yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] mrmazak:
MTK-su has worked on

R1-HD: MT-6735

-armv7-kernel worked-- param1: 0x1000, param2: 0x8040, type: 7

-arm gives error

- arm64 gives error

Life One Max: MT6737

-armv7-kernel worked -- param1: 0x3000, param2: 0x18040, type: 7

-arm gives error

- arm64 gives error

Life One X: MT-6753

-arm64 worked-- param1: 0x1000, param2: 0x8040, type: 7

-arm worked-- param1: 0x1000, param2: 0x8040, type: 7

- arm v7 incompatible system

Tank extreme pro : MT6737T

-arm V7 -- worked -- param1: 0x1000, param2: 0x8040, type: 4

None had "stacking protection detected"

I used simple test batch file to check.

I have 4 or 5 more mtk devices in the drawer I would like to test also. SO far all three of the above are same "family" mt-67*

@echo off
echo [*] Clearing tmp folder [*]
adb shell rm -rf /data/local/tmp/*
echo [*] copying MTK-SU to /data/local/tmp/mtk-du
adb push arm/mtk-su /data/local/tmp/arm-mtk-su
adb push arm64/mtk-su /data/local/tmp/arm64-mtk-su
adb push armv7-kernel/mtk-su /data/local/tmp/armv7-mtk-su
timeout 3
echo [*] changing permissions on copied files
adb shell chmod 0777 /data/local/tmp/*
timeout 3
echo Testing base conection
adb shell whoami
pause
echo Testing arm conection
adb shell "/data/local/tmp/arm-mtk-su -v -c whoami"
pause
echo Testing arm64 conection
adb shell "/data/local/tmp/arm64-mtk-su -v -c whoami"
pause
echo Testing armv7 conection
adb shell "/data/local/tmp/armv7-mtk-su -v -c whoami"
echo [*] Clearing tmp folder [*]
adb shell rm -rf /data/local/tmp/*
pause
[Fire HD 8 and HD 10 General] Centagon:
I rooted my Fire HD 8 (2017) successfully, but I must have deleted one system app too many because I boot into a black screen now (power off popup still displays, unit responds in ADB). It's not firelauncher, and i didn't disable the apps, i uninstalled them. Does anyone have a clue which one I need for the bootup? And could export me the APK? Thanks.
[Fire HD 8 and HD 10 General] mrmazak:
wow, really not mind reader here.

What apps did you 'nuke'
[Fire HD 8 and HD 10 General] Centagon:
If I remembered, it'd be a lot easier lol. I'm not too bright :(

When looking at this list: https://xdaforums.com/hd8-hd10/general/updated-amazon-app-bloatware-tracking-t3823624

The warning+ items would be:

amazon.client.metrics

amazon.client.metrics.api

amazon.device.backup

amazon.kindle.otter.settings

amazon.ods.kindleconnect

amazon.photos

amazon.webview.metrics.service

Also something about amazon.knight and amazon.paladin I vaguely remember removing.
[Fire HD 8 and HD 10 General] mrmazak:
Ok lets suggest this. I would say run the following "pm " command and post the output. That way someone with unmodified system can compair and share the ones that you are missing.

adb shell pm list packages > installed-aps.txt

then post the text file
[Fire HD 8 and HD 10 General] mrmazak:
If no one comes to help, you may need to do your homework , and help yourself.

1. download the restore / update.bin from amazon -- https://www.amazon.com/gp/help/customer/display.html?nodeId=202144610

2. rename from .bin to .zip

3. extract the zip file

4. extract the system.new.dat to .img with sdat2img.py

5. open the image file with something like ext2explore

Now you will have the original system in folder format, and can replace all that you need.

There are also tools with done in one step extraction.

Like Turksdev-image kichen

https://xdaforums.com/android/software/tool-turkdevs-image-kitchen-t3816395
[Fire HD 8 and HD 10 General] bigrammy:
Why are you spamming this thread?

A lot of post on this thread have nothing to do with mtk-su and acquiring temp root so why are you posting here :confused:

Post in your own device specific thread rather than bogging down the OP's thread with which package to disable nonsense :rolleyes:

If you have something useful to say like how to elevate from temp root to permanent root maybe install a safestrap or unlock the bootloader without bricking your device then that would cool :cool:

Otherwise get your temp root hit the OP's thanks button let him know your device specifics and move back to your own dedicated threads :good:
[Fire HD 8 and HD 10 General] diplomatic:
I guess you can.... But some of these tools around here that rely on temp root specifically ask the user to download it from this thread and copy it to their bin folder. I update it pretty often and want people to use the latest version. The next one might be faster or more reliable, you never know...

No, but it still needs to set the user ID credentials, capabilities and so on, which involves the hacking part. Skipping the selinux part would be virtually imperceptible. The biggest amount of time is spent on building the kernel symbol table. The rest is peanuts.
[Fire HD 8 and HD 10 General] diplomatic:
Excellent! Performing as advertised...

BTW, there's no point in testing all 3 binaries on the same phone. The armv7-kernel will never work at the same time as the 2 other ones. You might want to base your test on the output of "uname -m". Also, it would be great if you could post the (first or second) output line with "param1: 0xYYY param2: 0xYYY type: YYY" for each phone. And whether any of them print "Stack protection detected".
[Fire HD 8 and HD 10 General] bibikalka:
That's a good point! On the other hand, your version 11 is both very mature and is really really good !!! :D To me, 32-bit kernel hacking is a game changer, lots of devices have eligible MTK chipsets, but came with 32-bit kernels. BLU sold a lot of Amazon devices, so perhaps it would be OK to have an mtk-su included with that BLU R1 tool, at least, until it's tested by an eligible user.

The good part is that a whole bunch of the last 3 years worth of MTK devices now can get root. This deserves a nice news story on every Android site!!! The bad part is that a lot of those devices are already out of commission, since 3 years is an eternity in the Android world. I wonder which devices besides those sold by Amazon became really popular out there ...
[Fire HD 8 and HD 10 General] diplomatic:
Wow, are there really that many 32-bit kernel phones out there? I thought as a rule they made a 32-bit userspace ROM with a 64-bit kernel if space was tight. If I knew, I would've put a higher priority on making support for it....
[Fire HD 8 and HD 10 General] bibikalka:
I would imagine that a lot of low cost Chinese outfits pumped out MTK devices with the quickest OS option available - minimally updated 32 bit kernel that could be used across a range of their offerings. If it boots - it ships :D

Sometimes those devices rarely saw any Rom updates besides the factory supplied versions. Proper developers cost $$$, and there is often very limited budget for that.
[Fire HD 8 and HD 10 General] Mobkore:
Quick check: has anyone used diplomatic's temporary root shell to disable Amazon system apps? Was it permanent?

I just checked and simple adb disabling for user 0 worked for a few days and although some of the apps remain disabled allot of them were automatically re enabled even without ota updates, wondering if it's worth using the temp root shell for a permanent solution
[Fire HD 8 and HD 10 General] DB126:
Depends on system version, commands utilized and apps targeted. On FireOS v6 the major Amazon offenders (those that consume significant uncommanded resources) can be easily disabled, and remain disabled, without root suggesting the same outcome if applied w/temp root. I don't bother with the little crap which is visually annoying but largely benign. FireOS v5 is a different beast and harder to tame. I opt for custom ROMs on those devices or simply choose not to own them.
[Fire HD 8 and HD 10 General] diplomatic:
Rough outline to get boot-less, system-less root with Magisk and mtk-su

For advanced users or devs: here's a general overview for a method to get root with Magisk without having to modify your boot image.

Get a Magisk zip file and extract the magiskinit binary. Push magiskinit to your device.

Extract the magisk binary from magiskinit with ./magiskinit -x magisk

Make a symbolic link to (or a copy of) magiskinit and call it magiskpolicy.

Make a symbolic link to (or a copy of) magisk and call it su.

Make a small ext4 image of about 2 to 4MB (using something like make_ext4fs -J -l 2MB...). In it, place Magisk's magisk and su binaries. The su binary could be either a link to magisk or a copy of it. (Idea borrowed from [MENTION=7104332]k4y0z[/MENTION]'s unlock method.) You will need a root shell to mount the image and copy files to it.

Get a root shell with mtk-su ;)

Patch the running sepolicy with the magisk context using ./magiskpolicy --live --magisk 'allow magisk * * *' .

Start a temporary Magisk daemon with ./magisk --daemon

Start a temporary Magisk root shell with ./su. This may involve prompts from Magisk Manager.

Check to make sure the new root shell has the context u:r:magisk:s0. Don't proceed if it's not that context.

From the magisk context shell, mount the ext4 image to /system/xbin with

losetup /dev/block/loop0 magisk.img

mount -o ro /dev/block/loop0 /system/xbin​

You may be able to combine those 2 commands into one, but I wasn't able to on my device.

Kill the temporary magisk daemon with killall magiskd. The point of that is to launch a new daemon from within the magisk se-context. Otherwise there will be problems related to selinux.

Start a new daemon with magisk --daemon. Note that there's no ./ at the start. This is to test the loopback img.

Exit the temporary ./su shell. You may get an error message, but that's fine. At this point you should be back to the mtk-su shell.

Exit the mtk-su shell.

Check if su works. You should get a prompt from Magisk Manager.

At this point, if you get a normal root shell, you can do setenforce 1.

Now all apps that want su access will have it with proper prompting.

Have some app execute steps 6 through 17 at every startup.

Steps 1-5 are done once. Step 6 onward are done at every boot session. A script would probably help. I'm sure this is missing some details, but I just wanted to convey the general idea.

Important: If you get this system up and running, you of course want to avoid updating Magisk binaries through MM. That's pretty important because doing so will probably stop your device from booting.

Source: Magisk Tools
[Fire HD 8 and HD 10 General] tlyonstlyons:
Sorry, let me check if I am getting it.

->install hijacker and launcher

->soft root from post #1 and disable firelaunch, ads and whatever else is annoying with ADB

->on next boot, everything stays disabled and the tablet uses the better launcher w/hijack

->hijack has no flash of the other launcher since it is disabled

I am on a Fire HD 10 if it matters. Thanks!
[Fire HD 8 and HD 10 General] DB126:
That's the general gist. However, no guarantees as too many variables involved. Make sure you have a recovery plan.

Yes, it matters at HD10 remains on FireOS v5 which behaves somewhat differently.
[Fire HD 8 and HD 10 General] diplomatic:
General MTK thread

OK, I think mtk-su is ready for general release. I made a thread covering MTK devices collectively:

Amazing Temp Root for MediaTek ARMv8

Probably better to post about non-Amazon devices over there.
[Fire HD 8 and HD 10 General] Nyuku:
[MENTION=8132642]diplomatic[/MENTION] I've followed the script perfectly but cant seem to get SuperSU to detect the root?
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=9875821]Nyuku[/MENTION], hard to say without knowing more (or any) details. If you've followed the steps in [MENTION=4584276]dutchthomas[/MENTION]'s post 10, it should have worked out. Did you start daemonsu?
[Fire HD 8 and HD 10 General] Nyuku:
ah, i in fact did not start daemonsu, i'll try it now
[Fire HD 8 and HD 10 General] chilly24:
Ok so my HD8 6th Gen with 5.6.1.0 is now rooted thanks : )

But how can i now flash TWRP`?
[Fire HD 8 and HD 10 General] Rortiz2:
No TWRP for 6th Gen devices :)
[Fire HD 8 and HD 10 General] chilly24:
ok any other possibility to flash custom rooms?
[Fire HD 8 and HD 10 General] Datastream33:
Hey, Rortiz...

I can fully automate your script if you would like me to. ;)
[Fire HD 8 and HD 10 General] Rortiz2:
All yours.

---------- Post added at 07:10 PM ---------- Previous post was at 07:09 PM ----------

FlashFIre but it will not work for you because there is no custom ROM.
[Fire HD 8 and HD 10 General] fire1951:
Great news! Could this possibly work on Amazon Fire Stick 4k 2018 ( has MTK8695 chip).

(EDIT). Sorry! Missed that in first post.
[Fire HD 8 and HD 10 General] plusmce:
ok stupid question , so if i create a folder call "mtk" to desktop ? how do i push the file to data/local/tmp ?
[Fire HD 8 and HD 10 General] 0mr1:
adb push path/to/your/mtk/folder /data/local/tmp
[Fire HD 8 and HD 10 General] plusmce:
ok i use temp root to disabled firelauncher on my fire hd 8 8th gen and it works and now i am confusing to install superSU on windows 10 , could someone telling me what to do step by step ? willing to donate if someone can help me that , thanks !
[Fire HD 8 and HD 10 General] Rortiz2:
https://xdaforums.com/showpost.php?p=78996694&postcount=33
[Fire HD 8 and HD 10 General] RagManX:
Thank you so much for this method. I had to run it about two dozen times to get id 0 and be able to read /data/local/tmp to install permanent root on my 7th gen Fire 8, but it's working now. Instructions were super-clear, and the process couldn't be much easier. Thanks to [MENTION=8132642]diplomatic[/MENTION] and [MENTION=4584276]dutchthomas[/MENTION] for the tools and instructions to make this possible.
[Fire HD 8 and HD 10 General] el7145:
Trying to run this on my 2015 amazon fire tv, this is what i continuously get, can it really take 2 dozen times to get the uid 0??? Dont know if it makes any difference but im adb connected to my fire tv through network

C:\adb>adb shell

shell@sloane:/ $ cd /data/local/tmp

shell@sloane:/data/local/tmp $ chmod 755 mtk-su

shell@sloane:/data/local/tmp $ ./mtk-su -v

Building symbol table

kallsyms_addresses_pa 0x40aae000

kallsyms_num_syms 63062, addr_count 63062

kallsyms_names_pa 0x40b29400

Size of kallsyms_names 776235 bytes

kallsyms_markers_pa 0x40be6d00

kallsyms_token_table_pa 0x40be7500

kallsyms_token_index_pa 0x40be7900

Patching credentials

init_task va: ffffffc000df7b40

Possible list_head tasks at offset 0x338

0xffffffc066868348 0xffffffc066868d88 0xffffffc000df7e88

comm offset 0x4d0 comm: swapper/0

Did not find own task_struct (2)

New UID/GID: 2000/2000

Setting selinux permissive

Found adrp at offset 4

ADRP x0, base is 0xffffffc00102b000

Found ldr at offset 28

LDR [x0,2316], selinux_enforce VA is 0xffffffc00102b90c

Selinux is already permissive

starting /system/bin/sh

shell@sloane:/data/local/tmp $
[Fire HD 8 and HD 10 General] deepdvd:
Is there any way around setting the Default access to [Grant] in SuperSU? That was the only way I can get it to work.

Is this just how it is? I'd obviously much rather be prompted to allow per app or even be able to manually add apps to the allow list.

---------- Post added at 12:34 PM ---------- Previous post was at 12:30 PM ----------

Update: I just found this for those wondering:

https://xdaforums.com/hd8-hd10/general/supersu-access-workaround-fire-devices-t3738269
[Fire HD 8 and HD 10 General] plusmce:
ok im noob but i cannot push adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp

plus chmod: /system/xbin/su: No such file or directory

PS C:\Users\Kenny\Desktop\platform-tools> adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp

error: device '(null)' not found

PS C:\Users\Kenny\Desktop\platform-tools> adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp

cannot stat 'arm64/su': No such file or directory

PS C:\Users\Kenny\Desktop\platform-tools> ^C

PS C:\Users\Kenny\Desktop\platform-tools> adb shell

karnak:/ $ cd /data/local/tmp

karnak:/data/local/tmp $ chmod 755 mtk-su

karnak:/data/local/tmp $ ./mtk-su -v

Building symbol table

kallsyms_addresses_pa 0x40baf400

kallsyms_num_syms 69054, addr_count 69054

kallsyms_names_pa 0x40c36300

Size of kallsyms_names 830042 bytes

kallsyms_markers_pa 0x40d00e00

kallsyms_token_table_pa 0x40d01700

kallsyms_token_index_pa 0x40d01b00

Patching credentials

init_task va: ffffffc000fcea20

Possible list_head tasks at offset 0x338

0xffffffc0030c8338 0xffffffc02f2b53b8 0x000000000000008c

comm offset 0x5a8 comm: swapper/0

Found own task_struct at node 0

real_cred: 0xffffffc0387bf980, cred: 0xffffffc0387bf980

New UID/GID: 0/0

Setting selinux permissive

Found adrp at offset 4

ADRP x0, base is 0xffffffc00112e000

Found ldr at offset 28

LDR [x0,444], selinux_enforce VA is 0xffffffc00112e1bc

Switched selinux to permissive

starting /system/bin/sh

karnak:/data/local/tmp # chmod 0755 /system/xbin/su

chmod: /system/xbin/su: No such file or directory

1|karnak:/data/local/tmp # /system/xbin/su

/system/bin/sh: /system/xbin/su: not found

127|karnak:/data/local/tmp #
[Fire HD 8 and HD 10 General] plusmce:
thanks for your help but mine is fire hd 8 8th gen 2018 version
[Fire HD 8 and HD 10 General] Rortiz2:
Ahh... If you want you can test it also on the HD8 2018
[Fire HD 8 and HD 10 General] diplomatic:
There's something odd about this. You're setting permissions (chmod and chcon) before copying the files. Those are file paths that don't exist yet. First do the cp group, then your chmods.

OK, don't run this anymore. It's not compatible with that device yet. The line "0xffffffc066868348 0xffffffc066868d88 0xffffffc000df7e88" tells me that it's not parsing some kernel structures correctly. This will have to be addressed.
[Fire HD 8 and HD 10 General] plusmce:
This script will root your fire. ONLY HD 8 2017 OR HD 8 2016

Do you want to continue?y/n:y

-------------------------------------------------------------------------------

[*] Pushing files and removing old files...

adb server version (32) doesn't match this client (39); killing...

* daemon started successfully

arm64/su: 1 file pushed. 13.0 MB/s (108480 bytes in 0.008s)

arm64/supolicy: 1 file pushed. 8.1 MB/s (42712 bytes in 0.005s)

arm64/libsupol.so: 1 file pushed. 18.6 MB/s (334744 bytes in 0.017s)

3 files pushed. 11.3 MB/s (485936 bytes in 0.041s)

mtk-su: 1 file pushed. 7.1 MB/s (22136 bytes in 0.003s)

[*] Setting permissions...

[*]Executing exploit...

wait until it finishes... When the exploit finishes, DON'T CLOSE THIS WINDOW

AND FOLOW THE INSTRUCTIONS2.txt

/system/bin/sh: ./data/local/tmp/mtk-su: No such file or directory

Press any key to continue . . .

No such file or directory
[Fire HD 8 and HD 10 General] diplomatic:
Just a friendly reminder:
[Fire HD 8 and HD 10 General] plusmce:
thanks hopefully you can update detail steps for fire hd 8 2018 version or maybe make videos on youtube later , i am new for this i don't want to screw up my device so i giving up now , happy atleast i can disabled firelauncher with temp root !
[Fire HD 8 and HD 10 General] el7145:
ok, thanks for saving me from running the commands an additional 2 dozen times, lol...if you need me to test anything on my fire tv 2 just lemme know, and thanks for all the hardwork you put into doing this!
[Fire HD 8 and HD 10 General] Oco:
Thanks! I changed the order in my post
[Fire HD 8 and HD 10 General] plusmce:
how do i disable dm-verity on my fire hd 8 can you explain ?
[Fire HD 8 and HD 10 General] Oco:
[MENTION=8132642]diplomatic[/MENTION] For Fire 7 2015 I tried ARM files/folders from your file and SU but I get stucked in adb shell ./mtk-su -v it doesn't run, message is Error Opening Interface. Any suggestion in this error-try or this device is simply a no go for your tool? Regards

UPDATE: Ups, I saw first FAQ in OP, thanks
[Fire HD 8 and HD 10 General] diplomatic:
There is no bootloader unlock for that tablet yet. That's the reason you can't flash TWRP or custom rooms or ROMs.
[Fire HD 8 and HD 10 General] diplomatic:
Then please take this opportunity to include a proper SuperSU APK in there, not that fake one ridden with ads. Not sure if you saw the posts about that a few pages back, [MENTION=8978978]Rortiz2[/MENTION]. But people were complaining about ads coming from that SuperSU, which is different from the Play store version. Also, in that script, I'm not sure why you need multiple versions of mtk-su for every device. There is only one version, with 2 flavors. The latest is much better. And why not detect the device automatically, like via ro.product.device, rather than from user input?
[Fire HD 8 and HD 10 General] Datastream33:
I appreciate it. I'll let you know when it's finished ;)
[Fire HD 8 and HD 10 General] Rortiz2:
I'm so sorry ... It was the first one I had downloaded ..

PS: Sorry for not being an expert batch programmer...
[Fire HD 8 and HD 10 General] k4y0z:
[MENTION=8978978]Rortiz2[/MENTION] Maybe you can remove the SuperSU from your automated root or reupload with a proper version, if it is having issues?
[Fire HD 8 and HD 10 General] diplomatic:
That's fine, man.... that's why we do version updates. My mtk-su wasn't nearly as good in the beginning either.
[Fire HD 8 and HD 10 General] Rortiz2:
It's what I'm doing..

---------- Post added at 08:08 PM ---------- Previous post was at 07:55 PM ----------

Updated!
[Fire HD 8 and HD 10 General] Datastream33:
I will be sure to include the correct version of SuperSU. I will also add device detection, and architecture detection to ensure the proper mtk-su is used. Perhaps even the version of mtk-su that Rortiz has in there can be updated?

---------- Post added at 09:26 PM ---------- Previous post was at 09:21 PM ----------

Rortiz, you are the man. I give you props for your script. Your not bad dude, you are actually pretty good at batch programming and I would of never said you weren't (cause your not bad at all, by any stretch). I just wanted to help you make it fully automatic. That's all.

---------- Post added at 09:27 PM ---------- Previous post was at 09:26 PM ----------

Oh , ok you've updated it! Nice! :D:svetius:
[Fire HD 8 and HD 10 General] dutchthomas:
I started writing an app that would let you browse to the exploit (eg mtk-su), then browse to a payload (eg SuperSu.zip)... So that it could run the exploit and install the payload automatically. It would eliminate the need for adb/termux to get root. The idea was to keep the whole thing generic.

I got as far as browsing to the exploit then running it to get a root shell. Unfortunately I never got around to the install-SuperSu part, and now work is really busy. I won't have another chance to work on it for at least a month. If anyone else is interested in the idea though, I can provide some tips
[Fire HD 8 and HD 10 General] undertaker00:
After use semiautomated root 2.1 , and no errors, I got this error

255|root@douglas:/ # mount -o remount -rw /system

mount -o remount -rw /system

mount: Permission denied

could you help me ?

PD: fire 8 hd 2017
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=3775966]undertaker00[/MENTION], please check the FAQ and download the latest release. If you're still having problems, post back for more assistance.
[Fire HD 8 and HD 10 General] borissprat:
Updated?

er... is it? md5 checksum is identical
[Fire HD 8 and HD 10 General] dutchthomas:
Sometimes the exploit fails and you aren't in a fully rooted shell. If you get permission denied, you need to exit and run the exploit again. For most people the failure is rare, but sometimes it takes takes 5+ tries.

Make sure you exit fully, because as [MENTION=8132642]diplomatic[/MENTION] has pointed out, the shell can actually be more restrictive after the exploit fails. I believe this happens with root user when the selinux policy isn't correctly modified.

Make sure you're using the latest mtk-su while you're at it
[Fire HD 8 and HD 10 General] undertaker00:
Thanks.

It`s working.

Selinux problem finally resolved :D