yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] lifegap:
Anyway to install magisk n xposed?

From what I learnt that Magisk only be installed on HD10 2017 or HD8 2018 which bootloader can be unlocked. Other models cannot. I tried Magisk on my HD8 2016 so get bootloop in Amazon logo :(.

You can get flashfire to flash anything

---------- Post added at 10:24 AM ---------- Previous post was at 10:24 AM ----------

From what I learnt that Magisk only be installed on HD10 2017 or HD8 2018 which bootloader can be unlocked. Other models cannot. I tried Magisk on my HD8 2016 so get bootloop in Amazon logo :(.

You can get flashfire to flash anything
[Fire HD 8 and HD 10 General] DKXC:
For the Fire HD 8, 2018: how do I not trigger dm-verity? Should I just exit the ADB shell, and restart without mounting?

---------- Post added at 10:04 PM ---------- Previous post was at 09:41 PM ----------

Okay for some reason when I try to uninstall apps, it gives me "Failure [DELETE_FAILED_INTERNAL_ERROR]"
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=9281926]DKXC[/MENTION], if you want to install Magisk, it's a bit more complicated on that tablet. You have to unlock the bootloader, as described in this thread.

I'm not sure you can truly uninstall system apps without changing /system, but you can disable them, which is just as good.
[Fire HD 8 and HD 10 General] hyperblu:
[MENTION=8132642]diplomatic[/MENTION] I'm having some trouble. I am getting 0/0 and selinux is passive, but I am not getting root shell on FTV2. I'm assuming the su binary is not all there? I'm not able to install twrp without accessing root shell... How are we working around this?
[Fire HD 8 and HD 10 General] DKXC:
It's all good now, it worked, I didn't use adb for a long time.

I ran them with -k --user 0 and it worked, restarted and no dm-verity. Finally a debloated tablet :D
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=7935495]hyperblu[/MENTION], what do mean you're not getting a root shell? Is it a shell, just not root? Or no shell at all? If there is a shell, how did you determine that it's not a root shell? Excuse the thousand questions, just not enough info in your post. :)
[Fire HD 8 and HD 10 General] hyperblu:
[MENTION=8132642]diplomatic[/MENTION] I'm getting shell, just not able to make commands under su, which is why I questioned if the su binary is even there.

---------- Post added at 12:14 AM ---------- Previous post was at 12:11 AM ----------

When I try to make root commands using the mtk-su -c it says "newline" syntax error.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=7935495]hyperblu[/MENTION], of course su is not going to be there unless you install it. But with the mtk-su shell, you have full privileges to run any command that you can with su. That's why the 'su' in mtk-su. ;) Just omit the 'su' from the front of your command. As for the syntax error, please be more specific. What is the exact command you're trying to run? From which host OS?
[Fire HD 8 and HD 10 General] hyperblu:
Im trying to install twrp using the command "mtk-su -c sh /sdcard/firetv2_recovery_v7.zip” and press enter.

the next line says /system/bin/sh: mtk_su not found. Its not even trying to run under mtk-su commands.
[Fire HD 8 and HD 10 General] THERAJ12:
Will disabling free up space?
[Fire HD 8 and HD 10 General] diplomatic:
You need to call mtk-su just like you did before: ./mtk-su ... or use the full path of where it's at.

To make it simpler, just do it in multiple steps:

./mtk-su

sh /sdcard/firetv2_recovery_v7.zip

exit

If you had ever updated the system app and you uninstall the updates before disabling, then yes. But even uninstalling it from the system partition will not free up any useful space because you don't normally use that partition for your files.
[Fire HD 8 and HD 10 General] THERAJ12:
When I used titanium backup to uninstall bloatware I went from 8gb free to 12gh free which allows more space for the apps I really want
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=1573977]THERAJ12[/MENTION], actually, there's also app data & cache that you can clear. So yeah, that will free up (more) space on your data partition.
[Fire HD 8 and HD 10 General] hyperblu:
I was using windows powershell, so I wasn't aware I was already in root shell after executing mtk-su because the symbols are so blurry, smh. I have it working now and currently pushing rbox prerooted room via adb. Thanks! [emoji38]
[Fire HD 8 and HD 10 General] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] why this exploit doesn't work with mt8127? If it were compatible I would not have opened my tablet to root it.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION], it doesn't work with 32-bit chips because the exploitable system components are just not there...
[Fire HD 8 and HD 10 General] soweic:
SuperSU shows: Root undetected

HD8 2017
[Fire HD 8 and HD 10 General] samuel6827:
Go into SuperSu setting and set prompt to grant
[Fire HD 8 and HD 10 General] hochoch:
i ran into this too. i had root on my hd 8 7th 2017, tried to flash youtube vanced through ex manger and got a bootloop. i reinstalled the OS and got back to where i was, but when i ran the exploit and installed supersu, it get this error. it appears i'm rooted from the output: uid=0(root) gid=0(root) groups=0(root)

but when it says "undetected" i can't get rid of the screen that says it without closing the app, so settings aren't an option. anyone else have a similar situation/advice? it's for my kid so i'd really like to fix it and get the tablet back to him.

thanks!

Edit: followed manual directions someone posted on first page to put SuperSU components in right place and that worked.
[Fire HD 8 and HD 10 General] rabidbat:
im so lost i get this /mtk-su: not found
[Fire HD 8 and HD 10 General] diplomatic:
If you already pushed the file, entered the adb shell, and changed to the directory with mtk-su, then you have to run it like this:

./mtk-su

(Don't forget the dot.)
[Fire HD 8 and HD 10 General] Colossus96:
How to restore the tab if i get bootloop? Do i just download the update from amazon website & use adb to push it to system? Pls tell me the detail procedure.
[Fire HD 8 and HD 10 General] gretschpr:
Please bear with me on this ok? I'm stuck on the part where I push the mtk-su...i put the command and says no such file exist...can someone guide me on how to push it? I'll appreciate it

Edit: I mean, where do I need to put the file exactly so it gets recognize, I apologize for the nooby question, I have certainly rooted the majority of my smartphones, but I don't have that much experience with adb ?
[Fire HD 8 and HD 10 General] hochoch:
Download the correct firmware .bin file for your tablet from amazon. go into the recovery options on the fire, usually by holding down power and volume up or down while it is rebooting. scroll down to the "apply update from adb" option. make sure you have adb/platform tools installed already. open up a command prompt and type adb devices to make sure your pc is seeing the tablet while in adb mode. if it does, in the command prompt, type: adb sideload

then drag and drop the .bin file into the command prompt so the file path is correct. hit enter and it should start applying the update. it took me a couple tries to get it to recognize the device and apply. once it did, it booted right up where i left off. i was worried it was a factory reset, but it's like flashing a security update to your phone w/ the -w removed (if that makes sense). I used this crappy video as a guide:

https://www.youtube.com/watch?v=x_eY_-rlfX4

---------- Post added at 03:45 PM ---------- Previous post was at 03:41 PM ----------

try using the automated script found in this post: https://xdaforums.com/showpost.php?p=79077668&postcount=238

just pay attention to the 1-2 inputs you have to do as it prompts you. it worked for me until i borked it by trying to install something i shouldn't have.
[Fire HD 8 and HD 10 General] Colossus96:
When entering super su it says root undetected and closes the app. How can i install super su?

---------- Post added at 06:40 AM ---------- Previous post was at 06:11 AM ----------

I am getting mounting system partition as rw is denied.
[Fire HD 8 and HD 10 General] Colossus96:
I am not getting read write permission to system. Otherwise i am getting shell root. Because of system i can't install supersu.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=6389687]shawon11[/MENTION], exit the root shell and try again with mtk-su. Sometimes it doesn't succeed in disabling selinux.
[Fire HD 8 and HD 10 General] Colossus96:
No. It diabled selinux. I ran getenforce .. it showed permissive. The problem is grafics id is not 0.. see the picture. Other wise i get root@doglus. And can run ls. I didn't try anything else.

When exit the shell tab restart. Is it normal?

---------- Post added at 08:46 AM ---------- Previous post was at 07:57 AM ----------

Thanks to you i finally managed to root my fire hd 8 (7th gen) now if i do a factory reset will i loose root?
[Fire HD 8 and HD 10 General] gretschpr:
Hi, thanks for helping! I managed to succeed in root. But I then went to uninstall and freeze a bunch of apps using titanium backup and now the tablet stays on the fire logo (booting endlessly) lol

I guess I'll have to get the update bin file and sideload it as you pointed to the other guy. I'm on an older system version (can't recall the exact version number but it was last updated on Nov. 2018) so, if i get the latest firmware version, I should be able to root again, since the method is compatible with all versions up until now, right?
[Fire HD 8 and HD 10 General] hochoch:
It seems that way! I just downloaded the most current OS version and flashed that via adb. I was able to gain root again, albeit with more effort than the first time. Here is the post I used to gain root again after flashing the update: https://xdaforums.com/showpost.php?p=78991273&postcount=10

Note that at step 6 of the OP i used this command to gain access to the root shell instead of the command provided (also included in the OP instructions): Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.

Good luck!
[Fire HD 8 and HD 10 General] gretschpr:
Nice! Thanks for replying and helping out! I just finished downloading the bin file, I'm almost ready to update and root again, wish me luck! (you already did lol) ✌️
[Fire HD 8 and HD 10 General] diplomatic:
No, I don't think tablet restarting is normal. No idea what happened there. Don't think anyone else reported this...

OK, great! Factory reset will not remove your root. But you may have to reinstall the SuperSU app.
[Fire HD 8 and HD 10 General] dh010447:
Fails at step one, any thoughts?

glynd-a01:arm glynd$ adb push mtk-su /data/local/temp

adb: error: failed to copy 'mtk-su' to '/data/local/temp': remote couldn't create file: Permission denied

mtk-su: 0 files pushed. 5.0 MB/s (17696 bytes in 0.003s)
[Fire HD 8 and HD 10 General] Dan_firehd:
You might have a typing error.

It should have been : /data/local/tmp

NOT : /data/local/temp
[Fire HD 8 and HD 10 General] dh010447:
Thank you Dan... Seems I need to learn how to read... lol
[Fire HD 8 and HD 10 General] Technocian:
DUDE YOU ARE THE MAN!

Didn't think I would ever have root on this thing. Also, I forget to do "cd whateverpathmyarm64folderwasin" so I kept spamming the first command to no avail until I finally figured it out.
[Fire HD 8 and HD 10 General] dutchthomas:
No worries! [MENTION=8132642]diplomatic[/MENTION] did the hard part. Good work sticking with it
[Fire HD 8 and HD 10 General] tailstwilight:
Hey everyone.

I bought a new Fire HD 8 with Alexa Hands-Free (8th Generation), and well, it's not completely the same. The model is "KFOCWI" and the codename is "octopus", but all the karnak/KFKAWI steps worked fine, so yes, I am rooted and unlocked.

Firmware is Fire OS 6.3.0.1,

Based on Android 7.1.2 Neko

Build number NS6301/0001309035396

Build date is Dec. 4 2018.
[Fire HD 8 and HD 10 General] diplomatic:
Release 8 uploaded -- Needs Testing

Just posted the next version of mtk-su. This one is much faster. (With a lot of room for improvement still.) The reliability has increased as well. The main focus of this release is Android Oreo. I've added the groundwork for that OS, which means I don't have confirmation that it works yet, and will probably require fixes to finalize support for it. Of course let me know if anything's broken for already confirmed devices.

Need testers for MTK Android Oreo devices

See the special instructions for Oreo in post 3
[Fire HD 8 and HD 10 General] bibikalka:
[MENTION=8132642]diplomatic[/MENTION]

Fire HD8 2016 (MT8163V/B) - works

Fire HD10 2017 (MT8173) - no go:

shell@suez:/data/local/tmp $ ./mtk-su -v
Building symbol table
ioctl: No message of desired type
read_at_pa() failed
Error in find_kallsyms_addresses()
Unable to get kernel symbol table
starting /system/bin/sh
shell@suez:/data/local/tmp $

Fire HD7 2014 (MT8135) - no go:

shell@ariel:/data/local/tmp $ ./mtk-su
/system/bin/sh: ./mtk-su: not executable: 64-bit ELF file
shell@ariel:/data/local/tmp $ exit

Need to test:

Fire Stick 4K - MTK8695

Fire Stick 2nd gen - MT8127D (seems the same as Fire 7 2015/2017)
[Fire HD 8 and HD 10 General] diplomatic:
Whoa, you mean if it doesn't depend on any external libraries a 64-bit executable will load just fine even though the high-level system is only 32-bit? That's some sorcery right there. :) I'll keep that in mind.

But anyway I did just compile an arm version for you to test. (Unless someone beats you to it. [MENTION=6680544]bibikalka[/MENTION]?) It took more than a few tweaks to suppress the compiler warnings and make it run. ;) But I tested it on my tablet and it worked out just fine. The attached zip file has both arch's. Both of these deal with a 64-bit kernel, and in general I recommend you use the arm64 unless your device only has a 32-bit software base.

Thank you, sir.... You did have unlocked BL & root before TWRP, right? So the TWRP is not mutually exclusive to this exploit.

For intermittent errors like this, you have to keep your screen on and try again.

OK, I see. (Is that even the right remount command?) When you push the su-related binaries from Windows, you have to set the right permissions for the files because Windows does not distinguish between executable and not. This is something that hasn't been mentioned before.

Signs point to yes. :)
[Fire HD 8 and HD 10 General] diplomatic:
OK, I'll look into it for the HD 10. But I can tell you right now it will never work on the 2 devices you listed, the Fire TV Stick 4K and Fire TV Stick or any mt8127 based device.
[Fire HD 8 and HD 10 General] xyz`:
Yep it works now, took two tries to get selinux into permissive mode though (first got the root shell but selinux remained in enforcing mode, second running same command from the root shell put it into permissive successfully).
[Fire HD 8 and HD 10 General] diplomatic:
Sweet! Another device to the confirmed list. The selinux not being set sometimes, I just noticed that myself. It's another intermittent memory access glitch that you have to retry the exploit to get around.
[Fire HD 8 and HD 10 General] dutchthomas:
Good catch, I missed the permissions step! I might have gotten the permissions correct on my first failed attempt (coincidentally) and so I didn't need it again. I'll update my instructions after work
[Fire HD 8 and HD 10 General] Datastream33:
Ok, thank you. I'm going to try this method on Blu Vivo 8L.

---------- Post added at 01:55 AM ---------- Previous post was at 01:43 AM ----------

Ok, so I tried the steps and was met with an error when trying to run it.

The error is as follows:

ioctl: Invalid Argument
Error allocating driver buffer

What am I doing wrong? Does this mean it will not work for my device?
[Fire HD 8 and HD 10 General] bibikalka:
Cool! This may become the go-to method to access BootRom for the next generation of bootloader unlocking tools (instead of cover removal & contact shorting). Hopefully, it goes into BootRom like that on every MTK Fire tablet! Not having amonet write LK/TZ will greatly decrease the chance it'll freeze during the writing operations.

Just checked - LK+TZ size is about 3.7Mb. Just the preloader plus the little pieces is ~ 150k. So pre-writing LK/TZ/TWRP/boot via dd before going into BootRom will decrease the amount of data that needs to be written by about 25x! That's a lot less risk to have it freeze during the procedure.
[Fire HD 8 and HD 10 General] cybersaga:
So I tried it on my Acer B3-A40 tablet and got this:

./mtk-su -v
Building symbol table
Error in find_kallsyms_addresses()
Unable to get kernel symbol table
starting /system/bin/sh

I don't know if anything can be done about that. Maybe this has a kernel that's patched. (kernel is 4.4.22)
[Fire HD 8 and HD 10 General] diplomatic:
Hmm, there's nothing you're doing wrong. That result is odd, but I suspect mtk-su will need some tweaking to be compatible with that phone. I've checked some sources for mt6755 online. There's nothing that stands out to me yet. Do you have a link to kernel sources for that particular device?

That's weird, but I'd say promising. Do you have a link to the kernel sources?
[Fire HD 8 and HD 10 General] cybersaga:
Nothing here. I can try to poke around and see what I can find. I don't know where I'd find it if not the Acer site though.

---------- Post added at 08:52 PM ---------- Previous post was at 08:49 PM ----------

The source code for a similar model is available (under "Documents"): https://www.acer.com/ac/en/CA/content/support-product/7318?b=1

But a slightly different CPU: MT8167A
[Fire HD 8 and HD 10 General] my.ads0:
Well holy hell! That was really simple! The work that people do on this site continues to blow my mind. Thanks so much for your efforts and taking this root from PhD lvl to the tale of a 4th grade nothing. Much appreciated.

Fire HD 8 2017
[Fire HD 8 and HD 10 General] Oco:
Thanks, this is is to confirm root in HD8 2016. For all noobs as me [MENTION=8132642]diplomatic[/MENTION] [MENTION=4584276]dutchthomas[/MENTION] allow me to resume ADB commands/steps. Thanks again.

>>> Install SuperSu from Playstore, Aptoide, or any updated store/source
>>> From OP download/extract mtk-su and superSu (arm64 folder) in your ADB folder (easy to reach)
adb push arm64/su /data/local/tmp
adb push arm64/supolicy /data/local/tmp
adb push arm64/libsupol.so /data/local/tmp
adb push mtk-su /data/local/tmp/
adb shell
cd /data/local/tmp
chmod 755 mtk-su
>>> keep your tablet screen on and don't let it go to sleep
./mtk-su -v
mount -o remount -rw /system
>>> if it fails retry previos step
cp /data/local/tmp/su /system/xbin/su
cp /data/local/tmp/su /system/xbin/daemonsu
cp /data/local/tmp/supolicy /system/xbin/
cp /data/local/tmp/libsupol.so /system/lib/
cp /data/local/tmp/libsupol.so /system/lib64/
chmod 0755 /system/xbin/su
chcon u:object_r:system_file:s0 /system/xbin/su
chmod 0755 /system/xbin/daemonsu
chcon u:object_r:system_file:s0 /system/xbin/daemonsu
daemonsu --auto-daemon
>>> Open SuperSu app and allow it to update-normal, reboot, in settings put default access to Grant

After unistalling Amazon apps if you messed up the firmware (because root survives factory reset) you need to sideload official firmware from stock recovery mode.

A great list to manually disable apps in:

https://xdaforums.com/hd8-hd10/development/tips-tricks-root-t3310569
[Fire HD 8 and HD 10 General] Shadowwolf218:
Alright, I'm probably screwing this up somehow, but I'm getting "Error opening interface" when I try to execute the binary.

Device: Kindle Fire HD8 (5th gen)

Fire OS 5.3.6.4 (626533320)

Steps:

Download release 2 (since I can't use the 64-bit version)

Extract to /mtk/

adb push /mtk/arm/mtk-su /data/local/tmp/

adb shell

cd /data/local/tmp/

chmod 755 mtk-su

./mtk-su -v

Error opening interface

Sorry to bug y'all with this, I'm sure it's something super basic. Thanks for all the hard work getting this software root going.
[Fire HD 8 and HD 10 General] my.ads0:
...because, according to the OP, the Fire HD 8 5th gen isn't supported?
[Fire HD 8 and HD 10 General] Shadowwolf218:
...that would do it.

I totally thought I saw 5th gen in the list under 6th, not the Zenpad.

My fault. *facepalm*
[Fire HD 8 and HD 10 General] my.ads0:
Heh. I know how you feel. I was following the 8th gen root thread for a while and was excited to see how easy the hardware root method was. I read the entire thread, cleared a spot on my calendar, got myself prepared to root, and then realized I had the 7th gen, not the 8th!

It happens to the best of us.
[Fire HD 8 and HD 10 General] Rortiz2:
Yeah! But with this method I can root without unlocking the BL.

I can confirm that also works on BQ M10 that also useS MT8163
[Fire HD 8 and HD 10 General] plusmce:
Sorry i am new how can i extract mtk-su to /mtk/ ?
[Fire HD 8 and HD 10 General] teamfresno:
That's just a folder. You could name it whatever you want and then extract to it with winrar, winzip or whatever program you want to use. I usually extract the file that I want to push to where my ADB files are. It makes it a whole lot easier.
[Fire HD 8 and HD 10 General] master.peterm:
Is anyone working on TWRP for 2017 HD8?
[Fire HD 8 and HD 10 General] THERAJ12:
You need an unlocked BL first
[Fire HD 8 and HD 10 General] 0mr1:
Device: Nokia 3 (TA-1032)

OS Version: 8.1.0

Kernel Architecture: aarch64

Kernel Version: 3.18.79+

Results:

$ pwd
/data/data/com.termux/files/home
$ ls -l mtk-su
-rwx------ 1 u0_a174 u0_a174 34424 Mar 31 09:24 mtk-su
$ ./mtk-su -v
Cannot start. Try running this program from an app.
[Fire HD 8 and HD 10 General] bigrammy:
Sony XA1 Android 8.0

Sorry about the screenshots but for some reason termux does not pass the full verbose print out to a .txt file on sdcard. :confused:
[Fire HD 8 and HD 10 General] diplomatic:
Wow, awesome! Even though you didn't get uid 0 yet, it shows Oreo support is possible! I'll send you some test versions to fix that....

BTW, you can just copy-paste the text by long tapping the terminal screen....
[Fire HD 8 and HD 10 General] bigrammy:
Sony XA1, mt6757, Android 8.0, Kernel v4.4.83+

You are a genius :highfive: :victory:

Thank you!!!!

Notice my ta partition is backed up before unlocking the bootloader and if you know anything about Sony devices you will know this is the Holy grail for all Sony users.

I can't thank you enough. :o
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=3924647]bigrammy[/MENTION], yeah, I was sure that would happen :cool:
[Fire HD 8 and HD 10 General] De2290:
Is it possible to install SuperSU using Termux with this method?

Edit: also, I got permission denied using Termux with this method when I cd to the /root directory. Is that supposed to happen? I cannot run getenforce to check it.
[Fire HD 8 and HD 10 General] earthspiritraven:
Didn't understand very well what you need. But I've a phone (Alcatel 5 5085B) with Android 6.0 Kernel 3.18.19, security patch August 2018. It would seem that the exploit works (March 31, 2019, R7) as per the instructions in OP, since ID gives (uid=0(root) gid=0(root) groups=0(root) context=u:r:shell:s0)

First lines of the output are, although the last line I'm attaching seems suspect as I've ot seen it in the other outputs here:

param1: 0x1000, param2: 0x8040, type: 7

Building symbol table

kallsyms_addresses pa 0x40ba4d00

kallsyms_num_syms 55416, addr_count 55416

kallsyms_names pa 0x40c11200, size 654426

kallsyms_markers pa 0x40cb0f00

kallsyms_token_table pa 0x40cb1600

kallsyms_token_index pa 0x40cb1a00

Patching credentials

__ksymtab_init_task not found

Haven't been able to get permanent root yet, I'm unable to mount /system as rw. Maybe it has to do with the verity-dm seting? No the bootloader is not unlocked as I cannot enter fastboot to do so (I think it is one of the roms that [MENTION=5437200]PizzaG[/MENTION] mentions that do not have that little piece of code).