[Fire HD 6 and 7 General] powerpoint45:
I have spent hours looking for exploits, compiling CVE root exploits via NDK, and finding ways to root and have found no root exploit to work so far. One possibility may revolve around fastboot and/or the Fire update bin files. Here is some info:

update.bin files can be found here: https://www.amazon.com/gp/help/customer/display.html?nodeId=200529680

the update.bin files are jar files and can be modified with most archive managers or over command line, but I believe it will not get past security if you try to update with a modified jar. Plus the updater checks the update version so it does not update an already installed version.

You could add the su binary to /system/xbin but the update will not pass verification...

Error log for attempting to update a modified package is as followed:

I/SystemUpdates( 2175): Verifying sideload file...
I/SystemUpdates( 2175): sideload update lost
E/SystemUpdates( 2175): Verification exception:
E/SystemUpdates( 2175): com.amazon.dcp.ota.OTASideloadExceptionUnrecoverable
E/SystemUpdates( 2175): at com.amazon.dcp.ota.OTAController.throwExceptionOnError(OTAController.java:950)
E/SystemUpdates( 2175): at com.amazon.dcp.ota.OTAController.ensureSideloadCanBeInstalled(OTAController.java:871)
E/SystemUpdates( 2175): at com.amazon.settings.systemupdates.SystemUpdates$3.doInBackground(SystemUpdates.java:194)
E/SystemUpdates( 2175): at com.amazon.settings.systemupdates.SystemUpdates$3.doInBackground(SystemUpdates.java:171)
E/SystemUpdates( 2175): at android.os.AsyncTask$2.call(AsyncTask.java:288)
E/SystemUpdates( 2175): at java.util.concurrent.FutureTask.run(FutureTask.java:237)
E/SystemUpdates( 2175): at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:231)
E/SystemUpdates( 2175): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)
E/SystemUpdates( 2175): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)
E/SystemUpdates( 2175): at java.lang.Thread.run(Thread.java:841)

you get the same error when trying to update with an unmodified file that is the same version as what you are on. So maybe with a downgrade or when the next Fire OS update comes out, we could work something out but I am not exactly sure if it would work.

Here is a listing of the files inside an update.bin:

boot.img file_contexts images META-INF ota.prop recovery system tools

if you grab the boot.img from the update.bin, you can extract the boot.img with unpackbootimg and repackage it with mkbootimg. Tools can be found here: https://code.google.com/p/android-s...il?name=android_bootimg_tools.tar.gz&can=2&q=

when the boot img is unpacked you will see the following files:

boot.img-base boot.img-cmdline boot.img-pagesize boot.img-ramdisk.gz boot.img-zImage

boot.img-ramdisk.gz is the focus as it is a simple gz file containing another file called boot.img-ramdisk which is a cpio file and can be extracted with most archive managers or the command line

Why do I care about the boot image? You can obtain root by modifying lines default.prop inside of boot.img-ramdisk from

ro.adb.secure=1
ro.secure=1

to

ro.adb.secure=0
ro.secure=0

once those lines are modified you should be able to gain root in a shell vi adb entering the command

adb root

then once in a root shell, the su binary could be installed

when modifying the default.prop I tried repackaging it and booting the image using fastboot boot but nothing happens. This is the output. It gets stuck at booting...:

creating boot image - 5369856 bytes
downloading 'boot.img'...
OKAY [ 0.293s]
booting...

even the default unmodified boot.img does not seem to boot with fastboot boot. Could this be due to the locked bootloader? Usually it would give an error message if it was prohibited.

fastboot getvar all
(bootloader)	serialno: 00880807438504J3
(bootloader)	partition-offset:userdata: 86200000
(bootloader)	partition-size:userdata: 31e7fbe00
(bootloader)	partition-type:userdata: unknown
(bootloader)	partition-offset:cache: 4f200000
(bootloader)	partition-size:cache: 37000000
(bootloader)	partition-type:cache: unknown
(bootloader)	partition-offset:system: 4200000
(bootloader)	partition-size:system: 4b000000
(bootloader)	partition-type:system: unknown
(bootloader)	partition-offset:persisbackup: 3200000
(bootloader)	partition-size:persisbackup: 1000000
(bootloader)	partition-type:persisbackup: unknown
(bootloader)	partition-offset:MISC: 3180000
(bootloader)	partition-size:MISC: 80000
(bootloader)	partition-type:MISC: unknown
(bootloader)	partition-offset:DKB: 3080000
(bootloader)	partition-size:DKB: 100000
(bootloader)	partition-type:DKB: unknown
(bootloader)	partition-offset:KB: 2f80000
(bootloader)	partition-size:KB: 100000
(bootloader)	partition-type:KB: unknown
(bootloader)	partition-offset:recovery: 2780000
(bootloader)	partition-size:recovery: 800000
(bootloader)	partition-type:recovery: unknown
(bootloader)	partition-offset:boot: 1f80000
(bootloader)	partition-size:boot: 800000
(bootloader)	partition-type:boot: unknown
(bootloader)	partition-offset:UBOOT: 1f00000
(bootloader)	partition-size:UBOOT: 80000
(bootloader)	partition-type:UBOOT: unknown
(bootloader)	partition-offset:TEE2: 1a00000
(bootloader)	partition-size:TEE2: 500000
(bootloader)	partition-type:TEE2: unknown
(bootloader)	partition-offset:TEE1: 1500000
(bootloader)	partition-size:TEE1: 500000
(bootloader)	partition-type:TEE1: unknown
(bootloader)	partition-offset:PMT: 1100000
(bootloader)	partition-size:PMT: 400000
(bootloader)	partition-type:PMT: unknown
(bootloader)	partition-offset:PRO_INFO: 1008000
(bootloader)	partition-size:PRO_INFO: 20000
(bootloader)	partition-type:PRO_INFO: unknown
(bootloader)	max-download-size: 52429824
(bootloader)	kernel: lk
(bootloader)	product: ARIEL
(bootloader)	version: 0.5
(bootloader)	production: Unknown

Although we know all these things I still think that the best way may to find a local root exploit that works rather than messing with all this... but that is just my opinion. I am currently looking through these exploits but most are too old: http://adbtoolkit.com/rooting/exploits/#.VKDbFAMAI