yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] retyre:
The 2017 HD 10 is the only Fire tablet I have access to. These are the other exploits the doctor downloads (if the one in the OP fails; it usually doesn't fail on the 2017 HD 10, but one can manually delete files in /system to force it to fail): 6301805.zip, 21486085.zip, 1805PXN.zip, 7083636.zip.

Try each .zip, repeating the steps in the OP. See the OP for the output that should be generated when you execute the files in 20165195.zip.

Keep in mind that many of these CVE are years old and have been patched (or so they claim). For some reason, the 2017 HD 10 is still vulnerable.
[Fire HD 8 and HD 10 General] najoor:
Thanks for the post. I already rooted using the kingoroot method in the other thread, otherwise I would try this. One question though, after following that other root method I am stuck with having to set the supersu access mode to "Grant" which honestly bugs me. Had I followed your guide would I have been able to set the access mode to "Prompt"?

Oh one more thing, we cannot flash custom recovery on this device right? locked bootloader and all?
[Fire HD 8 and HD 10 General] Ganakim:
Getting access denied

I've followed the steps so far, but when I'm supposed to run the matrix command, it immediately tells me it can't access something... According to the ls above, it's not there, so it's not surprising it can't access it. I'm not sure what I'm missing
[Fire HD 8 and HD 10 General] Leon298:
Works Great through Linux

Confirmed to work on Fire HD 10 5.3.7.0 (650601220)

Used through linux as it's super simple

noob guide ~~(Because i'm board)~~ open a terminal (Ctrl+Alt+T) and run these 3 cmds [Credits to @ k4y0z]

sudo apt update

sudo add-apt-repository universe

sudo apt install python3 python3-serial adb fastboot dos2unix

this installs adb and everything you need to connect to the fire device. to use adb simply enter

adb shell

and your golden. follow the guide
[Fire HD 8 and HD 10 General] cgf:
Works great. Thanks!

I thought I was stuck with the suboptimal wait-five-second behavior with the launcher hijack package and the new FireOS 5.3.7.0. But, this technique for rooting worked perfectly so I can now disable the FireOS launcher and enable an Android launcher via su.

Thanks for the time and effort it took to researching this and for documenting it so well.

What a relief to just see a normal Android home screen!

Now, I have to wonder if I want to install Lineage OS for the complete experience...
[Fire HD 8 and HD 10 General] Avishay.a:
Hi,

I followed all the steps until I got the result:

Code:

[*] exploited 0x7f83021000=f97cff8c

end!!!!!!!

<WSRoot><Exploit>0</Exploit></WSRoot>

<WSRoot><Done>0</Done></WSRoot>

After, I used su command and got to a root shell.

I Installed SuperSU, updated binary as Normal, rebooted.

Though, I do not get a prompt to set SuperSU to Grant. Moreover, when I check with Root Checker I get that there's no root.

Any advice would be highly appreciated!
[Fire HD 8 and HD 10 General] Yucieue:
Hi, I got the following error at the Matrix step:

shell@suez:/data/local/tmp $ ./Matrix /data/local/tmp 2

./Matrix /data/local/tmp 2

<WSRoot><Command>0</Command></WSRoot>

Can not access /data/local/tmp/su

<WSRoot><InitResource>0x00000154</InitResource></WSRoot>

1|shell@suez:/data/local/tmp $

Apparently I cannot access /data/local/tmp/su

Any idea how to fix? Thanks in advance.
[Fire HD 8 and HD 10 General] kapsi3980:
hi experts,

I have finally given up searching rooting method for my fire HD 8 5th gen but fir OS is 5.3.6.4. Can someone guide me to remove all Amazon stuff from it and install android. Please help
[Fire HD 8 and HD 10 General] Beltar89:
Could you explain a little bit more?

Did you use files from first post? I have the same version but cannot get root yet.

regards

Beltar

Edit: Done, it works after hard reset
[Fire HD 8 and HD 10 General] smithbill:
Anyone know if this process to obtain root would actually work on a Fire HD 10 (suez) on Fire OS 5.6.7.0 (657612420) ?
[Fire HD 8 and HD 10 General] thomas_-_s:
Today tried the mentioned steps on my HD 10 2017 7th gen with 5.6.7.0 and it worked without any issues.
[Fire HD 8 and HD 10 General] TuaMadreHaUnNomeUnico:
Also, here it says it works for 5.6.8.0 too.

I need to try 🤞🏼
[Fire HD 8 and HD 10 General] KingLeaf:
I can't get this to work on 5.6.8.0.

After getting root access and installing SuperSU and updating the binary, I'm not getting the pop-up to grand SuperSu access and root no longer works.

I've tried like 10 times and still no luck here.
[Fire HD 8 and HD 10 General] HolyDonus:
how important is that last step? I was able to follow your guide and got my device rooted, but I couldn't delete com.wondershare.DashRoot or wondershare

it said I have no permission, I think
[Fire HD 8 and HD 10 General] Michajin:
If you have root and want to fully unlock it is not important. It is just removing the garbage installed with the kingoroot. If you have full root access you should work on the full unlock and install magisk for root.... Unlocking and magisk work so much better.
[Fire HD 8 and HD 10 General] HolyDonus:
I'm very confused by your post^

there is no Kingoroot by using the method in this thread, or am I mistaken? I have followed every step in this guide, so I have it rooted and SuperUser installed - why would I install Magisk now?

the only thing not working was that last step, as mentioned in my initial post
[Fire HD 8 and HD 10 General] Michajin:
Ok, there were a few options in the OP... Magisk can be hidden from apps that detect root and add modules and is still being supported. Unlocking gives you the option to install custom roms and make back-ups. If you have root access and that is all you want, likely you are good to go. The wondershare looked like adware to me...
[Fire HD 8 and HD 10 General] JJ2017:
Can confirm still working (y)

Just rooted a device with Fire OS 5.6.8.0 (659656820).

Did have to repeat it a couple of times though - got root on 3rd attempt.

Amazed still working after all this time!

Brilliant exploit, many thanks to the OP.
[Fire HD 8 and HD 10 General] DJWatson:
Looks like the files are offline, could someone resupply them ? Would want to try it on FireOS 5.6.9.0.
[Fire HD 8 and HD 10 General] Barron Arrow:
I found these instructions based on this guide, all of the file links still work https://github.com/3ch01c/3ch01c.github.io/blob/master/docs/how-to-setup-amazon-fire-hd10.md
[Fire HD 8 and HD 10 General] Barron Arrow:
This method worked for me to get basic root with SuperSu. I've been trying figure out how to install a custom ROM. How do I install Magisk and get full unlock?
[Fire HD 8 and HD 10 General] Barron Arrow:
I installed Magisk app, updated the app and then ran the install Magisk. Magisk prompted to restart the tablet, now I am stuck in a boot loop and do not know what to do next. Do you have any suggestions?
[Fire HD 8 and HD 10 General] sga999:
I had this problem a while back with newer magisk versions. I have not tried lately, so I did not know the problem was still there. I wonder why it has not been addressed by now.

I'll give a link to one of my posts in another thread. You can go into recovery using buttons and restore an older magisk version. Again, I have not been flashing anything on this device in a long time, so I hope it still works.

Post in thread '[UNLOCK][ROOT][TWRP][UNBRICK] Fire HD 10 2017 (suez)'

https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-10-2017-suez.3913639/post-84306245

EDIT: That link may be confusing. It's post 1326 in that thread.
[Fire HD 8 and HD 10 General] digixmax:
Did you try and get this to work on FireOS 5.6.9.0?
[Fire HD 8 and HD 10 General] fasnis:
Has anyone find out how to root Fire HD 10 2017 with Fire OS 5.7.0?
[Fire HD 8 and HD 10 General] Markus_W:
I've tried to root my FIRE HD10 207 OS 5.7.0.0 but I receive the following failure, do someone know whats the issue?

shell@suez:/data/local/tmp/20165195 $ ./Matrix /data/local/tmp 2

<WSRoot><Command>0</Command></WSRoot>

Can not access /data/local/tmp/fileWork

<WSRoot><InitResource>0x00000140</InitResource></WSRoot>

1|shell@suez:/data/local/tmp/20165195 $

thanks Markus
[Fire HD 8 and HD 10 General] retyre:
That's a "SuperSU in FireOS" issue that many (all?) of these Fire tablets suffer from. If there's a version of SuperSU that doesn't suffer from this, I don't know about it. I have been thinking about starting with an already-configured supersu.cfg (/data/data/eu.chainfire.supersu/files/supersu.cfg) from another device and editing the file to add manual entries for the apps on the HD 10 that need root access. SuperSU can then be set to Prompt (which equals Deny for this device).

ETA: Changing supersu.cfg does nothing. Instead, edit /data/data/eu.chainfire.supersu/shared_prefs/eu.chainfire.supersu_preferences.xml.

Correct on the locked bootloader and custom recovery. There's a way to get FlashFire working with Xposed, but it's a version of FlashFire from when Reagan was POTUS.
[Fire HD 8 and HD 10 General] bibikalka:
This file has the following format:

...
[eu.chainfire.flash]
uid=94
access=1
...

Now, getting app names is very easy. But how would one get "uid" value ?

It seems it was Obama :D But let's be thankful that at least the old versions are working to some extent, as opposed to none!
[Fire HD 8 and HD 10 General] retyre:
Run this as root:

dumpsys package eu.chainfire.flash

You will find "userId" in that text dump.

I edited my post to note that editing supersu.cfg does not help. You will have to edit eu.chainfire.supersu_preferences.xml. See this new thread for details.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
I have a couple of rooted Fire 7 (2015) tablets. SuperSU prompts when apps ask for root access correctly. You can also upgrade the software (keeping root) by flashing the update file and SuperSU zip with the current version of Flashfire. I am not sure about the Fire HD8 (2016). I have one but by the time the root method had become available, mine had already updated to a non-rootable version.
[Fire HD 8 and HD 10 General] Wall.swe:
Question

Is this way of rooting safer than the kingo way? Will this root work on 5.6.0.1?
[Fire HD 8 and HD 10 General] sga999:
retyre, I'm trying to do the offline Kingo root method that you described in post 10. But I'm unable to get the kingo file. That's the most important one! Every other file that you mention appears to get copied.

While running Kingo Root on the PC, I'm positioned at /data/local while in a command window, and I issue:

cp tmp/* /sdcard/k.

Do I have to issue this copy at the "perfect time" to get the kingo file? I have done it at various times, like at 81% and 97% and results are the same.

Another thing to note is that I'm already on 5.6.0.1. And already rooted. So I'm not starting off with sideload, etc. I just wanted to get the files that I can possibly use offline later, when I may need them. Could this be the problem?

I know you did not want to place the files anywhere. But do you have any other idea of how I can obtain this one file? Thanks for the great work!

EDIT: If you can tell me the size of Kingo, that might help me. As you did, I'm trying to associate the kingo file with one in the Kingo Root\files folder on the PC.
[Fire HD 8 and HD 10 General] retyre:
I edited your post to make it easier to reply.

1. Position yourself at /data/local/tmp and run ls -al every second or two like your life depends on it.

2. The "perfect" time lasts about 30 seconds, IIRC. The files are copied over adb and then decrypted in some manner (the files on the PC help with matching, but they cannot be used directly; I think each is 4 bytes short) before the kingo binary is run. Running the binary takes about 30 seconds (after which /data/local/tmp is wiped). This is the time to copy.

3. Don't think so (assuming you're rerooting using the PC app).

4. Try the suggestions in this post and reply here.

5. 541,900 bytes.
[Fire HD 8 and HD 10 General] sga999:
Thanks, retyre. I'll try the "repeating ls -al way" soon, and I'll report here. But it seems strange that I do get 13 out of the 14 files. Maybe kingo is the last one, and I'm just missing it.

I do see a file on the PC (kingo_45....) that is 541,904 bytes. I think you're saying there's no way for me to "convert" it to the right one (4 bytes smaller) for the tablet, right?.

EDIT: No luck. I was issuing ls -al "constantly", and within maybe 15 seconds, it showed 13 of the 14 files. For the rest of the time, maybe another 15 seconds, it still never showed the kingo file. Just saw your next post while I was writing this. Yes, I tried copying to /data/local/tmp, set permissions, tried to execute but got a syntax error: 'xxxx' unexpected, where xxxx is weird characters.

EDIT2: Well, now it's not rooting any more. I guess I did it about 10 times successfully. I've rebooted the tablet, but not the PC. Not sure if that will help. I'll keep trying, but I don't have much faith. I'm wondering if you could PM me the kingo file?
[Fire HD 8 and HD 10 General] retyre:
I haven't done this in a while, but I do remember copying all the files from the PC directly to internal storage, and it did not work. Every PC file was 4 bytes longer. Have you tried copying kingo_45327954 to /data/local/tmp, setting execute permissions, and running it? I think it won't work, but try it and post here.

See whether the kingo binary shows up when you repeatedly list the contents of /data/local/tmp.
[Fire HD 8 and HD 10 General] sga999:
My edited post shows before your most recent one. Sorry, responding at the same time as you wrote.
[Fire HD 8 and HD 10 General] sga999:
I have all necessary files now. But the chmod 755 * step does not work. It says "Operation not permitted". Since I happen to already be rooted, I can do su, and then chmod works. But in the event where I will normally be trying to do all of these offline kingo root steps, I will not be rooted yet. So I'm missing something.
[Fire HD 8 and HD 10 General] retyre:
You are unable to change permissions to the files in /data/local/tmp as a non-root user? That shouldn't happen. Are you copying from an adb shell?
[Fire HD 8 and HD 10 General] sga999:
Apologies, I'm not being very clear. After adb shell, I can ls sdcard, ls system, and others. But not data! I get opendir failed, permission denied (see below). I'm also unable to copy into /data/local/tmp. I was confusing you there because I had just been copying the files from sdcard/k with file explorer commands within FX File Explorer on the tablet. I should have been doing it in the shell on the PC, but this was just easier.

However, to do the permission changes, I did use the PC command window, adb shell, then the chmod failed. So I'm confusing you by mixing up what I was doing on the tablet vs. the PC.

A few hours ago, I mentioned that the online Kingo root was no longer working. Maybe I've gotten into some state where data is in some strange state. I had not intended to "start over" with adb sideload, etc. and do this whole procedure. But maybe I have to?!

C:\progfiles\Android\sdk\platform-tools>adb shell

shell@suez:/ $ ls -l system

drwxr-xr-x root root 2018-02-27 21:03 app

drwxr-xr-x root shell 2018-02-27 21:01 bin

-rw-r--r-- root root 6969 2018-01-04 18:31 build.prop

drwxr-xr-x root root 2018-01-04 18:31 data

drwxr-xr-x root root 2018-02-27 21:01 etc

lrw-r--r-- root root 2018-01-04 18:31 fonts -> /mnt/sqfs/fonts

drwxr-xr-x root root 2018-02-14 15:59 framework

drwxr-xr-x root root 2018-02-27 21:01 lib

drwxr-xr-x root root 2018-01-04 18:31 lib64

drwxr-xr-x root root 2018-01-04 18:31 local

drwx------ root root 1969-12-31 16:00 lost+found

drwxr-xr-x root root 2018-01-04 18:31 media

drwxr-xr-x root root 2018-02-14 16:55 priv-app

-rw-r--r-- root root 288671 2018-01-04 18:31 recovery-from-boot.p

drwxr-xr-x root root 2018-01-04 18:31 security

drwxr-xr-x root root 2018-01-04 18:31 sqfs

drwxr-xr-x root root 2018-01-04 18:31 tts

drwxr-xr-x root root 2018-01-04 18:31 usr

drwxr-xr-x root shell 2018-01-04 18:31 vendor

drwxr-xr-x root shell 2018-02-27 21:03 xbin

-rw-r--r-- root root 42 2018-02-14 15:59 xposed.prop

shell@suez:/ $ ls -l data

opendir failed, Permission denied

1|shell@suez:/ $

EDIT: Even though kingo root using the PC started failing earlier, I am still rooted and don't see any problems on the tablet at all. All apps that require root are still working.
[Fire HD 8 and HD 10 General] sga999:
Problem 1:

Sorry that I don't know enough about "groups" to figure out what I'm doing wrong. An earlier post #17 showed this:

shell@douglas:/ $ cd /data/local/tmp

shell@douglas:/data/local/tmp $ ls -l

-rw-rw---- shell shell 109400 2018-01-19 21:15 Matrix

-rw-rw---- shell shell 6488979 2018-01-19 21:15 Superuser.apk

-rwxr-xr-x shell shell 1126000 2017-11-13 17:41 busybox

If I do those commands, I get:

C:\progfiles\Android\sdk\platform-tools>adb shell

shell@suez:/ $ cd /data/local/tmp

shell@suez:/data/local/tmp $ ls -l

-rwxr-xr-x root root 527013 2018-03-03 22:35 packages.xml

-rwxr-xr-x root root 18937 2018-03-03 22:34 ps.txt

I think I need to have 'shell' showing for the group instead of root? I am issuing the adb shell in an administrative command prompt window. Any idea what I'm doing wrong?

Problem 2:

Since I couldn't get your offline method to work, I tried the "regular" (online) kingo root on the PC. This had worked for me a week or two ago (5.6.0.0 got updated to 5.6.0.1, even though I didn't want it to). Others have said that root was still working on 5.6.0.1, and it certainly did for me. But after trying many times today (trying to get the kingo file, which you helped me with), rooting from the PC started failing.

I uninstalled the PC Kingo root and reinstalled it. However, now it tried for about 30 minutes, installed many more of those kingo_xxx files in the files folder, and it finally said 'failed'. So I did adb sideload of the 5.6.0.1 bin file, tried again, same problem. So now, I'm unable to get root with either the offline or regular method! It makes no sense to me that it's not working with the PC method....unless Kingo somehow changed things for 5.6.0.1. I doubt it. The fact that only those 2 files are in there (see above - packages.xml, ps.txt) is telling me something... like maybe Kingo root is no longer able to copy files to /data/local/tmp either!

Thanks for any advice.
[Fire HD 8 and HD 10 General] retyre:
In a previous post, you wrote all your apps still have root access. You have now lost it?

I remember from our early rooting days that unrooting with Kingo would unmount /sdcard (perhaps others), but I do not remember read-only access to /data/local/tmp. Most rooting tools work from /data/local/tmp. If that's not writable, the only option may be a reset and adb sideload.

Do you have a good-enough backup of /system and /data (using FlashFire, perhaps) to be willing to start over? If so, backup everything from /sdcard and do a wipe (factory reset, from recovery, option 3) and then sideload the 5.6.0.1 update .bin. I did see (in a previous directory listing from you) xposed.prop in there, so I am guessing you have a FlashFire backup handy?
[Fire HD 8 and HD 10 General] sga999:
Yes, I got rid of root because PC Kingo root was no longer working, probably due to the "bad" /data/local/tmp.. And I was unable to make any progress at testing the offline root because of the same issue...I couldn't copy or chmod to the tmp folder. Also, I uninstalled PC Kingo root and reinstalled. I thought all of that might help the tmp folder problem, but it did not.

Yes, I do have a Flashfire backup of both system and data. But I had not anticipated testing the restore right now. I had only wanted to test the offline root. But I guess it's time! Gosh, my sdcard has lots of data, but I guess I have to start copying. I'm assuming there's no option for this tablet like TWRP has, where you can wipe data but leave sdcard intact? Thanks again.

EDIT: You mentioned wipe/factory reset followed by adb sideload. Won't 5.6.0.1 automatically install after I do the reset? Maybe you just want me to be "safe" by not getting anything further than 5.6.0.1?
[Fire HD 8 and HD 10 General] fuzzynco:
files in zip?

What is supposed to be in 20165195.zip?

I only got 2 files (both binaries) fileWork & Matrix

All the scripts and utilities were in the other zip file.
[Fire HD 8 and HD 10 General] retyre:
The two files you mentioned in your list. Just do a check against the file listing in the OP.
[Fire HD 8 and HD 10 General] sga999:
I'm finally getting around to posting about my success using the Kingo method in post 10. Thanks, retyre, for assisting me! I had problems "capturing" one of the the Kingo files (kingo) that is necessary. Then somehow, I was unable to write to /data/local/tmp. So I had LOTS of steps to do before I could move on to this offline root step. I'm going to post more about that in the xposed/flashfire thread.

Once I got restored properly, I copied only the 6 underlined files mentioned in post 10 to /data/local/tmp, did subsequent chmod, kingo steps. Everything went smoothly..

By the way, retyre, you thought my /data/local/tmp became unwriteable due to me unrooting with some way other than supersu. But that problem occurred sometime during all the online (PC) Kingo root attempts to capture the kingo file. I attempted that online way many times, with no unroot attempts in between at all. Somewhere in the midst of those attempts, /data/local/tmp got messed up. So I think doing online Kingo root over and over somehow caused this.

Thanks again for this method!
[Fire HD 8 and HD 10 General] yellowpage:
I'm new here to try the root method.

Have a question regarding "-- Type adb shell in an administrative command prompt. You should enter the tablet as a user."

What is the command I should type in the command prompt?

When I type "adb shell", I got something like "shell@suez:/ $". But for the copy command, I got "Permission denied". Do I miss anything?

Thanks for your help in advance.
[Fire HD 8 and HD 10 General] ¿GotJazz?:
I tried to capture all of the Kingo files, and I got almost all of them, except the most important one: kingo

I started the KingoRoot Windows app on my PC.

I was in an adb shell on my PC, located in the /data/local/tmp/ directory, repeatedly running the following command: cp * -a -f /sdcard/Kingo_files/

I never saw the "kingo" file appear in my /sdcard/Kingo_files/ directory. Is there something I'm missing?

Thanks,

¿GJ?
[Fire HD 8 and HD 10 General] retyre:
-- Can you do a repeated directory listing after you start Kingo (just to confirm the "kingo" binary is missing)?

-- Perhaps the binary has a different name. Is there a file in /sdcard/Kingo_files/ that's exactly 541,900 bytes?

-- Are you using the latest version of KingoRoot? If so, try with a older version (v1..5.0 or even earlier).
[Fire HD 8 and HD 10 General] ¿GotJazz?:
1 - A repeated, rapid directory listing of /data/local/tmp never showed the kingo binary in the directory

2 - I looked in my Win10 ..\AppData\Local\Kingosoft\Kingo Root\files directory, but didn't find a file exactly 541,900 bytes long. However, I did find a kingo_45327954 file that was 541,904 bytes long, and it was the only file anywhere near that size in the folder.

3 - I tried installing and running the earlier version of KingoRoot (dated 1-19-2017), but that also never put the "kingo" binary in the /data/local/tmp directory. This was the version I used to use to successfully root my HD8-6G in the past. However, It definitely operates differently now (visually and content), so I'm guessing that Kingo is feeding different files from it's web server down to the Windows App.
[Fire HD 8 and HD 10 General] sga999:
I had the same problem of not getting the kingo file. You can see my post #26 and others following that. I never figured out why the file was not being copied, but I was able to get it with retyre's help. As you said, the same version of kingoroot had been used earlier, and I had seen the kingo file. So it is a peculiar problem.
[Fire HD 8 and HD 10 General] dsubscribe:
Same issue for me
[Fire HD 8 and HD 10 General] Supersonic27543:
Did you allow USB debugging in developer options?

If you did, did you get the dialog "Allow USB debugging?" when connecting to PC?

Good Luck! :good: