yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] k4y0z:
Flashing TWRP isn't enough.

LK-payload needs to be written to boot0 at offset 0x200000.

Additionally you need to have the correct version of LK installed.

If you have an older version it could just be overwritten.

If your installed LK is newer, you will have to zero out RPMB.
[Fire HD 8 and HD 10 General] Rortiz2:
LOL

Very nice!

Awesome work [MENTION=8132642]diplomatic[/MENTION]

If you had discovered it before, I would not have asked you to compile TWRP for the BQ M8 and I would not have bothered you. By the way I I prefer to have TWRP. (thanks!)

I have reinstalled stock in my BQ M8 and the script has worked! If you want you can add it to the list of devices...

On Fire 7 7th Gen it not worked.. But we have TWRP.

EDIT: I have tried again and now I get this error

130|shell@Aquaris_M8:/data/local/tmp $ ./mtk-su -v
Building symbol table
kallsyms_addresses_pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names_pa 0x40aa3400
Size of kallsyms_names 602609 bytes
kallsyms_markers_pa 0x40b36600
kallsyms_token_table_pa 0x40b36c00
warning: token_count 1
kallsyms_token_index_pa 0x40b36d00
Patching credentials
__ksymtab_init_task not found
New UID/GID: 2000/2000
Setting selinux permissive
find_selinux_enforce_var() returned -1
starting /system/bin/sh
[Fire HD 8 and HD 10 General] bibikalka:
Yep! Cannot just flash TWRP on HD8 2018 - need to also unlock bootloader, otherwise TWRP won't boot. Which is not a problem, and in theory can be done all via dd - except for the amonet address issue (2Mb), see more below.

OK - once boot0 is zeroed out, how does one get into BootRom after that? One basically turns off the tablet, and then plugs it into Linux with amonet listening? Which tablet models were tested so far with this BootRom activation method?

For the boot0 size, see these outputs from 2 tablets, 'cat /proc/partitions'. In both cases, boot0 is only 1Mb - 1024 blocks below. So it's not possible to dd beyond that 1Mb from within FireOS. If the exploit was placed at ~512 Kb, then it'd be all in range.

Fire HD8 2016:

major minor #blocks name
179 0 15388672 mmcblk0
179 1 3072 mmcblk0p1
179 2 5120 mmcblk0p2
179 3 10240 mmcblk0p3
179 4 10240 mmcblk0p4
179 5 256 mmcblk0p5
179 6 500 mmcblk0p6
179 7 16268 mmcblk0p7
179 8 16384 mmcblk0p8
179 9 6144 mmcblk0p9
179 10 512 mmcblk0p10
179 11 8192 mmcblk0p11
179 12 10240 mmcblk0p12
179 13 1024 mmcblk0p13
179 14 5120 mmcblk0p14
179 15 5120 mmcblk0p15
179 16 40320 mmcblk0p16
179 17 1024 mmcblk0p17
179 18 1024 mmcblk0p18
179 19 1653024 mmcblk0p19
179 20 434176 mmcblk0p20
179 21 512 mmcblk0p21
179 22 16384 mmcblk0p22
179 23 4320 mmcblk0p23
179 24 13138927 mmcblk0p24
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 1024 mmcblk0boot0
179 33 2 mmcblk0boot0p1
179 34 2 mmcblk0boot0p2
179 35 256 mmcblk0boot0p3
179 36 747 mmcblk0boot0p4

Fire HD8 2018:

major minor #blocks name
179 0 15267840 mmcblk0
179 1 3072 mmcblk0p1
179 2 4608 mmcblk0p2
179 3 1024 mmcblk0p3
179 4 1024 mmcblk0p4
179 5 1024 mmcblk0p5
179 6 5120 mmcblk0p6
179 7 5120 mmcblk0p7
179 8 40448 mmcblk0p8
179 9 512 mmcblk0p9
179 10 8192 mmcblk0p10
179 11 16384 mmcblk0p11
179 12 20480 mmcblk0p12
179 13 3177472 mmcblk0p13
179 14 230400 mmcblk0p14
179 15 512000 mmcblk0p15
179 16 11240431 mmcblk0p16
179 96 4096 mmcblk0rpmb
179 64 4096 mmcblk0boot1
179 32 1024 mmcblk0boot0
179 33 2 mmcblk0boot0p1
179 34 2 mmcblk0boot0p2
179 35 256 mmcblk0boot0p3
179 36 747 mmcblk0boot0p4
[Fire HD 8 and HD 10 General] JJ2017:
[MENTION=8132642]diplomatic[/MENTION] - awesome work - just had to give it a go for myself...

Factory reset my HD8 (2017) (root originally via [MENTION=9325417]t0x1cSH[/MENTION] "Fire hd8 2017 root, debrick" post) and followed your post plus the 'speedy SU install' from [MENTION=4584276]dutchthomas[/MENTION] - post 10.

One difficulty: mtk-su seemed to run fine and UID= 0 was shown - but I did have trouble getting the the 'mount -o remount -rw /system' command to work at first - it needed a few attempts.

And then, using the work-through from post 10, I couldn't get full root (i.e. 'su' accepted at command prompt) until I changed permissions on each of the copied SU components (su, daemonsu etc) to those prescribed in [MENTION=9348949]<br />[/MENTION]'s awesome Hardmod post.

Bit strange? I was using Fire OS 5.3.6.0 - I wonder if version makes any difference? Got there eventually tho' :good:
[Fire HD 8 and HD 10 General] Rortiz2:
When you execute that command, simply turn off the tablet and when you connect it to the PC it will detect it in BootROM Mode. Checked in Fire 7 2017.
[Fire HD 8 and HD 10 General] Datastream33:
Wait, will this work for a mt6753 chipset?
[Fire HD 8 and HD 10 General] urbanman2004:
It's alive:

https://xdaforums.com/fire-tv/development/how-to-root-amazon-fire-tv-2-box-t3908387

I can finally go to sleep now
[Fire HD 8 and HD 10 General] edan13:
can I just run the script from post 50 or do i have to follow the steps from OP beforehand?

and will this give me PERM root on my Fire HD8 2017 or just TEMP root?

anyway, thank you everyone involved and sorry for the stupid question --cheers
[Fire HD 8 and HD 10 General] el7145:
My apologies, poor assumption on my part, I assumed he would be on a compatible device :(
[Fire HD 8 and HD 10 General] rigatky:
Just want to say thanks to all the amazing contributors, especially [MENTION=8132642]diplomatic[/MENTION].

I was able to root my Fire HD 8 7th gen with the noob-friendly batch files found on post 50. Never thought this day would come nearly 2 years later! Already got Nova launcher, debloated amazon stuff, and installed Xposed. Time to truly enjoy this tablet.

I can confirm it's perm root. Same model as you. You might get a permissions error but just close and try again until successful.

Thanks for this list. It's worth noting your script didn't have com.amazon.device.software.ota listed. Seems to be a second OTA package. Wouldn't want AMZN ruining our fun now :laugh:

Typing ps in a shell terminal shows many more amazon packages still running. I'm wondering if there's more we can add to the script. Would love to customize the lockscreen but I think that's too advanced based on another tutorial I saw on here.
[Fire HD 8 and HD 10 General] teamfresno:
[MENTION=5440471]urbanman2004[/MENTION] Your instructions for the Fire TV 2 could practically be cut in half. There are a lot of unnecessary steps. Once you get the temp root using [MENTION=8132642]diplomatic[/MENTION] mtk-su file, then all you need to do is run the v7 recovery file once you get the root shell. After that, they could follow your instructions to get the pre rooted image installed. You don't even need to download supersu and push those files over. Once you flash the pre rooted firmware, it installs supersu along with it also.

This is practically what I did.

adb connect 192.168.0.x

adb push path/to/mtk-su /data/local/tmp

adb shell

cd /data/local/tmp

chmod 755 mtk-su

./mtk-su -v

Once you get temp root. Just get into root shell and run

sh /sdcard/firetv2_recovery_v7.zip

Of course, you'd have to change sdcard to whichever storage you used.

Ctrl+C to get out of shell and then...

adb reboot

You should get the recovery menu once it boots up. Then all they'd have to do is flash the pre-rooted 5.2.6.8 firmware.

The other instructions(copying, permissions, etc) you included were used to permanently root the Fire HD 8 7th gen and other devices. For those devices, they needed those files and the certain permissions set manually, so when you open up superuser on your tablet, it'll update the binary files.

And 5.2.6.9 was confirmed to be rootable also by [MENTION=4556232]el7145[/MENTION] using the same method. We just couldn't get the permanent root to stick, so he just flashed the pre-reooted 5.2.6.8.
[Fire HD 8 and HD 10 General] urbanman2004:
You make it sound so easy so how come you couldn't have just put together a guide, disclosing your enormous wealth of knowledge a/b how to help out all those supposedly confused or misinformed newbs on a viable method regarding how to successfully root the AFTV2 after you first discovered it was possible like I did. Oh right, because you didn't... ;)
[Fire HD 8 and HD 10 General] teamfresno:
Your reply sounds more like a smart remark to me more than anything. I've never claimed to or acted like I have a wealth of knowledge. I Just saw your guide and thought I'd let you know that you didn't need most of steps you posted. If anything, you might change it up and make it easier for people. Because that's all I did and it worked for me. We've barely had permanent root for one whole day. We've had temp root for a bit. Me and [MENTION=4556232]el7145[/MENTION] are the only ones during that time frame that had a fire tv 2 to test. We've been trying to figure out how to get permanent root, but unable to until he reached out to [MENTION=3991724]rbox[/MENTION].
[Fire HD 8 and HD 10 General] urbanman2004:
I can't help it if that's how you feel, my response was factual in itself. Regardless of how many steps are included in my guide, if it helps the next man who's been racking his head a/b how to accomplish successful permanent root since instructions in this thread in particular are sparse, and far and few in between then I consider it a win. Focus on the fact that I was the one who first considered it would be a good idea to have all those advisory comments consolidated all into one thread as a user-friendly walkthrough, and at least congratulate or thank me for my efforts before going into your "constructive criticism" mode next time.
[Fire HD 8 and HD 10 General] teamfresno:
First of all, my post wasn't to knock or criticize your guide. From the trial and errors the last few days, I just saw the steps you didn't need, so that's why I mentioned it to you, hoping that input would help you with a few edits to your guide. The goal is to make it easier for everyone right? Secondly, I'm glad you did take the time to put up a guide for people. I'm sure a lot of people will benefit from it. Third, this is getting off topic, so I'll leave it here and just be happy we got root after a few years.
[Fire HD 8 and HD 10 General] urbanman2004:
Alright fair enough, understood. I was able to confirm your condensed method works so I'll be readjusting the instructions accordingly in my guide.
[Fire HD 8 and HD 10 General] tissle:
Would this work with the 2018 Fire HD 8?
[Fire HD 8 and HD 10 General] flaxstar:
I'm trying to use Xposed Installer on a Fire HD 8 2016, but it kept on detecting it as arm instead of arm64 so it will not install the Framework. Does anyone know of a solution for this?
[Fire HD 8 and HD 10 General] coolloser:
Satisfied user here!

I used this method on the 2017 hd 8 and the 2018 hd 8. Hardest part was remembering to switch between the 64 file and non.

I disabled the fire launcher on both and enabled widget support on the 2017. I didn't bother going for permanent root because this is perfect for my occasional needs.

Thanks for your awesome work and saving me from opening them up to do the other method! :laugh:
[Fire HD 8 and HD 10 General] tissle:
[MENTION=2047101]coolloser[/MENTION]

I'm pretty new to all this - can you tell me which method you used to....

1) Root the 2018 Fire HD

2) Disable Amazon Bloatware (including fire launcher)
[Fire HD 8 and HD 10 General] Rortiz2:
No!

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] bibikalka:
Yep! I took out the bulk of packages. But I am sure there is more to take out if one has time to test. OTA should already be disabled via apk renaming, as all guides tell you to do !!! :D

You want this Xposed installer - https://androidfilehost.com/?fid=962187416754464795 . It will find arm64. Then you need to delete "app_process64_xposed" as per instructions : https://xdaforums.com/hd8-hd10/general/xposed-framework-fire-hd-8-6th-t3549043

You can use temporary root here ('mtk-su') to disable packages on HD8 2018 (via "pm disable" commands). That may be enough for you at this point in time. To get permanent root, see this : https://xdaforums.com/hd8-hd10/general/tut-root-hd82018-via-magisk-t3906554
[Fire HD 8 and HD 10 General] urbanman2004:
Alright, so less than 24 hrs after rooting my AFTV2, not taking into account the repercussions for flashing files indiscriminately by way of custom recovery, like a big dummy I attempted to install Magisk 18.1 via TWRP, and was prompted that the installation went successful, but when I rebooted my device it's now stuck on a black screen with a small white Amazon logo where it constantly boot loops.

I've tried 'Alt+i+PrtScrn' on a USB keyboard, I've tried holding down the 'Back button+Right navigation button' on the remote, and in a act of desperation I even tried this workaround provided by [MENTION=3991724]rbox[/MENTION] but it keeps spitting back the error message

ADB doesn't recognize my device. However, when I attempted to connect my device directly to my PC, Windows does emit a chime indicating that it recognizes it, but the AFTV2 subsequently disconnects (after 5 secs) due to the reboot loop taking effect. However when it does disconnect, I notice that the LED indicator light on the box itself turns from illuminating a white light to an orange/amber light instead.

I've been at this for the past 2 hours, and have exhausted most of the options at my disposal. Damn, in retrospect it didn't occur to me that I should've attempted to unlock the bootloader before making such a risky move because at the moment I can't even fastboot the device, and now I regret trying my hand at rooting the thing w/o doing my due diligence. It's not the end of the world though. Although it's my only AFTV2 device, I still have other AFTV sticks (4K & Gen 2), and a AFTV3 to keep me busy I guess. I'll go ahead put this device away in the meantime until I can find someone who's familiar with these nuisances that has experience wiggling out sticky situations such as mine.

So if anybody knows a thing or 2 a/b these kind of side effects, please advise me with any helpful information as to what I can do to fix my issue, and lead me in the right direction. Lesson learned, thanks in advance.
[Fire HD 8 and HD 10 General] :
I am going to attempt this on a MT6739 Device for the heck of it. I'll post the results.
[Fire HD 8 and HD 10 General] krsmit0:
Can you plug it into a computer and as it's trying to boot, keep trying to run "adb reboot recovery" over and over. This might get you into recovery to restore.
[Fire HD 8 and HD 10 General] :
This is what I got on my MT6739 device. Any idea what it means. Is my device kernel too new?

[*] Pushing files and removing old files...

armv7/su: 1 file pushed. 7.2 MB/s (75356 bytes in 0.010s)

armv7/supolicy: 1 file pushed. 5.1 MB/s (42404 bytes in 0.008s)

armv7/libsupol.so: 1 file pushed. 8.8 MB/s (203236 bytes in 0.022s)

3 files pushed. 6.3 MB/s (320996 bytes in 0.049s)

mtk-su: 1 file pushed. 3.1 MB/s (17696 bytes in 0.005s)

[*] Setting permissions...

[*]Executing exploit...

wait until it finishes... When the exploit finishes, DON'T CLOSE THIS WINDOW

AND FOLOW THE INSTRUCTIONS2.txt

Failed critical init step 1

Press any key to continue . . .
[Fire HD 8 and HD 10 General] urbanman2004:
Ok, I'll try that and see if I can get that to work. Won't be at this very second since I'm currently occupied at the moment.

---EDIT---

No dice. I get the following error message

error: device '(null)' not found
[Fire HD 8 and HD 10 General] diplomatic:
Because it might have been best to keep a low profile for now. If it was just about the tablets, this method might not be a huge deal. The dirtycow vuln. for the HD 10 still has not been patched yet, for example. But if you're dealing with an easy root method for a Fire TV, that will garner enormous pressure to get fixed. Streaming box vendors have to protect licensed content at all costs. That's different from phones and tablets because media on TV boxes is higher tier (HD+) than mobile devices....

OK, cool... I just have to ask, in step 2, can you actually put a link to this thread, in addition or instead of, the file to download? I know you put one at the top, but I will be updating mtk-su and people should get the latest version (and see where it comes from)...
[Fire HD 8 and HD 10 General] coolloser:
1) I used the method in the op, use the mtk file that's in the arm64 folder. If you use the other one, it'll just say that the file isn't found, no harm in messing that up.

2)Make sure you have another launcher installed first!! In the shell type: pm disable com.amazon.firelauncher

replace com.amazon.firelauncher with the package name of what you want to disable (there's lots of lists on this forum)
[Fire HD 8 and HD 10 General] diplomatic:
Rel. 5 posted

I just uploaded a new version. It should be compatible with a wider range of kernels and have more stability. Let me know if there's anything wrong with it for currently confirmed devices. It's not impossible that some functionality could have become broken in the process...
[Fire HD 8 and HD 10 General] urbanman2004:
There is a link to this thread which has been there from the onset in the beginning paragraph where I gave credit to everyone whose content was involved w/ my guide. As you wish, I will update the link of your mtk-su to this thread instead in my guide.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5440471]urbanman2004[/MENTION]: ok, good. Just another minor point: in step 8, you don't need the -v switch to run the exploit, unless you want to collect debug data. When you type just ./mtk-su, it will only print out "New UID/GID: 0/0".

(And yes, as I said, I did see the link at the beginning :) )
[Fire HD 8 and HD 10 General] diplomatic:
Technically yes, it's because your device is too new. I've looked at the firmware for an mt6739 phone. There's a new software design that prevents the tool from working as is. But it may be possible to get it off the ground with some retooling. I'm not sure yet. Just letting you know it's on my backburner...
[Fire HD 8 and HD 10 General] urbanman2004:
Alright, I made the modification sans "-v" in the guide to reflect that.
[Fire HD 8 and HD 10 General] richardyiu:
just tried on my 2015 Sony TV that uses MediaTek chip and got

Failed critical init step 1 error as well
[Fire HD 8 and HD 10 General] Krog18:
When you connect it to a PC does it still continue to loop or does it just sit at the Amazon screen?

Edit: Nevermind, I just read further above that it still reboots when you connect it to your pc...
[Fire HD 8 and HD 10 General] BlueFlame4:
Confirmed and working on Alldocube iPlay 8 china tablet :D

It's running Android 6.0 and has a MTK8163 btw.

Doesn't really help much because of dm-verity :>

Thanks OP :)
[Fire HD 8 and HD 10 General] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] I get this error when I try to execute the exploit on the BQ M8 after update it to the 2.9.0 version:

mtk-su: 1 file pushed. 0.5 MB/s (26232 bytes in 0.052s)
param1: 0x3000, param2: 0x18040
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36c00
warning: token_count 1
kallsyms_token_index pa 0x40b36d00
Patching credentials
__ksymtab_init_task not found
Parsing copy_process()
init_task not found
New UID/GID: 2000/2000
Parsing sel_read_enforce()
find_selinux_enforce_var() returned -1
starting /system/bin/sh

Kernel: 3.18.22+

When I tried the exploit and it worked it was in version 2.8.0..

Any ideas?

I reexecuted it many times but I always get the same error.
[Fire HD 8 and HD 10 General] digidude512:
Got my Fire HD 8 2017 rooted great with [MENTION=8978978]Rortiz2[/MENTION] script

Thanks [MENTION=4584276]dutchthomas[/MENTION] for that

Anyone figured a way to install TWRP or Unlock the bootloader yet? Loving seeing the work.
[Fire HD 8 and HD 10 General] rigatky:
Hey, I started getting the same thing. Pop up ads with "opt out" at the bottom right. They came randomly, sometimes every 5 minutes and in any app. Using a Fire HD 8 7th gen as well.

How did you install SuperSU? I used the script and .apk from post #50. Curious if anyone else that used same method is experiencing this.

Anyway, I got AFWall+ and noticed the SuperSU app was reaching out multiple times a minute. After blocking its internet access the ads stopped.
[Fire HD 8 and HD 10 General] t3ch42:
Awesome work!

Was excited to find out I could unlock my 2015 fire 7 earlier this week, took it over to find the hd 8 2017 I had could be rooted also!

I went through the temp-root process and manually installed su for a permanent root. I am used to SuperSU, not too many issues over the years, but with recent installs, I have been interested in using the magisk modules for ease and "hidability" of root.

Is it possible to change the SuperSU out with magisk without bricking the tablet?

Also, unlocked BL and twrp would be great. Any requirements that we might be able to fulfill?
[Fire HD 8 and HD 10 General] diplomatic:
Cool, glad to hear that. Are you not able unlock the bootloader on that tablet? If not, it may still be possible to run custom self-signed (yellow state) boot images like it is on the mt8163 Zenpad series. That would allow you to disable dm-verity and install systemless root.

Well, why didn't you say it was on a different fw version? :) When you said it worked before, I just assumed nothing else has changed and it was just a random glitch. Anyway, this is just an alignment calculation bug that would affect something like 1/32 devices. Try this version and post output plz.
[Fire HD 8 and HD 10 General] Rortiz2:
Wow thanks. Sorry for the confusion..

When I saw that you had discovered this exploit I decided to Hard Reset the tablet. Unknowingly, I made Hard Reset to 2.8.0 which was the one I had downloaded on my computer and the exploit worked. Then I realized that the last version was 2.9.0 so I decided to update and then it did not work anymore ..

I'll have Hard Reset again to block the bootloader and remove TWRP because if I run it now (I'm root) it works correctly but since I already have SeLinux Permissive I do not know if it really works:

mtk-su: 1 file pushed. 0.5 MB/s (26232 bytes in 0.047s)
param1: 0x3000, param2: 0x18040
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing copy_process()
Found dmb ish instr at offset 2116
Found adrp instr at offset 2132
ADRP x3, 0xffffffc000cea000
Found add instr at offset 2140
ADD xd, x3, 2576
init_task va: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc01ec83e00 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 1
real_cred: 0xffffffc074b16a80, cred: 0xffffffc074b16a80
New UID/GID: 0/0
Parsing sel_read_enforce()
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA is 0xffffffc000dd913c
Setting selinux_enforce
Selinux is already permissive
starting /system/bin/sh
root@Aquaris_M8:/ #

Then I tell you if it works correctly.
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION], ok nice, looks like it worked! You don't need to do any resetting. If you start with a regular shell (UID 2000), then run the tool and end up with UID 0, that means it did its job. Your root manager has no relevance to this.
[Fire HD 8 and HD 10 General] Rortiz2:
Okay. Anyway it has worked with the bootloader blocked in 2.9.0.

Thank you diplomatic for your work.

BTW: I installed SuperSU and now the tablet stucks at the BQ Logo but i have adb connection. What I can do?

I think it uses dm-verity...
[Fire HD 8 and HD 10 General] diplomatic:
Oh, boy.... if it has dm-verity, as a rule of thumb you can't install any root manager, systemless or system-mode, until you unlock the BL. I think you need to unlock it, then flash your prerooted image.