[UNLOCK][ROOT][TWRP][UNBRICK][DOWNGRADE] Fire 7 (ford and austin).

[Bilal Omer]

Hey There, Sorry For Posting So late, but I installed twrp on my fire 5th gen and it worked, I then updated to fire os 5.7.0.0 and it worked fine. But then I decided to install magisk using magisk manager (which i shouldn't have done) and am now in a bootloop (amazon logo shows for a few seconds, then screen turns black, then a few seconds later the amazon logo appears again, and repeat.) . I cant acess recovery mode (holding down volume down + power puts me in preloader mode and bootrom-step.sh doesn't work) and cant access fastboot ( to flash retail boot.img ). I Think I might have sorta bricked it. Any solutions without opening up the device would be much appreciated.
Many thanks in advance

 

[ATrafficCone]

Hi. I am about to run this script on my 2017 fire. I would like to ask a few questions before i do.

1. Should the tablet be on or off during the shorting process?
2. I am going to be shorting the VDD1. Should i just lightly touch it with the paperclip?
3. After the tablet is shorted, should I just plug it in? Because my tablet automatically turns on after being plugged into USB.

Thanks!

 

[mrmazak]

Hi. I am about to run this script on my 2017 fire. I would like to ask a few questions before i do.

1. Should the tablet be on or off during the shorting process?
2. I am going to be shorting the VDD1. Should i just lightly touch it with the paperclip?
3. After the tablet is shorted, should I just plug it in? Because my tablet automatically turns on after being plugged into USB.

Thanks!

Yes.

--1. As written in step three from OP,

Table must be off when starting this step.

--2. some people have posted failed attempts when the short(ground) was not held steady, so dont try to push the paper clip through the board, but hold it firm

--3. yes just plug in the tablet, it will turn on and script should see the usb device (tablet with the shorted pin) and continue runing the code.

 

[venumx]

hey there, was trying to do this on my fire 5th gen and stuck on bootrom step, makes it to "Flash TZ" and makes it to a number < 1000 / 2244 and hangs. i have tried about 30 times and same result, but different numbers that I make it to every time. is there something I might be doing wrong here?

 

[wakyct]

Hello, I've never been on this forum before, just wanted to say many thanks to the developers who provided the tools, I was able to install Lineage on a Fire 7 last night.

Also to anyone else giving this a go, if at first you don't succeed -- keep trying. It took me about 3 hours with multiple failures where I thought my setup was wrong, or I had the wrong environment, or bad hardware, etc. In the end everything worked, my setup was fine, most of the problems were my own inexperience.

What worked for me:
* Manjaro OS. I had installed android-tools and python-pyserial, python3.
* Try different USB cables
* I cut a short section of old TRS cable wire and stripped the ends for the short. I used VDD, inserting the ground wire partway into the rectangular slot in the shield and touching the other end of the wire to the shield.
* If the bootrom-step.sh hangs on Waiting for bootrom... you probably aren't doing the short properly. This took me many attempts. Use lsusb to see if it lists the Fire.
* If fastboot.step.sh hangs, try unplugging the Fire, running the script, and plugging in again. This is what worked for me for the script to see the device.
* I did not touch the battery at all.
* Once you're in TWRP (the scripts will install this), remember to wipe the cache before installing your ROM. I transferred the ROM via SD card, formatted as FAT 32 via # mkfs.fat -F 32 /dev/<your SD device -- find with lsblk>


Good luck!

 

[Bilal Omer]

How Do You Short Pins on a 5th gen i messed it up and cant enter recovery (preloader mode) and stuck in bootloop. I've opened it up but don't want to remove the heat shield (idk how) and dont want to accidentaly perma brick it by shorting the wrong bit. Im on 5.7.0.0 and cant downgrade so im a bit stuck and dont want to buy a fastboot cable ( idk if that would work ). Any help would be greatly appreciated

 

[Bilal Omer]

Thank You

 

[AstralA]

How Do You Short Pins on a 5th gen i messed it up and cant enter recovery (preloader mode) and stuck in bootloop. I've opened it up but don't want to remove the heat shield (idk how) and dont want to accidentaly perma brick it by shorting the wrong bit. Im on 5.7.0.0 and cant downgrade so im a bit stuck and dont want to buy a fastboot cable ( idk if that would work ). Any help would be greatly appreciated

https://forum.xda-developers.com/attachments/fire7-brom-jpg.4704934/

That red dot is the point to short to the metal frame highlighted in red as well.
But if there is a shield over it? Not a way without removing it im afraid.
I cant confirm if fastboot would work or not.
Well heres the fastboot cable compatibility list
Compatibility

• No? - HD 8 and HD 10 - 2015
• No - Amazon Fire - 2015
• No - Fire HD 6 and 7 - 2014
• ? - Fire HDX 8.9 - 2014
• No - Kindle Fire HDX 7" & 8.9" - 2013
• Yes - Kindle Fire HD - 2013
• Yes - 7" Kindle Fire HD - 2012
• No - 8.9" Kindle Fire HD - 2012
• Yes - Kindle Fire 2 - 2012
• Yes - Kindle Fire - 2011

So back to shorting the pins.

You simply connect a wire from red pad to red shield frame temporarily.
The 5th gen shield is easily removable with careful prying at corners.
You can use a small screwdriver to pry, a phone pry tool or even a guitar pick. An old fake credit card from the mail could work too in a pinch. As long as its thin and stiff. An old butter knife. Whatevers handy.
Might be wise to use an alligator clip to help free 1 hand. You cant alligator clip a wire on the pad. But you maybe can clip an end of wire to shield frame pictured highlighted in red.
If you dont have alligator clips, you might be able to borrow a hair clip from a girl. That could work in a pinch. Or could be bought at drugstores.

Only 7th gen has soldered shield.
Some people chose to use angle cutters to cut a hole in soldered shield to expose the test pad.
But I wouldnt recommend that way.
But if yours is 5th gen thats irrelevant.
5th gen has removable shield without need for hot air or cutting.

To reattach 5th gen shield simply line up with the snap pads on the circuit and press it securely back in place. The snap pads are like a smashed u shape. As long as the shield is lined up itll snap right back in without much fuss.


If you want to see what a cut open shield looks like refer to platypoids photo (post #480 I think)
But keep in mind the shield has the purpose to shield electrostatic discharge/radio interferance.
Good luck

Also ive not shorted the points. My kindle works using volume. But ive shorted points on other stuff like phone in qhs usb 9008 mode. With patience and hope you should be able to do it.

 

[AstralA]

Can anybody tell me or confirm/deny?

Using this method compared to the slightly older root guides,

Amazon Fire 5th Gen [SuperTool] Root, Google play install, block ota updates and more

Hi guys its RootJunky again and i have put together another SuperTool for all of you. this SuperTool is for the Amazon Fire 5th gen 7in tablet only. Some options may work on other version but that would be at your own risk. NOTE This tool has...

forum.xda-developers.com

Amazon Fire 5th Gen 2015 Root[only hd 7 and os 5.0.1]

NOTE THIS ROOT ONLY WORKS WITH FIRE OS 5.0.1 AND ONLY THE HD 7 NOT THE 10 OR 8 WE HAVE GAINED ROOT!!! Thanks to jkchr1s for the help and the windows bat file, csolanol for actually finding the root, and diegocr as well as the Chainfire SuperSu...

forum.xda-developers.com

This can install twrp?
And the older guides cant? Only offering a 1 time boot to twrp to get root?

Anybody know how I could use this guide on windows?
I have a linux machine but cant connect it online so I cant get the packages required.
My old windows ive already swapped files from machine so it has adb and fastboot.
So would save me hassle if this was doable on windows.

I looked at the amazon fire 5th gen supertool from rootjunky but looking through the .bat it seems overcomplicated and convoluted. I just want to install twrp to sideload supersu initially. But I do want to permanently install twrp if possible. This guide offers that twrp install? Or is it a 1 time boot also?

It also appears like it needs internet as the bat starts with visiting rootjunkydl.com. also the bat tries to install adb and fastboot. But I dont want to install those for the 5th or sixth time.

Anyway any advice is appreciated

 

[SJRouge91]

Hi all, just joined cause I wanted to ask if I would be able to unlock/root my fire 5th gen fire to install Lineage OS; I do have google play on it installed from some years ago (from Rootjunky), and the os version is 5.6.8.0 (I can't remembered when it updated to that version), but I've since had airplane mode on to prevent any more updates. Can I still downgrade and root it? I had re-watched some of Rootjunky's videos on downgrading and rooting, and wonder if they are still relevant. Thanks in advance to anyone that can help me out.

 

[webhook]

Hi all, just joined cause I wanted to ask if I would be able to unlock/root my fire 5th gen fire to install Lineage OS; I do have google play on it installed from some years ago (from Rootjunky), and the os version is 5.6.8.0 (I can't remembered when it updated to that version), but I've since had airplane mode on to prevent any more updates. Can I still downgrade and root it? I had re-watched some of Rootjunky's videos on downgrading and rooting, and wonder if they are still relevant. Thanks in advance to anyone that can help me out.

You should be able to downgrade. I own a Fire 7" 5th gen and I think I had to downgrade it. I probably rooted it like October of last year or something. Since I had a new preloader, I had to downgrade using the 5.0.1 firmware provided in the beginning in the thread.

 

[SJRouge91]

You should be able to downgrade. I own a Fire 7" 5th gen and I think I had to downgrade it. I probably rooted it like October of last year or something. Since I had a new preloader, I had to downgrade using the 5.0.1 firmware provided in the beginning in the thread.

Thank you for the reply, I was a bit confused about how to downgrade it and didn't want to risk bricking it by trying to continue, so I used the Fire ToolBox found on the forums to remove the amazon bloat, and just repurposing it as an e-reader for the time being. I know people will ask "why'd you want to root it if you're just using it as an e-reader?" and my answer is that I wanted to mostly for learning and some bragging rights too, since there's not a lot of people that have done this. I guess I could still downgrade it in the future, but it would be nice if someone made a video tutorial.

 

[webhook]

Can anybody tell me or confirm/deny?

Using this method compared to the slightly older root guides,

Amazon Fire 5th Gen [SuperTool] Root, Google play install, block ota updates and more

Hi guys its RootJunky again and i have put together another SuperTool for all of you. this SuperTool is for the Amazon Fire 5th gen 7in tablet only. Some options may work on other version but that would be at your own risk. NOTE This tool has...

forum.xda-developers.com

Amazon Fire 5th Gen 2015 Root[only hd 7 and os 5.0.1]

NOTE THIS ROOT ONLY WORKS WITH FIRE OS 5.0.1 AND ONLY THE HD 7 NOT THE 10 OR 8 WE HAVE GAINED ROOT!!! Thanks to jkchr1s for the help and the windows bat file, csolanol for actually finding the root, and diegocr as well as the Chainfire SuperSu...

forum.xda-developers.com

This can install twrp?
And the older guides cant? Only offering a 1 time boot to twrp to get root?

Anybody know how I could use this guide on windows?
I have a linux machine but cant connect it online so I cant get the packages required.
My old windows ive already swapped files from machine so it has adb and fastboot.
So would save me hassle if this was doable on windows.

I looked at the amazon fire 5th gen supertool from rootjunky but looking through the .bat it seems overcomplicated and convoluted. I just want to install twrp to sideload supersu initially. But I do want to permanently install twrp if possible. This guide offers that twrp install? Or is it a 1 time boot also?

It also appears like it needs internet as the bat starts with visiting rootjunkydl.com. also the bat tries to install adb and fastboot. But I dont want to install those for the 5th or sixth time.

Anyway any advice is appreciated

This can install TWRP alright... I did this back in October 2022. Worked like a charm.

 

[AstralA]

This can install TWRP alright... I did this back in October 2022. Worked like a charm.

Sweet. Thanks webhook. Will try this asap.
Waiting on a new keyboard in the mail.
Worried my only keyboards around my house might be compromised with malicious intent.

Guess thats what I got for thinking I ever had friends in reality.
Look forward to taking the linux plunge though.

 

[coolst3r]

[cunny@fedora amonet]$ sudo ./stock-recovery.sh
[sudo] password for cunny:
Sending 'recovery' (5182 KB) OKAY [ 0.173s]
Writing 'recovery' FAILED (remote: 'the command you input is restricted on locked hw')
fastboot: error: Command failed
[cunny@fedora amonet]$

 

[Tcwatson]

Hello,

I tried this with my 7th gen Fire 7. I recently brought this tablet out of storage after many years, and the battery was completely dead. After charging, attempting to boot the tablet resulted in it freezing on the Fire logo (I let it sit like this overnight). I decided to try this as a last attempt to get some use out of this thing.

When trying the script, it took me a few tries of getting "Serial protocol mismatch" while trying to short CMD before trying VDD1.

When I finally did short VDD1, the script hung for a while on Handshake, then came back with this stack trace:

[2023-05-02 00:23:14.895618] Waiting for bootrom
[2023-05-02 00:23:18.668611] Found port = /dev/ttyACM1
[2023-05-02 00:23:18.669215] Handshake
Traceback (most recent call last):
  File "/home/me/Downloads/fire-root/amonet/modules/main.py", line 156, in <module>
    main()
  File "/home/me/Downloads/fire-root/amonet/modules/main.py", line 75, in main
    handshake(dev)
  File "/home/me/Downloads/fire-root/amonet/modules/handshake.py", line 9, in handshake
    dev.handshake()
  File "/home/me/Downloads/fire-root/amonet/modules/common.py", line 100, in handshake
    c = self._writeb(b'\xa0')
        ^^^^^^^^^^^^^^^^^^^^^
  File "/home/me/Downloads/fire-root/amonet/modules/common.py", line 95, in _writeb
    return self.dev.read()
           ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/serial/serialposix.py", line 595, in read
    raise SerialException(
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

Now, the tablet won't turn on, and further attempts to short are met with no response from the script. Is it bricked?

 

[fleisch80]

That depends.
When you last used it , did you notice it permanently freeze up .
I read where you said that it was giving you problems before.

usually , about 95 percent of the fire 7 models could be recovered but this of course is dependent on wether or not its board is working.

I wish I could give you some better advice , but the truth is at best it takes
feel for the process . you can do everything right and it can still not work ,
or sometimes you need to refine your steps , timing and know that
for no good reason one day it might take , another day it will give you problems trying to
get it .

What sometimes worked for me was trying the different sequences and
processes in different order , then go back to trying the specific code used to
flash it .

It also depends on what state your unit is in ,
I mean if you already partially got it to begin flashing but it glitched ,
Its possible you need to use one of those other sequences and codes to
Glitch the proccessor again before you can flash .


I'm pretty good at doing the process and flashing them ,
even for me its almost always never easy 123.

Its the feel for the whole process that will help you succeed at it .

MAKE SURE you ARE attempting the process while giving the
Files and commands sudo access , if you don't sudo before you begin each
command , it won't work !

 

[Bluddymarri]

Guys, I am stuck and need some help
I followed the instructions with my old Gen5 Fire 7 until the point where it said, that the tablet should boot into TWRP. Well, it does boot into TWRP, but I see the splash screen of it only for a few seconds and then the tablet decides to go into a reboot loop that only shows me the amazon logo. I only get out of the loop by unplugging USB and the battery. Afterwards I can start over from point 1 of the steps but always with the same result.

What I found out is, that when I am in the reboot loop, keeping power+vol pressed brings me again to TWRP, but also only for a second.

So, what am I doing wrong here?

 

[OrangeyMaq]

I know this post is 4 years old already but I'm experiencing an issue,
I have an Amazon Fire 7 (5th gen ford), running 5.3.6.4 firmware. I am trying the option with the tweezers/paperclip and when I plug my cable into the powered-off device, it's stuck on waiting for bootrom. I've even tried soldering on a cable with no luck (or maybe I didn't solder it on properly, doubt that tho) to no avail. I am considering the downgrade option, but from what I've seen on other XDA threads, that will cause a brick. Will the device when bricked still be able to perform the exploit or will it be permanently bricked?

Bit of extra info:

• OS is Fedora 38, with all the dependencies installed running inside of VirtualBox 7.0
• Host OS is Windows 11
• Device is fully detected by the OS and adb commands work
• Device is Amazon Fire 7 5th Gen (ford)
• Connected to a USB 2.0 port
• Firmware is 5.3.6.4

 

[webhook]

I know this post is 4 years old already but I'm experiencing an issue,
I have an Amazon Fire 7 (5th gen ford), running 5.3.6.4 firmware. I am trying the option with the tweezers/paperclip and when I plug my cable into the powered-off device, it's stuck on waiting for bootrom. I've even tried soldering on a cable with no luck (or maybe I didn't solder it on properly, doubt that tho) to no avail. I am considering the downgrade option, but from what I've seen on other XDA threads, that will cause a brick. Will the device when bricked still be able to perform the exploit or will it be permanently bricked?

Bit of extra info:

• OS is Fedora 38, with all the dependencies installed running inside of VirtualBox 7.0
• Host OS is Windows 11
• Device is fully detected by the OS and adb commands work
• Device is Amazon Fire 7 5th Gen (ford)
• Connected to a USB 2.0 port
• Firmware is 5.3.6.4

I have tried the "downgrade" option. No, it will not permanently brick your device. You can still do the exploit even when it's bricked as it will unbrick the device..

Also why use VirtualBox 7.0? It's recommended to use a native Linux installation to avoid issues.