[Fire HD 8 and HD 10 General] Supersonic27543:
Thread before changing to a master thread (for historical purposes :p)

NOW WE HAVE AN UNLOCKING METHOD WITH TWRP! THE CONTENT BELOW IS OUTDATED.

Hi,

Now, I'm sick of Amazon's bloat slowing my tablet, and the frustration of not being able to use root apps. Fire HD 10 got rooted, but HD 8 and HD 7 are still in dark. HD 7 users can at least downgrade their devices and hope for a root exploit, but HD 8 users can't. If anyone else wanting to root this tablet and make it super fast, get rid of Fire Launcher, use Xposed, remove bloat, etc., let's collaborate with this!

LATEST RELEASE - Fire OS 5.3.6.4/Fire OS 5.6.3.4

SECURITY PATCH - ???

KERNEL VERSION - 3.18.19

List of possible software root methods:

1.) eMMC overwriting

Thanks to the hardware root method, we have a full eMMC dump so using the loophole in the flash unlock process which causes overwriting partitions next to it, we could overwrite on all the way, flashing original things, to the system partition and then flash a modified system partition.

Additions to the list are welcome!

List of possible exploits

Additions to list are welcome!

1.)CVE-2017-8890

Status: Confirmed possible.

Description: As I think, this is the most exploitable currently. Running the PoC results in 'somewhat unnatural' Use-After-Free s but the PoC fails to orient them to escalate privileges.

Cons: This exploit is based on obsolete IPv4 sockets, unlike it's cousin CVE-2017-9077, which is based on IPv6, but rather the same exploitation as this. That 'may' make this harder to exploit, but of course there's no evidence.

I, really only added this to cons because you should have a con. :p

2.)CVE-2017-15868

Status: Unsure

Description: NP Hardass said that this vulnerability is present on the source,I haven't explored it yet.

Cons: ¯\_(ツ)_/¯

If you tried these exploits, please notify me in below and I'll update the status. UPDATE: No point on keeping on trying these kernel exploits as no one (please correct me) who knows to write exploits in C comes here anymore. If someone wants to try though I will start maintaining this list again. Come on, let's collaborate on this!!! :laugh:

Thanks!

Download the eMMC dump from here: https://www.androidfilehost.com/?w=files&flid=282721

PS: You can download original kernel sources from Amazon, just search for it.

Original Thread:

Hi,

Now, I'm sick of Amazon's bloat slowing my tablet, and the frustration of not being able to use root apps. Fire HD 10 got rooted, but HD 8 and HD 7 are still in dark. HD 7 users can at least downgrade their devices and hope for a root exploit, but HD 8 users can't. If anyone else wanting to root this tablet and make it super fast, get rid of Fire Launcher, use Xposed, remove bloat, etc., let's collaborate with this!

LATEST RELEASE - Fire OS 5.6.0.1

SECURITY PATCH - 2017/08/01

KERNEL VERSION - 3.18.19*

*a quite old release it is. :D

List of possible exploits

Additions to list are welcome!

1.)CVE-2017-12762

Status: Unsure

Description: A super likely-to-work great exploit. If you want you can go look at the kernel source (link included below the thread) 3.18.19 for proof, it starts in line 2640. Looks like a stack buffer overflow.

Cons: ASLR may be an absolute game killer in this case. And some skill is required to exploit, very less-known around the internet. And Amazon may have removed the ISDN support up from the roots of kernel, because it's VERY deprecated.

2.)CVE-2017-16939

Status: Unsure

Description: A nice attack vector. A PoC is available in SecuriTeam blogs, which triggers use-after-free. I tried contacting them for some help, but they almost instantly replied that they don't provide support for their reported vulnerabilities. Sad.

Cons: ¯\_(ツ)_/¯

3.)CVE-2017-15868

Status: Unsure

4.)CVE-2017-10661

Status: Unsure

5.)CVE-2017-7541

Status: Unsure

6.)CVE-2017-6074

Status: Unsure

If you tried these exploits, please notify me in below and I'll update the status. Come on, let's collaborate on this!!! :laugh:

Thanks!