Views: 4310
Changelog:
v2 – Fixed the issue with the screen
Make sure to read this guide completely before starting. It requires you to open the tablet, however you don’t need to solder or use any advanced tools.
This is only for Fire HD 8, 8th generation, also known as karnak or KFKAWI. It’s now confirmed to work on both 16GB and 32GB models.
You will lose all data on the tablet, make a backup of important data before you start. If you’ve enabled encryption, it’s probably a good idea to disable it before you proceed with the guide.
What you need:
– a Linux installation. Since I had to rush it, this guide is only for Linux. Once I get a chance to test it on Windows I’ll update the guide.
– microusb cable to connect your tablet to the PC
– some way to open the tablet (pry tool, opening picks, etc)
– something conductive (metal tweezers, a paper clip, a piece of wire, etc)
– amonet.tar.gz
– 6300.zip: https://mega.nz/#!FI1HSI5T!2zUAeiW9I…ilSnNYgOG9YPNE
– Magisk-v18.0.zip: https://github.com/topjohnwu/Magisk/…gisk-v18.0.zip
– finalize.zip
Install python3, PySerial, adb and fastboot. For Debian/Ubuntu something like this should work “sudo apt install python3 python3-serial android-tools-adb android-tools-fastboot”.
Extract amonet.tar.gz, open a terminal and navigate to it.
You might need to run the scripts on your PC under sudo if you’re getting permission errors.
0. Shut your device down and disconnect it from USB! Also, disconnect all other Android devices you might have connected from your PC. Also, if you have ModemManager installed, you MUST disable or uninstall it before you begin
1. Use a pry tool to remove the back shell from the tablet. Start at the bottom and work your way up. There are no cables between the back shell and the motherboard.
2. On the left side of the board there are 4 test points labeled DAT0, RST, CMD, CLK. We only care about the bottom one, CLK.
3. Plug in one end of the microusb cable, either to the PC or to the tablet, whatever’s more convenient.
4. On your PC, run `./bootrom-step.sh`. It should print “Waiting for the bootrom”.
5. Using your conductive apparatus, short the CLK test point to the ground. This means you should connect one side of your paperclip to the CLK pin and the other to the metallic shield or a side of the PCB. Firmly hold it in place so that there is connection. (See https://i.imgur.com/7BXIb2y.jpg)
6. Plug in the other end of the microusb cable.
7. You should see a new device appear on your PC
Code:
[10894.058045] usb 3-2.4.1: new full-speed USB device number 9 using xhci_hcd [10894.239684] usb 3-2.4.1: New USB device found, idVendor=0e8d, idProduct=0003 [10894.239690] usb 3-2.4.1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [10894.241330] cdc_acm 3-2.4.1:1.0: ttyACM0: USB ACM device
This *must* be the device you see. If you see a “preloader” device instead, you didn’t hold the paperclip strong enough. Unplug it, shut down your Fire (pull out USB cord and wait; if it doesn’t shut down, you might have to disconnect the battery) and try again starting at step 4.
8. The script you ran in step 4 should now tell you to remove the short. Remove the paperclip and press Enter as instructed.
9. The script will now proceed to downgrade your device and flash some essential files. Just let it be, it will take about 4 minutes. You should see the following output:
Code:
[2019-01-26 23:30:02.157670] Waiting for bootrom
[2019-01-26 23:30:20.438333] Found port = /dev/ttyACM0
[2019-01-26 23:30:20.439362] Handshake
[2019-01-26 23:30:20.441693] Disable watchdog
* * * Remove the short and press Enter * * *
[2019-01-26 23:30:22.636037] Init crypto engine
[2019-01-26 23:30:22.661832] Disable caches
[2019-01-26 23:30:22.662505] Disable bootrom range checks
[2019-01-26 23:30:22.685773] Load payload from ../brom-payload/build/payload.bin = 0x4690 bytes
[2019-01-26 23:30:22.693170] Send payload
[2019-01-26 23:30:23.527965] Let's rock
[2019-01-26 23:30:23.528832] Wait for the payload to come online...
[2019-01-26 23:30:24.260602] all good
[2019-01-26 23:30:24.261069] Check GPT
[2019-01-26 23:30:24.596346] gpt_parsed = {'proinfo': (1024, 6144), 'PMT': (7168, 9216), 'kb': (16384, 2048), 'dkb': (18432, 2048), 'lk': (20480, 2048), 'tee1': (22528, 10240), 'tee2': (32768, 10240), 'metadata': (43008, 80896), 'MISC': (123904, 1024), 'reserved': (124928, 16384), 'boot': (141312, 32768), 'recovery': (174080, 40960), 'system': (215040, 6354944), 'vendor': (6569984, 460800), 'cache': (7030784, 1024000), 'userdata': (8054784, 22722527)}
[2019-01-26 23:30:24.596619] Check boot0
[2019-01-26 23:30:24.841858] Check rpmb
[2019-01-26 23:30:25.051079] Downgrade rpmb
[2019-01-26 23:30:25.052924] Recheck rpmb
[2019-01-26 23:30:25.949978] rpmb downgrade ok
[2019-01-26 23:30:25.950284] Flash lk-payload
[5 / 5]
[2019-01-26 23:30:26.471797] Flash preloader
[288 / 288]
[2019-01-26 23:30:44.845804] Flash tz
[6732 / 6732]
[2019-01-26 23:33:08.502134] Flash lk
[685 / 685]
[2019-01-26 23:33:23.337460] Inject microloader
[4 / 4]
[2019-01-26 23:33:23.667547] Reboot to unlocked fastboot
If the script freezes at some point, you will have to restart it. Terminate the script, unplug USB, and try again starting at step 4. If after unplugging USB cable the device doesn’t shut down, you might have to disconnect the battery. You can keep it disconnected until the script succeeds, but once it’s done you must reconnect it before booting to fastboot.
9. You should see a success message: “Reboot to unlocked fastboot”. Only proceed if you see the message.
10. Once the device boots to fastboot (check with “fastboot devices”. You should see amazon logo on the screen.), you can run “./fastboot-step.sh”. Then, flip the device over so that you can see the display.
11. At this point the device should boot into recovery, however it’s possible that the screen will be off by default. Just press the power button twice and the screen should turn on.
12. We’ll now upload required files to the recovery. On your PC, do:
adb push 6300.zip /sdcard
adb push Magisk-v18.0.zip /sdcard
adb push finalize.zip /sdcard
13. In the recovery, go to “Install”, navigate to “/sdcard” and flash 6300.zip
14. Go to “Wipe” and do the default wipe, then reboot
15. At the Fire setup screen, select your language. On the next screen, Wifi setup, select any password-protected network, then instead of entering the password press “cancel”. Now, back at the wifi setup screen, press “skip” and “skip” in the dialog pop-up again
16. Hold down the power button, press Restart and hold volume down to boot into recovery.
17. In the recovery, go to “Install”, navigate to “/sdcard” and flash Magisk-v18.0.zip
18. Press back, select finalize.zip and flash it
19. Once finalize.zip is flashed, press “Reboot System”
20. Done. The device should now boot into a rooted 6.3.0.0 firmware. You should have Magisk manager installed, and root working. You will be able to boot into recovery by holding volume down.
21. At this point it should be safe to connect to wifi. If everything works okay, assemble your device.
Your device is now unlocked. You can flash a custom boot image, system image, etc. However, if you ever brick the device so bad the recovery does not boot, you will have to repeat these steps starting from the first one. Read below for what you should not do.
VERY IMPORTANT STUFF:
Only ever flash boot images from TWRP. Since nothing but TWRP is aware of the exploit, if you try to flash a boot image from Android, it won’t have the exploit integrated into it! This includes Magisk as well, so do NOT install or uninstall it from Magisk Manager (However, installing modules should be fine; although it depends on the specific module).
Due to how the exploit works, it takes over the first 0x400 bytes of boot.img/recovery.img. When flashing zips from the recovery, it will transparently remove and then reinstall the exploit when needed. So long as you flash zips from the recovery, you should treat the boot image normally. However, this means that you cannot use any other apps (e.g. FlashFire) to flash the boot or recovery partitions.
To revert back to stock:
– download update package from amazon https://fireos-tablet-src.s3.amazona…1309035396.bin to your PC
– flash 6300.zip from twrp
– flash revert-stock.zip from twrp
– wipe data
– reboot to recovery; you should see amazon recovery now
– select “apply update from ADB” in the recovery menu
– run “adb sideload update-kindle-NS6301_user_1611_0001309035396.bin” on your PC
Another way to fix a brick:
– Download update package from amazon https://fireos-tablet-src.s3.amazona…1309035396.bin to your PC
– Download and unzip revert-stock.zip
– Do steps 0 to 9 from this guide (so everything until fastboot-step.sh)
– Wait for device to boot into fastboot mode (check with “fastboot devices”)
– Run “fastboot flash boot boot.img” using boot.img from the revert-stock.zip
– Run “fastboot flash recovery recovery.img” using recovery.img from the from the revert-stock.zip
– Run “fastboot reboot recovery”
– Select “apply update from ADB” in the recovery menu
– Run “adb sideload update-kindle-NS6301_user_1611_0001309035396.bin” on your PC
Other misc information / troubleshooting:
– If you need to disconnect the battery, use a pair of tweezers to grab the wires and gently pull towards yourself. You can do bootrom-step.sh either with or without the battery connected, however fastboot-step.sh should be done with the battery connected.
– If your device is bricked (e.g. from a downgrade), just follow the steps as-is.
– If you’re getting an error like “Serial protocol mismatch”, or any other error in bootrom-step, try disabling or temporarily uninstalling ModemManager from your Linux
– To remount /system as rw use “mount -o rw,remount /system”. (“mount -o remount,rw /system” will not work)
Thanks to: @hwmod @firetablethelp for testing different versions of the payload.
Special thanks to: aftv2-tools contributors https://gitlab.com/zeroepoch/aftv2-tools; the bootrom download protocol scripts are largely based on their workAttached Files
| finalize.zip – [Click for QR Code] (1.2 KB, 4402 views) | |
| revert-stock.zip – [Click for QR Code] (9.70 MB, 3296 views) | |
| amonet-v2.tar – [Click for QR Code] (15.59 MB, 5086 views) |