yashsingh1/xdaforums huggingface dataset:
[Fire General] DragonFire1024:
It's all I want really. My new Fire HD 8 just arrived on my doorstep. I'm going to try the steps here before I do anything and see what I come up with.

---------- Post added at 02:16 PM ---------- Previous post was at 02:04 PM ----------

Damn. Didn't work for me :( Still have 3.2.1.

---------- Post added at 02:45 PM ---------- Previous post was at 02:16 PM ----------

And now it's making me update to 5.3.3.0 xD
[Fire General] Rbohannon89:
Please help me!

My Amazon tablet updated to 5.3.3.0 a few days ago while it was asleep. Then I learned there was no way to root it now cause of the updated version. I'm flipping **** did you have any luck on rooting ?
[Fire General] DB126:
See here; root not possible at present: https://xdaforums.com/amazon-fire/d...-5th-gen-supertool-root-t3272695/post72014820
[Fire General] Rbohannon89:
Bloody hell why not what's preventing it? There must be a way.
[Fire General] DB126:
Nothing blocking it; no vulnerabilities have been identified that can be exploited to gain root. Google (and by extension Amazon) are getting pretty good at cleaning up the sloppy coding that allowed easy rooting on previous Android/FireOS builds.
[Fire General] alexjfinch:
Fingers crossed for finding a vulnerability - big thanks to all those guys doing this in their spare time!

I had a 1st generation Kindle Fire and played around with it to make it more of a tablet, sadly I didn't catch the right thread in time for downgrading the 5.3.2.1 and bricked my newer device - thankfully it was only bought a month ago and I was able to exchange it.

Not opened it yet so, but will be this evening so I'll be interested to find out which software version is installed and I've ordered another off eBay - fingers crossed that has an older version.

Just to quickly confirm - if I root and installed a separate ROM on my Kindle, do I need to worry in the future about OTA updates or does it then just become a separate tablet? - I'm essentially converting a relatively cheap device into a more usable tool without breaking the bank.

Thanks

Al
[Fire General] crazyates:
If you are able to gain root, and then use the SuperTool to block OTA updates, then you do not have to worry about the Fire updating itself on you.

If you are able to ROM, then the ROMs do not use Amazon's OTA updates, so it will not update on you.

I rooted and ROM'd my FIre back when 5.1.2 was the current, and I used the Fire Nexus ROM for many months. Now I'm running the newest Fire Nexus ROM, and it's great.
[Fire General] alexjfinch:
Thanks for confirming that for me - essentially I just want to remove the FireOS and install an Android like ROM which is slim enough to run smoothly on the limited resources of the Kindle. We'll see how the next few purchases turn out and if a vulnerability is found in the newer OSs
[Fire General] DB126:
For awareness no one (to my knowledge) is actively seeking vunerabalities and associated exploits on this device and/or FireOS. KingRoot and similar tools simply aggregate previously identified 'hacks' for garden variety Android which FireOS is based upon. The author's efforts are more nefarious than altruistic as a rooted device is a wonderful platform for installing sponsored malware, nagware and other goodies you probably wouldn't voluntarily adopt.
[Fire General] alexjfinch:
Apologies I don't follow - essentially we're hoping that the Kingroot app may find an avenue for root access by chance rather than actually finding one in the newer updates to the OS. Am I also right in thinking, that Kingroot is finding vulnerabilities in other versions of Android that may be applicable to the current and future versions of the FireOS?

Am I right in thinking you can't remove the FireOS and install another OS like CM without root? this is all I'm looking to do - I'm also hoping that earlier versions of the FireOS are coming on the tablets I've ordered.
[Fire General] DB126:
- correct (or unlocking the bootloader which is not possible at present)
[Fire General] alexjfinch:
Has that ever been possible on the later Fires?
[Fire General] crazyates:
It was possible on some of the first versions of FireOS 5, but has not been that way for a very long time.

Some of the earliest devices can/do have TWRP installed, but since they locked the bootloader that is no longer an option.
[Fire General] DB126:
Clarifications:

- to the best of my knowledge 3rd gen HDX were the last Fire devices with a vulnerable bootloader (unlockable via exploit)

- all 5th gen devices enjoy a locked bootloader (woohoo!)

- TWRP can not be "installed" on any 5th gen device; 2015 Fire 7s that arrived with FireOS 5.0.x (and matching bootloader/kernel) could boot a custom recovery environment (eg: TWRP) from fastboot; Amazon blocked this oversight in FireOS 5.1.1 and higher
[Fire General] alexjfinch:
Thanks for letting me know.

Had quite a successful night last night - the Kindle I picked up came with 5.3.1.0 and I was able to gain root access and then use FlashFire to install CM12.

Queue a happy father in law where he can now do what he likes with his tab :)
[Fire General] DB126:
Great! For awareness CM 12.1 is no longer being updated (effectively discontinued). At present Fire Nexus is the only ROM for this device receiving active maintenance. If you are familiar with CM you can achieve the the same/better UI functionality flashing Xposed Framework and GravityBox (or a similar module) along with Nexus.

That said, nothing fundamentally wrong with CM. Just be aware of the current state.
[Fire General] alexjfinch:
Ah I may give that a go later then - at least I know the version of GAPPS and CM12 that I have work with this tab.

Just to clarify, what is Xposed Framework and GravityBox?
[Fire General] DB126:
Nexus has GAaps and SuperSU built-in. Just one zip to flash!

As for Xposed Framework you might find the following helpful/informative: https://www.howtogeek.com/195476/7-...ramework-on-a-rooted-android-phone-or-tablet/
[Fire General] AndroidNoob47:
Not sure if it'll work on the Fire, but Ive always had success using KingORoot even when it said it failed. I would just get into a root shell, install SuperSU then install a rom
[Fire General] DB126:
As long as a custom ROM is being immediately installed the questionable payload and general bad behavior of KingOroot is not a concern.
[Fire General] hasanbd:
LOT CODE at the bottom of the packet below M650 had the chance to be 5.3.1 or less than 5.3.1
[Fire General] TechDad378:
Tech Giant and Marketing Genius made a fortress called 5.3.3.0 which has become difficult to penetrate. Sounds like a predecessor to many future headaches with devices. :(
[Fire General] Ayden7777:
I gave my kindle fire 5th gen to someone else and bought a new tablet. Has anyone tried rooting with kingo root. Just remember to get rid of "Super Battery" and other apps it installs...At least isn't malicious like King Root.
[Fire General] DB126:
I put KingOroot and KingRoot in the same category. Seen reports of devices becoming unstable following KingOroot runs & difficulity removing KingORoot root manager (similar to more recent builds of KingRoot). Given limited experience I'd only considering using KingORoot if it was actually able to root 5.3.2.1 and above.
[Fire General] Ayden7777:
Sure thing, though kingoroot works with Allwinner a33 and a64 devices, if anyone is thinking about buying one of them.
[Fire General] DragonFire1024:
I rooted my XT907 with KingRoot and uninstalled with SuperSU. Though all Root checkers say I have Root, proper Root, some of my root apps won't accept granted SuperUser permissions. So I wonder if I ever had root or not a good one. I never trusted nor liked either of the two, but not many options out there.
[Fire General] alexjfinch:
I'm not really bothered about the behind bit of KingRoot etc - as long as I can get root access and remove FireOS that's all I want to do.

I've got a newer version of KingRoot and crossing all my fingers and toes!
[Fire General] BeeWall:
SuperSU is pretty good, and the dev was trustworthy, although it is yet to be seen how CCT will do. Hopefully they'll do well. I agree about KingRoot though.
[Fire General] Jake1702_:
So which would be a bigger pain to root? 5.3.2.1 or 5.3.3.0 (I still haven't got the update). It's very possible the latter has introduced an exploit. Or it could have patched some that were in 53.2.1 that nobody knew about. We may never know honestly...
[Fire General] DB126:
Unanswerable question. Amazon doesn't release a list of potential vulnerabilities with each new FireOS release.
[Fire General] alexjfinch:
Waiting game unfortunately - I've read somewhere that between certain versions only later ones were where root was able to be achieved but earlier ones weren't.

I suspect its usually when new apps or something are introduced into the FireOS where vulnerabilities are found and root access is achieved through that - although I could be talking complete rubbish!
[Fire General] Jake1702_:
I'm stupid and didn't notice mine updated. I checked and saw it was updated since April 12th. :/

---------- Post added at 07:44 PM ---------- Previous post was at 07:40 PM ----------

This may be a stupid question, but I'll ask anyway.

Would it somehow be possible to create a modified ROM of 5.3.3.0 and "trick" the tablet into thinking it's legit?
[Fire General] Jake1702_:
Ok, but how would the bootloader know the signature if it's an "update" that's newly released?
[Fire General] DB126:
Amazon signs each update with a private key. The bootloader compares this signature with a known value when the ROM starts (over simplified but sufficient for this discussion). If a third party modifies a ROM image the signatures will no longer match. A similar comparative process takes place when the bootloader itself is updated.
[Fire General] savvytechwinner:
The reason that they do these security measures, the exploit patching- is to keep THEM and THEIR money going while keeping the tablet dirt cheap, with a horrendous OS and intrusive ads on lock-screens and making people pay to get rid of them, while special offers still runs in the background- amazon sure knows how to make their consumers and 3rd party devs upset- just so they can keep the price low on the tablet. :(

This is why Amazon is so strict about not messing with THEIR tablet. See the correlation?
[Fire General] DB126:
Thank you for schooling the community with your perspective.

Hardware and software are sold as a package which is positioned as a captive portal to Amazon products and services. If you don't care for this arrangement do not buy the package.

Security measures go well beyond nafarois marketing intentions. Downloaded content (eg: video) must be adequately protected for Amazon to secure rights from distributors. Stand alone DRM is easily circumvented.
[Fire General] crazyates:
This isn't a clear cut answer, and you have to understand the second question to answer the first.

As mentioned, Amazon uses a locked bootloader that will only boot from a signed /boot volume on the device. Change the /boot at all, and the bootloader won't load it. When Amazon comes out with a new update that updates the /boot, it will also update the bootloader to work with that new /boot.

The bootloaders are also versioned, and it will not reflash themselves with an older version, or with a version not signed by Amazon. This is why we can't downgrade from 5.3.2.1 - the bootloader with that version won't work with anything lower, and the bootloader won't downgrade itself to be compatible.

Now that that's out of the way, we can answer your first question. If you were to create a ROM that used a stock /boot volume and a modified /system volume (that was compatible with the stock /boot), it would work, as the bootloader would load the stock /boot and assume that everything else was stock, and it would be fine. This is actually how the Fire Nexus ROM does it (stock /boot, modified /system).

The upside is that you get a true AOSP ROM with no Amazon software anywhere in the ROM, but the downside is that you can't change the /boot at all, which means no custom kernels (although there is a module available that installs to the /system, that enabled a few kernel tweaks) and there is no system-less root available (by nature, a system-less root installs to the /boot, which is impossible on these devices).

This is how Fire Nexus ROM does it, and they have versions using the 5.1.4 and 5.3.2.0 /boot. Even if Fire Nexus ROM were to make a new version using a 5.3.3.0 /boot, there would be no way of installing it, because we don't have root yet on those. In order to get to where we want to be, there are a lot of steps that have to happen, and they have to happen in order.

Hope that helps?
[Fire General] musiclover7:
Anyone know if there are people currently working on rooting 5.3.2.1?? As the device stands, I find it too annoying to be useful, and it sits on a corner of my desk powered off as a paper weight. It was an expensive paper weight as far as they go, but very inexpensive tablet at around 40 bucks. Anyways, if we ever get root on this version, I am happy to start using it again.

Just wondering if anyone knows whether there are people out there currently working on root for this device at this version? I have some skills, but surely none that could help with this, else I would...
[Fire General] DB126:
Seriously doubt there is a focused effort on any version of FireOS. Far more likely a vulnerability in Android 5.x will be discovered/exploited that can be leveraged against existing builds of FireOS until Google or Amazon patches it. Given Lollipop has been in the wild for nearly three years the number of new exploitable vulnerabilities is small. Amazon has also been aggressive patching outstanding issues and fixing flaws in the components they control.
[Fire General] musiclover7:
Well.. dang.. Sorry to hear that. Guess it will remain a paper weight...
[Fire General] DragonFire1024:
Sad to see that's how you feel. I can overlook Amazon's customization with what little workarounds and hacks we're able to use. Do I think there is a team of people working around the clock to root these things? No. But given the fact there is still interest in these things, I'm sure someone somewhere is trying, even if by mistake. If you truly think it's a paperweight, private message me and I'll give you my address so you can ship it to me :D
[Fire General] savvytechwinner:
Maybe we are looking for the wrong thing. Should we then try to find boot loader exploit instead? I'm not holding my breath about it.
[Fire General] DragonFire1024:
I'm not holding my breath for either of them. If 5.4 is already heading to devices, it's going to be a while before anything happens.
[Fire General] DB126:
Good luck with that. A fair bit of talent looked at potential vulnerabilities when 5th gen first arrived and concluded Amazon had done a credible job battening down the hatches. Just like on every other device released since late 2014. Understandably that talent has moved on to more fertile fields.
[Fire General] DragonFire1024:
I've figured out where the platform/firmware certificate codes are. But I can't pull the data using ADB.

adb shell
cd /data/system
ls

Or from a terminal

Xx_xxx@giza:/ $ cd /data/system
Xx_xxx@giza:/data/system $ ls

AIVPermissionsCorrected.txt
AmazonUsageStats
AmazonUsageStats-journal
SYSTEM_LAST_KMSG
amazon_package_flags.xml
appops.xml
arn:aws:remote-config:us-west-2:131913929554:appConfig:aifshut4_ConfigurationCache.db
arn:aws:remote-config:us-west-2:131913929554:appConfig:aifshut4_ConfigurationCache.db-journal
batterystats-checkin.bin
batterystats.bin
batterystats.bin_ext
batterystats.bin_ext_proc
cache
called_pre_boots.dat
chronos_db
compatibility
device_owner.xml
device_policies.xml
device_policies_tmp.xml
dropbox
entropy.dat
fdrw_apks.conf
fixed_schedule_config
framework_atlas.config
ifw
inputmethod
install_sessions
install_sessions.xml
job
last-fstrim
locksettings.db
locksettings.db-shm
locksettings.db-wal
marketplace.conf
ndebugsocket
netpolicy.xml
netstats
package-usage.list
packages.list
packages.xml
password.key
procstats
recent_images
recent_tasks
registered_services
seapp_hash
shared_prefs
smart_schedule_config
ss_history_tracker
sync
uiderrors.txt
usagestats
users
Xx_xxx@giza:/data/system $

Packages.xml is what we need. That contains the hexdump of the DER encoded certificate that Android verifies APKs with.

So I go to adb and usually I can pull files from the system, I just can't write them.

adb root
adb pull /data/system [destination]
Permission denied

I also tried to pull packages.xml alone with the same result.

If the hexdump is the same across all devices, I can just navigate there on my rooted XT907. Anyone want to do the same with their device and see if the codes match?

---------- Post added at 05:46 PM ---------- Previous post was at 05:32 PM ----------

Edit: here's the reference to such

https://android.stackexchange.com/questions/154013/platform-certificate
[Fire General] DragonFire1024:
Moderator Edit:

You appear to have completely missed this vital Forum Rule (you know, the Rules you were asked to read when you signed up):

6. Do not post or request warez.

If a piece of software requires you to pay to use it, then pay for it. We do not accept warez nor do we permit members to request, post, promote or describe ways in which warez, cracks, serial codes or other means of avoiding payment, can be obtained or used. This is a site of developers, i.e. the sort of people who create such software. When you cheat a software developer, you cheat us as a community.

The Rule says it all really - XDA is not the place to suggest ripping Developers off...
[Fire General] DB126:
Referencing that app is a good way to get banned from XDA. Please refrain.
[Fire General] DragonFire1024:
Sorry I had no idea. I truly meant no harm.
[Fire General] DragonFire1024:
How reliable is this? I heard about them in the past. Apparently they just added support for root? I don't believe it. Why? I tried. No root.
[Fire General] savvytechwinner:
I have an idea, I am doing research to at least find a temporary root exploit THAT way we can download TWRP from google play and boot into TWRP recovery from the temp root and flash a new Rom.
[Fire General] DragonFire1024:
That would be great. Ive been trying for a temp root. Even if it's through the emulator. I read some have done that but as soon as the emulator closes, you I lose root. I have a cheap UMX U673C that I just unlocked the bootloader to, however no custom recovery exists. And I've no I idea how to I flash my own recovery and neither TWRP or CWM will allow me to backup. I wish there was a way to use Xposed without root.
[Fire General] DB126:
Lol - that ain't gonna work. Suggest looking through some back posts to get a better understanding of why TWRP can not be installed and/or booted on this device (exception for early devices that had/retained 5.0.x bootloader). Not to mention a generic build of TWRP would likely bork device on first ROM flash attempt.
[Fire General] savvytechwinner:
They made an app you can boot into TWRP if you have root access? Either way couldn't you run FlashFire with Temp root??
[Fire General] DB126:
SuperSU is a FlashFire prerequisite; root itself won't do it. Unlikely you pull that off with a 'soft' (temp) root which rarely works anyhow.

To "boot" TWRP it must: 1) exist in the recovery partition (not possible on this device); or 2) be launchable via fastboot command which is blocked by Amazon.
[Fire General] savvytechwinner:
Makes since- thanks. However, your saying FlashFire will not work on temp root?
[Fire General] DB126:
FlashFire requires SuperSU which likely will not install in a "temp root" scenerio.
[Fire General] savvytechwinner:
What about Flashify?
[Fire General] DB126:
Flashify can not be used to install a ROM. Think we're done here.
[Fire General] Jake1702_:
So after almost a month not using it, and plugging it in today to turn it on, mine has updated to FireOS 5.4.0.0. I'm worried now.
[Fire General] Technocian:
Looks like July 25th there was a KingRoot released version 5.2.1. Did anyone try it on 5.3.2.1 yet?
[Fire General] DB126:
KingRoot works off a cloud database which is continuously updated. The Android client isn't involved in vulnerability assessment beyond setting up the local environment. That said, can't hurt to try.
[Fire General] Jake1702_:
Don't bother. I try whenever a new Kingroot version comes out. It doesn't work.
[Fire General] Technocian:
So did this guy realize he wasn't actually on 5.3.2. 1 or what? He seemed pretty positive he was on the right OS and Kingroot does take multiple tries sometimes. Do we just downgrade and run the crap out of the tool?
[Fire General] DragonFire1024:
The most I get to is 70% but I'm pretty sure that means very little
[Fire General] toresistfatality:
I hope there will be a solution to root the 5.3.2.1 fire some time in the near future... would be soooooo cool
[Fire General] BeeWall:
Nice. If you still have it, can you upload the kmPlugins.zip KingRoot puts in your download folder? I'm curious to see what exactly KingRoot does (I probably won't understand any of it, but I want to see anyway ?)
[Fire General] Mr McBoatface:
I knew there was something I forgot to do ...... just put cm12.1 on it. Will adb reset to 5.1.4 again and redo tomorrow. going to bed now :)
[Fire General] BeeWall:
OK. Thanks! It may not be 5.3.2.1 root, but it's still good!
[Fire General] Mr McBoatface:
Ok couldn't sleep ;) ADB restore and rerooted, needed 2 attempts again. These is no kmPlugins.zip with this edition of kingroot, however there is a kmPlugins.apk.

Forgot to mention earlier to help supertools remove kingroot I removed it from device administrator under the security setting and also under accessibility service setting .

Back to bed now :)
[Fire General] TechDad378:
Will provide you with versions when I can get to pc, as requested. Apologies for delay.
[Fire General] WXSky:
So has anyone been able to repeat this successfully on 5.3.2.1?
[Fire General] BeeWall:
Yeah, nevermind about the kmplugins idea. I just looked in one of those files, and it's just the APK for Purify. Not sure why you have APK and I have zip, but the contents are the same. Thanks though.
[Fire General] TechDad378:
Update...

I deleted all original files and began from square one. As stated in post earlier, I am trying to recreate the environment which caused success. Along the way I always try many unconventional ways to achieve root. I have 2 devices with locked bootloader, a Fire tab and a phone.

Between both devices I try alternate ways to root which allows me to test similar process on both devices. My mistake in the original rooting process was not keeping some sort of documentation.

At the moment root keeps failing around 70%+ when using KingRoot. When I started from square one it was failing around 17%.

It seems the versions of KingRoot does play a role in Rooting the Fire 5th gen. Currently trying to find the proper version with a few uncommon tweaks in order to achieve root again.

TD378
[Fire General] Duke91:
Yeah my fire tab on 5.3.2.1 always reboots at 17% and fails at 70%. I've used both kingroot 4.9.3 and 5.0.3 I believe. I've gave both purify and kingroot full accessibility and the same thing happens every time. Patiently waiting to see your results.
[Fire General] BeeWall:
Same with me. Sometimes, it reboots at 2 and fails at 65. But it still fails.