok, tried on the pi. still getting the same error. Here's the entire run with steps:
1) Run script on pi
2) Connect tablet
3) Tells me to remove short and press enter (even though I haven't shorted anything since the first time)
4) Error

Output:

Code:
[email protected]:~/amonet $ sudo ./bootrom-step.sh 
[2019-05-06 09:07:31.683291] Waiting for bootrom
[2019-05-06 09:07:48.379937] Found port = /dev/ttyACM0
[2019-05-06 09:07:48.382916] Handshake
[2019-05-06 09:07:48.389611] Disable watchdog

 * * * Remove the short and press Enter * * * 


[2019-05-06 09:07:57.187218] Init crypto engine
[2019-05-06 09:07:57.423934] Disable caches
[2019-05-06 09:07:57.428255] Disable bootrom range checks
[2019-05-06 09:07:57.551708] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-05-06 09:07:57.605608] Send payload
[2019-05-06 09:08:03.755314] Let's rock
[2019-05-06 09:08:03.763474] Wait for the payload to come online...
[2019-05-06 09:08:04.221035] all good
[2019-05-06 09:08:04.223145] Check GPT
Traceback (most recent call last):
  File "main.py", line 156, in <module>
    main()
  File "main.py", line 82, in main
    switch_user(dev)
  File "main.py", line 53, in switch_user
    block = dev.emmc_read(0)
  File "/home/pi/amonet/modules/common.py", line 193, in emmc_read
    raise RuntimeError("read fail")
RuntimeError: read fail

Surely this is recoverable?
 

whereismyhat

Member
Oct 1, 2009
39
1
Ok, tried on the pi. still getting the same error. Here's the entire run with steps:
1) Run script on pi
2) Connect tablet
3) Tells me to remove short and press enter (even though I haven't shorted anything since the first time)
4) Error

Output:

Code:
[email protected]:~/amonet $ sudo ./bootrom-step.sh 
[2019-05-06 09:07:31.683291] Waiting for bootrom
[2019-05-06 09:07:48.379937] Found port = /dev/ttyACM0
[2019-05-06 09:07:48.382916] Handshake
[2019-05-06 09:07:48.389611] Disable watchdog

 * * * Remove the short and press Enter * * * 


[2019-05-06 09:07:57.187218] Init crypto engine
[2019-05-06 09:07:57.423934] Disable caches
[2019-05-06 09:07:57.428255] Disable bootrom range checks
[2019-05-06 09:07:57.551708] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-05-06 09:07:57.605608] Send payload
[2019-05-06 09:08:03.755314] Let's rock
[2019-05-06 09:08:03.763474] Wait for the payload to come online...
[2019-05-06 09:08:04.221035] all good
[2019-05-06 09:08:04.223145] Check GPT
Traceback (most recent call last):
  File "main.py", line 156, in <module>
    main()
  File "main.py", line 82, in main
    switch_user(dev)
  File "main.py", line 53, in switch_user
    block = dev.emmc_read(0)
  File "/home/pi/amonet/modules/common.py", line 193, in emmc_read
    raise RuntimeError("read fail")
RuntimeError: read fail

Surely this is recoverable?


im in the exact place you are, i sure hope so..
 

Dan_firehd

Senior Member
Sep 14, 2017
167
81
Success with Window 10 via VirtualBox+Ubnutu

First of all, I would like to express an immeasurable amount of gratitude for the effort of @k4y0z.

My configuration is as follows : Fire7 (7th Gen; Austin) on Amazon OS 5.6.1.0 with OTA and many Amazon apps disabled by ADB “pm hide” command.

1. Install VirtualBox from here : https://www.virtualbox.org/wiki/Downloads
2. Follow this instruction to install Ubuntu : https://itsfoss.com/install-linux-in-virtualbox/
3. After successful installtion of VirtualBox+Ubuntu, make sure one has the most up-to-date Ubuntu packages by clicking the "Software Updater" application in Ubuntu.
4. Make sure VirtualBox+Ubuntu can communicate with the Fire7 (7th Gen; Autsin) when it is plugged into the USB port. I have two USB3 ports and one of them seems to work better. Make sure you know how to pass the USB device from PC to VirtualBox by click-checking “Devices--> USB” on the VirtualBox menu.
5. Follow this video to open the backcover of Fire7 (7th Gen; Austin). Don't break your finger nail, use a small flat-head screw driver instead : https://www.youtube.com/watch?v=kOu_2po6EkA
6. Use a plier to make an L-shaped metallic paper clip with the short leg about 1cm long to be inserted into the rectangular hole to touch VDD1: (see attached JPEG file at the bottom of this post)
7. With Fire7 still connected to PC via USB port, I power off Fire7.
8. At this stage Fire7 is off and connected to PC. Follow OP step by step. After seeing “Waiting for bootrom ..” in Ubuntu Terminal application window, I insert the metallic paper clip to touch VDD1. I can hear the USB connecting sound from the PC. I then pass Fire7 from PC to VirtualBox by click-checking “Devices--> USB” on the VirtualBox menu. One might have to experiment a few times, because sometimes the contact between paper clip and VDD1 is not good and the tablet is activated in the preloader mode and proceeds to boot up into Amazon OS. If the Fire7 boots up to Amzon OS, one just powers it off and tries the paper clip again. When one hears the USB connecting sound, one must immediately pass Fire7 to VirtualBox within 3 seconds to catch bootrom mode. It does not matter that there is no visual cue of the metallic paper clip shorting the VDD1 resistors (because I did not cut open the metal shield on the mother board at all). One just needs to lightly touch the general area of VDD1 resistors with an L-shaped metallic paper clip. One relies on the USB connecting sound to know that the shorting has occurred. Once the script runs, it will complete without further issues. I follow the OP all the way to step 8.
9. Download the latest Magisk (v19.1) to PC from : https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
10. File transfer Magisk-v19.1.zip from PC to Fire 7.
11. Boot into TWRP ; then select “Install” button and navigate to the location of Magisk-v19.1.zip. Reboot after installing Magisk. After rebooting to Amazon OS, I find that Magisk Manager (v.7.1.2) is also automatically installed.
12. Now Fire7 has TWRP and is rooted with Magisk (v19.1). All the original Amazon OS and user apps remain intact. Only recovery is patched to TWRP.
13. Install BusyBox : https://play.google.com/store/apps/details?id=stericson.busybox&hl=en_US
14. Follow this thread for some Advanced Tuning : https://forum.xda-developers.com/amazon-fire/general/root-advanced-tuning-t3711462

Now I am waiting for Lineage-12.1 to be more stable and mature before switching from Amazon OS 5.6.1.0 to it.
https://forum.xda-developers.com/amazon-fire/orig-development/rom-lineage-12-1-t3639447
 

Attachments

  • Fire7-austin-shorting-point-spot.jpg
    Fire7-austin-shorting-point-spot.jpg
    248.3 KB · Views: 1,832
Last edited:

leaskovski

Senior Member
Mar 31, 2006
489
20
So, for some reason whenever I go to apply an update via adb it gets to about 40% and then the kindle (Fire HD 8 7th gen) says:

E: failed to verify whole-file signature
E: signature verification failed
Installation aborted.

I have no idea why it is happening and I can't find any q/a about this anywhere. Please help.

I am trying to do the same with a Fire 7 (7th Gen), and it is chucking the same error with the bin file downloaded. :S
 

rlowens

Member
Dec 1, 2016
36
12
I am trying to do the same with a Fire 7 (7th Gen), and it is chucking the same error with the bin file downloaded. :S

As replied to that user, the 5.0.1 downgrade only works for Fire 7 5th-gen (which is why it won't apply for you or them). For 7th-gen you have to open it up and use the paperclip jumper method.
 

leaskovski

Senior Member
Mar 31, 2006
489
20
As replied to that user, the 5.0.1 downgrade only works for Fire 7 5th-gen (which is why it won't apply for you or them). For 7th-gen you have to open it up and use the paperclip jumper method.

Yup, found that out after rereading the thread and some other posts. I managed to get the do the paper clip method using the post by @Dan_firehd to short without pulling the shield off! Awesome work Dan... thanks!
 
  • Like
Reactions: DB126 and ajislav
Ok, tried on the pi. still getting the same error. Here's the entire run with steps:
1) Run script on pi
2) Connect tablet
3) Tells me to remove short and press enter (even though I haven't shorted anything since the first time)
4) Error

Output:




im in the exact place you are, i sure hope so..

Try this: Disconnect the battery, run the script. After you short the point and When it asks you to press enter, plug the battery in FIRST then quickly hit enter.

Sent from my Amazon KFSUWI using XDA Labs
 
  • Like
Reactions: ajislav

chefp

Senior Member
May 15, 2010
161
31
Thank you @k4y0z for assembling the tools and instructions.

It took quite a bit of experimentation to finally unlock the bootloader. One of the big time wastes was figuring out which is the "left" button to hold down. Left/right obviously depends on which way you look at the tablet. The button to hold down while plugging in the USB port is the Volume Up button.

In my case, even though I purchased my tablet before Amazon's 5.3.2 fw was released, I still had to downgrade to 5.0.1. It always entered preloader mode and refused to enter bootloader mode. Tried many dozens of times over a few hours. Even cracked open the case, but that was unnecessary if I had sideloaded the Amazon 5.0.1 firmware to begin with.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 112
    Read this whole guide before starting.

    This is for the 5th gen Fire and 7th gen Fire

    Current Version
    5th gen: amonet-ford-v1.4.1.zip
    7th gen: amonet-austin-v1.4.1.zip

    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    If your Fire is on a newer preloader-version (or a 7th gen) you may also need:
    • Something conductive (paperclip, tweezers etc)
    • Something to open the tablet.

    There is an alternative for opening the tablet (only 5th gen), which is described below.

    Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work:
    Code:
    sudo apt update
    sudo add-apt-repository universe
    sudo apt install python3 python3-serial adb fastboot

    Make sure ModemManager is disabled or uninstalled:
    Code:
    sudo systemctl stop ModemManager
    sudo systemctl disable ModemManager


    NOTE: If you have issues running the scripts, you might have to run them using sudo.
    Also try using different USB-ports (preferably USB-2.0-ports)


    If you're lucky and have an old preloader (Up to FireOS 5.3.2, thanks @MontysEvilTwin), you can just hold the left volume button while plugging the device in.
    If you're on a newer preloader, there are two options:
    1. Open the device and short the pin marked in the attached photo to ground while plugging in.
    2. (Only 5th gen) Downgrade to 5.0.1 firmware via adb sideload in Amazon recovery, then proceed to use the left volume button to enter boot-rom.

    NOTE: Using option two will brick your device until you have successfully finished the process.

    1. Extract the attached zip-file "amonet-ford-v1.4.1.zip" (use "amonet-austin-v1.4.1.zip" for 7th gen) and open a terminal in that directory.
    2. start the script:
    Code:
    sudo ./bootrom-step.sh

    It should now say Waiting for bootrom.

    3. If you have an old preloader or used option 2 above:
    Hold the left volume-button and plug the device in.
    If you chose option 1, short the device according to the attached photo and plug it in.

    NOTE: Make sure the device is powered off, before plugging it in.

    NOTE: If you have issues getting a 7th gen into bootrom, read this post by @hwmod

    NOTE: For hints, how to access the pins on a 7th gen without removing the shield, check Post 1075 by @shelleyfrank

    NOTE:

    In lsusb the boot-rom shows up as:
    Code:
    Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone

    If it shows up as:
    Code:
    Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
    instead, you are in preloader-mode, try again.

    dmesg lists the correct device as:
    Code:
    [ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.00


    4. When the script asks you to remove the short, remove the short and press enter.

    5. Wait for the script to finish.
    If it stalls at some point, stop it and restart the process from step 2.

    6. Your device should now reboot into unlocked fastboot state.

    7. Run
    Code:
    sudo ./fastboot-step.sh

    8. Wait for the device to reboot into TWRP.

    9. Use TWRP to flash custom ROM, Magisk or SuperSU

    To return back to stock, Go into hacked fastboot-mode, then run
    Code:
    sudo ./stock-recovery.sh
    Your device should reboot into amazon recovery. Use adb sideload to install stock image from there.

    NOTE:
    Only ever flash boot/recovery images using TWRP, if you use FlashFire or other methods that are not aware of the exploit,
    your device will likely not boot anymore (unless you flashed a signed image).
    TWRP will patch recovery/boot-images on the fly.


    NOTE:
    fastboot-step flashes the 5.6.3 boot.img, if your device hangs at the orange fire logo, try wiping cache first.
    If that doesn't help, your system is probably incompatible with that image, just flash the right boot.img via TWRP.


    NOTE:
    This process does not disable OTA or does any other modifications to your system.
    You will have to do that according to the other guides in this forum.


    Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
    Thanks also to @ANDROID2468 and @bibikalka for testing things.
    Thanks to @mateo121212 and @hwmod for debugging 7th gen.
    Thanks to @MontysEvilTwin for figuring out volume-button access works up to FireOS 5.3.2, and for figuring out that 5.3.2 PL/TZ fix prime video.
    23
    Features.

    • Uses 5.3.2 Preloader/TZ for easy access to bootrom (using left volume button/only 5th gen)
    • Uses 5.6.3 LK for full compatibility with newer kernels.
    • Hacked fastboot mode lets you use all fastboot commands (flash etc).
    • Boots custom/unsigned kernel-images (need to be patched)
    • Sets androidboot.unlocked_kernel=true (enables adb root-shell)
    • For the devs: sets printk.disable_uart=0 (enables debug-output over UART).

    NOTE: Hacked fastboot can be reached via TWRP.

    NOTE: Hacked fastboot won't patch your boot/recovery-images, so you can easily go back to stock.
    Use TWRP for autopatching.
    14
    Version 1.4 (25.03.2019)
    • Update TWRP to twrp-9.0 sources
    • Implement downgrade-protection for LK/PL/TZ
    • Add scripts to enter fastboot/recovery in case of bootloop
    • Automatically restore boot-patch when you boot into recovery

    Version 1.3 (20.03.2019)
    Version 1.2.1 (17.02.2019)

    • Fix bug in 7th gen.

    16.02.2019
    • Now also unlock for the 7th gen :)

    Version 1.2 (14.02.2019)
    • Updated TWRP to contain new microloader..
    • Added TWRP shell command reboot-amonet to reboot into hacked fastboot.

    Version 1.1 (14.02.2019):
    • Fixed bug, caused when flashing large images via hacked fastboot.
    • Include stock recovery.img and script to flash back.

    Source Code:
    https://github.com/chaosmaster/amonet
    https://github.com/chaosmaster/android_bootable_recovery
    14
    To avoid damage to heat shield use

    For future reference, here are some photo's to indicate the positions of easily accessible shorting points, CMD and VDD1, and how to short them using flex wire (audio cable etc.) so as to avoid having to remove, or prying open, the heat shield.

    I did two tablets, one using the CMD pin and the other one using the VDD1 pin for the shorting routine with success. In addition, I had to try different usb ports on my laptop, and also unscrew the battery plug of the tablet to detach it occasionally. A typical successful process would be, detach battery, reconnect battery, apply short, connect usb, wait for script. This reply is only for help, it isn't a full guide.
    8
    Read this whole guide before starting.

    This is for the 5th gen Fire.
    It can also be used to root a 7th gen, but there are some differences.
    It's best you wait for a separate guide how to use this to root your 7th gen.
    :
    :
    Very special thanks to @xyz' for making all this possible and putting up with the countless questions I have asked, helping me finish this.
    Thanks also to @[email protected] and @bibikalka for testing things.
    Outstanding contribution. Clear, concise and relevant to a broad community with appropriate acknowledgements. This is what XDA is all about.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone