┌──(kali㉿kali)-[~]

└─$ sudo apt update

Ign:1 file:/run/live/medium kali-last-snapshot InRelease
Get:2 file:/run/live/medium kali-last-snapshot Release [7,354 B]
Get:2 file:/run/live/medium kali-last-snapshot Release [7,354 B]
Ign:3 file:/run/live/medium kali-last-snapshot Release.gpg
Get:4 file:/run/live/medium kali-last-snapshot/main amd64 Packages [81.0 kB]
Get:5 http://kali.download/kali kali-rolling InRelease [41.5 kB]
Get:6 http://kali.download/kali kali-rolling/contrib Sources [82.5 kB]
Get:7 http://kali.download/kali kali-rolling/main Sources [17.4 MB]
Get:8 http://kali.download/kali kali-rolling/non-free Sources [124 kB]
Get:9 http://kali.download/kali kali-rolling/non-free-firmware Sources [8,275 B]
Get:10 http://kali.download/kali kali-rolling/main amd64 Packages [21.0 MB]
Get:11 http://kali.download/kali kali-rolling/main amd64 Contents (deb) [52.0 MB]
Get:12 http://kali.download/kali kali-rolling/contrib amd64 Packages [121 kB]
Get:13 http://kali.download/kali kali-rolling/contrib amd64 Contents (deb) [327 kB]
Get:14 http://kali.download/kali kali-rolling/non-free amd64 Packages [204 kB]
Get:15 http://kali.download/kali kali-rolling/non-free amd64 Contents (deb) [915
kB]
Get:16 http://kali.download/kali kali-rolling/non-free-firmware amd64 Packages
[10.6 kB]
Get:17 http://kali.download/kali kali-rolling/non-free-firmware amd64 Contents
(deb) [24.3 kB]
Fetched 92.2 MB in 16s (5,805 kB/s)
1250 packages can be upgraded. Run 'apt list --upgradable' to see them.
Warning: Conflicting distribution: file:/run/live/medium kali-last-snapshot Release
(expected kali-last-snapshot but got kali-rolling)
Notice: Repository 'file:/run/live/medium kali-last-snapshot Release' changed its
'Version' value from '2025.1' to '"2025.1"'

┌──(kali㉿kali)-[~]
└─$ sudo apd-add-repository
sudo: apd-add-repository: command not found

┌──(kali㉿kali)-[~]
└─$ sudo add-apt-repository universe
sudo: add-apt-repository: command not found

┌──(kali㉿kali)-[~]
└─$ deb http://http.kali.org/kali kali-rolling main contrib non-free

Command 'deb' not found, did you mean:

command 'dub' from deb dub
command 'derb' from deb icu-devtools
command 'debc' from deb devscripts
command 'debi' from deb devscripts
command 'deb3' from deb quilt
command 'dcb' from deb iproute2
command 'dex' from deb dex
command 'edb' from deb edb-debugger
Try: sudo apt install <deb name>

┌──(kali㉿kali)-[~]
└─$ nano /etc/apt/sources.list

┌──(kali㉿kali)-[~]
└─$ sudo apt install python3 python3-serial adb fastboot dos2unix
python3-serial is already the newest version (3.5-2).
python3-serial set to manually installed.
dos2unix is already the newest version (7.5.2-1).
dos2unix set to manually installed.
Upgrading:
libpython3-dev libpython3-stdlib python3 python3-dev python3-minimal
python3-venv

Installing:
adb fastboot

Installing dependencies:
android-libbase android-libcutils android-libsparse android-udev-
rules
android-libboringssl android-liblog android-libziparchive

Suggested packages:
android-sdk-platform-tools

Summary:
Upgrading: 6, Installing: 9, Removing: 0, Not Upgrading: 1244
Download size: 1,528 kB
Space needed: 4,457 kB / 3,696 MB available

Continue? [Y/n] y
Get:1 http://kali.download/kali kali-rolling/main amd64 python3-venv amd64 3.13.2-2
[1,180 B]
Get:2 http://kali.download/kali kali-rolling/main amd64 libpython3-dev amd64
3.13.2-2 [10.3 kB]
Get:3 http://kali.mirror2.gnc.am/kali kali-rolling/main amd64 python3-dev amd64
3.13.2-2 [26.1 kB]
Get:4 http://kali.mirror2.gnc.am/kali kali-rolling/main amd64 python3-minimal amd64
3.13.2-2 [27.1 kB]
Get:5 http://kali.itsec.am/kali kali-rolling/main amd64 python3 amd64 3.13.2-2
[28.1 kB]
Get:6 http://kali.itsec.am/kali kali-rolling/main amd64 libpython3-stdlib amd64
3.13.2-2 [10.1 kB]
Get:11 http://kali.mirror1.gnc.am/kali kali-rolling/main amd64 android-
libziparchive amd64 1:34.0.5-12 [50.3 kB]
Get:8 http://kali.itsec.am/kali kali-rolling/main amd64 android-libbase amd64
1:34.0.5-12 [103 kB]
Get:7 http://kali.download/kali kali-rolling/main amd64 android-liblog amd64
1:34.0.5-12 [40.2 kB]
Get:10 http://kali.itsec.am/kali kali-rolling/main amd64 android-libcutils amd64
1:34.0.5-12 [40.9 kB]
Get:12 http://http.kali.org/kali kali-rolling/main amd64 android-udev-rules all
0~20250314+ds-5 [11.3 kB]
Get:13 http://kali.mirror2.gnc.am/kali kali-rolling/main amd64 adb amd64 1:34.0.5-
12 [276 kB]
Get:9 http://http.kali.org/kali kali-rolling/main amd64 android-libboringssl amd64
14.0.0+r45-2 [671 kB]
Get:14 http://kali.download/kali kali-rolling/main amd64 android-libsparse amd64
1:34.0.5-12 [36.1 kB]
Get:15 http://kali.download/kali kali-rolling/main amd64 fastboot amd64 1:34.0.5-12
[196 kB]
Fetched 1,528 kB in 3s (539 kB/s)
Reading changelogs... Done
(Reading database ... 398797 files and directories currently installed.)
Preparing to unpack .../python3-venv_3.13.2-2_amd64.deb ...
Unpacking python3-venv (3.13.2-2) over (3.13.1-2) ...
Preparing to unpack .../libpython3-dev_3.13.2-2_amd64.deb ...
Unpacking libpython3-dev:amd64 (3.13.2-2) over (3.13.1-2) ...
Preparing to unpack .../python3-dev_3.13.2-2_amd64.deb ...
Unpacking python3-dev (3.13.2-2) over (3.13.1-2) ...
Preparing to unpack .../python3-minimal_3.13.2-2_amd64.deb ...
Unpacking python3-minimal (3.13.2-2) over (3.13.1-2) ...
Setting up python3-minimal (3.13.2-2) ...
(Reading database ... 398797 files and directories currently installed.)
Preparing to unpack .../00-python3_3.13.2-2_amd64.deb ...
running python pre-rtupdate hooks for python3.13...
Unpacking python3 (3.13.2-2) over (3.13.1-2) ...
Preparing to unpack .../01-libpython3-stdlib_3.13.2-2_amd64.deb ...
Unpacking libpython3-stdlib:amd64 (3.13.2-2) over (3.13.1-2) ...
Selecting previously unselected package android-liblog:amd64.
Preparing to unpack .../02-android-liblog_1%3a34.0.5-12_amd64.deb ...
Unpacking android-liblog:amd64 (1:34.0.5-12) ...
Selecting previously unselected package android-libbase:amd64.
Preparing to unpack .../03-android-libbase_1%3a34.0.5-12_amd64.deb ...
Unpacking android-libbase:amd64 (1:34.0.5-12) ...
Selecting previously unselected package android-libboringssl:amd64.
Preparing to unpack .../04-android-libboringssl_14.0.0+r45-2_amd64.deb ...
Unpacking android-libboringssl:amd64 (14.0.0+r45-2) ...
Selecting previously unselected package android-libcutils:amd64.
Preparing to unpack .../05-android-libcutils_1%3a34.0.5-12_amd64.deb ...
Unpacking android-libcutils:amd64 (1:34.0.5-12) ...
Selecting previously unselected package android-libziparchive:amd64.
Preparing to unpack .../06-android-libziparchive_1%3a34.0.5-12_amd64.deb ...
Unpacking android-libziparchive:amd64 (1:34.0.5-12) ...
Selecting previously unselected package android-udev-rules.
Preparing to unpack .../07-android-udev-rules_0~20250314+ds-5_all.deb ...
Unpacking android-udev-rules (0~20250314+ds-5) ...
Selecting previously unselected package adb.
Preparing to unpack .../08-adb_1%3a34.0.5-12_amd64.deb ...
Unpacking adb (1:34.0.5-12) ...
Selecting previously unselected package android-libsparse:amd64.
Preparing to unpack .../09-android-libsparse_1%3a34.0.5-12_amd64.deb ...
Unpacking android-libsparse:amd64 (1:34.0.5-12) ...
Selecting previously unselected package fastboot.
Preparing to unpack .../10-fastboot_1%3a34.0.5-12_amd64.deb ...
Unpacking fastboot (1:34.0.5-12) ...
Setting up libpython3-dev:amd64 (3.13.2-2) ...
Setting up android-liblog:amd64 (1:34.0.5-12) ...
Setting up android-libboringssl:amd64 (14.0.0+r45-2) ...
Setting up android-udev-rules (0~20250314+ds-5) ...
Setting up android-libbase:amd64 (1:34.0.5-12) ...
Setting up libpython3-stdlib:amd64 (3.13.2-2) ...
Setting up android-libziparchive:amd64 (1:34.0.5-12) ...
Setting up android-libcutils:amd64 (1:34.0.5-12) ...
Setting up python3 (3.13.2-2) ...
running python rtupdate hooks for python3.13...
/usr/share/kali-undercover/scripts/desktopconfig.py:274: SyntaxWarning: invalid
escape sequence '\s'
if re.match('^' + fallback_monitor + '[^/\s]+$', pp):
/usr/share/kali-undercover/scripts/desktopconfig.py:279: SyntaxWarning: invalid
escape sequence '\d'
w = re.search('^/backdrop/screen\d/monitor[^/]+/workspace\d/', pp)
running python post-rtupdate hooks for python3.13...
Setting up adb (1:34.0.5-12) ...
Setting up android-libsparse:amd64 (1:34.0.5-12) ...
Setting up python3-venv (3.13.2-2) ...
Setting up python3-dev (3.13.2-2) ...
Setting up fastboot (1:34.0.5-12) ...
Processing triggers for kali-menu (2025.1.1) ...
Processing triggers for doc-base (0.11.2) ...
Processing 45 changed doc-base files...
Processing triggers for libc-bin (2.40-3) ...
Processing triggers for man-db (2.13.0-1) ...

┌──(kali㉿kali)-[~]
└─$ sudo systemctl stop ModemManager

┌──(kali㉿kali)-[~]
└─$ sudo systemctl disable ModemManager
Removed '/etc/systemd/system/dbus-org.freedesktop.ModemManager1.service'.
Removed '/etc/systemd/system/multi-user.target.wants/ModemManager.service'.

┌──(kali㉿kali)-[~]
└─$ wget https://github.com/ryanfortner/FireHD8-2017/raw/master/amonet-douglas.zip
unzip amonet-douglas.zip
cd amonet
--2025-05-19 21:21:37--
https://github.com/ryanfortner/FireHD8-2017/raw/master/amonet-douglas.zip
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/ryanfortner/FireHD8-2017/master/amonet-
douglas.zip [following]
--2025-05-19 21:21:38-- https://raw.githubusercontent.com/ryanfortner/FireHD8-
2017/master/amonet-douglas.zip
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133,
185.199.109.133, 185.199.108.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|
185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 22329263 (21M) [application/zip]
Saving to: ‘amonet-douglas.zip’

amonet-douglas.zip 100%[==================================>] 21.29M

5.76MB/s in 3.9s

2025-05-19 21:21:42 (5.47 MB/s) - ‘amonet-douglas.zip’ saved [22329263/22329263]

Archive: amonet-douglas.zip
creating: amonet/
inflating: amonet/brick-9820.sh
inflating: amonet/functions.inc
creating: amonet/modules/
inflating: amonet/modules/common.py
inflating: amonet/modules/main.py
inflating: amonet/modules/handshake.py
inflating: amonet/modules/gpt.py
inflating: amonet/modules/logger.py
inflating: amonet/modules/load_payload.py
inflating: amonet/modules/handshake2.py
inflating: amonet/step-2.sh
creating: amonet/bin/
inflating: amonet/bin/fastboot
inflating: amonet/bin/preloader.hdr0
inflating: amonet/bin/minisu.img
 inflating: amonet/bin/tz.img
inflating: amonet/bin/lk.bin
inflating: amonet/bin/twrp.img
inflating: amonet/bin/brick-9820.img
inflating: amonet/bin/boot.payload
inflating: amonet/bin/preloader.hdr1
inflating: amonet/bin/fastboot32
inflating: amonet/bin/brick.img
extracting: amonet/bin/boot-recovery.bin
inflating: amonet/bin/boot.hdr
inflating: amonet/bin/preloader.bin
inflating: amonet/bin/busybox
creating: amonet/brom-payload/
creating: amonet/brom-payload/build/
inflating: amonet/brom-payload/build/payload.bin
inflating: amonet/brick.sh
extracting: amonet/boot-recovery.sh
extracting: amonet/bootrom-step-minimal.sh
inflating: amonet/step-1.sh
extracting: amonet/bootrom-step.sh
inflating: amonet/fastboot-step.sh
inflating: amonet/boot-fastboot.sh

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./brick-9820.sh
Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)
YES
Bricking PL Header
Check instructions on device

target reported max download size of 114294784 bytes

Sending 'brick' (111616 KB)...
OKAY [ 4.122s]
Writing 'brick'...
FAILED (status read failed (No such device))
Finished. Total time: 27.203s

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:24:25.026153] Waiting for bootrom
[2025-05-19 21:26:03.525133] Found port = /dev/ttyACM0
[2025-05-19 21:26:03.525667] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

[2025-05-19 21:26:20.545422] Init crypto engine

[2025-05-19 21:26:20.567570] Disable caches
[2025-05-19 21:26:20.568280] Disable bootrom range checks
[2025-05-19 21:26:20.583877] Load payload from ../brom-payload/build/payload.bin =
0x4888 bytes
[2025-05-19 21:26:20.587847] Send payload
[2025-05-19 21:26:21.258857] Let's rock
[2025-05-19 21:26:21.259379] Wait for the payload to come online...
[2025-05-19 21:26:22.188490] all good

Running in minimal mode, assuming LK and TZ to have already been flashed.

If this is correct (i.e. you used "brick" option in step 1) press enter, otherwise
terminate with Ctrl+C

[2025-05-19 21:26:45.199946] Check GPT

[2025-05-19 21:26:45.577112]
[2025-05-19 21:26:45.577411] Sector size (logical): 512 bytes
[2025-05-19 21:26:45.577655] Disk identifier (GUID): 20832D51-7A2F-4653-BA78-
E2B3871F2253
[2025-05-19 21:26:45.577832] Partition table holds up to 128 entries
[2025-05-19 21:26:45.577986] This partition table begins at sector 2 and ends at
sector 33
[2025-05-19 21:26:45.578128] First usable sector is 34, last usable sector is
30777310
[2025-05-19 21:26:45.578259] Other partition table is at sector 30777343
[2025-05-19 21:26:45.578389]
[2025-05-19 21:26:45.578587] Number Start (sector) End (sector) Size
Name
[2025-05-19 21:26:45.585206] 1 1024 7167 3.00 MiB
proinfo
[2025-05-19 21:26:45.585412] 2 7168 16383 4.50 MiB
PMT
[2025-05-19 21:26:45.585567] 3 16384 17407 512.00 KiB
lk
[2025-05-19 21:26:45.585712] 4 17408 18431 512.00 KiB
lk2
[2025-05-19 21:26:45.585856] 5 18432 51199 16.00 MiB
boot
[2025-05-19 21:26:45.586000] 6 51200 86015 17.00 MiB
recovery
[2025-05-19 21:26:45.586445] 7 86016 96255 5.00 MiB
tee1
[2025-05-19 21:26:45.586608] 8 96256 106495 5.00 MiB
tee2
[2025-05-19 21:26:45.586753] 9 106496 187391 39.50 MiB
metadata
[2025-05-19 21:26:45.586896] 10 187392 189439 1024.00 KiB
kb
[2025-05-19 21:26:45.587036] 11 189440 191487 1024.00 KiB
dkb
[2025-05-19 21:26:45.587175] 12 191488 192511 512.00 KiB
MISC
[2025-05-19 21:26:45.587312] 13 192512 208895 8.00 MiB
reserved
[2025-05-19 21:26:45.587452] 14 208896 3515391 1.58 GiB
system
[2025-05-19 21:26:45.587611] 15 3515392 4383743 424.00 MiB
cache
[2025-05-19 21:26:45.587752] 16 4383744 30777310 12.59 GiB
userdata
[2025-05-19 21:26:45.595803]
[2025-05-19 21:26:45.595887] Modify GPT
[2025-05-19 21:26:45.596046] Validate GPT
[2025-05-19 21:26:45.596232]
[2025-05-19 21:26:45.596279] Sector size (logical): 512 bytes
[2025-05-19 21:26:45.596329] Disk identifier (GUID): 20832D51-7A2F-4653-BA78-
E2B3871F2253
[2025-05-19 21:26:45.596367] Partition table holds up to 128 entries
[2025-05-19 21:26:45.596404] This partition table begins at sector 2 and ends at
sector 33
[2025-05-19 21:26:45.596438] First usable sector is 34, last usable sector is
30777310
[2025-05-19 21:26:45.596471] Other partition table is at sector 30777343
[2025-05-19 21:26:45.596502]
[2025-05-19 21:26:45.596546] Number Start (sector) End (sector) Size
Name
[2025-05-19 21:26:45.596689] 1 1024 7167 3.00 MiB
proinfo
[2025-05-19 21:26:45.596830] 2 7168 16383 4.50 MiB
PMT
[2025-05-19 21:26:45.596970] 3 16384 17407 512.00 KiB
lk
[2025-05-19 21:26:45.597109] 4 17408 18431 512.00 KiB
lk2
[2025-05-19 21:26:45.597253] 5 18432 51199 16.00 MiB
boot_x
[2025-05-19 21:26:45.597412] 6 51200 86015 17.00 MiB
recovery_x
[2025-05-19 21:26:45.597554] 7 86016 96255 5.00 MiB
tee1
[2025-05-19 21:26:45.597692] 8 96256 106495 5.00 MiB
tee2
[2025-05-19 21:26:45.597835] 9 106496 187391 39.50 MiB
metadata
[2025-05-19 21:26:45.597974] 10 187392 189439 1024.00 KiB
kb
[2025-05-19 21:26:45.598111] 11 189440 191487 1024.00 KiB
dkb
[2025-05-19 21:26:45.598248] 12 191488 192511 512.00 KiB
MISC
[2025-05-19 21:26:45.598388] 13 192512 208895 8.00 MiB
reserved
[2025-05-19 21:26:45.598525] 14 208896 3515391 1.58 GiB
system
[2025-05-19 21:26:45.598661] 15 3515392 4383743 424.00 MiB
cache
[2025-05-19 21:26:45.598799] 16 4383744 30325759 12.37 GiB
userdata
[2025-05-19 21:26:45.598937] 17 30325760 30551039 110.00 MiB
boot
[2025-05-19 21:26:45.599074] 18 30551040 30776319 110.00 MiB
recovery
[2025-05-19 21:26:45.606976]
[2025-05-19 21:26:45.607068] Flash new primary GPT
[34 / 34]
[2025-05-19 21:26:46.436105] Flash new backup GPT
[33 / 33]
[2025-05-19 21:26:47.277401]
[2025-05-19 21:26:47.277530] Sector size (logical): 512 bytes
[2025-05-19 21:26:47.277716] Disk identifier (GUID): 20832D51-7A2F-4653-BA78-
E2B3871F2253
[2025-05-19 21:26:47.277890] Partition table holds up to 128 entries
[2025-05-19 21:26:47.278043] This partition table begins at sector 2 and ends at
sector 33
[2025-05-19 21:26:47.278182] First usable sector is 34, last usable sector is
30777310
[2025-05-19 21:26:47.278316] Other partition table is at sector 30777343
[2025-05-19 21:26:47.278442]
[2025-05-19 21:26:47.278632] Number Start (sector) End (sector) Size
Name
[2025-05-19 21:26:47.279292] 1 1024 7167 3.00 MiB
proinfo
[2025-05-19 21:26:47.279933] 2 7168 16383 4.50 MiB
PMT
[2025-05-19 21:26:47.280559] 3 16384 17407 512.00 KiB
lk
[2025-05-19 21:26:47.281184] 4 17408 18431 512.00 KiB
lk2
[2025-05-19 21:26:47.281844] 5 18432 51199 16.00 MiB
boot_x
[2025-05-19 21:26:47.282472] 6 51200 86015 17.00 MiB
recovery_x
[2025-05-19 21:26:47.283095] 7 86016 96255 5.00 MiB
tee1
[2025-05-19 21:26:47.283713] 8 96256 106495 5.00 MiB
tee2
[2025-05-19 21:26:47.284368] 9 106496 187391 39.50 MiB
metadata
[2025-05-19 21:26:47.284981] 10 187392 189439 1024.00 KiB
kb
[2025-05-19 21:26:47.285632] 11 189440 191487 1024.00 KiB
dkb
[2025-05-19 21:26:47.286247] 12 191488 192511 512.00 KiB
MISC
[2025-05-19 21:26:47.286856] 13 192512 208895 8.00 MiB
reserved
[2025-05-19 21:26:47.287467] 14 208896 3515391 1.58 GiB
system
[2025-05-19 21:26:47.288084] 15 3515392 4383743 424.00 MiB
cache
[2025-05-19 21:26:47.288700] 16 4383744 30325759 12.37 GiB
userdata
[2025-05-19 21:26:47.289317] 17 30325760 30551039 110.00 MiB
boot
[2025-05-19 21:26:47.290072] 18 30551040 30776319 110.00 MiB
recovery
[2025-05-19 21:26:47.333249]
[2025-05-19 21:26:47.333628] Check boot0
[2025-05-19 21:26:47.576455] Check rpmb
[2025-05-19 21:26:47.786426] Clear preloader header
[8 / 8]
[2025-05-19 21:26:48.276593] Downgrade rpmb
[2025-05-19 21:26:48.278193] Recheck rpmb
[2025-05-19 21:26:49.172808] rpmb downgrade ok
[2025-05-19 21:26:49.173333] Inject payload
[8 / 8]
[962 / 962]
[8 / 8]
[962 / 962]
[2025-05-19 21:27:31.275940] Force recovery
[2025-05-19 21:27:31.613477] Flash preloader header
[4 / 4]
[4 / 4]
[2025-05-19 21:27:32.029189] Reboot

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./fastboot-step.sh
Your device will be reset to factory defaults...
Press Enter to Continue...

< waiting for any device >

^C

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:36:52.994663] Waiting for bootrom
[2025-05-19 21:37:39.909059] Found port = /dev/ttyACM0
[2025-05-19 21:37:39.947854] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

b''
b'\x00\x01'
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 129, in main
load_payload(dev, "../brom-payload/build/payload.bin")
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/load_payload.py", line 123, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 163, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 90, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
^CTraceback (most recent call last):
File "/usr/lib/python3.13/threading.py", line 1540, in _shutdown
_thread_shutdown()
KeyboardInterrupt:
^C

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:38:02.862608] Waiting for bootrom
[2025-05-19 21:38:06.874179] Found port = /dev/ttyACM0
[2025-05-19 21:38:06.874614] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
 File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
'device reports readiness to read but returned no data '
'(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:38:43.022377] Waiting for bootrom
[2025-05-19 21:38:46.533795] Found port = /dev/ttyACM0
[2025-05-19 21:38:46.534268] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
'device reports readiness to read but returned no data '
'(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:40:02.338969] Waiting for bootrom
[2025-05-19 21:40:26.311558] Found port = /dev/ttyACM0
[2025-05-19 21:40:26.311936] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
'device reports readiness to read but returned no data '
'(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:40:35.344036] Waiting for bootrom
[2025-05-19 21:40:37.851398] Found port = /dev/ttyACM0
[2025-05-19 21:40:37.851842] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
'device reports readiness to read but returned no data '
'(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:40:57.832212] Waiting for bootrom
[2025-05-19 21:40:58.585602] Found port = /dev/ttyACM0
[2025-05-19 21:40:58.585926] Handshake

^CTraceback (most recent call last):

File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
 ~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 565, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [],
timeout.time_left())

~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyboardInterrupt

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:41:36.699601] Waiting for bootrom
^X^CTraceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 123, in main
dev.find_device()
~~~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 79, in find_device
time.sleep(0.25)
~~~~~~~~~~^^^^^^
KeyboardInterrupt

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:43:03.661207] Waiting for bootrom
[2025-05-19 21:43:03.915261] Found port = /dev/ttyACM0
[2025-05-19 21:43:03.915735] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
'device reports readiness to read but returned no data '
 '(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:44:47.304881] Waiting for bootrom
[2025-05-19 21:44:54.072314] Found port = /dev/ttyACM0
[2025-05-19 21:44:54.072640] Handshake
^CTraceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 565, in read
ready, _, _ = select.select([self.fd, self.pipe_abort_read_r], [], [],
timeout.time_left())

~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyboardInterrupt

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./brick-9820.sh
Brick preloader to continue via bootrom-exploit? (Type "YES" to continue)
yes

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:45:35.550956] Waiting for bootrom
[2025-05-19 21:45:41.317989] Found port = /dev/ttyACM0
[2025-05-19 21:45:41.318424] Handshake
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 98, in _writeb
return self.dev.read()
~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 595, in read
raise SerialException(
 'device reports readiness to read but returned no data '
'(device disconnected or multiple access on port?)')
serial.serialutil.SerialException: device reports readiness to read but returned no
data (device disconnected or multiple access on port?)

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:45:49.543489] Waiting for bootrom
^CTraceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 123, in main
dev.find_device()
~~~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 79, in find_device
time.sleep(0.25)
~~~~~~~~~~^^^^^^
KeyboardInterrupt

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:45:59.423772] Waiting for bootrom
[2025-05-19 21:46:53.341322] Found port = /dev/ttyACM0
[2025-05-19 21:46:53.380131] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

b''
b'\x00\x01'
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 129, in main
load_payload(dev, "../brom-payload/build/payload.bin")
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/load_payload.py", line 123, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 163, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 90, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:47:18.081294] Waiting for bootrom
[2025-05-19 21:47:28.930187] Found port = /dev/ttyACM0
[2025-05-19 21:47:28.930498] Handshake
^CTraceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 126, in main
handshake(dev)
~~~~~~~~~^^^^^
File "/home/kali/amonet/modules/handshake.py", line 9, in handshake
dev.handshake()
~~~~~~~~~~~~~^^
File "/home/kali/amonet/modules/common.py", line 103, in handshake
c = self._writeb(b'\xa0')
File "/home/kali/amonet/modules/common.py", line 97, in _writeb
self.dev.write(out_str)
~~~~~~~~~~~~~~^^^^^^^^^
File "/usr/lib/python3/dist-packages/serial/serialposix.py", line 640, in write
abort, ready, _ = select.select([self.pipe_abort_write_r], [self.fd], [], None)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyboardInterrupt

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./fastboot-step.sh
Your device will be reset to factory defaults...
Press Enter to Continue...

< waiting for any device >

^C

┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:52:49.567813] Waiting for bootrom
[2025-05-19 21:53:53.686466] Found port = /dev/ttyACM0
[2025-05-19 21:53:53.725296] Handshake

* * * If you have a short attached, remove it now * * *

* * * Press Enter to continue * * *

b''
b'\x00\x01'
Traceback (most recent call last):
File "/home/kali/amonet/modules/main.py", line 256, in <module>
main()
~~~~^^
File "/home/kali/amonet/modules/main.py", line 129, in main
load_payload(dev, "../brom-payload/build/payload.bin")
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/load_payload.py", line 123, in load_payload
dev.write32(0x10007008, 0x1971) # low-level watchdog kick
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 163, in write32
self.check(self.dev.read(2), b'\x00\x01') # arg check
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kali/amonet/modules/common.py", line 90, in check
raise RuntimeError("ERROR: Serial protocol mismatch")
RuntimeError: ERROR: Serial protocol mismatch
┌──(kali㉿kali)-[~/amonet]
└─$ sudo ./bootrom-step-minimal.sh
[2025-05-19 21:54:03.509948] Waiting for bootrom