yashsingh1/xdaforums huggingface dataset:
[Kindle Fire HDX 7" & 8.9" General] tl3:
Besides noticing that the stock kernel has obviously changed, I also took a quick look at the system apps and found the following:

System App Inventory Differences between v13.3.1.0 and v13.3.2.1 for the HDX7 -

Removed:

ATVAndroidBilboClient-release-signed_22080010.apk
UnifiedSearch.odex

Added:

CABLService.apk
UnifiedShareSinaWeiboProxy_320082010.apk
WhisperlinkSdk.apk
com.amazon.avod.apk
com.amazon.communication.discovery.apk

Updated to:

AmazonGamesService_30040110.apk
AudibleForAndroid_1710016310.apk
AudibleStore_1023310.apk
CSApp_300059010.apk
CalendarProvider_310010610.apk
Calendar_310010610.apk
ContactsProvider_320082010.apk
ContactsSyncAdapter_320082010.apk
Contacts_320082010.apk
CrashManager-2054510.apk
DeskClock_55955910.apk
Email_310010610.apk
FacebookContactsSyncAdapter_320082010.apk
GoodreadsOnKindleTablet-1010210.apk
KindleConnect_1320000410.apk
KindleFireDeviceControls_1.0.86.2-release-signed.apk
KindleForAmazonTablet_1176493710.apk
Launcher-release-signed_82046410.apk
LegalNotices_1.0.31.0-release-signed.apk
LogManager-1045910.apk
MShopAndroidWindowshopKindleGen6Client-108461010-signed.apk
MetricsApi-2037410.apk
MetricsService-2055410.apk
ParentalControlsGen6_1.0.8.6-release-signed.apk
Photos_8009510.apk
SocialPlatform_320082010.apk
UnifiedSearch_1000011510.apk
UnifiedShareActivityChooser_320082010.apk
UnifiedShareFacebookProxy_320082010.apk
UnifiedShareTwitterProxy_320082010.apk
ZicoClient-release-signed_123000510.apk
amazonmp3_4021210.apk
com.amazon.cloud9-platform_38038210.apk
com.amazon.cloud9.systembrowserprovider-platform_38003110.apk
com.amazon.dataplanmanager-release-signed_3000510.apk
com.amazon.imp_120039810.apk
com.amazon.kindle.cms-service_29415910.apk
com.amazon.webapp-platform_2000253810.apk

Changed:

AmazonWebViewLib.apk
Amazon_Apps.apk
Camera.apk
RdmDeviceAdmin-release-signed.apk
WhisperplayActivityView.apk
WhisperplayCDSSettings.apk
WhisperplayCore.apk
WhisperplayQCSource.apk
dtcp_apk-release-signed.apk

There are likely more changes that are missed by this cursory assessment of the System apps inventory. Not sure if this would be of any use but FYI.
[Kindle Fire HDX 7" & 8.9" General] H0B0onDRUGS2:
Opening up the Safestrap ver 3.70 app on my Kindle HDX 7", 13.3.2.1 version now, the current "State" changed and now says the following: "State: Not Rooted" and "Safe System: Not Active" so it seems to have blocked access to going back and booting any backups made with Safestrap.

Using a ES File Explorer app where the Root Explorer option/button is located was left ON.

I tapped it to turn it OFF and turn it back ON. The error message of "Sorry, test failed. This feature cannot run on your device." pops up and now the button is left OFF (it did not change back to ON).

I'm going to assume that when I rooted my Fire HDX in the past with the 13.3.1.0 firmware version on it, and it randomly updated midway of using it [today], the update blocked my Kindle HDX from being rooted the old way.

Since it seems like this happened today to a lot of people, I hope my input/findings are of any help to give an idea of what we're dealing with, and how to re-root our devices.

**Also if anyone knows much about Safestrap, if we made a Backup of our device when it was running the 13.3.1.0 firmware version with Safestrap, could there be anyway of recovering it and replacing our current firmware, turn off our WiFi, and then block our HDX from auto-updating by renaming the otacerts.zip to otacerts.zip.old in /etc/security/? And on booting up the HDX, Safestrap does not load first and give us the option of choosing Recovery Mode or the Continue option anymore. Instead the Kindle Fire grey screen appears, and then the Kindle Fire color screen appears. Then the device continues to run the updated version and denies using the Safestrap app in recovery mode since we no longer have root access to run it.

Please someone help us with our devices that auto-updated, and those of us that didn't block our device from auto-updating. There has to be a way around it.
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
Once the stock rom is updated you can't go back. Only for rom slots can you restore with root but now it seems like if it updates in a rom slot it updates stock. So this may make our reason for even backing up the stock meaning less when it comes to blocking ota updates.
[Kindle Fire HDX 7" & 8.9" General] H0B0onDRUGS2:
I'm not sure mentioning that I chose to run on stock instead of running on a rom partition helps explain this further. I did so because the rom partitions were limited to 4GB on my device instead of using all the space I had available to drop files into and use. I was explained that "partition is king" when it comes to usable space when making them.
[Kindle Fire HDX 7" & 8.9" General] Demonoid111:
Looks like Amazon patched up the Vroot exploit too.

Previously, we were also able to root with that exploit. :P

---------- Post added at 05:35 PM ---------- Previous post was at 05:26 PM ----------

Had to do a factory reset.

My device started to act wonky after the update. A ton of apps were broken and apparently my entire data partition was screwed up (what?) as it wouldn't let me install any applications. I did an adb backup to restore everything right after smoothly. :)
[Kindle Fire HDX 7" & 8.9" General] improvius:
Going back to airplane mode...
[Kindle Fire HDX 7" & 8.9" General] H0B0onDRUGS2:
Did selecting Reset to Factory Defaults put your firmware back to 13.3.1.0? It mentions that it will reset to factory defaults by removing all personal info, Amazon account info, download content, and apps. I can't seem to search and find any mention of the Reset tool helping reverse firmware back to factory (13.3.1.0 on my device).

**Edit: Tested it for those wondering as well. Reset to Factory Defaults left 13.3.2.1 firmware on it still. Just need to wait I guess to find any way of re-rooting my Kindle HDX
[Kindle Fire HDX 7" & 8.9" General] Wrw311:
Just got home and checked mine. I'm running off a rom slot and using the xposed method to get both Appstores working. It hasn't checked for an update since February 5th, which I believe is when I installed it. So I was not updated but did not click to see if it would manually check for an update or not.
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
You can't. The bootloader or kernel needs to be cracked I believe.
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
Vroot. Bull! The guy who made that post said they found a different hole then what jcase posted. They (more then likely) used the same exploit.
[Kindle Fire HDX 7" & 8.9" General] R1Mike:
I'm running stock and just manually clicked updated to see if it would try and got "Last update failed". I have the following implemented:

Android Firewall enabled with iptables in custom script

I renamed otacerts.zip to otacerts.zip.old in /etc/security/

I renamed com.amazon.dcp.apk to com.amazon.dcp.apk.old in /system/app/

And, I'm now turning airplane mode on.
[Kindle Fire HDX 7" & 8.9" General] Maverick777:
I just got home to check my HDX 8.9. I'm running on Rom Slot 1. I'm still rooted. My stock rom had Android Firewall setup to block the iptables, but I'm too nervous to check it.
[Kindle Fire HDX 7" & 8.9" General] Wrw311:
I didn't rename anything and don't have firewall enabled, I guess there's a chance that it just hasn't triggered to update but my kindle hadn't tried to check since February 5th
[Kindle Fire HDX 7" & 8.9" General] R1Mike:
Sounds like it's a good thing for some of us on when our Kindles last checked. Mine was February 11th.
[Kindle Fire HDX 7" & 8.9" General] gqukyo:
I have a ton of wakelocks from Amazon Communication Services. Not sure if it's trying to phone home. Last update check for me was on 1/25. I'm on a safetrap slot and I do have android firewall with the custom script.
[Kindle Fire HDX 7" & 8.9" General] lionking2k:
I'm just having the following implementation:

- Cpasjuste's HDXposed app

- Renamed otacerts.zip to otacerts.zip.old in /etc/security/

- Renamed com.amazon.dcp.apk to com.amazon.dcp.apk.old in /system/app/

and no update whatsoever has happened since Jan 24th. I think the date is just the date when I did the above modification and nothing happen since then. I'm still running on the Rom-slot not have the gut to test it the stock Rom yet :silly:
[Kindle Fire HDX 7" & 8.9" General] BobJayJr:
Mine hasn't updated since 12/25. The update is sitting in my Download file but hasn't executed. My system partition probably didn't have enough space for the update to execute.
[Kindle Fire HDX 7" & 8.9" General] CmdrCrichton:
Just got got home and checked mine. I'm cpasjuste's thor gapps with Xposed on Rom slot 1 on my 8.9 hdx and I'm still rooted and nothing has changed. Last check was Feb. 2nd.
[Kindle Fire HDX 7" & 8.9" General] Clarke33:
When using Android firewall, is the script the same on the 8.9 as the 7?
[Kindle Fire HDX 7" & 8.9" General] Cpasjuste:
I think my xposed mod update "hack" just stop the update service to load in the background but do not prevent a manual update maybe. Or maybe it's just not suffisant as there where no update when I developed it. I'll try to take a look today.

"Envoyé depuis mon KFTHWI avec Tapatalk"
[Kindle Fire HDX 7" & 8.9" General] PariahNine:
I have Safestrap and the HDXposed module installed. I'm still rooted and running fine.
[Kindle Fire HDX 7" & 8.9" General] R1Mike:
So the update file is in the Download folder. I don't see one on mine. Good. What is the name of the file so that I can keep an eye out for it and delete it should I see it?
[Kindle Fire HDX 7" & 8.9" General] Sandwitches:
So, how are you guys renaming otacerts.zip and com.amazon.dcp.apk? Whenever I try to do it, it tells me that the task fails.
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
You need the right permissions to rename the files using ES File Manager. And You need to edit it in your stock rom.

otacerts.zip to otacerts.zip.old in /etc/security/

com.amazon.dcp.apk to com.amazon.dcp.apk.old in /system/app/

Select the app or file then click more then Properties. Next click Change next to Permissions. Next select all boxes under write then hit ok. Then rename it.

fwi- I'm not running iptables on my rom slot. I use it on my stock but I don't use it on my slot.

So it seems one of these files are blocking the update.

I'm pretty sure that com.amazon.dcp.apk is the main thing behind the ota updates.

Are there any other secret apps that push ota updates?
[Kindle Fire HDX 7" & 8.9" General] tl3:
If the Amazon procedure for a manual install is any indication, the downloaded update bin file (update-kindle-13.3.2.1_user_321093620.bin) should probably be located in the root directory of Kindle's 'Internal storage'. Thus, might want to monitor the root directory too... FYI.
[Kindle Fire HDX 7" & 8.9" General] nullstring2:
son of a *****. I swear I had the firewall rules enabled, but somehow this update still got applied.

safestrap just appears to be gone (???) and I am no longer rooted. :(

seriously wtf :(

version 13.3.2.1 installed. I think I am going to go try to return it to staples. Technically, I think yesterday was my last day, but hopefully they let it slide.

EDIT: returned. I'll pick up another one next time they go on sale again.
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
Just FYI, if you install the HDXposed module & root in the stock rom slot before installing safestrap & then root & also install HDXposed on the working rom slot, it seems it will not update.

I do not have anything else installed or renamed & I was running a different workaround before the last few day, so I only now installed HDXposed. At any rate, with bot slots rooted & HDXposed active in both slots, I have nto received the update & manually checking for it, it fails to download.

Also, you can stop updates simply by making the build.prop reflect a newer version, i.e changing the version to reflect one number higher. Similar to the modification made to reflash the same image when restoring to stock, where you change four numbers, i.e.

ro.build.version.incremental=14.3.2.1_user_321093620 - chnaged to this number or greater, as in 14.3.2.1_user_32109362

1

ro.build.version.number=321093620 - changed to 32109362

1

Just make sure the build number matches everywhere as it did before, so the fingerprint as well.
[Kindle Fire HDX 7" & 8.9" General] Sandwitches:
EDIT: WOW I was being stupid. You had it right there and I was too dense to catch it. thanks for the help.
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
If someone that UPDATED ALREADY can DL the attached file & do the following:

adb push kindleexploit /data/local/tmp/

adb shell chmod 755 /data/local/tmp/kindleexploit

adb shell /data/local/tmp/kindleexploit -c "/system/bin/id"

Send me the results & we can figure out the new address, if it exists, for the new kernel. That will make a modified exploit easy.
[Kindle Fire HDX 7" & 8.9" General] spersich:
First time posting. I am stock, rooted, HDX xposed module, iptables, and I renamed otacerts and com.amazon.dcp.apk despite the warning against renaming system file without safestrap or rom slot. When checking update status, it indicates last update failed. My device seems to be working fine in both Nova launcher and stock launcher.
[Kindle Fire HDX 7" & 8.9" General] wc4usa:
no issues yet using Android Cowboy's rom

Running the Rom that Android Cowboy posted in his video tutorial (on my HDX 7). Everything from both Amazon and Google works fine. Kindle is registered and also has no issues with Play Store, etc. No update activity in the stock download mgr., no trace of a bin file, device setting shows last checked Feb. 7 and still have the original version I rooted , and no "update failed" or any other signs of change whatsoever. I use the HDX every day with wireless on for extended periods.

I did change the com.Amazon.doc.apk filename but am not running a firewall.

EDIT: Added Android Firewall to block suggested ip addresses -- to be safe.
[Kindle Fire HDX 7" & 8.9" General] R1Mike:
Will do.
[Kindle Fire HDX 7" & 8.9" General] improvius:
Was the firewall the only thing you did, or did you also rename otacerts.zip and com.amazon.dcp.apk?
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
I think com.amazon.dcp.apk is pushing the updates but to be safe rename both. You don't need to use iptables but I do on my stock rom.

[Q] Does rename otacerts.zip and com.amazon.dcp.apk effect stock amazon apps working right?
[Kindle Fire HDX 7" & 8.9" General] Cpasjuste:
Yes I think its what I'm hooking with xposed. Need to upload sources by the way.

"Envoyé depuis mon KFTHWI avec Tapatalk"
[Kindle Fire HDX 7" & 8.9" General] gqukyo:
I did so much mucking around with trying to get both Amazon and Gapps working, I don't remember the order or the amount of things I've tried. I do know that using my stock Rom in a rom slot with hdxposed installed, mine doesn't update and when I check for updates, it comes back stating no updates available. I did have the android firewall custom script on but Amazon Communications Services it's wakelocking my HDX7 so I disable the firewall script and tried to check for updates and it came back with no updates again. I'm hoping the stupid wakelock is because it was constantly trying to check for updates. Freezing it with Titanium backup didn't do anything.
[Kindle Fire HDX 7" & 8.9" General] nullstring2:
Only had the firewall setup. That was the only thing mentioned in root thread when I had originally applied it.
[Kindle Fire HDX 7" & 8.9" General] holeshot77:
On Rom slot 1 and just the exposed module...no update. :)
[Kindle Fire HDX 7" & 8.9" General] quantump8:
I have root, safe strap, and Cpasjuste's HDXposed module and no update for me. If I manually check, it says device is up to date.

Also, am running on stock rom slot.
[Kindle Fire HDX 7" & 8.9" General] Clarke33:
Same here on a 8.9

---------- Post added at 10:22 PM ---------- Previous post was at 10:17 PM ----------

Disregard my post above. This is the post I meant to quote.
[Kindle Fire HDX 7" & 8.9" General] bravomail:
Take all precautions and Apply Rules in FW

I had only Firewall rules based on IPTables from root guide.

No update happened.

But Android FW is a peculiar piece of software.

In order for it to work you gotta hit "Apply rules".

Otherwise nothing happens.

After reading horror stories of upgrade I proceeded with:

- Xposed framework module of Cpasjuste

- renamed dcp.apk and set its permissions to 000 (don't remember exact name of file - look it up in thread)

- renamed otacerts.zip and set its permissions to 000

- edited build.prop and set build number everywhere (except market fingerprint) to 9 as first digit

Result:

- my build number is 14.3.9.xxxx_99999

- I'm reported as up to date when I try to hit Software update (there is also small fail message, but no FC)

:laugh:
[Kindle Fire HDX 7" & 8.9" General] hisee:
Can u share. That Xposed framework
[Kindle Fire HDX 7" & 8.9" General] kschang:
http://xdaforums.com/showthread.php?t=2577826
[Kindle Fire HDX 7" & 8.9" General] holeshot77:
My wife's kindle 8.9 just updated(non rooted etc). Mine still says up to date and no update found.
[Kindle Fire HDX 7" & 8.9" General] holeshot77:
Well..it happened..mine is updating.. bah..the root world is going to be gone!! LoL
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
If you boot using safestrap to recovery, it will overwrite the recovery & as long as you do it before rebooting, it will stick. Then you can flash the oem zip from Hashcode, followed by chainfires SuperSU & all is good again!

Everything works again for me. It seems Amazon doesn't blocked recovery installs until after the second boot.
[Kindle Fire HDX 7" & 8.9" General] davekaz:
I think the key is as look as your running all the goodies on stock your ok
[Kindle Fire HDX 7" & 8.9" General] iksel:
After update?
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
What after update?

If you DO NOT REBOOT, you can recover safestrap recovery & root access. If you panic & reboot, then you are stuck waiting for another fix or exploit. I do have one in the works, that is actually even easier than jcase's firsr exploit. It just takes advantage of the sloppy nature Amazon uses to update.
[Kindle Fire HDX 7" & 8.9" General] Tomen8r:
I installed just *14.zip and Android firewall and rec'd update recently. I didn't reboot. Not sure if tablet auto rebooted. I lost root. Lost play store. But most other Google apps still work. Gmail app DID not work after rooting but Amazon update FIXED GMAIL APP, which I a psyched about. Works as expected now

I didn't block everything AMazon with firewall as I use a lot of their stuff. I guessed which stuff to block. I didnt install safestrap or xposed and I didn't rename any files. Just the initial *14.zip, gapps and Android firewall.
[Kindle Fire HDX 7" & 8.9" General] dorpmuller:
I'd tossed my HDX aside for awhile as not useful w/o Google, etc. After seeing this thread I got it out again and followed this recipe; in addition I installed the xposed fix. Then I followed the Cowboy hack to get gapps installed.

You folks here are great! Everything works! I owe this group the world for the info I've found here. Youtube works and takes my login, Play store works normally, Nova works fine, wallpaper and widgets work, and I installed Calengoo so I'd get Google sync. And I just tried a manual update and it failed, so right now I'm elated! Couldn't be happier right now... many thanks everyone!

Rich
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
If you didn't reboot & you were rooted, try installing SafeStrap. It should work. It does not auto reboot the second time, it leaves it to you to do it.
[Kindle Fire HDX 7" & 8.9" General] kenmoini:
Interesting, what's the vector for your exploit and how's Amazon doing their updating procedures? I'm wondering if you're trying to exploit the Amazon update process, maybe we could formulate our own exploited update based off the files Amazon provides and then have it flash an open bootloader/root exploit... :highfive:
[Kindle Fire HDX 7" & 8.9" General] Tomen8r:
Thanks GSLEON3,

But the device was already rebooted and unrooted. Most Google apps still work except gapps and google play movies. Youtube works, GMail finally works and Google drive works. I still have safestrap is installed but unusable, as expected. BusyBox and SU can't find their binaries, as expected. I agree with your frustration but I am positive this device will be eventually exploited. I am looking forward to Nexus 8 as well, if it is indeed a real device! Thanks again.
[Kindle Fire HDX 7" & 8.9" General] Bamseline:
Still updating, firewall is no protection.

Asked me the same. Got my HDX 7" yesterday. Its rooted, has SU, Adroid Firewall installed and configured with IPs (72.21.194.208, 176.32.195.233, 72.21.195.233) and should block everything - BUT: It's still updating!! I saw the download progress in the system menu and shut down the device before it's finished.

Fortunately I've made an backup with safestrap and could restore the backuped 13.3.1. Version to the ROM Slot I made. Now I am in flight mode.

Will the xposed module work?

Edit:

I have totally deleted the ROM slot, created a new one and restored the backuped Version I made BEFORE the download of the update has started. When I have a look in the system menu there is still the entry "Download update stopped" It will procede when I go online.
[Kindle Fire HDX 7" & 8.9" General] glimmer00:
Did you try renaming the system app /system/apps/ com.amazon.dcp.apk to something else? Mine has a .bak on it now. I believe that app is responsible for the updates. After doing that I can goto device menu in settings and check for the update and it fails. I've also got the firewall in Whitelist mode with only the amazon apps I want enabled. Finally, I moved the otacerts file( search this forum for location).

Not sure any of this will work for an in progress download, or even if it will hurt things, just stuff to look into. I think I heard the updates go to /cache but have not been able to confirm(no update yet).
[Kindle Fire HDX 7" & 8.9" General] GSLEON3:
Bottom line. If you are using SafeStrap, in a ROM Slot & rooted when you get the update, just re-install safestarp apk & select the "Install Recovery" option.

Occasionally, the update will install the new boot.img, which will cause a black screen, but if you reboot into safestrap & then reinstall the entire 14.3.1.0 build, NOT Hashcodes version, but the unmodified bin (changed to have zip extension) with the kernel & everything else, you are back & running.

The update CANNOT update everything if you are in a rom-slot. It is impossible. That's why if re-install safestrap, 75% of the time it will still show as active. If it is still active, you can still reboot into the SS recovery (twrp). Otherwise, you just re-install the recovery, so all the SS files are restored & then you can reboot & reflash. The only way this update kicks you off root & fully updates you is if you uninstalled SafeStrap or are running in the STOCK slot.
[Kindle Fire HDX 7" & 8.9" General] Faznx92:
Is it safe to push a new general build.prop for the device? I may use it in my hdx utility application.

My current build.prop:

ro.build.version.incremental=13.3.1.0_user_310079820

ro.build.version.number=310079820
[Kindle Fire HDX 7" & 8.9" General] mech_supernova:
yes it will but if you edit the build.prop to make the device think its at the current version it will kill the update in its tracks, thats what I did. mine actually showes its current version as 13.3.2.1_user_321093620 but im still rooted

if you need help i'll tell you what all fields to change.
[Kindle Fire HDX 7" & 8.9" General] Bamseline:
Thanks a lot, but unfortunately I was unaware for a short moment and the update is installed. I lost root. I have to wait till the update is no problem for rooting any more. It's a pitty I never tried to develop with and for Android devices, so I am no help.

But also without root I was able to install most of the gApps as described by Androidcowboy. I installed the 1 mobile market as apk and could install a lot of my old apps which are not supportet by Amazon. GMail and Google Calendar is running, Google Music as well. Only PlayStore is not working and causes some times error statements.