[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)

Search This thread

Rortiz2

Senior Member
I was stupid enough to upgrade Magisk in the App. The App patched my boot and since this is a special boot my tablet does not boot anymore.
It stucks at the Amazon logo. I still have access to the TWRP recovery. So what do I need to flash where that my tablet is able to boot again?

Thanks in advance for any device! :)
Flash this to the boot partition (not boot_x) with hacked fastboot or use TWRP (+ ADB) to dd it to /dev/block/platform/soc/by-name/boot_amonet
 

Attachments

  • full.img
    110 MB · Views: 40

GoodSoul

Senior Member
Oct 10, 2010
283
337
▂ ▃ ▅ ▆ █
www.google.com
Flash this to the boot partition (not boot_x) with hacked fastboot or use TWRP (+ ADB) to dd it to /dev/block/platform/soc/by-name/boot_amonet
Thanks for reply @Rortiz2!
I am able to boot to TWRP. Fastboot does not show any devices on my pc. What would be the command to do for adb sideload?

Edit: Tried to flash full.img as img on TWRP. Results in: "Size of image is larger than target device". Tried to flash image on "boot".
 
Last edited:

GoodSoul

Senior Member
Oct 10, 2010
283
337
▂ ▃ ▅ ▆ █
www.google.com
Update: Did the command via Terminal in in Recovery (dd if=image of=/dev/block/platform/soc/by-name/boot_amonet). Did not help. Still rebooting to Recovery. :-|

What else could have Masigk 24.1 touched/broken?

Update 2:
I tried to flash an image in TWRP to "boot". That might have broken something else. Any IMG I can flash here?
 
Last edited:

Rortiz2

Senior Member
Update: Did the command via Terminal in in Recovery (dd if=image of=/dev/block/platform/soc/by-name/boot_amonet). Did not help. Still rebooting to Recovery. :-|

What else could have Masigk 24.1 touched/broken?

Update 2:
I tried to flash an image in TWRP to "boot". That might have broken something else. Any IMG I can flash here?
I guess you can always clear the PL header with ADB (in TWRP) and run bootrom-step.sh. That should restore the boot/recovery exploit.
 
  • Like
Reactions: GoodSoul

jpsshield

Member
Jan 10, 2019
11
2
I have to say all the different instruction were a little confusing. Have done all of this many times over the years so I am familiar with it. One my first Fire HD 8 douglas 2017 I mistakenly unplug it from the PC and could not get it to do anything. So I threw it the garage thinking I have to rip it apart. Second one....did the same thing...dead. So I was defeated. Well guess what, I just pluged the second one back in and ran sudo ./bootrom-step-minimal.sh and held power for 5 sec, then vol up and pwr but its all black...so I tried several times to time it and boom!!!!! Back in business and it also worked for the first one. :D
 

techprobalways

New member
Mar 22, 2022
2
0
I started the process of working through the steps laid out in this post on my Amazon Fire Tablet 8. The device had newer firmware than 5.6.4.0 I attempted to brick it. I had to use brick(-9820).sh, but when I try to run bootrom-step.sh, it keeps getting hung up on "waiting for bootrom." So I basically have a bricked tablet that won't do anything at the moment. Any tips for troubleshooting?
 

techprobalways

New member
Mar 22, 2022
2
0
I am trying to read through this whole thread to try to see if someone resolved my issue. Now I am stuck on it rebooting to the Amazon logo repeatedly.
 

R2D2_SW

Senior Member
Feb 9, 2009
410
63
Google Pixel 6
Recently there was a sale on this Fire hd 8 gen 7 for $20 at Woot so I brought it so I tried to hack. It is hard to find a one with the firmware 5.6.4.0 or lower so this is how I got it to work. Honorable mention to Opec who actually got the instructions right so I modified his instructions a little to fit everything in.

A) amonet-douglas-v1.2.zip from first Page of this Thread:
https://forum.xda-developers.com/...p.4845269/
Unpack the Archive to a separate Folder.
B) brick-douglas.zip from first Page of this Thread:
https://forum.xda-developers.com/...p.4825253/
Unpack the Archive to a separate Folder.

1) Boot from a live version of linux (I used Ubuntu mate Lts 20.04) or you can install linux in your computer.
2) Run the following commands to install tools;
sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix
3) Disable modem manager
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager
4) Reboot FireHD8 to Recovery (Power Off device, then hold VolUp + Power)
5) Select Factory Reset then Wipe Cache
6) Reboot to Bootloader. You will see the black screen with "Fastboot" in the lower corner.
7) Connect your usb cable to the tablet.
8) Open Terminal from "brick-douglas" folder an enter "sudo ./brick.sh (note that you are actually bricking your fire tablet in order to recover)
9) Check Display output for the "Disconnect USB and Powerdown" Message and do so when prompted. Proceed to step 10 if there no problems, but it didn't work for me.
*** Note if you see an error and the FireHD Reboot and do the "Apps and Data Optimization" at the Welcome Install Screen Powerdown the FireHD and enter Bootloader again.
a) repeat steps 4-7
b) Enter "sudo ./brick-8920.sh" instead of brick.sh
c) You should see Display output for the "Disconnect usb and powerdown" message and do so when prompted.
10) Open Terminal from "amonet-douglas-v1.2" foder.
11) Enter "sudo ./bootrom-step.sh"
12) Reconnect USB while your tablet is off.
13) Wait until the bootrom step is finished
14) Enter "sudo ./fastboot-step.sh"
15) You will end up in TWRP
16) Prepare a microsd card with Lineage OS 15.1 or 14.1 with the rom and gapps and install Lineage OS.
https://forum.xda-developers.com/...1.4328503/
https://forum.xda-developers.com/...1.4195349/
Tried this but I'm stuck on step 9b. Now whenever I type the brick command, it says "waiting on any device" and just stays like this forever. The first time around, it ran fine with brick.sh but that script failed. Since then, I have not been able to connect to the device. Any advice?

Update: Rebooting my machine seems to have resolved the issue.
 
Last edited:
Hey, not sure what happened, but I turned my Douglas on after a few days and it was stuck in a boot loop or something. It got stuck on the LineageOS boot animation for a while and then rebooted to TWRP automatically. This happened every time.

1. I tried to clear cache, but it said
Code:
Failed to mount '/cache' (No such device)

2.
Then i tried re-flash the LineageOS ROM zip, that I already had on the internal storage and it said "Failed to mount (No such device)" for `/cache`, `/system` and `/data`.

Now I seem to have lost everything that was on the internal storage, and it cannot mount anything. It won't connect to my computer either. It says "No media storage found. Make sure device is unlocked and MTP is enabled." It seems like the data partition does not have any file system format. And am unable to create one either. It says
Code:
failed to mount and unable to recreate `/data/media`

I also tried the repair file system, but it gives me the same "Failed to mount" error.

I found an old TWRP backup that I successfully copied to the mounted SD card. But during restore using twrp, it says This /data backup was made with ext4, so i need to change it back to ext4 to ensure it boots. But it won't let me change file system using twrp

Code:
Formatting Data using mke2fs
Done.
Failed to mount '/data' (No such device)
Unable to recreate /data/media folder
Updating partition details...
Failed to mount '/system' (No such device)
Failed to mount '/cache' (No such device)
Failed to mount '/data' (No such device)
...done
Unable to mount storage

---

After talking with @Rortiz2 he said, I retried the entire unlock process all over again, but my tablet refuses to go into the Hacked Bootloader.
1. `sudo ./brick.sh` showed success
2. `sudo ./bootrom-step.sh` also seemed to work fine, it reached the last step and said Reboot.
3. But after this step, I get nothing when I do `sudo fastboot devices`. So I can't do `sudo ./fastboot.sh` to reload TWRP.

I can boot into the TWRP using the Volume and Power keys. From there I have ADB access, and I can boot into the regular Fastboot mode. But if I select reboot into "Hacked BL", it just reboots into TWRP.

If I boot into fastboot using ADB or TWRP, and try to write anything, I get an error saying cannot write on locked hw

Bash:
sudo ./fastboot-step.sh
Your device will be reset to factory defaults...
Press Enter to Continue...

Sending 'recovery_x' (13196 KB)                    OKAY [  0.471s]
Writing 'recovery_x'                               FAILED (remote: 'the command you input is restricted on locked hw')
fastboot: error: Command failed

Same error if I try to flash stock recovery.img

In TWRP, when I go to Wipe and select Advanced Wipe,

If I select System, or Cache, or data, I get the following

Code:
Mount Point: /cache, /data or /system
File system: <blank>
Present: Yes                               Removable: No
Size: 0MB                                  Used: 0MB
Free: 0MB                                  Backup Size: 0MB

And the only option I see is `Change File System`. I tried to format each partition to `EXT4`, but it keeps

Bash:
Formatting data (or cahce or System) using mke2fs...
Done.
Updating partition details...
Failed to mount '/system' (No such device)
Failed to mount '/cache' (No such device)
Failed to mount '/data' (No such device)
...done
Unable to mount storage

PS: I am using Ubuntu 22.04, unlock tool v1.2, I have been using Rortiz2's LineageOS for a couple of years now. I was on the latest update of LineageOS 15.1, I believe it was the January update.

Thanks
 

DutyThree

New member
May 25, 2022
2
2
Just managed to get LineageOS 15.1 on my HD8 Gen 7, coming from FireOS 5.7.0.0. Working really good, so much quicker than before. No Gapps, only F-droid on it and for other stuff Aurora Store, that's what I wanted.

Many thanks to all the helpful guides, especially to @k4y0z , @pug_ster and @kingladar with your step-by-step guides!

For me btw the sudo ./brick-9820.sh worked, first one failed.
 

robloxboy

New member
Jun 11, 2022
1
0
[email protected]:~/Downloads/amonet$ sudo ./step-1.sh
Testing root access...

Trying to use mtk-su to get temp root...
Pushing root files
bin/mtk-su: 1 file pushed. 6.7 MB/s (60840 bytes in 0.009s)
bin/minisu.img: 1 file pushed. 10.6 MB/s (1048576 bytes in 0.094s)
bin/busybox: 1 file pushed. 7.0 MB/s (587368 bytes in 0.081s)
Failed critical init step 3
Failed critical init step 3
Failed critical init step 3
Failed critical init step 3
Failed critical init step 3
what does this mean?
 

Johnny1805

New member
Jun 17, 2022
1
0
Hi all,

I got FW 5.7.0.0. Hence I need to intentionally brick it.
However, after typing "YES", I get no prompt on the tablet?

What am I doing wrong?
(when attempting to run step-1.sh, I actually get a message on the tablet. The procedure fails with "Failed critical init step 4. Firmware support not implemented". I guess that's because of 5.7.0.0?)
 
Last edited:

Jupp69

New member
Dec 8, 2021
3
0
Hello,
been using my HD8 for over a year with LineageOS, presently 15.1 from 13. June 2022. Worked quite well for me. Previous OTA updates (2-3) went smoothly, no problems. Update to LOS 15.1 from 14. June 2022 did not work, black screen after reboot, with recovery mode, then fastboot mode indicated at bottom of a black screen.
Reflashing did not work, error HW locked bootloader. Could not get into TWRP, either. Even opened the device to try a hardware short, found out I would have had to desolder a metal screen.
Shell scripts (brick.sh) did not work. Just before giving up I played around with fastboot commands.
This worked for me:
- switch the tab on
- screen says recovery mode, then a few seconds later fastboot mode
- connect to a linux pc with the usual fastboot & adb tools installed
- open a console
- command: fastboot reboot recovery
- tablet reboots into LineageOS 15.1 13. June version.
TWRP no longer works, cannot be accessed neither through extended reboot menu nor through any hardware button combination. So I keep using 13. June version of this rom.
Any suggestions what went wrong and how I can get back OTA or manual updates and TWRP will be much appreciated.
Regards, -Jupp69
 

Dokuss

Member
Mar 17, 2021
11
1
Hi everybody! Need yours in solving one problem. I cracked one by one 2 tablets 8 7 generation. The first one cracked and everything worked. The second gave an error and now bootrom-step.sh Ends half way.

Code:
sudo ./bootrom-step.sh
[2022-06-10 15:35:30.997561] Waiting for bootrom
[2022-06-10 15:35:38.284236] Found port = /dev/ttyACM0
[2022-06-10 15:35:38.284643] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *


[2022-06-10 15:35:40.289210] Init crypto engine
[2022-06-10 15:35:40.310312] Disable caches
[2022-06-10 15:35:40.310946] Disable bootrom range checks
[2022-06-10 15:35:40.328877] Load payload from ../brom-payload/build/payload.bin = 0x4888 bytes
[2022-06-10 15:35:40.335969] Send payload
[2022-06-10 15:35:40.941849] Let's rock
[2022-06-10 15:35:40.942919] Wait for the payload to come online...
[2022-06-10 15:35:41.872219] all good
[2022-06-10 15:35:41.873009] Check GPT
[2022-06-10 15:35:42.251272]
[2022-06-10 15:35:42.251598] Sector size (logical): 512 bytes
[2022-06-10 15:35:42.251924] Disk identifier (GUID): 92F9DCB2-1DD8-4A2A-B453-BAD8DE8919E7
[2022-06-10 15:35:42.252172] Partition table holds up to 128 entries
[2022-06-10 15:35:42.252415] This partition table begins at sector 2 and ends at sector 33
[2022-06-10 15:35:42.252625] First usable sector is 34, last usable sector is 61071326
[2022-06-10 15:35:42.252844] Other partition table is at sector 61071359
[2022-06-10 15:35:42.253058]
[2022-06-10 15:35:42.253327] Number   Start (sector)     End (sector)  Size          Name           
[2022-06-10 15:35:42.255024]     1             1024             7167  3.00 MiB      proinfo         
[2022-06-10 15:35:42.255763]     2             7168            16383  4.50 MiB      PMT             
[2022-06-10 15:35:42.256446]     3            16384            17407  512.00 KiB    lk             
[2022-06-10 15:35:42.257129]     4            17408            18431  512.00 KiB    lk2             
[2022-06-10 15:35:42.257810]     5            18432            51199  16.00 MiB     boot_x         
[2022-06-10 15:35:42.258544]     6            51200            86015  17.00 MiB     recovery_x     
[2022-06-10 15:35:42.259233]     7            86016            96255  5.00 MiB      tee1           
[2022-06-10 15:35:42.259898]     8            96256           106495  5.00 MiB      tee2           
[2022-06-10 15:35:42.260576]     9           106496           187391  39.50 MiB     metadata       
[2022-06-10 15:35:42.261315]    10           187392           189439  1024.00 KiB   kb             
[2022-06-10 15:35:42.262299]    11           189440           191487  1024.00 KiB   dkb             
[2022-06-10 15:35:42.262975]    12           191488           192511  512.00 KiB    MISC           
[2022-06-10 15:35:42.263654]    13           192512           208895  8.00 MiB      reserved       
[2022-06-10 15:35:42.264324]    14           208896          3515391  1.58 GiB      system         
[2022-06-10 15:35:42.265023]    15          3515392          4383743  424.00 MiB    cache           
[2022-06-10 15:35:42.265691]    16          4383744         60619775  26.82 GiB     userdata       
[2022-06-10 15:35:42.266521]    17         60619776         60845055  110.00 MiB    boot           
[2022-06-10 15:35:42.267247]    18         60845056         61070335  110.00 MiB    recovery       
[2022-06-10 15:35:42.302514]
[2022-06-10 15:35:42.302856] Check boot0
[2022-06-10 15:35:42.544185] Check rpmb

rpmb looks broken; if this is expected (i.e. you're retrying the exploit) press enter, otherwise terminate with Ctrl+C


[2022-06-10 15:35:50.766945] Clear preloader header
[8 / 8]
[2022-06-10 15:35:51.184654] Downgrade rpmb
[2022-06-10 15:35:51.186665] Recheck rpmb
[2022-06-10 15:35:52.081217] rpmb downgrade ok
[2022-06-10 15:35:52.081835] Flash preloader
[272 / 272]
[272 / 272]
[2022-06-10 15:36:04.306882] Flash tz
[6459 / 6459]
[2022-06-10 15:38:23.222346] Flash lk
[950 / 950]
[2022-06-10 15:38:43.918867] Inject payload
Traceback (most recent call last):
  File "/home/dokuss/Desktop/Amazon Fire/Fire HD 8 7Gen (Douglas)/amonet-douglas-v1 (1).2/amonet/modules/main.py", line 256, in <module>
    main()
  File "/home/dokuss/Desktop/Amazon Fire/Fire HD 8 7Gen (Douglas)/amonet-douglas-v1 (1).2/amonet/modules/main.py", line 230, in main
    flash_binary(dev, "../bin/boot.hdr", gpt["boot"][0], gpt["boot"][1] * 0x200)
  File "/home/dokuss/Desktop/Amazon Fire/Fire HD 8 7Gen (Douglas)/amonet-douglas-v1 (1).2/amonet/modules/main.py", line 58, in flash_binary
    flash_data(dev, data, start_block, max_size=0)
  File "/home/dokuss/Desktop/Amazon Fire/Fire HD 8 7Gen (Douglas)/amonet-douglas-v1 (1).2/amonet/modules/main.py", line 47, in flash_data
    dev.emmc_write(start_block + x, data[x * 0x200:(x + 1) * 0x200])
  File "/home/dokuss/Desktop/Amazon Fire/Fire HD 8 7Gen (Douglas)/amonet-douglas-v1 (1).2/amonet/modules/common.py", line 215, in emmc_write
    raise RuntimeError("device failure")
RuntimeError: device failure
 

cellist

Member
Dec 22, 2013
20
5
Hi all,

I got FW 5.7.0.0. Hence I need to intentionally brick it.
However, after typing "YES", I get no prompt on the tablet?

What am I doing wrong?
(when attempting to run step-1.sh, I actually get a message on the tablet. The procedure fails with "Failed critical init step 4. Firmware support not implemented". I guess that's because of 5.7.0.0?)
I faced the same situation yesterday (yes, it is because of 5.7.0.0) and I was able to put twrp on it, and then LineageOS from there by using the steps described here (under "Root the tablet" until step 8. - confirming root) Then I could go on with "sudo ./step-1.sh", and continue along the temporary-bricking-route. It worked like a charm for me!

So I can also confirm the process described in pascal009's post from here (many thanks!)
 
Last edited:

doctorbconway

New member
Aug 31, 2012
2
0
I have a tablet stuck in a bricked state after brick-9820.sh. Below is the output. I get a similar "bad gpt" error from the gpt-fix-16g.sh script and trying to run the bootrom-step.sh using the hardware method (but it's hard to tell if I did that correctly). I had another Kindle HD 8 Douglas that I did at the same time that is working perfectly with Lineage OS on it now. Any thoughts?

Code:
/amonet-douglas-v1.2/amonet# ./bootrom-step.sh
[2022-07-20 15:23:00.969209] Waiting for bootrom
[2022-07-20 15:23:07.020511] Found port = /dev/ttyACM0
[2022-07-20 15:23:07.021285] Handshake

* * * If you have a short attached, remove it now * * *
* * * Press Enter to continue * * *


[2022-07-20 15:23:10.029187] Init crypto engine
[2022-07-20 15:23:10.042805] Disable caches
[2022-07-20 15:23:10.043337] Disable bootrom range checks
[2022-07-20 15:23:10.055313] Load payload from ../brom-payload/build/payload.bin = 0x4888 bytes
[2022-07-20 15:23:10.057206] Send payload
[2022-07-20 15:23:10.569326] Let's rock
[2022-07-20 15:23:10.569944] Wait for the payload to come online...
[2022-07-20 15:23:11.499520] all good
[2022-07-20 15:23:11.500163] Check GPT
[2022-07-20 15:23:11.878282]
[2022-07-20 15:23:11.878596] Sector size (logical): 512 bytes
[2022-07-20 15:23:11.878842] Disk identifier (GUID): 6679D4EB-2287-4373-B34B-34015A123D2A
[2022-07-20 15:23:11.879042] Partition table holds up to 128 entries
[2022-07-20 15:23:11.879238] This partition table begins at sector 2 and ends at sector 33
[2022-07-20 15:23:11.879411] First usable sector is 34, last usable sector is 30777310
[2022-07-20 15:23:11.879572] Other partition table is at sector 30777343
[2022-07-20 15:23:11.879728]
[2022-07-20 15:23:11.879994] Number   Start (sector)     End (sector)  Size          Name
[2022-07-20 15:23:11.881657]     1             1024             7167  3.00 MiB      proinfo
[2022-07-20 15:23:11.882356]     2             7168            16383  4.50 MiB      PMT
[2022-07-20 15:23:11.883015]     3            16384            17407  512.00 KiB    lk
[2022-07-20 15:23:11.883636]     4            17408            18431  512.00 KiB    lk2
[2022-07-20 15:23:11.884227]     5            18432            51199  16.00 MiB     boot
[2022-07-20 15:23:11.884840]     6            51200            86015  17.00 MiB     recovery
[2022-07-20 15:23:11.885439]     7            86016            96255  5.00 MiB      tee1
[2022-07-20 15:23:11.886049]     8            96256           106495  5.00 MiB      tee2
[2022-07-20 15:23:11.886946]     9           106496           187391  39.50 MiB     metadata
[2022-07-20 15:23:11.887585]    10           187392           189439  1024.00 KiB   kb
[2022-07-20 15:23:11.888171]    11           189440           191487  1024.00 KiB   dkb
[2022-07-20 15:23:11.888742]    12           191488           192511  512.00 KiB    MISC
[2022-07-20 15:23:11.889305]    13           192512           208895  8.00 MiB      reserved
[2022-07-20 15:23:11.890020]    14           208896          3515391  1.58 GiB      system
[2022-07-20 15:23:11.890631]    15          3515392          4383743  424.00 MiB    cache
[2022-07-20 15:23:11.891213]    16          4383744         30777310  12.59 GiB     userdata
[2022-07-20 15:23:11.926262]
[2022-07-20 15:23:11.926609] Modify GPT
[2022-07-20 15:23:11.927203] Validate GPT
[2022-07-20 15:23:11.927925]
[2022-07-20 15:23:11.928115] Sector size (logical): 512 bytes
[2022-07-20 15:23:11.928303] Disk identifier (GUID): 6679D4EB-2287-4373-B34B-34015A123D2A
[2022-07-20 15:23:11.928454] Partition table holds up to 128 entries
[2022-07-20 15:23:11.928570] This partition table begins at sector 2 and ends at sector 33
[2022-07-20 15:23:11.928683] First usable sector is 34, last usable sector is 30777310
[2022-07-20 15:23:11.928797] Other partition table is at sector 30777343
[2022-07-20 15:23:11.928897]
[2022-07-20 15:23:11.929079] Number   Start (sector)     End (sector)  Size          Name
[2022-07-20 15:23:11.929612]     1             1024             7167  3.00 MiB      proinfo
[2022-07-20 15:23:11.930073]     2             7168            16383  4.50 MiB      PMT
[2022-07-20 15:23:11.930514]     3            16384            17407  512.00 KiB    lk
[2022-07-20 15:23:11.930947]     4            17408            18431  512.00 KiB    lk2
[2022-07-20 15:23:11.931372]     5            18432            51199  16.00 MiB     boot_x
[2022-07-20 15:23:11.931793]     6            51200            86015  17.00 MiB     recovery_x
[2022-07-20 15:23:11.932215]     7            86016            96255  5.00 MiB      tee1
[2022-07-20 15:23:11.932647]     8            96256           106495  5.00 MiB      tee2
[2022-07-20 15:23:11.933075]     9           106496           187391  39.50 MiB     metadata
[2022-07-20 15:23:11.933540]    10           187392           189439  1024.00 KiB   kb
[2022-07-20 15:23:11.934017]    11           189440           191487  1024.00 KiB   dkb
[2022-07-20 15:23:11.934417]    12           191488           192511  512.00 KiB    MISC
[2022-07-20 15:23:11.934794]    13           192512           208895  8.00 MiB      reserved
[2022-07-20 15:23:11.935461]    14           208896          3515391  1.58 GiB      system
[2022-07-20 15:23:11.935870]    15          3515392          4383743  424.00 MiB    cache
[2022-07-20 15:23:11.936257]    16          4383744         30325759  12.37 GiB     userdata
[2022-07-20 15:23:11.936639]    17         30325760         30551039  110.00 MiB    boot
[2022-07-20 15:23:11.937018]    18         30551040         30776319  110.00 MiB    recovery
[2022-07-20 15:23:11.955031]
[2022-07-20 15:23:11.955188] Flash new primary GPT
[34 / 34]
[2022-07-20 15:23:12.680429] Flash new backup GPT
[33 / 33]
[2022-07-20 15:23:13.521322]
[2022-07-20 15:23:13.521450] Sector size (logical): 512 bytes
[2022-07-20 15:23:13.521761] Disk identifier (GUID): 6679D4EB-2287-4373-B34B-34015A123D2A
[2022-07-20 15:23:13.521989] Partition table holds up to 128 entries
[2022-07-20 15:23:13.522184] This partition table begins at sector 2 and ends at sector 33
[2022-07-20 15:23:13.522368] First usable sector is 34, last usable sector is 30777310
[2022-07-20 15:23:13.522562] Other partition table is at sector 30777343
[2022-07-20 15:23:13.522778]
[2022-07-20 15:23:13.523014] Number   Start (sector)     End (sector)  Size          Name
[2022-07-20 15:23:13.523629]     1             1024             7167  3.00 MiB      proinfo
[2022-07-20 15:23:13.524264]     2             7168            16383  4.50 MiB      PMT
[2022-07-20 15:23:13.524874]     3            16384            17407  512.00 KiB    lk
[2022-07-20 15:23:13.525477]     4            17408            18431  512.00 KiB    lk2
[2022-07-20 15:23:13.526434]     5            18432            51199  16.00 MiB     boot
[2022-07-20 15:23:13.527198]     6            51200            86015  17.00 MiB     recovery
[2022-07-20 15:23:13.527873]     7            86016            96255  5.00 MiB      tee1
[2022-07-20 15:23:13.528599]     8            96256           106495  5.00 MiB      tee2
[2022-07-20 15:23:13.529466]     9           106496           187391  39.50 MiB     metadata
[2022-07-20 15:23:13.530426]    10           187392           189439  1024.00 KiB   kb
[2022-07-20 15:23:13.531382]    11           189440           191487  1024.00 KiB   dkb
[2022-07-20 15:23:13.532049]    12           191488           192511  512.00 KiB    MISC
[2022-07-20 15:23:13.532668]    13           192512           208895  8.00 MiB      reserved
[2022-07-20 15:23:13.533275]    14           208896          3515391  1.58 GiB      system
[2022-07-20 15:23:13.533921]    15          3515392          4383743  424.00 MiB    cache
[2022-07-20 15:23:13.534528]    16          4383744         30777310  12.59 GiB     userdata
[2022-07-20 15:23:13.571483]
Traceback (most recent call last):
  File "/amonet-douglas-v1.2/amonet/modules/main.py", line 256, in <module>
    main()
  File "/amonet-douglas-v1.2/amonet/modules/main.py", line 177, in main
    raise RuntimeError("bad gpt")
RuntimeError: bad gpt
 

Top Liked Posts

  • There are no posts matching your filters.
  • 58
    Read this whole guide before starting.

    This is for the 7th gen Fire HD8 (douglas).

    Current version: amonet-douglas-v1.2.zip


    NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.


    NOTE: This process will modify the partition-table (GPT) of your device.



    NOTE: Your device will be reset to factory defaults (including internal storage) during this process.


    What you need:
    • A Linux installation or live-system
    • A micro-USB cable

    Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:
    Code:
    sudo apt update
    sudo add-apt-repository universe
    sudo apt install python3 python3-serial adb fastboot dos2unix

    1. Extract the attached zip-file "amonet-douglas-v1.1.zip" and open a terminal in that directory.


    NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder


    2. Enable ADB in Developer Settings

    3. Start the script:
    Code:
    sudo ./step-1.sh

    Your device will now reboot into recovery and perform a factory reset.

    NOTE: If you are on a firmware newer than 5.6.4.0, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
    If you chose the brick option, you don't need to run step-2.sh below:



    Make sure ModemManager is disabled or uninstalled:
    Code:
    sudo systemctl stop ModemManager
    sudo systemctl disable ModemManager


    WARNING: Do not use bootrom-step-minimal.sh if you bricked using brick(-9820).sh!
    You will need to use bootrom-step.sh.


    After you have confirmed the bricking by typing "YES", you will need disconnect the device and run
    Code:
    sudo ./bootrom-step-minimal.sh
    Then plug the device back in.

    It will then boot into "hacked fastboot" mode.
    Then run
    Code:
    sudo ./fastboot-step.sh



    NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"
    NOTE: Make sure you re-enable ADB after Factory Reset.



    4. Start the script:
    Code:
    sudo ./step-2.sh

    The exploit will now be flashed and your device will reboot into TWRP.

    You can now install Magisk from there.


    Going back to stock
    Extract the attached zip-file "amonet-douglas-return-to-stock.zip" into the same folder where you extracted "amonet-douglas-v1.0.zip" and open a terminal in that directory.
    You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.
    Just use hacked fastboot to
    Code:
    sudo fastboot flash recovery bin/recovery.img

    If you want to go back completely (including restoring your GPT):
    Code:
    sudo ./return-to-stock.sh

    Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 5.6.4.0 or newer, otherwise you may brick your device)

    Important information

    In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
    TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

    Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

    Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

    TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

    For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

    It is still advised to disable OTA.


    Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
    Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
    Thanks to @t0x1cSH and @breakfastofsecrets for testing.
    18
    Yesterday i managed to root updated FireOS and install Lineage 12.1, so, here's my story :D

    Version 5.6.6.0 build 654620620,
    on Linux KDE Neon.

    1. Installed python3, PySerial, adb, fastboot dos2unix as described in this and other posts.
      Code:
      sudo apt update
      sudo add-apt-repository universe
      sudo apt install python3 python3-serial adb fastboot dos2unix
    2. Downloaded the following attachments from the first post : amonet-douglas-v1.2.zip and brick-douglas.zip
    3. Extract both files to the same folder
    4. Enable Developer options and enable ADB (inside debugging options) on Amazon tablet
    5. Plug in the tablet (has to be turned on)
    6. Now comes the commands execution part. So, open the terminal in Linux (lines that start with // are comments and should not be run from command line - if you copy paste)

      Code:
      sudo systemctl stop ModemManager && sudo systemctl disable ModemManager
      Code:
      adb devices
      // there should be an item listed
      // to be sure, you can unplug and run it again, if it's empty, 
      // ou know tablet can connect, so plug in the tablet back
      Code:
      adb reboot bootloader
      // reboots the tablet and awaits commands
      Code:
      sudo ./brick.sh
      // type YES, hit enter
      // it will take a couple of minutes (around 3-5min in my case)
      // watch the tablet for success message, it should be displayed there if everything works
      // but also, watch your terminal...if it gives you error message similiar to:
      // ==> [I][U]failed with error message that it can't write somewhere[/U][/I]
      // you have to try with brick-9820 script
      Code:
      sudo ./brick-9820.sh
      // it will take a couple of minutes, similar to above step

      NOTE : after either of the above commands (which one succeeds) POWER OFF THE TABLET and DO NOT try to turn it back on. It should stay powered off!!

      Code:
      sudo ./bootrom-step.sh
      // this will take some time (in my case around 5-10 minutes)
      // will give you message similar to "awaiting device connection" and nothing else...
      // although nothing seems to happen, just wait a bit and watch the terminal, it will soon start displaying the process
      // it should then reboot the tablet, but in my case, that did not happen, so i had to do it manually...
      // NOTE that althought tablet seems to be "off", it isn't, so press power btn and hold for 5 sec to turn it off
      // after that click and hold volume up button (when in portrait mode it is the right one, the one closest to power btn)
      // and immediately after that press and hold the power btn until amazon logo shows itself
      // it should then show in bottom left corner HACKED FASTBOOT after a few seconds

      Code:
      sudo fastboot devices
      // there should be a device listed
      // if not, you should run (in the extracted directory that you are in):
      ./bin/fastboot devices
      // if sudo fastboot devices does not show your device but ./bin/fastboot works, you have to edit the fastboot-step.sh file and change the fastboot commands to ./bin/fastboot
      Code:
      sudo ./fastboot-step.sh
      // takes a couple of minutes (1-3 min in my case)
      // reboots the device

    after that you should be in TWRP :)

    NOTE when in TWRP:

    DO NOT RESTART tablet before the following
    (or amazon fire os will overwrite TWRP and you will be reset to factory default with fireOS, losing everything you've done and starting from scratch...
    when it happened to me, the brick-9820.sh didn't work anymore and had to use brick.sh script)

    -allow modifications
    -format data,system,cache partitions, go to wipe->advanced wipe-> repair/format (something like that), select each of the 3 partitions aformentioned and format to ext4
    -if you've done it correctly, there should not be any red warnings
    -after that go to wipe, select all partitions and wipe them (just to be sure)

    -tablet should be connected and TWRP should be left on

    on PC
    -download Lineage 12.1 ROM from https://forum.xda-developers.com/hd8-hd10/general/discussion-root-progress-fire-hd-8-t3743024
    -download opengapps from https://opengapps.org/
    - put them inside amonet-douglas-v1.2 folder where you've extracted the prior ZIP files (just to be clear, you can put them anywhere, but i like to keep it all inside the working directory)

    -go to terminal
    Code:
    adb push lineage-12.1-20200614-UNOFFICIAL-douglas.zip /sdcard
    adb push open_gapps-arm64-5.1-nano-20200624.zip /sdcard

    now the files are on the tablet
    - in TWRP go to INSTALL, go to /sdcard folder if not in it
    - first install Lineage ROM from zip
    - then install GApps from zip

    hope it works!
    I'm glad i've finally rooted it, thank you all for the great content here! :)
    12
    Wire root process

    after updating my tablet to the latest version Fire OS 5.6.4.0 (build 636559820) which does not have SW root I have decided to open up the unit and use hardware method which works on all versions of firmware

    What you will need

    1. wire
    2. plastic tool as in the picture below to open the unit.
    3. linux machine, I used Raspberry Pi 3+ and Raspbian.
    MVIMG_20190920_171046.jpg


    Process:

    1. remove SD card from the fire HD to avoid breaking it during the opening process ( yes it happened to me, luckily just 16GB card )
    2. use plastic tool to detach display from plastic rear chassis. It is very easy and safe process.
    MVIMG_20190920_171059.jpg

    3. Remove 4 screws from the motherboard.
    4. detach digitizer ( yellow ) cable and rear camera using plastic tool.
    MVIMG_20190920_171327.jpg

    5. You can leave display flex cable, battery and speaker ( soldered ) connected.
    6. turn montherboard on the other side so it lays on the battery. There is a small adhesive pad on the left side of PCA, use plastic tool to start lifting the board from that side.

    MVIMG_20190920_171508.jpg

    MVIMG_20190920_171533.jpg


    7. find pad TP28 and prepare you Linux PC now

    8. DOwnload amonet-douglas-v1.1.zip from OP of the thread , extract.
    9. run, it will take a while to update your linux distribution to the latest version.
    Code:
     sudo apt update
           sudo add-apt-repository universe
           sudo apt install python3 python3-serial adb fastboot dos2unix
    10. Get your self into the Amonet folder ( most licely Downloads/Amonet ) folder where you extracted ZIP from OP.
    11. run
    Code:
     sudo ./bootrom-step.sh
    12. you should see this msg on the screen
    Code:
    [2019-02-07 14:35:59.478924] Waiting for bootrom

    13 Now here is the tricky part which will require some practice. You have to short TP28 with grond ( the big pad neer TP28 ) and while doing it connect USB cable to the PC. Here is how I did it.
    IMG_20190920_171622.jpg

    IMG_20190920_171659.jpg

    14. So I was holding the wire in the left hand and used right hand to plug slowly USB cable into the montherboard. ( not easy I know, but you will get there )
    15. If you did it right you will see a message on the screen to Release the short wire and hit ENTER.
    16. wait till the scripts does its think and when you see this you are in fasboot. Look at the scrren, you should see AMAZON logo and small text on the bottom "fastboot xyz etc..." Don1t unplug table, keep going.
    Code:
    [2019-02-07 12:11:05.621357] Reboot to unlocked fastboot.
    17. run this script
    Code:
    sudo ./fastboot-step.sh
    18. Your unit should boot into TWRP
    19. Assemble back the unit so digitizer will work.
    20 boot into TWRP and install Lieage, GAPPS and Magisk. Install Lineage ZIP file from here. https://forum.xda-developers.com/hd8-hd10/orig-development/rom-lineage-12-1-t3953677
    7
    I was definitely on 9920 (exactly:FireOS 5.6.4.0 (636559920)). Was thinking I was stuck without an unlock method. I did the brick.sh script, then (and here's where my "some problems" comes in - my own error) without paying attention ran the wrong script as the next step after intentionally bricking my tablet. I don't know what state my table was in after doing that, but it wasn't booting into FireOS and I didn't have TWRP. So, not knowing what else to do, I tried flashing the latest official FireOS from the site I linked above. When I rebooted after doing that, I had a working FireOS and going into settings showed me on FireOS 5.6.4.0 (636558520).

    At this point, since I was on a TWRP-able OS, I just started over with step-1.sh and step-2.sh and was able to get where I ultimately wanted to be. I'm running SlimLP. Thanks to everyone who has worked through how to make this happen.

    Thank you sir! I thought 9920 was beyond saving so I did not bother. But after reading your post I decided to give it a try and the process was actually easier than I thought!

    Here's exactly what I did

    1. Code:
      adb reboot bootloader
      to put into fastboot
    2. Run
      Code:
      brick-9820.sh
      (yes, 9820. I tried brick.sh and it didn't work). In this step I actually got an error message on my computer, but it's OK as long as the DEVICE itself tells you to power off on the tablet screen. Power off and unplug the cable.
    3. Run
      Code:
      bootrom-step.sh
      , NOT the minimal one. Plug in the cable again. It'll reboot at the end but your screen would stay blank.
    4. Run
      Code:
      fastboot-step.sh
      , that's it I'm in TWRP !

    As a side note other than the brick step I actually ran the rest (1, 3 and 4) on a Mac (since I already got adb on it and did not want to setup the whole Android SDK on my Linux box again). The brick step I guess you have to be on Linux since the hacked fastboot only came as ELF in the zip. To run bootrom-step on Mac, simply comment out the modemanager check in main.py.
    7
    @willgaj did you enter bootloader mode on the Fire ? Powerdown and then Press VolUp + Power, wait until you see "Enter Recovery" , then select "Bootloader".

    Heres how it worked out for me:

    Files I used:

    amonet-douglas-v1.2.zip from first Page of this Thread:
    https://forum.xda-developers.com/attachments/amonet-douglas-v1-2-zip.4845269/
    Unpack the Archive to a separate Folder.

    brick-douglas.zip from first Page of this Thread:
    https://forum.xda-developers.com/attachments/brick-douglas-zip.4825253/
    Unpack the Archive to a separate Folder.


    MTK-su (i used te 64 bit) from here:
    https://forum.xda-developers.com/t/rapid-temporary-root-for-hd-8-hd-10.3904595/
    Unpack and copy to the MTK-su from the 64 Bit folder to the “bin” folders of the previous unpacked folders.


    Unlock steps:

    1. Reboot FireHD8 to Recovery (Power Off device, then hold VolUp + Power)

    2. Select Facotry Reset then Wipe Cache

    3. Reboot to Bootloader

    4. You will see the balck screen with “Fastboot” in the lower corner.

    5. Open Terminal from “brick-douglas” folder an enter “sudo ./brick.sh
    6. Check Display output for the “Disconnect USB and Powerdown” Message and do so when prompted
      (If theres an Error see below Step 12)

    7. Open Terminal from “amonet-douglas-v1.2” foder.

    8. Enter “sudo ./bootrom-step.sh"

    9. Reconnet USB

    10. Wait until the bootrom step is finished

    11. Enter “sudo ./fastboot-step.sh”

    12. You will end up in TWRP

    If theres an error let the FireHD Reboot and do the “Apps and Data Optimization” at the Welcome Install Screen Powerdown the FireHD and enter Bootloader again.
    • Open Terminal from “brick-douglas” folder
    • Enter “sudo ./brick-8920.sh”
    • Check Display output for the “Disconnect usb and powerdown” message and do so when prompted.
    • Enter “sudo ./bootrom-step.sh
    • Reconnet USB
    • Wait until the bootrom step is finished.
    • Enter “sudo ./fastboot-step.sh"
    • You will end up in TWRP


    Lineage OS installation:

    Prepare a Micro SD Card with: Lineage OS (Search the forum for the douglas (FireHD 8 7.Gen) or suez (FireHD 10 7Gen) Version, Gapps (ARM64, 7.1, nano) and Magisk and insert in FireHD.

    In TWRP Format Data and Wipe data, system, cache.

    Install Rom, gapps and magisk

    Reboot to Lineage OS



    Hardware Method:

    If you got stuck somewhere in the middle or the Exploit doesn’t work try the hardware method.

    I somehow bricked my HD10 , I think I disconnected the USB because I was to unpatient.

    For the Hardware method, you need to open the Tablet, use a prytool or a Creditcars / Knife to remove the backcover, just gently pry around the bezel until the screen pops out.

    You need to unscrew the mainboard and gently flip it over , on the HD10 I didn’t had to remove any wire , just be carefull with the speakers and put a piece of cardboard or plastic on the back between the mainboard and battery so it will not shorten or puncture the battery.

    Find the CLK pin (theres several pictures on the forum for your specific device) use a piece of wire or paperclip to shorten from a ground plane or the SD Card slot housing to the clock pin. This works best if you got someone that will help you.

    • Connect USB to the Tablet, but leave it unplugged on the Computer side.
    • Make sure the Tablet is powered down (Press and hold Power button for 30 seconds)
    • Open Terminal from “amonet-douglas-v1.2” foder.
    • Enter “sudo ./bootrom-step.sh”
    • Now shorten CLK to ground and hold it.
    • Ask a kind person to plug in the USB cable on the Computer now.
    • The Terminal will tell you to remove the wire when ready.
    • Press enter and wait for bootrom-step.sh to finish.
    • If an error during bootrom step occurs , just retry
    • After bootrom step is finished, enter “sudo ./fastboot-step.sh”
    • You will end up in TWRP

    PS: I directly installed LOS 14.1 on the HD8 , on the HD10 i i used LOS 12.1 because LOS 14.1 is missing Camera Support on the HD10 in fact loosing the camera shouldnt trouble too much as the picture quality is horrible anyways. As for now I am happy to have a running Android on the tabs and don´t need to worry amazon giving me headaches every few weeks when updating CrapOS and redndering my configuration unuseable , i got 14 HD8/10 deloyed around the house as input devices for Homeautomation (running Habpannel).

    One thing to mention when switching to LOS, is that you can´t use apps that need to be certified anymore, like Netflix, Banking etc.

    Good luck!

    PPS: Thanks a lot to k4y0z and his fellas for the great job!


    opec