[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)

[Sus_i]

No Error on boot-fastboot.sh, readout:

~/amonet $ sudo ./boot-fastboot.sh
[2022-10-12 20:48:29.254243] Waiting for preloader
[2022-10-12 20:48:55.459661] Found port = /dev/ttyACM0
[2022-10-12 20:48:55.496008] Handshake
[2022-10-12 20:48:55.516266] Preloader ready, sending FACTFACT

Looks good, check:
fastboot devices
if there is a device connected.

 

[spikked27]

Looks good, check:
fastboot devices
if there is a device connected.

Yep my device is listed and I was able to flash twrp but the tablet just hangs at the amazon logo when trying to boot into recovery

 

[Sus_i]

Yep my device is listed and I was able to flash twrp but the tablet just hangs at the amazon logo when trying to boot into recovery

How did you flash it and on which partition?

Try it like this:

fastboot flash recovery_x twrp.img
fastboot erase userdata
fastboot flash MISC boot-recovery.bin
fastboot reboot

In case you get still a bootloop at the logo, try again with:

fastboot flash recovery_x twrp.img
fastboot format userdata
fastboot flash MISC boot-recovery.bin
fastboot reboot

Grab the images out of the amonet.zip from bin folder.

 

[mobaddict]

I used the brick 9820 and do as told to remove the connection and power off. But upon doing the bootrom-step.sh and reconnecting, nothing happens and it looks like the tablet is in permanent brick. Any ideas on how to fix this?

 

[Sus_i]

I used the brick 9820 and do as told to remove the connection and power off. But upon doing the bootrom-step.sh and reconnecting, nothing happens and it looks like the tablet is in permanent brick. Any ideas on how to fix this?

Check lsusb while connected, if you can see something like mtk phone, preloader or fire device

 

[mobaddict]

Check lsusb while connected, if you can see something like mtk phone, preloader or fire device

Weird, I guess it needed to rest because I tried it again and it was now successful. Maybe just issue in the wired connection. Thanks for replying.

 

[kvjajoo]

Hi All,

I am running Fireos 5.7.0.0 on my 2017 Fire HD 8 (7 Gen). But when i run step-1.sh i get below error. I am using Ubuntu Desktop 22.04 running over VirtualBox 7.

[email protected]:~/Downloads/amonet$ sudo ./step-1.sh
Testing root access...

Trying to use mtk-su to get temp root...
Pushing root files
bin/mtk-su: 1 file pushed. 0.6 MB/s (65144 bytes in 0.099s)
bin/minisu.img: 1 file pushed. 0.7 MB/s (1048576 bytes in 1.344s)
bin/busybox: 1 file pushed. 0.7 MB/s (587368 bytes in 0.763s)
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
Failed critical init step 4
Firmware support not implemented
^C
[email protected]:~/Downloads/amonet$ adb devices
List of devices attached
G090ME0672570NKW    device

Any ideas on what's happening ??

 

[jonpjingleheimler]

Hi. Is there by any chance a adb command that can boot into hacked bootloader? I found a newer version of twrp and flashed the image to recovery in the original twrp. the new twrp does nothing and does not have a reboot to hacked bootloader option. I'm on Lineage 17 and it boots properly. I can boot to regular fastboot also but that seems rather pointless. any advice would be welcome. If the wifi allowed me to connect to more than a hotspot I'd simply stay on the os im stuck on now

 

[jonpjingleheimler]

Hi. Is there by any chance a adb command that can boot into hacked bootloader? I found a newer version of twrp and flashed the image to recovery in the original twrp. the new twrp does nothing and does not have a reboot to hacked bootloader option. I'm on Lineage 17 and it boots properly. I can boot to regular fastboot also but that seems rather pointless. any advice would be welcome. If the wifi allowed me to connect to more than a hotspot I'd simply stay on the os im stuck on now

Post in thread '[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)' https://forum.xda-developers.com/t/...-fire-hd-8-2017-douglas.3962846/post-80287339

This worked for me.

 

[j10hx40r]

@k4y0z, @Rortiz2, @xyz` I am trying to port this to Echo dot 2nd Gen (mt8163) and can use some help. I have no experience of reverse engineering or binary exploitation. Still I was able to figure some things out.​

For the preloader and LK included in https://d1s31zyz7dcc2d.cloudfront.n...it_puffin-NS6555_user_4310M_0008087721594.bin, I tried reverse engineering the same and was able to patch them to boot into an unlocked device when booting from USB. I have figured out some of the addresses needed for lk-payload and microloader as follows

get_device - 0x4bd190ec
cache_clean - 0x4bd1eac0
fastboot app - 0x4bd21158

I am struggling to create the ROP chain used in inject_microloader.py. Could you guys please help me out with this

PS: I have enabled full root adb access on this device with dm-verity disabled using fos_flags (0xA3) and have also disabled selinux using dev_flags (0x40) so I can easily test any changes on the device.

 

[[email protected]]

Thank you so much for your flashing method. None of the others which I tried got as far as running any scripts to transfer files!

The only time I was confused was when I ran your "sudo ./fastboot-step.sh
// takes a couple of minutes (1-3 min in my case)
// reboots the device"

I got a conflicting message on my Fire screen which told me to disconnect and reboot. I ignored it and got TWRP. The Lineage file I found no problem and downloaded. But the GAPPS file was more difficult. It wasn't until I read the actual filename to be installed that I googled it and downloaded it. Even then I could only find a previous version (3 months, that is) which installed successfully. Google Play services has just updated and all seems tickety-boo. Thank you so much again.

 

[CuF]

Did you go here and select the pico, arm64, 8.1 for LineageOS 15.1 and 10 for LineageOS 17.1?

The Open GApps Project

OpenGApps.org offers information and pre-built packages of The Open GApps Project. The Open GApps Project is an open-source effort to script the automatic generation of up-to-date Google Apps packages. All Android versions and platforms supported.

opengapps.org

 

[chaosl0rd]

Hi Guys,
first of all thanks for all the hard work.

Im trying to unlock my douglas Tablet with Firmware 5.7.0.0.
And i cant get it to work , i always get the following error:


<WSRoot><InitResource>0</InitResource></WSRoot>
Decrypt Success: /data/local/tmp/fileWork
Output File Name: /data/local/tmp/fileWork.
<WSRoot><Decrypt>0</Decrypt></WSRoot>
extracting: /data/local/tmp/Bridge_wsroot.sh
extracting: /data/local/tmp/krdirtyCow32
extracting: /data/local/tmp/krdirtyCow64
extracting: /data/local/tmp/libsupol.so
extracting: /data/local/tmp/my.sh
extracting: /data/local/tmp/mysupolicy
extracting: /data/local/tmp/patch_script.sh
extracting: /data/local/tmp/root3
<WSRoot><Decompression>0</Decompression></WSRoot>
execute string: /data/local/tmp/root3 /data/local/tmp/ 2
WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6ffffffe arg 0x600
WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6fffffff arg 0x1
ro.build.version.sdk :22
ro.product.cpu.abi :arm64-v8a
is x64
execute string: /data/local/tmp/krdirtyCow64 /data/local/tmp/ 2
WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6ffffffe arg 0xd30
WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6fffffff arg 0x1
path : /data/local/tmp/
path : /data/local/tmp
[*] path_script:/data/local/tmp/patch_script.sh /data/local/tmp
rm: /data/local/tmp/sepolicy: No such file or directory
rm: /data/local/tmp/load: No such file or directory
supolicy v2.76 (ndk:armeabi) - Copyright (C) 2014-2016 - Chainfire

Patching policy [/data/local/tmp/sepolicy] --> [/data/local/tmp/load] ...
-permissive:zygote=ok
-permissive:kernel=ok
-permissive:init=ok
-permissive:su=ok
-permissive:init_shell=ok
-permissive:shell=ok
-permissive:servicemanager=ok
- Success

find_opcode offset:2d0 opcode:aaffbbee
find ok star:7fb214a008 end:7fb214a2d8 size:2d0
sh : /data/local/tmp/my.sh /data/local/tmp 2 fwrite is count 213148 /data/local/tmp/load1
fwrite is count 54816 /data/local/tmp/load2
find_opcode offset:2b4 opcode:eaeaeaea
find_opcode offset:2b8 opcode:ebebebeb
find_opcode offset:22d opcode:abababab
load = 416bc load1 = 3409c load2 = d620
find_opcode offset:2b0 opcode:efefefef
find_opcode offset:24d opcode:cdcdcdcd
find_opcode offset:2bc opcode:acacacac
init_shellcode
loadsize:267964
loadpath:/data/local/tmp/load
shpath:/data/local/tmp/my.sh /data/local/tmp 2
shpath:2bc

open /proc
PID:188
find logd pid : bc
_inject_start_s:0x7fb214a008
Copying /sepolicy to /data/local/tmp/cp_sepolicy
cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/load1
size: 213148

[*] mmap 0x7fb1f3b000;
[*] exploit (patch)
[*] currently 0x7fb1f3b000=8f97cff8c
sched_setaffinity: Invalid argument[*] madvise = 0x7fb1f3b000 213148
checking the patch ... exploit
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
sleep 1s
exit fork(), loop time more then 30s

<WSRoot><Exploit>0x00000332</Exploit></WSRoot>
check done
sched_setaffinity: Invalid argument<WSRoot><Exploit>0x00000382</Exploit></WSRoot>
FAIL : load1 --> /sepolicy
<WSRoot><Exploit>0x00000341</Exploit></WSRoot>
<WSRoot><Exploit>0x00000881</Exploit></WSRoot>
<WSRoot><Done>0x00000172</Done></WSRoot>


Any Help would be appreciated.

 

[Thomas131]

Hi!
Thanks for the exploit!!

I have "unlocked" my douglas using this hack and installed LineageOS 17.1. How to install magisk - the normal way doesn't work and patching boot_x had no effect.

Thanks in advance!
Thomas

 

[danzew]

Leaving the content up so can laugh, but resolved on own. WSL needs USBIPD to see the attached tablet, if others also experience same as I.

So, in case any old timers are curious why the sudden spike in 2017 fire's... Woot sold a pallet or two of them recently and will likely have clueless sorts such as I wandering the halls aimlessly, touching things and asking dumb questions. So as to not disappoint, while I am or was quite the rooter ricky circa 2012 to 16 I had fallen out of the practice being on a severely prudish network famous for locked bootloaders etc.

Ok with my origin story stopped before it began, Win 10 natively from command, will see the tablet under adb devices. I can even toggle the revoke and get the tablet prompt to ask if pc is trusted... After a reboot, launching the linux shell,initiating script I get stuck at the empty adb devices screen. So, assuming that windows, even without user initiate is hijacking the device. so the shell isn't able to see. anybody have any idea how i can get it to recognize device?

 

[danzew]

Hi Guys,
first of all thanks for all the hard work.

Im trying to unlock my douglas Tablet with Firmware 5.7.0.0.
And i cant get it to work , i always get the following error:

Hi ChaosLord, We might be in similar boat. I too have a Gen7. From the OP it makes mention that if you have newer OS then 5.6 you need to brick and downgrade:

3. Start the script:
Code:
sudo ./step-1.sh

Your device will now reboot into recovery and perform a factory reset.

NOTE: If you are on a firmware newer than 5.6.4.0, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you don't need to run step-2.sh below:


Make sure ModemManager is disabled or uninstalled:
Code:
sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

WARNING: Do not use bootrom-step-minimal.sh if you bricked using brick(-9820).sh!
You will need to use bootrom-step.sh.

After you have confirmed the bricking by typing "YES", you will need disconnect the device and run

so my question is, after grabbing the arm64 version of rapid temp root file, as directed to place in bin folder, I run the step-1.sh and get a repeating error that

sudo ./step-1.sh
[sudo] password for dubya:
Testing root access...

Trying to use mtk-su to get temp root...
Pushing root files
bin/mtk-su: 1 file pushed. 5.6 MB/s (65144 bytes in 0.011s)
bin/minisu.img: 1 file pushed. 6.6 MB/s
bin/busybox: 1 file pushed
Failed critical init step 4
Firmware support not implemented
repeat

so were you ever prompted to brick device as instructions hint at? I feel either some directions got lost with edits over time, or the script is failing before it can ask me to brick. Any thoughts?

 

[chaosl0rd]

Hi ChaosLord, We might be in similar boat. I too have a Gen7. From the OP it makes mention that if you have newer OS then 5.6 you need to brick and downgrade:



so my question is, after grabbing the arm64 version of rapid temp root file, as directed to place in bin folder, I run the step-1.sh and get a repeating error that



so were you ever prompted to brick device as instructions hint at? I feel either some directions got lost with edits over time, or the script is failing before it can ask me to brick. Any thoughts?

Hi Danzew,

i tried the exact same at the beginning and got the same error (Failed critical init step 4), so i never got to the brick part and then got to the offline root method because everywhere is written down that it would work.

 

[danzew]

duplicate my apologies

 

[NeelFromYT]

I recently tried to root my fire hd8. but when I tried to boot into twrp using advanced restart, it shows recovery mode, then exits and boots normally. Please help bro

 

[danzew]

Hi Danzew,

i tried the exact same at the beginning and got the same error (Failed critical init step 4), so i never got to the brick part and then got to the offline root method because everywhere is written down that it would work.

can you point me at this offline root? So i read thru the whole thread, there was someone back in october with same issue but OP had already stopped replying to the thread. want to give your attempt a try because you had the impressive log to share... I attempted using the brick shell scripts (both independently, both fail to create the temp root shell to get TWRP installed. other then the other fellow who was successful on satuday, I'd say missing something.

Edit: i'm going to try the hardware root option, as that does still seem to have the most success. I'll try and find or will create if succssful a tutortial where the pictures haven't expired https://forum.xda-developers.com/t/...-fire-hd-8-2017-douglas.3962846/post-80287339