I was unable to preform a hard reset, must be blocked by one of the programs that I installed during the rooting process. I was able to reboot into fastboot mode and I'm looking for instructions on how to get into TWRP through fastboot. (if that is even possible)
Err, I don't think you can enter TWRP from Fastboot mode, not sure though. But it does sound to me that TWRP isn't even installed (TWRP has nothing to do with root'ing per se).
I think you need to re-flash TWRP. I don't recall the exact details but, first you need to find & download the correct flashable TWRP image, then connect your FireHD to a computer, enter Bootloader mode and then use adb to flash the TWRP recovery image to the tablet (it's something like 'fastboot flash recovery TWRP.img') and then use adb to reboot the tablet into TWRP (something like 'adb reboot recovery')
Once the tablet is rebooted to TWRP, *then* you can format data & flash your ROM (you may need to adb push the ROM to the tablet after formatting data). And *before* rebooting, flash the root method (I think Magisk 20.4 works?). So the ROM and Magisk are flashed the first time you enter TWRP and before trying to boot to the system - I think this is necessary because if you don't, then the TWRP recovery image you just flashed through adb can be overwritten & lost, so flashing the ROM & Magisk on the first entry into TWRP should make it permanent.
I'm not sure though as it's been months since I flashed my FireHD10
I think you need to re-flash TWRP. I don't recall the exact details but, first you need to find & download the correct flashable TWRP image, then connect your FireHD to a computer, enter Bootloader mode and then use adb to flash the TWRP recovery image to the tablet (it's something like 'fastboot flash recovery TWRP.img') and then use adb to reboot the tablet into TWRP (something like 'adb reboot recovery')
Once the tablet is rebooted to TWRP, *then* you can format data & flash your ROM (you may need to adb push the ROM to the tablet after formatting data). And *before* rebooting, flash the root method (I think Magisk 20.4 works?). So the ROM and Magisk are flashed the first time you enter TWRP and before trying to boot to the system - I think this is necessary because if you don't, then the TWRP recovery image you just flashed through adb can be overwritten & lost, so flashing the ROM & Magisk on the first entry into TWRP should make it permanent.
I'm not sure though as it's been months since I flashed my FireHD10
Last edited:
How did you install TWRP? Did you follow all of the instructions on the first post of this thread to unlock the bootloader (which is necessary), or did you only root the device? I am guessing that you only rooted it, as (IIRC) it should have automatically booted into TWRP during the final step of unlocking the bootloader. Also, I have no idea if all this works on 5.6.8.0.
In the amonet zip from OP is a script called boot-recovery.sh, very useful to boot into twrp (works only in case the exploit is in place). You may re-read the OP up to post #3 for details.
I think I should add some context...
I could not use https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-10-2017-suez.3913639/ because my HD 10 is 5.6.8.0, I used the instructions here https://github.com/3ch01c/3ch01c.github.io/blob/master/docs/how-to-setup-amazon-fire-hd10.md instead to get offline root via an exploit followed by installing SuperSU to maintain root. (the authors never meant to install a custom rom, only modify the current Amazon ROM so they did not unlock bootloader)
I proceeded to install the "official" TWRP app and in the "TWRP FLASH" was initially able to reboot into Amazon Recovery, but managed to mess something up so that the tablet won't reboot into recovery at all now (via the buttons or adb) just goes to black and white amazon logo, black screen, back to bw logo and fires up like normal (no recovery)
For a long time if I did "adb reboot bootloader" it would reboot into fastboot but keep disconnecting and reconnecting to the computer, but I think I was able to fix that today by installing the correct USB driver.
I just went into fastboot and tried "fastboot flash recovery twrp.img" and "fastboot flash recovery "TWRP_suez-180918.img"
I got the same error message both times
Booting Failed (remote: 'the command you input is restricted on locked hw')
I tried "fastboot oem unlock" and got the same error
Is there any way to get around this error?
I'm pretty lost at this point, is there any way to get TWRP working?
Solution for all offline/online or whatever tools rooted (i.e. supersu rooted) suez tablets is simple, only need to run this from OP:
Code:
sudo ./step-1.sh
sudo ./bootrom-step-minimal.sh
sudo ./fastboot-step.shIf the OS won't boot, your tablet is somehow bricked and you have to use the 'unbrick' guide from post #2
You will have to open the device/partially take it apart and if you follow the mentioned guide, the 'sudo ./bootrom-step.sh' and 'sudo ./fastboot-step.sh' scripts will get your tablet unlocked/rooted with twrp installed.
Well, I'm not sure what the reason would be for you to not unlock the bootloader & then just flash a Lineage ROM or even flash the latest FireOS ROM from Amazon (5.6.9.0 is available here) so you have FireOS with unlocked bootloader, TWRP installed & rooted so you can use a different Launcher if you want with FireOS. That's what I have on both my FireHD10 so I can use voice commands with Alexa with Nova Launcher as the default.
I think you'll have to try @Sus_i instructions & unlock your bootloader etc.
I want to make sure that I am not missing something obvious with Ubuntu...
Using both a Window's Ubuntu shell and a memory stick booted version of Ubuntu I get the same results with the first three steps sudo ./step-1.sh
adb server version (41) does not match this client (39); killing...
*daemon started successfully And then the curser just blinks indefinitely
if I close the terminal and open it back up to run sudo ./bootrom-step-minimal.sh
it says "waiting for bootrom" I tried rebooting into fastboot with "adb reboot bootloader" but that doesn't help
Tried step sudo ./fastboot-step.sh while in fastboot, says <waiting for any device> in fastboot and after reboot
The pad is still booting, just won't boot into recovery mode at all. When I use adb command "reboot recovery" it boots normally, when I use adb command "reboot bootloader" it boots into fastboot
Last edited:
Thats good.
Doesn't matter.
As a first step, boot the tablet, connect adb and check superuser:
Code:
adb shell
suThe step1 script from OP works only in case you get # su access via adb shell and if you have done all steps from OP like this:
Code:
sudo add-apt-repository universe
sudo apt update
sudo apt install python3 python3-serial adb fastboot dos2unix
sudo systemctl stop ModemManager
sudo systemctl disable ModemManagerIf you did this and su is there, run: sudo ./step-1.sh
If you get some errors, maybe copy/paste the terminal output into code tags...
Googling this error seems to suggest you have two adb servers running or there is some issue with the environment PATH. There is some blurb here which I didn't read all of.
If I recall correctly, I used a Linux Mint environment & didn't have any issues, so maybe that's a simple solution?
And more blurb here:
How To Resolve This ADB Server Version Doesn't Match This Client Error In Android? | The Dark Source
In this thread, we will resolve ADB server version doesn't match this client error, you will face some time while installing and configuring the ADB. Here we
thedarksource.com
Thanks Sus_i,Thats good.
Doesn't matter.
As a first step, boot the tablet, connect adb and check superuser:
Check popups on your tablet, enable root access for the shell.Code:adb shell su
The step1 script from OP works only in case you get # su access via adb shell and if you have done all steps from OP like this:
Code:sudo add-apt-repository universe sudo apt update sudo apt install python3 python3-serial adb fastboot dos2unix sudo systemctl stop ModemManager sudo systemctl disable ModemManager
If you did this and su is there, run: sudo ./step-1.sh
If you get some errors, maybe copy/paste the terminal output into code tags...
I had a serious set-back, installed Magisk without doing enough research. Now I'm stuck in a boot-loop and no working recovery mode. Planning on trying the brick script instructions.
Thanks for the advice smithbill. Decided to install a duel boot of Mint to resolve the adb issues. First install of Mint went sideways and broke my laptop. Spent tonight reinstalling Windows and Mint, have both working now on a duel boot. Unfortunately I tried installing Magisk the other night after reading another thread and my tablet is stuck in a bootloop with no accessible recovery mode. The only thing I can think to do is to try and follow the brick instructions.Googling this error seems to suggest you have two adb servers running or there is some issue with the environment PATH. There is some blurb here which I didn't read all of.
If I recall correctly, I used a Linux Mint environment & didn't have any issues, so maybe that's a simple solution?
And more blurb here:
How To Resolve This ADB Server Version Doesn't Match This Client Error In Android? | The Dark Source
In this thread, we will resolve ADB server version doesn't match this client error, you will face some time while installing and configuring the ADB. Here we
Always install Windows first, then boot a Linux Live from USB and either allow it to automatically install Linux alongside Windows for dual boot. Or you can use the Windows Disk Manager to 'shrink' your Windows C: partition leaving a block of Unused disk space, then Linux can be installed into that free space.
Presumably your FireHD can still get into Fastboot mode? I'm not sure of everything you can do in Fastboot mode, but this page:
https://www.makeuseof.com/tag/use-adb-fastboot-android/amp/
suggests you can do a lot like flashing new recovery images, wiping the system etc etc. Perhaps you could use 'adb sideload' something? Or uninstall Magisk?
Perhaps following the 'return to stock' instructions is an option, and once back at stock FireOS you could then restart the process to install TWRP etc
Last edited:
You could try the boot-recovery script from OP first, but I guess the unbrick solution from OP is the only way to fix it...
Back then I've watched a video on youtube, it's possible to open the tablet a few times without a single scratch
I believe boot-recovery should still work since he just overwrote the boot payloadYou could try the boot-recovery script from OP first, but I guess the unbrick solution from OP is the only way to fix it...
Back then I've watched a video on youtube, it's possible to open the tablet a few times without a single scratch
I actually messed up the boot recovery before this by trying to use the "official" TWRP App to flash itself onto the recovery mode. For some reason recovery mode stopped working. I was still able to boot into fastboot, but not now since my computer won't connect to the tablet while it is boot-looping.
After rooting it intially with offline root instructions I tried installing TWRP with the "official" TWRP App. After flashing a new recovery mode, recovery mode just stopped working on the tablet, I'm not sure why. Fastboot mode was still accessable, but not now with it stuck in a boot loop. (I think)
Yeah you completely killed it so you have to open it up now.
You can also try the fastboot brick exploit. If you're lucky enough it could work.
Good luck
Never use updated versions in the initial process. Use only what's given. Once it's all sorted & settled, then you can consider upgrading TWRPs etc
Surely even in a bootloop, you can still force it into Fastboot mode by holding down the relevant keys whilst it tries to boot? If not, then I guess you really have bricked it & you'll have to try the 'opening it up' thing.
I did end up having to open it up. (twice) Didn't install Majisk or new ROM the first time. I re-opened it and have Linage 12.1 installed now.
GApps failed to install for some reason. I'm going to install the fire toolbox and try to install them that way. Thanks for all of the help!Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
86Read this whole guide before starting.
This is for the 7th gen Fire HD10 (suez).
Current version: amonet-suez-v1.1.2.zip
NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.
NOTE: This process will modify the partition-table (GPT) of your device.
NOTE: Your device will be reset to factory defaults (including internal storage) during this process.
What you need:
- A Linux installation or live-system
- A micro-USB cable
Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
Code:sudo apt update sudo add-apt-repository universe sudo apt install python3 python3-serial adb fastboot dos2unix
1. Extract the attached zip-file "amonet-suez-v1.1.2.zip" and open a terminal in that directory.
NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder
2. Enable ADB in Developer Settings
3. Start the script:
Code:sudo ./step-1.sh
Your device will now reboot into recovery and perform a factory reset.
NOTE: If you are on firmware 5.6.4.0 or newer, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you don't need to run step-2.sh below:
NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"
NOTE: Make sure you re-enable ADB after Factory Reset.
4. Start the script:
Code:sudo ./step-2.sh
The exploit will now be flashed and your device will reboot into TWRP.
You can now install Magisk from there.
Going back to stock
Extract the attached zip-file "amonet-suez-v1.1-return-to-stock.zip" into the same folder where you extracted "amonet-suez-v1.1.2.zip" and open a terminal in that directory.
You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.
Just use hacked fastboot to
Code:fastboot flash recovery bin/recovery.img
If you want to go back completely (including restoring your GPT):
Code:sudo ./return-to-stock.sh
Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 5.6.3.0 or newer, otherwise you may brick your device)
Important information
In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.
Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)
Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.
TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).
For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).
It is still advised to disable OTA.
Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Special thanks also to @retyre for porting the bootrom-exploit and for testing.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Thanks also to @bibikalka and everyone who donated
Thanks to @TheRealIntence and @b1u3m3th for confirming it also works on the 64GB model.14Unbricking
If Recovery OR FireOS are still accessible there are other means of recovery, don't continue.
If your device shows one of the following symptoms:
- It doesn't show any life (screen stays dark)
- You see the white amazon logo, but cannot access Recovery or FireOS.
If you have a Type 1 brick, you may not have to open the device, if your device comes up in bootrom-mode (See Checking USB connection below).
- Make sure the device is powered off, by holding the power-button for 20+ seconds
- Start bootrom-step.sh
- Plug in USB
In all other cases you will have to open the device and partially take it apart.
Follow this guide by @retyre until (including) step 8..
At Step 6. you will replace
withCode:sudo ./bootrom.sh
Should the script stall at some point, restart it and replug the USB-cable (Shorting it again should not be necessary unless the script failed at the very beginning).Code:sudo ./bootrom-step.sh
If the script succeeded, put the device back together.
When you turn it on, it should start in hacked fastboot mode.
You can now use
This will flash TWRP and reset your device to factory defaults, then reboot into TWRP.Code:sudo ./fastboot-step.sh
Checking USB connection
In lsusb the boot-rom shows up as:
Code:Bus 002 Device 013: ID [b]0e8d:0003[/b] MediaTek Inc. MT6227 phone
If it shows up as:
instead, you are in preloader-mode, try again.Code:Bus 002 Device 014: ID [b]0e8d:2000[/b] MediaTek Inc. MT65xx Preloader
dmesg lists the correct device as:
Code:[ 6383.962057] usb 2-2: New USB device found, idVendor=[b]0e8d[/b], idProduct=[b]0003[/b], bcdDevice= 1.0011
You'll need a linux distrubution to work from, a live boot cd/usb will work fine.
Don't use WSL (Subsystem for Linux) on Windows 10 as usb support doesn't work properly, or at all, for anything other than usb storage devices.
This guide was part of a larger guide on Github, adapted from Retyre's XDA Guide.
Root on Fire HD10 2017 5.6.9.0 (not tried on other systems)
- Download the root exploit code (alternate link SHA256 8bfc3d5c75964e5fa28c8ffa39a87249ba10ea4180f55f546b2dcc286a585ea8) and Super_SU18+ (alternate link SHA256 b572c1a982d1e0baeb571d3bc0df7f6be11b14553c181c9e0bf737cc4a4fbbfd).
wget -c "http://myphone-download.wondershare.cc/mgroot/20165195.zip" "http://myphone-download.wondershare.cc/mgroot/SuperSU_18+.zip" - Unzip them both to a 20165195 directory.
unzip -u 20165195.zip -d 20165195 && unzip -u SuperSU_18+.zip -d 20165195 - Check the 20165195 directory contains all the needed files.
$ ls -1 20165195
Matrix
Superuser.apk
ddexe
debuggerd
fileWork
install-recovery.sh
krdem
mount
patch_boot.sh
pidof
push_root.sh
start_wssud.sh
su
su_arm64
supersu.zip
supolicy
toolbox
wsroot.sh - Push the directory to the tablet.
adb push 20165195 /data/local/tmp - Login to the tablet.
adb shell - Make the files executable.
chmod 755 /data/local/tmp/20165195/* - Run the exploit. You should see a lot of output while it runs.
/data/local/tmp/20165195/Matrix /data/local/tmp/20165195 2
If the script executes successfully, the final lines of output should display the memory location that was exploited (may be different than 0x7fab64c000) and a value of 0 for <Exploit> and <Done>. If it fails, check the Troubleshooting section: - exploited 0x7fab64c000=f97cff8c
end!!!!!!!
<WSRoot><Exploit>0</Exploit></WSRoot>
<WSRoot><Done>0</Done></WSRoot>
- You can verify root with su.
shell@suez:/ $ su
su
root@suez:/ # - Back on your computer, download SuperSU 2.82 SR5 apk (alternate link SHA256 2c7be9795a408d6fc74bc7286658dfe12252824867c3a2b726c1f3c78cee918b) and install it to the tablet with adb.
adb install "eu.chainfire.supersu_2.82-SR5-282_minAPI9(nodpi)_apkmirror.com.apk" - Open up the SuperSU app on the tablet, tap Get Started, then tap Continue and select Normal to update the app. Select Reboot after it is done installing to reboot the tablet.
- After the tablet reboots, open SuperSU app again, tap on Settings tab, then tap Default access, then choose Grant.
- Log in to your tablet.
adb shell - Switch to superuser and delete directories /data/data-lib/com.wondershare.DashRoot and /data/data-lib/wondershare.
su
rm -r /data/data-lib/com.wondershare.DashRoot /data/data-lib/wondershare
Once rooted, you can start the main guide on here for TWRP installation and skip past the root part.
Notes: At stage 7, running the exploit, you may find get an error instead of a successful output like above.
If you get this or similar, try rebooting your Fire HD and try again:
<WSRoot><Exploit>0x00000332</Exploit></WSRoot>
check done
sched_setaffinity: Function not implemented<WSRoot><Exploit>0x00000382</Exploit></WSRoot>
FAIL : load1 --> /sepolicy
<WSRoot><Exploit>0x00000341</Exploit></WSRoot>
<WSRoot><Exploit>0x00000881</Exploit></WSRoot>
<WSRoot><Done>0x00000172</Done></WSRoot>
I had to reboot once to get it to work. It's also worth noting that, even though it was successful the second time, i still received a function not implemented error, but it still worked. This is the part that you're looking for to be sucessful:
<WSRoot><Exploit>0</Exploit></WSRoot>
<WSRoot><Done>0</Done></WSRoot>10Changelog
Version 1.1.2 (26.03.2019)
- Fix regenerating GPT from temp GPT
Version 1.1.1 (26.03.2019)
- Fix unbricking procedure
Version 1.1 (25.03.2019)
- Update TWRP-sources to twrp-9.0 branch
- TWRP uses kernel compiled from source
- Add scripts to use handshake2.py to enter fastboot/recovery
Features.
- Uses 5.6.3 LK for full compatibility with newer kernels.
- Hacked fastboot mode lets you use all fastboot commands (flash etc).
- Boots custom/unsigned kernel-images (no patching needed)
- TWRP protects from downgrading PL/TZ/LK
- For the devs: sets printk.disable_uart=0 (enables debug-output over UART).
NOTE: Hacked fastboot can be reached via TWRP.
NOTE: Hacked fastboot doesn't remap partition names, so you can easily go back to stock
New posts
-
Question Sony Xperia 1 mark V china up rom SEA, Can use update OTA
- Latest: nhat.nguyen
