[UNLOCK][ROOT][TWRP][UNBRICK][DOWNGRADE] Fire 7 (ford and austin).

[cw-kid]

Magisk Manager saying "Upgrade to full Magisk Manger to finish the setup. Download and install?

I installed via TWRP Adb Sideload, the latest Magisk v21.4 .zip downloaded from the Github releases page here, whilst I was installing LineageOS 12.1 ROM and Gapps etc.

Now when I use the Root Checker app in the Android OS, it says I have no root.

Is it safe to install this Magisk Manager update when in the Android OS ?

I've never used Magisk before only SuperSu.

EDIT:

I've just seen there is also a " Magisk Manager v8.0.7 " on that Github page maybe I should of installed that as well whilst in TWRP?

Looking at this page its an apk file for Magisk Manager not a zip file. So maybe I have to just install that as you normally would an apk file actually in the Android OS.

EDIT 2:

I went ahead and installed the .apk in the Android OS, the tablet rebooted and OK and now when using Root Checker Basic app it says Root access is properly installed on this device. So it seems all OK.

Thanks

 

[Don_Pachuco]

Is it possible to do anything on a SV98LN, without having to use any Linux BS? Something like Odin or sdcardmaker? Or flash it in downloader mode?

 

[garrettbroadnax]

I don't know what this error means but someone had this issue

https://xdaforums.com/t/unlock-root...ford-and-austin.3899860/page-73#post-81380973

and apparently it was due to their Linux setup. I think they might have fixed it by reinstalling Linux or something.

Are you using a virtual machine? (They sometimes have issues with USB ports).
You could try using a Linux live USB with the latest Mint to boot with and do the exploit on that.
You could also try temporarily taking off the battery connector (it's the white plastic bit) for about 10 seconds and then put it back on.

I am using a VM (Ubuntu through Parallels) and this happened to me as well. I ended getting a slew of similar errors in code that seemed to work for everyone else, so I'll attribute it to that. Unf no fix found, ran into other problems.

 

[ldeveraux]

I am using a VM (Ubuntu through Parallels) and this happened to me as well. I ended getting a slew of similar errors in code that seemed to work for everyone else, so I'll attribute it to that. Unf no fix found, ran into other problems.

I'm not an expert, but I'll bet you could use this method in MacOS since it's unix based just like ubuntu.

 

[strabo231]

This worked out great! I had a 5 wire factory cable I got off Amazon awhile back handy, so the ground short ended up not being necessary. Thanks a lot!

 

[dmmatos]

This is what mine is doing. I attempted to add the input() before switch_user(dev) in main.py, however there are 6 occurrences of it and it starts throwing errors. Suggestions?


ubuntu@ubuntu:/media/ubuntu/Lego - mSATA/adb/amonet$ sudo ./bootrom-step.sh
[2021-02-19 15:04:17.878167] Waiting for bootrom
[2021-02-19 15:04:21.643298] Found port = /dev/ttyACM0
[2021-02-19 15:04:21.643962] Handshake
[2021-02-19 15:04:21.644554] Disable watchdog

* * * Remove the short and press Enter * * *


[2021-02-19 15:04:25.519834] Init crypto engine
[2021-02-19 15:04:25.540445] Disable caches
[2021-02-19 15:04:25.541260] Disable bootrom range checks
[2021-02-19 15:04:25.555087] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2021-02-19 15:04:25.557157] Send payload
[2021-02-19 15:04:26.140834] Let's rock
[2021-02-19 15:04:26.141727] Wait for the payload to come online...
[2021-02-19 15:04:26.751649] all good
[2021-02-19 15:04:26.752385] Check GPT
[2021-02-19 15:04:27.044356] gpt_parsed = {'KB': (2048, 2048), 'DKB': (4096, 2048), 'EXPDB': (6144, 35584), 'UBOOT': (41728, 2048), 'boot': (43776, 32768), 'recovery': (76544, 32768), 'MISC': (109312, 1024), 'LOGO': (110336, 7168), 'TEE1': (117504, 10240), 'TEE2': (127744, 10240), 'system': (137984, 2457600), 'cache': (2595584, 512000), 'userdata': (3107584, 12162271), '': (0, 1)}
[2021-02-19 15:04:27.045418] Check boot0
[2021-02-19 15:04:27.249822] Check rpmb
[2021-02-19 15:04:27.459593] rpmb looks broken; if this is expected (i.e. you're retrying the exploit) press enter, otherwise terminate with Ctrl+C

[2021-02-19 15:04:39.335067] Clear preloader header

[8 / 8]
[2021-02-19 15:04:39.704578] Downgrade rpmb
[2021-02-19 15:04:39.706684] Recheck rpmb
[2021-02-19 15:04:40.600713] rpmb downgrade ok
[2021-02-19 15:04:40.601801] Flash lk-payload
[5 / 5]
[2021-02-19 15:04:40.910275] Flash tz
[2308 / 2308]
[2021-02-19 15:05:28.640796] Flash lk
[974 / 974]
[2021-02-19 15:05:48.881966] Inject microloader
[2 / 2]
[2021-02-19 15:05:49.217866] Force fastboot
[2021-02-19 15:05:49.487354] Flash preloader
[248 / 248]
[2021-02-19 15:05:54.797959] Reboot to unlocked fastboot

ubuntu@ubuntu:/media/ubuntu/Lego - mSATA/adb/amonet$ sudo ./fastboot-step.sh
< waiting for any device >


(I've tried battery, no battery, rebooting with power/volume up, power/volume down, 35 seconds, etc. Nothing - screen doesn't even turn on). Any suggestions would be great1

I successfully installed Lineage OS on a Fire 7 7 tablet and have it working well. However, a second one I tried is stuck at:

6. Your device should now reboot into unlocked fastboot state.

It doesn't reboot and I can't get it to reboot - I've tried the process with disconnected battery, unplug and replug usb, re-connecting battery, etc.

I've tried to adb fastboot as well, but the device isn't reported as connected.

I am using Ubuntu via USB and am repeating the process the same way I did the first time.

Any suggestions would be greatly appreciated!

 

[JonB_Fire]

I'm trying to unbrick a Gen 5 Fire (Model SV98LN). See https://xdaforums.com/t/help-me-unbrick-my-kindle-fire-gen-5.4236449/

Following https://xdaforums.com/t/...ick-downgrade-fire-7-ford-and-austin.3899860/ I have got it into (hacked) FastBoot mode. It's displaying an Amazon logo and says "=> HACKED FASTBOOT: (0) - xyz, k4y0z" but can't be turned off (yet).

The next step in the procedure is to call the fastboot_step.sh script, but each tiome I do it errors out with "symbol lookup error: fastboot: undefined symbol: _Z15ErrorCodeStringi"

Any help? I think it's a Linux thing.

 

[JonB_Fire]

No matter - I fixed it by installing TWRP from a PC. So, I now have LineageOS installed.. need to put the open_gapps on there but for now it's all good.

 

[saltymyarse]

Ive tried to Follow the steps as listed but when i try to perform sudo ./bootrom-step.sh this happens:

[2021-02-25 16:36:13.893330] Waiting for bootrom
[2021-02-25 16:36:26.016340] Found port = /dev/ttyACM0
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 265, in open
self.fd = os.open(self.portstr, os.O_RDWR | os.O_NOCTTY | os.O_NONBLOCK)
FileNotFoundError: [Errno 2] No such file or directory: '/dev/ttyACM0'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 156, in <module>
main()
File "main.py", line 72, in main
dev.find_device()
File "/home/saltyboat/Downloads/Files/amonet/modules/common.py", line 83, in find_device
self.dev = serial.Serial(port, BAUD, timeout=TIMEOUT)
File "/usr/lib/python3/dist-packages/serial/serialutil.py", line 240, in __init__
self.open()
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 268, in open
raise SerialException(msg.errno, "could not open port {}: {}".format(self._port, msg))
serial.serialutil.SerialException: [Errno 2] could not open port /dev/ttyACM0: [Errno 2] No such file or directory: '/dev/ttyACM0'

 

[Mionaruse]

Hi, im trying to restore my kindle fire 5th gen to stock so I can trade it in, and all I need to do is get rid of twrp. How would i go about this?

 

[Rortiz2]

Hi, im trying to restore my kindle fire 5th gen to stock so I can trade it in, and all I need to do is get rid of twrp. How would i go about this?

As the OP says, run

sudo ./stock-recovery.sh

to flash and reboot back to Amazon Recovery. Once you're there, use adb sideload to install a stock update.bin.

 

[sgoloj07]

pretty sure the hardware is damaged, if i try to short it the script wont get past first stage, waiting for bootrom.

if i just plug it in without shorting the script will run but fail here:

[2019-02-17 20:55:23.766888] Waiting for bootrom
[2019-02-17 20:55:27.818604] Found port = /dev/ttyACM0
[2019-02-17 20:55:27.822653] Handshake
[2019-02-17 20:55:27.830617] Disable watchdog

* * * Remove the short and press Enter * * *


[2019-02-17 20:55:38.500868] Init crypto engine
[2019-02-17 20:55:38.839860] Disable caches
[2019-02-17 20:55:38.843787] Disable bootrom range checks
[2019-02-17 20:55:39.022190] Load payload from ../brom-payload/build/payload.bin = 0x45D0 bytes
[2019-02-17 20:55:39.039108] Send payload
[2019-02-17 20:55:48.263925] Let's rock
[2019-02-17 20:55:48.271800] Wait for the payload to come online...
[2019-02-17 20:55:48.728758] all good
[2019-02-17 20:55:48.729656] Check GPT
Traceback (most recent call last):
  File "main.py", line 130, in <module>
    main()
  File "main.py", line 71, in main
    switch_user(dev)
  File "main.py", line 41, in switch_user
    block = dev.emmc_read(0)
  File "/home/matthew/Downloads/amonet/modules/common.py", line 185, in emmc_read
    raise RuntimeError("read fail")
RuntimeError: read fail

This means boot rom mode yes? because its always like this

matthew@UNKNOWN:~/Downloads/amonet$ lsusb | grep MediaTek
Bus 005 Device 115: ID 0e8d:0003 MediaTek Inc. MT6227 phone

still having this issue i anyone ? still stuck in here

 

[ascorbin]

all i can say, after many years: I <3 XDA!!

grtz muffad aka ascorbin

 

[mickeyx323]

Ok, I got it working on both Fire 7 5th gen tablets... even though I used to get the
ERROR: Serial protocol mismatch
and/or stuck at the handshake line.

What did I do? Tried over a million thing on a span of 7 hours, which included crying, and praying to the top pop culture Gods out there.

Finally, I guess I did have an older version, because I randomly restarted the tablet, turned it off, and tried doing it holding the volume button furthest from the power button, and it fuc(^*$ worked. Did the same thing for the other tablet, didn't work at first, rebooted, and it didn't work, rebooted again, and it worked.

I was stuck on handshake and black screen on mine.
1. Run sudo ./bootrom-step.sh
2. Take off the cover disconnect the battery.
3. Get something to press the volume down button and plug it into the computer.
3. It started working and then I connect the battery. (I did this while it was running the script, you might be able to connect the battery after it is done, but im not sure).

 

[NTGDeveloper]

I was stuck on handshake and black screen on mine.
1. Run sudo ./bootrom-step.sh
2. Take off the cover disconnect the battery.
3. Get something to press the volume down button and plug it into the computer.
3. It started working and then I connect the battery. (I did this while it was running the script, you might be able to connect the battery after it is done, but im not sure).

Aw, I should've tried that when I was stuck on the handshake. I was stuck on it for a period of time and had to wait like 6 months before I got the motivation to try again with a different Linux device!

 

[spycedtx]

Please forgive my asking what may be basic questions already answered: thread search appears to be broken (0 results even on words I can see), and there are 92 pages

ford, was running 5.3.6.x, followed page 1 on this thread to sideload down to 5.0.1, which left a brick (As expected)

lsusb: Bus 020 Device 020: ID 0e8d:0003 MediaTek Inc. MT6227 phone


1: Can anyone verify this works or not on a mac? I've tried, and that leads me to...

2: Ran sudo ./bootrom-step.sh, held the left volume button and plugged it in, and released the button when I was prompted to remove the short and press Enter

I got this:

Spoiler

[2021-03-14 01:08:20.407662] Waiting for bootrom
[2021-03-14 01:08:38.695880] Found port = /dev/cu.usbmodem14201
[2021-03-14 01:08:38.698495] Handshake
[2021-03-14 01:08:38.699528] Disable watchdog

* * * Remove the short and press Enter * * *

[2021-03-14 01:09:31.571982] Init crypto engine

Traceback (most recent call last):

File "/Users/a/.pyenv/versions/3.8.5/lib/python3.8/site-packages/serial/serialposix.py", line 621, in write
n = os.write(self.fd, d)
OSError: [Errno 6] Device not configured


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 156, in <module>
main()
File "main.py", line 78, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/load_payload.py", line 104, in load_payload
init(dev)
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/load_payload.py", line 9, in init
dev.write32(CRYPTO_BASE + 0x0C0C, 0)
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/common.py", line 151, in write32
self.dev.write(b'\xd4')
File "/Users/a/.pyenv/versions/3.8.5/lib/python3.8/site-packages/serial/serialposix.py", line 655, in write
raise SerialException('write failed: {}'.format(e))
serial.serialutil.SerialException: write failed: [Errno 6] Device not configured

Okay, so I unplugged again, and tried it again.

This time I released the volume button as soon as I saw it show "handshake". And it just sat there, no output, no errors, just silence.

I stopped it, tried it again, this time holding the volume button even after 'handshake", waiting for it to tell me to press enter. And it never did, it's still sitting there after printing "Handshake".

3: When are you supposed to release the volume button?

4: Is it doing something after handshake? Will there be output so I know it's doing something, and not just hung and waiting ?

Thank you!

 

[NTGDeveloper]

1: Can anyone verify this works or not on a mac? I've tried, and that leads me to...

I am pretty sure that it says on the front page that this guide only works on Linux. You'll need to create a Linux bootable USB with Ubuntu or something based on Ubuntu and install the dependencies that are mentioned on the front page. Using a bootable USB will not wipe your macOS data, so don't worry about that. Try following this guide: https://ubuntu.com/tutorials/create-a-usb-stick-on-macos

 

[spycedtx]

I am pretty sure that it says on the front page that this guide only works on Linux. You'll need to create a Linux bootable USB with Ubuntu or something based on Ubuntu and install the dependencies that are mentioned on the front page. Using a bootable USB will not wipe your macOS data, so don't worry about that. Try following this guide: https://ubuntu.com/tutorials/create-a-usb-stick-on-macos

True, it does. And at some level, mac is *nix, no? And .. anyway, I saw some comments about others trying it, but never a confirmation of success or not.

Can you offer any answers on the other questions?

Thank you!

 

[NTGDeveloper]

True, it does. And at some level, mac is *nix, no? And .. anyway, I saw some comments about others trying it, but never a confirmation of success or not.

Can you offer any answers on the other questions?

Thank you!

Sure!

2: Ran sudo ./bootrom-step.sh, held the left volume button and plugged it in, and released the button when I was prompted to remove the short and press Enter

I got this:

Spoiler

[2021-03-14 01:08:20.407662] Waiting for bootrom
[2021-03-14 01:08:38.695880] Found port = /dev/cu.usbmodem14201
[2021-03-14 01:08:38.698495] Handshake
[2021-03-14 01:08:38.699528] Disable watchdog

* * * Remove the short and press Enter * * *

[2021-03-14 01:09:31.571982] Init crypto engine

Traceback (most recent call last):

File "/Users/a/.pyenv/versions/3.8.5/lib/python3.8/site-packages/serial/serialposix.py", line 621, in write
n = os.write(self.fd, d)
OSError: [Errno 6] Device not configured


During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "main.py", line 156, in <module>
main()
File "main.py", line 78, in main
load_payload(dev, "../brom-payload/build/payload.bin")
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/load_payload.py", line 104, in load_payload
init(dev)
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/load_payload.py", line 9, in init
dev.write32(CRYPTO_BASE + 0x0C0C, 0)
File "/Users/a/Downloads/amonet-ford-v1.4.1/amonet/modules/common.py", line 151, in write32
self.dev.write(b'\xd4')
File "/Users/a/.pyenv/versions/3.8.5/lib/python3.8/site-packages/serial/serialposix.py", line 655, in write
raise SerialException('write failed: {}'.format(e))
serial.serialutil.SerialException: write failed: [Errno 6] Device not configured

Okay, so I unplugged again, and tried it again.

This time I released the volume button as soon as I saw it show "handshake". And it just sat there, no output, no errors, just silence.

I stopped it, tried it again, this time holding the volume button even after 'handshake", waiting for it to tell me to press enter. And it never did, it's still sitting there after printing "Handshake".

For this, you shouldn't be seeing any blank thing. There should be a massive output if it is working successfully with numbers and such. Idk the specifics, but probably something to do with the macOS Darwin kernel and incompatibilities.

3: When are you supposed to release the volume button?

I'd say as soon as you see the "Remove Short and Press Enter" thing. You're pressing the volume button in order for the device to boot into the bootrom mode, so once you see the remove short, you can let go.

4: Is it doing something after handshake? Will there be output so I know it's doing something, and not just hung and waiting ?

While I don't exactly remember how I solved this issue when I had it myself, you can try plugging it into a USB 2 port if you haven't already, or you can also try to reboot the device by holding the power button for a while, then the volume button again for the bootrom.
I'd honestly believe from some of this that macOS is the culprit. The kernels are similar, but they have a lot of differences to the point where this probably won't work properly. Let me know if there are any more issues and I can try to help!

 

[fuhreal]

Would anyone be able to tell me which pin I need to short? My 2017 HD 10 doesn't seem to have the same layout as most of the pics I've found.

Thanks in advance!