yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] :
Android 6, fstab is in kernel. Patched boot.img signed and unsigned, doesnt work. Twrp is pry not gonna happen with locked bootloader. Even though android 6, it seems like it has newer security features of android 8-9. Not to mention august 2018 security patch. Plus the zram system is new to me. If i could get the true system mounted i could spam rw and push the files for at least perm root. But hell, even temp root will get it at least debloated. We plan to see what help flashfire can offer as well. Systemless root with supersu would be great with flashfire basically acting like custom recovery. Its def a very weird device setup

---------- Post added at 10:17 AM ---------- Previous post was at 10:12 AM ----------

Luckily i have the alcatel flash software for all mtk devices they make to get stock running. I already ported twrp, signed and unsigned, magisk patched boot.img didnt boot. Just need to figure out the zram thing and get to the real system. I know the location of real system, but unsure of commands i would used to try and mount it
[Fire HD 8 and HD 10 General] bigrammy:
Yes you are correct. :good:

Can you PM me a link to the stock boot.img I would like to have a look at that.
[Fire HD 8 and HD 10 General] :
As soon as i get home, ill grab his stick boot.img and pm it to you. Like i said, it did port twrp but no go. So just to make sure, ill use your guys suggestion of changing something simple in stock recovery and then seeing if that boots after flashing. That should rule out my ported twrp being broken and maybe thats y it not working. Leaving soon and got an hour drive home. Ill post back in a while.
[Fire HD 8 and HD 10 General] smileyint:
Keep up the good work guys on twrp and custom roms. Hope one day can flash latest firmware for the latest model on the old model like the 6th gen HD8 that i had. Also kinnda strange i couldnt find this thread under orig android dev but instead google keywords of the thread to revisit this thread.
[Fire HD 8 and HD 10 General] deathlessster:
dear Friends

I root my fire hd 8 7th gen successfully but i wont ask that there is any lineage rom for this device???
[Fire HD 8 and HD 10 General] dutchthomas:
First find a way to unlock the bootloader (;
[Fire HD 8 and HD 10 General] geddy3:
HD10 updated to 5.6.4.0

Just FYI, I had neglected to turn off OTA updates after rooting my HD10 2017 a couple weeks back. Amazon pushed out an update so now on 5.6.4.0 so lost root but was able to re-root again using this method. Will be turning off OTA now.
[Fire HD 8 and HD 10 General] CarthyMcDan:
Hi there,

I've managed to get root access, but how do I install SuperSU now? I tried to copy the files over to system/bin, but the SuperSU app doesn't start.

Which permissions must be set?

Thanks in advance
[Fire HD 8 and HD 10 General] diplomatic:
Release 10 posted

I've just uploaded R10, which includes better support for Oreo devices and kernels compiled with strong stack protection, such as on Nokia phones. It's also much more reliable in getting root and changing selinux due to retrying the unreliable steps multiple times.

Let me know if anything's broken for previously supported devices.

Needs testing on 32-bit kernel devices

I've included a binary that runs on 32-bit (armv7) kernels, which is the one in armv7-kernel. But it is not "activated" yet, meaning it will print text but not change anything in your device. Since I can't test it myself, at this stage it would be more likely to destabilize your OS than give you root. I need people to post its output so I can make proper support for those kernels. In the future, I'll probably combine that binary and the arm one into one executable. Thanks!

Note for testing: If it hangs for more than a few seconds, just press Ctrl+C to close it. If it doesn't want to close, then restart your device.
[Fire HD 8 and HD 10 General] fortis91:
[MENTION=8132642]diplomatic[/MENTION]

I happened to just download R10, it failed a couple times before I went back to an older version on my PC(R7). I didn't realize that you had a posted a version just now or I would have posted before using R7.

R10 - HD10 2017: tablet reboot after finish running ./mtk-su -v

shell@suez:/data/local/tmp $ ./mtk-su -v

param1: 0x3000, param2: 0x10000, type: 9

Building symbol table

kallsyms_addresses pa 0x40aa4600

kallsyms_num_syms 66781, addr_count 66781

kallsyms_names pa 0x40b26e00, size 832778

kallsyms_markers pa 0x40bf2400

kallsyms_token_table pa 0x40bf2d00

kallsyms_token_index pa 0x40bf3100

Patching credentials

init_task VA: 0xffffffc000e3a960

Possible list_head tasks at offset 0x368

0xffffffc020120368 0xffffffc046de5f68 0x000000000000008c

comm offset 0x5d8 comm: swapper/0

Found own task_struct at node 0

real_cred VA: 0xffffffc02b20a980

Parsing sel_read_enforce

Stack protection detected

ffffffc00027ef40+10: ADRP x19, 0xffffffc000f2b000

ffffffc00027ef40+24: LDR [x19, 200]

selinux_enforce VA: 0xffffffc000f2b0c8

Setting selinux_enforce

Switched selinux to permissive

Trying this again...

Switched selinux to permissive

Trying this again...

Switched selinux to permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@suez:/data/local/tmp
[Fire HD 8 and HD 10 General] diplomatic:
Oh, thanks for letting me know right away, [MENTION=3361451]fortis91[/MENTION]. It looks like this release is broken, so I pulled it for now. It falsely detects stack protection when there is none. Please keep using R9.
[Fire HD 8 and HD 10 General] diplomatic:
OK, R10 reuploaded and hopefully fixed. Please check, [MENTION=3361451]fortis91[/MENTION].
[Fire HD 8 and HD 10 General] mobaddict:
I have an ASUS Zenfone Max 3 (ZC520TL). I do get uid=0 (root) and a Permissive kernel so I know that the temporary root works. The only problem is I can't write SU binaries to /System as it can't be remounted to rw. How could I know if I have a dm-verity? I know that this is not really an Amazon device though I do have a Fire HD 8 2017 and successfully rooted it with this method.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=7837108]mobaddict[/MENTION], good to know mtk-su works on that phone. You can check what's mounted on /system with

mount | grep /system

If the line says something like /dev/block/dm-0, then it's dm-verity. You can also open the fstab.mtxxxx file located in your root directory and see if there's a 'verify' flag in the line that mounts /system. But even without checking, that is probably the reason you can't remount the partition. That's a decently recent phone. Most of them do have it enabled...
[Fire HD 8 and HD 10 General] mobaddict:
Hi [MENTION=8132642]diplomatic[/MENTION] thanks for the information and I'm confirming the this phone indeed has dm-verity. Sadly the bootloader is locked for this so I can't do anything about it. Thank you for the exploit. Just confirming that it works on this phone. :good: Good work on this.
[Fire HD 8 and HD 10 General] fortis91:
Works first time on HD10

shell@suez:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x10000, type: 9
Building symbol table
kallsyms_addresses pa 0x40aa4600
kallsyms_num_syms 66781, addr_count 66781
kallsyms_names pa 0x40b26e00, size 832778
kallsyms_markers pa 0x40bf2400
kallsyms_token_table pa 0x40bf2d00
kallsyms_token_index pa 0x40bf3100
Patching credentials
init_task VA: 0xffffffc000e3a960
Possible list_head tasks at offset 0x368
0xffffffc020120368 0xffffffc005caa5e8 0x000000000000008c
comm offset 0x5d8 comm: swapper/0
Found own task_struct at node 0
real_cred VA: 0xffffffc04bf7b800
Parsing sel_read_enforce
ffffffc00027ef40+04: ADRP x0, 0xffffffc000f46000
ffffffc00027ef40+1c: LDR [x0, 2116]
selinux_enforce VA: 0xffffffc000f46844
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@suez:/data/local/tmp # getenforce
Permissive
shell@suez:/data/local/tmp #

Thanks.
[Fire HD 8 and HD 10 General] diplomatic:
I came across some discussions that mention this phone is unlockable if it's on Nougat or downgraded to Nougat from Oreo. This is using the Asus unlock tool. Have you looked into that?
[Fire HD 8 and HD 10 General] gspitman:
All of this is running with no errors, but when I do "daemonsu --auto-daemon" event though I have a root@douglas prompt, I'm getting permission denied when I run it. Any ideas where I went wrong?
[Fire HD 8 and HD 10 General] mobaddict:
I am on Nougat but the Unlock Tool by ASUS doesn't work for me. I don't know how to make it work so I'm just stuck with this.
[Fire HD 8 and HD 10 General] dutchthomas:
Are you sure you ran the chmod step for daemonsu?
[Fire HD 8 and HD 10 General] gspitman:
Yes, I'm pretty sure I did. But I will try that again when I get back home today.
[Fire HD 8 and HD 10 General] Joven21:
sorry guys.. a very stupid question to ask since its my 1st fire tablet.

i had managed somehow to root it using the experimental method provided here. (using the semiautomated file provided)

However once i install play store, play protect scan and notice supersu and determine that it is unsafe to have.

it automatically uninstall the apk.

i had reinstall again and same thing happen.

anyway i can have supersu on my fire hd 8 7th gen permanently?

i got no idea how to install twrp after rooting too.

need some prof help please
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=6608279]Joven21[/MENTION], people have reported the same thing happening with SuperSU. You have to go into Play Store and turn off Play Protect. If that doesn't work, try installing the APK manually from another source.
[Fire HD 8 and HD 10 General] KingRedcode:
The reason so many people are having difficulty with the play store uninstalling their SuperSU is that the SuperSU apk that Rortiz provides in his SemiAutomatic script is bundled with at least 40 ad networks/activities. Technically, it isn't malicious (that's why VirusTotal doesn't pick anything up) but it is enough for the play store to flag it and delete it. I would recommend just using the play store version - it works perfectly.
[Fire HD 8 and HD 10 General] diplomatic:
Yes, I just checked it. Rortiz2's APK doesn't seem to be an authentic version. It doesn't match any of the SuperSU apps available on the Play store or those mirror APK download sites. Please look into this...
[Fire HD 8 and HD 10 General] gspitman:
This worked great!!
[Fire HD 8 and HD 10 General] anthonykb:
Output for ARMV7 Version, Root Not Achieved

Output from LG Tribute Dynasty :):D:):D

param1: 0x1000, param2: 0x8040, type: 4

Building symbol table

kallsyms_addresses pa 0x40e78360

kallsyms_num_syms 82817, addr_count 82817

kallsyms_names pa 0x40ec9180, size 1032377

kallsyms_markers pa 0x40fc5240

kallsyms_token_table pa 0x40fc5750

kallsyms_token_index pa 0x40fc5b00

Patching credentials

init_task VA: 0xc1428fa0

Possible list_head tasks at offset 0x2b0

0xeac782b0 0xd1a556b0 0x0000008c

Did not find comm (proc name) offset

Parsing sel_read_enforce

c0329de0: MOVW R12, #0x66b0

c0329de4: MOVT R12, #0xc172

selinux_enforce VA: 0xc17266b0

Setting selinux_enforce
[Fire HD 8 and HD 10 General] diplomatic:
Good stuff! That's very close. I'll send you a test version tomorrow.
[Fire HD 8 and HD 10 General] anthonykb:
Good to hear! Happy to help!

Thanks for all that you are doing for the community! Glad to help! Yeah it looked promising! :):D:):D
[Fire HD 8 and HD 10 General] Joven21:
noted with thanks.

I will install from playstore.

---------- Post added at 07:46 PM ---------- Previous post was at 07:36 PM ----------

i have successfully installed supersu from playstore

sorry for side tracking.

Can i install twrp (for my hd 8 7th gen) since i use the semiautomated method to root.

i cant seem to find a chat on it.
[Fire HD 8 and HD 10 General] diplomatic:
:D

OK, please test this one. I've fixed it hopefully & enabled it to actually hack the kernel to get root.
[Fire HD 8 and HD 10 General] anthonykb:
Here are the results

First run:

armv7l machine

param1: 0x1000, param2: 0x8040, type: 4

Building symbol table

kallsyms_addresses pa 0x40e78360

kallsyms_num_syms 82817, addr_count 82817

kallsyms_names pa 0x40ec9180, size 1032377

kallsyms_markers pa 0x40fc5240

kallsyms_token_table pa 0x40fc5750

kallsyms_token_index pa 0x40fc5b00

Patching credentials

init_task VA: 0xc1428fa0

Possible list_head tasks at offset 0x2b0

0xeac782b0 0xc6b320b0 0x0000008c

comm offset 0x430 comm: swapper/0

Found own task_struct at node 0

real_cred VA: 0xe7bff900

Parsing sel_read_enforce

c0329dec: MOVW R2, #0xdc90

c0329e00: MOVT R2, #0xc11b

selinux_enforce VA: 0xc17266b0

Setting selinux_enforce

Switched selinux to permissive

Trying this again...

Switched selinux to permissive

Results on consecutive runs:

armv7l machine

param1: 0x1000, param2: 0x8040, type: 4

Building symbol table

kallsyms_addresses pa 0x40e78360

kallsyms_num_syms 82817, addr_count 82817

kallsyms_names pa 0x40ec9180, size 1032377

kallsyms_markers pa 0x40fc5240

kallsyms_token_table pa 0x40fc5750

kallsyms_token_index pa 0x40fc5b00

Patching credentials

init_task VA: 0xc1428fa0

Possible list_head tasks at offset 0x2b0

0xeac782b0 0xe87502b0 0x0000008c

comm offset 0x430 comm: swapper/0

Found own task_struct at node 0

real_cred VA: 0xc5abd180

Parsing sel_read_enforce

c0329dec: MOVW R2, #0xdc90

c0329e00: MOVT R2, #0xc11b

selinux_enforce VA: 0xc17266b0

Setting selinux_enforce

Selinux is already permissive

id shows this:

uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(ad

b),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),300

6(net_bw_stats),3009(readproc) context=u:r:shell:s0

Sets permissive selinux but no root :):D:):D
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=7428782]anthonykb[/MENTION], OK, thanks... I'm not sure why that is. From the log, everything seemed to go well. There are several possibilities I can think of, which are not specific to the 32-bit kernel. Let me cook something up to test it and then I'll PM you...
[Fire HD 8 and HD 10 General] anthonykb:
Thanks I'll be willing to test something

However many trials it'll take in time to get this finished, I'll be willing to test until it's perfected or at least the software root achieved. Thanks you're awesome dude. You would be the first to have devised a root for the LG Tribute Dynasty. :):D:):D
[Fire HD 8 and HD 10 General] bigrammy:
v11 Nokia 3 Android 8.1

Busy day at work :crying:

Result of test :good:

cp /sdcard/mtk-su $HOME
$ chmod 755 mtk-su
$ ./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 12
Building symbol table
kallsyms_addresses pa 0x40a70900
kallsyms_num_syms 40733, addr_count 40733
kallsyms_names pa 0x40ac0300, size 509996
kallsyms_markers pa 0x40b3cc00
kallsyms_token_table pa 0x40b3d100
kallsyms_token_index pa 0x40b3d500
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Stack protection detected
ffffffc0000cb134+20: ADRP x21, 0xffffffc000dd5000
ffffffc0000cb134+24: ADD xd, x21, 3712
init_task VA: 0xffffffc000dd5e80
Possible list_head tasks at offset 0x340
0xffffffc078f37340 0xffffffc0720d8340 0x000000000000008c
comm offset 0x5f8 comm: swapper/0
Found own task_struct at node 0
real_cred VA: 0xffffffc01142eb40
Parsing sel_read_enforce
Stack protection detected
ffffffc0002a6928+28: ADRP x0, 0xffffffc000fd0000
ffffffc0002a6928+38: LDR [x0, 2788]
selinux_enforce VA: 0xffffffc000fd0ae4
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
[Fire HD 8 and HD 10 General] diplomatic:
Perfect, [MENTION=3924647]bigrammy[/MENTION]! Release 11 is ready...
[Fire HD 8 and HD 10 General] diplomatic:
Release 11

R11 has dropped. This should bring compatibility to many/most 32-bit kernel phones. (Why they still make 32-bit kernels for 64-bit chips... one of life's many unsolved mysteries.) As always, let me know of any problems on compatible devices.
[Fire HD 8 and HD 10 General] Mobkore:
I'm not interested in rooting or flashing rooms but I would like to disable a bunch of Amazon apps from my kindle 8 8th gen... If i gain temporary root, using this method, would i be able to uninstall them via command line? Disable?
[Fire HD 8 and HD 10 General] Rortiz2:
Yes. Just use pm disable

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] DB126:
On 8th gen devices running FireOS v6 most packages can be disabled via adb without root. I have yet to find one I couldn't clobber...but I only go after observed offenders vs everything detectable. Works a treat!

https://www.xda-developers.com/disable-system-app-bloatware-android/
[Fire HD 8 and HD 10 General] Mobkore:
Really? Damn, I assumed they would just auto restart upon boot.

Do if disabling via and works does uninstalling for user 0 also work? I just wanna get rid of Alexa, silk, freetime, game center etc
[Fire HD 8 and HD 10 General] Mobkore:
hmmmm, what am I doing wrong in Fire OS 6?

adb devices

List of devices attached

G0W0T90XXXXXX	no permissions; see

adb shell pm disable-user --user 0 com.amazon.webapp

error: insufficient permissions for device

See or more information

I have USB debugging on under developer options
[Fire HD 8 and HD 10 General] diplomatic:
If you're in Linux, try using sudo adb...
[Fire HD 8 and HD 10 General] Mobkore:
NICE... managed to disable all the amazon crap that kept eating ram (alexa, cards, etc...)

I'm not going to try to uninstall the apps for user 0 to see if I can free up some storage.

A question: with diplomatic's temporary root would it be possible to replace the launcher or is that something that requires permanent root?
[Fire HD 8 and HD 10 General] DB126:
Using launcher hijack I switched to Nova then disabled firelauncher via adb w/o rooting on a 2018 HD 8. Made no attempt to uninstall as package is located in system partition and thus has no impact on user accessible storage. Also like ability to reenable packages selectively as desired/needed without having to reload/reset.

Methodology is simple: see what's consuming excessive (operative word) resources via Memory and Running Services under Developer Options, then disable biggest offenders via adb. Also a great way to control unwanted activity like lock-screen ads.

This hybrid approach has pros/cons. Since my HD 8 is a secondary device I favor ability to use banking/streaming apps w/o having to screw with hiding root. I opt to sideload everything vs mess around with the Play Store under FireOS. Performance/responsiveness is acceptable once Amazon crud is tamed although aggressive swapping, relatively weak cpu and limited zram puts a lid on multitasking.
[Fire HD 8 and HD 10 General] bibikalka:
32-bit kernel support? I tried v11 on Blu R1 (mt6735, armv7l architecture, Android 6.0), and got this:

shell@R1_HD:/data/local/tmp $ ./mtk-su_av11 -v
armv7l machine
Cannot start: incompatible system
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=6680544]bibikalka[/MENTION], try the one in the armv7-kernel directory....
[Fire HD 8 and HD 10 General] bibikalka:
Wow, this is incredible! Great job, man!!! :D It works!!!

For the record, I do already have root, but nonetheless:

shell@R1_HD:/data/local/tmp $ ./mtk-su_arm7 -v
armv7l machine
param1: 0x1000, param2: 0x8040, type: 7
Building symbol table
kallsyms_addresses pa 0x40b8eb20
kallsyms_num_syms 55046, addr_count 55046
kallsyms_names pa 0x40bc4750, size 645020
kallsyms_markers pa 0x40c61ef0
kallsyms_token_table pa 0x40c62250
kallsyms_token_index pa 0x40c625d0
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
c00528c8: MOVW R7, #0xea90
c00528cc: MOVT R7, #0xc0f8
init_task VA: 0xc0f8ea90
Possible list_head tasks at offset 0x290
0xdac4c290 0xc3855290 0x0000008c
comm offset 0x400 comm: swapper/0
Found own task_struct at node 2
real_cred VA: 0xc2181e80
Parsing sel_read_enforce
c023f4ec: MOVW R12, #0x4274
c023f4f0: MOVT R12, #0xc111
selinux_enforce VA: 0xc1114274
Setting selinux_enforce
Switched selinux to permissive
Trying this again...
Switched selinux to permissive
Trying this again...
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@R1_HD:/data/local/tmp #
[Fire HD 8 and HD 10 General] diplomatic:
Woot! Had no doubt about it. :D Thanks for the feedback.
[Fire HD 8 and HD 10 General] bibikalka:
Overly self-confident much ? ;) Nah, cannot be ... :D

I created a thread to announce to the BLU crowd that now there is root:

https://xdaforums.com/r1-hd/how-to/blu-r1-root-os-version-t3921163

Perhaps, [MENTION=5312578]mrmazak[/MENTION] (a BLU veteran from the 2016 days!) would unlock a few more bootloaders in here using your new mtk-su version! :D
[Fire HD 8 and HD 10 General] diplomatic:
Ha! It can be in hindsight.

Cool! More free publicity. I remember looking at that tool a while ago to see how it worked. I'm sure it'll work with this temp root.

BTW, I wish I knew you had that phone. The testing phase of the new arm-kernel version would have gone a lot quicker. ;)
[Fire HD 8 and HD 10 General] NFSP G35:
I've noticed the fire is pretty terrible at multitasking, but didn't know why.

Is there anything to be done about it now that we have root?
[Fire HD 8 and HD 10 General] mrmazak:
Is it ok for me to use your elf file in my R1-HD 'tool'.?

I have printed credit like in photo attached.

And credits will of course go into xda thread.
[Fire HD 8 and HD 10 General] DB126:
Limited RAM, pokey CPU and aggressive use of ZRAM are the primary culprits. Nothing you can do about the hardware constraints but you can adjust virtual memory characteristics. First easy step is to dial back swappiness to 10 using a free tool such as Apps2SD. If that improves things you can then add a small static swap file to the mix. Makes a pretty sizable difference in performance, especially with Lollipop based FireOS v5.
[Fire HD 8 and HD 10 General] bibikalka:
I actually tested mtk-su on BLU couple of weeks ago, but then saw your stern warnings about 64 bit kernel only, and kind of gave up. Then I saw your 32 bit support comment, and was very surprised, so tried again ! ;)

Btw, running mtk-su the 2nd time without reboot in between finds that permissive Linux is already on. Could mtk-su detect that, and skip the hacking piece in the 2nd run? It should just proceed directly to invoke a root shell if it's already permissive, that would be way faster for sudo type of use.
[Fire HD 8 and HD 10 General] Mobkore:
you can get decent performance out of the fire hd 8 (using the 8th gen one):

I loaded up Google play services and the multitasking and general performance was terrible, here's what I did:

Removed Google play services and store (the ram price, performance hit does not justify them)

Installed apkgrabber to manage Google store apps

Disabled Amazon store and Amazon services that take huge amounts of ram in the background (alexa, showmode, Amazon video, kindle store etc)

It has been a night and day difference for me and the tablet is much more nimble

Right now I'm going to see if I can follow Davey and disable the launcher and Amazon home pages (???? Consumes ram like crazy) and use nova instead

I'll see if it performs any better... The trick with fire hd 8's is to disable all the background services

Edit: following Davey's advise I disabled both the firelauncher and paladin and installed a basic low ram launcher... The weird glitches with launcher hijack are gone since I disabled firelauncher ... Kindle feels amazing.

The only thing I'm not sure about is the launcher hijack since i have no idea who coded it and it has system access, with the fire launcher disabled is there anyway to uninstall launcher hijack and keep using a custom launcher?

You know what would the perfect Rom for these kindle tablets be: Android Go
[Fire HD 8 and HD 10 General] DB126:
Be a bit risky as FireOS provides no mechanism for setting the default launcher leaving you to rebuild or mess around w/adb commands if you custom launcher failed to start.

Launcher hijack does not communicate with the outside world and consumes minimal resources. Just leave it.