[Security Discussion] fwuebbel:
I just bought a used fire phone (note that this is rather a general security question, though, so I'm posting it here). Let me say, I am not an experienced user with Android, rather Linux, so I figured that owning a device without root access would not make sense. I realized that kingo root would be the solution to go with, and used it with immediate success. After getting access, I immediately removed the kingo application and several leftovers which are mentioned everywhere, went with super root, and felt safe.

However, I now realize that vital system files have been tampered with at some time in this procedure, among them /system/lib/libc.so, which really makes me nervous. Anyone has a clue? A better description follows.

Since I knew I was going to uninstall kingo root later, I started by saving the current configuration accessible to the shell user for reference via a command line like

./adb shell /data/local/tmp/busybox tar -cvf /sdcard/backup.tar --exclude proc --exclude storage --exclude mnt --exclude sys --exclude dev /

I then downloaded the android version of kingo root, started it, and bingo, it went root. That felt strange. Think of a userland program getting administrator rights on LInux or Windows - people would go berserk. In this case, no one really seems committed to closing this gap. Anyway, I had what I wanted. I saved the current configuration again using the command line above.

I then downloaded the kingoroot removal shellscript from //androidmtk.com/replace-kinguser-with-supersu and more or less followed its removal instructions for kingo root. At some point, you uninstall the kingo app - and it tells you, it will not be able to restore your phone to the old state and might actually brick it. Again, that feels strange, I can hardly think of changes that cannot be undone, unless you don't want to undo them. I then installed supersu via the play store, all went smoothly, and I saved the third configuration with the command line above.

On my Linux desktop, I then extracted all three tarfiles and detected the differences. Of course, those files mentioned everywhere had been added and showed up (like install_recovery.sh and so on). I didn't care too much about these. But there were more. In fact, the differences between the original Android version and the kingoroot-version included vital libraries:

Binary files old/system/lib/libLLVM.so and new/system/lib/libLLVM.so differ

Binary files old/system/lib/libc.so and new/system/lib/libc.so differ

Binary files old/system/lib/libharfbuzz_ng.so and new/system/lib/libharfbuzz_ng.so differ

Binary files old/system/lib/libicuuc.so and new/system/lib/libicuuc.so differ

Binary files old/system/lib/libsqlite.so and new/system/lib/libsqlite.so differ

Comparing the first and third version, after kingoroot deinstallation and superroot installation, shows even more:

Binary files old/system/lib/hw/bluetooth.default.so and newest/system/lib/hw/bluetooth.default.so differ

Binary files old/system/lib/libEGL.so and newest/system/lib/libEGL.so differ

Binary files old/system/lib/libEnsembleEngine.so and newest/system/lib/libEnsembleEngine.so differ

Binary files old/system/lib/libLLVM.so and newest/system/lib/libLLVM.so differ

Binary files old/system/lib/libandroid_runtime.so and newest/system/lib/libandroid_runtime.so differ

Binary files old/system/lib/libc.so and newest/system/lib/libc.so differ

Binary files old/system/lib/libcameraservice.so and newest/system/lib/libcameraservice.so differ

Binary files old/system/lib/libeuclid.so and newest/system/lib/libeuclid.so differ

Binary files old/system/lib/libeuclidogre.so and newest/system/lib/libeuclidogre.so differ

Binary files old/system/lib/libharfbuzz_ng.so and newest/system/lib/libharfbuzz_ng.so differ

Binary files old/system/lib/libicui18n.so and newest/system/lib/libicui18n.so differ

Binary files old/system/lib/libicuuc.so and newest/system/lib/libicuuc.so differ

Binary files old/system/lib/libkinesis_service.so and newest/system/lib/libkinesis_service.so differ

Binary files old/system/lib/libnfc-nci.so and newest/system/lib/libnfc-nci.so differ

Binary files old/system/lib/libodl.so and newest/system/lib/libodl.so differ

Binary files old/system/lib/libsqlite.so and newest/system/lib/libsqlite.so differ

Binary files old/system/lib/libstagefright.so and newest/system/lib/libstagefright.so differ

Only in newest/system/lib: libsupol.so

Binary files old/system/lib/libwebviewchromium.so and newest/system/lib/libwebviewchromium.so differ

Binary files old/system/vendor/lib/libsc-a3xx.so and newest/system/vendor/lib/libsc-a3xx.so differ

And I can confirm, they really differ, I can see the differences byte by byte - meaning that at some point they have been tampered with. Creation and modification times did not change, though.

I have three choices now: An OTA update happened while I did the rooting. Or I really now have system libraries that "someone" (me) installed on my mobile. Honestly, I don't dare restoring the old files, unaware of what might happen. The usual thing I'd do in Linux: copy the old files back, mv -f oldfile newfile. However, there's never a fear of being locked out on a desktop. Or, last chance: I am stupid and lib files just don't look the same when you look at them as an ordinary user at different points in time...

Any advice? Should I overwrite the new versions with the originals? Or is it just "normal" on Android?

Best wishes, Frank