[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 8 2017 (douglas)

[pbcsd]

Hmm.. Are there instructions on installing Magisk and a Rom?

 

[kerazee]

@willgaj did you enter bootloader mode on the Fire ? Powerdown and then Press VolUp + Power, wait until you see "Enter Recovery" , then select "Bootloader".

Heres how it worked out for me:

Files I used:

amonet-douglas-v1.2.zip from first Page of this Thread:
https://xdaforums.com/attachments/amonet-douglas-v1-2-zip.4845269/
Unpack the Archive to a separate Folder.

brick-douglas.zip from first Page of this Thread:
https://xdaforums.com/attachments/brick-douglas-zip.4825253/
Unpack the Archive to a separate Folder.


MTK-su (i used te 64 bit) from here:
https://xdaforums.com/t/rapid-temporary-root-for-hd-8-hd-10.3904595/
Unpack and copy to the MTK-su from the 64 Bit folder to the “bin” folders of the previous unpacked folders.


Unlock steps:

1. Reboot FireHD8 to Recovery (Power Off device, then hold VolUp + Power)
   
   
2. Select Facotry Reset then Wipe Cache
   
   
3. Reboot to Bootloader
   
   
4. You will see the balck screen with “Fastboot” in the lower corner.
   
   
5. Open Terminal from “brick-douglas” folder an enter “sudo ./brick.sh
   ”
6. Check Display output for the “Disconnect USB and Powerdown” Message and do so when prompted
   (If theres an Error see below Step 12)
   
   
7. Open Terminal from “amonet-douglas-v1.2” foder.
   
   
8. Enter “sudo ./bootrom-step.sh"
   
   
9. Reconnet USB
   
   
10. Wait until the bootrom step is finished
    
    
11. Enter “sudo ./fastboot-step.sh”
    
    
12. You will end up in TWRP

If theres an error let the FireHD Reboot and do the “Apps and Data Optimization” at the Welcome Install Screen Powerdown the FireHD and enter Bootloader again.

• Open Terminal from “brick-douglas” folder
• Enter “sudo ./brick-8920.sh”
• Check Display output for the “Disconnect usb and powerdown” message and do so when prompted.
• Enter “sudo ./bootrom-step.sh
• Reconnet USB
• Wait until the bootrom step is finished.
• Enter “sudo ./fastboot-step.sh"
• You will end up in TWRP

Lineage OS installation:

Prepare a Micro SD Card with: Lineage OS (Search the forum for the douglas (FireHD 8 7.Gen) or suez (FireHD 10 7Gen) Version, Gapps (ARM64, 7.1, nano) and Magisk and insert in FireHD.

In TWRP Format Data and Wipe data, system, cache.

Install Rom, gapps and magisk

Reboot to Lineage OS



Hardware Method:

If you got stuck somewhere in the middle or the Exploit doesn’t work try the hardware method.

I somehow bricked my HD10 , I think I disconnected the USB because I was to unpatient.

For the Hardware method, you need to open the Tablet, use a prytool or a Creditcars / Knife to remove the backcover, just gently pry around the bezel until the screen pops out.

You need to unscrew the mainboard and gently flip it over , on the HD10 I didn’t had to remove any wire , just be carefull with the speakers and put a piece of cardboard or plastic on the back between the mainboard and battery so it will not shorten or puncture the battery.

Find the CLK pin (theres several pictures on the forum for your specific device) use a piece of wire or paperclip to shorten from a ground plane or the SD Card slot housing to the clock pin. This works best if you got someone that will help you.

• Connect USB to the Tablet, but leave it unplugged on the Computer side.
• Make sure the Tablet is powered down (Press and hold Power button for 30 seconds)
• Open Terminal from “amonet-douglas-v1.2” foder.
• Enter “sudo ./bootrom-step.sh”
• Now shorten CLK to ground and hold it.
• Ask a kind person to plug in the USB cable on the Computer now.
• The Terminal will tell you to remove the wire when ready.
• Press enter and wait for bootrom-step.sh to finish.
• If an error during bootrom step occurs , just retry
• After bootrom step is finished, enter “sudo ./fastboot-step.sh”
• You will end up in TWRP

PS: I directly installed LOS 14.1 on the HD8 , on the HD10 i i used LOS 12.1 because LOS 14.1 is missing Camera Support on the HD10 in fact loosing the camera shouldnt trouble too much as the picture quality is horrible anyways. As for now I am happy to have a running Android on the tabs and don´t need to worry amazon giving me headaches every few weeks when updating CrapOS and redndering my configuration unuseable , i got 14 HD8/10 deloyed around the house as input devices for Homeautomation (running Habpannel).

One thing to mention when switching to LOS, is that you can´t use apps that need to be certified anymore, like Netflix, Banking etc.

Good luck!

PPS: Thanks a lot to k4y0z and his fellas for the great job!


opec

You sir are a legend, thanks for the great instructions, rooted and installed without the need to crack open the case.

 

[pbcsd]

Just trying to revert back to stock on one of my devices. Seem to just hang here at waiting for device?

ubuntu@ubuntu:~/Downloads/Amonet/amonet-douglas-v1.2/amonet$ fastboot flash recovery bin/recovery.img
< waiting for any device >

When I do a sudo fastboot devices, it identifies that my Fire is attached.

 

[renatus_lupus]

I figured I'd explain what I had to do after spending all day trying to figure it out. If on Linux (I was using a VM), you had to put mtk-su in the bin folder, and running step-1.sh script throws repeated "cannot be supported" errors, you wanna unplug and power the tablet off, hold the left volume key and the power button, let go of only the power button when the Amazon logo shows, and enter bootloader mode. While your Linux install or VM has the tablet in bootloader mode docked, run the ModemManager commands, the brick script (I had to use brick-9820, so mind the red text warning in the OP), then after unplugging and rebooting when the tablet prompts to do so (after saying it's been "Pwned!" by k4y0z), run the bootrom-step script and then the fastboot-step script, and it eventually went into TWRP for me.

I was having issues pushing .zips for Lineage OS and GApps to my device through my Linux VM, so what I did was I plugged the device into my host Windows 10, installed ADB tools on Windows 10, opened PowerShell, changed to the directory where those zip files were ("cd X:\Downloads" in my case), then "adb push .\[zip file name] /sdcard". The file names are long, so the tab key can complete the file name in the command after you type the first few letters of it. Hope this helps someone!

 

[landmerk7]

does this method still work for the newest version (5.6.8.0)?

 

[IsolatePlz]

I need help I'm stuck at "USB Transferring..." on my device and "Sending 'brick'" on my Virtual Machine. I'm using Ubuntu on Virtual Box I don't think the Virtual Machine is the problem because this has worked for people in the past.

 

[renatus_lupus]

does this method still work for the newest version (5.6.8.0)?

I can't vouch for that version personally, my device was 5.3.X.X when I did it

 

[12o0n3y]

thank you Rortiz2 i will try

---------- Post added at 03:36 PM ---------- Previous post was at 03:30 PM ----------



I do this method on windows 10 with linux shell and i get success thank you very much

How did you attached USB to linux? I am using windows 10 with wsl + Ubuntu. Thanks!

 

[pokemon81]

*del*
wrong Thread

 

[renatus_lupus]

How did you attached USB to linux? I am using windows 10 with wsl + Ubuntu. Thanks!

Are you on a virtual machine? If you're using Oracle VM VirtualBox, as long as the device is plugged into your PC before starting the VM, it should be available under Devices > USB, and selecting it should route it to the virtual Linux instance

I need help I'm stuck at "USB Transferring..." on my device and "Sending 'brick'" on my Virtual Machine. I'm using Ubuntu on Virtual Box I don't think the Virtual Machine is the problem because this has worked for people in the past.

you ran the two ModemManager commands the guide told you to do while the device was in recovery/fastboot mode before trying to send the brick, right? (You do that by turning it off and holding the power + left volume button, and releasing the power button once the Amazon logo appears)
Also sorry if you already knew how to do that, I forgot if it would say "sending brick..." when the device wasn't in that mode. The guide wasn't very clear about when you needed to put it in recovery mode

 

[mopst]

How did you attached USB to linux? I am using windows 10 with wsl + Ubuntu. Thanks!

The following worked for me. We kill any running adb servers, run it intentionally on port 5037 on all interfaces, elevate to root in WSL, again kill adb server, and kill any that might be running under any other user, export the socket so ADB looks for it elsewhere, and then run the devices command to see if we can see our device. This is preferable, in my opinion, to connecting via internet, because I really didn't want to risk Amazon auto-updating the device and forcing me to then downgrade it. Using this, I could connect via USB and keep it offline. Hope it helps someone.

Windows CMD:

adb kill-server
adb -a -P 5037 nodaemon server

WSL, using sudo to switch to root because the bash scripts need to run with root privileges.

sudo su - root
adb kill-server
killall adb
export ADB_SERVER_SOCKET=tcp:LOCAL_IP_HERE:5037
adb devices

Replace LOCAL_IP_HERE with your Windows IP -- it's likely something like 192.168.1.x. You can find this out by entering ipconfig in the Windows command prompt. If adb devices outputs a device ID string, something like:

List of devices attached
G821GL02845209BP        recovery

...then you can proceed by running the bash script as per the OP's instructions.

 

[kbroh]

does this method still work for the newest version (5.6.8.0)?

It worked 3/9/21 for me on Douglas Fire 2017, 5.6.8.0. Perfectly! Every other tutorial on here did not work, but Opec user was spot on!

 

[Crono75]

I have a Fire HD 8(7th generation) with OS 5.6.8.0.
I used brick-douglas with the command "sudo ./brick-8920.sh".
But after the command unfortunately the USB came off and now it won't boot into bootloader mode. It seems to be dead, but when i connect the usb to the pc i hear the beep. Do you have any suggestions? Thanks to all!!!!

 

[Korin67]

I have a Fire HD 8(7th generation) with OS 5.6.8.0.
I used brick-douglas with the command "sudo ./brick-8920.sh".
But after the command unfortunately the USB came off and now it won't boot into bootloader mode. It seems to be dead, but when i connect the usb to the pc i hear the beep. Do you have any suggestions? Thanks to all!!!!

What was displayed on the tablet when you issue brick-8920.sh? Did you see like: disconnect the tablet and power off ? If this is the case your tablet is bricked (not dead). Just keep going to the next step.

 

[skudo101]

I have a Fire HD 8(7th generation) with OS 5.6.8.0.
I used brick-douglas with the command "sudo ./brick-8920.sh".
But after the command unfortunately the USB came off and now it won't boot into bootloader mode. It seems to be dead, but when i connect the usb to the pc i hear the beep. Do you have any suggestions? Thanks to all!!!!

I also have the same situation as you, do you have any way to fix it? I do everything but HD8 is still can not reboot, It just black screen

 

[k1ndlef4cker]

Is there any problems if i flash the stock rom from amazon website with twrp? (currently runing lineageos) because i heard from somewhere that it would do something with twrp

 

[gops75]

Yesterday i managed to root updated FireOS and install Lineage 12.1, so, here's my story

Version 5.6.6.0 build 654620620,
on Linux KDE Neon.

1. Installed python3, PySerial, adb, fastboot dos2unix as described in this and other posts.
   

   sudo apt update
   sudo add-apt-repository universe
   sudo apt install python3 python3-serial adb fastboot dos2unix

2. Downloaded the following attachments from the first post : amonet-douglas-v1.2.zip and brick-douglas.zip
3. Extract both files to the same folder
4. Enable Developer options and enable ADB (inside debugging options) on Amazon tablet
5. Plug in the tablet (has to be turned on)
6. Now comes the commands execution part. So, open the terminal in Linux (lines that start with // are comments and should not be run from command line - if you copy paste)
   
   

   sudo systemctl stop ModemManager && sudo systemctl disable ModemManager

   adb devices
   // there should be an item listed
   // to be sure, you can unplug and run it again, if it's empty,
   // ou know tablet can connect, so plug in the tablet back

   adb reboot bootloader
   // reboots the tablet and awaits commands

   sudo ./brick.sh
   // type YES, hit enter
   // it will take a couple of minutes (around 3-5min in my case)
   // watch the tablet for success message, it should be displayed there if everything works
   // but also, watch your terminal...if it gives you error message similiar to:
   // ==> [I][U]failed with error message that it can't write somewhere[/U][/I]
   // you have to try with brick-9820 script

   sudo ./brick-9820.sh
   // it will take a couple of minutes, similar to above step

   
   NOTE : after either of the above commands (which one succeeds) POWER OFF THE TABLET and DO NOT try to turn it back on. It should stay powered off!!
   
   

   sudo ./bootrom-step.sh
   // this will take some time (in my case around 5-10 minutes)
   // will give you message similar to "awaiting device connection" and nothing else...
   // although nothing seems to happen, just wait a bit and watch the terminal, it will soon start displaying the process
   // it should then reboot the tablet, but in my case, that did not happen, so i had to do it manually...
   // NOTE that althought tablet seems to be "off", it isn't, so press power btn and hold for 5 sec to turn it off
   // after that click and hold volume up button (when in portrait mode it is the right one, the one closest to power btn)
   // and immediately after that press and hold the power btn until amazon logo shows itself
   // it should then show in bottom left corner HACKED FASTBOOT after a few seconds

   
   

   sudo fastboot devices
   // there should be a device listed
   // if not, you should run (in the extracted directory that you are in):
   ./bin/fastboot devices
   // if sudo fastboot devices does not show your device but ./bin/fastboot works, you have to edit the fastboot-step.sh file and change the fastboot commands to ./bin/fastboot

   sudo ./fastboot-step.sh
   // takes a couple of minutes (1-3 min in my case)
   // reboots the device

after that you should be in TWRP

NOTE when in TWRP:

DO NOT RESTART tablet before the following
(or amazon fire os will overwrite TWRP and you will be reset to factory default with fireOS, losing everything you've done and starting from scratch...
when it happened to me, the brick-9820.sh didn't work anymore and had to use brick.sh script)

-allow modifications
-format data,system,cache partitions, go to wipe->advanced wipe-> repair/format (something like that), select each of the 3 partitions aformentioned and format to ext4
-if you've done it correctly, there should not be any red warnings
-after that go to wipe, select all partitions and wipe them (just to be sure)

-tablet should be connected and TWRP should be left on

on PC
-download Lineage 12.1 ROM from https://xdaforums.com/hd8-hd10/general/discussion-root-progress-fire-hd-8-t3743024
-download opengapps from https://opengapps.org/
- put them inside amonet-douglas-v1.2 folder where you've extracted the prior ZIP files (just to be clear, you can put them anywhere, but i like to keep it all inside the working directory)

-go to terminal

adb push lineage-12.1-20200614-UNOFFICIAL-douglas.zip /sdcard
adb push open_gapps-arm64-5.1-nano-20200624.zip /sdcard

now the files are on the tablet
- in TWRP go to INSTALL, go to /sdcard folder if not in it
- first install Lineage ROM from zip
- then install GApps from zip

hope it works!
I'm glad i've finally rooted it, thank you all for the great content here!

I tried the steps posted by @deverro but due to my hasty thinking, I got my fire hd 8 device bricked.

I followed the steps -- reboot to bootloader, and then tried ./brick.sh, and it gave me failed (data write failure) result.

Then I tried ./brick-9820.sh. It actually worked, and I saw that files transferred in the device screen (fire HD 8) which asked to switch the device off (or take the plug off or something similar --- don't remember). But at the same time, my command window (Linux PC) still showing writing 'brick'...

I was thinking I should switch off the device as per the device screen but as soon as I switched it off, the PC command window gave me error saying 'Failed (status read failed No such device).

Now my device seems bricked. Is there a way to get it back to at least factory setting. I tried the (Volume Minus Key + Power), Not helping.

Any suggestions. Please let me know steps to get either Lineage OS or factory set up in my bricked device. Thanks.

 

[gops75]

I tried the steps posted by @deverro but due to my hasty thinking, I got my fire hd 8 device bricked.

I followed the steps -- reboot to bootloader, and then tried ./brick.sh, and it gave me failed (data write failure) result.

Then I tried ./brick-9820.sh. It actually worked, and I saw that files transferred in the device screen (fire HD 8) which asked to switch the device off (or take the plug off or something similar --- don't remember). But at the same time, my command window (Linux PC) still showing writing 'brick'...

I was thinking I should switch off the device as per the device screen but as soon as I switched it off, the PC command window gave me error saying 'Failed (status read failed No such device).

Now my device seems bricked. Is there a way to get it back to at least factory setting. I tried the (Volume Minus Key + Power), Not helping.

Any suggestions. Please let me know steps to get either Lineage OS or factory set up in my bricked device. Thanks.

Hi All and @deverro:

I continued doing the next step and it worked. Thanks a lot.

Please ignore my previous post.

Regards,
GV

 

[coffekind]

Git for Windows

We bring the awesome Git VCS to Windows

gitforwindows.org

would windows users be able to bypass using wsl, vm, and/or usb bootables altogether by using this? Asking cause I have no idea about this stuff, and it seems it'd make it way quicker & easier. Also, apologies if this was mentioned earlier in the thread.
Nope it did not work. I'm inclined to say after toiling with it for over a day, the boot unlock process is impossible using windows with wsl, unless I missed something to make adb and fastboot actually work properly with it. bootable drive it is then.

 

[SamDungUser]

Read this whole guide before starting.

This is for the 7th gen Fire HD8 (douglas).

Current version: amonet-douglas-v1.2.zip


NOTE: This process does not require you to open your device, but should something go horribly wrong, be prepared to do so.


NOTE: This process will modify the partition-table (GPT) of your device.


NOTE: Your device will be reset to factory defaults (including internal storage) during this process.


What you need:

• A Linux installation or live-system
• A micro-USB cable

Install python3, PySerial, adb, fastboot dos2unix. For Debian/Ubuntu something like this should work:

sudo apt update
sudo add-apt-repository universe
sudo apt install python3 python3-serial adb fastboot dos2unix

1. Extract the attached zip-file "amonet-douglas-v1.1.zip" and open a terminal in that directory.


NOTE: If you are already rooted, continue with the next step, otherwise get mtk-su by @diplomatic from here and place (the unpacked binary) into amonet/bin folder


2. Enable ADB in Developer Settings

3. Start the script:

sudo ./step-1.sh

Your device will now reboot into recovery and perform a factory reset.

NOTE: If you are on a firmware newer than 5.6.4.0, a downgrade is necessary, this requires bricking the device temporarily. (The screen won't come on at all)
If you chose the brick option, you don't need to run step-2.sh below:

Make sure ModemManager is disabled or uninstalled:

sudo systemctl stop ModemManager
sudo systemctl disable ModemManager

WARNING: Do not use bootrom-step-minimal.sh if you bricked using brick(-9820).sh!
You will need to use bootrom-step.sh.

After you have confirmed the bricking by typing "YES", you will need disconnect the device and run

sudo ./bootrom-step-minimal.sh

Then plug the device back in.

It will then boot into "hacked fastboot" mode.
Then run

sudo ./fastboot-step.sh

NOTE: When you are back at initial setup, you can skip registration by selecting a WiFi-Network, then pressing "Cancel" and then "Not Now"
NOTE: Make sure you re-enable ADB after Factory Reset.


4. Start the script:

sudo ./step-2.sh

The exploit will now be flashed and your device will reboot into TWRP.

You can now install Magisk from there.


Going back to stock
Extract the attached zip-file "amonet-douglas-return-to-stock.zip" into the same folder where you extracted "amonet-douglas-v1.0.zip" and open a terminal in that directory.
You can go back to stock without restoring the original partition-table, so you can go back to unlocked without wiping data.
Just use hacked fastboot to

sudo fastboot flash recovery bin/recovery.img

If you want to go back completely (including restoring your GPT):

sudo ./return-to-stock.sh

Your device should reboot into Amazon Recovery. Use adb sideload to install stock image from there. (Make sure to use FireOS 5.6.4.0 or newer, otherwise you may brick your device)

Important information

In the new partitioning scheme your boot/recovery-images will be in boot_x/recovery_x respectively, while boot/recovery will hold the exploit.
TWRP takes care of remapping these for you, so installing zips/images from TWRP will work as expected.

Don't flash boot/recovery images from FireOS (FlashFire, MagiskManager etc.) (If you do anyway, make sure you flash them to boot_x/recovery_x)

Should you accidentally overwrite the wrong boot, but your TWRP is still working, rebooting into TWRP will fix that automatically.

TWRP will prevent updates from overwriting LK/Preloader/TZ, so generally installing an update should work without issues (only full updates, incremental updates won't work).

For ROM developers there is still an option to overwrite these, which should only be done after thorough testing and if needed (LK should never be updated).

It is still advised to disable OTA.


Very special thanks to @xyz` for making all this possible and putting up with the countless questions I have asked, helping me finish this.
Special thanks also to @diplomatic for his wonderfull mtk-su, allowing you to unlock without opening the device.
Thanks to @t0x1cSH and @breakfastofsecrets for testing.

Hi, I bricked the device via modifying partitions. Can someone help? I tried shorting but it seems to refuse booting anything, TWRP or hacked FB. Help please!