yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Rortiz2:
I explain my goal:

Root without Unlock BL.

I confirm that the tablet does not use dm-verity (I have checked).

If I install supersu, I have root until I reboot and stuck in BootLogo.

If I do not restart and use flashfire for flash to preerooted image this will work?
[Fire HD 8 and HD 10 General] BlueFlame4:
Sorry for the weird question but couldn't he dd the bootimage (via your temporary root), unpack it, disable dm-verity in fstab, repack, dd onto boot partition (via your temporary root) and be done? Or has dm-verity to be disabled in-kernel?

Cheers,

Jan
[Fire HD 8 and HD 10 General] diplomatic:
Do you know if it's installing it in systemless mode? Because your only option is to avoid touching the boot image and install it in system mode (to the system partition). I found something you need to do to force it to system mode. Run the command 'echo SYSTEMLESS=false >> /data/.supersu', which will let the installer know you don't want systemless.
[Fire HD 8 and HD 10 General] diplomatic:
Yes, that will work if he unlocks the BL. But he doesn't want to unlock it for some reason. The other possibility is to sign it yourself with the standard android boot signer and see if it simply gives you a warning about yellow state instead of refusing to boot.
[Fire HD 8 and HD 10 General] Rortiz2:
I do not want to unlock the bootloader so that I do not get the message of:

Your device has unlocked and can not be trusted ...
[Fire HD 8 and HD 10 General] BlueFlame4:
...but it's the truth anyways! :silly:
[Fire HD 8 and HD 10 General] Rortiz2:
I already know it...

Well anyway, I'll continue using the TWRP method.

Anyway thank you very much!
[Fire HD 8 and HD 10 General] diplomatic:
This is also true for most stock Mediatek devices as of now. With this weakness present, any app can become root....

So how about hitting some gratitude buttons for a change???? ;)
[Fire HD 8 and HD 10 General] inscythe:
Finally I have a reason to update my old Fire HD8 6th gen to the latest firmware. Was previously using 5.2 with its ****ty notification bar, but now I'm rocking 5.6.3.0 no problem!

Had to restart the mtk-su to get the remount working to install SuperSU, then after that it was smooth sailing! Thanks OP!
[Fire HD 8 and HD 10 General] BlueFlame4:
Yup, I've been using MTK devices for a while and it's gotten better already but still there's plenty of open doors.

On another note, you might qualify for Amazon's bug bounty program. Just saying :)
[Fire HD 8 and HD 10 General] bigrammy:
Hi,

Would it be possible for your binary to automatically dump some small partitions while it's executing the temp root?
[Fire HD 8 and HD 10 General] Rortiz2:
Yes, you can use:

dd if=partition/path of=/sdcard/dump-name
[Fire HD 8 and HD 10 General] bigrammy:
Thanks Rortiz2,

Can I do this without mounting the system rw as my device has dm-verity enabled.
[Fire HD 8 and HD 10 General] Rortiz2:
'-_-
[Fire HD 8 and HD 10 General] Rortiz2:
Yes! Tested without mounting system rw:

root@Aquaris_M8:/ # dd if=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/recovery of=/storage/emulated/0/recovery.img
msdc.0/11230000.MSDC0/by-name/recovery of=/storage/emulated/0/recovery.img <
32768+0 records in
32768+0 records out
16777216 bytes transferred in 2.793 secs (6006880 bytes/sec)
[Fire HD 8 and HD 10 General] bigrammy:
Many thanks :good:

I will test this on some of my Sony mtk devices as it could be very useful for grabbing ta partition backup before unlocking the bootloader :fingers-crossed:
[Fire HD 8 and HD 10 General] sga999:
I get an error on the mount command now that it is in the .sh file. It works if I paste it into the shell, as I was doing before with your previous files. Is it working for you when it's in the .sh file? Here's the error that displays. Usage: mount [-r] [-w] [-o options] [-t type] device directory
[Fire HD 8 and HD 10 General] sga999:
No luck. I tried your new mount command, but it had the same problem. Strange that it's fine when not in the script file. Then, very weird, while I was trying it multiple times, somehow it rebooted and was in a bootloop. I had to use adb sideload, etc. to get back to where I had been. Kind of a pain. I have no idea how I could have caused that, just trying a mount command!

Anyway, I'll keep trying and see what I can figure out. I have modified your files to suit the way I have things set up, so I suppose that could be messed up. But again, if I do the mount outside of the script (either format that you had), all is well. So it's a mystery.
[Fire HD 8 and HD 10 General] BlueFlame4:
Probably dm-verity?
[Fire HD 8 and HD 10 General] diplomatic:
So have you tried this yet? Does it work on your Sony mt67xx phones?
[Fire HD 8 and HD 10 General] AccountForXDA:
Tried it on a Huaweii Y6 II phone (MT6735) without success

shell@HWLYO-L6735:/data/local/tmp $ ./mtk-su -v
param1: 0x1000, param2: 0x8040
Building symbol table
Error in find_kallsyms_addresses()
Unable to get kernel symbol table
starting /system/bin/sh
[Fire HD 8 and HD 10 General] bigrammy:
Hi, It failed ("init 1" I think it said ) on the Sony XA1 (mt6757) Stock ROM Android 8.0 kernel v4.x.x

I have not had chance to test it on any others due that they all need reverting back to stock roms firsts before testing.

I will inform you if it works on any of my sony's.

What Android version are these Amazon devices running BTW?

The Dirtycow exploit works on sony's up to Android 6.0 but for devices that shipped with 7.0 + we have not been unable to get a "ta" backup prior to unlocking the bootloader.
[Fire HD 8 and HD 10 General] :
I had a couple questions I was hoping someone could answer for me. Is this using the dirty cow exploit? I want to say no because I think I read it's a kernel patch, but just making sure. I have a MT6739 Soc and I was wondering what I would need to look for in the Kernel to know if this method would be adaptable for my device. Thanks for your work regardless if it works for me. Nice to see people thinking outside the box and making it happen.
[Fire HD 8 and HD 10 General] DB126:
- no

- not available for MT6739 yet
[Fire HD 8 and HD 10 General] sga999:
The OP says this about dm-verity: WARNING FOR FIRE HD 8 2018 AND OTHER FIRE OS 6 DEVICES. I have a Fire HD 10 2017.

Secondly, I can issue the mount command over and over, when not in the sh file, and it works fine. And even when it was in the sh file, I tried many times, and it just showed that it was an invalid command format. It was only after maybe a 10th try that something happened to my system to cause the bootloop.
[Fire HD 8 and HD 10 General] BlueFlame4:
It's not guaranteed that dm-verity is exclusively for these devices (for example my low budget 50$ china tablet uses it as well and it's pretty common nowadays). That's why I am asking. Also the symptoms seem to match.

On Topic:

Just tested this on Fire Stick 2nd gen (MT8127D) and it tells me this:

Failed critical init step 1

So doesn't seem to work there ;)

Cheers,

Jan
[Fire HD 8 and HD 10 General] :
once rooted, it's fairly easy to either patch out dm-verity yourself from the fstab or run a dm-verity disabler zip from recovery
[Fire HD 8 and HD 10 General] diplomatic:
Fire OS 5 is based on Android 5. It doesn't have dm-verity. Fire OS 6 does. There is no ambiguity about it.

Oh yeah? I could have sworn I put it on the confirmed list...

*Only if the bootloader is unlocked or not too restrictive.
[Fire HD 8 and HD 10 General] BlueFlame4:
My bad, sorry.

TBH I am surprised as well. Just double checked again even with aarch64 and arm binary:

shell@tank:/data/local/tmp $ ./mtk-su -v
Failed critical init step 1
1|shell@tank:/data/local/tmp $ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
shell@tank:/data/local/tmp $ ^D
➜ arm adb push mtk-su /data/local/tmp
➜ arm cd arm6
➜ arm cd ../arm64
➜ arm64 adb push mtk-su /data/local/tmp
[100%] /data/local/tmp/mtk-su
➜ arm64 adb shell
shell@tank:/ $ cd /data/local/tmp
shell@tank:/data/local/tmp $ ./mtk-su -v
/system/bin/sh: ./mtk-su: not executable: 64-bit ELF file

Yes, I used v5 of your binary.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=3784300]BlueFlame4[/MENTION], I was just being sarcastic, man. This method doesn't support any 32-bit platforms. There was no mention of any mt8127 devices being compatible. And also this:
[Fire HD 8 and HD 10 General] ksdsksd:
I've tried with multiple versions, both manually, and using your script... Thank you for your work. However, I encounter the same problem, it will install and run the daemon upon reboot but, when I try to run 'su' the terminal just hangs. If the daemon isn't running, the 'su' just drops me back to the unprivliged prompt. Any suggestions?

Fire HD8 2017 5.3.6.4
[Fire HD 8 and HD 10 General] sga999:
[MENTION=8132642]diplomatic[/MENTION], thanks for your confirmation that my bootloop was unrelated to dm-verity. I have done dozens of successful mount system read/write commands after the exploit with no problem, so dm-verity being the cause didn't make sense. The cause of the bootloop was that I was trying both offline cow root and this mtk root (just for fun!) at various times. I mixed up some of the file copies. (By the way, the bootloop occurred when I rebooted after trying different formats of the mount command. But the invalid mount commands had nothing to do with the bootloop). This bootloop happened to me a second time yesterday. But this time, instead of going through adb sideload and a long re-setup, I fixed the batch file on the laptop. While in bootloop, I was able to run the corrected batch file, and all was well!

Now..for the issue where the mount command in the .sh file was invalid. I had modified (with an old editor) the .sh file that was provided by [MENTION=8978978]Rortiz2[/MENTION], and when I did that, cr/lf characters were placed at the end of each line. If I change the mount line to have only cr, not lf, the command is now valid. That explains why using the .sh file failed while just entering the mount command by hand worked. The lines with daemonsu and exit also required omitting cr. Strangely enough, other lines in the .sh file (cp, chmod, etc.) had cr/lf, but they execute successfully. I'm not familiar enough with linux to know why various commands work with cr/lf and others require only cr. I'm sure I've read somewhere that certain types of files need to be edited with notepad++. My mistake. But just out of curiosity, does anyone know why some commands in a script allow cr/lf and some not?

[MENTION=8132642]diplomatic[/MENTION], thanks for your great work. [MENTION=8978978]Rortiz2[/MENTION], thanks for the automated root ideas
[Fire HD 8 and HD 10 General] Rortiz2:
Set supersu acces to grant (promt is not working)

---------- Post added at 08:28 PM ---------- Previous post was at 08:26 PM ----------

Can you share the modded root_fire.sh please?

Thanks.
[Fire HD 8 and HD 10 General] ksdsksd:
Thank you!!!!!!
[Fire HD 8 and HD 10 General] ksdsksd:
Your V2.1, I had no problem with the bash script on the fire. Just had to do the batch file manually, as I only run linux.
[Fire HD 8 and HD 10 General] sga999:
I am modifying files to suit my own needs. For instance, I have ADB in the windows path, so I don't have to have a separate folder. And since I only have a Fire HD 10, I have modified the bat file to only support that device. So I don't think it will be useful to you or others.

About the root-fire.sh file, yours already had only the LF, not the CR. I caused the problem by using a different editor that put CR/LF, so the commands I mentioned before did not execute properly. So again, I don't think you need my changes. But I really appreciate your files which have greatly helped me do my own thing.
[Fire HD 8 and HD 10 General] ksdsksd:
Rortiz2

I converted your .bat to a .sh for linux users.

#!/bin/sh

adb kill-server
clear
echo Thanks to diplomatic!
echo "This script will root your device. Please, select your device:"
echo
echo " *************************************"
echo " * 1. Fire HD8 2016 and 2017 *"
echo " * 2. Fire HD8 2018(Only shell root) *"
echo " * 3. Fire HD10 2017 *"
echo " * 4. BQ M8 *"
echo " * 5. Other MT8163 based devices *"
echo " *************************************"
echo
echo "What is your device?:"

pause(){
echo 'Press [Enter] to continue'
read _
}

RunRooting(){
clear
echo [*] Installing SuperSU.apk...
adb uninstall eu.chainfire.supersu
adb install apps/SuperSU.apk

echo [*] Pushing files and removing old files...
adb shell rm data/local/tmp/mtk-su
adb shell rm data/local/tmp/root_fire.sh
adb push arm64/su arm64/supolicy arm64/libsupol.so /data/local/tmp
adb push devices/$1/mtk-su /data/local/tmp/
adb push root_fire.sh /data/local/tmp

echo [*] Setting permissions...
adb shell chmod 0755 data/local/tmp/mtk-su
adb shell chmod 777 data/local/tmp/root_fire.sh

echo [*]Executing exploit...
echo "wait until it finishes... When the exploit finishes, DON'T CLOSE THIS WINDOW"
echo "and type: sh data/local/tmp/root_fire.sh"
adb shell ./data/local/tmp/mtk-su
pause

echo "ROOTED!"
adb reboot
}

read uni

if [ $uni -eq 1 ]
then
RunRooting hd8
fi

if [ $uni -eq 2 ]
then
adb shell rm data/local/tmp/mtk-su
adb push devices/$1/mtk-su /data/local/tmp/
adb shell chmod 0755 data/local/tmp/mtk-su
adb shell ./data/local/tmp/mtk-su

pause

fi

if [ $uni -eq 3 ]
then
RunRooting hd10
fi

if [ $uni -eq 4 ]
then
RunRooting m8
fi

if [ $uni -eq 5 ]
then
RunRooting mt8163-based
fi
[Fire HD 8 and HD 10 General] tek3195:
Working on HD8 2017 KFDOWI

Worked like a charm. getenforce shows Enforcing but had no issues installing SuperSu. I have proper root access, add it to the working list in OP if you will. Thanks a million man, this is a good thing.
[Fire HD 8 and HD 10 General] diplomatic:
Release 6 posted

I just posted a new version that supports even more devices. If you have a device with Linux 4.4.x and you were previously getting "Unable to get kernel symbol table", this one's for you. And of course, let me know if anything's broken for previously confirmed devices.
[Fire HD 8 and HD 10 General] ersen.o:
just to confirm, can i update my fire hd 10 to latest firmware and then do all this?
[Fire HD 8 and HD 10 General] :
Does anyone know if this works on MT6753 Soc? Thanks
[Fire HD 8 and HD 10 General] lifegap:
Thanks a lot. I get SuperSu

Thanks a lot. I get SuperSu now on my Fire HD 8 (2016) , follows your details instructions and cmd lines. However,after restart, the Root Checker app show my Fire HD 8 is not rooted even SuperSu app work well. Is my Fire HD 8 rooted permanently?
[Fire HD 8 and HD 10 General] dutchthomas:
I think root checker failed for me too, but root worked fine elsewhere so I didn't bother checking again. I can check my tablet tomorrow. Make sure you set SuperSu to grant by default too

But yes, if you let SuperSu update the binary, it should be a permanent root.
[Fire HD 8 and HD 10 General] lifegap:
I allow SuperSu to update the binary by Normal (not TWRP), then the Fire restarted. I though it is permanent rooted, but all apps need root like Greenify or Kernel Adiutor cannot find rooted. I repeat the procedures to ./mtk-su -v and get a log here. Everything seem fine but not rooted. Please advice. Thanks

PS. My HD 8 2016 is on the latest Fire OS 5.3.6.4. The mtk-su is the arm64 as instructed for all other models except HD8 2018. Rootchecker: Su found, has Su info but No access to Root access.

C:\>cd adb

C:\adb>adb push mtk-su /data/local/tmp/

591 KB/s (26232 bytes in 0.043s)

C:\adb>adb shell

shell@giza:/ $ cd /data/local/tmp

cd /data/local/tmp

shell@giza:/data/local/tmp $ chmod 755 mtk-su

chmod 755 mtk-su

shell@giza:/data/local/tmp $ ./mtk-su -v

./mtk-su -v

param1: 0x3000, param2: 0x10000

Building symbol table

kallsyms_addresses pa 0x40afc100

kallsyms_num_syms 67998, addr_count 67998

kallsyms_names pa 0x40b80f00, size 817197

kallsyms_markers pa 0x40c48800

kallsyms_token_table pa 0x40c49100

kallsyms_token_index pa 0x40c49500

Patching credentials

init_task va: 0xffffffc000f0aa20

Possible list_head tasks at offset 0x338

0xffffffc0030c8338 0xffffffc02e6ad3b8 0x000000000000008c

comm offset 0x5a8 comm: swapper/0

Found own task_struct at node 0

real_cred: 0xffffffc00d2db600, cred: 0xffffffc00d2db600

Parsing sel_read_enforce

Found adrp instr at offset 4

ADRP x0, 0xffffffc001062000

Found ldr instr at offset 28

LDR [x0,4092]

selinux_enforce VA is 0xffffffc001062ffc

Setting selinux_enforce

Switched selinux to permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@giza:/data/local/tmp #
[Fire HD 8 and HD 10 General] lifegap:
Finally Rooted. It's weird, all apps need root permissions do not pop up to ask for it. Bu t after changing the SuperSu (Free) setting in Access from Prompt to Grant, so the root checker show Rooted !. It's great for my Fire HD 8
[Fire HD 8 and HD 10 General] ersen.o:
can someone please help me, everything is going as it should on my FIRE HD 10 on 5.3.6.4 but its on confimation, its not rooted?? please help

heres what i did

C:\Windows\System32>cd c:/adb

c:\adb>adb push c:/adb/arm64/mtk-su /data/local/tmp/

c:/adb/arm64/mtk-su: 1 file pushed. 4.5 MB/s (26232 bytes in 0.006s)

c:\adb>adb shell

shell@suez:/ $ cd /data/local/tmp

shell@suez:/data/local/tmp $ chmod 755 mtk-su

shell@suez:/data/local/tmp $ ./mtk-su -v

param1: 0x3000, param2: 0x10000

Building symbol table

kallsyms_addresses pa 0x40aa4600

kallsyms_num_syms 66781, addr_count 66781

kallsyms_names pa 0x40b26e00, size 832778

kallsyms_markers pa 0x40bf2400

kallsyms_token_table pa 0x40bf2d00

kallsyms_token_index pa 0x40bf3100

Patching credentials

init_task va: 0xffffffc000e3a960

Possible list_head tasks at offset 0x368

0xffffffc020120368 0xffffffc03451d3e8 0x000000000000008c

comm offset 0x5d8 comm: swapper/0

Found own task_struct at node 0

real_cred: 0xffffffc03446f900, cred: 0xffffffc03446f900

Parsing sel_read_enforce

Found adrp instr at offset 4

ADRP x0, 0xffffffc000f46000

Found ldr instr at offset 28

LDR [x0,2116]

selinux_enforce VA is 0xffffffc000f46844

Setting selinux_enforce

Selinux is already permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@suez:/data/local/tmp # exit

shell@suez:/data/local/tmp $ exit

c:\adb>adb shell su

/system/bin/sh: su: not found
[Fire HD 8 and HD 10 General] dutchthomas:
There's an outstanding issue that causes the SuperSu popup to not work, so setting the default is the workaround

Mtk-su gives you a one-time root shell. You have to use the shell to root the tablet permanently. You can use the directions in post 10, or find the automated script by [MENTION=8978978]Rortiz2[/MENTION]
[Fire HD 8 and HD 10 General] caldersm44:
bibikalka <<------ GENIUS...!! Thanks so much......was able to disable the firelauncher with your Super Clean Easy method...!! No more flicker...!!
[Fire HD 8 and HD 10 General] ersen.o:
cant find his post, its buggin me too
[Fire HD 8 and HD 10 General] diplomatic:
Yes, it's actually been reported to work on one such device. Only one way to find out if it will work with your phone....
[Fire HD 8 and HD 10 General] NFSP G35:
It's earlier in this thread:
[Fire HD 8 and HD 10 General] ersen.o:
thx man, any idea if you want it back how to bring it back?
[Fire HD 8 and HD 10 General] NFSP G35:
You mean getting the fire launcher back?

Not really sure since it's such a bad launcher I never really considered it LOL.

I guess you would have to pm enable it, then launch it and enable as the default launcher.
[Fire HD 8 and HD 10 General] ersen.o:
yea haha, cuz i noticed when i tried to update nova, i had to uninstall it first, so would that not cause an issue?
[Fire HD 8 and HD 10 General] NFSP G35:
You won't have to uninstall Nova. I didn't
[Fire HD 8 and HD 10 General] :
Alright, tried this on an Alcatel 5085N running Android 6.0 and it's an MT6753 device. My buddy in Brazil didn't have PC access, so he tried to do this from terminal. He made it to:

read failed: Bad address

Error in find_kallsyms_addresses()

Unable to get kernel symbol table

New UID/GID 2000/2000

Any idea what that means and is it fixable to get root do you think?
[Fire HD 8 and HD 10 General] jonathanmoneill:
I'm having the same issue, getting the temp root seems fine and I can run ls no problem but I'm repeatedly getting permission denied when I try the mount command. Any help would be hugely appreciated :)

EDIT: Seem to have gotten past this, literally took approximately 20 tries but worked as expected. Now struggling to install SuperSu though :(

FINAL EDIT: I got there in the end through the tried and tested method of just repeatedly bashing at it til it worked :P Many thanks to all who contributed to this, it's awesome :D
[Fire HD 8 and HD 10 General] diplomatic:
Yeah, I think it's fixable. But that error could mean a lot of things. I have a hunch about what's going on. What kernel version is that phone running? And is it 64-bit?

EDIT: OK, I think I found the problem. Stay tuned for a test version.
[Fire HD 8 and HD 10 General] :
That's awesome, I'm ready to test when you are, lol. Yes it is a 64bit device and the kernel version is 3.18.19. Android 6.0
[Fire HD 8 and HD 10 General] :
Apologies, apparently im dyslexic, lol. The chipset is a MT6735, not sure if that changes anything or not

I'm a bit confused at this point. The internet says it's an MT6753

https://www.phonemore.com/alcatel-a5-max-led-5085n/specs/3697

The unpacked boot.img and recovery.img both show MT6735 though
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION], it's mt6753. The internal name is mt6735 because those chips are all the same platform. Doesn't really matter, tho. Anyway, here's a test version for your friend to try.

Also, can someone test this on any HD 8 tablet? There was a conflict that needed to be resolved between the HD 8 and some mt67xx SW variations like in this example. The changes could have affected HD 8 operation.
[Fire HD 8 and HD 10 General] :
Thank you so much, really appreciated. I'm away from the house for a bit so when I talk to my buddy tomorrow I'll let you know asap how it goes
[Fire HD 8 and HD 10 General] NFSP G35:
Is it a valid test on an HD8 that's already rooted? Just to check if I get a temp root shell?
[Fire HD 8 and HD 10 General] :
well he ran the test file this morning, appears to be a different error? Here is the output of it

shell@ELSA6:/data/local/tmp $ ./mtk-su -s -v -c id

param1: 0x1000, param2: 0x8040

read failed: Bad address

Error in find_kallsyms_addresses()

Unable to get kernel symbol table
[Fire HD 8 and HD 10 General] diplomatic:
Yeah, absolutely. Your root manager has nothing to do with getting root privileges with mtk-su.

EDIT: Actually, never mind. I already noticed a problem so I removed it. I will have another one later on.

Hmm, it's still the same error. Can he try the mtk-su_r4.zip file from the OP? If that doesn't work, then I'm not even in the ballpark about this issue. It would have to be investigated.
[Fire HD 8 and HD 10 General] NFSP G35:
Ok cool. I thought so, just making sure.

I have a couple of 2017 HD8s that I can test on whenever you get the latest version ready.
[Fire HD 8 and HD 10 General] :
Yes, I'll grab the v4 and pass it along. Thanks much
[Fire HD 8 and HD 10 General] Perdio:
Fire HD 8 7th gen (2017) succesfully rooted, thanks D