[Fire HD 8 and HD 10 General] retyre:
"Offline" rooting with Kingo

This method is not as offline as the method in the OP, but here's how you can perform a variant of "offline" rooting with Kingo. I will begin by mentioning that Kingo's files are not easily accessible to the user, so you will have to have these files handy before you begin. Sadly, these files can only be obtained while Kingo is doing online rooting. Most (but not all, from what I have seen thus far) of these files are in your AppData\Local\Kingosoft\Kingo Root\files folder, but with different names.

I figured out the actual file names by matching the file sizes in the \files folder on my PC with the files created by Kingo in /data/local/tmp on the tablet while the online Kingo rooting process is _ongoing_ (ls -al). As I mentioned earlier, not every file in /data/local/tmp is in \files, though (could be in other folders on the PC; I haven't looked yet). Following this post, I also did a hex dump of the traffic over USB, but nearly all of it was Kingo transferring its files to /data/local/tmp..

Why does this have to be done while the rooting is in progress? Because Kingo cleans up the /data/local/tmp directory after the rooting is complete. In other words, you will have to copy the files from /data/local/tmp to /sdcard before the rooting completes. If you can do that, these are the files you will obtain: KingoUser.apk,

busybox

, ddexe, debuggerd,

kingo

, kingo_1b90d7d01 (likely a copy of KingoUser.apk), kingorootname,

mkdevsh

, su,

suarm64

,

supolicy

, suv7, install-recovery.sh, and

libsupol.so

(

emphasis

added to denote the required files). Some information is here as well.

So, what's the best way to obtain these files at this point? Sadly, by rooting (again) with Kingo. (Since these files are not publicly available, I do not think it's right for me to upload them somewhere.) If you can get a hold of these files and save them off the tablet, your future Kingo rooting can be completely offline ... and _mucho_ simpler than the procedure currently in the OP.

Here's what you would do with the aforementioned files:

-- Do steps 4 and 5 in the OP.

-- Download the SuperSU 2.79 apk from here and copy it to /sdcard.

-- Copy all the files Kingo files to a folder on /sdcard (say, k).

-- Copy everything from /sdcard/k to /data/local/tmp:

cp /sdcard/k/* /data/local/tmp/
cd /data/local/tmp
ls -l

-- Change permissions to execute:

chmod 755 *

-- This is the actual rooting command:

./kingo

This should be done in less than a minute, after which you will be back at the shell prompt.

-- Test root:

su

-- Mount /system writable to check:

mount -w -o remount /system

-- Install SuperSU 2.79 to get around the "su binary occupied" issue with later SuperSU versions. You should see installation failed (as usual), but things should be fine after the reboot.

-- Set default access to Grant in SuperSU's settings.

I have tested this multiple times. Works every time. Like I said, much easier than the method currently in the OP, but with the added challenge of obtaining non-public rooting files.

How does Kingo root, you ask? The mkdevsh file in /data/local/tmp (it's not on the computer as far as I can tell) is the only script I could find. At this time, I do not know the exploit being used here; it appears to be significantly more efficient than the doctor's remedy, that's for sure. Anyone interested in reversing the "kingo" binary?